Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-40699 State: PUBLISHED Published: 2023-03-16T08:57:24.921Z Last Updated: 2025-01-13T15:51:09.315Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Dario Curvino Products: Yasr – Yet Another Stars Rating Problem Types: CWE-79 Description: Cross-Site Scripting (XSS) vulnerability in Dario Curvino Yasr – Yet Another Stars Rating plugin <= 3.1.2 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/yet-another-stars-rating/wordpress-yasr-yet-another-stars-rating-plugin-3-1-2-xss-arbitrary-shortcode-execution-vulnerability?_s_id=cve
CVE ID: CVE-2022-40700 State: PUBLISHED Published: 2024-01-19T14:30:11.427Z Last Updated: 2024-11-13T17:40:07.080Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) Vendors: Montonio, Wpopal, AMO for WP – Membership Management, Long Watch Studio, Squidesma, Paul Clark, Designmodo Inc., Philip M. Hofer (Frumph), Arun Basil Lal, Team Agence-Press, Unihost, deano1987 Products: Montonio for WooCommerce, Wpopal Core Features, ArcStone, WooVirtualWallet – A virtual wallet for WooCommerce, WooVIP – Membership plugin for WordPress and WooCommerce, WooSupply – Suppliers, Supply Orders and Stock Management, Theme Minifier, Styles, WordPress Page Builder – Qards, PHPFreeChat, Custo
uppliers, Supply Orders and Stock Management, Theme Minifier, Styles, WordPress Page Builder – Qards, PHPFreeChat, Custom Login Admin Front-end CSS, CSS Adder By Agence-Press, Confirm Data, AMP Toolbox, Admin CSS MU Problem Types: CWE-918 Description: Server-Side Request Forgery (SSRF) vulnerability in Montonio Montonio for WooCommerce, Wpopal Wpopal Core Features, AMO for WP – Membership Management ArcStone wp-amo, Long Watch Studio WooVirtualWallet – A virtual wallet for WooCommerce, Long Watch Studio WooVIP – Membership plugin for WordPress and WooCommerce, Long Watch Studio WooSupply – Suppliers, Supply Orders and Stock Management, Squidesma Theme Minifier, Paul Clark Styles styles, Desi
udio WooSupply – Suppliers, Supply Orders and Stock Management, Squidesma Theme Minifier, Paul Clark Styles styles, Designmodo Inc. WordPress Page Builder – Qards, Philip M. Hofer (Frumph) PHPFreeChat, Arun Basil Lal Custom Login Admin Front-end CSS, Team Agence-Press CSS Adder By Agence-Press, Unihost Confirm Data, deano1987 AMP Toolbox amp-toolbox, Arun Basil Lal Admin CSS MU.This issue affects Montonio for WooCommerce: from n/a through 6.0.1; Wpopal Core Features: from n/a through 1.5.8; ArcStone: from n/a through 4.6.6; WooVirtualWallet – A virtual wallet for WooCommerce: from n/a through 2.2.1; WooVIP – Membership plugin for WordPress and WooCommerce: from n/a through 1.4.4; WooSupply –
e: from n/a through 2.2.1; WooVIP – Membership plugin for WordPress and WooCommerce: from n/a through 1.4.4; WooSupply – Suppliers, Supply Orders and Stock Management: from n/a through 1.2.2; Theme Minifier: from n/a through 2.0; Styles: from n/a through 1.2.3; WordPress Page Builder – Qards: from n/a through 1.0.5; PHPFreeChat: from n/a through 0.2.8; Custom Login Admin Front-end CSS: from n/a through 1.4.1; CSS Adder By Agence-Press: from n/a through 1.5.0; Confirm Data: from n/a through 1.0.7; AMP Toolbox: from n/a through 2.1.1; Admin CSS MU: from n/a through 2.6. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vul
ional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/montonio-for-woocommerce/wordpress-montonio-for-woocommerce-plugin-6-0-1-server-side-request-forgery-ssrf?_s_id=cve - https://patchstack.com/database/vulnerability/wpopal-core-features/wordpress-wpopal-core-features-plugin-1-5-7-server-side-request-forgery-ssrf?_s_id=cve - https://patchstack.com/database/vulnerability/wp-amo/wordpress-amo-for-wp-plugin-4-6-6-server-side-request-forgery-ssrf?_s_id=cve - https://patchstack.com/database/vulnerability/woovirtualwallet/wordpress-woovirtualwallet-plugin-2-2-1-server-side-request-forgery-ssrf?_s_id=cve - https://patchst
ty/woovirtualwallet/wordpress-woovirtualwallet-plugin-2-2-1-server-side-request-forgery-ssrf?_s_id=cve - https://patchstack.com/database/vulnerability/woovip/wordpress-woovip-plugin-1-4-4-server-side-request-forgery-ssrf?_s_id=cve - https://patchstack.com/database/vulnerability/woosupply/wordpress-woosupply-plugin-1-2-2-server-side-request-forgery-ssrf?_s_id=cve - https://patchstack.com/database/vulnerability/theme-minifier/wordpress-theme-minifier-plugin-2-0-server-side-request-forgery-ssrf?_s_id=cve - https://patchstack.com/database/vulnerability/styles/wordpress-styles-plugin-1-2-3-server-side-request-forgery-ssrf?_s_id=cve - https://patchstack.com/database/vulnerability/qards-free/wordpr
lugin-1-2-3-server-side-request-forgery-ssrf?_s_id=cve - https://patchstack.com/database/vulnerability/qards-free/wordpress-wordpress-page-builder-qards-plugin-1-0-5-server-side-request-forgery-ssrf?_s_id=cve - https://patchstack.com/database/vulnerability/phpfreechat/wordpress-phpfreechat-plugin-0-2-8-server-side-request-forgery-ssrf?_s_id=cve - https://patchstack.com/database/vulnerability/custom-login-admin-front-end-css-with-multisite-support/wordpress-custom-login-admin-front-end-css-plugin-1-4-1-server-side-request-forgery-ssrf?_s_id=cve - https://patchstack.com/database/vulnerability/css-adder-by-agence-press/wordpress-css-adder-by-agene-press-plugin-1-5-0-server-side-request-forgery-
ase/vulnerability/css-adder-by-agence-press/wordpress-css-adder-by-agene-press-plugin-1-5-0-server-side-request-forgery-ssrf?_s_id=cve - https://patchstack.com/database/vulnerability/confirm-data/wordpress-confirm-data-plugin-1-0-7-unauth-server-side-request-forgery-ssrf-vulnerability?_s_id=cve - https://patchstack.com/database/vulnerability/amp-toolbox/wordpress-amp-toolbox-plugin-2-1-1-server-side-request-forgery-ssrf?_s_id=cve - https://patchstack.com/database/vulnerability/admin-css-mu/wordpress-admin-css-mu-plugin-2-6-server-side-request-forgery-ssrf-vulnerability?_s_id=cve
CVE ID: CVE-2022-40701 State: PUBLISHED Published: 2023-01-26T21:24:50.399Z Last Updated: 2024-08-03T12:21:46.552Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H) Vendors: Siretta Products: QUARTZ-GOLD Problem Types: CWE-22 Description: A directory traversal vulnerability exists in the httpd delfile.cgi functionality of Siretta QUARTZ-GOLD G5.0.1.5-210720-141020. A specially-crafted HTTP request can lead to arbitrary file deletion. An attacker can send an HTTP request to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2022-1606
CVE ID: CVE-2022-40702 State: PUBLISHED Published: 2024-01-17T16:51:05.932Z Last Updated: 2024-08-03T12:21:46.639Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: Zorem Products: Advanced Local Pickup for WooCommerce Problem Types: CWE-862 Description: Missing Authorization vulnerability in Zorem Advanced Local Pickup for WooCommerce.This issue affects Advanced Local Pickup for WooCommerce: from n/a through 1.5.2. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/advanced-local-pickup-for-woocommerce/wordpress-advanced-local-pickup-for-woocommerce-plugin-1-5-2-broken-access
ability/advanced-local-pickup-for-woocommerce/wordpress-advanced-local-pickup-for-woocommerce-plugin-1-5-2-broken-access-control?_s_id=cve
CVE ID: CVE-2022-40703 State: PUBLISHED Published: 2022-10-26T20:02:06.819Z Last Updated: 2025-04-16T16:08:38.405Z Severity: MEDIUM (CVSS 5.2 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N) Vendors: AliveCor Products: Kardia App Problem Types: CWE-302 Description: CWE-302 Authentication Bypass by Assumed-Immutable Data in AliveCor Kardia App version 5.17.1-754993421 and prior on Android allows an unauthenticated attacker with physical access to the Android device containing the app to bypass application authentication and alter information in the app. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsma-22-29
: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsma-22-298-01
CVE ID: CVE-2022-40704 State: PUBLISHED Published: 2023-01-17T00:00:00.000Z Last Updated: 2025-04-04T19:41:57.750Z Vendors: n/a Products: phoronix-test-suite Problem Types: CWE-79 Description: A XSS vulnerability was found in phoromatic_r_add_test_details.php in phoronix-test-suite. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/phoronix-test-suite/phoronix-test-suite/issues/650 - https://github.com/phoronix-test-suite/phoronix-test-suite/commit/d3880d9d3ba795138444da83f1153c3c3ac27640
CVE ID: CVE-2022-40705 State: PUBLISHED Published: 2022-09-22T08:15:16 Last Updated: 2024-08-03T12:21:46.448Z Vendors: Apache Software Foundation Products: Apache SOAP Problem Types: CWE-611 Description: An Improper Restriction of XML External Entity Reference vulnerability in RPCRouterServlet of Apache SOAP allows an attacker to read arbitrary files over HTTP. This issue affects Apache SOAP version 2.2 and later versions. It is unknown whether previous versions are also affected. NOTE: This vulnerability only affects products that are no longer supported by the maintainer Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://lists.apache.org/threa
Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://lists.apache.org/thread/02yo04w93rdjmllz4454lvodn5xzhwhl - http://www.openwall.com/lists/oss-security/2022/09/22/1
CVE ID: CVE-2022-40707 State: PUBLISHED Published: 2022-09-28T21:10:22 Last Updated: 2024-08-03T12:21:46.562Z Vendors: Trend Micro Products: Trend Micro Deep Security Problem Types: Out-Of-Bounds Read Information Disclosure Description: An Out-of-bounds read vulnerability in Trend Micro Deep Security 20 and Cloud One - Workload Security Agent for Windows could allow a local attacker to disclose sensitive information on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit these vulnerabilities. This vulnerability is similar to, but not identical to CVE-2022-40708. Additional Analyst Notes: - CVE
vulnerabilities. This vulnerability is similar to, but not identical to CVE-2022-40708. Additional Analyst Notes: - CVE Program Container: References: - https://success.trendmicro.com/solution/000291590 - https://www.zerodayinitiative.com/advisories/ZDI-22-1297/
CVE ID: CVE-2022-40708 State: PUBLISHED Published: 2022-09-28T21:10:23.000Z Last Updated: 2025-05-20T20:27:37.351Z Vendors: Trend Micro Products: Trend Micro Deep Security Problem Types: Out-Of-Bounds Read Information Disclosure Description: An Out-of-bounds read vulnerability in Trend Micro Deep Security 20 and Cloud One - Workload Security Agent for Windows could allow a local attacker to disclose sensitive information on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit these vulnerabilities. This vulnerability is similar to, but not identical to CVE-2022-40707. Additional Analyst Notes: -
hese vulnerabilities. This vulnerability is similar to, but not identical to CVE-2022-40707. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://success.trendmicro.com/solution/000291590 - https://www.zerodayinitiative.com/advisories/ZDI-22-1298/
CVE ID: CVE-2022-40709 State: PUBLISHED Published: 2022-09-28T21:10:24 Last Updated: 2024-11-20T14:56:09.409Z Vendors: Trend Micro Products: Trend Micro Deep Security Problem Types: Out-Of-Bounds Read Information Disclosure Description: An Out-of-bounds read vulnerability in Trend Micro Deep Security 20 and Cloud One - Workload Security Agent for Windows could allow a local attacker to disclose sensitive information on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit these vulnerabilities. This vulnerability is similar to, but not identical to CVE-2022-40707 and 40708. Additional Analyst Not
vulnerabilities. This vulnerability is similar to, but not identical to CVE-2022-40707 and 40708. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://success.trendmicro.com/solution/000291590 - https://www.zerodayinitiative.com/advisories/ZDI-22-1299/
CVE ID: CVE-2022-40710 State: PUBLISHED Published: 2022-09-28T21:10:25 Last Updated: 2024-08-03T12:21:46.609Z Vendors: Trend Micro Products: Trend Micro Deep Security Problem Types: Link Following LPE Description: A link following vulnerability in Trend Micro Deep Security 20 and Cloud One - Workload Security Agent for Windows could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://success.trendmicro.com/solution/000291590 - https://www.zerodayinitiativ
- CVE Program Container: References: - https://success.trendmicro.com/solution/000291590 - https://www.zerodayinitiative.com/advisories/ZDI-22-1296/
CVE ID: CVE-2022-40711 State: PUBLISHED Published: 2023-01-01T00:00:00.000Z Last Updated: 2025-04-11T13:57:21.009Z Vendors: n/a Products: n/a Problem Types: n/a Description: PrimeKey EJBCA 7.9.0.2 Community allows stored XSS in the End Entity section. A user with the RA Administrator role can inject an XSS payload to target higher-privilege users. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://verneet.com/cve-2022-40711/
CVE ID: CVE-2022-40712 State: PUBLISHED Published: 2022-09-19T15:52:24.000Z Last Updated: 2025-06-03T18:19:05.785Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in NOKIA 1350OMS R14.2. Reflected XSS exists under different /cgi-bin/R14.2* endpoints. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.gruppotim.it/it/footer/red-team.html
CVE ID: CVE-2022-40713 State: PUBLISHED Published: 2022-09-19T15:52:28.000Z Last Updated: 2025-06-03T18:20:00.367Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in NOKIA 1350OMS R14.2. Multiple Relative Path Traversal issues exist in different specific endpoints via the file parameter, allowing a remote authenticated attacker to read files on the filesystem arbitrarily. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.gruppotim.it/it/footer/red-team.html
CVE ID: CVE-2022-40714 State: PUBLISHED Published: 2022-09-19T15:52:33 Last Updated: 2024-08-03T12:21:46.660Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in NOKIA 1350OMS R14.2. Reflected XSS exists under different /oms1350/* endpoints. Additional Analyst Notes: - CVE Program Container: References: - https://www.gruppotim.it/it/footer/red-team.html
CVE ID: CVE-2022-40715 State: PUBLISHED Published: 2022-09-19T15:52:39 Last Updated: 2024-08-03T12:21:46.745Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in NOKIA 1350OMS R14.2. An Absolute Path Traversal vulnerability exists for a specific endpoint via the logfile parameter, allowing a remote authenticated attacker to read files on the filesystem arbitrarily. Additional Analyst Notes: - CVE Program Container: References: - https://www.gruppotim.it/it/footer/red-team.html
CVE ID: CVE-2022-40716 State: PUBLISHED Published: 2022-09-23T00:00:00.000Z Last Updated: 2025-05-27T14:54:21.059Z Vendors: n/a Products: n/a Problem Types: n/a Description: HashiCorp Consul and Consul Enterprise up to 1.11.8, 1.12.4, and 1.13.1 do not check for multiple SAN URI values in a CSR on the internal RPC endpoint, enabling leverage of privileged access to bypass service mesh intentions. Fixed in 1.11.9, 1.12.5, and 1.13.2." Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://discuss.hashicorp.com - https://discuss.hashicorp.com/t/hcsec-2022-20-consul-service-mesh-intention-bypass-with-malicious-certificate-signing-request/44628 - https:
icorp.com/t/hcsec-2022-20-consul-service-mesh-intention-bypass-with-malicious-certificate-signing-request/44628 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZTE4ITXXPIWZEQ4HYQCB6N6GZIMWXDAI/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LYZOKMMVX4SIEHPJW3SJUQGMO5YZCPHC/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XNF4OLYZRQE75EB5TW5N42FSXHBXGWFE/
CVE ID: CVE-2022-40717 State: PUBLISHED Published: 2023-01-26T00:00:00.000Z Last Updated: 2025-04-01T14:55:26.382Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: D-Link Products: DIR-2150 Problem Types: CWE-121 Description: This vulnerability allows network-adjacent attackers to execute arbitrary code on affected D-Link DIR-2150 4.0.1 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the anweb service, which listens on TCP ports 80 and 443 by default. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker
per validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-15727. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-22-1220/ - https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10304
CVE ID: CVE-2022-40718 State: PUBLISHED Published: 2023-01-26T00:00:00.000Z Last Updated: 2025-04-01T14:55:06.136Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: D-Link Products: DIR-2150 Problem Types: CWE-121 Description: This vulnerability allows network-adjacent attackers to execute arbitrary code on affected D-Link DIR-2150 4.0.1 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the anweb service, which listens on TCP ports 80 and 443 by default. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker
per validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-15728. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10304 - https://www.zerodayinitiative.com/advisories/ZDI-22-1221/
CVE ID: CVE-2022-40719 State: PUBLISHED Published: 2023-01-26T00:00:00.000Z Last Updated: 2025-04-01T14:54:48.971Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: D-Link Products: DIR-2150 Problem Types: CWE-78 Description: This vulnerability allows network-adjacent attackers to execute arbitrary commands on affected installations of D-Link DIR-2150 4.0.1 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the xupnpd_generic.lua plugin for the xupnpd service, which listens on TCP port 4044 by default. When parsing the feed parameter, the process does not properly validate a user-supplied string before using it
default. When parsing the feed parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-15906. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10304 - https://www.zerodayinitiative.com/advisories/ZDI-22-1223/
CVE ID: CVE-2022-40720 State: PUBLISHED Published: 2023-01-26T00:00:00.000Z Last Updated: 2025-04-01T14:54:19.595Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: D-Link Products: DIR-2150 Problem Types: CWE-78 Description: This vulnerability allows network-adjacent attackers to execute arbitrary commands on affected installations of D-Link DIR-2150 4.0.1 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Dreambox plugin for the xupnpd service, which listens on TCP port 4044 by default. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call.
The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the router. Was ZDI-CAN-15935. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10304 - https://www.zerodayinitiative.com/advisories/ZDI-22-1224/
CVE ID: CVE-2022-40721 State: PUBLISHED Published: 2022-10-03T14:53:48 Last Updated: 2024-08-03T12:21:46.741Z Vendors: n/a Products: CreativeDream file uploader Problem Types: Arbitrary file upload Description: Arbitrary file upload vulnerability in php uploader Additional Analyst Notes: - CVE Program Container: References: - https://github.com/CreativeDream/php-uploader/issues/23%2C - http://www.vapidlabs.com/advisory.php?v=216 - http://www.openwall.com/lists/oss-security/2022/10/03/3
CVE ID: CVE-2022-40722 State: PUBLISHED Published: 2023-04-25T00:00:00.000Z Last Updated: 2025-02-04T14:49:20.723Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N) Vendors: Ping Identity Products: PingID Adapter for PingFederate, PingID Integration Kit (includes PingID Adapter), PingFederate (includes PingID Adapter) Problem Types: CWE-780 Description: A misconfiguration of RSA padding implemented in the PingID Adapter for PingFederate to support Offline MFA with PingID mobile authenticators is vulnerable to pre-computed dictionary attacks, leading to a bypass of offline MFA. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https
a bypass of offline MFA. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://docs.pingidentity.com/r/en-us/pingid/pingid_integration_kit_2_20_rn - https://docs.pingidentity.com/r/en-us/pingid/pingid_adapter_configuring_offline_mfa
CVE ID: CVE-2022-40723 State: PUBLISHED Published: 2023-04-25T00:00:00.000Z Last Updated: 2025-02-04T14:48:54.313Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:H/RL:U/RC:C) Vendors: Ping Identity Products: PingID Radius PCV, PingID Integration Kit (includes Radius PCV), PingFederate (includes Radius PCV) Problem Types: CWE-305 Description: The PingID RADIUS PCV adapter for PingFederate, which supports RADIUS authentication with PingID MFA, is vulnerable to MFA bypass under certain configurations. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://docs.pingidentity.com/r/en-us/pingid/pingid_integration_kit_2_19_rn