Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-37203 State: PUBLISHED Published: 2022-09-19T15:26:22 Last Updated: 2024-08-03T10:29:19.412Z Vendors: n/a Products: n/a Problem Types: n/a Description: JFinal CMS 5.1.0 is vulnerable to SQL Injection. These interfaces do not use the same component, nor do they have filters, but each uses its own SQL concatenation method, resulting in SQL injection. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/AgainstTheLight/someEXP_of_jfinal_cms/blob/main/jfinal_cms/sql3.md - https://github.com/AgainstTheLight/CVE-2022-37203/blob/main/README.md
CVE ID: CVE-2022-37204 State: PUBLISHED Published: 2022-09-20T16:58:31.000Z Last Updated: 2025-05-27T18:09:55.503Z Vendors: n/a Products: n/a Problem Types: n/a Description: Final CMS 5.1.0 is vulnerable to SQL Injection. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/AgainstTheLight/someEXP_of_jfinal_cms/blob/main/jfinal_cms/sql7.md - https://github.com/AgainstTheLight/CVE-2022-37204/blob/main/README.md
CVE ID: CVE-2022-37205 State: PUBLISHED Published: 2022-09-20T17:40:08.000Z Last Updated: 2025-05-28T16:12:20.880Z Vendors: n/a Products: n/a Problem Types: n/a Description: JFinal CMS 5.1.0 is affected by: SQL Injection. These interfaces do not use the same component, nor do they have filters, but each uses its own SQL concatenation method, resulting in SQL injection. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/AgainstTheLight/someEXP_of_jfinal_cms/blob/main/jfinal_cms/sql8.md - https://github.com/AgainstTheLight/CVE-2022-37205/blob/main/README.md
CVE ID: CVE-2022-37207 State: PUBLISHED Published: 2022-09-15T14:34:24 Last Updated: 2024-08-03T10:29:19.447Z Vendors: n/a Products: n/a Problem Types: n/a Description: JFinal CMS 5.1.0 is affected by: SQL Injection. These interfaces do not use the same component, nor do they have filters, but each uses its own SQL concatenation method, resulting in SQL injection Additional Analyst Notes: - CVE Program Container: References: - https://github.com/AgainstTheLight/someEXP_of_jfinal_cms/blob/main/jfinal_cms/sql10.md - https://github.com/AgainstTheLight/CVE-2022-37207/blob/main/README.md
CVE ID: CVE-2022-37208 State: PUBLISHED Published: 2022-10-13T00:00:00.000Z Last Updated: 2025-05-15T15:17:13.213Z Vendors: n/a Products: n/a Problem Types: n/a Description: JFinal CMS 5.1.0 is vulnerable to SQL Injection. These interfaces do not use the same component, nor do they have filters, but each uses its own SQL concatenation method, resulting in SQL injection. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/AgainstTheLight/someEXP_of_jfinal_cms/blob/main/jfinal_cms/sql5.md - https://github.com/AgainstTheLight/CVE-2022-37208
CVE ID: CVE-2022-37209 State: PUBLISHED Published: 2022-09-27T13:12:35.000Z Last Updated: 2025-05-22T13:46:30.901Z Vendors: n/a Products: n/a Problem Types: n/a Description: JFinal CMS 5.1.0 is affected by: SQL Injection. These interfaces do not use the same component, nor do they have filters, but each uses its own SQL concatenation method, resulting in SQL injection. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/AgainstTheLight/someEXP_of_jfinal_cms/blob/main/jfinal_cms/sql9.md - https://github.com/AgainstTheLight/CVE-2022-37209/tree/main
CVE ID: CVE-2022-37223 State: PUBLISHED Published: 2022-08-23T13:31:07 Last Updated: 2024-08-03T10:29:19.455Z Vendors: n/a Products: n/a Problem Types: n/a Description: JFinal CMS 5.1.0 is vulnerable to SQL Injection via /jfinal_cms/system/role/list. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jflyfox/jfinal_cms/issues/49
CVE ID: CVE-2022-37232 State: PUBLISHED Published: 2022-09-23T00:10:00.000Z Last Updated: 2025-05-27T14:42:49.500Z Vendors: n/a Products: n/a Problem Types: n/a Description: Netgear N300 wireless router wnr2000v4-V1.0.0.70 is vulnerable to Buffer Overflow via uhttpd. There is a stack overflow vulnerability caused by strcpy. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.netgear.com/about/security/ - https://www.netgear.com/support/download/?model=WNR2000v4 - https://github.com/Davidteeri/Bug-Report/blob/main/netgear-n300-0x429cbc.md
CVE ID: CVE-2022-37234 State: PUBLISHED Published: 2022-09-22T18:26:11.000Z Last Updated: 2025-05-27T15:04:10.330Z Vendors: n/a Products: n/a Problem Types: n/a Description: Netgear Nighthawk AC1900 Smart WiFi Dual Band Gigabit Router R7000-V1.0.11.134_10.2.119 is vulnerable to Buffer Overflow via the wl binary in firmware. There is a stack overflow vulnerability caused by strncpy. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.netgear.com/about/security/ - https://www.netgear.com/support/download/?model=R7000 - https://github.com/Davidteeri/Bug-Report/blob/main/netgear-R7000-0x461bc-strncpy.md
CVE ID: CVE-2022-37235 State: PUBLISHED Published: 2022-09-23T00:06:29.000Z Last Updated: 2025-05-27T14:51:24.166Z Vendors: n/a Products: n/a Problem Types: n/a Description: Netgear Nighthawk AC1900 Smart WiFi Dual Band Gigabit Router R7000-V1.0.11.134_10.2.119 is vulnerable to Buffer Overflow via the wl binary in firmware. There is a stack overflow vulnerability caused by strncat Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.netgear.com/about/security/ - https://www.netgear.com/support/download/?model=R7000 - https://github.com/Davidteeri/Bug-Report/blob/main/netgear-R7000-0x461bc.md
CVE ID: CVE-2022-37237 State: PUBLISHED Published: 2022-08-30T15:30:04 Last Updated: 2024-08-03T10:29:19.444Z Vendors: n/a Products: n/a Problem Types: n/a Description: An attacker can send malicious RTMP requests to make the ZLMediaKit server crash remotely. Affected version is below commit 7d8b212a3c3368bc2f6507cb74664fc419eb9327. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ZLMediaKit/ZLMediaKit/issues/1839
CVE ID: CVE-2022-37238 State: PUBLISHED Published: 2022-08-25T15:01:12 Last Updated: 2024-08-03T10:29:20.572Z Vendors: n/a Products: n/a Problem Types: n/a Description: MDaemon Technologies SecurityGateway for Email Servers 8.5.2 is vulnerable to Cross Site Scripting (XSS) via the currentRequest parameter. Additional Analyst Notes: - CVE Program Container: References: - https://gtn.com.np/wp-content/uploads/2022/07/Authenticated-Reflected-Cross-Site-Scripting-XSS-at-currentRequest-Parameter.pdf - https://files.mdaemon.com/securitygateway/release/relnotes_en.htm
CVE ID: CVE-2022-37239 State: PUBLISHED Published: 2022-08-25T14:59:13 Last Updated: 2024-08-03T10:29:19.469Z Vendors: n/a Products: n/a Problem Types: n/a Description: MDaemon Technologies SecurityGateway for Email Servers 8.5.2 is vulnerable to Cross Site Scripting (XSS) via the rulles_list_ajax endpoint. Additional Analyst Notes: - CVE Program Container: References: - https://files.mdaemon.com/securitygateway/release/relnotes_en.htm - https://gtn.com.np/wp-content/uploads/2022/07/Stored-Cross-Site-Scripting-XSS.pdf
CVE ID: CVE-2022-37240 State: PUBLISHED Published: 2022-08-25T14:56:25 Last Updated: 2024-08-03T10:29:19.469Z Vendors: n/a Products: n/a Problem Types: n/a Description: MDaemon Technologies SecurityGateway for Email Servers 8.5.2 is vulnerable to HTTP Response splitting via the format parameter. Additional Analyst Notes: - CVE Program Container: References: - https://files.mdaemon.com/securitygateway/release/relnotes_en.htm - https://gtn.com.np/wp-content/uploads/2022/07/HTTP-Response-splitting-through-format-parameter.pdf
CVE ID: CVE-2022-37241 State: PUBLISHED Published: 2022-08-25T14:54:47 Last Updated: 2024-08-03T10:29:19.469Z Vendors: n/a Products: n/a Problem Types: n/a Description: MDaemon Technologies SecurityGateway for Email Servers 8.5.2 is vulnerable to Cross Site Scripting (XSS) via the data_leak_list_ajax endpoint. Additional Analyst Notes: - CVE Program Container: References: - https://files.mdaemon.com/securitygateway/release/relnotes_en.htm - https://gtn.com.np/wp-content/uploads/2022/07/Stored-Cross-Site-Scripting-XSS-at-data_leak_list_ajax-endpoint.pdf
CVE ID: CVE-2022-37242 State: PUBLISHED Published: 2022-08-25T14:53:07 Last Updated: 2024-08-03T10:29:20.584Z Vendors: n/a Products: n/a Problem Types: n/a Description: MDaemon Technologies SecurityGateway for Email Servers 8.5.2, is vulnerable to HTTP Response splitting via the data parameter. Additional Analyst Notes: - CVE Program Container: References: - https://files.mdaemon.com/securitygateway/release/relnotes_en.htm - https://gtn.com.np/wp-content/uploads/2022/07/HTTP-Response-splitting-through-DATA-parameter.pdf
CVE ID: CVE-2022-37243 State: PUBLISHED Published: 2022-08-25T14:43:36 Last Updated: 2024-08-03T10:29:19.470Z Vendors: n/a Products: n/a Problem Types: n/a Description: MDaemon Technologies SecurityGateway for Email Servers 8.5.2 is vulnerable to Cross Site Scripting (XSS) via the whitelist endpoint. Additional Analyst Notes: - CVE Program Container: References: - https://files.mdaemon.com/securitygateway/release/relnotes_en.htm - https://gtn.com.np/wp-content/uploads/2022/07/Stored-Cross-Site-Scripting-XSS-at-whitelist-endpoint.pdf
CVE ID: CVE-2022-37244 State: PUBLISHED Published: 2022-08-25T14:41:42 Last Updated: 2024-08-03T10:29:19.458Z Vendors: n/a Products: n/a Problem Types: n/a Description: MDaemon Technologies SecurityGateway for Email Servers 8.5.2 is vulnerable to IFRAME Injectionvia the currentRequest parameter. after login leads to inject malicious tag leads to IFRAME injection. Additional Analyst Notes: - CVE Program Container: References: - https://files.mdaemon.com/securitygateway/release/relnotes_en.htm - https://gtn.com.np/wp-content/uploads/2022/07/IFRAME-Injection-at-currentRequest-Parameter.pdf
CVE ID: CVE-2022-37245 State: PUBLISHED Published: 2022-08-25T14:13:53 Last Updated: 2024-08-03T10:29:20.644Z Vendors: n/a Products: n/a Problem Types: n/a Description: MDaemon Technologies SecurityGateway for Email Servers 8.5.2 is vulnerable to Cross Site Scripting (XSS) via the Blacklist endpoint. Additional Analyst Notes: - CVE Program Container: References: - https://files.mdaemon.com/securitygateway/release/relnotes_en.htm - https://gtn.com.np/wp-content/uploads/2022/07/Stored-Cross-Site-Scripting-XSS-at-Blacklist-endpoint.pdf
CVE ID: CVE-2022-37246 State: PUBLISHED Published: 2022-09-21T14:14:01.000Z Last Updated: 2025-05-27T18:23:15.388Z Vendors: n/a Products: n/a Problem Types: n/a Description: Craft CMS 4.2.0.1 is affected by Cross Site Scripting (XSS) in the file src/web/assets/cp/src/js/BaseElementSelectInput.js and in specific on the line label: elementInfo.label. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/craftcms/cms/commit/1d5fdba23c84d6d09a8a980c7b6fc52fb93b679b - https://labs.integrity.pt/advisories/cve-2022-37246/
CVE ID: CVE-2022-37247 State: PUBLISHED Published: 2022-09-16T20:27:42 Last Updated: 2024-08-03T10:29:20.962Z Vendors: n/a Products: n/a Problem Types: n/a Description: Craft CMS 4.2.0.1 is vulnerable to stored a cross-site scripting (XSS) via /admin/settings/fields page. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/craftcms/cms/commit/cedeba0609e4b173cd584dae7f33c5f713f19627 - https://labs.integrity.pt/advisories/cve-2022-37247/
CVE ID: CVE-2022-37248 State: PUBLISHED Published: 2022-09-16T15:09:46 Last Updated: 2024-08-03T10:29:20.735Z Vendors: n/a Products: n/a Problem Types: n/a Description: Craft CMS 4.2.0.1 is vulnerable to Cross Site Scripting (XSS) via src/helpers/Cp.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/craftcms/cms/commit/cedeba0609e4b173cd584dae7f33c5f713f19627 - https://labs.integrity.pt/advisories/cve-2022-37248/
CVE ID: CVE-2022-37249 State: REJECTED Published: N/A Last Updated: 2024-05-07T16:35:26.017528 Description: No description available.
CVE ID: CVE-2022-37250 State: PUBLISHED Published: 2022-09-16T14:57:51.000Z Last Updated: 2025-06-03T18:03:34.717Z Vendors: n/a Products: n/a Problem Types: n/a Description: Craft CMS 4.2.0.1 suffers from Stored Cross Site Scripting (XSS) in /admin/myaccount. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/craftcms/cms/commit/cdc9cb66d0716c9552e4113c8e426fd1a31f9516 - https://labs.integrity.pt/advisories/cve-2022-37250/
CVE ID: CVE-2022-37251 State: PUBLISHED Published: 2022-09-16T20:54:16 Last Updated: 2024-08-03T10:29:20.604Z Vendors: n/a Products: n/a Problem Types: n/a Description: Craft CMS 4.2.0.1 is vulnerable to Cross Site Scripting (XSS) via Drafts. Additional Analyst Notes: - CVE Program Container: References: - http://craft.com - https://labs.integrity.pt/advisories/cve-2022-37251/
CVE ID: CVE-2022-37253 State: PUBLISHED Published: 2022-09-06T19:46:50 Last Updated: 2024-08-03T10:29:20.542Z Vendors: n/a Products: n/a Problem Types: n/a Description: Persistent cross-site scripting (XSS) in Crime Reporting System 1.0 allows a remote attacker to introduce arbitary Javascript via manipulation of an unsanitized POST parameter Additional Analyst Notes: - CVE Program Container: References: - https://sourcecodehero.com/crime-reporting-system-project-in-php-with-source-code/ - https://packetstormsecurity.com/files/167875/Crime-Reporting-System-1.0-Cross-Site-Scripting.html
CVE ID: CVE-2022-37254 State: PUBLISHED Published: 2022-08-19T16:45:49 Last Updated: 2024-08-03T10:29:20.566Z Vendors: n/a Products: n/a Problem Types: n/a Description: DolphinPHP 1.5.1 is vulnerable to Cross Site Scripting (XSS) via Background - > System - > system function - > configuration management. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/caiweiming/DolphinPHP/issues/42
CVE ID: CVE-2022-37255 State: PUBLISHED Published: 2023-04-16T00:00:00.000Z Last Updated: 2025-02-06T18:33:46.961Z Vendors: n/a Products: n/a Problem Types: n/a Description: TP-Link Tapo C310 1.3.0 devices allow access to the RTSP video feed via credentials of User --- and Password TPL075526460603. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.tp-link.com/ - http://packetstormsecurity.com/files/171540/Tapo-C310-RTSP-Server-1.3.0-Unauthorized-Video-Stream-Access.html
CVE ID: CVE-2022-37257 State: PUBLISHED Published: 2022-09-15T12:30:55 Last Updated: 2024-08-03T10:29:20.385Z Vendors: n/a Products: n/a Problem Types: n/a Description: Prototype pollution vulnerability in function convertLater in npm-convert.js in stealjs steal 2.2.4 via the requestedVersion variable in npm-convert.js. Additional Analyst Notes: - CVE Program Container: References: - http://steal.com - http://stealjs.com - https://github.com/stealjs/steal/blob/c9dd1eb19ed3f97aeb93cf9dcea5d68ad5d0ced9/ext/npm-convert.js#L362 - https://github.com/stealjs/steal/blob/c9dd1eb19ed3f97aeb93cf9dcea5d68ad5d0ced9/ext/npm-convert.js#L371 - https://github.com/stealjs/steal/issues/1526
CVE ID: CVE-2022-37258 State: PUBLISHED Published: 2022-09-16T20:57:18 Last Updated: 2024-08-03T10:29:20.487Z Vendors: n/a Products: n/a Problem Types: n/a Description: Prototype pollution vulnerability in function convertLater in npm-convert.js in stealjs steal 2.2.4 via the packageName variable in npm-convert.js. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/stealjs/steal/blob/c9dd1eb19ed3f97aeb93cf9dcea5d68ad5d0ced9/ext/npm-convert.js#L362 - https://github.com/stealjs/steal/blob/c9dd1eb19ed3f97aeb93cf9dcea5d68ad5d0ced9/ext/npm-convert.js#L369 - https://github.com/stealjs/steal/issues/1527
CVE ID: CVE-2022-37259 State: PUBLISHED Published: 2022-09-20T17:31:22.000Z Last Updated: 2025-05-28T18:45:49.332Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Regular Expression Denial of Service (ReDoS) flaw was found in stealjs steal 2.2.4 via the string variable in babel.js. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/stealjs/steal/blob/c9dd1eb19ed3f97aeb93cf9dcea5d68ad5d0ced9/ext/babel.js#L54124 - https://github.com/stealjs/steal/blob/c9dd1eb19ed3f97aeb93cf9dcea5d68ad5d0ced9/ext/babel.js#L54129 - https://github.com/stealjs/steal/issues/1528
CVE ID: CVE-2022-37260 State: PUBLISHED Published: 2022-09-15T18:18:22 Last Updated: 2024-08-03T10:29:20.580Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Regular Expression Denial of Service (ReDoS) flaw was found in stealjs steal 2.2.4 via the input variable in main.js. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/stealjs/steal/blob/c9dd1eb19ed3f97aeb93cf9dcea5d68ad5d0ced9/main.js#L3344 - https://github.com/stealjs/steal/blob/c9dd1eb19ed3f97aeb93cf9dcea5d68ad5d0ced9/main.js#L2490 - https://github.com/stealjs/steal/issues/1529
CVE ID: CVE-2022-37262 State: PUBLISHED Published: 2022-09-15T15:37:47 Last Updated: 2024-08-03T10:29:20.962Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Regular Expression Denial of Service (ReDoS) flaw was found in stealjs steal 2.2.4 via the source and sourceWithComments variable in main.js. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/stealjs/steal/blob/c9dd1eb19ed3f97aeb93cf9dcea5d68ad5d0ced9/main.js#L3507 - https://github.com/stealjs/steal/blob/c9dd1eb19ed3f97aeb93cf9dcea5d68ad5d0ced9/main.js#L3497 - https://github.com/stealjs/steal/issues/1531
CVE ID: CVE-2022-37264 State: PUBLISHED Published: 2022-09-15T15:44:40 Last Updated: 2024-08-03T10:29:20.650Z Vendors: n/a Products: n/a Problem Types: n/a Description: Prototype pollution vulnerability in stealjs steal 2.2.4 via the optionName variable in main.js. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/stealjs/steal/blob/c9dd1eb19ed3f97aeb93cf9dcea5d68ad5d0ced9/main.js#L647 - https://github.com/stealjs/steal/blob/c9dd1eb19ed3f97aeb93cf9dcea5d68ad5d0ced9/main.js#L2194 - https://github.com/stealjs/steal/issues/1533
CVE ID: CVE-2022-37265 State: PUBLISHED Published: 2022-09-20T17:36:24.000Z Last Updated: 2025-05-28T18:05:27.992Z Vendors: n/a Products: n/a Problem Types: n/a Description: Prototype pollution vulnerability in stealjs steal 2.2.4 via the alias variable in babel.js. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/stealjs/steal/blob/c9dd1eb19ed3f97aeb93cf9dcea5d68ad5d0ced9/ext/babel.js#L4216 - https://github.com/stealjs/steal/blob/c9dd1eb19ed3f97aeb93cf9dcea5d68ad5d0ced9/ext/babel.js#L4569 - https://github.com/stealjs/steal/issues/1534
CVE ID: CVE-2022-37266 State: PUBLISHED Published: 2022-09-15T12:27:41 Last Updated: 2024-08-03T10:29:20.976Z Vendors: n/a Products: n/a Problem Types: n/a Description: Prototype pollution vulnerability in function extend in babel.js in stealjs steal 2.2.4 via the key variable in babel.js. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/stealjs/steal/blob/c9dd1eb19ed3f97aeb93cf9dcea5d68ad5d0ced9/ext/babel.js#L29165 - https://github.com/stealjs/steal/blob/c9dd1eb19ed3f97aeb93cf9dcea5d68ad5d0ced9/ext/babel.js#L29169 - https://github.com/stealjs/steal/issues/1535
CVE ID: CVE-2022-37290 State: PUBLISHED Published: 2022-11-14T00:00:00.000Z Last Updated: 2025-05-01T13:34:59.402Z Vendors: n/a Products: n/a Problem Types: n/a Description: GNOME Nautilus 42.2 allows a NULL pointer dereference and get_basename application crash via a pasted ZIP archive. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.gnome.org/GNOME/nautilus/-/tree/master - https://gitlab.gnome.org/GNOME/nautilus/-/issues/2376 - https://gitlab.gnome.org/GNOME/nautilus/-/merge_requests/1001 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PX5CVF4FAHFA6UNKHFBBLOP2NUMIQJAY/ - https://list
ct.org/archives/list/package-announce%40lists.fedoraproject.org/message/PX5CVF4FAHFA6UNKHFBBLOP2NUMIQJAY/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XYPDZ7LBBUVU3WFK7DCGDFGK2GXTKGT5/
CVE ID: CVE-2022-37292 State: PUBLISHED Published: 2022-08-25T15:07:34 Last Updated: 2024-08-03T10:29:20.580Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda AX12 V22.03.01.21_CN is vulnerable to Buffer Overflow. This overflow is triggered in the sub_42FDE4 function, which satisfies the request of the upper-level interface function sub_430124, that is, handles the post request under /goform/SetIpMacBind. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/The-Itach1/IOT-CVE/tree/master/Tenda/AX12/1
CVE ID: CVE-2022-37298 State: PUBLISHED Published: 2022-10-20T00:00:00.000Z Last Updated: 2025-05-08T15:54:56.495Z Vendors: n/a Products: n/a Problem Types: n/a Description: Shinken Solutions Shinken Monitoring Version 2.4.3 affected is vulnerable to Incorrect Access Control. The SafeUnpickler class found in shinken/safepickle.py implements a weak authentication scheme when unserializing objects passed from monitoring nodes to the Shinken monitoring server. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/naparuba/shinken/commit/2dae40fd1e713aec9e1966a0ab7a580b9180cff2 - https://github.com/dbyio/cve-2022-37298
CVE ID: CVE-2022-37299 State: PUBLISHED Published: 2022-09-09T14:10:07 Last Updated: 2024-08-03T10:29:20.959Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Shirne CMS 1.2.0. There is a Path Traversal vulnerability which could cause arbitrary file read via /static/ueditor/php/controller.php Additional Analyst Notes: - CVE Program Container: References: - https://gitee.com/shirnecn/ShirneCMS/issues/I5JRHJ?from=project-issue
CVE ID: CVE-2022-37300 State: PUBLISHED Published: 2022-09-12T17:40:10 Last Updated: 2024-08-03T10:29:20.628Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Schneider Electric Products: EcoStruxure Control Expert, EcoStruxure Process Expert, Modicon M340 CPU, Modicon M580 CPU Problem Types: CWE-640 Description: A CWE-640: Weak Password Recovery Mechanism for Forgotten Password vulnerability exists that could cause unauthorized access in read and write mode to the controller when communicating over Modbus. Affected Products: EcoStruxure Control Expert Including all Unity Pro versions (former name of EcoStruxure Control Expert) (V15.0 SP1 and prior), EcoStr
ontrol Expert Including all Unity Pro versions (former name of EcoStruxure Control Expert) (V15.0 SP1 and prior), EcoStruxure Process Expert, Including all versions of EcoStruxure Hybrid DCS (former name of EcoStruxure Process Expert) (V2021 and prior), Modicon M340 CPU (part numbers BMXP34*) (V3.40 and prior), Modicon M580 CPU (part numbers BMEP* and BMEH*) (V3.20 and prior). Additional Analyst Notes: - CVE Program Container: References: - https://www.se.com/us/en/download/document/SEVD-2022-221-01/
CVE ID: CVE-2022-37301 State: PUBLISHED Published: 2022-11-22T00:00:00.000Z Last Updated: 2025-04-28T14:32:19.547Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Schneider Electric Products: Modicon M340 CPU (part numbers BMXP34*), Modicon M580 CPU (part numbers BMEP* and BMEH*) , Legacy Modicon Quantum/Premium, Modicon Momentum MDI (171CBU*), Modicon MC80 (BMKC80) Problem Types: CWE-191 Description: A CWE-191: Integer Underflow (Wrap or Wraparound) vulnerability exists that could cause a denial of service of the controller due to memory access violations when using the Modbus TCP protocol. Affected products: Modicon M340 CPU (part numbers BMXP34*)(V3.40 and