Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-25904 State: PUBLISHED Published: 2022-12-21T01:21:43.830Z Last Updated: 2025-04-16T14:42:09.443Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P) Vendors: n/a Products: safe-eval Problem Types: Prototype Pollution Description: All versions of package safe-eval are vulnerable to Prototype Pollution which allows an attacker to add or modify properties of the Object.prototype.Consolidate when using the function safeEval. This is because the function uses vm variable, leading an attacker to modify properties of the Object.prototype. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/S
dditional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-JS-SAFEEVAL-3175701 - https://github.com/hacksparrow/safe-eval/issues/26
CVE ID: CVE-2022-25905 State: PUBLISHED Published: 2023-02-16T19:59:47.318Z Last Updated: 2025-01-27T18:24:40.737Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) oneAPI Data Analytics Library (oneDAL) for Intel(R) oneAPI Base Toolkit Problem Types: escalation of privilege Description: Uncontrolled search path element in the Intel(R) oneAPI Data Analytics Library (oneDAL) before version 2021.5 for Intel(R) oneAPI Base Toolkit may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.intel.com/conten
s. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00674.html
CVE ID: CVE-2022-25906 State: PUBLISHED Published: 2023-02-01T05:00:02.596Z Last Updated: 2025-03-26T20:22:01.409Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P) Vendors: n/a Products: is-http2 Problem Types: CWE-78 Description: All versions of the package is-http2 are vulnerable to Command Injection due to missing input sanitization or other checks, and sandboxes being employed to the isH2 function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-JS-ISHTTP2-3153878 - https://github.com/stefanjudis/is-http2/blob/master/index.js%23L23
CVE ID: CVE-2022-25907 State: PUBLISHED Published: 2022-08-09T05:00:17.639847Z Last Updated: 2024-09-16T20:32:06.789Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: n/a Products: ts-deepmerge Problem Types: Prototype Pollution Description: The package ts-deepmerge before 2.0.2 are vulnerable to Prototype Pollution due to missing sanitization of the merge function. Additional Analyst Notes: - CVE Program Container: References: - https://security.snyk.io/vuln/SNYK-JS-TSDEEPMERGE-2959975 - https://github.com/voodoocreation/ts-deepmerge/releases/tag/2.0.2 - https://github.com/voodoocreation/ts-deepmerge/commit/9be5148773343c57be9de39728d6ead18eddf10b
CVE ID: CVE-2022-25908 State: PUBLISHED Published: 2023-01-24T05:00:01.702Z Last Updated: 2025-04-01T15:30:09.604Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P) Vendors: n/a Products: create-choo-electron Problem Types: CWE-78 Description: All versions of the package create-choo-electron are vulnerable to Command Injection via the devInstall function due to improper user-input sanitization. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-JS-CREATECHOOELECTRON-3157953
CVE ID: CVE-2022-25909 State: REJECTED Published: N/A Last Updated: 2025-05-28T16:41:02.527Z Description: No description available.
CVE ID: CVE-2022-25912 State: PUBLISHED Published: 2022-12-12T01:49:10.008Z Last Updated: 2025-04-22T20:15:14.996Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P) Vendors: n/a Products: simple-git Problem Types: Remote Code Execution (RCE) Description: The package simple-git before 3.15.0 are vulnerable to Remote Code Execution (RCE) when enabling the ext transport protocol, which makes it exploitable via clone() method. This vulnerability exists due to an incomplete fix of [CVE-2022-24066](https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-2434306). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln
Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-3112221 - https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-3153532 - https://github.com/steveukx/git-js/commit/774648049eb3e628379e292ea172dccaba610504 - https://github.com/steveukx/git-js/releases/tag/simple-git%403.15.0 - https://github.com/steveukx/git-js/blob/main/docs/PLUGIN-UNSAFE-ACTIONS.md%23overriding-allowed-protocols
CVE ID: CVE-2022-25914 State: PUBLISHED Published: 2022-09-08T05:05:17.747601Z Last Updated: 2024-09-17T00:11:32.255Z Severity: MEDIUM (CVSS 5.6 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: n/a Products: com.google.cloud.tools:jib-core Problem Types: Remote Code Execution (RCE) Description: The package com.google.cloud.tools:jib-core before 0.22.0 are vulnerable to Remote Code Execution (RCE) via the isDockerInstalled function, due to attempting to execute input. Additional Analyst Notes: - CVE Program Container: References: - https://security.snyk.io/vuln/SNYK-JAVA-COMGOOGLECLOUDTOOLS-2968871 - https://github.com/GoogleContainerTools/jib/pull/3744 - https://github.com/GoogleContai
VA-COMGOOGLECLOUDTOOLS-2968871 - https://github.com/GoogleContainerTools/jib/pull/3744 - https://github.com/GoogleContainerTools/jib/commit/67fa40bc2c484da0546333914ea07a89fe44eaaf
CVE ID: CVE-2022-25915 State: PUBLISHED Published: 2022-03-31T08:55:11 Last Updated: 2024-08-03T04:49:44.278Z Vendors: ELECOM CO.,LTD. Products: ELECOM LAN routers Problem Types: Improper Access Control Description: Improper access control vulnerability in ELECOM LAN routers (WRC-1167GST2 firmware v1.25 and prior, WRC-1167GST2A firmware v1.25 and prior, WRC-1167GST2H firmware v1.25 and prior, WRC-2533GS2-B firmware v1.52 and prior, WRC-2533GS2-W firmware v1.52 and prior, WRC-1750GS firmware v1.03 and prior, WRC-1750GSV firmware v2.11 and prior, WRC-1900GST firmware v1.03 and prior, WRC-2533GST firmware v1.03 and prior, WRC-2533GSTA firmware v1.03 and prior, WRC-2533GST2 firmware v1.25 and pr
d prior, WRC-2533GST firmware v1.03 and prior, WRC-2533GSTA firmware v1.03 and prior, WRC-2533GST2 firmware v1.25 and prior, WRC-2533GST2SP firmware v1.25 and prior, WRC-2533GST2-G firmware v1.25 and prior, and EDWRC-2533GST2 firmware v1.25 and prior) allows a network-adjacent authenticated attacker to bypass access restriction and to access the management screen of the product via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://www.elecom.co.jp/news/security/20211130-01/ - https://jvn.jp/en/jp/JVN88993473/
CVE ID: CVE-2022-25916 State: PUBLISHED Published: 2023-02-01T05:00:01.174Z Last Updated: 2025-03-27T13:33:41.094Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P) Vendors: n/a Products: mt7688-wiscan Problem Types: CWE-78 Description: Versions of the package mt7688-wiscan before 0.8.3 are vulnerable to Command Injection due to improper input sanitization in the 'wiscan.scan' function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-JS-MT7688WISCAN-3177394 - https://github.com/simenkid/mt7688-wiscan/blob/master/index.js%23L22 - https://github.com/simenkid/mt7688-wiscan/commit/ff6d6567c65b4e
.com/simenkid/mt7688-wiscan/blob/master/index.js%23L22 - https://github.com/simenkid/mt7688-wiscan/commit/ff6d6567c65b4e972916a8fbc4533212f20a2fa5
CVE ID: CVE-2022-25917 State: PUBLISHED Published: 2022-11-11T15:49:09.844Z Last Updated: 2025-02-05T15:07:59.835Z Severity: MEDIUM (CVSS 6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H) Vendors: n/a Products: Intel(R) Server Board M50CYP Family Problem Types: denial of service Description: Uncaught exception in the firmware for some Intel(R) Server Board M50CYP Family before version R01.01.0005 may allow a privileged user to potentially enable a denial of service via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00708.html
CVE ID: CVE-2022-25918 State: PUBLISHED Published: 2022-10-27T05:05:09.944Z Last Updated: 2025-05-05T18:24:44.572Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: n/a Products: shescape Problem Types: Regular Expression Denial of Service (ReDoS) Description: The package shescape from 1.5.10 and before 1.6.1 are vulnerable to Regular Expression Denial of Service (ReDoS) via the escape function in index.js, due to the usage of insecure regex in the escapeArgBash function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-JS-SHESCAPE-3061108 - https://github.com/ericcornelissen/shescape/
ent: References: - https://security.snyk.io/vuln/SNYK-JS-SHESCAPE-3061108 - https://github.com/ericcornelissen/shescape/blob/main/src/unix.js%23L52 - https://github.com/ericcornelissen/shescape/commit/552e8eab56861720b1d4e5474fb65741643358f9 - https://github.com/ericcornelissen/shescape/releases/tag/v1.6.1
CVE ID: CVE-2022-25920 State: REJECTED Published: N/A Last Updated: 2023-03-07T22:17:45.708Z Description: No description available.
CVE ID: CVE-2022-25921 State: PUBLISHED Published: 2022-08-29T05:05:15.275130Z Last Updated: 2024-09-17T01:56:00.229Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: n/a Products: morgan-json Problem Types: Arbitrary Code Execution Description: All versions of package morgan-json are vulnerable to Arbitrary Code Execution due to missing sanitization of input passed to the Function constructor. Additional Analyst Notes: - CVE Program Container: References: - https://security.snyk.io/vuln/SNYK-JS-MORGANJSON-2976193 - https://github.com/indexzero/morgan-json/blob/3a76010215a4256d41687d082cd66c4f00ea5717/index.js%23L46
CVE ID: CVE-2022-25922 State: PUBLISHED Published: 2022-03-07T15:28:22.000Z Last Updated: 2025-04-16T16:43:59.855Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) Vendors: Power Line Communications Products: PLC4TRUCKS Problem Types: CWE-306 Description: Power Line Communications PLC4TRUCKS J2497 trailer brake controllers implement diagnostic functions which can be invoked by replaying J2497 messages. There is no authentication or authorization for these functions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-063-01
CVE ID: CVE-2022-25923 State: PUBLISHED Published: 2023-01-06T05:00:01.298Z Last Updated: 2025-04-10T13:36:44.511Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P) Vendors: n/a Products: exec-local-bin Problem Types: CWE-78 Description: Versions of the package exec-local-bin before 1.2.0 are vulnerable to Command Injection via the theProcess() functionality due to improper user-input sanitization. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-JS-EXECLOCALBIN-3157956 - https://github.com/saeedseyfi/exec-local-bin/blob/92db00bde9d6e2d83410849f898df12f075b73b0/index.js%23L9 - https://github.
tps://github.com/saeedseyfi/exec-local-bin/blob/92db00bde9d6e2d83410849f898df12f075b73b0/index.js%23L9 - https://github.com/saeedseyfi/exec-local-bin/commit/d425866375c85038133a6f79db2aac66c0a72624
CVE ID: CVE-2022-25926 State: PUBLISHED Published: 2023-01-04T17:01:54.603Z Last Updated: 2025-04-10T14:00:38.462Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P) Vendors: n/a Products: window-control Problem Types: CWE-78 Description: Versions of the package window-control before 1.4.5 are vulnerable to Command Injection via the sendKeys function, due to improper input sanitization. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-JS-WINDOWCONTROL-3186345 - https://github.com/bruno-robert/window-control/commit/075c854534a749d887655a906759f5a7eee95173 - https://github.com/bruno-robert/windo
.com/bruno-robert/window-control/commit/075c854534a749d887655a906759f5a7eee95173 - https://github.com/bruno-robert/window-control/releases/tag/v1.4.5
CVE ID: CVE-2022-25927 State: PUBLISHED Published: 2023-01-25T05:00:00.897Z Last Updated: 2025-04-01T18:28:37.897Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P) Vendors: n/a Products: ua-parser-js Problem Types: CWE-1333 Description: Versions of the package ua-parser-js from 0.7.30 and before 0.7.33, from 0.8.1 and before 1.0.33 are vulnerable to Regular Expression Denial of Service (ReDoS) via the trim() function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-JS-UAPARSERJS-3244450 - https://github.com/faisalman/ua-parser-js/commit/a6140a17dd0300a35cfc9cff999545f267889411
CVE ID: CVE-2022-25929 State: PUBLISHED Published: 2022-12-21T23:14:33.786Z Last Updated: 2025-04-16T18:32:19.005Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P) Vendors: n/a Products: smoothie Problem Types: Cross-site Scripting (XSS) Description: The package smoothie from 1.31.0 and before 1.36.1 are vulnerable to Cross-site Scripting (XSS) due to improper user input sanitization in strokeStyle and tooltipLabel properties. Exploiting this vulnerability is possible when the user can control these properties. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-JS-SMOOTHIE-3177364 - https://
gram Container: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-JS-SMOOTHIE-3177364 - https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-3177368 - https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-3177369 - https://github.com/joewalnes/smoothie/commit/8e0920d50da82f4b6e605d56f41b69fbb9606a98 - https://github.com/joewalnes/smoothie/pull/147
CVE ID: CVE-2022-25931 State: PUBLISHED Published: 2022-12-21T01:21:43.830Z Last Updated: 2025-04-16T18:07:59.150Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P) Vendors: n/a Products: easy-static-server Problem Types: Directory Traversal Description: All versions of package easy-static-server are vulnerable to Directory Traversal due to missing input sanitization and sandboxes being employed to the req.url user input that is passed to the server code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-JS-EASYSTATICSERVER-3153539 - https://github.com/cunjieliu/easyServer/blob/master/index.js
://security.snyk.io/vuln/SNYK-JS-EASYSTATICSERVER-3153539 - https://github.com/cunjieliu/easyServer/blob/master/index.js%23L27 - https://gist.github.com/lirantal/fdfbe26561788c8194a54bf6d31772c9
CVE ID: CVE-2022-25932 State: PUBLISHED Published: 2022-11-09T17:35:34.920Z Last Updated: 2025-04-15T18:41:18.033Z Severity: HIGH (CVSS 7.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L) Vendors: InHand Networks Products: InRouter302 Problem Types: CWE-284 Description: The firmware of InHand Networks InRouter302 V3.5.45 introduces fixes for TALOS-2022-1472 and TALOS-2022-1474. The fixes are incomplete. An attacker can still perform, respectively, a privilege escalation and an information disclosure vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2022-1523 - https://inhandnetworks
Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2022-1523 - https://inhandnetworks.com/upload/attachment/202210/25/InHand-PSA-2022-02.pdf
CVE ID: CVE-2022-25936 State: PUBLISHED Published: 2023-01-30T05:00:01.825Z Last Updated: 2025-03-27T20:13:15.090Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P) Vendors: n/a Products: servst Problem Types: CWE-22 Description: Versions of the package servst before 2.0.3 are vulnerable to Directory Traversal due to improper sanitization of the filePath variable. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-JS-SERVST-3244896 - https://gist.github.com/lirantal/691d02d607753d54856f9335f9a1692f - https://github.com/andrepolischuk/servst/commit/f7cae5d2d7c64c86bc512e1e50614240396ef114
CVE ID: CVE-2022-25937 State: PUBLISHED Published: 2023-02-13T05:00:01.128Z Last Updated: 2025-03-21T14:52:00.741Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P) Vendors: n/a Products: glance Problem Types: CWE-22 Description: Versions of the package glance before 3.0.9 are vulnerable to Directory Traversal that allows users to read files outside the public root directory. This is related to but distinct from the vulnerability reported in [CVE-2018-3715](https://security.snyk.io/vuln/npm:glance:20180129). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-JS-GLANCE-3318395 - https://github
Container: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-JS-GLANCE-3318395 - https://github.com/jarofghosts/glance/commit/8cecfe90286e0c45a5494067f1b592d0ccfeabac
CVE ID: CVE-2022-25940 State: PUBLISHED Published: 2022-12-21T01:21:43.830Z Last Updated: 2025-04-16T18:34:01.838Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P) Vendors: n/a Products: lite-server Problem Types: Denial of Service (DoS) Description: All versions of package lite-server are vulnerable to Denial of Service (DoS) when an attacker sends an HTTP request and includes control characters that the decodeURI() function is unable to parse. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-JS-LITESERVER-3153540 - https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-3175617 - https://gis
ty.snyk.io/vuln/SNYK-JS-LITESERVER-3153540 - https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-3175617 - https://gist.github.com/lirantal/832382155e00da92bfd8bb3adea474eb
CVE ID: CVE-2022-25942 State: PUBLISHED Published: 2022-08-22T18:20:49.608Z Last Updated: 2025-04-15T18:52:22.800Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: HDF5 Group Products: libhdf5 Problem Types: CWE-125 Description: An out-of-bounds read vulnerability exists in the gif2h5 functionality of HDF5 Group libhdf5 1.10.4. A specially-crafted GIF file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2022-1486
CVE ID: CVE-2022-25943 State: PUBLISHED Published: 2022-03-09T04:45:13 Last Updated: 2024-08-03T04:49:44.469Z Vendors: WPS Office Software Products: WPS Office for Windows Problem Types: CWE-276 Description: The installer of WPS Office for Windows versions prior to v11.2.0.10258 fails to configure properly the ACL for the directory where the service program is installed. Additional Analyst Notes: - CVE Program Container: References: - https://www.wps.com/whatsnew/pc/20210806/ - https://jvn.jp/en/vu/JVNVU90673830/ - https://github.com/HadiMed/KINGSOFT-WPS-Office-LPE
CVE ID: CVE-2022-25946 State: PUBLISHED Published: 2022-05-05T16:21:26.941651Z Last Updated: 2024-09-17T03:28:41.853Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N) Vendors: F5 Products: BIG-IP (Advanced WAF, APM, ASM), BIG-IP Guided Configuration (GC) Problem Types: CWE-354 Description: On all versions of 16.1.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x of F5 BIG-IP Advanced WAF, ASM, and ASM, and F5 BIG-IP Guided Configuration (GC) all versions prior to 9.0, when running in Appliance mode, an authenticated attacker with Administrator role privilege may be able to bypass Appliance mode restrictions due to a missing integrity check in F5 BIG-IP Guided Configuration.
ge may be able to bypass Appliance mode restrictions due to a missing integrity check in F5 BIG-IP Guided Configuration. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K52322100
CVE ID: CVE-2022-25948 State: PUBLISHED Published: 2022-12-23T23:03:51.372Z Last Updated: 2025-04-14T18:09:37.390Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: n/a Products: liquidjs Problem Types: Information Exposure Description: The package liquidjs before 10.0.0 are vulnerable to Information Exposure when ownPropertyOnly parameter is set to False, which results in leaking properties of a prototype. Workaround For versions 9.34.0 and higher, an option to disable this functionality is provided. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-JS-LIQUIDJS-2952868 - https://github
ontainer: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-JS-LIQUIDJS-2952868 - https://github.com/harttle/liquidjs/issues/454 - https://github.com/harttle/liquidjs/commit/7e99efc5131e20cf3f59e1fc2c371a15aa4109db - https://github.com/harttle/liquidjs/commit/7eb621601c2b05d6e379e5ce42219f2b1f556208 - https://groups.google.com/u/0/a/snyk.io/g/report/c/9ipXecWRtTM/m/IgLadevtCQAJ
CVE ID: CVE-2022-25949 State: PUBLISHED Published: 2022-03-17T17:15:25 Last Updated: 2024-08-03T04:56:36.510Z Vendors: KINGSOFT JAPAN, INC. Products: KINGSOFT Internet Security 9 Plus Problem Types: CWE-121 Description: The kernel mode driver kwatch3 of KINGSOFT Internet Security 9 Plus Version 2010.06.23.247 fails to properly handle crafted inputs, leading to stack-based buffer overflow. Additional Analyst Notes: - CVE Program Container: References: - https://support.kingsoft.jp/support-info/weakness.html - https://jvn.jp/en/jp/JVN21234459/
CVE ID: CVE-2022-25952 State: PUBLISHED Published: 2022-11-03T19:35:04.736Z Last Updated: 2025-02-20T19:56:26.912Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Keywordrush Products: Content Egg (WordPress plugin) Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Keywordrush Content Egg plugin <= 5.4.0 on WordPress. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/content-egg/wordpress-content-egg-plugin-5-4-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve - https://wordpress.org/plugins/content-egg/#developers
CVE ID: CVE-2022-25957 State: REJECTED Published: N/A Last Updated: 2023-03-07T22:19:31.229Z Description: No description available.
CVE ID: CVE-2022-25959 State: PUBLISHED Published: 2022-04-01T22:17:53.047Z Last Updated: 2025-04-16T17:57:41.902Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Omron Products: CX-Position Problem Types: CWE-119 Description: Omron CX-Position (versions 2.5.3 and prior) is vulnerable to memory corruption while processing a specific project file, which may allow an attacker to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-088-02 - https://www.zerodayinitiative.com/advisories/ZDI-22-577/