Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-29827 State: PUBLISHED Published: 2022-11-24T23:22:43.489Z Last Updated: 2025-04-25T17:51:32.509Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: Mitsubishi Electric Corporation Products: GX Works3 Problem Types: CWE-321 Description: Use of Hard-coded Cryptographic Key vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A and later allows a remote unauthenticated attacker to disclose sensitive information. As a result, unauthenticated attackers may view programs and project files or execute programs illegally. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mitsubishielectri
Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-015_en.pdf - https://jvn.jp/vu/JVNVU97244961/index.html - https://www.cisa.gov/uscert/ics/advisories/icsa-22-333-05
CVE ID: CVE-2022-29828 State: PUBLISHED Published: 2022-11-24T23:23:04.141Z Last Updated: 2025-04-25T17:51:05.762Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: Mitsubishi Electric Corporation Products: GX Works3 Problem Types: CWE-321 Description: Use of Hard-coded Cryptographic Key vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A and later allows a remote unauthenticated attacker to disclose sensitive information. As a result, unauthenticated attackers may view programs and project file or execute programs illegally. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mitsubishielectric
CVE ID: CVE-2022-29829 State: PUBLISHED Published: 2022-11-24T23:23:31.959Z Last Updated: 2025-11-07T06:49:58.053Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: Mitsubishi Electric Corporation Products: GX Works3, GT Designer3 Version1 (GOT2000), Motion Control Setting(GX Works3 related software), MT Works2 Problem Types: CWE-321 Description: Use of Hard-coded Cryptographic Key vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A to 1.090U, GT Designer3 Version1 (GOT2000) versions from 1.122C to 1.290C, Motion Control Setting(GX Works3 related software) versions from 1.035M to 1.042U, and MT Works2 versions from 1.100E to 1.200J allows a rem
ng(GX Works3 related software) versions from 1.035M to 1.042U, and MT Works2 versions from 1.100E to 1.200J allows a remote unauthenticated attacker to disclose sensitive information. As a result, unauthenticated users may view programs and project files or execute programs illegally. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-015_en.pdf - https://jvn.jp/vu/JVNVU97244961/index.html - https://www.cisa.gov/uscert/ics/advisories/icsa-22-333-05
CVE ID: CVE-2022-29830 State: PUBLISHED Published: 2022-11-24T23:23:51.967Z Last Updated: 2025-11-07T06:50:28.850Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: Mitsubishi Electric Corporation Products: GX Works3, Motion Control Setting(GX Works3 related software) Problem Types: CWE-321 Description: Use of Hard-coded Cryptographic Key vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A to 1.095Z, and Motion Control Setting(GX Works3 related software) versions from 1.000A to 1.065T allows a remote unauthenticated attacker to disclose or tamper with sensitive information. As a result, unauthenticated attackers may obtain information about p
to disclose or tamper with sensitive information. As a result, unauthenticated attackers may obtain information about project files illegally. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-015_en.pdf - https://jvn.jp/vu/JVNVU97244961/index.html - https://www.cisa.gov/uscert/ics/advisories/icsa-22-333-05
CVE ID: CVE-2022-29831 State: PUBLISHED Published: 2022-11-24T23:36:18.688Z Last Updated: 2025-04-25T17:50:05.829Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Mitsubishi Electric Corporation Products: GX Works3 Problem Types: CWE-259 Description: Use of Hard-coded Password vulnerability in Mitsubishi Electric Corporation GX Works3 versions from 1.015R to 1.095Z allows a remote unauthenticated attacker to obtain information about the project file for MELSEC safety CPU modules. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-015_en.pdf - https://jvn.j
ulnrichment: References: - https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-015_en.pdf - https://jvn.jp/vu/JVNVU97244961 - https://www.cisa.gov/uscert/ics/advisories/icsa-22-333-05
CVE ID: CVE-2022-29832 State: PUBLISHED Published: 2022-11-24T23:37:41.044Z Last Updated: 2025-04-25T17:36:39.764Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Mitsubishi Electric Corporation Products: GX Works3, GX Works2, GX Developer Problem Types: CWE-316 Description: Cleartext Storage of Sensitive Information in Memory vulnerability in Mitsubishi Electric Corporation GX Works3 versions 1.015R and later, GX Works2 all versions and GX Developer versions 8.40S and later allows a remote unauthenticated attacker to disclose sensitive information. As a result, unauthenticated users could obtain information about the project file for MELSEC safety CPU modules
ation. As a result, unauthenticated users could obtain information about the project file for MELSEC safety CPU modules or project file for MELSEC Q/FX/L series with security setting. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-015_en.pdf - https://jvn.jp/vu/JVNVU97244961 - https://www.cisa.gov/uscert/ics/advisories/icsa-22-333-05
CVE ID: CVE-2022-29833 State: PUBLISHED Published: 2022-11-24T23:38:06.033Z Last Updated: 2025-04-25T17:35:54.773Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N) Vendors: Mitsubishi Electric Corporation Products: GX Works3 Problem Types: CWE-522 Description: Insufficiently Protected Credentials vulnerability in Mitsubishi Electric Corporation GX Works3 versions 1.015R and later allows a remote unauthenticated attacker to disclose sensitive information. As a result, unauthenticated users could access to MELSEC safety CPU modules illgally. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mitsubishielectric.com/en/ps
Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-015_en.pdf - https://jvn.jp/vu/JVNVU97244961 - https://www.cisa.gov/uscert/ics/advisories/icsa-22-333-05
CVE ID: CVE-2022-29834 State: PUBLISHED Published: 2022-07-20T16:48:46 Last Updated: 2024-08-03T06:33:42.679Z Vendors: n/a Products: ICONICS GENESIS64 Problem Types: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ICONICS GENESIS64 versions 10.97 to 10.97.1 allows a remote unauthenticated attacker to access to arbitrary files in the GENESIS64 server and disclose information stored in the files by embedding a malicious URL parameter in the URL of the monitoring screen delivered to the GENESIS64 mobile monitoring application and accessing the monitoring sc
he URL of the monitoring screen delivered to the GENESIS64 mobile monitoring application and accessing the monitoring screen. Additional Analyst Notes: - CVE Program Container: References: - https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-008_en.pdf - https://jvn.jp/vu/JVNVU96480474/index.html
CVE ID: CVE-2022-29835 State: PUBLISHED Published: 2022-09-19T19:43:53 Last Updated: 2024-08-03T06:33:42.851Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: Western Digital Products: WD Discovery Problem Types: CWE-328 Description: WD Discovery software executable files were signed with an unsafe SHA-1 hashing algorithm. An attacker could use this weakness to create forged certificate signatures due to the use of a hashing algorithm that is not collision-free. This could thereby impact the confidentiality of user content. This issue affects: Western Digital WD Discovery WD Discovery Desktop App versions prior to 4.4.396 on Mac; WD Discovery Desktop App vers
s: Western Digital WD Discovery WD Discovery Desktop App versions prior to 4.4.396 on Mac; WD Discovery Desktop App versions prior to 4.4.396 on Windows. Additional Analyst Notes: - CVE Program Container: References: - https://www.westerndigital.com/support/product-security/wdc-22014-wd-discovery-desktop-app-version-4-4-396
CVE ID: CVE-2022-29836 State: PUBLISHED Published: 2022-11-09T00:00:00.000Z Last Updated: 2025-05-01T13:39:39.152Z Severity: LOW (CVSS 1.9 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N) Vendors: Western Digital, SanDisk Products: My Cloud Home, ibi Problem Types: CWE-22 Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability was discovered via an HTTP API on Western Digital My Cloud Home; My Cloud Home Duo; and SanDisk ibi devices that could allow an attacker to abuse certain parameters to point to random locations on the file system. This could also allow the attacker to initiate the installation of custom packages at these locations. This ca
e system. This could also allow the attacker to initiate the installation of custom packages at these locations. This can only be exploited once the attacker has been authenticated to the device. This issue affects: Western Digital My Cloud Home and My Cloud Home Duo versions prior to 8.11.0-113 on Linux; SanDisk ibi versions prior to 8.11.0-113 on Linux. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.westerndigital.com/support/product-security/wdc-22016-my-cloud-home-ibi-firmware-version-8-11-0-113
CVE ID: CVE-2022-29837 State: PUBLISHED Published: 2022-12-01T00:00:00.000Z Last Updated: 2025-04-24T20:12:31.109Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: Western Digital, SanDisk Products: My Cloud Home, ibi Problem Types: CWE-22 Description: A path traversal vulnerability was addressed in Western Digital My Cloud Home, My Cloud Home Duo and SanDisk ibi which could allow an attacker to initiate installation of custom ZIP packages and overwrite system files. This could potentially lead to a code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.westerndigital.com/support/product-security/
- CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.westerndigital.com/support/product-security/wdc-22018-western-digital-my-cloud-home-my-cloud-home-duo-and-sandisk-ibi-firmware-version-8-12-0-178
CVE ID: CVE-2022-29838 State: PUBLISHED Published: 2022-12-09T00:00:00.000Z Last Updated: 2025-04-23T14:15:52.043Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: Western Digital Products: My Cloud Problem Types: CWE-287 Description: Improper Authentication vulnerability in the encrypted volumes and auto mount features of Western Digital My Cloud devices allows insecure direct access to the drive information in the case of a device reset. This issue affects: Western Digital My Cloud My Cloud versions prior to 5.25.124 on Linux. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.westerndigital.com/support/pro
nalyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.westerndigital.com/support/product-security/wdc-22019-my-cloud-firmware-version-5-25-124
CVE ID: CVE-2022-29839 State: PUBLISHED Published: 2022-12-09T00:00:00.000Z Last Updated: 2025-04-22T19:44:49.073Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: Western Digital Products: My Cloud Problem Types: CWE-522 Description: Insufficiently Protected Credentials vulnerability in the remote backups application on Western Digital My Cloud devices that could allow an attacker who has gained access to a relevant endpoint to use that information to access protected data. This issue affects: Western Digital My Cloud My Cloud versions prior to 5.25.124 on Linux. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https:
r to 5.25.124 on Linux. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.westerndigital.com/support/product-security/wdc-22019-my-cloud-firmware-version-5-25-124
CVE ID: CVE-2022-29840 State: PUBLISHED Published: 2023-05-10T22:09:28.939Z Last Updated: 2025-01-24T21:01:46.538Z Severity: MEDIUM (CVSS 5.1 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: Western Digital Products: My Cloud OS 5 Problem Types: CWE-918 Description: Server-Side Request Forgery (SSRF) vulnerability that could allow a rogue server on the local network to modify its URL to point back to the loopback adapter was addressed in Western Digital My Cloud OS 5 devices. This could allow the URL to exploit other vulnerabilities on the local server.This issue affects My Cloud OS 5 devices before 5.26.202. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: R
cts My Cloud OS 5 devices before 5.26.202. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.westerndigital.com/support/product-security/wdc-23006-my-cloud-firmware-version-5-26-202
CVE ID: CVE-2022-29841 State: PUBLISHED Published: 2023-05-10T21:04:49.083Z Last Updated: 2025-01-24T21:01:04.089Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Western Digital Products: My Cloud OS 5 Problem Types: CWE-78 Description: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that was caused by a command that read files from a privileged location and created a system command without sanitizing the read data. This command could be triggered by an attacker remotely to cause code execution and gain a reverse shell in Western Digital My Cloud OS 5 devices.This issue affects My Cloud OS 5: before 5.26.
ecution and gain a reverse shell in Western Digital My Cloud OS 5 devices.This issue affects My Cloud OS 5: before 5.26.119. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.westerndigital.com/support/product-security/wdc-23002-my-cloud-firmware-version-5-26-119
CVE ID: CVE-2022-29842 State: PUBLISHED Published: 2023-05-10T20:53:19.844Z Last Updated: 2025-01-24T21:00:19.549Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Western Digital Products: My Cloud OS 5 Problem Types: CWE-77 Description: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability that could allow an attacker to execute code in the context of the root user on a vulnerable CGI file was discovered in Western Digital My Cloud OS 5 devicesThis issue affects My Cloud OS 5: before 5.26.119. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.westerndigital.com
Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.westerndigital.com/support/product-security/wdc-23002-my-cloud-firmware-version-5-26-119
CVE ID: CVE-2022-29843 State: PUBLISHED Published: 2023-01-25T00:00:00.000Z Last Updated: 2025-04-04T20:33:03.268Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Western Digital Products: My Cloud Problem Types: CWE-78 Description: A command injection vulnerability in the DDNS service configuration of Western Digital My Cloud OS 5 devices running firmware versions prior to 5.26.119 allows an attacker to execute code in the context of the root user. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.westerndigital.com/en-in/support/product-security/wdc-23002-my-cloud-firmware-version-5-26-119
CVE ID: CVE-2022-29844 State: PUBLISHED Published: 2023-01-25T00:00:00.000Z Last Updated: 2025-04-04T20:31:50.811Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: Western Digital Products: My Cloud Problem Types: CWE-23 Description: A vulnerability in the FTP service of Western Digital My Cloud OS 5 devices running firmware versions prior to 5.26.119 allows an attacker to read and write arbitrary files. This could lead to a full NAS compromise and would give remote execution capabilities to the attacker. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.westerndigital.com/en-in/support/product-security/wdc-
ram Container: - CISA ADP Vulnrichment: References: - https://www.westerndigital.com/en-in/support/product-security/wdc-23002-my-cloud-firmware-version-5-26-119
CVE ID: CVE-2022-29845 State: PUBLISHED Published: 2022-05-11T17:55:49 Last Updated: 2024-08-03T06:33:42.817Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Progress Ipswitch WhatsUp Gold 21.1.0 through 21.1.1, and 22.0.0, it is possible for an authenticated user to invoke an API transaction that would allow them to read the contents of a local file. Additional Analyst Notes: - CVE Program Container: References: - https://www.progress.com/network-monitoring - https://community.progress.com/s/article/WhatsUp-Gold-Critical-Product-Alert-May-2022
CVE ID: CVE-2022-29846 State: PUBLISHED Published: 2022-05-11T17:55:55 Last Updated: 2024-08-03T06:33:42.860Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Progress Ipswitch WhatsUp Gold 16.1 through 21.1.1, and 22.0.0, it is possible for an unauthenticated attacker to obtain the WhatsUp Gold installation serial number. Additional Analyst Notes: - CVE Program Container: References: - https://www.progress.com/network-monitoring - https://community.progress.com/s/article/WhatsUp-Gold-Critical-Product-Alert-May-2022
CVE ID: CVE-2022-29847 State: PUBLISHED Published: 2022-05-11T17:56:00 Last Updated: 2024-08-03T06:33:42.846Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Progress Ipswitch WhatsUp Gold 21.0.0 through 21.1.1, and 22.0.0, it is possible for an unauthenticated attacker to invoke an API transaction that would allow them to relay encrypted WhatsUp Gold user credentials to an arbitrary host. Additional Analyst Notes: - CVE Program Container: References: - https://www.progress.com/network-monitoring - https://community.progress.com/s/article/WhatsUp-Gold-Critical-Product-Alert-May-2022
CVE ID: CVE-2022-29848 State: PUBLISHED Published: 2022-05-11T17:56:07 Last Updated: 2024-08-03T06:33:42.886Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Progress Ipswitch WhatsUp Gold 17.0.0 through 21.1.1, and 22.0.0, it is possible for an authenticated user to invoke an API transaction that would allow them to read sensitive operating-system attributes from a host that is accessible by the WhatsUp Gold system. Additional Analyst Notes: - CVE Program Container: References: - https://www.progress.com/network-monitoring - https://community.progress.com/s/article/WhatsUp-Gold-Critical-Product-Alert-May-2022
CVE ID: CVE-2022-29849 State: PUBLISHED Published: 2022-05-01T23:23:33 Last Updated: 2024-08-03T06:33:42.852Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Progress OpenEdge before 11.7.14 and 12.x before 12.2.9, certain SUID binaries within the OpenEdge application were susceptible to privilege escalation. If exploited, a local attacker could elevate their privileges and compromise the affected system. Additional Analyst Notes: - CVE Program Container: References: - https://www.progress.com/openedge - https://community.progress.com/s/article/Remediation-of-Privilege-Escalation-Security-Vulnerability-CVE-2022-29849 - https://community.progress.com/s/article/OpenEdge-12-2-9-Up
Privilege-Escalation-Security-Vulnerability-CVE-2022-29849 - https://community.progress.com/s/article/OpenEdge-12-2-9-Update-is-available - https://community.progress.com/s/article/OpenEdge-11-7-14-is-Now-Available
CVE ID: CVE-2022-29850 State: PUBLISHED Published: 2022-08-25T23:11:48 Last Updated: 2024-08-03T06:33:42.933Z Vendors: n/a Products: n/a Problem Types: n/a Description: Various Lexmark products through 2022-04-27 allow an attacker who has already compromised an affected Lexmark device to maintain persistence across reboots. Additional Analyst Notes: - CVE Program Container: References: - https://support.lexmark.com/alerts/ - https://publications.lexmark.com/publications/security-alerts/CVE-2022-29850.pdf - https://www.lexmark.com/en_us/solutions/security/lexmark-security-advisories.html
CVE ID: CVE-2022-29851 State: PUBLISHED Published: 2022-10-24T20:35:00.000Z Last Updated: 2025-05-07T14:08:49.894Z Vendors: n/a Products: n/a Problem Types: n/a Description: documentconverter in OX App Suite through 7.10.6, in a non-default configuration with ghostscript, allows OS Command Injection because file conversion may occur for an EPS document that is disguised as a PDF document. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://packetstormsecurity.com/files/168242/OX-App-Suite-Cross-Site-Scripting-Command-Injection.html
CVE ID: CVE-2022-29852 State: PUBLISHED Published: 2022-12-26T00:00:00.000Z Last Updated: 2025-04-14T18:28:27.517Z Vendors: n/a Products: n/a Problem Types: n/a Description: OX App Suite through 8.2 allows XSS because BMFreehand10 and image/x-freehand are not blocked. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://open-xchange.com - https://seclists.org/fulldisclosure/2022/Sep/0
CVE ID: CVE-2022-29853 State: PUBLISHED Published: 2022-12-26T00:00:00.000Z Last Updated: 2025-04-14T18:27:59.904Z Vendors: n/a Products: n/a Problem Types: n/a Description: OX App Suite through 8.2 allows XSS via a certain complex hierarchy that forces use of Show Entire Message for a huge HTML e-mail message. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://open-xchange.com - https://seclists.org/fulldisclosure/2022/Sep/0
CVE ID: CVE-2022-29854 State: PUBLISHED Published: 2022-05-13T13:12:13 Last Updated: 2024-08-03T06:33:42.959Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability in Mitel 6900 Series IP (MiNet) phones excluding 6970, versions 1.8 (1.8.0.12) and earlier, could allow a unauthenticated attacker with physical access to the phone to gain root access due to insufficient access control for test functionality during system startup. A successful exploit could allow access to sensitive information and code execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.mitel.com/support/security-advisories - https://www.mitel.com/support/security-advisori
ainer: References: - https://www.mitel.com/support/security-advisories - https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-22-0003 - https://www.syss.de/pentest-blog/undocumented-functionality-backdoor-in-mitel-desk-phones-syss-2022-021 - http://seclists.org/fulldisclosure/2022/Jun/32 - http://packetstormsecurity.com/files/167547/Mitel-6800-6900-Series-SIP-Phones-Backdoor-Access.html