Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-28783 State: PUBLISHED Published: 2022-05-03T19:40:36 Last Updated: 2024-08-03T06:03:52.620Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Samsung Mobile Products: Samsung Mobile Devices Problem Types: CWE-20 Description: Improper validation of removing package name in Galaxy Themes prior to SMR May-2022 Release 1 allows attackers to uninstall arbitrary packages without permission. The patch adds proper validation logic for removing package name. Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=5
CVE ID: CVE-2022-28784 State: PUBLISHED Published: 2022-05-03T19:41:01 Last Updated: 2024-08-03T06:03:52.605Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Samsung Mobile Products: Samsung Mobile Devices Problem Types: CWE-22 Description: Path traversal vulnerability in Galaxy Themes prior to SMR May-2022 Release 1 allows attackers to list file names in arbitrary directory as system user. The patch addresses incorrect implementation of file path validation check logic. Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=5
CVE ID: CVE-2022-28785 State: PUBLISHED Published: 2022-05-03T19:41:16 Last Updated: 2024-08-03T06:03:52.677Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Samsung Mobile Products: Samsung Mobile Devices Problem Types: CWE-125 Description: Improper buffer size check logic in aviextractor library prior to SMR May-2022 Release 1 allows out of bounds read leading to possible temporary denial of service. The patch adds buffer size check logic. Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=5
CVE ID: CVE-2022-28786 State: PUBLISHED Published: 2022-05-03T19:41:33 Last Updated: 2024-08-03T06:03:52.652Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Samsung Mobile Products: Samsung Mobile Devices Problem Types: CWE-125 Description: Improper buffer size check logic in aviextractor library prior to SMR May-2022 Release 1 allows out of bounds read leading to possible temporary denial of service. The patch adds buffer size check logic. Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=5
CVE ID: CVE-2022-28787 State: PUBLISHED Published: 2022-05-03T19:41:47 Last Updated: 2024-08-03T06:03:52.650Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Samsung Mobile Products: Samsung Mobile Devices Problem Types: CWE-125 Description: Improper buffer size check logic in wmfextractor library prior to SMR May-2022 Release 1 allows out of bounds read leading to possible temporary denial of service. The patch adds buffer size check logic. Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=5
CVE ID: CVE-2022-28788 State: PUBLISHED Published: 2022-05-03T19:42:02 Last Updated: 2024-08-03T06:03:52.687Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Samsung Mobile Products: Samsung Mobile Devices Problem Types: CWE-125 Description: Improper buffer size check logic in aviextractor library prior to SMR May-2022 Release 1 allows out of bounds read leading to possible temporary denial of service. The patch adds buffer size check logic. Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=5
CVE ID: CVE-2022-28789 State: PUBLISHED Published: 2022-05-03T19:42:17 Last Updated: 2024-08-03T06:03:52.664Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Samsung Mobile Products: Voice Note Problem Types: CWE-862 Description: Unprotected activities in Voice Note prior to version 21.3.51.11 allows attackers to record voice without user interaction. The patch adds proper permission for vulnerable activities. Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=5
CVE ID: CVE-2022-28790 State: PUBLISHED Published: 2022-05-03T19:42:38 Last Updated: 2024-08-03T06:03:52.724Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Samsung Mobile Products: Link to Windows Service Problem Types: CWE-287 Description: Improper authentication in Link to Windows Service prior to version 2.3.04.1 allows attacker to lock the device. The patch adds proper caller signature check logic. Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=5
CVE ID: CVE-2022-28791 State: PUBLISHED Published: 2022-05-03T19:43:31 Last Updated: 2024-08-03T06:03:52.581Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: Samsung Mobile Products: Galaxy Store Problem Types: CWE-20 Description: Improper input validation vulnerability in InstallAgent in Galaxy Store prior to version 4.5.41.8 allows attacker to overwrite files stored in a specific path. The patch adds proper protection to prevent overwrite to existing files. Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=5
CVE ID: CVE-2022-28792 State: PUBLISHED Published: 2022-05-03T19:43:47 Last Updated: 2024-08-03T06:03:52.776Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: Samsung Mobile Products: Gear IconX PC Manager Problem Types: CWE-427 Description: DLL hijacking vulnerability in Gear IconX PC Manager prior to version 2.1.220405.51 allows attacker to execute arbitrary code. The patch adds proper absolute path to prevent dll hijacking. Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=5
CVE ID: CVE-2022-28793 State: PUBLISHED Published: 2022-05-03T19:44:08 Last Updated: 2024-08-03T06:03:52.587Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N) Vendors: Samsung Mobile Products: Samsung Mobile Devices Problem Types: CWE-754 Description: Given the TEE is compromised and controlled by the attacker, improper state maintenance in StrongBox allows attackers to change Android ROT during device boot cycle after compromising TEE. The patch is applied in Galaxy S22 to prevent change of Android ROT after first initialization at boot time. Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/serviceWeb.smsb?year=2022&
onal Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=5
CVE ID: CVE-2022-28794 State: PUBLISHED Published: 2022-06-07T17:51:36 Last Updated: 2024-08-03T06:03:53.053Z Severity: LOW (CVSS 2.2 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N) Vendors: Samsung Mobile Products: Samsung Mobile Devices Problem Types: CWE-213 Description: Sensitive information exposure in low-battery dumpstate log prior to SMR Jun-2022 Release 1 allows local attackers to get SIM card information. Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=6
CVE ID: CVE-2022-28795 State: PUBLISHED Published: 2022-04-12T16:11:34 Last Updated: 2024-08-03T06:03:52.992Z Vendors: n/a Products: Avira Password Manager – Browser Extensions Problem Types: Sensitive Data Leakage Description: A vulnerability within the Avira Password Manager Browser Extensions provided a potential loophole where, if a user visited a page crafted by an attacker, the discovered vulnerability could trigger the Password Manager Extension to fill in the password field automatically. An attacker could then access this information via JavaScript. The issue was fixed with the browser extensions version 2.18.5 for Chrome, MS Edge, Opera, Firefox, and Safari. Additional Analyst Note
ixed with the browser extensions version 2.18.5 for Chrome, MS Edge, Opera, Firefox, and Safari. Additional Analyst Notes: - CVE Program Container: References: - https://support.norton.com/sp/static/external/tools/security-advisories.html
CVE ID: CVE-2022-28796 State: PUBLISHED Published: 2022-04-08T04:11:51 Last Updated: 2024-08-03T06:03:52.967Z Vendors: n/a Products: n/a Problem Types: n/a Description: jbd2_journal_wait_updates in fs/jbd2/transaction.c in the Linux kernel before 5.17.1 has a use-after-free caused by a transaction_t race condition. Additional Analyst Notes: - CVE Program Container: References: - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.17.1 - https://github.com/torvalds/linux/commit/cc16eecae687912238ee6efbff71ad31e2bc414e - https://security.netapp.com/advisory/ntap-20220506-0006/
CVE ID: CVE-2022-28799 State: PUBLISHED Published: 2022-05-30T13:46:19 Last Updated: 2024-08-03T06:03:53.125Z Vendors: n/a Products: n/a Problem Types: n/a Description: The TikTok application before 23.7.3 for Android allows account takeover. A crafted URL (unvalidated deeplink) can force the com.zhiliaoapp.musically WebView to load an arbitrary website. This may allow an attacker to leverage an attached JavaScript interface for the takeover with one click. Additional Analyst Notes: - CVE Program Container: References: - https://support.tiktok.com/en/safety-hc/reporting-security-vulnerabilities/reporting-the-security-vulnerabilities - https://hackerone.com/reports/1500614 - https://github.co
urity-vulnerabilities/reporting-the-security-vulnerabilities - https://hackerone.com/reports/1500614 - https://github.com/Ch0pin/security-advisories/security/advisories/GHSA-v39p-88q5-5cvr
CVE ID: CVE-2022-28802 State: PUBLISHED Published: 2022-09-21T19:46:28.000Z Last Updated: 2025-05-27T20:10:19.291Z Vendors: n/a Products: n/a Problem Types: n/a Description: Code by Zapier before 2022-08-17 allowed intra-account privilege escalation that included execution of Python or JavaScript code. In other words, Code by Zapier was providing a customer-controlled general-purpose virtual machine that unintentionally granted full access to all users of a company's account, but was supposed to enforce role-based access control within that company's account. Before 2022-08-17, a customer could have resolved this by (in effect) using a separate virtual machine for an application that held cr
-17, a customer could have resolved this by (in effect) using a separate virtual machine for an application that held credentials - or other secrets - that weren't supposed to be shared among all of its employees. (Multiple accounts would have been needed to operate these independent virtual machines.) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.zenity.io/blog/zapescape-organization-wide-control-over-code-by-zapier/ - https://www.zenity.io/blog/zapescape-vulnerability-disclosure/
CVE ID: CVE-2022-28803 State: PUBLISHED Published: 2022-06-29T00:50:16 Last Updated: 2024-08-03T06:03:52.992Z Vendors: n/a Products: n/a Problem Types: n/a Description: In SilverStripe Framework through 2022-04-07, Stored XSS can occur in javascript link tags added via XMLHttpRequest (XHR). Additional Analyst Notes: - CVE Program Container: References: - https://silverstripe.org - https://www.silverstripe.org/download/security-releases/cve-2022-28803
CVE ID: CVE-2022-28805 State: PUBLISHED Published: 2022-04-08T00:00:00 Last Updated: 2024-08-03T06:03:53.085Z Vendors: n/a Products: n/a Problem Types: n/a Description: singlevar in lparser.c in Lua from (including) 5.4.0 up to (excluding) 5.4.4 lacks a certain luaK_exp2anyregup call, leading to a heap-based buffer over-read that might affect a system that compiles untrusted Lua code. Additional Analyst Notes: - CVE Program Container: References: - https://lua-users.org/lists/lua-l/2022-02/msg00001.html - https://lua-users.org/lists/lua-l/2022-02/msg00070.html - https://lua-users.org/lists/lua-l/2022-04/msg00009.html - https://github.com/lua/lua/commit/1f3c6f4534c6411313361697d98d1145a1f030f
-users.org/lists/lua-l/2022-04/msg00009.html - https://github.com/lua/lua/commit/1f3c6f4534c6411313361697d98d1145a1f030fa - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RJNJ66IFDUKWJJZXHGOLRGIA3HWWC36R/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UHYZOEFDVLVAD6EEP4CDW6DNONIVVHPA/ - https://security.gentoo.org/glsa/202305-23
CVE ID: CVE-2022-28806 State: PUBLISHED Published: 2022-05-04T14:10:18.000Z Last Updated: 2025-11-04T19:13:03.588Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on certain Fujitsu LIEFBOOK devices (A3510, U9310, U7511/U7411/U7311, U9311, E5510/E5410, U7510/U7410/U7310, E459/E449) with BIOS versions before v1.09 (A3510), v2.17 (U9310), v2.30 (U7511/U7411/U7311), v2.33 (U9311), v2.23 (E5510), v2.19 (U7510/U7410), v2.13 (U7310), and v1.09 (E459/E449). The FjGabiFlashCoreAbstractionSmm driver registers a Software System Management Interrupt (SWSMI) handler that is not sufficiently validated to ensure that the CommBuffer (or any other communication buffer's ne
(SWSMI) handler that is not sufficiently validated to ensure that the CommBuffer (or any other communication buffer's nested contents) are not pointing to SMRAM contents. A potential attacker can therefore write fixed data to SMRAM, which could lead to data corruption inside this memory (e.g., change the SMI handler's code or modify SMRAM map structures to break input pointer validation for other SMI handlers). Thus, the attacker could elevate privileges from ring 0 to ring -2 and execute arbitrary code in SMM. Additional Analyst Notes: - CVE Program Container: References: - https://www.binarly.io/advisories - https://kb.cert.org/vuls/id/796611 - https://support.ts.fujitsu.com/ProductSecurit
- https://www.binarly.io/advisories - https://kb.cert.org/vuls/id/796611 - https://support.ts.fujitsu.com/ProductSecurity/content/Fujitsu-PSIRT-FCCL-IS-2021-090903-Security-Advisory.asp - http://www.fmworld.net/biz/common/insyde/20220210/
CVE ID: CVE-2022-28807 State: PUBLISHED Published: 2022-07-17T22:18:34 Last Updated: 2024-08-03T06:03:53.076Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Open Design Alliance Drawings SDK before 2023.2. An Out-of-Bounds Read vulnerability exists when rendering a .dwg file after it's opened in the recovery mode. An attacker can leverage this vulnerability to execute code in the context of the current process. Additional Analyst Notes: - CVE Program Container: References: - https://www.opendesign.com/security-advisories
CVE ID: CVE-2022-28808 State: PUBLISHED Published: 2022-07-17T22:19:05 Last Updated: 2024-08-03T06:03:53.157Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Open Design Alliance Drawings SDK before 2023.3. An Out-of-Bounds Read vulnerability exists when reading DWG files in a recovery mode. An attacker can leverage this vulnerability to execute code in the context of the current process. Additional Analyst Notes: - CVE Program Container: References: - https://www.opendesign.com/security-advisories
CVE ID: CVE-2022-28809 State: PUBLISHED Published: 2022-07-17T22:21:58 Last Updated: 2024-08-03T06:03:53.046Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Open Design Alliance Drawings SDK before 2023.3. An Out-of-Bounds Read vulnerability exists when reading a DWG file with an invalid vertex number in a recovery mode. An attacker can leverage this vulnerability to execute code in the context of the current process. Additional Analyst Notes: - CVE Program Container: References: - https://www.opendesign.com/security-advisories
CVE ID: CVE-2022-28810 State: PUBLISHED Published: 2022-04-18T12:22:59.000Z Last Updated: 2025-10-21T23:15:41.530Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine ADSelfService Plus before build 6122 allows a remote authenticated administrator to execute arbitrary operating OS commands as SYSTEM via the policy custom script feature. Due to the use of a default administrator password, attackers may be able to abuse this functionality with minimal effort. Additionally, a remote and partially authenticated attacker may be able to inject arbitrary commands into the custom script due to an unsanitized password field. Additional Analyst Notes: - CVE Program Container:
ommands into the custom script due to an unsanitized password field. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.manageengine.com/products/self-service-password/kb/cve-2022-28810.html - http://packetstormsecurity.com/files/166816/ManageEngine-ADSelfService-Plus-Custom-Script-Execution.html - https://github.com/rapid7/metasploit-framework/pull/16475 - https://www.rapid7.com/blog/post/2022/04/14/cve-2022-28810-manageengine-adselfservice-plus-authenticated-command-execution-fixed/
CVE ID: CVE-2022-28811 State: PUBLISHED Published: 2022-09-28T13:45:32.000Z Last Updated: 2025-05-21T14:34:10.950Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Carlo Gavazzi Products: UWP 3.0 Monitoring Gateway and Controller, UWP 3.0 Monitoring Gateway and Controller – Security Enhanced, UWP 3.0 Monitoring Gateway and Controller – EDP version, CPY Car Park Server Problem Types: CWE-78 Description: In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 a remote, unauthenticated attacker could utilize an improper input validation on an API-submitted parameter to execute arbitrary OS commands. Additional Analyst Notes: - CVE
mproper input validation on an API-submitted parameter to execute arbitrary OS commands. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert.vde.com/en/advisories/VDE-2022-029/
CVE ID: CVE-2022-28812 State: PUBLISHED Published: 2022-09-28T13:45:33.000Z Last Updated: 2025-05-20T20:35:08.654Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Carlo Gavazzi Products: UWP 3.0 Monitoring Gateway and Controller, UWP 3.0 Monitoring Gateway and Controller – Security Enhanced, UWP 3.0 Monitoring Gateway and Controller – EDP version, CPY Car Park Server Problem Types: CWE-798 Description: In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 a remote, unauthenticated attacker could make use of hard-coded credentials to gain SuperUser access to the device. Additional Analyst Notes: - CVE Program Container: - CIS
hard-coded credentials to gain SuperUser access to the device. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert.vde.com/en/advisories/VDE-2022-029/
CVE ID: CVE-2022-28813 State: PUBLISHED Published: 2022-09-28T00:00:00.000Z Last Updated: 2025-05-21T14:58:20.935Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Carlo Gavazzi Products: UWP 3.0 Monitoring Gateway and Controller, UWP 3.0 Monitoring Gateway and Controller – Security Enhanced, UWP 3.0 Monitoring Gateway and Controller – EDP version, CPY Car Park Server Problem Types: CWE-89 Description: In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 a remote, unauthenticated attacker could make use of an SQL-injection to gain access to a volatile temporary database with the current states of the device. Additional Analyst N
QL-injection to gain access to a volatile temporary database with the current states of the device. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert.vde.com/en/advisories/VDE-2022-029/
CVE ID: CVE-2022-28814 State: PUBLISHED Published: 2022-09-28T13:45:35.000Z Last Updated: 2025-05-20T20:35:41.068Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Carlo Gavazzi Products: UWP 3.0 Monitoring Gateway and Controller, UWP 3.0 Monitoring Gateway and Controller – Security Enhanced, UWP 3.0 Monitoring Gateway and Controller – EDP version, CPY Car Park Server Problem Types: CWE-23 Description: Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 was discovered to be vulnerable to a relative path traversal vulnerability which enables remote attackers to read arbitrary files and gain full control of the device. Additiona
rsal vulnerability which enables remote attackers to read arbitrary files and gain full control of the device. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert.vde.com/en/advisories/VDE-2022-029/
CVE ID: CVE-2022-28815 State: PUBLISHED Published: 2022-09-28T13:45:36.000Z Last Updated: 2025-05-20T20:36:22.425Z Severity: LOW (CVSS 2.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N) Vendors: Carlo Gavazzi Products: UWP 3.0 Monitoring Gateway and Controller, UWP 3.0 Monitoring Gateway and Controller – Security Enhanced, UWP 3.0 Monitoring Gateway and Controller – EDP version, CPY Car Park Server Problem Types: CWE-89 Description: In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 the Sentilo Proxy server was discovered to contain a SQL injection vulnerability allowing an attacker to query other tables of the Sentilo service. Additional Analyst Notes: - CV
njection vulnerability allowing an attacker to query other tables of the Sentilo service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert.vde.com/en/advisories/VDE-2022-029/
CVE ID: CVE-2022-28816 State: PUBLISHED Published: 2022-09-28T13:45:37.000Z Last Updated: 2025-05-20T20:36:50.107Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Carlo Gavazzi Products: UWP 3.0 Monitoring Gateway and Controller, UWP 3.0 Monitoring Gateway and Controller – Security Enhanced, UWP 3.0 Monitoring Gateway and Controller – EDP version, CPY Car Park Server Problem Types: CWE-79 Description: In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 the Sentilo Proxy is prone to reflected XSS which only affects the Sentilo service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - h
affects the Sentilo service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert.vde.com/en/advisories/VDE-2022-029/
CVE ID: CVE-2022-28817 State: REJECTED Published: 2022-08-23T09:55:55 Last Updated: 2022-08-23T09:55:54 Description: No description available.
CVE ID: CVE-2022-28818 State: PUBLISHED Published: 2022-05-12T18:59:12.804571Z Last Updated: 2024-09-16T17:54:20.583Z Severity: MEDIUM (CVSS 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Adobe Products: ColdFusion Problem Types: CWE-79 Description: ColdFusion versions CF2021U3 (and earlier) and CF2018U13 are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser. Additional Analyst Notes: - CVE Program Container: References: - https://helpx.adobe.com/security/products/coldfusion/apsb22-22.html
CVE ID: CVE-2022-28819 State: PUBLISHED Published: 2022-05-12T18:55:48.241Z Last Updated: 2025-04-23T18:27:00.899Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Character Animator Problem Types: CWE-787 Description: Adobe Character Animator versions 4.4.2 (and earlier) and 22.3 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious SVG file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/securi