Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-36126 State: PUBLISHED Published: 2022-07-16T18:59:46 Last Updated: 2024-08-03T10:00:01.571Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:H/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Inductive Automation Ignition before 7.9.20 and 8.x before 8.1.17. The ScriptInvoke function allows remote attackers to execute arbitrary code by supplying a Python script. Additional Analyst Notes: - CVE Program Container: References: - https://support.inductiveautomation.com/hc/en-us/articles/7625759776653 - https://github.com/sourceincite/randy - https://srcincite.io/advisories/src-2022-0014/
CVE ID: CVE-2022-36127 State: PUBLISHED Published: 2022-07-18T11:30:13 Last Updated: 2024-08-03T10:00:01.456Z Vendors: Apache Software Foundation Products: Apache SkyWalking NodeJS Agent Problem Types: Denial of Service Description: A vulnerability in Apache SkyWalking NodeJS Agent prior to 0.5.1. The vulnerability will cause NodeJS services that has this agent installed to be unavailable if the OAP is unhealthy and NodeJS agent can't establish the connection. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread/x238wo4r5goy39dxdjcmlofp6gcdnqr3 - http://www.openwall.com/lists/oss-security/2022/07/18/1
CVE ID: CVE-2022-36129 State: PUBLISHED Published: 2022-07-26T22:21:51 Last Updated: 2024-08-03T10:00:01.365Z Vendors: n/a Products: n/a Problem Types: n/a Description: HashiCorp Vault Enterprise 1.7.0 through 1.9.7, 1.10.4, and 1.11.0 clusters using Integrated Storage expose an unauthenticated API endpoint that could be abused to override the voter status of a node within a Vault HA cluster, introducing potential for future data loss or catastrophic failure. Fixed in Vault Enterprise 1.9.8, 1.10.5, and 1.11.1. Additional Analyst Notes: - CVE Program Container: References: - https://discuss.hashicorp.com - https://discuss.hashicorp.com/t/hcsec-2022-15-vault-enterprise-does-not-verify-existin
- https://discuss.hashicorp.com - https://discuss.hashicorp.com/t/hcsec-2022-15-vault-enterprise-does-not-verify-existing-voter-status-when-joining-an-integrated-storage-ha-node/42420 - https://security.netapp.com/advisory/ntap-20220901-0011/
CVE ID: CVE-2022-36130 State: PUBLISHED Published: 2022-09-01T01:45:00 Last Updated: 2024-08-03T10:00:04.216Z Vendors: n/a Products: n/a Problem Types: n/a Description: HashiCorp Boundary up to 0.10.1 did not properly perform data integrity checks to ensure the resources were associated with the correct scopes, allowing potential privilege escalation for authorized users of another scope. Fixed in Boundary 0.10.2. Additional Analyst Notes: - CVE Program Container: References: - https://discuss.hashicorp.com - https://discuss.hashicorp.com/t/hcsec-2022017-boundary-allowed-access-to-host-sets-and-credential-sources-for-authorized-users-of-another-scope/43493
CVE ID: CVE-2022-36131 State: PUBLISHED Published: 2022-07-22T12:36:36 Last Updated: 2024-08-03T10:00:01.369Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Better PDF Exporter add-on 10.0.0 for Atlassian Jira is prone to stored XSS via a crafted description to the PDF Templates overview page. Additional Analyst Notes: - CVE Program Container: References: - https://marketplace.atlassian.com/apps/5167/better-pdf-exporter-for-jira?tab=overview&hosting=server - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2022-038.txt
CVE ID: CVE-2022-36133 State: PUBLISHED Published: 2022-11-25T00:00:00.000Z Last Updated: 2025-04-25T17:31:19.789Z Vendors: n/a Products: n/a Problem Types: n/a Description: The WebConfig functionality of Epson TM-C3500 and TM-C7500 devices with firmware version WAM31500 allows authentication bypass. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://download.epson-biz.com/epson/epson_public_document.php?name=Infomation_history.pdf - https://download.epson-biz.com/modules/colorworks/
CVE ID: CVE-2022-36136 State: PUBLISHED Published: 2022-11-29T00:00:00.000Z Last Updated: 2025-04-25T14:58:26.534Z Vendors: n/a Products: n/a Problem Types: n/a Description: ChurchCRM Version 4.4.5 has XSS vulnerabilities that allow attackers to store XSS via location input Deposit Comment. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ChurchCRM/CRM/releases/tag/4.4.5 - https://grimthereaperteam.medium.com/churchcrm-version-4-4-5-stored-xss-vulnerability-at-deposit-commend-839d2c587d6e
CVE ID: CVE-2022-36137 State: PUBLISHED Published: 2022-11-29T00:00:00.000Z Last Updated: 2025-04-25T14:57:34.693Z Vendors: n/a Products: n/a Problem Types: n/a Description: ChurchCRM Version 4.4.5 has XSS vulnerabilities that allow attackers to store XSS via location input sHeader. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ChurchCRM/CRM/releases/tag/4.4.5 - https://grimthereaperteam.medium.com/churchcrm-version-4-4-5-stored-xss-vulnerability-at-sheader-2ed4184030f7
CVE ID: CVE-2022-36139 State: PUBLISHED Published: 2022-08-16T20:13:24 Last Updated: 2024-08-03T10:00:04.189Z Vendors: n/a Products: n/a Problem Types: n/a Description: SWFMill commit 53d7690 was discovered to contain a heap-buffer overflow via SWF::Writer::writeByte(unsigned char). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/djcsdy/swfmill/issues/56
CVE ID: CVE-2022-36140 State: PUBLISHED Published: 2022-08-16T20:13:25 Last Updated: 2024-08-03T10:00:04.218Z Vendors: n/a Products: n/a Problem Types: n/a Description: SWFMill commit 53d7690 was discovered to contain a segmentation violation via SWF::DeclareFunction2::write(SWF::Writer*, SWF::Context*). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/djcsdy/swfmill/issues/57
CVE ID: CVE-2022-36141 State: PUBLISHED Published: 2022-08-16T20:13:26 Last Updated: 2024-08-03T10:00:03.697Z Vendors: n/a Products: n/a Problem Types: n/a Description: SWFMill commit 53d7690 was discovered to contain a segmentation violation via SWF::MethodBody::write(SWF::Writer*, SWF::Context*). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/djcsdy/swfmill/issues/58
CVE ID: CVE-2022-36142 State: PUBLISHED Published: 2022-08-16T20:13:34 Last Updated: 2024-08-03T10:00:04.285Z Vendors: n/a Products: n/a Problem Types: n/a Description: SWFMill commit 53d7690 was discovered to contain a heap-buffer overflow via SWF::Reader::getU30(). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/djcsdy/swfmill/issues/61
CVE ID: CVE-2022-36143 State: PUBLISHED Published: 2022-08-16T20:13:35 Last Updated: 2024-08-03T10:00:04.004Z Vendors: n/a Products: n/a Problem Types: n/a Description: SWFMill commit 53d7690 was discovered to contain a heap-buffer overflow via __interceptor_strlen.part at /sanitizer_common/sanitizer_common_interceptors.inc. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/djcsdy/swfmill/issues/62
CVE ID: CVE-2022-36144 State: PUBLISHED Published: 2022-08-16T20:13:36 Last Updated: 2024-08-03T10:00:04.288Z Vendors: n/a Products: n/a Problem Types: n/a Description: SWFMill commit 53d7690 was discovered to contain a heap-buffer overflow via base64_encode. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/djcsdy/swfmill/issues/63
CVE ID: CVE-2022-36145 State: PUBLISHED Published: 2022-08-16T20:13:36 Last Updated: 2024-08-03T10:00:03.844Z Vendors: n/a Products: n/a Problem Types: n/a Description: SWFMill commit 53d7690 was discovered to contain a segmentation violation via SWF::Reader::getWord(). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/djcsdy/swfmill/issues/64
CVE ID: CVE-2022-36146 State: PUBLISHED Published: 2022-08-16T20:13:37 Last Updated: 2024-08-03T10:00:04.197Z Vendors: n/a Products: n/a Problem Types: n/a Description: SWFMill commit 53d7690 was discovered to contain a memory allocation issue via operator new[](unsigned long) at asan_new_delete.cpp. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/djcsdy/swfmill/issues/65
CVE ID: CVE-2022-36148 State: PUBLISHED Published: 2022-08-16T20:02:23 Last Updated: 2024-08-03T10:00:04.288Z Vendors: n/a Products: n/a Problem Types: n/a Description: fdkaac commit 53fe239 was discovered to contain a floating point exception (FPE) via wav_open at /src/wav_reader.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nu774/fdkaac/issues/52
CVE ID: CVE-2022-36149 State: PUBLISHED Published: 2022-08-16T20:13:39 Last Updated: 2024-08-03T10:00:04.395Z Vendors: n/a Products: n/a Problem Types: n/a Description: tifig v0.2.2 was discovered to contain a heap-use-after-free via temInfoEntry(). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/monostream/tifig/issues/70
CVE ID: CVE-2022-36150 State: PUBLISHED Published: 2022-08-16T20:13:40 Last Updated: 2024-08-03T10:00:03.917Z Vendors: n/a Products: n/a Problem Types: n/a Description: tifig v0.2.2 was discovered to contain a heap-buffer overflow via __asan_memmove at /asan/asan_interceptors_memintrinsics.cpp. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/monostream/tifig/issues/68
CVE ID: CVE-2022-36151 State: PUBLISHED Published: 2022-08-16T20:13:41 Last Updated: 2024-08-03T10:00:04.287Z Vendors: n/a Products: n/a Problem Types: n/a Description: tifig v0.2.2 was discovered to contain a segmentation violation via getType() at /common/bbox.cpp. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/monostream/tifig/issues/69
CVE ID: CVE-2022-36152 State: PUBLISHED Published: 2022-08-16T20:02:26 Last Updated: 2024-08-03T10:00:04.142Z Vendors: n/a Products: n/a Problem Types: n/a Description: tifig v0.2.2 was discovered to contain a memory leak via operator new[](unsigned long) at /asan/asan_new_delete.cpp. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/monostream/tifig/issues/72
CVE ID: CVE-2022-36153 State: PUBLISHED Published: 2022-08-16T20:13:42 Last Updated: 2024-08-03T10:00:04.076Z Vendors: n/a Products: n/a Problem Types: n/a Description: tifig v0.2.2 was discovered to contain a segmentation violation via std::vector<unsigned int, std::allocator<unsigned int> >::size() const at /bits/stl_vector.h. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/monostream/tifig/issues/71
CVE ID: CVE-2022-36155 State: PUBLISHED Published: 2022-08-16T20:02:29 Last Updated: 2024-08-03T10:00:04.279Z Vendors: n/a Products: n/a Problem Types: n/a Description: tifig v0.2.2 was discovered to contain a resource allocation issue via operator new(unsigned long) at asan_new_delete.cpp. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/monostream/tifig/issues/73
CVE ID: CVE-2022-36157 State: PUBLISHED Published: 2022-08-19T21:05:20 Last Updated: 2024-08-03T10:00:04.448Z Vendors: n/a Products: n/a Problem Types: n/a Description: XXL-JOB all versions as of 11 July 2022 are vulnerable to Insecure Permissions resulting in the ability to execute admin function with low Privilege account. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Richard-Muzi/vulnerability/issues/1
CVE ID: CVE-2022-36158 State: PUBLISHED Published: 2022-09-26T10:07:23.000Z Last Updated: 2025-05-21T16:08:48.872Z Vendors: n/a Products: n/a Problem Types: n/a Description: Contec FXA3200 version 1.13.00 and under suffers from Insecure Permissions in the Wireless LAN Manager interface which allows malicious actors to execute Linux commands with root privilege via a hidden web page (/usr/www/ja/mnt_cmd.cgi). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.contec.com/products-services/computer-networking/flexlan-fx/fx-accesspoint/fxa3200/feature/#section - https://gist.github.com/Nwqda/aac33d1936d2b514a3268f145345abb4 - https://samy.link/b
esspoint/fxa3200/feature/#section - https://gist.github.com/Nwqda/aac33d1936d2b514a3268f145345abb4 - https://samy.link/blog/contec-flexlan-fxa2000-and-fxa3000-series-vulnerability-repo - https://jvn.jp/en/vu/JVNVU98305100/
CVE ID: CVE-2022-36159 State: PUBLISHED Published: 2022-09-26T10:07:27.000Z Last Updated: 2025-05-21T17:55:39.230Z Vendors: n/a Products: n/a Problem Types: n/a Description: Contec FXA3200 version 1.13 and under were discovered to contain a hard coded hash password for root stored in the component /etc/shadow. As the password strength is weak, it can be cracked in few minutes. Through this credential, a malicious actor can access the Wireless LAN Manager interface and open the telnet port then sniff the traffic or inject any malware. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.contec.com/products-services/computer-networking/flexlan-f
Container: - CISA ADP Vulnrichment: References: - https://www.contec.com/products-services/computer-networking/flexlan-fx/fx-accesspoint/fxa3200/feature/#section - https://gist.github.com/Nwqda/aac33d1936d2b514a3268f145345abb4 - https://samy.link/blog/contec-flexlan-fxa2000-and-fxa3000-series-vulnerability-repo - https://jvn.jp/en/vu/JVNVU98305100/
CVE ID: CVE-2022-36161 State: PUBLISHED Published: 2022-07-26T12:57:16 Last Updated: 2024-08-03T10:00:04.208Z Vendors: n/a Products: n/a Problem Types: n/a Description: Orange Station 1.0 was discovered to contain a SQL injection vulnerability via the username parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/mayuri_k/2022/Orange-Station-1.0
CVE ID: CVE-2022-36168 State: PUBLISHED Published: 2022-08-25T23:40:09 Last Updated: 2024-08-03T10:00:04.255Z Vendors: n/a Products: n/a Problem Types: n/a Description: A directory traversal vulnerability was discovered in Wuzhicms 4.1.0. via /coreframe/app/attachment/admin/index.php: Additional Analyst Notes: - CVE Program Container: References: - https://github.com/wuzhicms/wuzhicms/issues/202 - https://github.com/Cigar-Fasion/CVE/issues/1
CVE ID: CVE-2022-36170 State: PUBLISHED Published: 2022-08-19T20:30:49 Last Updated: 2024-08-03T10:00:04.289Z Vendors: n/a Products: n/a Problem Types: n/a Description: MapGIS 10.5 Pro IGServer has hardcoded credentials in the front-end and can lead to escalation of privileges and arbitrary file deletion. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/prismbreak/vulnerabilities/issues/2 - http://example.com:8082/#/login
CVE ID: CVE-2022-36171 State: PUBLISHED Published: 2022-08-19T21:13:20 Last Updated: 2024-08-03T10:00:04.406Z Vendors: n/a Products: n/a Problem Types: n/a Description: MapGIS IGServer 10.5.6.11 is vulnerable to Arbitrary file deletion. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/prismbreak/vulnerabilities/issues/2
CVE ID: CVE-2022-36173 State: PUBLISHED Published: 2022-09-12T20:56:05 Last Updated: 2024-08-03T10:00:04.200Z Vendors: n/a Products: n/a Problem Types: n/a Description: FreshService macOS Agent < 4.4.0 and FreshServce Linux Agent < 3.4.0 are vulnerable to TLS Man-in-The-Middle via the FreshAgent client and scheduled update service. Additional Analyst Notes: - CVE Program Container: References: - https://community.freshworks.com/product-updates/freshservice-release-notes-april-2022-23982#Security+updates:+Discovery+Probe+and+Discovery+Agent - https://public-exposure.inform.social/post/integrity-checking/
CVE ID: CVE-2022-36174 State: PUBLISHED Published: 2022-09-12T20:55:52 Last Updated: 2024-08-03T10:00:04.183Z Vendors: n/a Products: n/a Problem Types: n/a Description: FreshService Windows Agent < 2.11.0 and FreshService macOS Agent < 4.2.0 and FreshService Linux Agent < 3.3.0. are vulnerable to Broken integrity checking via the FreshAgent client and scheduled update service. Additional Analyst Notes: - CVE Program Container: References: - https://community.freshworks.com/product-updates/freshservice-release-notes-april-2022-23982#Security+updates:+Discovery+Probe+and+Discovery+Agent - https://public-exposure.inform.social/post/integrity-checking/
CVE ID: CVE-2022-36179 State: PUBLISHED Published: 2022-11-22T00:00:00.000Z Last Updated: 2025-04-29T15:17:39.703Z Vendors: n/a Products: n/a Problem Types: n/a Description: Fusiondirectory 1.3 suffers from Improper Session Handling. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://fusiondirectory.com - https://yoroi.company/research/cve-advisory-full-disclosure-multiple-vulnerabilities/ - https://lists.debian.org/debian-lts-announce/2023/07/msg00009.html
CVE ID: CVE-2022-36180 State: PUBLISHED Published: 2022-11-22T00:00:00.000Z Last Updated: 2025-04-29T15:16:41.448Z Vendors: n/a Products: n/a Problem Types: n/a Description: Fusiondirectory 1.3 is vulnerable to Cross Site Scripting (XSS) via /fusiondirectory/index.php?message=[injection], /fusiondirectory/index.php?message=invalidparameter&plug={Injection], /fusiondirectory/index.php?signout=1&message=[injection]&plug=106. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://fusiondirectory.com - https://yoroi.company/research/cve-advisory-full-disclosure-multiple-vulnerabilities/ - https://lists.debian.org/debian-lts-announce/2023/07/msg00009.html
CVE ID: CVE-2022-36182 State: PUBLISHED Published: 2022-10-27T00:00:00.000Z Last Updated: 2025-05-07T17:56:09.000Z Vendors: n/a Products: n/a Problem Types: n/a Description: Hashicorp Boundary v0.8.0 is vulnerable to Clickjacking which allow for the interception of login credentials, re-direction of users to malicious sites, or causing users to perform malicious actions on the site. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://owasp.org/www-community/attacks/Clickjacking - https://packetstormsecurity.com/files/168654/Hashicorp-Boundary-Clickjacking.html
CVE ID: CVE-2022-36186 State: PUBLISHED Published: 2022-08-17T14:46:40 Last Updated: 2024-08-03T10:00:04.568Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Null Pointer dereference vulnerability exists in GPAC 2.1-DEV-revUNKNOWN-master via the function gf_filter_pid_set_property_full () at filter_core/filter_pid.c:5250,which causes a Denial of Service (DoS). This vulnerability was fixed in commit b43f9d1. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gpac/gpac/issues/2223
CVE ID: CVE-2022-36190 State: PUBLISHED Published: 2022-08-17T00:00:00 Last Updated: 2024-08-03T10:00:04.217Z Vendors: n/a Products: n/a Problem Types: n/a Description: GPAC mp4box 2.1-DEV-revUNKNOWN-master has a use-after-free vulnerability in function gf_isom_dovi_config_get. This vulnerability was fixed in commit fef6242. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gpac/gpac/issues/2220 - https://www.debian.org/security/2023/dsa-5411
CVE ID: CVE-2022-36191 State: PUBLISHED Published: 2022-08-17T00:00:00 Last Updated: 2024-08-03T10:00:04.406Z Vendors: n/a Products: n/a Problem Types: n/a Description: A heap-buffer-overflow had occurred in function gf_isom_dovi_config_get of isomedia/avc_ext.c:2490, as demonstrated by MP4Box. This vulnerability was fixed in commit fef6242. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gpac/gpac/issues/2218 - https://www.debian.org/security/2023/dsa-5411
CVE ID: CVE-2022-36193 State: PUBLISHED Published: 2022-11-28T00:00:00.000Z Last Updated: 2025-04-25T19:26:17.909Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection in School Management System 1.0 allows remote attackers to modify or delete data, causing persistent changes to the application's content or behavior by using malicious SQL queries. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/lahirudanushka/School-Management-System---PHP-MySQL - https://github.com/G37SYS73M/Advisory_G37SYS73M/blob/main/CVE-2022-36193/POC.md
CVE ID: CVE-2022-36194 State: PUBLISHED Published: 2022-08-29T05:42:05 Last Updated: 2024-08-03T10:00:04.199Z Vendors: n/a Products: n/a Problem Types: n/a Description: Centreon 22.04.0 is vulnerable to Cross Site Scripting (XSS) from the function Pollers > Broker Configuration by adding a crafted payload into the name parameter. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/168149/Centreon-22.04.0-Cross-Site-Scripting.html - https://github.com/amdsyad/poc-dump/blob/main/Stored%20XSS%20in%20name%20parameter%20in%20Centreon%20version%2022.04.0
CVE ID: CVE-2022-36197 State: PUBLISHED Published: 2022-08-03T00:03:41 Last Updated: 2024-08-03T10:00:04.103Z Vendors: n/a Products: n/a Problem Types: n/a Description: BigTree CMS 4.4.16 was discovered to contain an arbitrary file upload vulnerability which allows attackers to execute arbitrary code via a crafted PDF file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/bigtreecms/BigTree-CMS/issues/392
CVE ID: CVE-2022-36198 State: PUBLISHED Published: 2022-08-22T00:31:13 Last Updated: 2024-08-03T10:00:04.197Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injections detected in Bus Pass Management System 1.0 via buspassms/admin/view-enquiry.php, buspassms/admin/pass-bwdates-reports-details.php, buspassms/admin/changeimage.php, buspassms/admin/search-pass.php, buspassms/admin/edit-category-detail.php, and buspassms/admin/edit-pass-detail.php Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jcarabantes/Bus-Vulnerabilities - https://phpgurukul.com/bus-pass-management-system-using-php-and-mysql
CVE ID: CVE-2022-36200 State: PUBLISHED Published: 2022-08-29T14:21:40 Last Updated: 2024-08-03T10:00:04.232Z Vendors: n/a Products: n/a Problem Types: n/a Description: In FiberHome VDSL2 Modem HG150-Ub_V3.0, Credentials of Admin are submitted in URL, which can be logged/sniffed. Additional Analyst Notes: - CVE Program Container: References: - https://youtu.be/nHgstvq0rr8 - https://github.com/afaq1337/CVE-2022-36200
CVE ID: CVE-2022-36201 State: PUBLISHED Published: 2022-08-31T20:47:11 Last Updated: 2024-08-03T10:00:04.178Z Vendors: n/a Products: n/a Problem Types: n/a Description: Doctor’s Appointment System v1.0 is vulnerable to Blind SQLi via settings.php. Additional Analyst Notes: - CVE Program Container: References: - https://www.sourcecodester.com/hashenudara/simple-doctors-appointment-project.html - https://github.com/aznull/CVEs - http://packetstormsecurity.com/files/168212/Doctors-Appointment-System-1.0-SQL-Injection.html
CVE ID: CVE-2022-36202 State: PUBLISHED Published: 2022-08-31T20:43:31 Last Updated: 2024-08-03T10:00:04.097Z Vendors: n/a Products: n/a Problem Types: n/a Description: Doctor's Appointment System1.0 is vulnerable to Incorrect Access Control via edoc/patient/settings.php. The settings.php is affected by Broken Access Control (IDOR) via id= parameter. Additional Analyst Notes: - CVE Program Container: References: - http://hshnudr.com - https://www.sourcecodester.com/hashenudara/simple-doctors-appointment-project.html - https://github.com/aznull/CVEs
CVE ID: CVE-2022-36203 State: PUBLISHED Published: 2022-08-31T20:36:08 Last Updated: 2024-08-03T10:00:04.230Z Vendors: n/a Products: n/a Problem Types: n/a Description: Doctor's Appointment System 1.0 is vulnerable to Cross Site Scripting (XSS) via the admin panel. In addition, it leads to takeover the administrator account by stealing the cookie via XSS. Additional Analyst Notes: - CVE Program Container: References: - https://www.sourcecodester.com/hashenudara/simple-doctors-appointment-project.html - https://github.com/aznull/CVEs - http://packetstormsecurity.com/files/168211/Doctors-Appointment-System-1.0-Cross-Site-Scripting.html