Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-22106 State: PUBLISHED Published: 2022-09-02T11:31:16 Last Updated: 2024-08-03T03:00:55.353Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Qualcomm, Inc. Products: Snapdragon Auto Problem Types: Integer Overflow to Buffer Overflow in Automotive Multimedia Description: Memory corruption in multimedia due to improper length check while copying the data in Snapdragon Auto Additional Analyst Notes: - CVE Program Container: References: - https://www.qualcomm.com/company/product-security/bulletins/august-2022-bulletin
CVE ID: CVE-2022-22107 State: PUBLISHED Published: 2022-01-05T15:05:16 Last Updated: 2024-08-03T03:00:55.213Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Bottelet Products: DaybydayCRM, flarepoint Problem Types: CWE-862 Description: In Daybyday CRM, versions 2.0.0 through 2.2.0 are vulnerable to Missing Authorization. An attacker that has the lowest privileges account (employee type user), can view the appointments of all users in the system including administrators. However, this type of user is not authorized to view the calendar at all. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Bottelet/DaybydayCRM/commit/a039
ll. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Bottelet/DaybydayCRM/commit/a0392f4a4a14e1e3fedaf6817aefce69b6bd661b - https://www.whitesourcesoftware.com/vulnerability-database/CVE-2022-22107
CVE ID: CVE-2022-22108 State: PUBLISHED Published: 2022-01-05T15:05:18 Last Updated: 2024-08-03T03:00:55.285Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Bottelet Products: DaybydayCRM, flarepoint Problem Types: CWE-862 Description: In Daybyday CRM, versions 2.0.0 through 2.2.0 are vulnerable to Missing Authorization. An attacker that has the lowest privileges account (employee type user), can view the absences of all users in the system including administrators. This type of user is not authorized to view this kind of information. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Bottelet/DaybydayCRM/commit/fe842ea5ede2
tional Analyst Notes: - CVE Program Container: References: - https://github.com/Bottelet/DaybydayCRM/commit/fe842ea5ede237443f1f45a99aeb839133115d8b - https://www.whitesourcesoftware.com/vulnerability-database/CVE-2022-22108
CVE ID: CVE-2022-22109 State: PUBLISHED Published: 2022-01-05T15:05:20 Last Updated: 2024-08-03T03:00:55.224Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Bottelet Products: DaybydayCRM, flarepoint Problem Types: CWE-79 Description: In Daybyday CRM, version 2.2.0 is vulnerable to Stored Cross-Site Scripting (XSS) vulnerability that allows low privileged application users to store malicious scripts in the title field of new tasks. These scripts are executed in a victim’s browser when they open the “/tasks” page to view all the tasks. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Bottelet/DaybydayCRM/commit/002dc75f400c
tional Analyst Notes: - CVE Program Container: References: - https://github.com/Bottelet/DaybydayCRM/commit/002dc75f400cf307bd00b71a5a93f1e26e52cee2 - https://www.whitesourcesoftware.com/vulnerability-database/CVE-2022-22109
CVE ID: CVE-2022-22110 State: PUBLISHED Published: 2022-01-05T15:05:21 Last Updated: 2024-08-03T03:00:55.381Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Bottelet Products: DaybydayCRM, flarepoint Problem Types: CWE-521 Description: In Daybyday CRM, versions 1.1 through 2.2.0 enforce weak password requirements in the user update functionality. A user with privileges to update his password could change it to a weak password, such as those with a length of a single character. This may allow an attacker to brute-force users’ passwords with minimal to no computational effort. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/B
inimal to no computational effort. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Bottelet/DaybydayCRM/commit/a0392f4a4a14e1e3fedaf6817aefce69b6bd661b - https://www.whitesourcesoftware.com/vulnerability-database/CVE-2022-22110
CVE ID: CVE-2022-22111 State: PUBLISHED Published: 2022-01-05T15:05:22 Last Updated: 2024-08-03T03:00:55.383Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Bottelet Products: DaybydayCRM, flarepoint Problem Types: CWE-862 Description: In DayByDay CRM, version 2.2.0 is vulnerable to missing authorization. Any application user in the application who has update user permission enabled is able to change the password of other users, including the administrator’s. This allows the attacker to gain access to the highest privileged user in the application. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Bottelet/DaybydayCRM/commit/
cation. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Bottelet/DaybydayCRM/commit/fe842ea5ede237443f1f45a99aeb839133115d8b - https://www.whitesourcesoftware.com/vulnerability-database/CVE-2022-22111
CVE ID: CVE-2022-22112 State: PUBLISHED Published: 2022-01-13T08:35:12.079573Z Last Updated: 2024-09-16T23:35:56.740Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Bottelet Products: DaybydayCRM Problem Types: CWE-79 Description: In DayByDay CRM, versions 1.1 through 2.2.1 (latest) suffer from an application-wide Client-Side Template Injection (CSTI). A low privileged attacker can input template injection payloads in the application at various locations to execute JavaScript on the client browser. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Bottelet/DaybydayCRM/blob/2.2.1/resources/views/partials/clientheader.blade.p
ontainer: References: - https://github.com/Bottelet/DaybydayCRM/blob/2.2.1/resources/views/partials/clientheader.blade.php#L17 - https://www.whitesourcesoftware.com/vulnerability-database/CVE-2022-22112
CVE ID: CVE-2022-22113 State: PUBLISHED Published: 2022-01-13T08:35:13.633720Z Last Updated: 2024-09-17T02:31:21.087Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Bottelet Products: DaybydayCRM Problem Types: CWE-613 Description: In DayByDay CRM, versions 2.2.0 through 2.2.1 (latest) are vulnerable to Insufficient Session Expiration. When a password has been changed by the user or by an administrator, a user that was already logged in, will still have access to the application even after the password was changed. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Bottelet/DaybydayCRM/blob/master/config/session.php#L32 - http
- CVE Program Container: References: - https://github.com/Bottelet/DaybydayCRM/blob/master/config/session.php#L32 - https://www.whitesourcesoftware.com/vulnerability-database/CVE-2022-22113
CVE ID: CVE-2022-22114 State: PUBLISHED Published: 2022-01-10T15:26:54.681124Z Last Updated: 2024-09-16T19:36:11.282Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: sismics Products: docs Problem Types: CWE-79 Description: In Teedy, versions v1.5 through v1.9 are vulnerable to Reflected Cross-Site Scripting (XSS). The “search term" search functionality is not sufficiently sanitized while displaying the results of the search, which can be leveraged to inject arbitrary scripts. These scripts are executed in a victim’s browser when they enter the crafted URL. In the worst case, the victim who inadvertently triggers the attack is a highly privileged administr
er the crafted URL. In the worst case, the victim who inadvertently triggers the attack is a highly privileged administrator. The injected scripts can extract the Session ID, which can lead to full Account Takeover of the administrator, by an unauthenticated attacker. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sismics/docs/commit/4951229576d6892dc58ab8c572e73639ca82d80c - https://www.whitesourcesoftware.com/vulnerability-database/CVE-2022-22114
CVE ID: CVE-2022-22115 State: PUBLISHED Published: 2022-01-10T15:26:56.337833Z Last Updated: 2024-09-17T03:28:07.597Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: sismics Products: docs Problem Types: CWE-79 Description: In Teedy, versions v1.5 through v1.9 are vulnerable to Stored Cross-Site Scripting (XSS) in the name of a created Tag. Since the Tag name is not being sanitized properly in the edit tag page, a low privileged attacker can store malicious scripts in the name of the Tag. In the worst case, the victim who inadvertently triggers the attack is a highly privileged administrator. The injected scripts can extract the Session ID, which can lead to
gers the attack is a highly privileged administrator. The injected scripts can extract the Session ID, which can lead to full Account Takeover of the administrator, and privileges escalation. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sismics/docs/commit/4951229576d6892dc58ab8c572e73639ca82d80c - https://www.whitesourcesoftware.com/vulnerability-database/CVE-2022-22115
CVE ID: CVE-2022-22116 State: PUBLISHED Published: 2022-01-10T15:26:44.139518Z Last Updated: 2024-09-17T03:13:41.409Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: directus Products: directus Problem Types: CWE-79 Description: In Directus, versions 9.0.0-alpha.4 through 9.4.1 are vulnerable to stored Cross-Site Scripting (XSS) vulnerability via SVG file upload in media upload functionality. A low privileged attacker can inject arbitrary javascript code which will be executed in a victim’s browser when they open the image URL. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/directus/directus/commit/ec86d5412d45136915d9b62
nalyst Notes: - CVE Program Container: References: - https://github.com/directus/directus/commit/ec86d5412d45136915d9b622b4a890dd26932b10 - https://www.whitesourcesoftware.com/vulnerability-database/CVE-2022-22116
CVE ID: CVE-2022-22117 State: PUBLISHED Published: 2022-01-10T15:26:45.928993Z Last Updated: 2024-09-16T18:44:02.548Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: directus Products: directus Problem Types: CWE-79 Description: In Directus, versions 9.0.0-alpha.4 through 9.4.1 allow unrestricted file upload of .html files in the media upload functionality, which leads to Cross-Site Scripting vulnerability. A low privileged attacker can upload a crafted HTML file as a profile avatar, and when an admin or another user opens it, the XSS payload gets triggered. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/directus/directus
ad gets triggered. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/directus/directus/commit/ec86d5412d45136915d9b622b4a890dd26932b10 - https://www.whitesourcesoftware.com/vulnerability-database/CVE-2022-22117
CVE ID: CVE-2022-22120 State: PUBLISHED Published: 2022-01-10T15:25:27.052771Z Last Updated: 2024-09-16T23:27:02.597Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: nocodb Products: nocodb Problem Types: CWE-203 Description: In NocoDB, versions 0.9 to 0.83.8 are vulnerable to Observable Discrepancy in the password-reset feature. When requesting a password reset for a given email address, the application displays an error message when the email isn't registered within the system. This allows attackers to enumerate the registered users' email addresses. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nocodb/nocodb/commit/f4
l addresses. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nocodb/nocodb/commit/f46e89b0 - https://www.whitesourcesoftware.com/vulnerability-database/CVE-2022-22120
CVE ID: CVE-2022-22121 State: PUBLISHED Published: 2022-01-10T15:25:28.528621Z Last Updated: 2024-09-17T04:09:34.606Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: nocodb Products: nocodb Problem Types: CWE-1236 Description: In NocoDB, versions 0.81.0 through 0.83.8 are affected by CSV Injection vulnerability (Formula Injection). A low privileged attacker can create a new table to inject payloads in the table rows. When an administrator accesses the User Management endpoint and exports the data as a CSV file and opens it, the payload gets executed. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nocodb/nocodb/commit/079e3abe
cuted. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nocodb/nocodb/commit/079e3abe - https://www.whitesourcesoftware.com/vulnerability-database/CVE-2022-22121
CVE ID: CVE-2022-22122 State: REJECTED Published: 2022-01-13T16:35:16 Last Updated: 2022-02-02T16:15:44 Description: No description available.
CVE ID: CVE-2022-22123 State: PUBLISHED Published: 2022-01-13T16:45:14.866929Z Last Updated: 2024-09-17T01:51:59.138Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: halo-dev Products: halo Problem Types: CWE-79 Description: In Halo, versions v1.0.0 to v1.4.17 (latest) are vulnerable to Stored Cross-Site Scripting (XSS) in the article title. An authenticated attacker can inject arbitrary javascript code that will execute on a victim’s server. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/halo-dev/halo/blob/v1.4.17/src/main/java/run/halo/app/service/impl/PostServiceImpl.java#L391 - https://github.com/halo-dev/halo/issues/
lob/v1.4.17/src/main/java/run/halo/app/service/impl/PostServiceImpl.java#L391 - https://github.com/halo-dev/halo/issues/1557 - https://www.whitesourcesoftware.com/vulnerability-database/CVE-2022-22123
CVE ID: CVE-2022-22124 State: PUBLISHED Published: 2022-01-13T16:45:16.379212Z Last Updated: 2024-09-17T02:42:04.777Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: halo-dev Products: halo Problem Types: CWE-79 Description: In Halo, versions v1.0.0 to v1.4.17 (latest) are vulnerable to Stored Cross-Site Scripting (XSS) in the profile image. An authenticated attacker can upload a carefully crafted SVG file that will trigger arbitrary javascript to run on a victim’s browser. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/halo-dev/halo/blob/v1.4.17/src/main/java/run/halo/app/handler/file/FileHandler.java#L30 - https://githu
tps://github.com/halo-dev/halo/blob/v1.4.17/src/main/java/run/halo/app/handler/file/FileHandler.java#L30 - https://github.com/halo-dev/halo/issues/1575 - https://www.whitesourcesoftware.com/vulnerability-database/CVE-2022-22124
CVE ID: CVE-2022-22125 State: PUBLISHED Published: 2022-01-13T16:45:17.760717Z Last Updated: 2024-09-17T04:20:50.355Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: halo-dev Products: halo Problem Types: CWE-79 Description: In Halo, versions v1.0.0 to v1.4.17 (latest) are vulnerable to Stored Cross-Site Scripting (XSS) in the article tag. An authenticated admin attacker can inject arbitrary javascript code that will execute on a victim’s server. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/halo-dev/halo/issues/1557 - https://github.com/halo-dev/halo/blob/v1.4.17/src/main/java/run/halo/app/service/impl/PostServiceImpl.j
lo/issues/1557 - https://github.com/halo-dev/halo/blob/v1.4.17/src/main/java/run/halo/app/service/impl/PostServiceImpl.java#L500 - https://www.whitesourcesoftware.com/vulnerability-database/CVE-2022-22125
CVE ID: CVE-2022-22126 State: PUBLISHED Published: 2022-02-20T19:00:14 Last Updated: 2024-08-03T03:07:48.263Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: nasa Products: openmct Problem Types: CWE-79 Description: Openmct versions 1.3.0 to 1.7.7 are vulnerable against stored XSS via the “Web Page” element, that allows the injection of malicious JavaScript into the ‘URL’ field. This issue affects: nasa openmct 1.7.7 version and prior versions; 1.3.0 version and later versions. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nasa/openmct/commit/abc93d0ec4b104dac1ea5f8a615d06e3ab78934a
CVE ID: CVE-2022-22127 State: PUBLISHED Published: 2022-05-25T13:56:52 Last Updated: 2024-08-03T03:07:48.934Z Vendors: n/a Products: Tableau Server Problem Types: Broken Access Control Description: Tableau is aware of a broken access control vulnerability present in Tableau Server affecting Tableau Server customers using Local Identity Store for managing users. The vulnerability allows a malicious site administrator to change passwords for users in different sites hosted on the same Tableau Server, resulting in the potential for unauthorized access to data.Tableau Server versions affected are:2020.4.16, 2021.1.13, 2021.2.10, 2021.3.9, 2021.4.4 and earlierNote: All future releases of Tableau
rsions affected are:2020.4.16, 2021.1.13, 2021.2.10, 2021.3.9, 2021.4.4 and earlierNote: All future releases of Tableau Server will address this security issue. Versions that are no longer supported are not tested and may be vulnerable. Additional Analyst Notes: - CVE Program Container: References: - https://help.salesforce.com/s/articleView?id=000365493&type=1
CVE ID: CVE-2022-22128 State: PUBLISHED Published: 2022-10-17T00:00:00.000Z Last Updated: 2025-05-13T20:10:37.338Z Vendors: n/a Products: Tableau Server Problem Types: Remote Code Execution Description: Tableau discovered a path traversal vulnerability affecting Tableau Server Administration Agent’s internal file transfer service that could allow remote code execution.Tableau only supports product versions for 24 months after release. Older versions have reached their End of Life and are no longer supported. They are also not assessed for potential security issues and do not receive security updates. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - ht
t receive security updates. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://help.salesforce.com/s/articleView?id=000367027&type=1
CVE ID: CVE-2022-22137 State: PUBLISHED Published: 2022-05-03T16:05:10.182Z Last Updated: 2025-04-15T19:04:40.772Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Accusoft Products: ImageGear Problem Types: CWE-131 Description: A memory corruption vulnerability exists in the ioca_mys_rgb_allocate functionality of Accusoft ImageGear 19.10. A specially-crafted malformed file can lead to an arbitrary free. An attacker can provide a malicious file to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2022-1449
CVE ID: CVE-2022-22138 State: PUBLISHED Published: 2022-06-17T20:05:18.053395Z Last Updated: 2024-09-17T04:24:58.685Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P) Vendors: n/a Products: fast-string-search Problem Types: Denial of Service (DoS) Description: All versions of package fast-string-search are vulnerable to Denial of Service (DoS) when computations are incorrect for non-string inputs. One can cause the V8 to attempt reading from non-permitted locations and cause a segmentation fault due to the violation. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-FASTSTRINGSEARCH-2392367
CVE ID: CVE-2022-22139 State: PUBLISHED Published: 2022-05-12T16:35:50.000Z Last Updated: 2025-05-05T16:29:59.921Z Vendors: n/a Products: Intel(R) XTU software Problem Types: escalation of privilege Description: Uncontrolled search path in the Intel(R) XTU software before version 7.3.0.33 may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00663.html
CVE ID: CVE-2022-22140 State: PUBLISHED Published: 2022-08-05T21:11:31.490Z Last Updated: 2025-04-15T18:58:41.916Z Severity: CRITICAL (CVSS 9.6 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: TCL Products: LinkHub Mesh Wifi Problem Types: CWE-78 Description: An os command injection vulnerability exists in the confsrv ucloud_add_node functionality of TCL LinkHub Mesh Wi-Fi MS1G_00_01.00_14. A specially-crafted network packet can lead to arbitrary command execution. An attacker can send a malicious packet to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2022-
rogram Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2022-1458
CVE ID: CVE-2022-22141 State: PUBLISHED Published: 2022-03-11T09:10:44 Last Updated: 2024-08-03T03:07:48.318Z Vendors: Yokogawa Electric Corporation Products: CENTUM CS 3000, CENTUM VP, Exaopc Problem Types: CWE-732 Description: 'Long-term Data Archive Package' service implemented in the following Yokogawa Electric products creates some named pipe with imporper ACL configuration. CENTUM CS 3000 versions from R3.08.10 to R3.09.00, CENTUM VP versions from R4.01.00 to R4.03.00, from R5.01.00 to R5.04.20, and from R6.01.00 to R6.08.00, Exaopc versions from R3.72.00 to R3.79.00. Additional Analyst Notes: - CVE Program Container: References: - https://web-material3.yokogawa.com/1/32094/files/YSAR-
Additional Analyst Notes: - CVE Program Container: References: - https://web-material3.yokogawa.com/1/32094/files/YSAR-22-0001-E.pdf
CVE ID: CVE-2022-22142 State: PUBLISHED Published: 2022-02-08T10:30:39 Last Updated: 2024-08-03T03:07:48.949Z Vendors: econosys system Products: php_mailform Problem Types: Cross-site scripting Description: Reflected cross-site scripting vulnerability in the checkbox of php_mailform versions prior to Version 1.40 allows a remote unauthenticated attacker to inject an arbitrary script via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/econosys-system/php_mailform - https://jvn.jp/en/jp/JVN16690037/index.html
CVE ID: CVE-2022-22143 State: PUBLISHED Published: 2022-05-01T15:30:45.287380Z Last Updated: 2024-09-17T02:02:16.928Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: n/a Products: convict Problem Types: Prototype Pollution Description: The package convict before 6.2.2 are vulnerable to Prototype Pollution via the convict function due to missing validation of parentKey. **Note:** This vulnerability derives from an incomplete fix of another [vulnerability](https://security.snyk.io/vuln/SNYK-JS-CONVICT-1062508) Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-CONVICT-2340604 - https://github.com/mozilla/node-convict/bl
ogram Container: References: - https://snyk.io/vuln/SNYK-JS-CONVICT-2340604 - https://github.com/mozilla/node-convict/blob/5eb1314f85346760a3c31cb14510f2f0af11d0d3/packages/convict/src/main.js%23L569 - https://github.com/mozilla/node-convict/commit/3b86be087d8f14681a9c889d45da7fe3ad9cd880
CVE ID: CVE-2022-22144 State: PUBLISHED Published: 2022-08-05T21:11:47.285Z Last Updated: 2025-04-15T18:58:31.980Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: TCL Products: LinkHub Mesh Wifi Problem Types: CWE-259 Description: A hard-coded password vulnerability exists in the libcommonprod.so prod_change_root_passwd functionality of TCL LinkHub Mesh Wi-Fi MS1G_00_01.00_14. During system startup this functionality is always called, leading to a known root password. An attacker does not have to do anything to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vul