Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-45194 State: PUBLISHED Published: 2022-11-11T00:00:00.000Z Last Updated: 2025-05-01T13:59:27.887Z Severity: LOW (CVSS 3.8 CVSS:3.1/AC:L/AV:A/A:N/C:L/I:N/PR:N/S:C/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: CBRN-Analysis before 22 allows XXE attacks via am mws XML document, leading to NTLMv2-SSP hash disclosure. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://zigrin.com/advisories/cbrn-analysis-external-xml-entity-injection/
CVE ID: CVE-2022-45195 State: PUBLISHED Published: 2022-11-12T00:00:00.000Z Last Updated: 2025-05-01T13:37:08.170Z Vendors: n/a Products: n/a Problem Types: n/a Description: SimpleXMQ before 3.4.0, as used in SimpleX Chat before 4.2, does not apply a key derivation function to intended data, which can interfere with forward secrecy and can have other impacts if there is a compromise of a single private key. This occurs in the X3DH key exchange for the double ratchet protocol. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/trailofbits/publications/blob/master/reviews/SimpleXChat.pdf - https://simplex.chat/blog/20221108-simplex-chat
ithub.com/trailofbits/publications/blob/master/reviews/SimpleXChat.pdf - https://simplex.chat/blog/20221108-simplex-chat-v4.2-security-audit-new-website.html - https://github.com/simplex-chat/simplexmq/pull/548 - https://github.com/simplex-chat/simplexmq/compare/v3.3.0...v3.4.0
CVE ID: CVE-2022-45196 State: PUBLISHED Published: 2022-11-12T00:00:00.000Z Last Updated: 2025-05-01T18:59:54.349Z Vendors: n/a Products: n/a Problem Types: n/a Description: Hyperledger Fabric 2.3 allows attackers to cause a denial of service (orderer crash) by repeatedly sending a crafted channel tx with the same Channel name. NOTE: the official Fabric with Raft prevents exploitation via a locking mechanism and a check for names that already exist. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/SmartBFT-Go/fabric/issues/286 - https://github.com/hyperledger/fabric/pull/2934
CVE ID: CVE-2022-45197 State: PUBLISHED Published: 2022-12-25T00:00:00.000Z Last Updated: 2025-04-14T18:20:25.935Z Vendors: n/a Products: n/a Problem Types: n/a Description: Slixmpp before 1.8.3 lacks SSL Certificate hostname validation in XMLStream, allowing an attacker to pose as any server in the eyes of Slixmpp. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/poezio/slixmpp/tags - https://github.com/poezio/slixmpp/commits/master/slixmpp/xmlstream/xmlstream.py - https://lab.louiz.org/poezio/slixmpp/-/commits/master - https://lab.louiz.org/poezio/slixmpp/-/commit/b60b1b985db928532f97c4f61d6fbc801f0aa7fa - https://security.gentoo.
ster - https://lab.louiz.org/poezio/slixmpp/-/commit/b60b1b985db928532f97c4f61d6fbc801f0aa7fa - https://security.gentoo.org/glsa/202305-07
CVE ID: CVE-2022-45198 State: PUBLISHED Published: 2022-11-14T00:00:00 Last Updated: 2024-08-03T14:09:56.639Z Vendors: n/a Products: n/a Problem Types: n/a Description: Pillow before 9.2.0 performs Improper Handling of Highly Compressed GIF Data (Data Amplification). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/python-pillow/Pillow/commit/11918eac0628ec8ac0812670d9838361ead2d6a4 - https://github.com/python-pillow/Pillow/pull/6402 - https://bugs.gentoo.org/855683 - https://github.com/python-pillow/Pillow/releases/tag/9.2.0 - https://cwe.mitre.org/data/definitions/409.html - https://security.gentoo.org/glsa/202211-10
CVE ID: CVE-2022-45199 State: PUBLISHED Published: 2022-11-14T00:00:00 Last Updated: 2024-08-03T14:09:56.981Z Vendors: n/a Products: n/a Problem Types: n/a Description: Pillow before 9.3.0 allows denial of service via SAMPLESPERPIXEL. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/python-pillow/Pillow/commit/2444cddab2f83f28687c7c20871574acbb6dbcf3 - https://github.com/python-pillow/Pillow/pull/6700 - https://bugs.gentoo.org/878769 - https://github.com/python-pillow/Pillow/releases/tag/9.3.0 - https://security.gentoo.org/glsa/202211-10
CVE ID: CVE-2022-45202 State: PUBLISHED Published: 2022-11-29T00:00:00.000Z Last Updated: 2025-04-25T14:48:40.277Z Vendors: n/a Products: n/a Problem Types: n/a Description: GPAC v2.1-DEV-rev428-gcb8ae46c8-master was discovered to contain a stack overflow via the function dimC_box_read at isomedia/box_code_3gpp.c. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/gpac/gpac/issues/2296 - https://www.debian.org/security/2023/dsa-5411
CVE ID: CVE-2022-45204 State: PUBLISHED Published: 2022-11-29T00:00:00.000Z Last Updated: 2025-04-25T14:47:41.342Z Vendors: n/a Products: n/a Problem Types: n/a Description: GPAC v2.1-DEV-rev428-gcb8ae46c8-master was discovered to contain a memory leak via the function dimC_box_read at isomedia/box_code_3gpp.c. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/gpac/gpac/issues/2307
CVE ID: CVE-2022-45205 State: PUBLISHED Published: 2022-11-25T00:00:00.000Z Last Updated: 2025-04-29T14:20:47.951Z Vendors: n/a Products: n/a Problem Types: n/a Description: Jeecg-boot v3.4.3 was discovered to contain a SQL injection vulnerability via the component /sys/dict/queryTableData. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://jeecg-boot.com - https://github.com/jeecgboot/jeecg-boot/issues/4128
CVE ID: CVE-2022-45206 State: PUBLISHED Published: 2022-11-25T00:00:00.000Z Last Updated: 2025-04-29T14:18:23.009Z Vendors: n/a Products: n/a Problem Types: n/a Description: Jeecg-boot v3.4.3 was discovered to contain a SQL injection vulnerability via the component /sys/duplicate/check. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://jeecg-boot.com - https://github.com/jeecgboot/jeecg-boot/issues/4129
CVE ID: CVE-2022-45207 State: PUBLISHED Published: 2022-11-25T00:00:00.000Z Last Updated: 2025-04-29T14:16:39.890Z Vendors: n/a Products: n/a Problem Types: n/a Description: Jeecg-boot v3.4.3 was discovered to contain a SQL injection vulnerability via the component updateNullByEmptyString. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://jeecg-boot.com - https://github.com/jeecgboot/jeecg-boot/issues/4127
CVE ID: CVE-2022-45208 State: PUBLISHED Published: 2022-11-25T00:00:00.000Z Last Updated: 2025-04-29T14:14:49.142Z Vendors: n/a Products: n/a Problem Types: n/a Description: Jeecg-boot v3.4.3 was discovered to contain a SQL injection vulnerability via the component /sys/user/putRecycleBin. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://jeecg-boot.com - https://github.com/jeecgboot/jeecg-boot/issues/4126
CVE ID: CVE-2022-45210 State: PUBLISHED Published: 2022-11-25T00:00:00.000Z Last Updated: 2025-04-29T14:13:58.518Z Vendors: n/a Products: n/a Problem Types: n/a Description: Jeecg-boot v3.4.3 was discovered to contain a SQL injection vulnerability via the component /sys/user/deleteRecycleBin. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://jeecg-boot.com - https://github.com/jeecgboot/jeecg-boot/issues/4125
CVE ID: CVE-2022-45213 State: PUBLISHED Published: 2023-01-01T00:00:00.000Z Last Updated: 2025-04-10T19:19:44.782Z Vendors: n/a Products: n/a Problem Types: n/a Description: perfSONAR before 4.4.6 inadvertently supports the parse option for a file:// URL. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.perfsonar.net/releasenotes-2022-11-09-4-4-6.html - https://zxsecurity.co.nz/research/advisories/perfsonar-multiple/
CVE ID: CVE-2022-45214 State: PUBLISHED Published: 2022-11-28T00:00:00.000Z Last Updated: 2025-04-25T19:47:54.377Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in Sanitization Management System v1.0.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the username parameter at /php-sms/classes/Login.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Rajeshwar40/CVE/blob/main/CVE-2022-45214.txt
CVE ID: CVE-2022-45215 State: PUBLISHED Published: 2022-12-02T00:00:00.000Z Last Updated: 2025-04-24T19:19:03.033Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in Book Store Management System v1.0.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter under the Add New System User module. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.sourcecodester.com/php/15748/book-store-management-system-project-using-php-codeigniter-3-free-source-code.html - https://github.com/Rajeshwar40/CVE/blob/main/CVE-2022-45215
CVE ID: CVE-2022-45217 State: PUBLISHED Published: 2022-12-07T00:00:00.000Z Last Updated: 2025-04-23T18:40:15.584Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in Book Store Management System v1.0.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Level parameter under the Add New System User module. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.sourcecodester.com/php/15748/book-store-management-system-project-using-php-codeigniter-3-free-source-code.html - https://github.com/sudoninja-noob/CVE-2022-45217/blob/main/CVE-2022-45217
CVE ID: CVE-2022-45218 State: PUBLISHED Published: 2022-11-25T00:00:00 Last Updated: 2024-08-03T14:09:56.613Z Vendors: n/a Products: n/a Problem Types: n/a Description: Human Resource Management System v1.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability. This vulnerability is triggered via a crafted payload injected into an authentication error message. Additional Analyst Notes: - CVE Program Container: References: - https://www.sourcecodester.com/sites/default/files/download/oretnom23/hrm.zip - https://github.com/Rajeshwar40/CVE/blob/main/CVE-2022-45218
CVE ID: CVE-2022-45221 State: PUBLISHED Published: 2022-11-28T00:00:00.000Z Last Updated: 2025-04-25T19:49:04.372Z Vendors: n/a Products: n/a Problem Types: n/a Description: Web-Based Student Clearance System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability in changepassword.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the txtnew_password parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://medium.com/%40just0rg/web-based-student-clearance-system-in-php-free-source-code-v1-0-unrestricted-input-leads-to-xss-5802ead12124
CVE ID: CVE-2022-45223 State: PUBLISHED Published: 2022-11-28T00:00:00.000Z Last Updated: 2025-04-28T18:21:15.441Z Vendors: n/a Products: n/a Problem Types: n/a Description: Web-Based Student Clearance System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability in /Admin/add-student.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the txtfullname parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://medium.com/%40just0rg/web-based-student-clearance-system-in-php-free-source-code-v1-0-unrestricted-input-leads-to-xss-5802ead12124
CVE ID: CVE-2022-45224 State: PUBLISHED Published: 2022-11-28T00:00:00.000Z Last Updated: 2025-04-28T18:15:45.212Z Vendors: n/a Products: n/a Problem Types: n/a Description: Web-Based Student Clearance System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability in Admin/add-admin.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the txtfullname parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://medium.com/%40just0rg/book-store-management-system-1-0-unrestricted-input-leads-to-xss-74506d42492e
CVE ID: CVE-2022-45225 State: PUBLISHED Published: 2022-11-25T00:00:00.000Z Last Updated: 2025-04-29T14:10:18.572Z Vendors: n/a Products: n/a Problem Types: n/a Description: Book Store Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability in /bsms_ci/index.php/book. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the book_title parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://medium.com/%40just0rg/book-store-management-system-1-0-unrestricted-input-leads-to-xss-74506d42492e
CVE ID: CVE-2022-45227 State: PUBLISHED Published: 2022-12-12T00:00:00.000Z Last Updated: 2025-04-23T13:45:11.292Z Vendors: n/a Products: n/a Problem Types: n/a Description: The web portal of Dragino Lora LG01 18ed40 IoT v4.3.4 has the directory listing at the URL https://10.10.20.74/lib/. This address has a backup file which can be downloaded without any authentication. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://sectrio.com/vulnerability-research/cve-2022-45227/
CVE ID: CVE-2022-45228 State: PUBLISHED Published: 2022-12-12T00:00:00.000Z Last Updated: 2025-04-23T13:43:59.995Z Vendors: n/a Products: n/a Problem Types: n/a Description: Dragino Lora LG01 18ed40 IoT v4.3.4 was discovered to contain a Cross-Site Request Forgery in the logout page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://sectrio.com/vulnerability-research/cve-2022-45228/
CVE ID: CVE-2022-45269 State: PUBLISHED Published: 2022-12-12T00:00:00.000Z Last Updated: 2025-04-23T13:42:17.381Z Vendors: n/a Products: n/a Problem Types: n/a Description: A directory traversal vulnerability in the component SCS.Web.Server.SPI/1.0 of Linx Sphere LINX 7.35.ST15 allows attackers to read arbitrary files. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gist.github.com/robotshell/7b97af98c5dc0cacd57e6bfac90019cd
CVE ID: CVE-2022-45275 State: PUBLISHED Published: 2022-12-12T00:00:00.000Z Last Updated: 2025-04-23T13:27:16.337Z Vendors: n/a Products: n/a Problem Types: n/a Description: An arbitrary file upload vulnerability in /queuing/admin/ajax.php?action=save_settings of Dynamic Transaction Queuing System v1.0 allows attackers to execute arbitrary code via a crafted PHP file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ATKF/bug_report/blob/main/vendors/oretnom23/dynamic-transaction-queuing-system/RCE-1.md
CVE ID: CVE-2022-45276 State: PUBLISHED Published: 2022-11-23T00:00:00.000Z Last Updated: 2025-04-25T19:26:02.550Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in the /index/user/user_edit.html component of YJCMS v1.0.9 allows unauthenticated attackers to obtain the Administrator account password. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Zoe0427/YJCMS
CVE ID: CVE-2022-45278 State: PUBLISHED Published: 2022-11-23T00:00:00.000Z Last Updated: 2025-04-25T19:25:14.387Z Vendors: n/a Products: n/a Problem Types: n/a Description: Jizhicms v2.3.3 was discovered to contain a SQL injection vulnerability via the /index.php/admins/Fields/get_fields.html component. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Cherry-toto/jizhicms/issues/83
CVE ID: CVE-2022-45280 State: PUBLISHED Published: 2022-11-23T00:00:00.000Z Last Updated: 2025-04-25T19:21:24.920Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in the Url parameter in /login.php of EyouCMS v1.6.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/weng-xianhu/eyoucms/issues/32
CVE ID: CVE-2022-45283 State: PUBLISHED Published: 2022-12-05T00:00:00.000Z Last Updated: 2025-04-24T13:51:25.600Z Vendors: n/a Products: n/a Problem Types: n/a Description: GPAC MP4box v2.0.0 was discovered to contain a stack overflow in the smil_parse_time_list parameter at /scenegraph/svg_attributes.c. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/gpac/gpac/issues/2295 - https://www.debian.org/security/2023/dsa-5411
CVE ID: CVE-2022-45285 State: PUBLISHED Published: 2023-02-13T00:00:00.000Z Last Updated: 2025-03-24T17:46:19.679Z Vendors: n/a Products: n/a Problem Types: n/a Description: Vsourz Digital Advanced Contact form 7 DB Versions 1.7.2 and 1.9.1 is vulnerable to Cross Site Scripting (XSS). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/IthacaLabs/Vsourz-Digital/blob/main/AdvancedContactForm_CF7_DB_XSS/ - https://github.com/IthacaLabs/Vsourz-Digital/blob/main/AdvancedContactForm_CF7_DB_XSS/AdvancedContactForm_CF7_DB_XSS.txt
CVE ID: CVE-2022-45287 State: PUBLISHED Published: 2023-06-21T00:00:00 Last Updated: 2024-12-06T21:32:12.577Z Vendors: n/a Products: n/a Problem Types: n/a Description: An access control issue in Registration.aspx of Temenos CWX 8.5.6 allows authenticated attackers to escalate privileges and perform arbitrary Administrative commands. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://temenos.com - http://cwx.com - https://github.com/WhiteBearVN/CWX-Registration-Broken-Access-Control/blob/main/README.md
CVE ID: CVE-2022-45290 State: PUBLISHED Published: 2022-12-09T00:00:00.000Z Last Updated: 2025-04-23T14:05:50.702Z Vendors: n/a Products: n/a Problem Types: n/a Description: Kbase Doc v1.0 was discovered to contain an arbitrary file deletion vulnerability via the component /web/IndexController.java. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/HH1F/KbaseDoc-v1.0-Arbitrary-file-deletion-vulnerability/blob/main/README.md
CVE ID: CVE-2022-45291 State: PUBLISHED Published: 2023-04-25T00:00:00.000Z Last Updated: 2025-02-04T17:17:33.411Z Vendors: n/a Products: n/a Problem Types: n/a Description: PWS Personal Weather Station Dashboard (PWS_Dashboard) LTS December 2020 (2012_lts) allows remote code execution by injecting PHP code into settings.php. Attacks can use the PWS_printfile.php, PWS_frame_text.php, PWS_listfile.php, PWS_winter.php, and PWS_easyweathersetup.php endpoints. A contributing factor is a hardcoded login password of support, which is not documented. (This is not the same as the documented setup password, which is 12345.) The issue was fixed in late 2022. Additional Analyst Notes: - CVE Program Con
ocumented setup password, which is 12345.) The issue was fixed in late 2022. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://pwsdashboard.com/ - https://cavefxa.com/posts/cve-2022-45291/
CVE ID: CVE-2022-45292 State: PUBLISHED Published: 2022-12-09T00:00:00.000Z Last Updated: 2025-04-23T14:01:25.725Z Vendors: n/a Products: n/a Problem Types: n/a Description: User invites for Funkwhale v1.2.8 do not permanently expire after being used for signup and can be used again after an account has been deleted. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://dev.funkwhale.audio/funkwhale/funkwhale/-/issues/1952
CVE ID: CVE-2022-45297 State: PUBLISHED Published: 2023-01-31T00:00:00.000Z Last Updated: 2025-03-27T18:33:05.938Z Vendors: n/a Products: n/a Problem Types: n/a Description: EQ v1.5.31 to v2.2.0 was discovered to contain a SQL injection vulnerability via the UserPwd parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/tlfyyds/EQ - http://packetstormsecurity.com/files/171615/EQ-Enterprise-Management-System-2.2.0-SQL-Injection.html
CVE ID: CVE-2022-45299 State: PUBLISHED Published: 2023-01-13T00:00:00.000Z Last Updated: 2025-04-07T19:11:13.145Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in the IpFile argument of rust-lang webbrowser-rs v0.8.2 allows attackers to access arbitrary files via supplying a crafted URL. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/offalltn/CVE-2022-45299
CVE ID: CVE-2022-45301 State: PUBLISHED Published: 2022-11-29T00:00:00.000Z Last Updated: 2025-04-25T14:46:19.969Z Vendors: n/a Products: n/a Problem Types: n/a Description: Insecure permissions in Chocolatey Ruby package v3.1.2.1 and below grants all users in the Authenticated Users group write privileges for the path C:\tools\ruby31 and all files located in that folder. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ycdxsb/Vuln/blob/main/ruby-weak-permission-vuln/ruby-weak-permission-vuln.md
CVE ID: CVE-2022-45304 State: PUBLISHED Published: 2022-11-29T00:00:00.000Z Last Updated: 2025-04-25T14:33:30.769Z Vendors: n/a Products: n/a Problem Types: n/a Description: Insecure permissions in Chocolatey Cmder package v1.3.20 and below grants all users in the Authenticated Users group write privileges for the path C:\tools\Cmder and all files located in that folder. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ycdxsb/Vuln/blob/main/cmder-weak-permission-vuln/cmder-weak-permission-vuln.md
CVE ID: CVE-2022-45305 State: PUBLISHED Published: 2022-11-29T00:00:00.000Z Last Updated: 2025-04-25T14:32:46.229Z Vendors: n/a Products: n/a Problem Types: n/a Description: Insecure permissions in Chocolatey Python3 package v3.11.0 and below grants all users in the Authenticated Users group write privileges for the subfolder C:\Python311 and all files located in that folder. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ycdxsb/Vuln/blob/main/python3-weak-permission-vuln/python3-weak-permission-vuln.md
CVE ID: CVE-2022-45306 State: PUBLISHED Published: 2022-11-29T00:00:00.000Z Last Updated: 2025-04-25T14:45:33.604Z Vendors: n/a Products: n/a Problem Types: n/a Description: Insecure permissions in Chocolatey Azure-Pipelines-Agent package v2.211.1 and below grants all users in the Authenticated Users group write privileges for the subfolder C:\agent and all files located in that folder. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ycdxsb/Vuln/blob/main/azure-pipelines-agent-weak-permission-vuln/azure-pipelines-agent-weak-permission-vuln.md
CVE ID: CVE-2022-45307 State: PUBLISHED Published: 2022-11-29T00:00:00.000Z Last Updated: 2025-04-25T14:44:44.150Z Vendors: n/a Products: n/a Problem Types: n/a Description: Insecure permissions in Chocolatey PHP package v8.1.12 and below grants all users in the Authenticated Users group write privileges for the subfolder C:\tools\php81 and all files located in that folder. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ycdxsb/Vuln/blob/main/php-weak-permission-vuln/php-weak-permission-vuln.md
CVE ID: CVE-2022-45313 State: PUBLISHED Published: 2022-12-05T00:00:00.000Z Last Updated: 2025-04-24T13:50:10.585Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mikrotik RouterOs before stable v7.5 was discovered to contain an out-of-bounds read in the hotspot process. This vulnerability allows attackers to execute arbitrary code via a crafted nova message. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/cq674350529/pocs_slides/blob/master/advisory/MikroTik/CVE-2022-45313/README.md