Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-36215 State: PUBLISHED Published: 2022-08-17T19:12:41 Last Updated: 2024-08-03T10:00:04.288Z Vendors: n/a Products: n/a Problem Types: n/a Description: DedeBIZ v6 was discovered to contain a remote code execution vulnerability in sys_info.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/whitehatl/Vulnerability/blob/main/web/dedebiz/6.0.0/sys_info.poc.md
CVE ID: CVE-2022-36216 State: PUBLISHED Published: 2022-08-17T19:06:03 Last Updated: 2024-08-03T10:00:04.320Z Vendors: n/a Products: n/a Problem Types: n/a Description: DedeCMS v5.7.94 - v5.7.97 was discovered to contain a remote code execution vulnerability in member_toadmin.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/whitehatl/Vulnerability/blob/main/web/dedecms/5.7.94/member_toadmin.poc.md
CVE ID: CVE-2022-36220 State: PUBLISHED Published: 2022-08-19T12:42:04 Last Updated: 2024-08-03T10:00:04.207Z Vendors: n/a Products: n/a Problem Types: n/a Description: Kiosk breakout (without quit password) in Safe Exam Browser (Windows) <3.4.0, which allows an attacker to achieve code execution via the browsers' print dialog. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/SafeExamBrowser/seb-win-refactoring/issues/434 - https://safeexambrowser.org/windows/win_release_notes_en.html
CVE ID: CVE-2022-36221 State: PUBLISHED Published: 2022-12-21T00:00:00.000Z Last Updated: 2025-04-16T18:09:24.973Z Vendors: n/a Products: n/a Problem Types: n/a Description: Nokia Fastmile 3tg00118abad52 is affected by an authenticated path traversal vulnerability which allows attackers to read any named pipe file on the system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://eddiez.me/hacking-the-nokia-fastmile-pt2/#pipe-path-traversal
CVE ID: CVE-2022-36222 State: PUBLISHED Published: 2022-12-21T00:00:00.000Z Last Updated: 2025-04-16T17:58:07.561Z Vendors: n/a Products: n/a Problem Types: n/a Description: Nokia Fastmile 3tg00118abad52 devices shipped by Optus are shipped with a default hardcoded admin account of admin:Nq+L5st7o This account can be used locally to access the web admin interface. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://eddiez.me/hacking-the-nokia-fastmile-pt2/#identical-super-admin-passwords
CVE ID: CVE-2022-36223 State: PUBLISHED Published: 2022-12-16T00:00:00.000Z Last Updated: 2025-04-18T13:24:24.550Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Emby Server 4.6.7.0, the playlist name field is vulnerable to XSS stored where it is possible to steal the administrator access token and flip or steal the media server administrator account. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://medium.com/%40cupc4k3/administrator-account-takeover-in-emby-media-server-616fc2a6704f
CVE ID: CVE-2022-36224 State: PUBLISHED Published: 2022-08-19T16:34:16 Last Updated: 2024-08-03T10:00:04.174Z Vendors: n/a Products: n/a Problem Types: n/a Description: XunRuiCMS V4.5.6 is vulnerable to Cross Site Request Forgery (CSRF). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/dayrui/xunruicms/issues/1
CVE ID: CVE-2022-36225 State: PUBLISHED Published: 2022-08-19T16:43:49 Last Updated: 2024-08-03T10:00:04.302Z Vendors: n/a Products: n/a Problem Types: n/a Description: EyouCMS V1.5.8-UTF8-SP1 is vulnerable to Cross Site Request Forgery (CSRF) via the background, column management function and add. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/weng-xianhu/eyoucms/issues/26
CVE ID: CVE-2022-36226 State: PUBLISHED Published: 2022-08-25T23:37:21 Last Updated: 2024-08-03T10:00:04.327Z Vendors: n/a Products: n/a Problem Types: n/a Description: SiteServerCMS 5.X has a Remote-download-Getshell-vulnerability via /SiteServer/Ajax/ajaxOtherService.aspx. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/we1h0/SiteServer-CMS-Remote-download-Getshell - https://www.slpyue.com
CVE ID: CVE-2022-36227 State: PUBLISHED Published: 2022-11-22T00:00:00.000Z Last Updated: 2025-11-03T21:46:29.036Z Vendors: n/a Products: n/a Problem Types: n/a Description: In libarchive before 3.6.2, the software does not check for an error after calling calloc function that can return with a NULL pointer if the function fails, which leads to a resultant NULL pointer dereference. NOTE: the discoverer cites this CWE-476 remark but third parties dispute the code-execution impact: "In rare circumstances, when NULL is equivalent to the 0x0 memory address and privileged code can access it, then writing or reading memory is possible, which may lead to code execution." Additional Analyst Notes: -
an access it, then writing or reading memory is possible, which may lead to code execution." Additional Analyst Notes: - CVE Program Container: References: - https://github.com/libarchive/libarchive/issues/1754 - https://bugs.gentoo.org/882521 - https://github.com/libarchive/libarchive/blob/v3.0.0a/libarchive/archive_write.c#L215 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V67OO2UUQAUJS3IK4JZPF6F3LUCBU6IS/ - https://lists.debian.org/debian-lts-announce/2023/01/msg00034.html - https://security.gentoo.org/glsa/202309-14
CVE ID: CVE-2022-36228 State: PUBLISHED Published: 2023-10-09T00:00:00 Last Updated: 2024-10-30T14:21:56.998Z Vendors: n/a Products: n/a Problem Types: n/a Description: Nokelock Smart padlock O1 Version 5.3.0 is vulnerable to Insecure Permissions. By sending a request, you can add any device and set the device password in the Nokelock app. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gist.github.com/YTrick/59c06611052d3fdae034e7087293bbc0
CVE ID: CVE-2022-36231 State: PUBLISHED Published: 2023-02-23T00:00:00.000Z Last Updated: 2025-03-13T19:40:15.624Z Vendors: n/a Products: n/a Problem Types: n/a Description: pdf_info 0.5.3 is vulnerable to Command Execution because the Ruby code uses backticks instead of Open3. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://rubygems.org/gems/pdf_info - https://github.com/affix/CVE-2022-36231 - https://github.com/newspaperclub/pdf_info/pull/15 - https://github.com/newspaperclub/pdf_info/issues/16
CVE ID: CVE-2022-36233 State: PUBLISHED Published: 2022-08-19T21:31:12 Last Updated: 2024-08-03T10:00:04.233Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda AC9 V15.03.2.13 is vulnerable to Buffer Overflow via httpd, form_fast_setting_wifi_set. httpd. Additional Analyst Notes: - CVE Program Container: References: - http://tenda.com - https://www.cnblogs.com/Amalll/p/16606980.html
CVE ID: CVE-2022-36234 State: PUBLISHED Published: 2022-07-28T22:50:03 Last Updated: 2024-08-03T10:00:04.281Z Vendors: n/a Products: n/a Problem Types: n/a Description: SimpleNetwork TCP Server commit 29bc615f0d9910eb2f59aa8dff1f54f0e3af4496 was discovered to contain a double free vulnerability which is exploited via crafted TCP packets. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/kashimAstro/SimpleNetwork/issues/22
CVE ID: CVE-2022-36242 State: PUBLISHED Published: 2022-08-16T16:56:30 Last Updated: 2024-08-03T10:00:04.283Z Vendors: n/a Products: n/a Problem Types: n/a Description: Clinic's Patient Management System v1.0 is vulnerable to SQL Injection via /pms/update_medicine.php?id=. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/MouZhou/bug_report/blob/main/vendors/oretnom23/clinics-patient-management-system/SQLi-1.md
CVE ID: CVE-2022-36243 State: PUBLISHED Published: 2023-05-30T00:00:00 Last Updated: 2025-01-13T20:56:36.011Z Vendors: Shop Beat Products: studio Problem Types: CWE-548 Description: Shop Beat Solutions (pty) LTD Shop Beat Media Player 2.5.95 up to 3.2.57 is vulnerable to Directory Traversal via server.shopbeat.co.za. Information Exposure Through Directory Listing vulnerability in "studio" software of Shop Beat. This issue affects: Shop Beat studio studio versions prior to 3.2.57 on arm. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.shopbeat.co.za
CVE ID: CVE-2022-36244 State: PUBLISHED Published: 2023-05-30T00:00:00 Last Updated: 2025-01-13T20:55:19.155Z Vendors: Shop Beat Products: studio Problem Types: CWE-79 Description: Shop Beat Solutions (Pty) LTD Shop Beat Media Player 2.5.95 up to 3.2.57 suffers from Multiple Stored Cross-Site Scripting (XSS) vulnerabilities via Shop Beat Control Panel found at www.shopbeat.co.za controlpanel.shopbeat.co.za. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.shopbeat.co.za
CVE ID: CVE-2022-36246 State: PUBLISHED Published: 2023-05-30T00:00:00 Last Updated: 2025-01-13T20:54:08.746Z Vendors: Shop Beat Products: studio Problem Types: CWE-264 Description: Shop Beat Solutions (Pty) LTD Shop Beat Media Player 2.5.95 up to 3.2.57 is vulnerable to Insecure Permissions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.shopbeat.co.za
CVE ID: CVE-2022-36247 State: PUBLISHED Published: 2023-05-30T00:00:00 Last Updated: 2025-01-13T20:53:20.516Z Vendors: Shop Beat Products: studio Problem Types: By modifying IDOR data on controlpanel.shopbeat.co.za an attacker could manipulate unauthorised assets. Description: Shop Beat Solutions (Pty) LTD Shop Beat Media Player 2.5.95 up to 3.2.57 is vulnerable to IDOR via controlpanel.shopbeat.co.za. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.shopbeat.co.za
CVE ID: CVE-2022-36249 State: PUBLISHED Published: 2023-05-30T00:00:00 Last Updated: 2025-01-13T20:51:29.627Z Vendors: Shop Beat Products: studio Problem Types: CWE-288 Description: Shop Beat Solutions (Pty) LTD Shop Beat Media Player 2.5.95 up to 3.2.57 is vulnerable to Bypass 2FA via APIs. For Controlpanel Lite. "After login we are directly able to use the bearer token or jsession ID to access the apis instead of entering the 2FA code. Thus, leading to bypass of 2FA on API level. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.shopbeat.co.za
CVE ID: CVE-2022-36250 State: PUBLISHED Published: 2023-05-30T00:00:00 Last Updated: 2025-01-13T20:50:36.099Z Vendors: Shop Beat Products: studio Problem Types: CWE-352 Description: Shop Beat Solutions (Pty) LTD Shop Beat Media Player 2.5.95 up to 3.2.57 is vulnerable to Cross Site Request Forgery (CSRF). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.shopbeat.co.za
CVE ID: CVE-2022-36251 State: PUBLISHED Published: 2022-08-22T00:37:38 Last Updated: 2024-08-03T10:00:04.307Z Vendors: n/a Products: n/a Problem Types: n/a Description: Clinic's Patient Management System v1.0 is vulnerable to Cross Site Scripting (XSS) via patients.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ZhenKaiHe/bug_report/blob/main/vendors/onetnom23/clinics-patient-management-system/XSS-1.md
CVE ID: CVE-2022-36254 State: PUBLISHED Published: 2022-09-12T03:04:08 Last Updated: 2024-08-03T10:00:04.255Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple persistent cross-site scripting (XSS) vulnerabilities in index.php in tramyardg Hotel Management System 1.0 allow remote attackers to inject arbitrary web script or HTML via multiple parameters such as "fullname". Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tramyardg/hotel-mgmt-system - https://gist.github.com/ziyishen97/c464b459df73c4cef241e7ec774b7cf6
CVE ID: CVE-2022-36255 State: PUBLISHED Published: 2022-09-12T03:06:49 Last Updated: 2024-08-03T10:00:04.310Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection vulnerability in SupplierDAO.java in sazanrjb InventoryManagementSystem 1.0 allows attackers to execute arbitrary SQL commands via the parameters such as "searchTxt". Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sazanrjb/InventoryManagementSystem/issues/14 - https://github.com/sazanrjb/InventoryManagementSystem - https://gist.github.com/ziyishen97/268678bca3034c64861b135946ee9fc3
CVE ID: CVE-2022-36256 State: PUBLISHED Published: 2022-09-12T03:08:56 Last Updated: 2024-08-03T10:00:04.275Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection vulnerability in Stocks.java in sazanrjb InventoryManagementSystem 1.0 allows attackers to execute arbitrary SQL commands via the parameters such as "productcode". Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sazanrjb/InventoryManagementSystem/issues/14 - https://github.com/sazanrjb/InventoryManagementSystem - https://gist.github.com/ziyishen97/0fd90a5939ffb401e8a74f4a415e1610
CVE ID: CVE-2022-36257 State: PUBLISHED Published: 2022-09-12T03:11:12 Last Updated: 2024-08-03T10:00:04.310Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection vulnerability in UserDAO.java in sazanrjb InventoryManagementSystem 1.0 allows attackers to execute arbitrary SQL commands via the parameters such as "users", "pass", etc. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sazanrjb/InventoryManagementSystem/issues/14 - https://github.com/sazanrjb/InventoryManagementSystem - https://gist.github.com/ziyishen97/ff3816032a76796f45368ed243ab3343
CVE ID: CVE-2022-36258 State: PUBLISHED Published: 2022-09-12T03:12:59 Last Updated: 2024-08-03T10:00:04.336Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection vulnerability in CustomerDAO.java in sazanrjb InventoryManagementSystem 1.0 allows attackers to execute arbitrary SQL commands via the parameters such as "searchTxt". Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sazanrjb/InventoryManagementSystem/issues/14 - https://github.com/sazanrjb/InventoryManagementSystem - https://gist.github.com/ziyishen97/3553468b534c250f7b0d47e8a4c5fa52
CVE ID: CVE-2022-36259 State: PUBLISHED Published: 2022-09-12T03:14:33 Last Updated: 2024-08-03T10:00:04.284Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection vulnerability in ConnectionFactory.java in sazanrjb InventoryManagementSystem 1.0 allows attackers to execute arbitrary SQL commands via the parameters such as "username", "password", etc. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sazanrjb/InventoryManagementSystem/issues/14 - https://github.com/sazanrjb/InventoryManagementSystem - https://gist.github.com/ziyishen97/47666f584cd4cdad1d0f6af5f33a56db
CVE ID: CVE-2022-36261 State: PUBLISHED Published: 2022-08-23T12:46:47 Last Updated: 2024-08-03T10:00:04.290Z Vendors: n/a Products: n/a Problem Types: n/a Description: An arbitrary file deletion vulnerability was discovered in taocms 3.0.2, that allows attacker to delete file in server when request url admin.php?action=file&ctrl=del&path=/../../../test.txt Additional Analyst Notes: - CVE Program Container: References: - https://github.com/chasingboy/cms-pentest/blob/main/taocms-arbitrary-file-deletion-vulnerability.md - https://github.com/chasingboy/cms-pentest/blob/main/taocms-arbitrary-file-deletion-vulnerability.md?by=xboy%28topsec%29
CVE ID: CVE-2022-36262 State: PUBLISHED Published: 2022-08-15T11:30:59 Last Updated: 2024-08-03T10:00:04.318Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in taocms 3.0.2. in the website settings that allows arbitrary php code to be injected by modifying config.php. Additional Analyst Notes: - CVE Program Container: References: - http://taocms.com - https://github.com/taogogo/taocms - https://github.com/taogogo/taocms/issues/34 - https://github.com/taogogo/taocms/issues/34?by=xboy%28topsec%29
CVE ID: CVE-2022-36263 State: PUBLISHED Published: 2022-08-19T14:48:11.000Z Last Updated: 2025-06-27T13:39:29.544Z Vendors: n/a Products: n/a Problem Types: n/a Description: StreamLabs Desktop Application 1.9.0 is vulnerable to Incorrect Access Control via obs64.exe. An attacker can execute arbitrary code via a crafted .exe file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ycdxsb/Vuln/blob/main/Streamlabs-CreateProcessW-API-Misuse-Binary-Hijack/
CVE ID: CVE-2022-36264 State: PUBLISHED Published: 2022-08-08T14:38:01 Last Updated: 2024-08-03T10:00:04.412Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Airspan AirSpot 5410 version 0.3.4.1-4 and under there exists an Unauthenticated remote Arbitrary File Upload vulnerability which allows overwriting arbitrary files. A malicious actor can remotely upload a file of their choice and overwrite any file in the system by manipulating the filename and append a relative path that will be interpreted during the upload process. Using this method, it is possible to rewrite any file in the system or upload a new file. Additional Analyst Notes: - CVE Program Container: References: - h
rewrite any file in the system or upload a new file. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/Nwqda/e82b3155401b094372195fdaa9b54833 - https://wdi.rfwel.com/cdn/techdocs/AirSpot5410.pdf
CVE ID: CVE-2022-36265 State: PUBLISHED Published: 2022-08-08T14:36:44 Last Updated: 2024-08-03T10:00:04.314Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Airspan AirSpot 5410 version 0.3.4.1-4 and under there exists a Hidden system command web page. After performing a reverse engineering of the firmware, it was discovered that a hidden page not listed in the administration management interface allows a user to execute Linux commands on the device with root privileges. An authenticated malicious threat actor can use this page to fully compromise the device. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/Nwqda/e82b3155401b094372195fda
Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/Nwqda/e82b3155401b094372195fdaa9b54833 - https://wdi.rfwel.com/cdn/techdocs/AirSpot5410.pdf
CVE ID: CVE-2022-36266 State: PUBLISHED Published: 2022-08-08T14:35:29 Last Updated: 2024-08-03T10:00:04.483Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Airspan AirSpot 5410 version 0.3.4.1-4 and under there exists a stored XSS vulnerability. As the binary file /home/www/cgi-bin/login.cgi does not check if the user is authenticated, a malicious actor can craft a specific request on the login.cgi endpoint that contains a base32 encoded XSS payload that will be accepted and stored. A successful attack will results in the injection of malicious scripts into the user settings page. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/Nwqda/e
the user settings page. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/Nwqda/e82b3155401b094372195fdaa9b54833 - https://wdi.rfwel.com/cdn/techdocs/AirSpot5410.pdf - http://packetstormsecurity.com/files/168114/FLIX-AX8-1.46.16-Remote-Command-Execution.html
CVE ID: CVE-2022-36267 State: PUBLISHED Published: 2022-08-08T14:34:15 Last Updated: 2024-08-03T10:00:04.316Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Airspan AirSpot 5410 version 0.3.4.1-4 and under there exists a Unauthenticated remote command injection vulnerability. The ping functionality can be called without user authentication when crafting a malicious http request by injecting code in one of the parameters allowing for remote code execution. This vulnerability is exploited via the binary file /home/www/cgi-bin/diagnostics.cgi that accepts unauthenticated requests and unsanitized data. As a result, a malicious actor can craft a specific request and interact remote
enticated requests and unsanitized data. As a result, a malicious actor can craft a specific request and interact remotely with the device. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/Nwqda/e82b3155401b094372195fdaa9b54833 - https://wdi.rfwel.com/cdn/techdocs/AirSpot5410.pdf - http://packetstormsecurity.com/files/168047/AirSpot-5410-0.3.4.1-4-Remote-Command-Injection.html
CVE ID: CVE-2022-36270 State: PUBLISHED Published: 2022-08-10T16:32:26 Last Updated: 2024-08-03T10:00:04.335Z Vendors: n/a Products: n/a Problem Types: n/a Description: Clinic's Patient Management System v1.0 has arbitrary code execution via url: ip/pms/users.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/FF9118/bug_report/blob/main/vendors/oretnom23/clinics-patient-management-system/RCE-1.md
CVE ID: CVE-2022-36271 State: PUBLISHED Published: 2022-09-07T13:46:44 Last Updated: 2024-08-03T10:00:04.316Z Vendors: n/a Products: n/a Problem Types: n/a Description: Outbyte PC Repair Installation File 1.7.112.7856 is vulnerable to Dll Hijacking. iertutil.dll is missing so an attacker can use a malicious dll with same name and can get admin privileges. Additional Analyst Notes: - CVE Program Container: References: - http://outbyte.com - https://github.com/SaumyajeetDas/POC-of-CVE-2022-36271
CVE ID: CVE-2022-36272 State: PUBLISHED Published: 2022-08-16T12:49:14 Last Updated: 2024-08-03T10:00:04.231Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mingsoft MCMS 5.2.8 was discovered to contain a SQL injection vulnerability in /mdiy/page/verify URI via fieldName parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ming-soft/MCMS/issues/97
CVE ID: CVE-2022-36273 State: PUBLISHED Published: 2022-08-16T12:43:35 Last Updated: 2024-08-03T10:00:04.288Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda AC9 V15.03.2.21_cn is vulnerable to command injection via goform/SetSysTimeCfg. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/F0und-icu/CVEIDs/tree/main/TendaAC9
CVE ID: CVE-2022-36276 State: PUBLISHED Published: 2023-10-04T15:04:11.438Z Last Updated: 2024-09-05T18:07:23.795Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L) Vendors: TCMAN Products: GIM Problem Types: CWE-89 Description: TCMAN GIM v8.0.1 is vulnerable to a SQL injection via the 'SqlWhere' parameter inside the function 'BuscarESM'. The exploitation of this vulnerability might allow a remote attacker to directly interact with the database. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tcman-gim
CVE ID: CVE-2022-36277 State: PUBLISHED Published: 2023-10-04T15:05:35.689Z Last Updated: 2024-09-05T18:06:41.819Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: TCMAN Products: GIM Problem Types: CWE-79 Description: The 'sReferencia', 'sDescripcion', 'txtCodigo' and 'txtDescripcion' parameters, in the frmGestionStock.aspx and frmEditServicio.aspx files in TCMAN GIM v8.0.1, could allow an attacker to perform persistent XSS attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tcman-gim
CVE ID: CVE-2022-36278 State: PUBLISHED Published: 2023-02-16T20:00:05.751Z Last Updated: 2025-01-27T18:20:16.751Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) Battery Life Diagnostic Tool software Problem Types: escalation of privilege Description: Insufficient control flow management in the Intel(R) Battery Life Diagnostic Tool software before version 2.2.0 may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00726.html