Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-25345 State: PUBLISHED Published: 2022-06-17T20:00:23.118231Z Last Updated: 2024-09-17T00:35:39.258Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P) Vendors: n/a Products: @discordjs/opus Problem Types: Denial of Service (DoS) Description: All versions of package @discordjs/opus are vulnerable to Denial of Service (DoS) when trying to encode using an encoder with zero channels, or a non-initialized buffer. This leads to a hard crash. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-DISCORDJSOPUS-2403100 - https://github.com/discordjs/opus/blob/3ca4341ffdd81cf83cec57045e59e228e6017590/src/node-opus.cc%23L
ORDJSOPUS-2403100 - https://github.com/discordjs/opus/blob/3ca4341ffdd81cf83cec57045e59e228e6017590/src/node-opus.cc%23L28
CVE ID: CVE-2022-25347 State: PUBLISHED Published: 2022-03-29T16:37:04.204Z Last Updated: 2025-04-16T16:37:18.369Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Delta Electronics Products: DIAEnergie Problem Types: CWE-37 Description: Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) is vulnerable to path traversal attacks, which may allow an attacker to write arbitrary files to locations on the file system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-081-01
CVE ID: CVE-2022-25348 State: PUBLISHED Published: 2022-03-31T07:21:19 Last Updated: 2024-08-03T04:36:06.856Z Vendors: HiBARA Software Products: AttacheCase Problem Types: Untrusted search path vulnerability Description: Untrusted search path vulnerability in AttacheCase ver.4.0.2.7 and earlier allows an attacker to gain privileges and execute arbitrary code via a Trojan horse DLL in an unspecified directory. Additional Analyst Notes: - CVE Program Container: References: - https://hibara.org/software/attachecase/?lang=en - https://jvn.jp/en/jp/JVN10140834/index.html
CVE ID: CVE-2022-25349 State: PUBLISHED Published: 2022-05-01T15:30:22.561132Z Last Updated: 2024-09-17T00:55:44.827Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: n/a Products: materialize-css Problem Types: Cross-site Scripting (XSS) Description: All versions of package materialize-css are vulnerable to Cross-site Scripting (XSS) due to improper escape of user input (such as &lt;not-a-tag /&gt;) that is being parsed as HTML/JavaScript, and inserted into the Document Object Model (DOM). This vulnerability can be exploited when the user-input is provided to the autocomplete component. Additional Analyst Notes: - CVE Program Container: References: - https:/
nput is provided to the autocomplete component. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-MATERIALIZECSS-2324800 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2766498 - https://github.com/Dogfalo/materialize/blob/v1-dev/js/autocomplete.js%23L285%20
CVE ID: CVE-2022-25350 State: PUBLISHED Published: 2023-01-24T05:00:01.270Z Last Updated: 2025-04-01T15:30:49.697Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P) Vendors: n/a Products: puppet-facter Problem Types: CWE-78 Description: All versions of the package puppet-facter are vulnerable to Command Injection via the getFact function due to improper input sanitization. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-JS-PUPPETFACTER-3175616 - https://github.com/olindata/node-puppet-facter/blob/f34bcc754325d71bb3b1b534804e53d6170f15f5/index.js%23L10
CVE ID: CVE-2022-25352 State: PUBLISHED Published: 2022-03-17T11:20:50.476744Z Last Updated: 2024-09-17T02:37:23.733Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P) Vendors: n/a Products: libnested Problem Types: Prototype Pollution Description: The package libnested before 1.5.2 are vulnerable to Prototype Pollution via the set function in index.js. **Note:** This vulnerability derives from an incomplete fix for [CVE-2020-28283](https://security.snyk.io/vuln/SNYK-JS-LIBNESTED-1054930) Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-LIBNESTED-2342117 - https://github.com/dominictarr/libnested/blob/master/index.js%23L22
: - https://snyk.io/vuln/SNYK-JS-LIBNESTED-2342117 - https://github.com/dominictarr/libnested/blob/master/index.js%23L22 - https://github.com/dominictarr/libnested/commit/c1129865d75fbe52b5a4f755ad3110ca5420f2e1
CVE ID: CVE-2022-25354 State: PUBLISHED Published: 2022-03-17T11:20:56.621019Z Last Updated: 2024-09-16T17:14:02.822Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L/E:P) Vendors: n/a Products: set-in Problem Types: Prototype Pollution Description: The package set-in before 2.0.3 are vulnerable to Prototype Pollution via the setIn method, as it allows an attacker to merge object prototypes into it. **Note:** This vulnerability derives from an incomplete fix of [CVE-2020-28273](https://security.snyk.io/vuln/SNYK-JS-SETIN-1048049) Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-SETIN-2388571 - https://github.com/ahdinosaur/set
s: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-SETIN-2388571 - https://github.com/ahdinosaur/set-in/blob/dfc226d95cce8129de6708661e06e0c2c06f3490/index.js%23L5 - https://github.com/ahdinosaur/set-in/commit/6bad255961d379e4b1f5fbc52ef9dc8420816f24
CVE ID: CVE-2022-25355 State: PUBLISHED Published: 2022-02-24T09:50:35 Last Updated: 2024-08-03T04:36:07.005Z Vendors: EC-CUBE CO.,LTD. Products: EC-CUBE 3 series and EC-CUBE 4 series Problem Types: Improper Control of Dynamically-Managed Code Resources Description: EC-CUBE 3.0.0 to 3.0.18-p3 and EC-CUBE 4.0.0 to 4.1.1 improperly handle HTTP Host header values, which may lead a remote unauthenticated attacker to direct the vulnerable version of EC-CUBE to send an Email with some forged reissue-password URL to EC-CUBE users. Additional Analyst Notes: - CVE Program Container: References: - https://www.ec-cube.net/info/weakness/20220221/ - https://jvn.jp/en/jp/JVN53871926/index.html
CVE ID: CVE-2022-25356 State: PUBLISHED Published: 2022-04-05T01:58:35.000Z Last Updated: 2025-09-05T17:07:36.837Z Vendors: n/a Products: n/a Problem Types: n/a Description: Alt-N MDaemon Security Gateway through 8.5.0 allows SecurityGateway.dll?view=login XML Injection. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.swascan.com/security-blog/ - https://www.altn.com/Products/SecurityGateway-Email-Firewall/ - https://www.swascan.com/security-advisory-alt-n-security-gateway/
CVE ID: CVE-2022-25357 State: PUBLISHED Published: 2022-07-17T20:11:16 Last Updated: 2024-08-03T04:36:06.827Z Vendors: n/a Products: n/a Problem Types: n/a Description: Pexip Infinity 27.x before 27.2 has Improper Access Control. An attacker can sometimes join a conference (call join) if it has a lock but not a PIN. Additional Analyst Notes: - CVE Program Container: References: - https://docs.pexip.com/admin/security_bulletins.htm#CVE-2022-25357
CVE ID: CVE-2022-25358 State: PUBLISHED Published: 2022-02-18T21:59:54 Last Updated: 2024-08-03T04:36:07.003Z Vendors: n/a Products: n/a Problem Types: n/a Description: A ..%2F path traversal vulnerability exists in the path handler of awful-salmonella-tar before 0.0.4. Attackers can only list directories (not read files). This occurs because the safe-path? Scheme predicate is not used for directories. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mario-goulart/awful-salmonella-tar/commit/f705c881769b7610745cd4b4d8ae8b41b3f4f845 - https://wiki.call-cc.org/eggref/5/awful-salmonella-tar
CVE ID: CVE-2022-25359 State: PUBLISHED Published: 2022-02-26T04:19:01 Last Updated: 2024-08-03T04:36:06.970Z Vendors: n/a Products: n/a Problem Types: n/a Description: On ICL ScadaFlex II SCADA Controller SC-1 and SC-2 1.03.07 devices, unauthenticated remote attackers can overwrite, delete, or create files. Additional Analyst Notes: - CVE Program Container: References: - http://files.iclinks.com/datasheets/Scadaflex%20II/Scadaflex%20SC-1%20&%20SC-2_A1_compressed.pdf - https://packetstormsecurity.com/files/166103/ICL-ScadaFlex-II-SCADA-Controllers-SC-1-SC-2-1.03.07-Remote-File-Modification.html
CVE ID: CVE-2022-25360 State: PUBLISHED Published: 2022-02-24T04:53:14 Last Updated: 2024-08-03T04:36:06.959Z Vendors: n/a Products: n/a Problem Types: n/a Description: WatchGuard Firebox and XTM appliances allow an authenticated remote attacker with unprivileged credentials to upload files to arbitrary locations. This vulnerability impacts Fireware OS before 12.7.2_U2, 12.x before 12.1.3_U8, and 12.2.x through 12.5.x before 12.5.9_U2. Additional Analyst Notes: - CVE Program Container: References: - https://www.watchguard.com/support/release-notes/fireware/12/en-US/EN_ReleaseNotes_Fireware_12_7_2/index.html#Fireware/en-US/resolved_issues.html
CVE ID: CVE-2022-25361 State: PUBLISHED Published: 2022-06-07T13:26:39 Last Updated: 2024-08-03T04:36:06.903Z Vendors: n/a Products: n/a Problem Types: n/a Description: WatchGuard Firebox and XTM appliances allow an unauthenticated remote attacker to delete arbitrary files from a limited set of directories on the system. This vulnerability impacts Fireware OS before 12.7.2_U2, 12.x before 12.1.3_U8, and 12.2.x through 12.5.x before 12.5.9_U2. Additional Analyst Notes: - CVE Program Container: References: - https://watchguard.com - https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2022-00004
CVE ID: CVE-2022-25363 State: PUBLISHED Published: 2022-02-24T04:56:20 Last Updated: 2024-08-03T04:36:06.972Z Vendors: n/a Products: n/a Problem Types: n/a Description: WatchGuard Firebox and XTM appliances allow an authenticated remote attacker with unprivileged credentials to modify privileged management user credentials. This vulnerability impacts Fireware OS before 12.7.2_U2, 12.x before 12.1.3_U8, and 12.2.x through 12.5.x before 12.5.9_U2. Additional Analyst Notes: - CVE Program Container: References: - https://www.watchguard.com/support/release-notes/fireware/12/en-US/EN_ReleaseNotes_Fireware_12_7_2/index.html#Fireware/en-US/resolved_issues.html
CVE ID: CVE-2022-25364 State: PUBLISHED Published: 2022-03-17T16:24:15 Last Updated: 2024-08-03T04:36:06.981Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Gradle Enterprise before 2021.4.2, the default built-in build cache configuration allowed anonymous write access. If this was not manually changed, a malicious actor with network access to the build cache could potentially populate it with manipulated entries that execute malicious code as part of a build. As of 2021.4.2, the built-in build cache is inaccessible-by-default, requiring explicit configuration of its access-control settings before it can be used. (Remote build cache nodes are unaffected as they are inaccessibl
n of its access-control settings before it can be used. (Remote build cache nodes are unaffected as they are inaccessible-by-default.) Additional Analyst Notes: - CVE Program Container: References: - https://security.gradle.com - https://security.gradle.com/advisory/2022-02
CVE ID: CVE-2022-25365 State: PUBLISHED Published: 2022-02-19T01:56:06 Last Updated: 2024-08-03T04:36:06.950Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AC:L/AV:L/A:H/C:H/I:H/PR:L/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: Docker Desktop before 4.5.1 on Windows allows attackers to move arbitrary files. NOTE: this issue exists because of an incomplete fix for CVE-2022-23774. Additional Analyst Notes: - CVE Program Container: References: - https://docs.docker.com/desktop/windows/release-notes/ - https://security.netapp.com/advisory/ntap-20220331-0001/
CVE ID: CVE-2022-25366 State: PUBLISHED Published: 2022-02-19T02:26:47 Last Updated: 2024-08-03T04:36:06.917Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cryptomator through 1.6.5 allows DYLIB injection because, although it has the flag 0x1000 for Hardened Runtime, it has the com.apple.security.cs.disable-library-validation and com.apple.security.cs.allow-dyld-environment-variables entitlements. An attacker can exploit this by creating a malicious .dylib file that can be executed via the DYLD_INSERT_LIBRARIES environment variable. Additional Analyst Notes: - CVE Program Container: References: - https://cryptomator.org/ - https://medium.com/%40tehwinsam/cryptomator-1-6-5-dylib-
CVE Program Container: References: - https://cryptomator.org/ - https://medium.com/%40tehwinsam/cryptomator-1-6-5-dylib-injection-8004a1e90b26
CVE ID: CVE-2022-25368 State: PUBLISHED Published: 2022-03-09T18:17:28 Last Updated: 2024-08-03T04:36:06.904Z Vendors: n/a Products: n/a Problem Types: n/a Description: Spectre BHB is a variant of Spectre-v2 in which malicious code uses the shared branch history (stored in the CPU BHB) to influence mispredicted branches in the victim's hardware context. Speculation caused by these mispredicted branches can then potentially be used to cause cache allocation, which can then be used to infer information that should be protected. Additional Analyst Notes: - CVE Program Container: References: - https://amperecomputing.com/products/security-bulletins/impact-of-spectre-bhb-on-ampere.html - https://
r: References: - https://amperecomputing.com/products/security-bulletins/impact-of-spectre-bhb-on-ampere.html - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23960 - https://developer.arm.com/support/arm-security-updates/speculative-processor-vulnerability/spectre-bhb
CVE ID: CVE-2022-25370 State: PUBLISHED Published: 2022-09-02T07:10:16 Last Updated: 2024-08-03T04:36:06.924Z Vendors: Apache Software Foundation Products: Apache OFBiz Problem Types: CWE-79 Description: Apache OFBiz uses the Birt plugin (https://eclipse.github.io/birt-website/) to create data visualizations and reports. In Apache OFBiz release 18.12.05, and earlier versions, by leveraging a vulnerability in Birt (https://bugs.eclipse.org/bugs/show_bug.cgi?id=538142), an unauthenticated malicious user could perform a stored XSS attack in order to inject a malicious payload and execute it using the stored XSS. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apac
and execute it using the stored XSS. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread/vrvzokvxqtc4t6d7g8xgz89xpxcvjofh - http://www.openwall.com/lists/oss-security/2022/09/02/8 - http://www.openwall.com/lists/oss-security/2022/09/03/1
CVE ID: CVE-2022-25371 State: PUBLISHED Published: 2022-09-02T07:10:17 Last Updated: 2024-11-20T15:11:11.129Z Vendors: Apache Software Foundation Products: Apache OFBiz Problem Types: CWE-22 Description: Apache OFBiz uses the Birt project plugin (https://eclipse.github.io/birt-website/) to create data visualizations and reports. By leveraging a bug in Birt (https://bugs.eclipse.org/bugs/show_bug.cgi?id=538142) it is possible to perform a remote code execution (RCE) attack in Apache OFBiz, release 18.12.05 and earlier. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/bvp3sczqq863lxr1wh7wjvdtjbkcwspq - http://www.openwall
A ADP Vulnrichment: References: - https://lists.apache.org/thread/bvp3sczqq863lxr1wh7wjvdtjbkcwspq - http://www.openwall.com/lists/oss-security/2022/09/02/7 - http://www.openwall.com/lists/oss-security/2022/09/03/1 - http://www.openwall.com/lists/oss-security/2022/09/08/2
CVE ID: CVE-2022-25372 State: PUBLISHED Published: 2022-02-20T19:17:02 Last Updated: 2024-08-03T04:36:07.002Z Vendors: n/a Products: n/a Problem Types: n/a Description: Pritunl Client through 1.2.3019.52 on Windows allows local privilege escalation, related to an ACL entry for CREATOR OWNER in platform_windows.go. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pritunl/pritunl-client-electron/blob/caa78d626198b6961f3f39eca2acd39064c2df96/CHANGES#L6 - https://github.com/pritunl/pritunl-client-electron/commit/e16d47437f8ef62546aa00edb0d64be2a7d2205b - https://rhinosecuritylabs.com/penetration-testing/cve-2022-25372-local-privilege-escalation-in-pritunl-vpn-c
2a7d2205b - https://rhinosecuritylabs.com/penetration-testing/cve-2022-25372-local-privilege-escalation-in-pritunl-vpn-client/
CVE ID: CVE-2022-25373 State: PUBLISHED Published: 2022-04-05T18:30:13 Last Updated: 2024-08-03T04:36:06.934Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine SupportCenter Plus before 11020 allows Stored XSS in the request history. Additional Analyst Notes: - CVE Program Container: References: - https://manageengine.com - https://pitstop.manageengine.com/portal/en/community/topic/manageengine-supportcenter-plus-version-11-0-build-11020-released - https://raxis.com/blog/cve-2022-25373
CVE ID: CVE-2022-25374 State: PUBLISHED Published: 2022-02-25T12:25:04 Last Updated: 2024-08-03T04:36:07.000Z Vendors: n/a Products: n/a Problem Types: n/a Description: HashiCorp Terraform Enterprise v202112-1, v202112-2, v202201-1, and v202201-2 were configured to log inbound HTTP requests in a manner that may capture sensitive data. Fixed in v202202-1. Additional Analyst Notes: - CVE Program Container: References: - https://discuss.hashicorp.com - https://discuss.hashicorp.com/t/hcsec-2022-06-terraform-enterprise-may-capture-sensitive-data-in-logs/
CVE ID: CVE-2022-25375 State: PUBLISHED Published: 2022-02-20T19:47:01 Last Updated: 2024-08-03T04:36:06.951Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in drivers/usb/gadget/function/rndis.c in the Linux kernel before 5.16.10. The RNDIS USB gadget lacks validation of the size of the RNDIS_MSG_SET command. Attackers can obtain sensitive information from kernel memory. Additional Analyst Notes: - CVE Program Container: References: - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.16.10 - https://github.com/torvalds/linux/commit/38ea1eac7d88072bbffb630e2b3db83ca649b826 - https://github.com/szymonh/rndis-co - http://www.openwall.com/lists/oss-sec
t/38ea1eac7d88072bbffb630e2b3db83ca649b826 - https://github.com/szymonh/rndis-co - http://www.openwall.com/lists/oss-security/2022/02/21/1 - https://www.debian.org/security/2022/dsa-5092 - https://lists.debian.org/debian-lts-announce/2022/03/msg00011.html - https://lists.debian.org/debian-lts-announce/2022/03/msg00012.html - https://www.debian.org/security/2022/dsa-5096
CVE ID: CVE-2022-25377 State: PUBLISHED Published: 2024-02-22T00:00:00 Last Updated: 2024-08-21T17:46:27.441Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ACME-challenge endpoint in Appwrite 0.5.0 through 0.12.x before 0.12.2 allows remote attackers to read arbitrary local files via ../ directory traversal. In order to be vulnerable, APP_STORAGE_CERTIFICATES/.well-known/acme-challenge must exist on disk. (This pathname is automatically created if the user chooses to install Let's Encrypt certificates via Appwrite.) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/appwrite/appwrite/blob/0.12.0/app/controllers/genera
ontainer: - CISA ADP Vulnrichment: References: - https://github.com/appwrite/appwrite/blob/0.12.0/app/controllers/general.php#L539 - https://github.com/appwrite/appwrite/releases/tag/0.12.2 - https://github.com/appwrite/appwrite/pull/2780 - https://dubell.io/unauthenticated-lfi-in-appwrite-0.5.0-0.12.1/
CVE ID: CVE-2022-25389 State: PUBLISHED Published: 2022-03-18T21:31:16 Last Updated: 2024-08-03T04:36:06.927Z Vendors: n/a Products: n/a Problem Types: n/a Description: DCN Firewall DCME-520 was discovered to contain an arbitrary file download vulnerability via the path parameter in the file /audit/log/log_management.php. Additional Analyst Notes: - CVE Program Container: References: - https://www.adminxe.com/3246.html
CVE ID: CVE-2022-25390 State: PUBLISHED Published: 2022-03-18T21:31:17 Last Updated: 2024-08-03T04:36:06.971Z Vendors: n/a Products: n/a Problem Types: n/a Description: DCN Firewall DCME-520 was discovered to contain a remote command execution (RCE) vulnerability via the host parameter in the file /system/tool/ping.php. Additional Analyst Notes: - CVE Program Container: References: - https://www.adminxe.com/3276.html
CVE ID: CVE-2022-25393 State: PUBLISHED Published: 2022-03-02T22:39:26 Last Updated: 2024-08-03T04:36:07.006Z Vendors: n/a Products: n/a Problem Types: n/a Description: Simple Bakery Shop Management v1.0 was discovered to contain a SQL injection vulnerability via the username parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/2022/Simple-Bakery-Shop-Management
CVE ID: CVE-2022-25394 State: PUBLISHED Published: 2022-03-02T22:39:26 Last Updated: 2024-08-03T04:36:07.063Z Vendors: n/a Products: n/a Problem Types: n/a Description: Medical Store Management System v1.0 was discovered to contain a SQL injection vulnerability via the cid parameter under customer-add.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/abhisheks008/2022/Medical-Store-Management-System
CVE ID: CVE-2022-25395 State: PUBLISHED Published: 2022-03-02T22:39:27 Last Updated: 2024-08-03T04:36:06.998Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cosmetics and Beauty Product Online Store v1.0 was discovered to contain multiple reflected cross-site scripting (XSS) attacks via the search parameter under the /cbpos/ app. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/2022/Cosmetics-and-Beauty-Product-Online-Store
CVE ID: CVE-2022-25396 State: PUBLISHED Published: 2022-03-02T22:39:28 Last Updated: 2024-08-03T04:36:06.981Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cosmetics and Beauty Product Online Store v1.0 was discovered to contain a SQL injection vulnerability via the search parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/2022/Cosmetics-and-Beauty-Product-Online-Store/SQL-Injection
CVE ID: CVE-2022-25398 State: PUBLISHED Published: 2022-03-02T22:39:30 Last Updated: 2024-08-03T04:36:06.877Z Vendors: n/a Products: n/a Problem Types: n/a Description: Auto Spare Parts Management v1.0 was discovered to contain a SQL injection vulnerability via the user parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/pavanpatil45/Auto-Spare-Parts-Management
CVE ID: CVE-2022-25399 State: PUBLISHED Published: 2022-03-02T22:39:31 Last Updated: 2024-08-03T04:36:06.926Z Vendors: n/a Products: n/a Problem Types: n/a Description: Simple Real Estate Portal System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/2022/Simple-Real-Estate-Portal-System
CVE ID: CVE-2022-25401 State: PUBLISHED Published: 2022-02-23T21:11:22 Last Updated: 2024-08-03T04:36:07.015Z Vendors: n/a Products: n/a Problem Types: n/a Description: The copy function of the file manager in Cuppa CMS v1.0 allows any file to be copied to the current directory, granting attackers read access to arbitrary files. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/dota-st/Vulnerability/blob/master/CuppaCMS/CuppaCMS_second.md
CVE ID: CVE-2022-25402 State: PUBLISHED Published: 2022-02-23T21:11:21 Last Updated: 2024-08-03T04:36:06.932Z Vendors: n/a Products: n/a Problem Types: n/a Description: An incorrect access control issue in HMS v1.0 allows unauthenticated attackers to read and modify all PHP files. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/dota-st/Vulnerability/blob/master/HMS/HMS.md