Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-29913 State: PUBLISHED Published: 2022-12-22T00:00:00.000Z Last Updated: 2025-04-15T20:00:52.594Z Vendors: Mozilla Products: Thunderbird Problem Types: Speech Synthesis feature not properly disabled Description: The parent process would not properly check whether the Speech Synthesis feature is enabled, when receiving instructions from a child process. This vulnerability affects Thunderbird < 91.9. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2022-18/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1764778
CVE ID: CVE-2022-29914 State: PUBLISHED Published: 2022-12-22T00:00:00.000Z Last Updated: 2025-04-15T19:58:21.812Z Vendors: Mozilla Products: Thunderbird, Firefox ESR, Firefox Problem Types: Fullscreen notification bypass using popups Description: When reusing existing popups Firefox would have allowed them to cover the fullscreen notification UI, which could have enabled browser spoofing attacks. This vulnerability affects Thunderbird < 91.9, Firefox ESR < 91.9, and Firefox < 100. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2022-16/ - https://www.mozilla.org/security/advisories/mfsa2022-18/ - https
ps://www.mozilla.org/security/advisories/mfsa2022-16/ - https://www.mozilla.org/security/advisories/mfsa2022-18/ - https://www.mozilla.org/security/advisories/mfsa2022-17/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1746448
CVE ID: CVE-2022-29915 State: PUBLISHED Published: 2022-12-22T00:00:00.000Z Last Updated: 2025-04-15T15:10:56.037Z Vendors: Mozilla Products: Firefox Problem Types: Leaking cross-origin redirect through the Performance API Description: The Performance API did not properly hide the fact whether a request cross-origin resource has observed redirects. This vulnerability affects Firefox < 100. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2022-16/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1751678
CVE ID: CVE-2022-29916 State: PUBLISHED Published: 2022-12-22T00:00:00.000Z Last Updated: 2025-04-15T15:08:08.311Z Vendors: Mozilla Products: Thunderbird, Firefox ESR, Firefox Problem Types: Leaking browser history with CSS variables Description: Firefox behaved slightly differently for already known resources when loading CSS resources involving CSS variables. This could have been used to probe the browser history. This vulnerability affects Thunderbird < 91.9, Firefox ESR < 91.9, and Firefox < 100. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2022-16/ - https://www.mozilla.org/security/advisories/m
: References: - https://www.mozilla.org/security/advisories/mfsa2022-16/ - https://www.mozilla.org/security/advisories/mfsa2022-18/ - https://www.mozilla.org/security/advisories/mfsa2022-17/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1760674
CVE ID: CVE-2022-29917 State: PUBLISHED Published: 2022-12-22T00:00:00.000Z Last Updated: 2025-04-15T15:06:32.473Z Vendors: Mozilla Products: Thunderbird, Firefox ESR, Firefox Problem Types: Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9 Description: Mozilla developers Andrew McCreight, Gabriele Svelto, Tom Ritter and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 99 and Firefox ESR 91.8. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 91.9, Firefox ESR < 91.9, and Firefox < 100. Additional Analyst Notes:
ry code. This vulnerability affects Thunderbird < 91.9, Firefox ESR < 91.9, and Firefox < 100. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2022-16/ - https://www.mozilla.org/security/advisories/mfsa2022-18/ - https://www.mozilla.org/security/advisories/mfsa2022-17/ - https://bugzilla.mozilla.org/buglist.cgi?bug_id=1684739%2C1706441%2C1753298%2C1762614%2C1762620%2C1764778
CVE ID: CVE-2022-29918 State: PUBLISHED Published: 2022-12-22T00:00:00.000Z Last Updated: 2025-04-15T15:05:14.221Z Vendors: Mozilla Products: Firefox Problem Types: Memory safety bugs fixed in Firefox 100 Description: Mozilla developers Gabriele Svelto, Randell Jesup and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 99. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 100. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2022-16/ - htt
Program Container: - CISA ADP Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2022-16/ - https://bugzilla.mozilla.org/buglist.cgi?bug_id=1744043%2C1747178%2C1753535%2C1754017%2C1755847%2C1756172%2C1757477%2C1758223%2C1760160%2C1761481%2C1761771
CVE ID: CVE-2022-29919 State: PUBLISHED Published: 2023-05-10T13:16:50.541Z Last Updated: 2025-01-27T18:07:58.232Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) VROC software Problem Types: escalation of privilege, CWE-416 Description: Use after free in the Intel(R) VROC software before version 7.7.6.1003 may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00692.html
CVE ID: CVE-2022-29920 State: REJECTED Published: N/A Last Updated: 2025-05-28T18:19:27.463Z Description: No description available.
CVE ID: CVE-2022-29921 State: REJECTED Published: N/A Last Updated: 2025-05-28T18:19:28.646Z Description: No description available.
CVE ID: CVE-2022-29922 State: PUBLISHED Published: 2022-09-14T17:03:34.160Z Last Updated: 2025-06-04T15:06:31.593Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Hitachi Energy Products: MicroSCADA X SYS600, MicroSCADA Pro SYS600 Problem Types: CWE-20 Description: Improper Input Validation vulnerability in the handling of a specially crafted IEC 61850 packet with a valid data item but with incorrect data type in the IEC 61850 OPC Server in the Hitachi Energy MicroSCADA X SYS600, MicroSCADA Pro SYS600. The vulnerability may cause a denial-of-service on the IEC 61850 OPC Server part of the SYS600 product. This issue affects: Hitachi Energy MicroSCADA Pro SYS600
service on the IEC 61850 OPC Server part of the SYS600 product. This issue affects: Hitachi Energy MicroSCADA Pro SYS600 version 9.4 FP2 Hotfix 4 and earlier versions Hitachi Energy MicroSCADA X SYS600 version 10 to version 10.3.1. cpe:2.3:a:hitachienergy:microscada_pro_sys600:9.0:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:microscada_pro_sys600:9.1:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:microscada_pro_sys600:9.2:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:microscada_pro_sys600:9.3:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:microscada_pro_sys600:9.4:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:microscada_x_sys600:10:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:microscada_x_sys600:10.1:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:
oscada_x_sys600:10:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:microscada_x_sys600:10.1:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:microscada_x_sys600:10.1.1:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:microscada_x_sys600:10.2:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:microscada_x_sys600:10.2.1:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:microscada_x_sys600:10.3:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:microscada_x_sys600:10.3.1:*:*:*:*:*:*:* Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://search.abb.com/library/Download.aspx?DocumentID=8DBD000106&LanguageCode=en&DocumentPartId=&Action=Launch
CVE ID: CVE-2022-29923 State: PUBLISHED Published: 2022-07-20T18:39:11.373679Z Last Updated: 2024-09-17T03:44:11.275Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: ThingsForRestaurants Products: Quick Restaurant Reservations (WordPress plugin) Problem Types: CWE-79 Description: Cross-site Scripting (XSS) vulnerability in ThingsForRestaurants Quick Restaurant Reservations (WordPress plugin) allows Reflected XSS.This issue affects Quick Restaurant Reservations (WordPress plugin): from n/a through 1.4.1. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/quick-restaurant-reservations/wordpress-quick-
am Container: References: - https://patchstack.com/database/vulnerability/quick-restaurant-reservations/wordpress-quick-restaurant-reservations-plugin-1-4-1-authenticated-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2022-29924 State: REJECTED Published: N/A Last Updated: 2025-05-28T17:22:09.650Z Description: No description available.
CVE ID: CVE-2022-29925 State: PUBLISHED Published: 2022-06-14T07:05:47 Last Updated: 2024-08-03T06:33:43.328Z Vendors: FUJI ELECTRIC CO., LTD. / Hakko Electronics Co., Ltd. Products: V-SFT Problem Types: Access of Uninitialized Pointer Description: Access of uninitialized pointer vulnerability exists in the simulator module contained in the graphic editor 'V-SFT' versions prior to v6.1.6.0, which may allow an attacker to obtain information and/or execute arbitrary code by having a user to open a specially crafted image file. Additional Analyst Notes: - CVE Program Container: References: - https://monitouch.fujielectric.com/site/download-e/09vsft6_inf/Search.php - https://jvn.jp/en/vu/JVNVU99
: References: - https://monitouch.fujielectric.com/site/download-e/09vsft6_inf/Search.php - https://jvn.jp/en/vu/JVNVU99188133/index.html
CVE ID: CVE-2022-29926 State: REJECTED Published: 2022-07-11T09:30:12 Last Updated: 2022-07-11T09:30:12 Description: No description available.
CVE ID: CVE-2022-29927 State: PUBLISHED Published: 2022-05-12T08:35:12 Last Updated: 2024-08-03T06:33:43.184Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: JetBrains Products: TeamCity Problem Types: CWE-79 Description: In JetBrains TeamCity before 2022.04 reflected XSS on the Build Chain Status page was possible Additional Analyst Notes: - CVE Program Container: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2022-29928 State: PUBLISHED Published: 2022-05-12T08:35:14 Last Updated: 2024-08-03T06:33:43.306Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: JetBrains Products: TeamCity Problem Types: CWE-532 Description: In JetBrains TeamCity before 2022.04 leak of secrets in TeamCity agent logs was possible Additional Analyst Notes: - CVE Program Container: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2022-29929 State: PUBLISHED Published: 2022-05-12T08:35:16 Last Updated: 2024-08-03T06:33:43.165Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: JetBrains Products: TeamCity Problem Types: CWE-79 Description: In JetBrains TeamCity before 2022.04 potential XSS via Referrer header was possible Additional Analyst Notes: - CVE Program Container: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2022-29930 State: PUBLISHED Published: 2022-05-12T08:35:17 Last Updated: 2024-08-03T06:33:43.149Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N) Vendors: JetBrains Products: Ktor Problem Types: CWE-342 Description: SHA1 implementation in JetBrains Ktor Native 2.0.0 was returning the same value. The issue was fixed in Ktor version 2.0.1. Additional Analyst Notes: - CVE Program Container: References: - https://www.jetbrains.com/privacy-security/issues-fixed/ - https://github.com/ktorio/ktor/pull/2966
CVE ID: CVE-2022-29931 State: PUBLISHED Published: 2022-06-25T18:42:02.000Z Last Updated: 2025-05-30T16:02:09.153Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AC:L/AV:N/A:N/C:L/I:L/PR:N/S:C/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: The administration interface of the Raytion Custom Security Manager (Raytion CSM) in Version 7.2.0 allows reflected Cross-site Scripting (XSS). Additional Analyst Notes: - CVE Program Container: References: - https://excellium-services.com/cert-xlm-advisory/CVE-2022-29931 - https://cds.thalesgroup.com/en/tcs-cert/CVE-2022-29931
CVE ID: CVE-2022-29932 State: PUBLISHED Published: 2022-05-11T13:49:53 Last Updated: 2024-08-03T06:33:43.116Z Vendors: n/a Products: n/a Problem Types: n/a Description: The HTTP Server in PRIMEUR SPAZIO 2.5.1.954 (File Transfer) allows an unauthenticated attacker to obtain sensitive data (related to the content of transferred files) via a crafted HTTP request. Additional Analyst Notes: - CVE Program Container: References: - https://www.primeur.com/managed-file-transfer - https://github.com/Off3nS3c/CVE-2022-29932/blob/main/Proof-of-Concept.md
CVE ID: CVE-2022-29933 State: PUBLISHED Published: 2022-05-09T17:48:45 Last Updated: 2024-08-03T06:33:43.179Z Vendors: n/a Products: n/a Problem Types: n/a Description: Craft CMS through 3.7.36 allows a remote unauthenticated attacker, who knows at least one valid username, to reset the account's password and take over the account by providing a crafted HTTP header to the application while using the password reset functionality. Specifically, the attacker must send X-Forwarded-Host to the /index.php?p=admin/actions/users/send-password-reset-email URI. NOTE: the vendor's position is that a customer can already work around this by adjusting the configuration (i.e., by not using the default con
ition is that a customer can already work around this by adjusting the configuration (i.e., by not using the default configuration). Additional Analyst Notes: - CVE Program Container: References: - https://sec-consult.com/vulnerability-lab/ - https://github.com/craftcms/cms/blob/develop/CHANGELOG.md - http://packetstormsecurity.com/files/166989/Craft-CMS-3.7.36-Password-Reset-Poisoning-Attack.html - https://sec-consult.com/vulnerability-lab/advisory/password-reset-poisoning-attack-craft-cms/
CVE ID: CVE-2022-29934 State: PUBLISHED Published: 2022-04-29T16:35:12 Last Updated: 2024-08-03T06:33:43.161Z Vendors: n/a Products: n/a Problem Types: n/a Description: USU Oracle Optimization before 5.17.5 lacks Polkit authentication, which allows smartcollector users to achieve root access via pkexec. NOTE: this is not an Oracle Corporation product. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/orangecertcc/security-research/security/advisories/GHSA-4vr2-wxp6-w29v
CVE ID: CVE-2022-29935 State: PUBLISHED Published: 2022-04-29T16:34:59 Last Updated: 2024-08-03T06:33:43.147Z Vendors: n/a Products: n/a Problem Types: n/a Description: USU Oracle Optimization before 5.17.5 allows attackers to discover the quantum credentials via an agent-installer download. NOTE: this is not an Oracle Corporation product. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/orangecertcc/security-research/security/advisories/GHSA-rcp9-qm7c-5mmx
CVE ID: CVE-2022-29936 State: PUBLISHED Published: 2022-04-29T16:34:47 Last Updated: 2024-08-03T06:33:43.112Z Vendors: n/a Products: n/a Problem Types: n/a Description: USU Oracle Optimization before 5.17 allows authenticated quantum users to achieve remote code execution because of /v2/quantum/save-data-upload-big-file Java deserialization. NOTE: this is not an Oracle Corporation product. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/orangecertcc/security-research/security/advisories/GHSA-rj5c-j274-vw7g
CVE ID: CVE-2022-29937 State: PUBLISHED Published: 2022-04-29T16:34:36 Last Updated: 2024-08-03T06:33:43.072Z Vendors: n/a Products: n/a Problem Types: n/a Description: USU Oracle Optimization before 5.17.5 allows authenticated DataCollection users to achieve agent root access because some common OS commands are blocked but (for example) an OS command for base64 decoding is not blocked. NOTE: this is not an Oracle Corporation product. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/orangecertcc/security-research/security/advisories/GHSA-xw3r-mq8p-fjv5
CVE ID: CVE-2022-29938 State: PUBLISHED Published: 2022-05-05T11:40:35 Last Updated: 2024-08-03T06:33:43.077Z Vendors: n/a Products: n/a Problem Types: n/a Description: In LibreHealth EHR 2.0.0, lack of sanitization of the GET parameter payment_id in interface\billing\new_payment.php via interface\billing\payment_master.inc.php leads to SQL injection. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/LibreHealthIO/lh-ehr/tags - https://gitlab.com/librehealth/ehr/lh-ehr/-/tags - https://nitroteam.kz/index.php?action=researches&slug=librehealth_r
CVE ID: CVE-2022-29939 State: PUBLISHED Published: 2022-05-05T11:40:32 Last Updated: 2024-08-03T06:33:43.192Z Vendors: n/a Products: n/a Problem Types: n/a Description: In LibreHealth EHR 2.0.0, lack of sanitization of the GET parameters debug and InsId in interface\billing\sl_eob_process.php leads to multiple cross-site scripting (XSS) vulnerabilities. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/LibreHealthIO/lh-ehr/tags - https://gitlab.com/librehealth/ehr/lh-ehr/-/tags - https://nitroteam.kz/index.php?action=researches&slug=librehealth_r
CVE ID: CVE-2022-29940 State: PUBLISHED Published: 2022-05-05T11:40:30 Last Updated: 2024-08-03T06:33:43.061Z Vendors: n/a Products: n/a Problem Types: n/a Description: In LibreHealth EHR 2.0.0, lack of sanitization of the GET parameters formseq and formid in interface\orders\find_order_popup.php leads to multiple cross-site scripting (XSS) vulnerabilities. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/LibreHealthIO/lh-ehr/tags - https://gitlab.com/librehealth/ehr/lh-ehr/-/tags - https://nitroteam.kz/index.php?action=researches&slug=librehealth_r
CVE ID: CVE-2022-29942 State: PUBLISHED Published: 2022-05-04T17:26:23 Last Updated: 2024-08-03T06:33:43.180Z Vendors: n/a Products: n/a Problem Types: n/a Description: Talend Administration Center has a vulnerability that allows an authenticated user to use the Service Registry 'Add' functionality to perform SSRF HTTP GET requests on URLs in the internal network. The issue is fixed for versions 8.0.x in TPS-5189, versions 7.3.x in TPS-5175, and versions 7.2.x in TPS-5201. Earlier versions of Talend Administration Center may also be impacted; users are encouraged to update to a supported version. Additional Analyst Notes: - CVE Program Container: References: - https://Talend.com - https://ww
to a supported version. Additional Analyst Notes: - CVE Program Container: References: - https://Talend.com - https://www.talend.com/security/incident-response/#CVE-2022-29942
CVE ID: CVE-2022-29943 State: PUBLISHED Published: 2022-05-04T17:26:26 Last Updated: 2024-08-03T06:33:43.183Z Vendors: n/a Products: n/a Problem Types: n/a Description: Talend Administration Center has a vulnerability that allows an authenticated user to use XML External Entity (XXE) processing to achieve read access as root on the remote filesystem. The issue is fixed for versions 8.0.x in TPS-5189, versions 7.3.x in TPS-5175, and versions 7.2.x in TPS-5201. Earlier versions of Talend Administration Center may also be impacted; users are encouraged to update to a supported version. Additional Analyst Notes: - CVE Program Container: References: - https://Talend.com - https://www.talend.com/s
version. Additional Analyst Notes: - CVE Program Container: References: - https://Talend.com - https://www.talend.com/security/incident-response/#CVE-2022-29942
CVE ID: CVE-2022-29944 State: PUBLISHED Published: 2023-04-20T00:00:00.000Z Last Updated: 2025-02-05T15:28:57.984Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in ONOS 2.5.1. There is an incorrect comparison of paths installed by intents. An existing intents does not redirect to a new path, even if a new intent that shares the path with higher priority is installed. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wiki.onosproject.org/display/ONOS/Intent+Framework - https://www.usenix.org/system/files/sec23fall-prepub-285_kim-jiwon.pdf
CVE ID: CVE-2022-29945 State: PUBLISHED Published: 2022-04-29T19:39:43 Last Updated: 2024-08-03T06:33:43.160Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AC:H/AV:N/A:N/C:L/I:N/PR:N/S:C/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: DJI drone devices sold in 2017 through 2022 broadcast unencrypted information about the drone operator's physical location via the AeroScope protocol. Additional Analyst Notes: - CVE Program Container: References: - https://www.theverge.com/2022/4/28/23046916/dji-aeroscope-signals-not-encrypted-drone-tracking - https://twitter.com/d0tslash/status/1519774807776284672 - https://twitter.com/StarFire2258/status/1519767091829637120
CVE ID: CVE-2022-29946 State: PUBLISHED Published: 2024-07-11T00:00:00 Last Updated: 2024-10-30T14:43:56.230Z Vendors: n/a Products: n/a Problem Types: n/a Description: NATS.io NATS Server before 2.8.2 and Streaming Server before 0.24.6 could allow a remote attacker to bypass security restrictions, caused by the failure to enforce negative user permissions in one scenario. By using a queue subscription on the wildcard, an attacker could exploit this vulnerability to allow denied subjects. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/nats-io/advisories/blob/main/CVE/CVE-2022-29946.txt
CVE ID: CVE-2022-29947 State: PUBLISHED Published: 2022-04-29T20:23:22 Last Updated: 2024-08-03T06:33:43.279Z Vendors: n/a Products: n/a Problem Types: n/a Description: Woodpecker before 0.15.1 allows XSS via build logs because web/src/components/repo/build/BuildLog.vue lacks escaping. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/woodpecker-ci/woodpecker/releases/tag/v0.15.1 - https://github.com/woodpecker-ci/woodpecker/pull/879
CVE ID: CVE-2022-29948 State: PUBLISHED Published: 2022-06-10T16:39:13 Last Updated: 2024-08-03T06:33:43.195Z Vendors: n/a Products: n/a Problem Types: n/a Description: Due to an insecure design, the Lepin EP-KP001 flash drive through KP001_V19 is vulnerable to an authentication bypass attack that enables an attacker to gain access to the stored encrypted data. Normally, the encrypted disk partition with this data is unlocked by entering the correct passcode (6 to 14 digits) via the keypad and pressing the Unlock button. This authentication is performed by an unknown microcontroller. By replacing this microcontroller on a target device with one from an attacker-controlled Lepin EP-KP001 whos
ontroller. By replacing this microcontroller on a target device with one from an attacker-controlled Lepin EP-KP001 whose passcode is known, it is possible to successfully unlock the target device and read the stored data in cleartext. Additional Analyst Notes: - CVE Program Container: References: - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2022-024.txt - http://seclists.org/fulldisclosure/2022/Jun/27 - http://packetstormsecurity.com/files/167550/Lepin-EP-KP001-KP001_V19-Authentication-Bypass.html
CVE ID: CVE-2022-29950 State: PUBLISHED Published: 2022-05-04T14:23:43 Last Updated: 2024-08-03T06:33:43.173Z Vendors: n/a Products: n/a Problem Types: n/a Description: Experian Hunter 1.16 allows remote authenticated users to modify assumed-immutable elements via the (1) rule name parameter to the Rules page or the (2) subrule name or (3) categories name parameter to the Subrules page. NOTE: the vendor disputes this because version 1.16 has never existed Additional Analyst Notes: - CVE Program Container: References: - https://www.experian.in/hunter - https://gist.github.com/Voidager88/73c2d512a72cceb0ef84dbf87a497d10