Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-42452 State: PUBLISHED Published: 2023-03-30T20:37:43.755Z Last Updated: 2025-02-12T14:55:27.554Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: HCL Software Products: HCL Launch Problem Types: n/a Description: HCL Launch is vulnerable to HTML injection. HTML code is stored and included without being sanitized. This can lead to further attacks such as XSS and Open Redirections. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0102081
CVE ID: CVE-2022-42453 State: PUBLISHED Published: 2022-12-17T19:03:24.947Z Last Updated: 2025-04-17T15:07:35.259Z Severity: MEDIUM (CVSS 6.9 CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:N) Vendors: HCL Software Products: BigFix Platform Problem Types: n/a Description: There are insufficient warnings when a Fixlet is imported by a user. The warning message currently assumes the owner of the script is the logged in user, with insufficient warnings when attempting to run the script. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0102049
CVE ID: CVE-2022-42454 State: PUBLISHED Published: 2022-12-19T21:10:13.991Z Last Updated: 2025-04-16T18:24:00.436Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: HCL Software Products: BigFix Insights for Vulnerability Remediation Problem Types: n/a Description: Insights for Vulnerability Remediation (IVR) is vulnerable to man-in-the-middle attacks that may lead to information disclosure. This requires privileged network access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0102168
CVE ID: CVE-2022-42455 State: PUBLISHED Published: 2023-02-15T00:00:00.000Z Last Updated: 2025-03-19T18:00:16.253Z Vendors: n/a Products: n/a Problem Types: n/a Description: ASUS EC Tool driver (aka d.sys) 1beb15c90dcf7a5234ed077833a0a3e900969b60be1d04fcebce0a9f8994bdbb, as signed by ASUS and shipped with multiple ASUS software products, contains multiple IOCTL handlers that provide raw read and write access to port I/O and MSRs via unprivileged IOCTL calls. Local users can gain privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2023/MNDT-2023-0003.md
CVE ID: CVE-2022-42457 State: PUBLISHED Published: 2022-10-06T00:00:00 Last Updated: 2024-08-03T13:10:40.910Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:H/S:C/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: Generex CS141 through 2.10 allows remote command execution by administrators via a web interface that reaches run_update in /usr/bin/gxserve-update.sh (e.g., command execution can occur via a reverse shell installed by install.sh). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/hubertfarnsworth12/Generex-CS141-Authenticated-Remote-Command-Execution - https://www.generex.de/products/ups/ - https://www.generex.de/supp
enerex-CS141-Authenticated-Remote-Command-Execution - https://www.generex.de/products/ups/ - https://www.generex.de/support/downloads/ups/cs141 - https://www.generex.de/support/downloads/ups/cs141/update - https://github.dev/hubertfarnsworth12/Generex-CS141-Authenticated-Remote-Command-Execution
CVE ID: CVE-2022-42458 State: PUBLISHED Published: 2022-12-07T00:00:00.000Z Last Updated: 2025-04-23T14:22:12.681Z Vendors: Shift Tech Inc. Products: bingo!CMS Problem Types: Authentication Bypass Using an Alternate Path or Channel Description: Authentication bypass using an alternate path or channel vulnerability in bingo!CMS version1.7.4.1 and earlier allows a remote unauthenticated attacker to upload an arbitrary file. As a result, an arbitrary script may be executed and/or a file may be altered. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.bingo-cms.jp/information/20221011.html - https://jvn.jp/en/jp/JVN74592196/index.html
CVE ID: CVE-2022-42459 State: PUBLISHED Published: 2022-11-18T22:17:20.430Z Last Updated: 2025-02-20T19:50:42.640Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Biplob Adhikari Products: Image Hover Effects Ultimate (WordPress plugin) Problem Types: CWE-264, CWE-269 Description: Auth. WordPress Options Change vulnerability in Image Hover Effects Ultimate plugin <= 9.7.1 on WordPress. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/image-hover-effects-ultimate/wordpress-image-hover-effects-ultimate-plugin-9-7-1-auth-wordpress-options-change-vulnerability?_s_id=cve - https:
imate/wordpress-image-hover-effects-ultimate-plugin-9-7-1-auth-wordpress-options-change-vulnerability?_s_id=cve - https://wordpress.org/plugins/image-hover-effects-ultimate/
CVE ID: CVE-2022-42460 State: PUBLISHED Published: 2022-11-10T21:36:55.829959Z Last Updated: 2024-09-16T16:33:35.150Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: SedLex Products: Traffic Manager (WordPress plugin) Problem Types: CWE-264, CWE-79 Description: Broken Access Control vulnerability leading to Stored Cross-Site Scripting (XSS) in Traffic Manager plugin <= 1.4.5 on WordPress. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/traffic-manager/wordpress-traffic-manager-plugin-1-4-5-broken-access-control-vulnerability-leading-to-stored-cross-site-scripting-xss?_s_id=cve - https://wordpress
lugin-1-4-5-broken-access-control-vulnerability-leading-to-stored-cross-site-scripting-xss?_s_id=cve - https://wordpress.org/plugins/traffic-manager/
CVE ID: CVE-2022-42461 State: PUBLISHED Published: 2022-11-18T19:06:13.058Z Last Updated: 2025-02-20T19:52:10.497Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: miniOrange Products: miniOrange's Google Authenticator (WordPress plugin) Problem Types: CWE-264 Description: Broken Access Control vulnerability in miniOrange's Google Authenticator plugin <= 5.6.1 on WordPress. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/miniorange-2-factor-authentication/wordpress-miniorange-s-google-authenticator-plugin-5-6-1-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2022-42462 State: PUBLISHED Published: 2023-01-17T04:36:15.616Z Last Updated: 2025-01-13T15:59:22.342Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: Adeel Ahmed Products: IP Blacklist Cloud Problem Types: CWE-79 Description: Auth. Stored Cross-Site Scripting (XSS) vulnerability in Adeel Ahmed's IP Blacklist Cloud plugin <= 5.00 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/ip-blacklist-cloud/wordpress-ip-blacklist-cloud-plugin-5-00-auth-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2022-42463 State: PUBLISHED Published: 2022-10-14T14:40:09.252Z Last Updated: 2025-05-14T15:11:42.282Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: OpenHarmony Products: OpenHarmony Problem Types: CWE-287 Description: OpenHarmony-v3.1.2 and prior versions have an authenication bypass vulnerability in a callback handler function of Softbus_server in communication subsystem. Attackers can launch attacks on distributed networks by sending Bluetooth rfcomm packets to any remote device and executing arbitrary commands. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitee.com/openharmony/security/blob
alyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitee.com/openharmony/security/blob/master/en/security-disclosure/2022/2022-10.md
CVE ID: CVE-2022-42464 State: PUBLISHED Published: 2022-10-14T14:40:12.042Z Last Updated: 2025-05-14T15:11:24.640Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: OpenHarmony Products: OpenHarmony Problem Types: CWE-276 Description: OpenHarmony-v3.1.2 and prior versions, 3.0.6 and prior versions have a Kernel memory pool override vulnerability in /dev/mmz_userdev device driver. The impact depends on the privileges of the attacker. The unprivileged process run on the device could disclose sensitive information including kernel pointer, which could be used in further attacks. The processes with system user UID run on the device would be able to mmap memory poo
could be used in further attacks. The processes with system user UID run on the device would be able to mmap memory pools used by kernel and override them which could be used to gain kernel code execution on the device, gain root privileges, or cause device reboot. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitee.com/openharmony/security/blob/master/en/security-disclosure/2022/2022-10.md
CVE ID: CVE-2022-42465 State: PUBLISHED Published: 2023-05-10T13:17:11.339Z Last Updated: 2025-01-27T18:01:09.529Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) OFU software Problem Types: escalation of privilege, CWE-284 Description: Improper access control in kernel mode driver for the Intel(R) OFU software before version 14.1.30 may allow a privileged user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00792.html
CVE ID: CVE-2022-42466 State: PUBLISHED Published: 2022-10-19T00:00:00.000Z Last Updated: 2025-05-08T19:54:09.104Z Vendors: Apache Software Foundation Products: Apache Isis Problem Types: CWE-79 Description: Prior to 2.0.0-M9, it was possible for an end-user to set the value of an editable string property of a domain object to a value that would be rendered unchanged when the value was saved. In particular, the end-user could enter javascript or similar and this would be executed. As of this release, the inputted strings are properly escaped when rendered. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/83ftj5jgtv3mbm2
t Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/83ftj5jgtv3mbm28w3trjyvd591jztrz - http://www.openwall.com/lists/oss-security/2022/10/19/2
CVE ID: CVE-2022-42467 State: PUBLISHED Published: 2022-10-19T00:00:00 Last Updated: 2024-08-03T13:10:40.997Z Vendors: Apache Software Foundation Products: Apache Isis Problem Types: CWE-1188 Description: When running in prototype mode, the h2 webconsole module (accessible from the Prototype menu) is automatically made available with the ability to directly query the database. It was felt that it is safer to require the developer to explicitly enable this capability. As of 2.0.0-M8, this can now be done using the 'isis.prototyping.h2-console.web-allow-remote-access' configuration property; the web console will be unavailable without setting this configuration. As an additional safeguard, the
ration property; the web console will be unavailable without setting this configuration. As an additional safeguard, the new 'isis.prototyping.h2-console.generate-random-web-admin-password' configuration parameter (enabled by default) requires that the administrator use a randomly generated password to use the console. The password is printed to the log, as "webAdminPass: xxx" (where "xxx") is the password. To revert to the original behaviour, the administrator would therefore need to set these configuration parameter: isis.prototyping.h2-console.web-allow-remote-access=true isis.prototyping.h2-console.generate-random-web-admin-password=false Note also that the h2 webconsole is never availab
e isis.prototyping.h2-console.generate-random-web-admin-password=false Note also that the h2 webconsole is never available in production mode, so these safeguards are only to ensure that the webconsole is secured by default also in prototype mode. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://lists.apache.org/thread/jbv2ddt00h7ntlbm6vkk4wdmb31pm8q3 - http://www.openwall.com/lists/oss-security/2022/10/19/1
CVE ID: CVE-2022-42468 State: PUBLISHED Published: 2022-10-26T00:00:00.000Z Last Updated: 2025-05-07T13:53:00.467Z Vendors: Apache Software Foundation Products: Apache Flume Problem Types: CWE-20, CWE-74 Description: Apache Flume versions 1.4.0 through 1.10.1 are vulnerable to a remote code execution (RCE) attack when a configuration uses a JMS Source with an unsafe providerURL. This issue is fixed by limiting JNDI to allow only the use of the java protocol or no protocol. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://issues.apache.org/jira/browse/FLUME-3437 - https://lists.apache.org/thread/939wkx8o90bp6m2ht3t1sdyo1ncypl78 - https://lists.
es.apache.org/jira/browse/FLUME-3437 - https://lists.apache.org/thread/939wkx8o90bp6m2ht3t1sdyo1ncypl78 - https://lists.apache.org/thread/1ckhmp539zr2nd2rs45pocpywk2d9zvz
CVE ID: CVE-2022-42469 State: PUBLISHED Published: 2023-04-11T16:07:17.688Z Last Updated: 2024-10-22T20:47:05.116Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:F/RL:X/RC:R) Vendors: Fortinet Products: FortiOS Problem Types: CWE-183 Description: A permissive list of allowed inputs vulnerability [CWE-183] in FortiGate version 7.2.3 and below, version 7.0.9 and below Policy-based NGFW Mode may allow an authenticated SSL-VPN user to bypass the policy via bookmarks in the web portal. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-22-381
CVE ID: CVE-2022-42470 State: PUBLISHED Published: 2023-04-11T16:06:02.222Z Last Updated: 2024-10-23T14:29:44.829Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R) Vendors: Fortinet Products: FortiClientWindows Problem Types: CWE-23 Description: A relative path traversal vulnerability in Fortinet FortiClient (Windows) 7.0.0 - 7.0.7, 6.4.0 - 6.4.9, 6.2.0 - 6.2.9 and 6.0.0 - 6.0.10 allows an attacker to execute unauthorized code or commands via sending a crafted request to a specific named pipe. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-22-320
CVE ID: CVE-2022-42471 State: PUBLISHED Published: 2023-01-03T16:58:16.051Z Last Updated: 2024-10-22T20:51:05.460Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N/E:F/RL:U/RC:C) Vendors: Fortinet Products: FortiWeb Problem Types: CWE-113 Description: An improper neutralization of CRLF sequences in HTTP headers ('HTTP Response Splitting') vulnerability [CWE-113] In FortiWeb version 7.0.0 through 7.0.2, FortiWeb version 6.4.0 through 6.4.2, FortiWeb version 6.3.6 through 6.3.20 may allow an authenticated and remote attacker to inject arbitrary headers. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/
Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-22-250
CVE ID: CVE-2022-42472 State: PUBLISHED Published: 2023-02-16T18:07:00.188Z Last Updated: 2024-10-22T20:49:22.231Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N/E:P/RL:U/RC:C) Vendors: Fortinet Products: FortiProxy, FortiOS Problem Types: CWE-113 Description: A improper neutralization of crlf sequences in http headers ('http response splitting') in Fortinet FortiOS versions 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, 6.4.0 through 6.4.11, 6.2.0 through 6.2.12, 6.0.0 through 6.0.16, FortiProxy 7.2.0 through 7.2.1, 7.0.0 through 7.0.7, 2.0.0 through 2.0.10, 1.2.0 through 1.2.13, 1.1.0 through 1.1.6 may allow an authenticated and remote attacker to perform an HTTP request
10, 1.2.0 through 1.2.13, 1.1.0 through 1.1.6 may allow an authenticated and remote attacker to perform an HTTP request splitting attack which gives attackers control of the remaining headers and body of the response. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-22-362
CVE ID: CVE-2022-42473 State: PUBLISHED Published: 2022-11-02T00:00:00 Last Updated: 2024-10-22T20:52:17.735Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:U/RC:R) Vendors: Fortinet Products: Fortinet FortiSOAR Problem Types: Information disclosure Description: A missing authentication for a critical function vulnerability in Fortinet FortiSOAR 6.4.0 - 6.4.4 and 7.0.0 - 7.0.3 and 7.2.0 allows an attacker to disclose information via logging into the database using a privileged account without a password. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-22-216
CVE ID: CVE-2022-42474 State: PUBLISHED Published: 2023-06-13T08:41:42.277Z Last Updated: 2024-10-22T20:46:07.625Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H/E:P/RL:X/RC:C) Vendors: Fortinet Products: FortiSwitchManager, FortiProxy, FortiOS Problem Types: CWE-23 Description: A relative path traversal vulnerability [CWE-23] in Fortinet FortiOS version 7.2.0 through 7.2.3, version 7.0.0 through 7.0.9 and before 6.4.12, FortiProxy version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.7, FortiSwitchManager version 7.2.0 through 7.2.1 and before 7.0.1 allows an privileged attacker to delete arbitrary directories from the filesystem through crafted HTTP requests. Additiona
lows an privileged attacker to delete arbitrary directories from the filesystem through crafted HTTP requests. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-22-393
CVE ID: CVE-2022-42475 State: PUBLISHED Published: 2023-01-02T08:18:49.444Z Last Updated: 2025-10-21T23:15:29.105Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C) Vendors: Fortinet Products: FortiProxy, FortiOS Problem Types: CWE-197 Description: A heap-based buffer overflow vulnerability [CWE-122] in FortiOS SSL-VPN 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, 6.4.0 through 6.4.10, 6.2.0 through 6.2.11, 6.0.15 and earlier and FortiProxy SSL-VPN 7.2.0 through 7.2.1, 7.0.7 and earlier may allow a remote unauthenticated attacker to execute arbitrary code or commands via specifically crafted requests. Additional Analyst Notes: - CVE Program Container: - CIS
e arbitrary code or commands via specifically crafted requests. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-22-398
CVE ID: CVE-2022-42476 State: PUBLISHED Published: 2023-03-07T16:21:53.725Z Last Updated: 2024-10-23T14:31:15.323Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:C) Vendors: Fortinet Products: FortiOS, FortiProxy Problem Types: CWE-23 Description: A relative path traversal vulnerability [CWE-23] in Fortinet FortiOS version 7.2.0 through 7.2.2, 7.0.0 through 7.0.8 and before 6.4.11, FortiProxy version 7.2.0 through 7.2.2 and 7.0.0 through 7.0.8 allows privileged VDOM administrators to escalate their privileges to super admin of the box via crafted CLI requests. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://
crafted CLI requests. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-22-401
CVE ID: CVE-2022-42477 State: PUBLISHED Published: 2023-04-11T16:06:17.894Z Last Updated: 2024-10-23T14:29:14.227Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N/E:P/RL:X/RC:R) Vendors: Fortinet Products: FortiAnalyzer Problem Types: CWE-20 Description: An improper input validation vulnerability [CWE-20] in FortiAnalyzer version 7.2.1 and below, version 7.0.6 and below, 6.4 all versions may allow an authenticated attacker to disclose file system information via custom dataset SQL queries. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-22-432
CVE ID: CVE-2022-42478 State: PUBLISHED Published: 2023-06-13T08:41:42.765Z Last Updated: 2024-10-23T14:27:01.609Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:X/RL:U/RC:C) Vendors: Fortinet Products: FortiSIEM Problem Types: CWE-307 Description: An Improper Restriction of Excessive Authentication Attempts [CWE-307] in FortiSIEM below 7.0.0 may allow a non-privileged user with access to several endpoints to brute force attack these endpoints. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-22-258
CVE ID: CVE-2022-42480 State: REJECTED Published: N/A Last Updated: 2025-05-28T18:21:02.538Z Description: No description available.
CVE ID: CVE-2022-42484 State: PUBLISHED Published: 2023-01-30T10:12:04.966Z Last Updated: 2024-08-03T13:10:40.936Z Severity: CRITICAL (CVSS 9.1 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: FreshTomato, Siretta Products: FreshTomato, QUARTZ-GOLD Problem Types: CWE-78 Description: An OS command injection vulnerability exists in the httpd logs/view.cgi functionality of FreshTomato 2022.5. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can send an HTTP request to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2022-1641
CVE ID: CVE-2022-42485 State: PUBLISHED Published: 2023-03-21T05:28:04.327Z Last Updated: 2025-01-10T19:18:48.320Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Galaxy Weblinks Products: Gallery with thumbnail slider Problem Types: CWE-79 Description: Auth. (contributor+) Cross-Site Scripting (XSS) vulnerability in Galaxy Weblinks Gallery with thumbnail slider plugin <= 6.0 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/gallery-with-thumbnail-slider/wordpress-gallery-with-thumbnail-slider-plugin-6-0-auth-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2022-42486 State: PUBLISHED Published: 2022-12-07T00:00:00.000Z Last Updated: 2025-04-23T16:02:53.115Z Vendors: baserCMS Users Community Products: baserCMS Problem Types: Cross-site scripting Description: Stored cross-site scripting vulnerability in User group management of baserCMS versions prior to 4.7.2 allows a remote authenticated attacker with an administrative privilege to inject an arbitrary script. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://basercms.net/security/JVN_53682526 - https://jvn.jp/en/jp/JVN53682526/index.html
CVE ID: CVE-2022-42487 State: REJECTED Published: N/A Last Updated: 2025-05-28T18:21:03.916Z Description: No description available.
CVE ID: CVE-2022-42488 State: PUBLISHED Published: 2022-10-14T14:40:00.078Z Last Updated: 2025-05-14T15:16:52.107Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: OpenHarmony Products: OpenHarmony Problem Types: CWE-287 Description: OpenHarmony-v3.1.2 and prior versions have a Missing permission validation vulnerability in param service of startup subsystem. An malicious application installed on the device could elevate its privileges to the root user, disable security features, or cause DoS by disabling particular services. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitee.com/openharmony/security/blob/mas