Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-28365 State: PUBLISHED Published: 2022-04-09T00:00:00 Last Updated: 2024-08-03T05:56:14.870Z Vendors: n/a Products: n/a Problem Types: n/a Description: Reprise License Manager 14.2 is affected by an Information Disclosure vulnerability via a GET request to /goforms/rlminfo. No authentication is required. The information disclosed is associated with software versions, process IDs, network configuration, hostname(s), system architecture, and file/directory details. Additional Analyst Notes: - CVE Program Container: References: - https://www.reprisesoftware.com/products/software-license-management.php - http://packetstormsecurity.com/files/166647/Reprise-License-Manager-14.2-Cr
m/products/software-license-management.php - http://packetstormsecurity.com/files/166647/Reprise-License-Manager-14.2-Cross-Site-Scripting-Information-Disclosure.html - https://seclists.org/fulldisclosure/2022/Apr/1 - https://www.reprisesoftware.com/RELEASE_NOTES
CVE ID: CVE-2022-28366 State: PUBLISHED Published: 2022-04-21T22:41:53 Last Updated: 2024-08-03T05:56:15.220Z Vendors: n/a Products: n/a Problem Types: n/a Description: Certain Neko-related HTML parsers allow a denial of service via crafted Processing Instruction (PI) input that causes excessive heap memory consumption. In particular, this issue exists in HtmlUnit-Neko through 2.26, and is fixed in 2.27. This issue also exists in CyberNeko HTML through 1.9.22 (also affecting OWASP AntiSamy before 1.6.6), but 1.9.22 is the last version of CyberNeko HTML. NOTE: this may be related to CVE-2022-24839. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nahsra/anti
lated to CVE-2022-24839. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nahsra/antisamy/releases/tag/v1.6.6 - https://search.maven.org/artifact/net.sourceforge.htmlunit/neko-htmlunit - https://sourceforge.net/projects/htmlunit/files/htmlunit/2.27/
CVE ID: CVE-2022-28367 State: PUBLISHED Published: 2022-04-21T22:42:14 Last Updated: 2024-08-03T05:56:14.935Z Vendors: n/a Products: n/a Problem Types: n/a Description: OWASP AntiSamy before 1.6.6 allows XSS via HTML tag smuggling on STYLE content with crafted input. The output serializer does not properly encode the supposed Cascading Style Sheets (CSS) content. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nahsra/antisamy/releases/tag/v1.6.6 - https://github.com/nahsra/antisamy/commit/0199e7e194dba5e7d7197703f43ebe22401e61ae
CVE ID: CVE-2022-28368 State: PUBLISHED Published: 2022-04-03T00:00:00 Last Updated: 2024-08-03T05:56:14.887Z Vendors: n/a Products: n/a Problem Types: n/a Description: Dompdf 1.2.1 allows remote code execution via a .php file in the src:url field of an @font-face Cascading Style Sheets (CSS) statement (within an HTML input file). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/dompdf/dompdf/issues/2598 - https://snyk.io/blog/security-alert-php-pdf-library-dompdf-rce/ - https://github.com/snyk-labs/php-goof - https://packagist.org/packages/dompdf/dompdf#v1.2.1 - https://github.com/dompdf/dompdf/pull/2808 - https://github.com/dompdf/dompdf/commit/4c70e1025b
s/dompdf/dompdf#v1.2.1 - https://github.com/dompdf/dompdf/pull/2808 - https://github.com/dompdf/dompdf/commit/4c70e1025bcd9b7694b95dd552499bd83cd6141d - http://packetstormsecurity.com/files/171738/Dompdf-1.2.1-Remote-Code-Execution.html
CVE ID: CVE-2022-28369 State: PUBLISHED Published: 2022-07-14T12:29:24 Last Updated: 2024-08-03T05:56:14.797Z Vendors: n/a Products: n/a Problem Types: n/a Description: Verizon 5G Home LVSKIHP InDoorUnit (IDU) 3.4.66.162 does not validate the user-provided URL within the crtcmode function's enable_ssh sub-operation of the crtcrpc JSON listener (found at /lib/functions/wnc_jsonsh/crtcmode.sh) A remote attacker on the local network can provide a malicious URL. The data (found at that URL) is written to /usr/sbin/dropbear and then executed as root. Additional Analyst Notes: - CVE Program Container: References: - https://www.verizon.com/info/reportsecurityvulnerability/ - https://github.com/Jous
CVE Program Container: References: - https://www.verizon.com/info/reportsecurityvulnerability/ - https://github.com/JousterL/SecWriteups/blob/main/Verizon%20LVSKIHP%205G%20Modem/readme.md
CVE ID: CVE-2022-28370 State: PUBLISHED Published: 2022-07-14T12:29:14 Last Updated: 2024-08-03T05:56:15.264Z Vendors: n/a Products: n/a Problem Types: n/a Description: On Verizon 5G Home LVSKIHP OutDoorUnit (ODU) 3.33.101.0 devices, the RPC endpoint crtc_fw_upgrade provides a means of provisioning a firmware update for the device. /lib/functions/wnc_jsonsh/wnc_crtc_fw.sh has no cryptographic validation of the image, thus allowing an attacker to modify the installed firmware. Additional Analyst Notes: - CVE Program Container: References: - https://www.verizon.com/info/reportsecurityvulnerability/ - https://github.com/JousterL/SecWriteups/blob/main/Verizon%20LVSKIHP%205G%20Modem/readme.md
CVE ID: CVE-2022-28371 State: PUBLISHED Published: 2022-07-14T12:29:06 Last Updated: 2024-08-03T05:56:15.189Z Vendors: n/a Products: n/a Problem Types: n/a Description: On Verizon 5G Home LVSKIHP InDoorUnit (IDU) 3.4.66.162 and OutDoorUnit (ODU) 3.33.101.0 devices, the CRTC and ODU RPC endpoints rely on a static certificate for access control. This certificate is embedded in the firmware, and is identical across the fleet of devices. An attacker need only download this firmware and extract the private components of these certificates (from /etc/lighttpd.d/ca.pem and /etc/lighttpd.d/server.pem) to gain access. (The firmware download location is shown in a device's upgrade logs.) Additional An
ghttpd.d/server.pem) to gain access. (The firmware download location is shown in a device's upgrade logs.) Additional Analyst Notes: - CVE Program Container: References: - https://www.verizon.com/info/reportsecurityvulnerability/ - https://github.com/JousterL/SecWriteups/blob/main/Verizon%20LVSKIHP%205G%20Modem/readme.md
CVE ID: CVE-2022-28372 State: PUBLISHED Published: 2022-07-14T12:28:59 Last Updated: 2024-08-03T05:56:14.901Z Vendors: n/a Products: n/a Problem Types: n/a Description: On Verizon 5G Home LVSKIHP InDoorUnit (IDU) 3.4.66.162 and OutDoorUnit (ODU) 3.33.101.0 devices, the CRTC and ODU RPC endpoints provide a means of provisioning a firmware update for the device via crtc_fw_upgrade or crtcfwimage. The URL provided is not validated, and thus allows for arbitrary file upload to the device. This occurs in /lib/lua/luci/crtc.lua (IDU) and /lib/functions/wnc_jsonsh/wnc_crtc_fw.sh (ODU). Additional Analyst Notes: - CVE Program Container: References: - https://www.verizon.com/info/reportsecurityvulner
ODU). Additional Analyst Notes: - CVE Program Container: References: - https://www.verizon.com/info/reportsecurityvulnerability/ - https://github.com/JousterL/SecWriteups/blob/main/Verizon%20LVSKIHP%205G%20Modem/readme.md
CVE ID: CVE-2022-28373 State: PUBLISHED Published: 2022-07-14T12:28:51 Last Updated: 2024-08-03T05:56:14.994Z Vendors: n/a Products: n/a Problem Types: n/a Description: Verizon 5G Home LVSKIHP InDoorUnit (IDU) 3.4.66.162 does not properly sanitize user-controlled parameters within the crtcreadpartition function of the crtcrpc JSON listener in /usr/lib/lua/luci/crtc.lua. A remote attacker on the local network can inject shell metacharacters to achieve remote code execution as root. Additional Analyst Notes: - CVE Program Container: References: - https://www.verizon.com/info/reportsecurityvulnerability/ - https://github.com/JousterL/SecWriteups/blob/main/Verizon%20LVSKIHP%205G%20Modem/readme.m
reportsecurityvulnerability/ - https://github.com/JousterL/SecWriteups/blob/main/Verizon%20LVSKIHP%205G%20Modem/readme.md
CVE ID: CVE-2022-28374 State: PUBLISHED Published: 2022-07-14T12:28:40 Last Updated: 2024-08-03T05:56:15.159Z Vendors: n/a Products: n/a Problem Types: n/a Description: Verizon 5G Home LVSKIHP OutDoorUnit (ODU) 3.33.101.0 does not property sanitize user-controlled parameters within the DMACC URLs on the Settings page of the Engineering portal. An authenticated remote attacker on the local network can inject shell metacharacters into /usr/lib/lua/5.1/luci/controller/admin/settings.lua to achieve remote code execution as root. Additional Analyst Notes: - CVE Program Container: References: - https://www.verizon.com/info/reportsecurityvulnerability/ - https://github.com/JousterL/SecWriteups/blob
: References: - https://www.verizon.com/info/reportsecurityvulnerability/ - https://github.com/JousterL/SecWriteups/blob/main/Verizon%20LVSKIHP%205G%20Modem/readme.md
CVE ID: CVE-2022-28375 State: PUBLISHED Published: 2022-07-14T12:28:33 Last Updated: 2024-08-03T05:56:14.946Z Vendors: n/a Products: n/a Problem Types: n/a Description: Verizon 5G Home LVSKIHP OutDoorUnit (ODU) 3.33.101.0 does not property sanitize user-controlled parameters within the crtcswitchsimprofile function of the crtcrpc JSON listener. A remote attacker on the local network can inject shell metacharacters into /usr/lib/lua/5.1/luci/controller/rpc.lua to achieve remote code execution as root, Additional Analyst Notes: - CVE Program Container: References: - https://www.verizon.com/info/reportsecurityvulnerability/ - https://github.com/JousterL/SecWriteups/blob/main/Verizon%20LVSKIHP%2
ww.verizon.com/info/reportsecurityvulnerability/ - https://github.com/JousterL/SecWriteups/blob/main/Verizon%20LVSKIHP%205G%20Modem/readme.md
CVE ID: CVE-2022-28376 State: PUBLISHED Published: 2022-04-03T03:27:43 Last Updated: 2024-08-03T05:56:15.219Z Vendors: n/a Products: n/a Problem Types: n/a Description: Verizon 5G Home LVSKIHP outside devices through 2022-02-15 allow anyone (knowing the device's serial number) to access a CPE admin website, e.g., at the 10.0.0.1 IP address. The password (for the verizon username) is calculated by concatenating the serial number and the model (i.e., the LVSKIHP string), running the sha256sum program, and extracting the first seven characters concatenated with the last seven characters of that SHA-256 value. Additional Analyst Notes: - CVE Program Container: References: - https://www.reddit.co
characters of that SHA-256 value. Additional Analyst Notes: - CVE Program Container: References: - https://www.reddit.com/r/verizon/comments/sstq4c/5g_home_internet_dropping_out/hx3ir0s/ - https://github.com/JousterL/SecWriteups/blob/main/Verizon%20LVSKIHP%205G%20Modem/readme.md
CVE ID: CVE-2022-28377 State: PUBLISHED Published: 2022-07-14T12:28:09 Last Updated: 2024-08-03T05:56:14.940Z Vendors: n/a Products: n/a Problem Types: n/a Description: On Verizon 5G Home LVSKIHP InDoorUnit (IDU) 3.4.66.162 and OutDoorUnit (ODU) 3.33.101.0 devices, the CRTC and ODU RPC endpoints rely on a static account username/password for access control. This password can be generated via a binary included in the firmware, after ascertaining the MAC address of the IDU's base Ethernet interface, and adding the string DEVICE_MANUFACTURER='Wistron_NeWeb_Corp.' to /etc/device_info to replicate the host environment. This occurs in /etc/init.d/wnc_factoryssidkeypwd (IDU). Additional Analyst Not
e_info to replicate the host environment. This occurs in /etc/init.d/wnc_factoryssidkeypwd (IDU). Additional Analyst Notes: - CVE Program Container: References: - https://www.verizon.com/info/reportsecurityvulnerability/ - https://github.com/JousterL/SecWriteups/blob/main/Verizon%20LVSKIHP%205G%20Modem/readme.md
CVE ID: CVE-2022-28378 State: PUBLISHED Published: 2022-04-03T17:28:54 Last Updated: 2024-08-03T05:56:15.241Z Vendors: n/a Products: n/a Problem Types: n/a Description: Craft CMS before 3.7.29 allows XSS. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#3729---2022-01-18
CVE ID: CVE-2022-28379 State: PUBLISHED Published: 2022-04-03T17:42:12 Last Updated: 2024-08-03T05:56:14.945Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:H/S:U/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: jc21.com Nginx Proxy Manager before 2.9.17 allows XSS during item deletion. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/NginxProxyManager/nginx-proxy-manager/issues/1950 - https://github.com/NginxProxyManager/nginx-proxy-manager/releases/tag/v2.9.17
CVE ID: CVE-2022-28380 State: PUBLISHED Published: 2022-04-03T17:55:06 Last Updated: 2024-08-03T05:56:15.156Z Vendors: n/a Products: n/a Problem Types: n/a Description: The rc-httpd component through 2022-03-31 for 9front (Plan 9 fork) allows ..%2f directory traversal if serve-static is used. Additional Analyst Notes: - CVE Program Container: References: - https://desuarchive.org/g/thread/86286230 - https://git.9front.org/plan9front/plan9front/241667b933ff5bacb9a3974f6877fb8aad78bed3/commit.html
CVE ID: CVE-2022-28381 State: PUBLISHED Published: 2022-04-03T18:30:20 Last Updated: 2024-08-03T05:56:15.255Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mediaserver.exe in ALLMediaServer 1.6 has a stack-based buffer overflow that allows remote attackers to execute arbitrary code via a long string to TCP port 888, a related issue to CVE-2017-17932. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Matrix07ksa/ALLMediaServer-1.6-Buffer-Overflow - http://packetstormsecurity.com/files/166573/ALLMediaServer-1.6-Buffer-Overflow.html
CVE ID: CVE-2022-28382 State: PUBLISHED Published: 2022-06-08T00:00:00 Last Updated: 2024-08-03T05:56:14.945Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in certain Verbatim drives through 2022-03-31. Due to the use of an insecure encryption AES mode (Electronic Codebook, aka ECB), an attacker may be able to extract information even from encrypted data, for example by observing repeating byte patterns. The firmware of the USB-to-SATA bridge controller INIC-3637EN uses AES-256 with the ECB mode. This operation mode of block ciphers (e.g., AES) always encrypts identical plaintext data, in this case blocks of 16 bytes, to identical ciphertext data. For som
., AES) always encrypts identical plaintext data, in this case blocks of 16 bytes, to identical ciphertext data. For some data, for instance bitmap images, the lack of the cryptographic property called diffusion, within ECB, can leak sensitive information even in encrypted data. Thus, the use of the ECB operation mode can put the confidentiality of specific information at risk, even in an encrypted form. This affects Keypad Secure USB 3.2 Gen 1 Drive Part Number #49428, Store 'n' Go Secure Portable HDD GD25LK01-3637-C VER4.0, Executive Fingerprint Secure SSD GDMSFE01-INI3637-C VER1.1, and Fingerprint Secure Portable Hard Drive Part Number #53650. Additional Analyst Notes: - CVE Program Conta
7-C VER1.1, and Fingerprint Secure Portable Hard Drive Part Number #53650. Additional Analyst Notes: - CVE Program Container: References: - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2022-002.txt - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2022-006.txt - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2022-010.txt - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2022-015.txt - http://seclists.org/fulldisclosure/2022/Jun/18 - http://seclists.org/fulldisclosure/2022/Jun/22 - http://seclists.org/fulldisclosure/2022/Jun/9 - http://seclists.org/fulldisclosure/2022/Jun/24 - http://packetstormsecurit
tp://seclists.org/fulldisclosure/2022/Jun/9 - http://seclists.org/fulldisclosure/2022/Jun/24 - http://packetstormsecurity.com/files/167491/Verbatim-Keypad-Secure-USB-3.2-Gen-1-Drive-ECB-Issue.html - http://packetstormsecurity.com/files/167500/Verbatim-Store-N-Go-Secure-Portable-HDD-GD25LK01-3637-C-VER4.0-Risky-Crypto.html - http://packetstormsecurity.com/files/167532/Verbatim-Fingerprint-Secure-Portable-Hard-Drive-53650-Risky-Crypto.html - http://packetstormsecurity.com/files/167528/Verbatim-Executive-Fingerprint-Secure-SSD-GDMSFE01-INI3637-C-VER1.1-Risky-Crypto.html - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2022-044.txt - http://seclists.org/fulldisclosure/2022
s://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2022-044.txt - http://seclists.org/fulldisclosure/2022/Oct/4
CVE ID: CVE-2022-28383 State: PUBLISHED Published: 2022-06-08T00:00:00 Last Updated: 2024-08-03T05:56:15.115Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in certain Verbatim drives through 2022-03-31. Due to insufficient firmware validation, an attacker can store malicious firmware code for the USB-to-SATA bridge controller on the USB drive (e.g., by leveraging physical access during the supply chain). This code is then executed. This affects Keypad Secure USB 3.2 Gen 1 Drive Part Number #49428, Store 'n' Go Secure Portable HDD GD25LK01-3637-C VER4.0, Executive Fingerprint Secure SSD GDMSFE01-INI3637-C VER1.1, and Fingerprint Secure Portable Hard Drive
1-3637-C VER4.0, Executive Fingerprint Secure SSD GDMSFE01-INI3637-C VER1.1, and Fingerprint Secure Portable Hard Drive Part Number #53650. Additional Analyst Notes: - CVE Program Container: References: - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2022-003.txt - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2022-007.txt - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2022-011.txt - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2022-016.txt - http://seclists.org/fulldisclosure/2022/Jun/19 - http://seclists.org/fulldisclosure/2022/Jun/25 - http://seclists.org/fulldisclosure/2022/Jun/10 - http://s
2022/Jun/19 - http://seclists.org/fulldisclosure/2022/Jun/25 - http://seclists.org/fulldisclosure/2022/Jun/10 - http://seclists.org/fulldisclosure/2022/Jun/12 - http://packetstormsecurity.com/files/167482/Verbatim-Keypad-Secure-USB-3.2-Gen-1-Drive-Missing-Control.html - http://packetstormsecurity.com/files/167508/Verbatim-Store-N-Go-Secure-Portable-HDD-GD25LK01-3637-C-VER4.0-Missing-Trust.html - http://packetstormsecurity.com/files/167535/Verbatim-Fingerprint-Secure-Portable-Hard-Drive-53650-Missing-Trust.html - http://packetstormsecurity.com/files/167539/Verbatim-Executive-Fingerprint-Secure-SSD-GDMSFE01-INI3637-C-VER1.1-Missing-Trust.html - https://www.syss.de/fileadmin/dokumente/Publikati
-Fingerprint-Secure-SSD-GDMSFE01-INI3637-C-VER1.1-Missing-Trust.html - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2022-045.txt - http://seclists.org/fulldisclosure/2022/Oct/5
CVE ID: CVE-2022-28384 State: PUBLISHED Published: 2022-06-08T00:00:00 Last Updated: 2024-08-03T05:56:14.937Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in certain Verbatim drives through 2022-03-31. Due to an insecure design, they allow an offline brute-force attack for determining the correct passcode, and thus gaining unauthorized access to the stored encrypted data. This affects Keypad Secure USB 3.2 Gen 1 Drive Part Number #49428 and Store 'n' Go Secure Portable HDD GD25LK01-3637-C VER4.0. Additional Analyst Notes: - CVE Program Container: References: - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2022-001.txt - https://ww
Container: References: - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2022-001.txt - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2022-005.txt - http://seclists.org/fulldisclosure/2022/Jun/17 - http://seclists.org/fulldisclosure/2022/Jun/8 - http://packetstormsecurity.com/files/167481/Verbatim-Keypad-Secure-USB-3.2-Gen-1-Drive-Cryptography-Issue.html - http://packetstormsecurity.com/files/167499/Verbatim-Store-N-Go-Secure-Portable-HDD-GD25LK01-3637-C-VER4.0-Risky-Crypto.html - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2022-043.txt - http://seclists.org/fulldisclosure/2022/Oct/3
CVE ID: CVE-2022-28385 State: PUBLISHED Published: 2022-06-08T15:39:26 Last Updated: 2024-08-03T05:56:15.177Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in certain Verbatim drives through 2022-03-31. Due to missing integrity checks, an attacker can manipulate the content of the emulated CD-ROM drive (containing the Windows and macOS client software). The content of this emulated CD-ROM drive is stored as an ISO-9660 image in the hidden sectors of the USB drive, that can only be accessed using special IOCTL commands, or when installing the drive in an external disk enclosure. By manipulating this ISO-9660 image or replacing it with another one, an attac
the drive in an external disk enclosure. By manipulating this ISO-9660 image or replacing it with another one, an attacker is able to store malicious software on the emulated CD-ROM drive. This software may get executed by an unsuspecting victim when using the device. For example, an attacker with temporary physical access during the supply chain could program a modified ISO-9660 image on a device that always accepts an attacker-controlled password for unlocking the device. If the attacker later on gains access to the used USB drive, he can simply decrypt all contained user data. Storing arbitrary other malicious software is also possible. This affects Executive Fingerprint Secure SSD GDMSF
r data. Storing arbitrary other malicious software is also possible. This affects Executive Fingerprint Secure SSD GDMSFE01-INI3637-C VER1.1 and Fingerprint Secure Portable Hard Drive Part Number #53650. Additional Analyst Notes: - CVE Program Container: References: - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2022-013.txt - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2022-017.txt - http://seclists.org/fulldisclosure/2022/Jun/23 - http://seclists.org/fulldisclosure/2022/Jun/26 - http://packetstormsecurity.com/files/167546/Verbatim-Executive-Fingerprint-Secure-SSD-GDMSFE01-INI3637-C-VER1.1-Insufficient-Verification.html - http://packetstorm
/Verbatim-Executive-Fingerprint-Secure-SSD-GDMSFE01-INI3637-C-VER1.1-Insufficient-Verification.html - http://packetstormsecurity.com/files/167536/Verbatim-Fingerprint-Secure-Portable-Hard-Drive-53650-Insufficient-Verification.html
CVE ID: CVE-2022-28386 State: PUBLISHED Published: 2022-06-08T00:00:00 Last Updated: 2024-08-03T05:56:14.917Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in certain Verbatim drives through 2022-03-31. The security feature for lockout (e.g., requiring a reformat of the drive after 20 failed unlock attempts) does not work as specified. More than 20 attempts may be made. This affects Keypad Secure USB 3.2 Gen 1 Drive Part Number #49428 and Store 'n' Go Secure Portable HDD GD25LK01-3637-C VER4.0. Additional Analyst Notes: - CVE Program Container: References: - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2022-004.txt - https://www.s
tainer: References: - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2022-004.txt - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2022-008.txt - http://seclists.org/fulldisclosure/2022/Jun/11 - http://seclists.org/fulldisclosure/2022/Jun/20 - http://packetstormsecurity.com/files/167509/Verbatim-Store-N-Go-Secure-Portable-HDD-GD25LK01-3637-C-VER4.0-Behavior-Violation.html - http://packetstormsecurity.com/files/167492/Verbatim-Keypad-Secure-USB-3.2-Gen-1-Drive-Passcode-Retry.html - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2022-046.txt - http://seclists.org/fulldisclosure/2022/Oct/6