Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-43972 State: PUBLISHED Published: 2023-01-09T00:00:00.000Z Last Updated: 2025-04-09T14:22:24.605Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Linksys Products: WRT54GL Wireless-G Broadband Router Problem Types: CWE-476 Description: A null pointer dereference vulnerability exists in Linksys WRT54GL Wireless-G Broadband Router with firmware <= 4.30.18.006. A null pointer dereference in the soap_action function within the upnp binary can be triggered by an unauthenticated attacker via a malicious POST request invoking the AddPortMapping action. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https:/
AddPortMapping action. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://youtu.be/73-1lhvJPNg - https://youtu.be/TeWAmZaKQ_w - https://youtu.be/RfWVYCUBNZ0
CVE ID: CVE-2022-43973 State: PUBLISHED Published: 2023-01-09T00:00:00.000Z Last Updated: 2025-04-09T14:20:48.368Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Linksys Products: WRT54GL Wireless-G Broadband Router Problem Types: CWE-78 Description: An arbitrary code execution vulnerability exisits in Linksys WRT54GL Wireless-G Broadband Router with firmware <= 4.30.18.006. The Check_TSSI function within the httpd binary uses unvalidated user input in the construction of a system command. An authenticated attacker with administrator privileges can leverage this vulnerability over the network via a malicious POST request to /apply.cgi to execute arbitrary com
ges can leverage this vulnerability over the network via a malicious POST request to /apply.cgi to execute arbitrary commands on the underlying Linux operating system as root. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://youtu.be/73-1lhvJPNg - https://youtu.be/TeWAmZaKQ_w - https://youtu.be/RfWVYCUBNZ0
CVE ID: CVE-2022-43974 State: PUBLISHED Published: 2023-01-09T00:00:00.000Z Last Updated: 2025-03-06T15:49:59.219Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AC:H/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: MatrixSSL 4.0.4 through 4.5.1 has an integer overflow in matrixSslDecodeTls13. A remote attacker might be able to send a crafted TLS Message to cause a buffer overflow and achieve remote code execution. This is fixed in 4.6.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.telekom.com/en/company/data-privacy-and-security/news/advisories-504842 - https://github.com/matrixssl/matrixssl/security/advi
m.com/en/company/data-privacy-and-security/news/advisories-504842 - https://github.com/matrixssl/matrixssl/security/advisories/GHSA-fmwc-gwc5-2g29 - https://github.com/matrixssl/matrixssl/blob/4-6-0-open/doc/CHANGES_v4.x.md
CVE ID: CVE-2022-43975 State: PUBLISHED Published: 2023-01-17T00:00:00.000Z Last Updated: 2025-04-07T16:25:04.747Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in FC46-WebBridge on GE Grid Solutions MS3000 devices before 3.7.6.25p0_3.2.2.17p0_4.7p0. A vulnerability in the web server allows arbitrary files and configurations to be read via directory traversal over TCP port 8888. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wid.cert-bund.de/.well-known/csaf/white/2022/bsi-2022-0005.json
CVE ID: CVE-2022-43976 State: PUBLISHED Published: 2023-01-17T00:00:00.000Z Last Updated: 2025-04-07T16:09:01.562Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in FC46-WebBridge on GE Grid Solutions MS3000 devices before 3.7.6.25p0_3.2.2.17p0_4.7p0. Direct access to the API is possible on TCP port 8888 via programs located in the cgi-bin folder without any authentication. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wid.cert-bund.de/.well-known/csaf/white/2022/bsi-2022-0005.json
CVE ID: CVE-2022-43977 State: PUBLISHED Published: 2023-01-17T00:00:00.000Z Last Updated: 2025-04-04T19:40:56.812Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on GE Grid Solutions MS3000 devices before 3.7.6.25p0_3.2.2.17p0_4.7p0. The debug port accessible via TCP (a qconn service) lacks access control. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wid.cert-bund.de/.well-known/csaf/white/2022/bsi-2022-0005.json
CVE ID: CVE-2022-43978 State: PUBLISHED Published: 2023-01-27T00:00:00.000Z Last Updated: 2025-03-27T20:23:30.280Z Severity: MEDIUM (CVSS 5.6 CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N) Vendors: Artica PFMS Products: Pandora FMS Problem Types: CWE-287 Description: There is an improper authentication vulnerability in Pandora FMS v764. The application verifies that the user has a valid session when he is not trying to do a login. Since the secret is static in generatePublicHash function, an attacker with knowledge of a valid session can abuse this in order to pass the authentication check. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://pando
ntication check. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/
CVE ID: CVE-2022-43979 State: PUBLISHED Published: 2023-01-27T00:00:00.000Z Last Updated: 2025-03-27T20:22:36.308Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:L) Vendors: Artica PFMS Products: Pandora FMS Problem Types: CWE-434 Description: There is a Path Traversal that leads to a Local File Inclusion in Pandora FMS v764. A function is called to check that the parameter that the user has inserted does not contain malicious characteres, but this check is insufficient. An attacker could insert an absolute path to overcome the heck, thus being able to incluse any PHP file that resides on the disk. The exploitation of this vulnerability could lead to a remote code exec
o incluse any PHP file that resides on the disk. The exploitation of this vulnerability could lead to a remote code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/
CVE ID: CVE-2022-43980 State: PUBLISHED Published: 2023-01-27T00:00:00.000Z Last Updated: 2025-03-27T20:22:04.349Z Severity: MEDIUM (CVSS 5.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:N) Vendors: Artica PFMS Products: Pandora FMS Problem Types: CWE-352 Description: There is a stored cross-site scripting vulnerability in Pandora FMS v765 in the network maps editing functionality. An attacker could modify a network map, including on purpose the name of an XSS payload. Once created, if a user with admin privileges clicks on the edited network maps, the XSS payload will be executed. The exploitation of this vulnerability could allow an atacker to steal the value of the admin user´s cookie. Addi
cuted. The exploitation of this vulnerability could allow an atacker to steal the value of the admin user´s cookie. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/ - https://github.com/Argonx21/CVE-2022-43980
CVE ID: CVE-2022-43982 State: PUBLISHED Published: 2022-11-02T00:00:00.000Z Last Updated: 2025-05-02T20:27:57.851Z Vendors: Apache Software Foundation Products: Apache Airflow Problem Types: CWE-79 Description: In Apache Airflow versions prior to 2.4.2, the "Trigger DAG with config" screen was susceptible to XSS attacks via the `origin` query argument. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/apache/airflow/pull/27143 - https://lists.apache.org/thread/vqnvdrfsw9z7v7c46qh3psjgr7wy959l
CVE ID: CVE-2022-43983 State: PUBLISHED Published: 2022-11-25T00:00:00.000Z Last Updated: 2025-04-29T14:39:09.767Z Vendors: n/a Products: Browsershot Problem Types: Server Side XSS Description: Browsershot version 3.57.2 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not validate that the HTML content passed to the Browsershot::html method does not contain URL's that use the file:// protocol. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/spatie/browsershot/ - https://fluidattacks.com/advisories/khalid/
CVE ID: CVE-2022-43984 State: PUBLISHED Published: 2022-11-25T00:00:00.000Z Last Updated: 2025-04-29T14:37:41.012Z Vendors: n/a Products: Browsershot Problem Types: Server Side XSS Description: Browsershot version 3.57.3 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not validate that the JS content imported from an external source passed to the Browsershot::html method does not contain URLs that use the file:// protocol. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/malone/ - https://github.com/spatie/browsershot/
CVE ID: CVE-2022-43985 State: PUBLISHED Published: 2022-11-02T00:00:00.000Z Last Updated: 2025-05-02T20:26:58.562Z Vendors: Apache Software Foundation Products: Apache Airflow Problem Types: CWE-601 Description: In Apache Airflow versions prior to 2.4.2, there was an open redirect in the webserver's `/confirm` endpoint. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/apache/airflow/pull/27143 - https://lists.apache.org/thread/m13y9s5kw92fw9l8j4qd85h0txp4kfcq
CVE ID: CVE-2022-43989 State: PUBLISHED Published: 2022-11-01T00:00:00.000Z Last Updated: 2025-05-05T14:22:58.312Z Vendors: n/a Products: SICK SIM2x00 (ARM) Problem Types: CWE-306 Description: Password recovery vulnerability in SICK SIM2x00 (ARM) Partnumber 1092673 and 1081902 with firmware version < 1.2.0 allows an unprivileged remote attacker to gain access to the userlevel defined as RecoverableUserLevel by invocating the password recovery mechanism method. This leads to an increase in their privileges on the system and thereby affecting the confidentiality integrity and availability of the system. An attacker can expect repeatable success by exploiting the vulnerability. The recommended
availability of the system. An attacker can expect repeatable success by exploiting the vulnerability. The recommended solution is to update the firmware to a version >= 1.2.0 as soon as possible (available in SICK Support Portal). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://sick.com/psirt
CVE ID: CVE-2022-43990 State: PUBLISHED Published: 2022-11-01T00:00:00.000Z Last Updated: 2025-05-05T14:21:57.920Z Vendors: n/a Products: SICK SIM1012 Problem Types: CWE-306 Description: Password recovery vulnerability in SICK SIM1012 Partnumber 1098146 with firmware version <2.2.0 allows an unprivileged remote attacker to gain access to the userlevel defined as RecoverableUserLevel by invocating the password recovery mechanism method. This leads to an increase in their privileges on the system and thereby affecting the confidentiality integrity and availability of the system. An attacker can expect repeatable success by exploiting the vulnerability. The recommended solution is to update the
em. An attacker can expect repeatable success by exploiting the vulnerability. The recommended solution is to update the firmware to a version >= 2.2.0 as soon as possible (available in SICK Support Portal). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://sick.com/psirt
CVE ID: CVE-2022-43995 State: PUBLISHED Published: 2022-11-02T00:00:00.000Z Last Updated: 2025-05-05T13:45:19.142Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sudo 1.8.0 through 1.9.12, with the crypt() password backend, contains a plugins/sudoers/auth/passwd.c array-out-of-bounds error that can result in a heap-based buffer over-read. This can be triggered by arbitrary local users with access to Sudo by entering a password of seven characters or fewer. The impact could vary depending on the system libraries, compiler, and processor architecture. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.sudo.ws/security/advisories/ -
nalyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.sudo.ws/security/advisories/ - https://github.com/sudo-project/sudo/commit/bd209b9f16fcd1270c13db27ae3329c677d48050 - https://news.ycombinator.com/item?id=33465707 - https://bugzilla.redhat.com/show_bug.cgi?id=2139911 - https://security.gentoo.org/glsa/202211-08
CVE ID: CVE-2022-43996 State: PUBLISHED Published: 2022-12-13T00:00:00.000Z Last Updated: 2025-04-22T15:10:58.311Z Vendors: n/a Products: n/a Problem Types: n/a Description: The csaf_provider package before 0.8.2 allows XSS via a crafted CSAF document uploaded as text/html. The endpoint upload allows valid CSAF advisories (JSON format) to be uploaded with Content-Type text/html and filenames ending in .html. When subsequently accessed via web browser, these advisories are served and interpreted as HTML pages. Such uploaded advisories can contain JavaScript code that will execute within the browser context of users inspecting the advisory. Additional Analyst Notes: - CVE Program Container: -
ecute within the browser context of users inspecting the advisory. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wid.cert-bund.de/.well-known/csaf/white/2022/bsi-2022-0003.json
CVE ID: CVE-2022-43997 State: PUBLISHED Published: 2023-01-25T00:00:00.000Z Last Updated: 2025-04-01T15:24:32.999Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in Aternity agent in Riverbed Aternity before 12.1.4.27 allows for local privilege escalation. There is an insufficiently protected handle to the A180AG.exe SYSTEM process with PROCESS_ALL_ACCESS rights. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://winternl.com/cve-2022-43997/ - https://gist.github.com/jackullrich/21fcfe75aeb5e18c60b80e684b83d741
CVE ID: CVE-2022-43999 State: PUBLISHED Published: 2022-11-16T00:00:00.000Z Last Updated: 2025-04-30T15:40:10.365Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in BACKCLICK Professional 5.9.63. Due to exposed CORBA management services, arbitrary system commands can be executed on the server. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2022-034.txt - https://www.syss.de/pentest-blog/vielfaeltige-schwachstellen-in-backclick-professional-syss-2022-026-bis-037
CVE ID: CVE-2022-44000 State: PUBLISHED Published: 2022-11-16T00:00:00.000Z Last Updated: 2025-04-30T15:39:20.064Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in BACKCLICK Professional 5.9.63. Due to an exposed internal communications interface, it is possible to execute arbitrary system commands on the server. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.syss.de/pentest-blog/vielfaeltige-schwachstellen-in-backclick-professional-syss-2022-026-bis-037 - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2022-032.txt
CVE ID: CVE-2022-44001 State: PUBLISHED Published: 2022-11-17T00:00:00.000Z Last Updated: 2025-04-29T14:56:45.457Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in BACKCLICK Professional 5.9.63. User authentication for accessing the CORBA back-end services can be bypassed. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.syss.de/pentest-blog/vielfaeltige-schwachstellen-in-backclick-professional-syss-2022-026-bis-037 - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2022-035.txt
CVE ID: CVE-2022-44002 State: PUBLISHED Published: 2022-11-16T00:00:00.000Z Last Updated: 2025-04-30T15:38:16.684Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in BACKCLICK Professional 5.9.63. Due to insufficient output encoding of user-supplied data, the web application is vulnerable to cross-site scripting (XSS) at various locations. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.syss.de/pentest-blog/vielfaeltige-schwachstellen-in-backclick-professional-syss-2022-026-bis-037
CVE ID: CVE-2022-44003 State: PUBLISHED Published: 2022-11-16T00:00:00.000Z Last Updated: 2025-04-30T14:03:40.514Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in BACKCLICK Professional 5.9.63. Due to insufficient escaping of user-supplied input, the application is vulnerable to SQL injection at various locations. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.syss.de/pentest-blog/vielfaeltige-schwachstellen-in-backclick-professional-syss-2022-026-bis-037 - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2022-029.txt
CVE ID: CVE-2022-44004 State: PUBLISHED Published: 2022-11-16T00:00:00.000Z Last Updated: 2025-04-30T14:02:19.648Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in BACKCLICK Professional 5.9.63. Due to insecure design or lack of authentication, unauthenticated attackers can complete the password-reset process for any account and set a new password. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.syss.de/pentest-blog/vielfaeltige-schwachstellen-in-backclick-professional-syss-2022-026-bis-037 - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2022-030.txt
CVE ID: CVE-2022-44005 State: PUBLISHED Published: 2022-11-16T00:00:00.000Z Last Updated: 2025-04-30T14:00:49.152Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in BACKCLICK Professional 5.9.63. Due to the use of consecutive IDs in verification links, the newsletter sign-up functionality is vulnerable to the enumeration of subscribers' e-mail addresses. Furthermore, it is possible to subscribe and verify other persons' e-mail addresses to newsletters without their consent. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.syss.de/pentest-blog/vielfaeltige-schwachstellen-in-backclick-professional-syss-202
nrichment: References: - https://www.syss.de/pentest-blog/vielfaeltige-schwachstellen-in-backclick-professional-syss-2022-026-bis-037 - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2022-026.txt
CVE ID: CVE-2022-44006 State: PUBLISHED Published: 2022-11-16T00:00:00.000Z Last Updated: 2025-04-30T15:33:34.773Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in BACKCLICK Professional 5.9.63. Due to improper validation or sanitization of upload filenames, an externally reachable, unauthenticated update function permits writing files outside the intended target location. Achieving remote code execution is possible, e.g., by uploading an executable file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.syss.de/pentest-blog/vielfaeltige-schwachstellen-in-backclick-professional-syss-2022-026-bis-037 - ht
ces: - https://www.syss.de/pentest-blog/vielfaeltige-schwachstellen-in-backclick-professional-syss-2022-026-bis-037 - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2022-031.txt
CVE ID: CVE-2022-44007 State: PUBLISHED Published: 2022-11-16T00:00:00.000Z Last Updated: 2025-04-29T20:31:25.154Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in BACKCLICK Professional 5.9.63. Due to an unsafe implementation of session tracking, it is possible for an attacker to trick users into opening an authenticated user session for a session identifier known to the attacker, aka Session Fixation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.syss.de/pentest-blog/vielfaeltige-schwachstellen-in-backclick-professional-syss-2022-026-bis-037 - https://www.syss.de/fileadmin/dokumente/Publikationen/A
schwachstellen-in-backclick-professional-syss-2022-026-bis-037 - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2022-036.txt
CVE ID: CVE-2022-44008 State: PUBLISHED Published: 2022-11-16T00:00:00.000Z Last Updated: 2025-04-30T15:32:35.887Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in BACKCLICK Professional 5.9.63. Due to improper validation, arbitrary local files can be retrieved by accessing the back-end Tomcat server directly. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2022-037.txt
CVE ID: CVE-2022-44009 State: PUBLISHED Published: 2022-12-05T00:00:00.000Z Last Updated: 2025-04-24T13:56:33.601Z Vendors: n/a Products: n/a Problem Types: n/a Description: Improper access control in Key-Value RBAC in StackStorm version 3.7.0 didn't check the permissions in Jinja filters, allowing attackers to access K/V pairs of other users, potentially leading to the exposure of sensitive Information. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://stackstorm.com/2022/12/v3-8-0-released/
CVE ID: CVE-2022-44010 State: PUBLISHED Published: 2023-11-23T00:00:00 Last Updated: 2024-08-03T13:47:05.601Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in ClickHouse before 22.9.1.2603. An attacker could send a crafted HTTP request to the HTTP Endpoint (usually listening on port 8123 by default), causing a heap-based buffer overflow that crashes the process. This does not require authentication. The fixed versions are 22.9.1.2603, 22.8.2.11, 22.7.4.16, 22.6.6.16, and 22.3.12.19. Additional Analyst Notes: - CVE Program Container: References: - https://clickhouse.com/docs/en/whats-new/security-changelog
CVE ID: CVE-2022-44011 State: PUBLISHED Published: 2023-11-23T00:00:00 Last Updated: 2024-08-03T13:47:05.424Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in ClickHouse before 22.9.1.2603. An authenticated user (with the ability to load data) could cause a heap buffer overflow and crash the server by inserting a malformed CapnProto object. The fixed versions are 22.9.1.2603, 22.8.2.11, 22.7.4.16, 22.6.6.16, and 22.3.12.19. Additional Analyst Notes: - CVE Program Container: References: - https://clickhouse.com
CVE ID: CVE-2022-44012 State: PUBLISHED Published: 2022-12-25T00:00:00.000Z Last Updated: 2025-04-15T13:31:58.639Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in /DS/LM_API/api/SelectionService/InsertQueryWithActiveRelationsReturnId in Simmeth Lieferantenmanager before 5.6. An attacker can execute JavaScript code in the browser of the victim if a site is loaded. The victim's encrypted password can be stolen and most likely be decrypted. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-simmeth-system-gmbh-lieferantenmanager/
CVE ID: CVE-2022-44013 State: PUBLISHED Published: 2022-12-25T00:00:00.000Z Last Updated: 2025-04-15T13:30:53.809Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Simmeth Lieferantenmanager before 5.6. An attacker can make various API calls without authentication because the password in a Credential Object is not checked. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-simmeth-system-gmbh-lieferantenmanager/