Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-40405 State: PUBLISHED Published: 2022-11-14T00:00:00.000Z Last Updated: 2025-04-30T18:53:53.826Z Vendors: n/a Products: n/a Problem Types: n/a Description: WoWonder Social Network Platform v4.1.2 was discovered to contain a SQL injection vulnerability via the offset parameter at requests.php?f=load-my-blogs. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/nhiephon/Research
CVE ID: CVE-2022-40407 State: PUBLISHED Published: 2022-09-29T13:20:22.000Z Last Updated: 2025-05-20T19:15:42.185Z Vendors: n/a Products: n/a Problem Types: n/a Description: A zip slip vulnerability in the file upload function of Chamilo v1.11 allows attackers to execute arbitrary code via a crafted Zip file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/chamilo/chamilo-lms - https://support.chamilo.org/projects/chamilo-18/wiki/Security_issues#Issue-94-2022-09-06-High-impact-Moderate-risk-Authenticated-RCE-via-zipslip-attack-in-file-upload - https://github.com/alexmackey/security-research/blob/main/chamilo/ChamiloRceViaZipSlip.md
CVE ID: CVE-2022-40408 State: PUBLISHED Published: 2022-09-29T13:33:54.000Z Last Updated: 2025-05-20T18:13:03.291Z Vendors: n/a Products: n/a Problem Types: n/a Description: FeehiCMS v2.1.1 was discovered to contain a cross-site scripting (XSS) vulnerability via a crafted payload injected into the Comment box under the Single Page module. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/liufee/feehicms/issues/3
CVE ID: CVE-2022-40424 State: PUBLISHED Published: 2022-09-19T14:43:27 Last Updated: 2024-08-03T12:21:45.557Z Vendors: n/a Products: n/a Problem Types: n/a Description: The d8s-urls for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. A potential code execution backdoor inserted by third parties is the democritus-networking package. The affected version of d8s-urls is 0.1.0 Additional Analyst Notes: - CVE Program Container: References: - https://pypi.org/project/democritus-networking/ - https://github.com/democritus-project/d8s-urls/issues/9
CVE ID: CVE-2022-40425 State: PUBLISHED Published: 2022-09-19T15:15:51 Last Updated: 2024-08-03T12:21:45.754Z Vendors: n/a Products: n/a Problem Types: n/a Description: The d8s-html for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-networking package. The affected version is 0.1.0. Additional Analyst Notes: - CVE Program Container: References: - https://pypi.org/project/democritus-networking/ - https://github.com/democritus-project/d8s-html/issues/11
CVE ID: CVE-2022-40426 State: PUBLISHED Published: 2022-09-19T15:17:43 Last Updated: 2024-08-03T12:21:45.680Z Vendors: n/a Products: n/a Problem Types: n/a Description: The d8s-asns for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-networking package. The affected version is 0.1.0. Additional Analyst Notes: - CVE Program Container: References: - https://pypi.org/project/democritus-networking/ - https://github.com/democritus-project/d8s-asns/issues/8
CVE ID: CVE-2022-40427 State: PUBLISHED Published: 2022-09-19T14:54:11 Last Updated: 2024-08-03T12:21:45.593Z Vendors: n/a Products: n/a Problem Types: n/a Description: The d8s-domains for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-networking package. The affected version is 0.1.0 Additional Analyst Notes: - CVE Program Container: References: - https://pypi.org/project/democritus-networking/ - https://github.com/democritus-project/d8s-domains/issues/7
CVE ID: CVE-2022-40428 State: PUBLISHED Published: 2022-09-19T15:19:19 Last Updated: 2024-08-03T12:21:46.280Z Vendors: n/a Products: n/a Problem Types: n/a Description: The d8s-mpeg for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-networking package. The affected version is 0.1.0. Additional Analyst Notes: - CVE Program Container: References: - https://pypi.org/project/democritus-networking/ - https://github.com/democritus-project/d8s-mpeg/issues/5
CVE ID: CVE-2022-40429 State: PUBLISHED Published: 2022-09-19T15:08:06 Last Updated: 2024-08-03T12:21:46.120Z Vendors: n/a Products: n/a Problem Types: n/a Description: The d8s-ip-addresses for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-networking package. The affected version is 0.1.0. Additional Analyst Notes: - CVE Program Container: References: - https://pypi.org/project/democritus-networking/ - https://github.com/democritus-project/d8s-ip-addresses/issues/12
CVE ID: CVE-2022-40430 State: PUBLISHED Published: 2022-09-19T15:21:17 Last Updated: 2024-08-03T12:21:46.373Z Vendors: n/a Products: n/a Problem Types: n/a Description: The d8s-utility for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-networking package. The affected version is 0.1.0. Additional Analyst Notes: - CVE Program Container: References: - https://pypi.org/project/democritus-networking/ - https://github.com/democritus-project/d8s-utility/issues/9
CVE ID: CVE-2022-40431 State: PUBLISHED Published: 2022-09-19T15:11:37 Last Updated: 2024-08-03T12:21:45.679Z Vendors: n/a Products: n/a Problem Types: n/a Description: The d8s-pdfs for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-networking package. The affected version is 0.1.0. Additional Analyst Notes: - CVE Program Container: References: - https://pypi.org/project/democritus-networking/ - https://github.com/democritus-project/d8s-pdfs/issues/5
CVE ID: CVE-2022-40432 State: PUBLISHED Published: 2022-09-19T15:23:26 Last Updated: 2024-08-03T12:21:45.685Z Vendors: n/a Products: n/a Problem Types: n/a Description: The d8s-strings for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-hypothesis package. The affected version is 0.1.0. Additional Analyst Notes: - CVE Program Container: References: - https://pypi.org/project/d8s-strings/ - https://pypi.org/project/democritus-hypothesis/ - https://github.com/democritus-project/d8s-strings/issues/21
CVE ID: CVE-2022-40433 State: REJECTED Published: 2023-08-22T00:00:00 Last Updated: 2024-02-16T23:22:28.065Z Description: No description available.
CVE ID: CVE-2022-40434 State: PUBLISHED Published: 2022-12-19T00:00:00.000Z Last Updated: 2025-04-17T15:07:54.996Z Vendors: n/a Products: n/a Problem Types: n/a Description: Softr v2.0 was discovered to be vulnerable to HTML injection via the Name field of the Account page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.softr.io/ - http://softr.com - https://isaghojaria.medium.com/softr-v2-0-was-discovered-to-be-vulnerable-to-html-injection-via-the-name-field-of-the-account-page-c6fbd3162254
CVE ID: CVE-2022-40435 State: PUBLISHED Published: 2022-12-19T00:00:00.000Z Last Updated: 2025-04-17T15:06:08.522Z Vendors: n/a Products: n/a Problem Types: n/a Description: Employee Performance Evaluation System v1.0 was discovered to contain a persistent cross-site scripting (XSS) vulnerability via adding new entries under the Departments and Designations module. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://employee.com - https://www.sourcecodester.com - https://isaghojaria.medium.com/employee-performance-evaluation-system-v1-0-fdf7eb5eaf92
CVE ID: CVE-2022-40438 State: PUBLISHED Published: 2022-09-14T20:06:38 Last Updated: 2024-08-03T12:21:46.246Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow vulnerability in function AP4_MemoryByteStream::WritePartial in mp42aac in Bento4 v1.6.0-639, allows attackers to cause a denial of service via a crafted file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/axiomatic-systems/Bento4/issues/751
CVE ID: CVE-2022-40439 State: PUBLISHED Published: 2022-09-14T20:06:32 Last Updated: 2024-08-03T12:21:46.147Z Vendors: n/a Products: n/a Problem Types: n/a Description: An memory leak issue was discovered in AP4_StdcFileByteStream::Create in mp42ts in Bento4 v1.6.0-639, allows attackers to cause a denial of service via a crafted file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/axiomatic-systems/Bento4/issues/750
CVE ID: CVE-2022-40440 State: PUBLISHED Published: 2022-10-11T00:00:00 Last Updated: 2024-08-03T12:21:45.907Z Vendors: n/a Products: n/a Problem Types: n/a Description: mxGraph v4.2.2 was discovered to contain a cross-site scripting (XSS) vulnerability via the setTooltips() function. Additional Analyst Notes: - CVE Program Container: References: - http://mxgraph.com - https://github.com/jgraph/mxgraph - https://github.com/SxB64/mxgraph-xss-vul/wiki
CVE ID: CVE-2022-40443 State: PUBLISHED Published: 2022-09-22T13:32:34.000Z Last Updated: 2025-05-27T16:15:21.257Z Vendors: n/a Products: n/a Problem Types: n/a Description: An absolute path traversal vulnerability in ZZCMS 2022 allows attackers to obtain sensitive information via a crafted GET request sent to /one/siteinfo.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/liong007/ZZCMS/issues/1
CVE ID: CVE-2022-40444 State: PUBLISHED Published: 2022-09-22T13:32:35.000Z Last Updated: 2025-05-27T16:14:39.393Z Vendors: n/a Products: n/a Problem Types: n/a Description: ZZCMS 2022 was discovered to contain a full path disclosure vulnerability via the page /admin/index.PHP? _server. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/liong007/ZZCMS/issues/2
CVE ID: CVE-2022-40446 State: PUBLISHED Published: 2022-09-22T13:32:36.000Z Last Updated: 2025-05-27T15:56:37.792Z Vendors: n/a Products: n/a Problem Types: n/a Description: ZZCMS 2022 was discovered to contain a SQL injection vulnerability via the component /admin/sendmailto.php?tomail=&groupid=. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/liong007/ZZCMS/issues/4
CVE ID: CVE-2022-40447 State: PUBLISHED Published: 2022-09-22T13:32:37.000Z Last Updated: 2025-05-27T15:52:29.673Z Vendors: n/a Products: n/a Problem Types: n/a Description: ZZCMS 2022 was discovered to contain a SQL injection vulnerability via the keyword parameter at /admin/baojia_list.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/liong007/ZZCMS/issues/5
CVE ID: CVE-2022-40468 State: PUBLISHED Published: 2022-09-19T00:00:00.000Z Last Updated: 2025-11-04T16:09:53.843Z Vendors: n/a Products: n/a Problem Types: n/a Description: Potential leak of left-over heap data if custom error page templates containing special non-standard variables are used. Tinyproxy commit 84f203f and earlier use uninitialized buffers in process_request() function. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tinyproxy/tinyproxy - https://github.com/tinyproxy/tinyproxy/blob/84f203fb1c4733608c7283bbe794005a469c4b00/src/reqs.c#L346 - https://github.com/tinyproxy/tinyproxy/issues/457 - https://github.com/tinyproxy/tinyproxy/issues/457#
src/reqs.c#L346 - https://github.com/tinyproxy/tinyproxy/issues/457 - https://github.com/tinyproxy/tinyproxy/issues/457#issuecomment-1264176815 - https://security.gentoo.org/glsa/202305-27
CVE ID: CVE-2022-40469 State: PUBLISHED Published: 2022-10-12T00:00:00.000Z Last Updated: 2025-05-15T15:04:19.542Z Vendors: n/a Products: n/a Problem Types: n/a Description: iKuai OS v3.6.7 was discovered to contain an authenticated remote code execution (RCE) vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ikuai8.com/component/download - https://www.ikuai8.com/download.php?n=/3.x/iso/iKuai8_x64_3.6.7_Build202208301257.iso - https://github.com/yikesoftware/exp_and_poc_archive/tree/main/CVE/CVE-2022-40469
CVE ID: CVE-2022-40470 State: PUBLISHED Published: 2022-11-21T00:00:00.000Z Last Updated: 2025-04-29T20:03:23.332Z Vendors: n/a Products: n/a Problem Types: n/a Description: Phpgurukul Blood Donor Management System 1.0 allows Cross Site Scripting via Add Blood Group Name Feature. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://drive.google.com/file/d/1UDuez2CTscdWXYzyXLi3x8CMs9IWLL11/view?usp=sharing
CVE ID: CVE-2022-40471 State: PUBLISHED Published: 2022-10-31T00:00:00.000Z Last Updated: 2025-05-06T15:41:02.673Z Vendors: n/a Products: n/a Problem Types: n/a Description: Remote Code Execution in Clinic's Patient Management System v 1.0 allows Attacker to Upload arbitrary php webshell via profile picture upload functionality in users.php Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.sourcecodester.com/php-clinics-patient-management-system-source-code - https://drive.google.com/file/d/1m-wTfOL5gY3huaSEM3YPSf98qIrkl-TW/view?usp=sharing - https://github.com/RashidKhanPathan/CVE-2022-40471
CVE ID: CVE-2022-40472 State: PUBLISHED Published: 2022-09-29T19:02:07.000Z Last Updated: 2025-05-20T20:05:27.033Z Vendors: n/a Products: n/a Problem Types: n/a Description: ZKTeco Xiamen Information Technology ZKBio Time 8.0.7 Build: 20220721.14829 was discovered to contain a CSV injection vulnerability. This vulnerability allows attackers to execute arbitrary code via a crafted payload injected into the Content text field of the Add New Message module. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://the-it-wonders.blogspot.com/2022/09/zkbio-time-csv-injection.html
CVE ID: CVE-2022-40475 State: PUBLISHED Published: 2022-09-29T11:37:10.000Z Last Updated: 2025-05-21T14:21:27.445Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK A860R V4.1.2cu.5182_B20201027 was discovered to contain a command injection via the component /cgi-bin/downloadFile.cgi. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/1759134370/iot/blob/main/TOTOLINK/A860R/6.md
CVE ID: CVE-2022-40476 State: PUBLISHED Published: 2022-09-14T20:06:21 Last Updated: 2024-08-03T12:21:45.937Z Vendors: n/a Products: n/a Problem Types: n/a Description: A null pointer dereference issue was discovered in fs/io_uring.c in the Linux kernel before 5.15.62. A local user could use this flaw to crash the system or potentially cause a denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://lore.kernel.org/lkml/CAO4S-mdVW5GkODk0+vbQexNAAJZopwzFJ9ACvRCJ989fQ4A6Ow%40mail.gmail.com/ - https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/fs/io_uring.c?h=v5.15.61&id=3746d62ecf1c872a520c4866118edccb121c44fd - https://mirrors.edge.kerne
table/linux.git/commit/fs/io_uring.c?h=v5.15.61&id=3746d62ecf1c872a520c4866118edccb121c44fd - https://mirrors.edge.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.62
CVE ID: CVE-2022-40480 State: PUBLISHED Published: 2023-02-07T00:00:00.000Z Last Updated: 2025-03-25T15:39:11.620Z Vendors: n/a Products: n/a Problem Types: n/a Description: Nordic Semiconductor, Microchip Technology NRF5340-DK DT100112 was discovered to contain an issue which allows attackers to cause a Denial of Service (DoS) via a crafted ConReq packet. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://blediff.github.io/
CVE ID: CVE-2022-40482 State: PUBLISHED Published: 2023-04-25T00:00:00.000Z Last Updated: 2025-02-03T20:49:55.862Z Vendors: n/a Products: n/a Problem Types: n/a Description: The authentication method in Laravel 8.x through 9.x before 9.32.0 was discovered to be vulnerable to user enumeration via timeless timing attacks with HTTP/2 multiplexing. This is caused by the early return inside the hasValidCredentials method in the Illuminate\Auth\SessionGuard class when a user is found to not exist. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://ephort.dk/blog/laravel-timing-attack-vulnerability/ - https://github.com/ephort/laravel-user-enumeration-
ces: - https://ephort.dk/blog/laravel-timing-attack-vulnerability/ - https://github.com/ephort/laravel-user-enumeration-demo - https://github.com/laravel/framework/pull/44069 - https://github.com/laravel/framework/releases/tag/v9.32.0
CVE ID: CVE-2022-40483 State: PUBLISHED Published: 2022-09-26T13:14:26.000Z Last Updated: 2025-05-21T18:42:37.599Z Vendors: n/a Products: n/a Problem Types: n/a Description: Wedding Planner v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /wedding_details.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Geoduck-CNN/Bug_report/blob/main/vendors/pushpam02/wedding-planner/SQLi-1.md
CVE ID: CVE-2022-40484 State: PUBLISHED Published: 2022-09-26T13:14:27.000Z Last Updated: 2025-05-21T18:40:11.118Z Vendors: n/a Products: n/a Problem Types: n/a Description: Wedding Planner v1.0 was discovered to contain a SQL injection vulnerability via the booking parameter at /admin/client_edit.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Geoduck-CNN/Bug_report/blob/main/vendors/pushpam02/wedding-planner/SQLi-2.md
CVE ID: CVE-2022-40485 State: PUBLISHED Published: 2022-09-26T13:14:28.000Z Last Updated: 2025-05-21T18:38:32.557Z Vendors: n/a Products: n/a Problem Types: n/a Description: Wedding Planner v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /package_detail.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Geoduck-CNN/Bug_report/blob/main/vendors/pushpam02/wedding-planner/SQLi-3.md
CVE ID: CVE-2022-40486 State: PUBLISHED Published: 2022-09-28T12:59:46.000Z Last Updated: 2025-05-21T14:49:09.938Z Vendors: n/a Products: n/a Problem Types: n/a Description: TP Link Archer AX10 V1 Firmware Version 1.3.1 Build 20220401 Rel. 57450(5553) was discovered to allow authenticated attackers to execute arbitrary code via a crafted backup file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/gscamelo/TP-Link-Archer-AX10-V1/blob/main/README.md - https://www.tp-link.com/br/home-networking/wifi-router/archer-ax10/ - https://www.tp-link.com/br/support/download/archer-ax10/v1/
CVE ID: CVE-2022-40487 State: PUBLISHED Published: 2022-10-31T00:00:00.000Z Last Updated: 2025-05-06T16:22:34.325Z Vendors: n/a Products: n/a Problem Types: n/a Description: ProcessWire v3.0.200 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities via the Search Users and Search Pages function. These vulnerabilities allow attackers to execute arbitrary web scripts or HTML via injection of a crafted payload. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://processwire.com - https://gist.github.com/filipaze/32ab8683af8d82827028164e361b6e86
CVE ID: CVE-2022-40488 State: PUBLISHED Published: 2022-10-31T00:00:00.000Z Last Updated: 2025-05-06T18:24:05.062Z Vendors: n/a Products: n/a Problem Types: n/a Description: ProcessWire v3.0.200 was discovered to contain a Cross-Site Request Forgery (CSRF). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://processwire.com - https://gist.github.com/filipaze/76138289ded98aa45dfcd939a8afd331
CVE ID: CVE-2022-40489 State: PUBLISHED Published: 2022-12-01T00:00:00.000Z Last Updated: 2025-04-24T20:24:55.671Z Vendors: n/a Products: n/a Problem Types: n/a Description: ThinkCMF version 6.0.7 is affected by a Cross Site Request Forgery (CSRF) vulnerability that allows a Super Administrator user to be injected into administrative users. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/thinkcmf/thinkcmf/issues/736
CVE ID: CVE-2022-40490 State: PUBLISHED Published: 2025-02-06T00:00:00.000Z Last Updated: 2025-08-20T02:25:20.632Z Vendors: n/a Products: n/a Problem Types: CWE-79 Description: Tiny File Manager v2.4.7 and below was discovered to contain a Cross Site Scripting (XSS) vulnerability. This vulnerability allows attackers to execute arbitrary code via a crafted payload injected into the name of an uploaded or already existing file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/prasathmani/tinyfilemanager - https://github.com/whitej3rry/CVE-2022-40490/blob/main/PoC.md
CVE ID: CVE-2022-40494 State: PUBLISHED Published: 2022-10-06T00:00:00 Last Updated: 2024-08-03T12:21:45.557Z Vendors: n/a Products: n/a Problem Types: n/a Description: NPS before v0.26.10 was discovered to contain an authentication bypass vulnerability via constantly generating and sending the Auth key and Timestamp parameters. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/1security/Vulnerability/blob/main/web/nps/1.md - https://blog.carrot2.cn/2022/08/cve-2022-40494.html
CVE ID: CVE-2022-40497 State: PUBLISHED Published: 2022-09-27T23:34:13.000Z Last Updated: 2025-05-21T15:02:09.029Z Vendors: n/a Products: n/a Problem Types: n/a Description: Wazuh v3.6.1 - v3.13.5, v4.0.0 - v4.2.7, and v4.3.0 - v4.3.7 were discovered to contain an authenticated remote code execution (RCE) vulnerability via the Active Response endpoint. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/wazuh/wazuh/pull/14801
CVE ID: CVE-2022-40502 State: PUBLISHED Published: 2023-02-09T06:58:49.985Z Last Updated: 2024-08-03T12:21:45.979Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Qualcomm, Inc. Products: Snapdragon Problem Types: CWE-20 Description: Transient DOS due to improper input validation in WLAN Host. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.qualcomm.com/company/product-security/bulletins/february-2023-bulletin
CVE ID: CVE-2022-40503 State: PUBLISHED Published: 2023-04-04T04:46:53.479Z Last Updated: 2024-08-03T12:21:45.922Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L) Vendors: Qualcomm, Inc. Products: Snapdragon Problem Types: CWE-126 Description: Information disclosure due to buffer over-read in Bluetooth Host while A2DP streaming. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.qualcomm.com/company/product-security/bulletins/april-2023-bulletin
CVE ID: CVE-2022-40504 State: PUBLISHED Published: 2023-05-02T07:30:18.673Z Last Updated: 2024-08-03T12:21:45.563Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Qualcomm, Inc. Products: Snapdragon Problem Types: CWE-617 Description: Transient DOS due to reachable assertion in Modem when UE received Downlink Data Indication message from the network. Additional Analyst Notes: - CVE Program Container: References: - https://www.qualcomm.com/company/product-security/bulletins/may-2023-bulletin
CVE ID: CVE-2022-40505 State: PUBLISHED Published: 2023-05-02T05:08:52.616Z Last Updated: 2024-08-03T12:21:45.669Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L) Vendors: Qualcomm, Inc. Products: Snapdragon Problem Types: CWE-126 Description: Information disclosure due to buffer over-read in Modem while parsing DNS hostname. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.qualcomm.com/company/product-security/bulletins/may-2023-bulletin