Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-3989 State: PUBLISHED Published: 2022-12-12T17:54:58.545Z Last Updated: 2025-04-22T14:45:06.597Z Vendors: Unknown Products: Motors Problem Types: CWE-434 Unrestricted Upload of File with Dangerous Type Description: The Motors WordPress plugin before 1.4.4 does not properly validate uploaded files for dangerous file types (such as .php) in an AJAX action, allowing an attacker to sign up on a victim's WordPress instance, upload a malicious PHP file and attempt to launch a brute-force attack to discover the uploaded payload. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/1bd20329-f3a5-466d-81b0-e4ff0ca3
gram Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/1bd20329-f3a5-466d-81b0-e4ff0ca32091
CVE ID: CVE-2022-3990 State: PUBLISHED Published: 2023-01-30T18:52:10.637Z Last Updated: 2025-03-28T14:22:08.350Z Vendors: HP Inc. Products: HPSFViewer Problem Types: n/a Description: HPSFViewer might allow Escalation of Privilege. This potential vulnerability was remediated on July 29th, 2022. Customers who opted for automatic updates should have already received the remediation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.hp.com/us-en/document/ish_7256634-7256658-16
CVE ID: CVE-2022-3991 State: PUBLISHED Published: 2022-11-29T20:43:32.624Z Last Updated: 2025-01-23T20:48:47.703Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: deanoakley Products: Photospace Gallery Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Photospace Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its settings parameters saved via the update() function in versions up to, and including, 2.3.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level permissions and above
ion and output escaping. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://plugins.trac.wordpress.org/browser/photospace/trunk/photospace.php#L87 - https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-3991
CVE ID: CVE-2022-3992 State: PUBLISHED Published: 2022-11-14T00:00:00.000Z Last Updated: 2025-04-15T13:14:11.146Z Severity: LOW (CVSS 2.4 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N) Vendors: SourceCodester Products: Sanitization Management System Problem Types: CWE-707 Description: A vulnerability classified as problematic was found in SourceCodester Sanitization Management System. Affected by this vulnerability is an unknown functionality of the file admin/?page=system_info of the component Banner Image Handler. The manipulation leads to cross site scripting. The attack can be launched remotely. The associated identifier of this vulnerability is VDB-213571. Additional Analyst Notes: - CVE
can be launched remotely. The associated identifier of this vulnerability is VDB-213571. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.213571
CVE ID: CVE-2022-3993 State: PUBLISHED Published: 2022-11-14T00:00:00.000Z Last Updated: 2025-04-30T19:00:20.634Z Severity: CRITICAL (CVSS 9.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H) Vendors: kareadita Products: kareadita/kavita Problem Types: CWE-307 Description: Improper Restriction of Excessive Authentication Attempts in GitHub repository kareadita/kavita prior to 0.6.0.3. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/kareadita/kavita/commit/f8db37d3f9aa42d47e7c4f4ca839e892d3f97afb - https://huntr.dev/bounties/bebd0cd6-18ec-469c-b6ca-19ffa9db0699
CVE ID: CVE-2022-3994 State: PUBLISHED Published: 2023-01-02T21:49:19.538Z Last Updated: 2025-04-10T18:47:27.795Z Vendors: Unknown Products: Authenticator Problem Types: CWE-400 Uncontrolled Resource Consumption Description: The Authenticator WordPress plugin before 1.3.1 does not prevent subscribers from updating a site's feed access token, which may deny other users access to the functionality in certain configurations. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/802a2139-ab48-4281-888f-225e6e3134aa
CVE ID: CVE-2022-3995 State: PUBLISHED Published: 2022-11-29T20:43:15.611Z Last Updated: 2025-01-23T20:49:07.448Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/A:N/I:L/C:N/S:U/UI:N/PR:L/AC:L/AV:N) Vendors: subratamal Products: TeraWallet – For WooCommerce Problem Types: CWE-639 Authorization Bypass Through User-Controlled Key Description: The TeraWallet plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 1.4.3. This is due to insufficient validation of the user-controlled key on the lock_unlock_terawallet AJAX action. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to lock/unlock other users wallets.
possible for authenticated attackers, with subscriber-level permissions and above, to lock/unlock other users wallets. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://plugins.trac.wordpress.org/changeset/2817824/woo-wallet/trunk?contextall=1&old=2816610&old_path=%2Fwoo-wallet%2Ftrunk - https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-3995
CVE ID: CVE-2022-3996 State: PUBLISHED Published: 2022-12-13T15:43:06.821Z Last Updated: 2024-08-03T01:27:54.475Z Vendors: OpenSSL Products: OpenSSL Problem Types: CWE-667 Description: If an X.509 certificate contains a malformed policy constraint and policy processing is enabled, then a write lock will be taken twice recursively. On some operating systems (most widely: Windows) this results in a denial of service when the affected process hangs. Policy processing being enabled on a publicly facing server is not considered to be a common setup. Policy processing is enabled by passing the `-policy' argument to the command line utilities or by calling the `X509_VERIFY_PARAM_set1_policies()' fu
by passing the `-policy' argument to the command line utilities or by calling the `X509_VERIFY_PARAM_set1_policies()' function. Update (31 March 2023): The description of the policy processing enablement was corrected based on CVE-2023-0466. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.openssl.org/news/secadv/20221213.txt - https://github.com/openssl/openssl/commit/7725e7bfe6f2ce8146b6552b44e0d226be7638e7
CVE ID: CVE-2022-3997 State: PUBLISHED Published: 2022-11-15T00:00:00.000Z Last Updated: 2025-04-15T13:13:41.159Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: MonikaBrzica Products: scm Problem Types: CWE-707 Description: A vulnerability, which was classified as critical, has been found in MonikaBrzica scm. Affected by this issue is some unknown functionality of the file upis_u_bazu.php. The manipulation of the argument email/lozinka/ime/id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-213698 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Pr
public and may be used. VDB-213698 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/MonikaBrzica/scm/issues/2 - https://vuldb.com/?id.213698
CVE ID: CVE-2022-3998 State: PUBLISHED Published: 2022-11-15T00:00:00.000Z Last Updated: 2025-04-15T13:13:33.213Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: MonikaBrzica Products: scm Problem Types: CWE-707 Description: A vulnerability, which was classified as critical, was found in MonikaBrzica scm. This affects an unknown part of the file uredi_korisnika.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-213699. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vu
ociated identifier of this vulnerability is VDB-213699. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/MonikaBrzica/scm/issues/1 - https://vuldb.com/?id.213699
CVE ID: CVE-2022-3999 State: PUBLISHED Published: 2022-12-12T17:54:49.698Z Last Updated: 2025-04-22T14:49:47.210Z Vendors: Unknown Products: DPD Baltic Shipping Problem Types: CWE-862 Missing Authorization, CWE-352 Cross-Site Request Forgery (CSRF) Description: The DPD Baltic Shipping WordPress plugin before 1.2.57 does not have authorisation and CSRF in an AJAX action, which could allow any authenticated users, such as subscriber to delete arbitrary options from the blog, which could make the blog unavailable. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/625ae924-68db-4579-a34f-e6f33aa33643
CVE ID: CVE-2022-40000 State: PUBLISHED Published: 2022-12-15T00:00:00.000Z Last Updated: 2025-04-21T15:17:10.650Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability in FeehiCMS-2.1.1 allows remote attackers to run arbitrary code via the username field of the admin log in page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/liufee/cms/issues/64
CVE ID: CVE-2022-40001 State: PUBLISHED Published: 2022-12-15T00:00:00.000Z Last Updated: 2025-04-21T15:16:08.814Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability in FeehiCMS-2.1.1 allows remote attackers to run arbitrary code via the title field of the create article page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/liufee/cms/issues/65
CVE ID: CVE-2022-40002 State: PUBLISHED Published: 2022-12-15T00:00:00.000Z Last Updated: 2025-04-21T15:14:48.565Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability in FeehiCMS-2.1.1 allows remote attackers to run arbirtary code via the callback parameter to /cms/notify. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/liufee/cms/issues/66
CVE ID: CVE-2022-40004 State: PUBLISHED Published: 2022-12-15T00:00:00.000Z Last Updated: 2025-04-21T17:56:48.245Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability in Things Board 3.4.1 allows remote attackers to escalate privilege via crafted URL to the Audit Log. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gist.github.com/s3d113/bba63da007fcbe243615dd2a81690ffb
CVE ID: CVE-2022-40005 State: PUBLISHED Published: 2022-12-25T00:00:00.000Z Last Updated: 2025-04-14T18:34:50.044Z Vendors: n/a Products: n/a Problem Types: n/a Description: Intelbras WiFiber 120AC inMesh before 1-1-220826 allows command injection by authenticated users, as demonstrated by the /boaform/formPing6 and /boaform/formTracert URIs for ping and traceroute. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cyberdanube.com/en/authenticated-command-injection-in-intelbras-wifiber-120ac-inmesh/ - https://seclists.org/fulldisclosure/2022/Dec/13
CVE ID: CVE-2022-40008 State: PUBLISHED Published: 2022-09-20T19:14:19.000Z Last Updated: 2025-05-28T16:05:44.990Z Vendors: n/a Products: n/a Problem Types: n/a Description: SWFTools commit 772e55a was discovered to contain a heap-buffer overflow via the function readU8 at /lib/ttf.c. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/matthiaskramm/swftools/issues/188
CVE ID: CVE-2022-40009 State: PUBLISHED Published: 2022-09-20T19:14:20.000Z Last Updated: 2025-05-28T16:05:12.593Z Vendors: n/a Products: n/a Problem Types: n/a Description: SWFTools commit 772e55a was discovered to contain a heap-use-after-free via the function grow_unicode at /lib/ttf.c. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/matthiaskramm/swftools/issues/190
CVE ID: CVE-2022-40010 State: PUBLISHED Published: 2023-06-26T00:00:00 Last Updated: 2024-12-05T16:41:48.848Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda AC6 AC1200 Smart Dual-Band WiFi Router 15.03.06.50_multi was discovered to contain a cross-site scripting (XSS) vulnerability via the deviceId parameter in the Parental Control module. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://packetstormsecurity.com/files/173029/Tenda-AC6-AC1200-15.03.06.50_multi-Cross-Site-Scripting.html
CVE ID: CVE-2022-40011 State: PUBLISHED Published: 2022-12-23T00:00:00.000Z Last Updated: 2025-04-15T14:22:50.823Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability in typora through 1.38 allows remote attackers to run arbitrary code via export from editor. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://typora.com - http://wwwtyporaio.com - https://gist.github.com/wangking1/61bdd1967367301a950ffbb3d10386f3
CVE ID: CVE-2022-40016 State: PUBLISHED Published: 2023-02-15T00:00:00.000Z Last Updated: 2025-03-19T18:02:17.996Z Vendors: n/a Products: n/a Problem Types: n/a Description: Use After Free (UAF) vulnerability in ireader media-server before commit 3e0f63f1d3553f75c7d4eb32fa7c7a1976a9ff84 in librtmp, allows attackers to cause a denial of service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ireader/media-server/issues/235
CVE ID: CVE-2022-40021 State: PUBLISHED Published: 2023-02-17T00:00:00.000Z Last Updated: 2025-03-18T16:10:51.780Z Vendors: n/a Products: n/a Problem Types: n/a Description: QVidium Technologies Amino A140 (prior to firmware version 1.0.0-283) was discovered to contain a command injection vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.securifera.com/advisories/CVE-2022-40021/
CVE ID: CVE-2022-40022 State: PUBLISHED Published: 2023-02-13T00:00:00.000Z Last Updated: 2025-03-21T18:36:12.024Z Vendors: n/a Products: n/a Problem Types: n/a Description: Microchip Technology (Microsemi) SyncServer S650 was discovered to contain a command injection vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.microsemi.com/document-portal/doc_download/135737-datasheet-syncserver-s650 - https://www.microsemi.com/campaigns/network-time-servers/syncserver-s600/?url= - https://www.microsemi.com/campaigns/network-time-servers/S650p/%3Fgd%3D1&id=5&gclid=Cj0KCQjwjbyYBhCdARIsAArC6LL-202ej5YfDB5lMIMSZ2735qjo5yaj2i-PrvLv2Cnh_kI
/network-time-servers/S650p/%3Fgd%3D1&id=5&gclid=Cj0KCQjwjbyYBhCdARIsAArC6LL-202ej5YfDB5lMIMSZ2735qjo5yaj2i-PrvLv2Cnh_kIJtFJ0oF8aAlMpEALw_wcB - https://www.securifera.com/advisories/CVE-2022-40022/ - http://packetstormsecurity.com/files/172907/Symmetricom-SyncServer-Unauthenticated-Remote-Command-Execution.html
CVE ID: CVE-2022-40023 State: PUBLISHED Published: 2022-09-07T00:00:00 Last Updated: 2024-08-03T12:07:43.228Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sqlalchemy mako before 1.2.2 is vulnerable to Regular expression Denial of Service when using the Lexer class to parse. This also affects babelplugin and linguaplugin. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sqlalchemy/mako/issues/366 - https://github.com/sqlalchemy/mako/commit/925760291d6efec64fda6e9dd1fd9cfbd5be068c - https://github.com/sqlalchemy/mako/blob/c2f392e0be52dc67d1b9770ab8cce6a9c736d547/mako/ext/extract.py#L21 - https://pyup.io/vulnerabilities/CVE-2022-40023/50870/ - ht
2e0be52dc67d1b9770ab8cce6a9c736d547/mako/ext/extract.py#L21 - https://pyup.io/vulnerabilities/CVE-2022-40023/50870/ - https://lists.debian.org/debian-lts-announce/2022/09/msg00026.html - https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages/
CVE ID: CVE-2022-40026 State: PUBLISHED Published: 2022-09-21T17:11:40.000Z Last Updated: 2025-05-28T13:43:03.867Z Vendors: n/a Products: n/a Problem Types: n/a Description: SourceCodester Simple Task Managing System v1.0 was discovered to contain a SQL injection vulnerability via the bookId parameter at board.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/xidaner/CVE_HUNTER/blob/main/CVE_09/2022-09-01-SQL1.md
CVE ID: CVE-2022-40027 State: PUBLISHED Published: 2022-09-21T17:11:41.000Z Last Updated: 2025-05-28T13:40:56.365Z Vendors: n/a Products: n/a Problem Types: n/a Description: SourceCodester Simple Task Managing System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component newTask.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the shortName parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://simple.com - https://www.sourcecodester.com/php/15624/simple-task-managing-system-php-mysqli-free-source-code.html - https://github.com/xidaner
w.sourcecodester.com/php/15624/simple-task-managing-system-php-mysqli-free-source-code.html - https://github.com/xidaner/CVE_HUNTER/blob/main/CVE_09/2022-09-01-XSS1.md
CVE ID: CVE-2022-40028 State: PUBLISHED Published: 2022-09-21T17:11:42.000Z Last Updated: 2025-05-28T13:37:56.966Z Vendors: n/a Products: n/a Problem Types: n/a Description: SourceCodester Simple Task Managing System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component newProjectValidation.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the fullName parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://simple.com - https://www.sourcecodester.com/php/15624/simple-task-managing-system-php-mysqli-free-source-code.html - https://github
- https://www.sourcecodester.com/php/15624/simple-task-managing-system-php-mysqli-free-source-code.html - https://github.com/xidaner/CVE_HUNTER/blob/main/CVE_09/2022-09-01-XSS2.md
CVE ID: CVE-2022-40029 State: PUBLISHED Published: 2022-09-21T17:11:43.000Z Last Updated: 2025-05-28T13:36:59.155Z Vendors: n/a Products: n/a Problem Types: n/a Description: SourceCodester Simple Task Managing System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component newProjectValidation.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the shortName parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://simple.com - https://www.sourcecodester.com/php/15624/simple-task-managing-system-php-mysqli-free-source-code.html - https://githu
- https://www.sourcecodester.com/php/15624/simple-task-managing-system-php-mysqli-free-source-code.html - https://github.com/xidaner/CVE_HUNTER/blob/main/CVE_09/2022-09-01-XSS3.md
CVE ID: CVE-2022-40030 State: PUBLISHED Published: 2022-09-21T17:11:44.000Z Last Updated: 2025-05-28T13:59:37.457Z Vendors: n/a Products: n/a Problem Types: n/a Description: SourceCodester Simple Task Managing System v1.0 was discovered to contain a SQL injection vulnerability via the bookId parameter at changeStatus.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://simple.com - https://www.sourcecodester.com/php/15624/simple-task-managing-system-php-mysqli-free-source-code.html - https://github.com/xidaner/CVE_HUNTER/blob/main/CVE_09/2022-09-01-SQL2.md
CVE ID: CVE-2022-40032 State: PUBLISHED Published: 2023-02-17T00:00:00.000Z Last Updated: 2025-03-18T16:09:53.363Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection vulnerability in Simple Task Managing System version 1.0 in login.php in 'username' and 'password' parameters, allows attackers to execute arbitrary code and gain sensitive information. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.sourcecodester.com/php/15624/simple-task-managing-system-php-mysqli-free-source-code.html - https://www.sourcecodester.com/sites/default/files/download/razormist/Task%20Managing%20System%20in%20PHP.zip - https://github.com/h
sourcecodester.com/sites/default/files/download/razormist/Task%20Managing%20System%20in%20PHP.zip - https://github.com/h4md153v63n/CVE-2022-40032_Simple-Task-Managing-System-V1.0-SQL-Injection-Vulnerability-Unauthenticated - http://packetstormsecurity.com/files/171739/Simple-Task-Managing-System-1.0-SQL-Injection.html
CVE ID: CVE-2022-40034 State: PUBLISHED Published: 2023-01-23T00:00:00.000Z Last Updated: 2025-04-03T14:30:20.790Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-Site Scripting (XSS) vulnerability found in Rawchen blog-ssm v1.0 allows attackers to execute arbitrary code via the 'notifyInfo' parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/rawchen/blog-ssm/issues/4
CVE ID: CVE-2022-40035 State: PUBLISHED Published: 2023-01-25T00:00:00.000Z Last Updated: 2025-04-01T15:25:46.545Z Vendors: n/a Products: n/a Problem Types: n/a Description: File Upload Vulnerability found in Rawchen Blog-ssm v1.0 allowing attackers to execute arbitrary commands and gain escalated privileges via the /uploadFileList component. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/rawchen/blog-ssm/issues/3
CVE ID: CVE-2022-40036 State: PUBLISHED Published: 2023-01-24T00:00:00.000Z Last Updated: 2025-04-02T14:59:36.888Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Rawchen blog-ssm v1.0 allows an attacker to obtain sensitive user information by bypassing permission checks via the /adminGetUserList component. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/rawchen/blog-ssm/issues/5
CVE ID: CVE-2022-40037 State: PUBLISHED Published: 2023-01-24T00:00:00.000Z Last Updated: 2025-04-02T14:58:26.059Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue discovered in Rawchen blog-ssm v1.0 allows remote attacker to escalate privileges and execute arbitrary commands via the component /upFile. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/rawchen/blog-ssm/issues/2
CVE ID: CVE-2022-40043 State: PUBLISHED Published: 2022-09-26T15:38:17.000Z Last Updated: 2025-05-21T15:16:24.176Z Vendors: n/a Products: n/a Problem Types: n/a Description: Centreon v20.10.18 was discovered to contain a SQL injection vulnerability via the esc_name (Escalation Name) parameter at Configuration/Notifications/Escalations. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/centreon/centreon/releases - https://www.hakaioffensivesecurity.com/centreon-sqli-and-xss-vulnerability/