Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-37130 State: PUBLISHED Published: 2022-08-31T00:00:00 Last Updated: 2024-08-03T10:21:33.144Z Vendors: n/a Products: n/a Problem Types: n/a Description: In D-Link DIR-816 A2_v1.10CNB04, DIR-878 DIR_878_FW1.30B08.img a command injection vulnerability occurs in /goform/Diagnosis, after the condition is met, setnum will be spliced into v10 by snprintf, and the system will be executed, resulting in a command injection vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://www.dlink.com/en/security-bulletin/ - https://github.com/z1r00/IOT_Vul/blob/main/dlink/Dir816/Diagnosis/readme.md - https://github.com/726232111/VulIoT/tree/main/D-Link/DIR-816%20
r00/IOT_Vul/blob/main/dlink/Dir816/Diagnosis/readme.md - https://github.com/726232111/VulIoT/tree/main/D-Link/DIR-816%20A2_v1.10CNB05/Diagnosis
CVE ID: CVE-2022-37133 State: PUBLISHED Published: 2022-08-22T14:44:22 Last Updated: 2024-08-03T10:21:33.156Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-link DIR-816 A2_v1.10CNB04.img reboots the router without authentication via /goform/doReboot. No authentication is required, and reboot is executed when the function returns at the end. Additional Analyst Notes: - CVE Program Container: References: - https://www.dlink.com/en/security-bulletin/ - https://github.com/z1r00/IOT_Vul/blob/main/dlink/Dir816/doReboot/readme.md
CVE ID: CVE-2022-37134 State: PUBLISHED Published: 2022-08-22T14:41:44 Last Updated: 2024-08-03T10:21:33.147Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-link DIR-816 A2_v1.10CNB04.img is vulnerable to Buffer Overflow via /goform/form2Wan.cgi. When wantype is 3, l2tp_usrname will be decrypted by base64, and the result will be stored in v94, which does not check the size of l2tp_usrname, resulting in stack overflow. Additional Analyst Notes: - CVE Program Container: References: - https://www.dlink.com/en/security-bulletin/ - https://github.com/z1r00/IOT_Vul/blob/main/dlink/Dir816/form2Wan_cgi/readme.md
CVE ID: CVE-2022-37137 State: PUBLISHED Published: 2022-09-14T03:24:01.000Z Last Updated: 2025-06-04T15:09:22.989Z Vendors: n/a Products: n/a Problem Types: n/a Description: PayMoney 3.3 is vulnerable to Stored Cross-Site Scripting (XSS) during replying the ticket. The XSS can be obtain from injecting under "Message" field with "description" parameter with the specially crafted payload to gain Stored XSS. The XSS then will prompt after that or can be access from the view ticket function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://paymoney.techvill.org/ - https://github.com/saitamang/POC-DUMP/tree/main/PayMoney
CVE ID: CVE-2022-37138 State: PUBLISHED Published: 2022-09-14T03:37:43 Last Updated: 2024-08-03T10:21:33.220Z Vendors: n/a Products: n/a Problem Types: n/a Description: Loan Management System 1.0 is vulnerable to SQL Injection at the login page, which allows unauthorized users to login as Administrator after injecting username form. Additional Analyst Notes: - CVE Program Container: References: - https://www.sourcecodester.com/php/15529/loan-management-system-oop-php-mysqlijquery-free-source-code.html - https://github.com/saitamang/POC-DUMP/blob/main/Loan%20Management%20System/README.md
CVE ID: CVE-2022-37139 State: PUBLISHED Published: 2022-09-14T03:31:46 Last Updated: 2024-08-03T10:21:33.216Z Vendors: n/a Products: n/a Problem Types: n/a Description: Loan Management System version 1.0 suffers from a persistent cross site scripting vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://www.sourcecodester.com/php/15529/loan-management-system-oop-php-mysqlijquery-free-source-code.html - https://github.com/saitamang/POC-DUMP/blob/main/Loan%20Management%20System/README.md
CVE ID: CVE-2022-37140 State: PUBLISHED Published: 2022-09-14T03:41:09 Last Updated: 2024-08-03T10:21:33.218Z Vendors: n/a Products: n/a Problem Types: n/a Description: PayMoney 3.3 is vulnerable to Client Side Remote Code Execution (RCE). The vulnerability exists on the reply ticket function and upload the malicious file. A calculator will open when the victim who download the file open the RTF file. Additional Analyst Notes: - CVE Program Container: References: - https://paymoney.techvill.org - https://github.com/saitamang/POC-DUMP/tree/main/PayMoney
CVE ID: CVE-2022-37144 State: PUBLISHED Published: 2022-09-08T00:27:59 Last Updated: 2024-08-03T10:21:33.180Z Vendors: n/a Products: n/a Problem Types: n/a Description: The PlexTrac platform prior to API version 1.17.0 does not restrict excessive MFA TOTP submission attempts. An unauthenticated remote attacker in possession of a valid username and password can bruteforce their way past MFA protections to login as the targeted user. Additional Analyst Notes: - CVE Program Container: References: - http://plextrac.com - https://www.controlgap.com/blog/a-plextrac-story
CVE ID: CVE-2022-37145 State: PUBLISHED Published: 2022-09-08T00:28:04 Last Updated: 2024-08-03T10:21:33.223Z Vendors: n/a Products: n/a Problem Types: n/a Description: The PlexTrac platform prior to version 1.17.0 does not restrict excessive authentication attempts for accounts configured to use the PlexTrac authentication provider. An unauthenticated remote attacker could perform a bruteforce attack on the login page with no time or attempt limitation in an attempt to obtain valid credentials for the platform users configured to use the PlexTrac authentication provider. Additional Analyst Notes: - CVE Program Container: References: - http://plextrac.com - https://www.controlgap.com/blog/a-
dditional Analyst Notes: - CVE Program Container: References: - http://plextrac.com - https://www.controlgap.com/blog/a-plextrac-story
CVE ID: CVE-2022-37146 State: PUBLISHED Published: 2022-09-08T00:28:09 Last Updated: 2024-08-03T10:21:33.201Z Vendors: n/a Products: n/a Problem Types: n/a Description: The PlexTrac platform prior to version 1.28.0 allows for username enumeration via HTTP response times on invalid login attempts for users configured to use the PlexTrac authentication provider. Login attempts for valid, unlocked users configured to use PlexTrac as their authentication provider take significantly longer than those for invalid users, allowing for valid users to be enumerated by an unauthenticated remote attacker. Note that the lockout policy implemented in Plextrac version 1.17.0 makes it impossible to distingu
ted remote attacker. Note that the lockout policy implemented in Plextrac version 1.17.0 makes it impossible to distinguish between valid, locked user accounts and user accounts that do not exist, but does not prevent valid, unlocked users from being enumerated. Additional Analyst Notes: - CVE Program Container: References: - http://plextrac.com - https://www.controlgap.com/blog/a-plextrac-story
CVE ID: CVE-2022-37149 State: PUBLISHED Published: 2022-08-30T14:39:02 Last Updated: 2024-08-03T10:21:33.197Z Vendors: n/a Products: n/a Problem Types: n/a Description: WAVLINK WL-WN575A3 RPT75A3.V4300.201217 was discovered to contain a command injection vulnerability when operating the file adm.cgi. This vulnerability allows attackers to execute arbitrary commands via the username parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/fxc233/iot-vul/blob/main/WAVLINK/WN575A3/Readme.md
CVE ID: CVE-2022-37150 State: PUBLISHED Published: 2022-08-26T12:15:03 Last Updated: 2024-08-03T10:21:33.249Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Online Diagnostic Lab Management System 1.0. There is a stored XSS vulnerability via firstname, address, middlename, lastname , gender, email, contact parameters. Additional Analyst Notes: - CVE Program Container: References: - https://www.sourcecodester.com/php/15129/online-diagnostic-lab-management-system-php-free-source-code.html - https://github.com/Fjowel/CVE-2022-37150
CVE ID: CVE-2022-37151 State: PUBLISHED Published: 2022-08-26T12:23:15 Last Updated: 2024-08-03T10:21:33.227Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is an unauthorized access vulnerability in Online Diagnostic Lab Management System 1.0. Additional Analyst Notes: - CVE Program Container: References: - https://www.sourcecodester.com/php/15129/online-diagnostic-lab-management-system-php-free-source-code.html - https://github.com/Fjowel/CVE-2022-37151
CVE ID: CVE-2022-37152 State: PUBLISHED Published: 2022-08-26T12:17:49 Last Updated: 2024-08-03T10:21:33.231Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Online Diagnostic Lab Management System 1.0, There is a SQL injection vulnerability via "dob" parameter in "/classes/Users.php?f=save_client" Additional Analyst Notes: - CVE Program Container: References: - https://www.sourcecodester.com/php/15129/online-diagnostic-lab-management-system-php-free-source-code.html - https://github.com/Fjowel/CVE-2022-37152
CVE ID: CVE-2022-37153 State: PUBLISHED Published: 2022-08-24T12:22:56 Last Updated: 2024-08-03T10:21:33.194Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Artica Proxy 4.30.000000. There is a XSS vulnerability via the password parameter in /fw.login.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Fjowel/CVE-2022-37153
CVE ID: CVE-2022-37155 State: PUBLISHED Published: 2022-12-13T00:00:00.000Z Last Updated: 2025-04-22T15:42:51.715Z Vendors: n/a Products: n/a Problem Types: n/a Description: RCE in SPIP 3.1.13 through 4.1.2 allows remote authenticated users to execute arbitrary code via the _oups parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://spawnzii.github.io/posts/2022/07/how-we-have-pwned-root-me-in-2022/ - https://blog.spip.net/Mise-a-jour-critique-de-securite-sortie-de-SPIP-4-1-5-SPIP-4-0-8-et-SPIP-3-2-16.html - https://pastebin.com/ZH7CPc8X - https://github.com/Abyss-W4tcher/ab4yss-wr4iteups/blob/ffa980faa9e3598d49d6fb7def4f7a67cfb5f427/SPI
tebin.com/ZH7CPc8X - https://github.com/Abyss-W4tcher/ab4yss-wr4iteups/blob/ffa980faa9e3598d49d6fb7def4f7a67cfb5f427/SPIP%20-%20Pentest/SPIP%204.1.2/SPIP_4.1.2_AUTH_RCE/SPIP_4.1.2_AUTH_RCE_Abyss_Watcher_12_07_22.md
CVE ID: CVE-2022-37158 State: PUBLISHED Published: 2022-08-25T16:06:59 Last Updated: 2024-08-03T10:21:33.257Z Vendors: n/a Products: n/a Problem Types: n/a Description: RuoYi v3.8.3 has a Weak password vulnerability in the management system. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/YunaiV/ruoyi-vue-pro/issues/170
CVE ID: CVE-2022-37159 State: PUBLISHED Published: 2022-08-25T16:26:37 Last Updated: 2024-08-03T10:21:33.217Z Vendors: n/a Products: n/a Problem Types: n/a Description: Claroline 13.5.7 and prior is vulnerable to Remote code execution via arbitrary file upload. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/matthieu-hackwitharts/claroline-CVEs/blob/main/rce/rce_file_upload.md
CVE ID: CVE-2022-37160 State: PUBLISHED Published: 2022-08-25T16:29:01 Last Updated: 2024-08-03T10:21:33.234Z Vendors: n/a Products: n/a Problem Types: n/a Description: Claroline 13.5.7 and prior allows an authenticated attacker to elevate privileges via the arbitrary creation of a privileged user. By combining the XSS vulnerability present in several upload forms and a javascript request to the present API, it is possible to trigger the creation of a user with administrative rights by opening an SVG file as an administrator user. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/matthieu-hackwitharts/claroline-CVEs/blob/main/csrf/csrf.md
CVE ID: CVE-2022-37161 State: PUBLISHED Published: 2022-08-25T16:21:28 Last Updated: 2024-08-03T10:21:33.176Z Vendors: n/a Products: n/a Problem Types: n/a Description: Claroline 13.5.7 and prior is vulnerable to Cross Site Scripting (XSS) via SVG file upload. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/matthieu-hackwitharts/claroline-CVEs/blob/main/svg_xss/svg_xss.md
CVE ID: CVE-2022-37162 State: PUBLISHED Published: 2022-08-25T16:19:42 Last Updated: 2024-08-03T10:21:33.239Z Vendors: n/a Products: n/a Problem Types: n/a Description: Claroline 13.5.7 and prior is vulnerable to Cross Site Scripting (XSS). An attacker can obtain javascript code execution by adding arbitrary javascript code in the 'Location' field of a calendar event. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/matthieu-hackwitharts/claroline-CVEs/blob/main/calendar_xss/calendar_xss.md
CVE ID: CVE-2022-37163 State: PUBLISHED Published: 2022-09-08T15:16:50 Last Updated: 2024-08-03T10:21:33.225Z Vendors: n/a Products: n/a Problem Types: n/a Description: Bminusl IHateToBudget v1.5.7 employs a weak password policy which allows attackers to potentially gain unauthorized access to the application via brute-force attacks. Additionally, user passwords are hashed without a salt or pepper making it much easier for tools like hashcat to crack the hashes. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/bminusl/ihatetobudget/issues/24 - https://gainsec.com/2022/08/07/cve-2022-hardcoded-creds-weak-password-hauk-android-location-sharing/
CVE ID: CVE-2022-37164 State: PUBLISHED Published: 2022-09-08T15:16:56 Last Updated: 2024-08-03T10:21:33.284Z Vendors: n/a Products: n/a Problem Types: n/a Description: Inoda OnTrack v3.4 employs a weak password policy which allows attackers to potentially gain unauthorized access to the application via brute-force attacks. Additionally, user passwords are hashed without a salt or pepper making it much easier for tools like hashcat to crack the hashes. Additional Analyst Notes: - CVE Program Container: References: - https://cwe.mitre.org/data/definitions/521.html - https://cwe.mitre.org/data/definitions/916.html - https://github.com/inoda/ontrack/issues/78 - https://gainsec.com/2022/08/07/cv
cwe.mitre.org/data/definitions/916.html - https://github.com/inoda/ontrack/issues/78 - https://gainsec.com/2022/08/07/cve-2022-hardcoded-creds-weak-password-hauk-android-location-sharing/
CVE ID: CVE-2022-37172 State: PUBLISHED Published: 2022-08-30T20:05:56 Last Updated: 2024-08-03T10:21:33.225Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in the install directory (C:\msys64) of Msys2 v20220603 and below allows authenticated attackers to execute arbitrary code via overwriting binaries located in the directory. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ycdxsb/Vuln/tree/main/Msys2-Vuln
CVE ID: CVE-2022-37173 State: PUBLISHED Published: 2022-08-30T20:05:57 Last Updated: 2024-08-03T10:21:33.254Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in the installer of gvim 9.0.0000 allows authenticated attackers to execute arbitrary code via a binary hijacking attack on C:\Program.exe. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ycdxsb/Vuln/tree/main/Gvim-Installer-Vuln
CVE ID: CVE-2022-37175 State: PUBLISHED Published: 2022-08-19T20:50:21 Last Updated: 2024-08-03T10:21:33.226Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda ac15 firmware V15.03.05.18 httpd server has stack buffer overflow in /goform/formWifiBasicSet. Additional Analyst Notes: - CVE Program Container: References: - https://drive.google.com/file/d/16hshiCHS8j3YaFPkQD3xajVuwu_QVBe3/view - https://www.cnblogs.com/Amalll/p/16527552.html
CVE ID: CVE-2022-37176 State: PUBLISHED Published: 2022-08-30T15:07:40 Last Updated: 2024-08-03T10:21:33.254Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda AC6(AC1200) v5.0 Firmware v02.03.01.114 and below contains a vulnerability which allows attackers to remove the Wi-Fi password and force the device into open security mode via a crafted packet sent to goform/setWizard. Additional Analyst Notes: - CVE Program Container: References: - http://tenda.com - http://ac6ac1200.com - https://drive.google.com/drive/folders/1L6ojSooP8sbZLQYRsAxlb0IWVAZef8Z7?usp=sharing
CVE ID: CVE-2022-37177 State: PUBLISHED Published: 2022-08-29T00:00:00 Last Updated: 2024-08-03T10:21:33.283Z Vendors: n/a Products: n/a Problem Types: n/a Description: HireVue Hiring Platform V1.0 suffers from Use of a Broken or Risky Cryptographic Algorithm. NOTE: this is disputed by the vendor for multiple reasons, e.g., it is inconsistent with CVE ID assignment rules for cloud services, and no product with version V1.0 exists. Furthermore, the rail-fence cipher has been removed, and TLS 1.2 is now used for encryption. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.hirevue.com/ - https://github.com/JC175/CVE-2022-37177
CVE ID: CVE-2022-37178 State: PUBLISHED Published: 2022-08-24T16:34:24 Last Updated: 2024-08-03T10:21:33.231Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in 72crm 9.0. There is a SQL Injection vulnerability in View the task calendar. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/72wukong/72crm-9.0-PHP/issues/34
CVE ID: CVE-2022-37181 State: PUBLISHED Published: 2022-08-24T16:31:52 Last Updated: 2024-08-03T10:21:33.222Z Vendors: n/a Products: n/a Problem Types: n/a Description: 72crm 9.0 has an Arbitrary file upload vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/72wukong/72crm-9.0-PHP/issues/35
CVE ID: CVE-2022-37183 State: PUBLISHED Published: 2022-08-31T17:09:50 Last Updated: 2024-08-03T10:21:33.239Z Vendors: n/a Products: n/a Problem Types: n/a Description: Piwigo 12.3.0 is vulnerable to Cross Site Scripting (XSS) via /search/1940/created-monthly-list. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/Piwigo/2022/12.3.0
CVE ID: CVE-2022-37184 State: PUBLISHED Published: 2022-08-31T17:18:02 Last Updated: 2024-08-03T10:21:33.243Z Vendors: n/a Products: n/a Problem Types: n/a Description: The application manage_website.php on Garage Management System 1.0 is vulnerable to Shell File Upload. The already authenticated malicious user, can upload a dangerous RCE or LCE exploit file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/mayuri_k/2022/Garage-Management-System-1.0-SFU
CVE ID: CVE-2022-37185 State: PUBLISHED Published: 2022-09-06T19:28:44 Last Updated: 2024-08-03T10:21:33.240Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability exists in the school information query interface (repschoolproj.php) of the EMS 6.2 system of the Office of the Thai Basic Education Commission, which can lead to data leakage. Additional Analyst Notes: - CVE Program Container: References: - http://eme1.obec.go.th - http://eme1.obec.go.th/~eme62/repschoolproj.php?claster=school&idarea=648 - https://github.com/00xdF/emes/blob/main/readme.md
CVE ID: CVE-2022-37186 State: PUBLISHED Published: 2023-04-16T00:00:00.000Z Last Updated: 2025-02-06T18:50:51.917Z Vendors: n/a Products: n/a Problem Types: n/a Description: In LemonLDAP::NG before 2.0.15. some sessions are not deleted when they are supposed to be deleted according to the timeoutActivity setting. This can occur when there are at least two servers, and a session is manually removed before the time at which it would have been removed automatically. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/issues/2758 - https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/commit/59c781b393947663ad3
/lemonldap-ng/lemonldap-ng/-/issues/2758 - https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/commit/59c781b393947663ad3bf26bad0581413dd6fae4 - https://lists.debian.org/debian-lts-announce/2023/01/msg00027.html - https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/releases/v2.0.15
CVE ID: CVE-2022-37189 State: PUBLISHED Published: 2022-09-07T12:34:59 Last Updated: 2024-08-03T10:21:33.224Z Vendors: n/a Products: n/a Problem Types: n/a Description: DDMAL MEI2Volpiano 0.8.2 is vulnerable to XML External Entity (XXE), leading to a Denial of Service. This occurs due to the usage of the unsafe 'xml.etree' library to parse untrusted XML input. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/DDMAL/MEI2Volpiano/ - https://github.com/DDMAL/MEI2Volpiano/blob/987b70fff991235e682405f901388af0f414eaa8/mei2volpiano/mei2volpiano.py#L59 - https://docs.python.org/3/library/xml.html#xml-vulnerabilities - https://pyup.io/vulnerabilities/CVE-2022-37189/
y#L59 - https://docs.python.org/3/library/xml.html#xml-vulnerabilities - https://pyup.io/vulnerabilities/CVE-2022-37189/50928/
CVE ID: CVE-2022-37190 State: PUBLISHED Published: 2022-09-13T22:07:14 Last Updated: 2024-08-03T10:21:33.250Z Vendors: n/a Products: n/a Problem Types: n/a Description: CuppaCMS 1.0 is vulnerable to Remote Code Execution (RCE). An authenticated user can control both parameters (action and function) from "/api/index.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/CuppaCMS/CuppaCMS/issues/22 - https://github.com/badru8612/Authenticated-RCE-CuppaCMS
CVE ID: CVE-2022-37191 State: PUBLISHED Published: 2022-09-13T22:07:19 Last Updated: 2024-08-03T10:21:33.205Z Vendors: n/a Products: n/a Problem Types: n/a Description: The component "cuppa/api/index.php" of CuppaCMS v1.0 is Vulnerable to LFI. An authenticated user can read system files via crafted POST request using [function] parameter value as LFI payload. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/CuppaCMS/CuppaCMS/issues/20 - https://github.com/badru8612/CuppaCMS-Authenticated-LFI-Vulnerability
CVE ID: CVE-2022-37193 State: PUBLISHED Published: 2022-09-27T12:54:21.000Z Last Updated: 2025-05-22T13:51:24.235Z Vendors: n/a Products: n/a Problem Types: n/a Description: Chipolo ONE Bluetooth tracker (2020) Chipolo iOS app version 4.13.0 is vulnerable to Incorrect Access Control. Chipolo devices suffer from access revocation evasion attacks once the malicious sharee obtains the access credentials. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://chipolo.net/en-us/products/chipolo-one-4-pack - https://github.com/zhouxinan/CCS22MaaGIoT/blob/main/ChipoloONE.md
CVE ID: CVE-2022-37197 State: PUBLISHED Published: 2022-11-18T00:00:00.000Z Last Updated: 2025-04-29T19:11:58.165Z Vendors: n/a Products: n/a Problem Types: n/a Description: IOBit IOTransfer V4 is vulnerable to Unquoted Service Path. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.exploit-db.com/exploits/51029
CVE ID: CVE-2022-37199 State: PUBLISHED Published: 2022-08-23T12:54:01 Last Updated: 2024-08-03T10:21:33.235Z Vendors: n/a Products: n/a Problem Types: n/a Description: JFinal CMS 5.1.0 is vulnerable to SQL Injection via /jfinal_cms/system/user/list. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jflyfox/jfinal_cms/issues/48
CVE ID: CVE-2022-37201 State: PUBLISHED Published: 2022-09-15T15:03:37 Last Updated: 2024-08-03T10:21:33.233Z Vendors: n/a Products: n/a Problem Types: n/a Description: JFinal CMS 5.1.0 is vulnerable to SQL Injection. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/AgainstTheLight/someEXP_of_jfinal_cms/blob/main/jfinal_cms/sql4.md - https://github.com/AgainstTheLight/CVE-2022-37201/blob/main/README.md
CVE ID: CVE-2022-37202 State: PUBLISHED Published: 2022-10-26T00:00:00.000Z Last Updated: 2025-05-07T18:40:34.467Z Vendors: n/a Products: n/a Problem Types: n/a Description: JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/advicefeedback/list Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/AgainstTheLight/someEXP_of_jfinal_cms/blob/main/jfinal_cms/sql1.md - https://github.com/AgainstTheLight/CVE-2022-37202/blob/main/README.md