Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-43680 State: PUBLISHED Published: 2022-10-24T00:00:00.000Z Last Updated: 2025-05-30T19:20:52.533Z Vendors: n/a Products: n/a Problem Types: n/a Description: In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate in out-of-memory situations. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/libexpat/libexpat/pull/650 - https://github.com/libexpat/libexpat/issues/649 - https://github.com/libexpat/libexpat/pull/616 - https://lists.debian.org/debian-lts-announce/2022/10/msg00033.html - https://www.debian.org/security/2022/dsa-5266 - https://s
//lists.debian.org/debian-lts-announce/2022/10/msg00033.html - https://www.debian.org/security/2022/dsa-5266 - https://security.gentoo.org/glsa/202210-38 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BY4OPSIB33ETNUXZY2UPZ4NGQ3OKDY4D/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AJ5VY2VYXE4WTRGQ6LMGLF6FV3SY37YE/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IUJ2BULJTZ2BMSKQHB6US674P55UCWWS/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XG5XOOB7CD55CEE6OJYKSACSIMQ4RWQ6/ - https://list
ct.org/archives/list/package-announce%40lists.fedoraproject.org/message/XG5XOOB7CD55CEE6OJYKSACSIMQ4RWQ6/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DPQVIF6TOJNY2T3ZZETFKR4G34FFREBQ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FFCOMBSOJKLIKCGCJWHLJXO4EVYBG7AR/ - https://security.netapp.com/advisory/ntap-20221118-0007/ - http://www.openwall.com/lists/oss-security/2023/12/28/5 - http://www.openwall.com/lists/oss-security/2024/01/03/5
CVE ID: CVE-2022-43681 State: PUBLISHED Published: 2023-05-03T00:00:00 Last Updated: 2024-08-03T13:40:06.339Z Vendors: n/a Products: n/a Problem Types: n/a Description: An out-of-bounds read exists in the BGP daemon of FRRouting FRR through 8.4. When sending a malformed BGP OPEN message that ends with the option length octet (or the option length word, in case of an extended OPEN message), the FRR code reads of out of the bounds of the packet, throwing a SIGABRT signal and exiting. This results in a bgpd daemon restart, causing a Denial-of-Service condition. Additional Analyst Notes: - CVE Program Container: References: - https://forescout.com - https://www.debian.org/security/2023/dsa-5495
yst Notes: - CVE Program Container: References: - https://forescout.com - https://www.debian.org/security/2023/dsa-5495 - https://lists.debian.org/debian-lts-announce/2023/09/msg00020.html
CVE ID: CVE-2022-43684 State: PUBLISHED Published: 2023-06-13T18:51:39.984Z Last Updated: 2025-02-13T16:33:36.489Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: ServiceNow Products: Now Platform Problem Types: CWE-200 Description: ServiceNow has released patches and an upgrade that address an Access Control List (ACL) bypass issue in ServiceNow Core functionality. Additional Details This issue is present in the following supported ServiceNow releases: * Quebec prior to Patch 10 Hot Fix 8b * Rome prior to Patch 10 Hot Fix 1 * San Diego prior to Patch 7 * Tokyo prior to Tokyo Patch 1; and * Utah prior to Utah General Availability If this ACL bypass issue w
rior to Patch 7 * Tokyo prior to Tokyo Patch 1; and * Utah prior to Utah General Availability If this ACL bypass issue were to be successfully exploited, it potentially could allow an authenticated user to obtain sensitive information from tables missing authorization controls. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1303489 - http://seclists.org/fulldisclosure/2023/Jul/11 - https://news.ycombinator.com/item?id=36638530 - https://x64.sh/posts/ServiceNow-Insecure-access-control-to-admin/ - http://packetstormsecurity.com/files/173354/ServiceNow-Insecure-Access-Control-Full-A
nsecure-access-control-to-admin/ - http://packetstormsecurity.com/files/173354/ServiceNow-Insecure-Access-Control-Full-Admin-Compromise.html
CVE ID: CVE-2022-43685 State: PUBLISHED Published: 2022-11-22T00:00:00.000Z Last Updated: 2025-04-29T04:14:31.585Z Vendors: n/a Products: n/a Problem Types: n/a Description: CKAN through 2.9.6 account takeovers by unauthenticated users when an existing user id is sent via an HTTP POST request. This allows a user to take over an existing account including superuser accounts. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://ckan.org/ - https://ckan.org/blog/get-latest-patch-releases-your-ckan-site-october-2022
CVE ID: CVE-2022-43686 State: PUBLISHED Published: 2022-11-14T00:00:00.000Z Last Updated: 2025-04-30T15:21:24.180Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2, the authTypeConcreteCookieMap table can be filled up causing a denial of service (high load). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/concretecms/concretecms/releases/9.1.3 - https://github.com/concretecms/concretecms/releases/8.5.10 - https://documentation.concretecms.org/developers/introduction/version-history/913-release-notes - https://documentation.concretecms.org/develo
concretecms.org/developers/introduction/version-history/913-release-notes - https://documentation.concretecms.org/developers/introduction/version-history/8510-release-notes - https://www.concretecms.org/about/project-news/security/concrete-cms-security-advisory-2022-10-31
CVE ID: CVE-2022-43687 State: PUBLISHED Published: 2022-11-14T00:00:00.000Z Last Updated: 2025-04-30T15:19:24.451Z Vendors: n/a Products: n/a Problem Types: n/a Description: Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 does not issue a new session ID upon successful OAuth authentication. Remediate by updating to Concrete CMS 9.1.3+ or 8.5.10+. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/concretecms/concretecms/releases/9.1.3 - https://github.com/concretecms/concretecms/releases/8.5.10 - https://documentation.concretecms.org/developers/introduction/version-history/913-release-notes - https://documen
5.10 - https://documentation.concretecms.org/developers/introduction/version-history/913-release-notes - https://documentation.concretecms.org/developers/introduction/version-history/8510-release-notes - https://www.concretecms.org/about/project-news/security/concrete-cms-security-advisory-2022-10-31
CVE ID: CVE-2022-43688 State: PUBLISHED Published: 2022-11-14T00:00:00 Last Updated: 2024-08-03T13:40:06.191Z Vendors: n/a Products: n/a Problem Types: n/a Description: Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to Stored Cross-Site Scripting (XSS) in icons since the Microsoft application tile color is not sanitized. Remediate by updating to Concrete CMS 9.1.3+ or 8.5.10+. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/concretecms/concretecms/releases/9.1.3 - https://github.com/concretecms/concretecms/releases/8.5.10 - https://documentation.concretecms.org/developers/introduction/version-history/913-release-no
ncretecms/releases/8.5.10 - https://documentation.concretecms.org/developers/introduction/version-history/913-release-notes - https://documentation.concretecms.org/developers/introduction/version-history/8510-release-notes - https://www.concretecms.org/about/project-news/security/concrete-cms-security-advisory-2022-10-31
CVE ID: CVE-2022-43689 State: PUBLISHED Published: 2022-11-14T00:00:00.000Z Last Updated: 2025-04-30T15:17:33.059Z Vendors: n/a Products: n/a Problem Types: n/a Description: Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to XXE based DNS requests leading to IP disclosure. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/concretecms/concretecms/releases/9.1.3 - https://github.com/concretecms/concretecms/releases/8.5.10 - https://documentation.concretecms.org/developers/introduction/version-history/913-release-notes - https://documentation.concretecms.org/developers/introduction/version-histor
duction/version-history/913-release-notes - https://documentation.concretecms.org/developers/introduction/version-history/8510-release-notes - https://www.concretecms.org/about/project-news/security/concrete-cms-security-advisory-2022-10-31
CVE ID: CVE-2022-43690 State: PUBLISHED Published: 2022-11-14T00:00:00.000Z Last Updated: 2025-04-30T15:15:17.931Z Vendors: n/a Products: n/a Problem Types: n/a Description: Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 did not use strict comparison for the legacy_salt so that limited authentication bypass could occur if using this functionality. Remediate by updating to Concrete CMS 9.1.3+ or 8.5.10+. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/concretecms/concretecms/releases/9.1.3 - https://github.com/concretecms/concretecms/releases/8.5.10 - https://documentation.concretecms.org/developers/intro
.3 - https://github.com/concretecms/concretecms/releases/8.5.10 - https://documentation.concretecms.org/developers/introduction/version-history/913-release-notes - https://documentation.concretecms.org/developers/introduction/version-history/8510-release-notes - https://www.concretecms.org/about/project-news/security/concrete-cms-security-advisory-2022-10-31
CVE ID: CVE-2022-43691 State: PUBLISHED Published: 2022-11-14T00:00:00.000Z Last Updated: 2025-04-30T15:13:11.486Z Vendors: n/a Products: n/a Problem Types: n/a Description: Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 inadvertently disclose server-side sensitive information (secrets in environment variables and server information) when Debug Mode is left on in production. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/concretecms/concretecms/releases/9.1.3 - https://github.com/concretecms/concretecms/releases/8.5.10 - https://documentation.concretecms.org/developers/introduction/version-history/913-r
etecms/concretecms/releases/8.5.10 - https://documentation.concretecms.org/developers/introduction/version-history/913-release-notes - https://documentation.concretecms.org/developers/introduction/version-history/8510-release-notes - https://www.concretecms.org/about/project-news/security/concrete-cms-security-advisory-2022-10-31
CVE ID: CVE-2022-43692 State: PUBLISHED Published: 2022-11-14T00:00:00.000Z Last Updated: 2025-04-30T15:10:48.418Z Vendors: n/a Products: n/a Problem Types: n/a Description: Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to Reflected XSS - user can cause an administrator to trigger reflected XSS with a url if the targeted administrator is using an old browser that lacks XSS protection. Remediate by updating to Concrete CMS 9.1.3+ or 8.5.10+. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/concretecms/concretecms/releases/9.1.3 - https://github.com/concretecms/concretecms/releases/8.5.10 - h
tps://github.com/concretecms/concretecms/releases/9.1.3 - https://github.com/concretecms/concretecms/releases/8.5.10 - https://documentation.concretecms.org/developers/introduction/version-history/913-release-notes - https://documentation.concretecms.org/developers/introduction/version-history/8510-release-notes - https://www.concretecms.org/about/project-news/security/concrete-cms-security-advisory-2022-10-31
CVE ID: CVE-2022-43693 State: PUBLISHED Published: 2022-11-14T00:00:00.000Z Last Updated: 2025-04-30T15:09:16.135Z Vendors: n/a Products: n/a Problem Types: n/a Description: Concrete CMS is vulnerable to CSRF due to the lack of "State" parameter for external Concrete authentication service for users of Concrete who use the "out of the box" core OAuth. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/concretecms/concretecms/releases/9.1.3 - https://github.com/concretecms/concretecms/releases/8.5.10 - https://documentation.concretecms.org/developers/introduction/version-history/913-release-notes - https://documentation.concretecms.org
tation.concretecms.org/developers/introduction/version-history/913-release-notes - https://documentation.concretecms.org/developers/introduction/version-history/8510-release-notes - https://www.concretecms.org/about/project-news/security/concrete-cms-security-advisory-2022-10-31
CVE ID: CVE-2022-43694 State: PUBLISHED Published: 2022-11-14T00:00:00.000Z Last Updated: 2025-04-30T15:07:29.250Z Vendors: n/a Products: n/a Problem Types: n/a Description: Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to Reflected XSS in the image manipulation library due to un-sanitized output. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/concretecms/concretecms/releases/9.1.3 - https://github.com/concretecms/concretecms/releases/8.5.10 - https://documentation.concretecms.org/developers/introduction/version-history/913-release-notes - https://documentation.concretecms.org/developers/
etecms.org/developers/introduction/version-history/913-release-notes - https://documentation.concretecms.org/developers/introduction/version-history/8510-release-notes - https://www.concretecms.org/about/project-news/security/concrete-cms-security-advisory-2022-10-31
CVE ID: CVE-2022-43695 State: PUBLISHED Published: 2022-11-14T00:00:00.000Z Last Updated: 2025-05-13T19:25:33.426Z Vendors: n/a Products: n/a Problem Types: n/a Description: Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to Stored Cross-Site Scripting (XSS) in dashboard/system/express/entities/associations because Concrete CMS allows association with an entity name that doesn’t exist or, if it does exist, contains XSS since it was not properly sanitized. Remediate by updating to Concrete CMS 9.1.3+ or 8.5.10+. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/concretecms/concretecms/releases/
es: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/concretecms/concretecms/releases/9.1.3 - https://github.com/concretecms/concretecms/releases/8.5.10 - https://documentation.concretecms.org/developers/introduction/version-history/913-release-notes - https://documentation.concretecms.org/developers/introduction/version-history/8510-release-notes - https://www.concretecms.org/about/project-news/security/concrete-cms-security-advisory-2022-10-31
CVE ID: CVE-2022-43696 State: PUBLISHED Published: 2023-04-15T00:00:00.000Z Last Updated: 2025-02-06T16:01:32.585Z Vendors: n/a Products: n/a Problem Types: n/a Description: OX App Suite before 7.10.6-rev20 allows XSS via upsell ads. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://open-xchange.com - https://seclists.org/fulldisclosure/2023/Feb/3
CVE ID: CVE-2022-43697 State: PUBLISHED Published: 2023-04-15T00:00:00.000Z Last Updated: 2025-02-06T20:33:19.978Z Vendors: n/a Products: n/a Problem Types: n/a Description: OX App Suite before 7.10.6-rev30 allows XSS via an activity tracking adapter defined by jslob. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://open-xchange.com - https://seclists.org/fulldisclosure/2023/Feb/3
CVE ID: CVE-2022-43698 State: PUBLISHED Published: 2023-04-15T00:00:00.000Z Last Updated: 2025-02-06T20:31:39.275Z Vendors: n/a Products: n/a Problem Types: n/a Description: OX App Suite before 7.10.6-rev30 allows SSRF because changing a POP3 account disregards the deny-list. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://open-xchange.com - https://seclists.org/fulldisclosure/2023/Feb/3
CVE ID: CVE-2022-43699 State: PUBLISHED Published: 2023-04-15T00:00:00.000Z Last Updated: 2025-02-06T20:00:33.198Z Vendors: n/a Products: n/a Problem Types: n/a Description: OX App Suite before 7.10.6-rev30 allows SSRF because e-mail account discovery disregards the deny-list and thus can be attacked by an adversary who controls the DNS records of an external domain (found in the host part of an e-mail address). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://open-xchange.com - https://seclists.org/fulldisclosure/2023/Feb/3
CVE ID: CVE-2022-43701 State: PUBLISHED Published: 2023-07-27T21:28:08.461Z Last Updated: 2025-02-13T16:33:37.089Z Vendors: Arm Ltd Products: Arm Compiler 5 (AC5), Arm Compiler for Embedded 6 (AC6), Fast Models (FM), Arm Compiler for Embedded FuSA (ACEF), Arm Development Studio (ADS), Arm Forge (AF), Arm Mobile Studio (AMS), DS-5 Development Studio, Fast Models (FM), GNU Toolchain (GT), Keil MDK (KMDK), Mbed Studio (MS) Problem Types: CWE-276 Description: When the installation directory does not have sufficiently restrictive file permissions, an attacker can modify files in the installation directory to cause execution of malicious code. Additional Analyst Notes: - CVE Program Container: - C
the installation directory to cause execution of malicious code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://developer.arm.com/documentation/ka005596/latest - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00930.html
CVE ID: CVE-2022-43702 State: PUBLISHED Published: 2023-07-27T21:47:25.882Z Last Updated: 2025-02-13T16:33:37.678Z Vendors: Arm Ltd Products: Arm Compiler 5 (AC5), Arm Compiler for Embedded 6 (AC6), Fast Models (FM), Arm Compiler for Embedded FuSA (ACEF), Arm Development Studio (ADS), Arm Forge (AF), Arm Mobile Studio (AMS), DS-5 Development Studio, Fast Models (FM), GNU Toolchain (GT), Keil MDK (KMDK), Mbed Studio (MS) Problem Types: CWE-284 Description: When the directory containing the installer does not have sufficiently restrictive file permissions, an attacker can modify (or replace) the installer to execute malicious code. Additional Analyst Notes: - CVE Program Container: - CISA ADP
ify (or replace) the installer to execute malicious code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://developer.arm.com/documentation/ka005596/latest - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00930.html
CVE ID: CVE-2022-43703 State: PUBLISHED Published: 2023-07-27T21:52:29.229Z Last Updated: 2025-02-13T16:33:38.228Z Vendors: Arm Ltd Products: Arm Compiler 5 (AC5), Arm Compiler for Embedded 6 (AC6), Fast Models (FM), Arm Compiler for Embedded FuSA (ACEF), Arm Development Studio (ADS), Arm Forge (AF), Arm Mobile Studio (AMS), DS-5 Development Studio, Fast Models (FM), GNU Toolchain (GT), Keil MDK (KMDK), Mbed Studio (MS) Problem Types: CWE-427 Description: An installer that loads or executes files using an unconstrained search path may be vulnerable to substitute files under control of an attacker being loaded or executed instead of the intended files. Additional Analyst Notes: - CVE Program
control of an attacker being loaded or executed instead of the intended files. Additional Analyst Notes: - CVE Program Container: References: - https://developer.arm.com/documentation/ka005596/latest - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00930.html
CVE ID: CVE-2022-43704 State: PUBLISHED Published: 2023-01-20T00:00:00.000Z Last Updated: 2025-04-02T16:02:55.110Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Sinilink XY-WFT1 WiFi Remote Thermostat, running firmware 1.3.6, allows an attacker to bypass the intended requirement to communicate using MQTT. It is possible to replay Sinilink aka SINILINK521 protocol (udp/1024) commands interfacing directly with the target device. This, in turn, allows for an attack to control the onboard relay without requiring authentication via the mobile application. This might result in an unacceptable temperature within the target device's physical environment. Additional Analyst Notes: -
ight result in an unacceptable temperature within the target device's physical environment. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/cve-2022-43704-capture-replay-vulnerability-in-sinilink-xy-wft1-thermostat/
CVE ID: CVE-2022-43705 State: PUBLISHED Published: 2022-11-27T00:00:00.000Z Last Updated: 2025-04-25T19:21:47.339Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Botan before 2.19.3, it is possible to forge OCSP responses due to a certificate verification error. This issue was introduced in Botan 1.11.34 (November 2016). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/randombit/botan/releases/tag/2.19.3 - https://github.com/randombit/botan/security/advisories/GHSA-4v9w-qvcq-6q7w
CVE ID: CVE-2022-43706 State: PUBLISHED Published: 2022-12-05T00:00:00.000Z Last Updated: 2025-04-24T13:57:41.968Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Web UI of StackStorm versions prior to 3.8.0 allowed logged in users with write access to pack rules to inject arbitrary script or HTML that may be executed in Web UI for other logged in users. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://stackstorm.com/2022/12/v3-8-0-released/
CVE ID: CVE-2022-43707 State: PUBLISHED Published: 2022-11-21T00:00:00.000Z Last Updated: 2025-04-29T14:16:33.815Z Vendors: n/a Products: n/a Problem Types: n/a Description: MyBB 1.8.31 has a Cross-site scripting (XSS) vulnerability in the visual MyCode editor (SCEditor) allows remote attackers to inject HTML via user input or stored data Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://mybb.com - https://github.com/mybb/mybb/security/advisories/GHSA-6vpw-m83q-27px
CVE ID: CVE-2022-43708 State: PUBLISHED Published: 2022-11-21T00:00:00.000Z Last Updated: 2025-04-29T14:15:07.099Z Vendors: n/a Products: n/a Problem Types: n/a Description: MyBB 1.8.31 has a (issue 2 of 2) cross-site scripting (XSS) vulnerabilities in the post Attachments interface allow attackers to inject HTML by persuading the user to upload a file with specially crafted name Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://mybb.com - https://github.com/mybb/mybb/security/advisories/GHSA-p9m7-9qv4-x93w
CVE ID: CVE-2022-43709 State: PUBLISHED Published: 2022-11-21T00:00:00.000Z Last Updated: 2025-04-29T14:12:48.349Z Vendors: n/a Products: n/a Problem Types: n/a Description: MyBB 1.8.31 has a SQL injection vulnerability in the Admin CP's Users module allows remote authenticated users to modify the query string via direct user input or stored search filter settings. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://mybb.com - https://github.com/mybb/mybb/security/advisories/GHSA-ggp5-454p-867v
CVE ID: CVE-2022-43710 State: PUBLISHED Published: 2023-07-26T00:00:00 Last Updated: 2024-10-23T19:19:51.879Z Vendors: n/a Products: n/a Problem Types: n/a Description: Interactive Forms (IAF) in GX Software XperienCentral versions 10.31.0 until 10.33.0 was vulnerable to cross site request forgery (CSRF) because the unique token could be deduced using the names of all input fields. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://service.gxsoftware.com - https://service.gxsoftware.com/hc/nl/articles/12208173122461