Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
network maps and XSS payload will be executed, which could be used for stealing admin users cookie value. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/ - https://gist.github.com/damodarnaik/ac07a179972cd4d508f246e9bc5500e7
CVE ID: CVE-2022-45437 State: PUBLISHED Published: 2023-02-15T00:00:00.000Z Last Updated: 2025-03-18T19:20:57.800Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N) Vendors: Artica PFMS Products: Pandora FMS Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Artica PFMS Pandora FMS v765 on all allows Cross-Site Scripting (XSS). A user with edition privileges can create a Payload in the reporting dashboard module. An admin user can observe the Payload without interaction and attacker can get information. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Refere
ion and attacker can get information. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/ - https://gist.github.com/damodarnaik/06180e8a5aa237b38740486b3e398011
CVE ID: CVE-2022-45438 State: PUBLISHED Published: 2023-01-16T10:12:02.872Z Last Updated: 2025-04-07T14:59:56.105Z Vendors: Apache Software Foundation Products: Apache Superset Problem Types: CWE-668 Description: When explicitly enabling the feature flag DASHBOARD_CACHE (disabled by default), the system allowed for an unauthenticated user to access dashboard configuration metadata using a REST API Get endpoint. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/snxbkf2x9kww7s0wkmydct9nhqqn9rv9
CVE ID: CVE-2022-45439 State: PUBLISHED Published: 2023-01-17T00:00:00.000Z Last Updated: 2025-04-03T13:36:07.204Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Zyxel Products: AX7501-B0 firmware Problem Types: CWE-312 Description: A pair of spare WiFi credentials is stored in the configuration file of the Zyxel AX7501-B0 firmware prior to V5.17(ABPC.3)C0 in cleartext. An unauthenticated attacker could use the credentials to access the WLAN service if the configuration file has been retrieved from the device by leveraging another known vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.zyxel
lnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-cleartext-storage-of-wifi-credentials-and-improper-symbolic-links-of-ftp-for-ax7501-b0-cpe
CVE ID: CVE-2022-45440 State: PUBLISHED Published: 2023-01-17T00:00:00.000Z Last Updated: 2025-04-03T13:32:23.497Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: Zyxel Products: AX7501-B0 firmware Problem Types: CWE-552 Description: A vulnerability exists in the FTP server of the Zyxel AX7501-B0 firmware prior to V5.17(ABPC.3)C0, which processes symbolic links on external storage media. A local authenticated attacker with administrator privileges could abuse this vulnerability to access the root file system by creating a symbolic link on external storage media, such as a USB flash drive, and then logging into the FTP server on a vulnerable device. Additiona
xternal storage media, such as a USB flash drive, and then logging into the FTP server on a vulnerable device. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-cleartext-storage-of-wifi-credentials-and-improper-symbolic-links-of-ftp-for-ax7501-b0-cpe
CVE ID: CVE-2022-45441 State: PUBLISHED Published: 2023-02-07T00:00:00.000Z Last Updated: 2025-03-25T14:49:09.998Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Zyxel Products: NBG-418N v2 firmware Problem Types: CWE-79 Description: A cross-site scripting (XSS) vulnerability in Zyxel NBG-418N v2 firmware versions prior to V1.00(AARP.13)C0, which could allow an attacker to store malicious scripts in the Logs page of the GUI on a vulnerable device. A successful XSS attack could force an authenticated user to execute the stored malicious scripts and then result in a denial-of-service (DoS) condition when the user visits the Logs page of the GUI on the device.
ipts and then result in a denial-of-service (DoS) condition when the user visits the Logs page of the GUI on the device. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-xss-vulnerability-in-nbg-418n-v2-home-router
CVE ID: CVE-2022-45442 State: PUBLISHED Published: 2022-11-28T00:00:00.000Z Last Updated: 2025-11-04T16:09:56.861Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: sinatra Products: sinatra Problem Types: CWE-494 Description: Sinatra is a domain-specific language for creating web applications in Ruby. An issue was discovered in Sinatra 2.0 before 2.2.3 and 3.0 before 3.0.4. An application is vulnerable to a reflected file download (RFD) attack that sets the Content-Disposition header of a response when the filename is derived from user-supplied input. Version 2.2.3 and 3.0.4 contain patches for this issue. Additional Analyst Notes: - CVE Program Container: - CI
d input. Version 2.2.3 and 3.0.4 contain patches for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/sinatra/sinatra/security/advisories/GHSA-2x8x-jmrp-phxw - https://github.com/sinatra/sinatra/commit/ea8fc9495a350f7551b39e3025bfcd06f49f363b - https://github.com/advisories/GHSA-8x94-hmjh-97hq - https://www.blackhat.com/docs/eu-14/materials/eu-14-Hafif-Reflected-File-Download-A-New-Web-Attack-Vector.pdf - https://lists.debian.org/debian-lts-announce/2023/01/msg00005.html
CVE ID: CVE-2022-45444 State: PUBLISHED Published: 2023-01-18T00:41:51.151Z Last Updated: 2025-01-16T22:00:00.806Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Sewio Products: RTLS Studio Problem Types: CWE-259 Description: Sewio’s Real-Time Location System (RTLS) Studio version 2.0.0 up to and including version 2.6.2 contains hard-coded passwords for select users in the application’s database. This could allow a remote attacker to login to the database with unrestricted access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-23-012-01
CVE ID: CVE-2022-45447 State: PUBLISHED Published: 2023-09-20T09:30:09.498Z Last Updated: 2024-09-06T14:12:13.723Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Prestashop Products: M4 PDF plugin Problem Types: CWE-22 Description: M4 PDF plugin for Prestashop sites, in its 3.2.3 version and before, is vulnerable to a directory traversal vulnerability. The “f” parameter is not properly checked in the resource /m4pdf/pdf.php, returning any file given its relative path. An attacker that exploits this vulnerability could download /etc/passwd from the server if the file exists. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Referenc
from the server if the file exists. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-m4-pdf-plugin-prestashop-sites
CVE ID: CVE-2022-45448 State: PUBLISHED Published: 2023-09-20T12:14:58.361Z Last Updated: 2024-09-06T14:11:51.047Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: Prestashop Products: M4 PDF plugin Problem Types: CWE-79 Description: M4 PDF plugin for Prestashop sites, in its 3.2.3 version and before, is vulnerable to an arbitrary HTML Document crafting vulnerability. The resource /m4pdf/pdf.php uses templates to dynamically create documents. In the case that the template does not exist, the application will return a fixed document with a message in mpdf format. An attacker could exploit this vulnerability by inputting a valid HTML/CSS document as the value of t
ge in mpdf format. An attacker could exploit this vulnerability by inputting a valid HTML/CSS document as the value of the parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-m4-pdf-plugin-prestashop-sites
CVE ID: CVE-2022-45449 State: PUBLISHED Published: 2024-07-16T14:47:21.100Z Last Updated: 2024-08-03T14:17:00.910Z Severity: HIGH (CVSS 7.7 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: Acronis Products: Acronis Cyber Protect 15 Problem Types: CWE-200 Description: Sensitive information disclosure due to excessive privileges assigned to Acronis Agent. The following products are affected: Acronis Cyber Protect 15 (Windows, Linux) before build 30984. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://security-advisory.acronis.com/advisories/SEC-5279
CVE ID: CVE-2022-45450 State: PUBLISHED Published: 2023-05-18T09:27:38.534Z Last Updated: 2025-01-22T16:18:42.210Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: Acronis Products: Acronis Agent, Acronis Cyber Protect 15 Problem Types: CWE-285 Description: Sensitive information disclosure and manipulation due to improper authorization. The following products are affected: Acronis Agent (Linux, macOS, Windows) before build 28610, Acronis Cyber Protect 15 (Linux, macOS, Windows) before build 30984. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security-advisory.acronis.com/advisories/SEC-2410
CVE ID: CVE-2022-45451 State: PUBLISHED Published: 2023-08-31T14:43:49.464Z Last Updated: 2024-10-01T17:50:36.690Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Acronis Products: Acronis Cyber Protect Home Office, Acronis Agent, Acronis Cyber Protect 15 Problem Types: CWE-269 Description: Local privilege escalation due to insecure driver communication port permissions. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 40173, Acronis Agent (Windows) before build 30600, Acronis Cyber Protect 15 (Windows) before build 30984. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http
dows) before build 30984. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security-advisory.acronis.com/advisories/SEC-4858 - https://security-advisory.acronis.com/SEC-5487
CVE ID: CVE-2022-45452 State: PUBLISHED Published: 2023-05-18T09:21:55.932Z Last Updated: 2025-01-22T14:44:25.933Z Severity: HIGH (CVSS 7.3 CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Acronis Products: Acronis Agent, Acronis Cyber Protect 15 Problem Types: CWE-269 Description: Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Agent (Windows) before build 30430, Acronis Cyber Protect 15 (Windows) before build 30984. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security-advisory.acronis.com/advisories/SEC-3967
CVE ID: CVE-2022-45453 State: PUBLISHED Published: 2023-05-18T09:19:10.914Z Last Updated: 2025-01-22T14:45:54.838Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Acronis Products: Acronis Cyber Protect 15 Problem Types: CWE-310 Description: TLS/SSL weak cipher suites enabled. The following products are affected: Acronis Cyber Protect 15 (Windows, Linux) before build 30984. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security-advisory.acronis.com/advisories/SEC-5112
CVE ID: CVE-2022-45454 State: PUBLISHED Published: 2023-02-13T09:25:26.680Z Last Updated: 2025-03-21T14:48:53.018Z Severity: LOW (CVSS 2.2 CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N) Vendors: Acronis Products: Acronis Agent, Acronis Cyber Protect 15 Problem Types: CWE-200 Description: Sensitive information disclosure due to insecure folder permissions. The following products are affected: Acronis Agent (Windows) before build 30161, Acronis Cyber Protect 15 (Windows) before build 30984. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security-advisory.acronis.com/advisories/SEC-4379
CVE ID: CVE-2022-45455 State: PUBLISHED Published: 2023-02-13T09:27:01.356Z Last Updated: 2025-03-21T14:48:25.891Z Severity: MEDIUM (CVSS 6.6 CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:L) Vendors: Acronis Products: Acronis Cyber Protect Home Office, Acronis Agent, Acronis Cyber Protect 15 Problem Types: CWE-459 Description: Local privilege escalation due to incomplete uninstallation cleanup. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 40107, Acronis Agent (Windows) before build 30025, Acronis Cyber Protect 15 (Windows) before build 30984. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://securit
e build 30984. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security-advisory.acronis.com/advisories/SEC-4459
CVE ID: CVE-2022-45456 State: PUBLISHED Published: 2023-04-26T19:54:03.119Z Last Updated: 2025-01-30T21:28:40.529Z Severity: LOW (CVSS 3.3 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: Acronis Products: Acronis Agent Problem Types: CWE-287 Description: Denial of service due to unauthenticated API endpoint. The following products are affected: Acronis Agent (Windows, macOS, Linux) before build 30161. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security-advisory.acronis.com/advisories/SEC-4149
CVE ID: CVE-2022-45457 State: PUBLISHED Published: 2023-05-18T09:23:51.453Z Last Updated: 2025-01-22T14:43:42.077Z Severity: MEDIUM (CVSS 4.2 CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: Acronis Products: Acronis Agent, Acronis Cyber Protect 15 Problem Types: CWE-295 Description: Sensitive information disclosure and manipulation due to improper certification validation. The following products are affected: Acronis Agent (Windows) before build 29633, Acronis Cyber Protect 15 (Windows) before build 30984. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security-advisory.acronis.com/advisories/SEC-3957
CVE ID: CVE-2022-45458 State: PUBLISHED Published: 2023-05-18T09:25:04.232Z Last Updated: 2025-01-22T14:43:05.998Z Severity: MEDIUM (CVSS 4.2 CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: Acronis Products: Acronis Agent, Acronis Cyber Protect 15 Problem Types: CWE-295 Description: Sensitive information disclosure and manipulation due to improper certification validation. The following products are affected: Acronis Agent (Windows, macOS, Linux) before build 29633, Acronis Cyber Protect 15 (Windows, macOS, Linux) before build 30984. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security-advisory.acronis.com/advisories/SEC-3952
CVE ID: CVE-2022-45459 State: PUBLISHED Published: 2023-05-18T09:26:22.045Z Last Updated: 2025-01-22T16:18:57.514Z Severity: LOW (CVSS 3.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) Vendors: Acronis Products: Acronis Agent, Acronis Cyber Protect 15 Problem Types: CWE-200 Description: Sensitive information disclosure due to insecure registry permissions. The following products are affected: Acronis Agent (Windows) before build 30025, Acronis Cyber Protect 15 (Windows) before build 30984. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security-advisory.acronis.com/advisories/SEC-3196
CVE ID: CVE-2022-45460 State: PUBLISHED Published: 2023-03-28T00:00:00.000Z Last Updated: 2025-02-19T19:40:06.314Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple Xiongmai NVR devices, including MBD6304T V4.02.R11.00000117.10001.131900.00000 and NBD6808T-PL V4.02.R11.C7431119.12001.130000.00000, allow an unauthenticated and remote user to exploit a stack-based buffer overflow and crash the web server, resulting in a system reboot. An unauthenticated and remote attacker can execute arbitrary code by sending a crafted HTTP request that triggers the overflow condition via a long URI passed to a sprintf call. NOTE: this is different than CVE-2018-10088, but this may overlap C
w condition via a long URI passed to a sprintf call. NOTE: this is different than CVE-2018-10088, but this may overlap CVE-2017-16725. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/tothi/pwn-hisilicon-dvr/blob/master/pwn_hisilicon_dvr.py - https://vulncheck.com/advisories/xiongmai-uri-overflow
CVE ID: CVE-2022-45461 State: PUBLISHED Published: 2022-11-17T00:00:00.000Z Last Updated: 2025-04-29T13:54:22.295Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AC:H/AV:N/A:H/C:H/I:H/PR:L/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: The Java Admin Console in Veritas NetBackup through 10.1 and related Veritas products on Linux and UNIX allows authenticated non-root users (that have been explicitly added to the auth.conf file) to execute arbitrary commands as root. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.veritas.com/content/support/en_US/security/VTS22-015
CVE ID: CVE-2022-45462 State: PUBLISHED Published: 2022-11-23T00:00:00.000Z Last Updated: 2025-04-25T19:08:33.652Z Vendors: Apache Software Foundation Products: Apache DolphinScheduler Problem Types: CWE-77 Description: Alarm instance management has command injection when there is a specific command configured. It is only for logged-in users. We recommend you upgrade to version 2.0.6 or higher Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/2f126y32bf1v3mvxkdgt2jr5j3l1t01w - http://www.openwall.com/lists/oss-security/2022/11/23/1
CVE ID: CVE-2022-45468 State: PUBLISHED Published: 2023-03-21T22:24:37.550Z Last Updated: 2025-01-17T22:05:23.827Z Vendors: VISAM Products: VBASE Problem Types: CWE-611 Description: Versions of VISAM VBASE Automation Base prior to 11.7.5 may disclose information if a valid user opens a specially crafted file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-080-05
CVE ID: CVE-2022-45469 State: PUBLISHED Published: 2023-11-14T19:04:36.206Z Last Updated: 2024-08-30T16:06:07.740Z Severity: LOW (CVSS 2.2 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: n/a Products: Intel Unison software Problem Types: escalation of privilege, CWE-20 Description: Improper input validation for some Intel Unison software may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00963.html
CVE ID: CVE-2022-45470 State: PUBLISHED Published: 2022-11-21T00:00:00.000Z Last Updated: 2025-04-29T13:56:28.845Z Vendors: Apache Software Foundation Products: Apache Hama Problem Types: CWE-20 Description: missing input validation in Apache Hama may cause information disclosure through path traversal and XSS. Since Apache Hama is EOL, we do not expect these issues to be fixed. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/ztvoshd4kxvp5vlro52mpgpfxct4ft8l - http://www.openwall.com/lists/oss-security/2022/11/21/1
CVE ID: CVE-2022-45471 State: PUBLISHED Published: 2022-11-18T14:04:02.694Z Last Updated: 2025-04-28T19:12:02.607Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:L) Vendors: JetBrains Products: Hub Problem Types: CWE-770 Description: In JetBrains Hub before 2022.3.15181 Throttling was missed when sending emails to a particular email address Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2022-45472 State: PUBLISHED Published: 2022-11-23T00:00:00.000Z Last Updated: 2025-04-25T19:05:02.649Z Vendors: n/a Products: n/a Problem Types: n/a Description: CAE LearningSpace Enterprise (with Intuity License) image 267r patch 639 allows DOM XSS, related to ontouchmove and onpointerup. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.caehealthcare.com/learningspace/enterprise/ - https://github.com/nicbrinkley/CVE-2022-45472
CVE ID: CVE-2022-45473 State: PUBLISHED Published: 2022-11-18T00:00:00.000Z Last Updated: 2025-04-30T14:53:14.365Z Vendors: n/a Products: n/a Problem Types: n/a Description: In drachtio-server 0.8.18, /var/log/drachtio has mode 0777 and drachtio.log has mode 0666. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/drachtio/drachtio-server/issues/241 - https://github.com/drachtio/drachtio-server/commit/f791a9313c58a911ce09f465f4bba594243b29ec
CVE ID: CVE-2022-45474 State: PUBLISHED Published: 2022-11-18T00:00:00.000Z Last Updated: 2025-04-29T19:00:48.442Z Vendors: n/a Products: n/a Problem Types: n/a Description: drachtio-server 0.8.18 has a request-handler.cpp event_cb use-after-free for any request. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/drachtio/drachtio-server/issues/240 - https://github.com/drachtio/drachtio-server/commit/860f025468feb31c43227153d8fb3f34210a522e
CVE ID: CVE-2022-45475 State: PUBLISHED Published: 2022-11-25T00:00:00.000Z Last Updated: 2025-04-29T14:07:53.180Z Vendors: n/a Products: Tiny File Manager Problem Types: Remote command execution Description: Tiny File Manager version 2.4.8 allows an unauthenticated remote attacker to access the application's internal files. This is possible because the application is vulnerable to broken access control. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/prasathmani/tinyfilemanager/ - https://fluidattacks.com/advisories/mosey/
CVE ID: CVE-2022-45476 State: PUBLISHED Published: 2022-11-25T00:00:00.000Z Last Updated: 2025-04-29T14:05:00.400Z Vendors: n/a Products: Tiny File Manager Problem Types: Remote command execution Description: Tiny File Manager version 2.4.8 executes the code of files uploaded by users of the application, instead of just returning them for download. This is possible because the application is vulnerable to insecure file upload. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/prasathmani/tinyfilemanager/ - https://fluidattacks.com/advisories/mosey/
CVE ID: CVE-2022-45477 State: PUBLISHED Published: 2022-12-05T00:00:00.000Z Last Updated: 2025-04-24T13:48:12.198Z Vendors: Telepad Products: Telepad Problem Types: CWE-306 Description: Telepad allows remote unauthenticated users to send instructions to the server to execute arbitrary code without any previous authorization or authentication. CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.synopsys.com/blogs/software-security/cyrc-advisory-remote-code-execution-vulnerabilities-mouse-keyboard-apps/