Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-40303 State: PUBLISHED Published: 2022-11-22T00:00:00.000Z Last Updated: 2025-04-29T04:24:02.694Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with the XML_PARSE_HUGE parser option enabled, several integer counters can overflow. This results in an attempt to access an array at a negative 2GB offset, typically leading to a segmentation fault. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.gnome.org/GNOME/libxml2/-/tags/v2.10.3 - https://gitlab.gnome.org/GNOME/libxml2/-/commit/c846986356fc149915a74972bf198abc266bc2
rg/GNOME/libxml2/-/tags/v2.10.3 - https://gitlab.gnome.org/GNOME/libxml2/-/commit/c846986356fc149915a74972bf198abc266bc2c0 - https://security.netapp.com/advisory/ntap-20221209-0003/ - https://support.apple.com/kb/HT213534 - https://support.apple.com/kb/HT213533 - https://support.apple.com/kb/HT213531 - https://support.apple.com/kb/HT213536 - https://support.apple.com/kb/HT213535 - http://seclists.org/fulldisclosure/2022/Dec/21 - http://seclists.org/fulldisclosure/2022/Dec/25 - http://seclists.org/fulldisclosure/2022/Dec/26 - http://seclists.org/fulldisclosure/2022/Dec/24 - http://seclists.org/fulldisclosure/2022/Dec/27
CVE ID: CVE-2022-40304 State: PUBLISHED Published: 2022-11-23T00:00:00.000Z Last Updated: 2025-04-28T19:49:17.691Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in libxml2 before 2.10.3. Certain invalid XML entity definitions can corrupt a hash table key, potentially leading to subsequent logic errors. In one case, a double-free can be provoked. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.gnome.org/GNOME/libxml2/-/tags - https://gitlab.gnome.org/GNOME/libxml2/-/tags/v2.10.3 - https://gitlab.gnome.org/GNOME/libxml2/-/commit/1b41ec4e9433b05bb0376be4725804c54ef1d80b - https://security.netapp.com/ad
ttps://gitlab.gnome.org/GNOME/libxml2/-/commit/1b41ec4e9433b05bb0376be4725804c54ef1d80b - https://security.netapp.com/advisory/ntap-20221209-0003/ - https://support.apple.com/kb/HT213534 - https://support.apple.com/kb/HT213533 - https://support.apple.com/kb/HT213531 - https://support.apple.com/kb/HT213536 - https://support.apple.com/kb/HT213535 - http://seclists.org/fulldisclosure/2022/Dec/21 - http://seclists.org/fulldisclosure/2022/Dec/25 - http://seclists.org/fulldisclosure/2022/Dec/26 - http://seclists.org/fulldisclosure/2022/Dec/24 - http://seclists.org/fulldisclosure/2022/Dec/27
CVE ID: CVE-2022-40305 State: PUBLISHED Published: 2022-09-09T04:23:04 Last Updated: 2024-08-03T12:14:40.081Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Server-Side Request Forgery issue in Canto Cumulus through 11.1.3 allows attackers to enumerate the internal network, overload network resources, and possibly have unspecified other impact via the server parameter to the /cwc/login login form. Additional Analyst Notes: - CVE Program Container: References: - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2022-023.txt
CVE ID: CVE-2022-40306 State: PUBLISHED Published: 2022-09-15T14:03:43 Last Updated: 2024-10-16T17:08:43.183819 Vendors: n/a Products: n/a Problem Types: n/a Description: The login form /Login in ECi Printanista Hub (formerly FMAudit Printscout) before 5.5.2 (July 2023) performs expensive RSA key-generation operations, which allows attackers to cause a denial of service (DoS) by requesting that form repeatedly. Additional Analyst Notes: - CVE Program Container: References: - https://www.ecisolutions.com/products/printanista-hub/ - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2022-042.txt - https://releasenotes.printanista.net/PrintanistaHub
CVE ID: CVE-2022-40307 State: PUBLISHED Published: 2022-09-09T00:00:00 Last Updated: 2024-08-03T12:14:40.052Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Linux kernel through 5.19.8. drivers/firmware/efi/capsule-loader.c has a race condition with a resultant use-after-free. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/torvalds/linux/commit/9cb636b5f6a8cc6d1b50809ec8f8d33ae0c84c95 - https://lists.debian.org/debian-lts-announce/2022/10/msg00000.html - https://www.debian.org/security/2022/dsa-5257 - https://lists.debian.org/debian-lts-announce/2022/11/msg00001.html
CVE ID: CVE-2022-40308 State: PUBLISHED Published: 2022-11-15T00:00:00.000Z Last Updated: 2025-04-30T16:03:13.651Z Vendors: Apache Software Foundation Products: Apache Archiva Problem Types: Arbitrary file read vulnerability Description: If anonymous read enabled, it's possible to read the database file directly without logging in. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/x01pnn0jjsw512cscxsbxzrjmz64n4cc - http://www.openwall.com/lists/oss-security/2022/11/15/2
CVE ID: CVE-2022-40309 State: PUBLISHED Published: 2022-11-15T00:00:00.000Z Last Updated: 2025-04-30T16:02:30.071Z Vendors: Apache Software Foundation Products: Apache Archiva Problem Types: Arbitrary directory deletion Description: Users with write permissions to a repository can delete arbitrary directories. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/1odl4p85r96n27k577jk6ftrp19xfc27 - http://www.openwall.com/lists/oss-security/2022/11/15/3
CVE ID: CVE-2022-40310 State: PUBLISHED Published: 2022-09-23T14:20:52.161Z Last Updated: 2025-02-20T20:03:45.598Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Blaz K. Products: Rate my Post – WP Rating System (WordPress plugin) Problem Types: Race condition Description: Authenticated (subscriber+) Race Condition vulnerability in Rate my Post – WP Rating System plugin <= 3.3.4 at WordPress allows attackers to increase/decrease votes. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/rate-my-post/#developers - https://patchstack.com/database/vulnerability/rate-my-post/wordpress-rate-my-p
ss.org/plugins/rate-my-post/#developers - https://patchstack.com/database/vulnerability/rate-my-post/wordpress-rate-my-post-wp-rating-system-plugin-3-3-4-race-condition-vulnerability/_s_id=cve
CVE ID: CVE-2022-40311 State: PUBLISHED Published: 2022-10-21T15:32:11.718Z Last Updated: 2025-02-20T19:58:19.199Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: Fatcat Apps Products: Analytics Cat – Google Analytics Made Easy (WordPress plugin) Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) in Fatcat Apps Analytics Cat plugin <= 1.0.9 on WordPress. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/analytics-cat/wordpress-analytics-cat-plugin-1-0-9-authenticated-stored-cross-site-scripting-xss-vulnerability?_s_id=cve - https://wordpress
ess-analytics-cat-plugin-1-0-9-authenticated-stored-cross-site-scripting-xss-vulnerability?_s_id=cve - https://wordpress.org/plugins/analytics-cat/#developers
CVE ID: CVE-2022-40312 State: PUBLISHED Published: 2023-12-18T15:08:55.293Z Last Updated: 2024-08-03T12:14:40.080Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L) Vendors: GiveWP Products: GiveWP – Donation Plugin and Fundraising Platform Problem Types: CWE-918 Description: Server-Side Request Forgery (SSRF) vulnerability in GiveWP GiveWP – Donation Plugin and Fundraising Platform.This issue affects GiveWP – Donation Plugin and Fundraising Platform: from n/a through 2.25.1. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/give/wordpress-givewp-plugin-2-25-1-server-side-request-forgery-ssrf-vulnerability?_s
chstack.com/database/vulnerability/give/wordpress-givewp-plugin-2-25-1-server-side-request-forgery-ssrf-vulnerability?_s_id=cve
CVE ID: CVE-2022-40313 State: PUBLISHED Published: 2022-09-30T16:34:00.000Z Last Updated: 2025-05-20T18:20:46.944Z Vendors: n/a Products: moodle Problem Types: Stored XSS Description: Recursive rendering of Mustache template helpers containing user input could, in some cases, result in an XSS risk or a page failing to load. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2128146 - https://moodle.org/mod/forum/discuss.php?d=438392
CVE ID: CVE-2022-40314 State: PUBLISHED Published: 2022-09-30T16:29:22.000Z Last Updated: 2025-05-20T18:23:40.483Z Vendors: n/a Products: moodle Problem Types: Remote code execution Description: A remote code execution risk when restoring backup files originating from Moodle 1.9 was identified. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2128147 - https://moodle.org/mod/forum/discuss.php?d=438393
CVE ID: CVE-2022-40315 State: PUBLISHED Published: 2022-09-30T16:35:15.000Z Last Updated: 2025-05-20T16:41:34.571Z Vendors: n/a Products: moodle Problem Types: SQL injection Description: A limited SQL injection risk was identified in the "browse list of users" site administration page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://moodle.org/mod/forum/discuss.php?d=438394 - https://bugzilla.redhat.com/show_bug.cgi?id=2128150
CVE ID: CVE-2022-40316 State: PUBLISHED Published: 2022-09-30T16:37:12.000Z Last Updated: 2025-05-20T16:39:07.787Z Vendors: n/a Products: moodle Problem Types: SQL injection Description: The H5P activity attempts report did not filter by groups, which in separate groups mode could reveal information to non-editing teachers about attempts/users in groups they should not have access to. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2128151 - https://moodle.org/mod/forum/discuss.php?d=438395
CVE ID: CVE-2022-40317 State: PUBLISHED Published: 2022-09-09T16:45:31 Last Updated: 2024-08-03T12:14:40.121Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenKM 6.3.11 allows stored XSS related to the javascript&colon; substring in an A element. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/openkm/document-management-system/pull/336 - https://github.com/izdiwho/CVE-2022-40317
CVE ID: CVE-2022-40318 State: PUBLISHED Published: 2023-05-03T00:00:00 Last Updated: 2024-08-03T12:14:40.214Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in bgpd in FRRouting (FRR) through 8.4. By crafting a BGP OPEN message with an option of type 0xff (Extended Length from RFC 9072), attackers may cause a denial of service (assertion failure and daemon restart, or out-of-bounds read). This is possible because of inconsistent boundary checks that do not account for reading 3 bytes (instead of 2) in this 0xff case. NOTE: this behavior occurs in bgp_open_option_parse in the bgp_open.c file, a different location (with a different attack vector) relative to
ccurs in bgp_open_option_parse in the bgp_open.c file, a different location (with a different attack vector) relative to CVE-2022-40302. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/FRRouting/frr/releases - https://www.debian.org/security/2023/dsa-5495 - https://lists.debian.org/debian-lts-announce/2023/09/msg00020.html
CVE ID: CVE-2022-40319 State: PUBLISHED Published: 2023-01-17T00:00:00.000Z Last Updated: 2025-04-04T19:43:01.791Z Vendors: n/a Products: n/a Problem Types: n/a Description: The LISTSERV 17 web interface allows remote attackers to conduct Insecure Direct Object References (IDOR) attacks via a modified email address in a wa.exe URL. The impact is unauthorized modification of a victim's LISTSERV account. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://peach.ease.lsoft.com/scripts/wa-PEACH.exe?A0=LSTSRV-L - https://packetstormsecurity.com/2301-exploits/listserv17-idor.txt
CVE ID: CVE-2022-40320 State: PUBLISHED Published: 2022-09-09T20:38:22 Last Updated: 2024-08-03T12:14:40.077Z Vendors: n/a Products: n/a Problem Types: n/a Description: cfg_tilde_expand in confuse.c in libConfuse 3.3 has a heap-based buffer over-read. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/libconfuse/libconfuse/issues/163 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EDUT2V62V2XF2IT5TJFPB6P3EQ6X5VLL/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BSAZK4KAWRWNAFUBBXOYU3PVNH3X7226/ - https://lists.fedoraproject.org/archives/list/package-announce%
aproject.org/message/BSAZK4KAWRWNAFUBBXOYU3PVNH3X7226/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FJKHAPJ6AUWVP4HDGKH4M5A2XXWQI73O/
CVE ID: CVE-2022-40322 State: PUBLISHED Published: 2022-09-11T20:11:26 Last Updated: 2024-08-03T12:21:45.432Z Vendors: n/a Products: n/a Problem Types: n/a Description: SysAid Help Desk before 22.1.65 allows XSS, aka FR# 66542 and 65579. Additional Analyst Notes: - CVE Program Container: References: - https://documentation.sysaid.com/docs/22165-release-notes
CVE ID: CVE-2022-40323 State: PUBLISHED Published: 2022-09-11T20:11:34 Last Updated: 2024-08-03T12:21:45.590Z Vendors: n/a Products: n/a Problem Types: n/a Description: SysAid Help Desk before 22.1.65 allows XSS in the Password Services module, aka FR# 67241. Additional Analyst Notes: - CVE Program Container: References: - https://documentation.sysaid.com/docs/22165-release-notes
CVE ID: CVE-2022-40324 State: PUBLISHED Published: 2022-09-11T20:11:40 Last Updated: 2024-08-03T12:21:45.769Z Vendors: n/a Products: n/a Problem Types: n/a Description: SysAid Help Desk before 22.1.65 allows XSS via the Linked SRs field, aka FR# 67258. Additional Analyst Notes: - CVE Program Container: References: - https://documentation.sysaid.com/docs/22165-release-notes
CVE ID: CVE-2022-40325 State: PUBLISHED Published: 2022-09-11T20:11:47 Last Updated: 2024-08-03T12:21:45.991Z Vendors: n/a Products: n/a Problem Types: n/a Description: SysAid Help Desk before 22.1.65 allows XSS via the Asset Dashboard, aka FR# 67262. Additional Analyst Notes: - CVE Program Container: References: - https://documentation.sysaid.com/docs/22165-release-notes
CVE ID: CVE-2022-40337 State: PUBLISHED Published: 2022-09-16T15:19:17 Last Updated: 2024-08-03T12:21:45.665Z Vendors: n/a Products: n/a Problem Types: n/a Description: OASES (aka Open Aviation Strategic Engineering System) 8.8.0.2 allows attackers to execute arbitrary code via the Open Print Folder menu. Additional Analyst Notes: - CVE Program Container: References: - https://www.aspiresoftware.com/companies/oases/ - https://oases.aero/ - https://gist.github.com/Delson704557/df06fcee0b2676d611aef799e1c4a0e6
CVE ID: CVE-2022-40341 State: PUBLISHED Published: 2022-09-30T18:46:24.000Z Last Updated: 2025-05-20T15:36:39.164Z Vendors: n/a Products: n/a Problem Types: n/a Description: mojoPortal v2.7 was discovered to contain an arbitrary file upload vulnerability which allows attackers to execute arbitrary code via a crafted PNG file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://mojoportal.com - https://weed-1.gitbook.io/cve/mojoportal/upload-malicious-file-in-mojoportal-v2.7-cve-2022-40341
CVE ID: CVE-2022-40347 State: PUBLISHED Published: 2023-02-17T00:00:00.000Z Last Updated: 2025-03-18T16:08:21.946Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection vulnerability in Intern Record System version 1.0 in /intern/controller.php in 'phone', 'email', 'deptType' and 'name' parameters, allows attackers to execute arbitrary code and gain sensitive information. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://code-projects.org/intern-record-system-in-php-with-source-code/ - https://download-media.code-projects.org/2020/03/Intern_Record_System_In_PHP_With_Source_Code.zip - https://github.com/h4md153v63n/CVE-2022-40
.code-projects.org/2020/03/Intern_Record_System_In_PHP_With_Source_Code.zip - https://github.com/h4md153v63n/CVE-2022-40347_Intern-Record-System-phone-V1.0-SQL-Injection-Vulnerability-Unauthenticated - http://packetstormsecurity.com/files/171740/Intern-Record-System-1.0-SQL-Injection.html
CVE ID: CVE-2022-40348 State: PUBLISHED Published: 2023-02-18T00:00:00.000Z Last Updated: 2025-03-17T18:24:36.899Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability in Intern Record System version 1.0 in /intern/controller.php in 'name' and 'email' parameters, allows attackers to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://code-projects.org/intern-record-system-in-php-with-source-code/ - https://download-media.code-projects.org/2020/03/Intern_Record_System_In_PHP_With_Source_Code.zip - https://github.com/h4md153v63n/CVE-2022-40348_Intern-Record-System-Cross-site-Scr
d_System_In_PHP_With_Source_Code.zip - https://github.com/h4md153v63n/CVE-2022-40348_Intern-Record-System-Cross-site-Scripting-V1.0-Vulnerability-Unauthenticated
CVE ID: CVE-2022-40352 State: PUBLISHED Published: 2022-09-27T13:14:43.000Z Last Updated: 2025-05-22T13:44:18.882Z Vendors: n/a Products: n/a Problem Types: n/a Description: Online Tours & Travels Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/update_traveller.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/songbingxue/Bug_report/blob/main/vendors/mayuri_k/online-tours-travels-management-system/SQLi-1.md
CVE ID: CVE-2022-40353 State: PUBLISHED Published: 2022-09-27T13:14:44.000Z Last Updated: 2025-05-22T13:43:23.777Z Vendors: n/a Products: n/a Problem Types: n/a Description: Online Tours & Travels Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/up_booking.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/songbingxue/Bug_report/blob/main/vendors/mayuri_k/online-tours-travels-management-system/SQLi-2.md
CVE ID: CVE-2022-40354 State: PUBLISHED Published: 2022-09-27T13:14:45.000Z Last Updated: 2025-05-21T15:11:31.978Z Vendors: n/a Products: n/a Problem Types: n/a Description: Online Tours & Travels Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/update_booking.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/songbingxue/Bug_report/blob/main/vendors/mayuri_k/online-tours-travels-management-system/SQLi-3.md
CVE ID: CVE-2022-40357 State: PUBLISHED Published: 2022-09-20T20:01:30.000Z Last Updated: 2025-05-28T15:53:24.646Z Vendors: n/a Products: n/a Problem Types: n/a Description: A security issue was discovered in Z-BlogPHP <= 1.7.2. A Server-Side Request Forgery (SSRF) vulnerability in the zb_users/plugin/UEditor/php/action_crawler.php file allows remote attackers to force the application to make arbitrary requests via injection of arbitrary URLs into the source parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/zblogcn/zblogphp/issues/336
CVE ID: CVE-2022-40358 State: PUBLISHED Published: 2022-09-23T17:21:40.000Z Last Updated: 2025-05-22T18:43:20.725Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in AjaXplorer 4.2.3, allows attackers to cause cross site scripting vulnerabilities via a crafted svg file upload. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://sourceforge.net/projects/ajaxplorer/files/ajaxplorer/stable-channel/4.2.3/ - https://cxsecurity.com/issue/WLB-2022090059
CVE ID: CVE-2022-40359 State: PUBLISHED Published: 2022-09-23T17:25:23.000Z Last Updated: 2025-05-22T14:35:31.815Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross site scripting (XSS) vulnerability in kfm through 1.4.7 via crafted GET request to /kfm/index.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://code.google.com/archive/p/kfm/downloads - https://cxsecurity.com/issue/WLB-2022090057
CVE ID: CVE-2022-40361 State: PUBLISHED Published: 2024-01-11T00:00:00.000Z Last Updated: 2025-06-17T17:23:37.149Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting Vulnerability in Elite CRM v1.2.11 allows attacker to execute arbitrary code via the language parameter to the /ngs/login endpoint. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://elitecrm.co/ - https://hazemhussien99.wordpress.com/2024/01/07/cve-2022-40361-disclosure/
CVE ID: CVE-2022-40363 State: PUBLISHED Published: 2022-09-29T12:16:40.000Z Last Updated: 2025-05-21T14:06:09.769Z Vendors: n/a Products: n/a Problem Types: n/a Description: A buffer overflow in the component nfc_device_load_mifare_ul_data of Flipper Devices Inc., Flipper Zero before v0.65.2 allows attackers to cause a Denial of Service (DoS) via a crafted NFC file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vvx7.io/posts/2022/09/your-amiibos-haunted/ - https://github.com/flipperdevices/flipperzero-firmware/pull/1697
CVE ID: CVE-2022-40365 State: PUBLISHED Published: 2022-09-14T20:06:43 Last Updated: 2024-08-03T12:21:45.515Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross site scripting (XSS) vulnerability in ouqiang gocron through 1.5.3, allows attackers to execute arbitrary code via scope.row.hostname in web/vue/src/pages/taskLog/list.vue. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ouqiang/gocron - https://github.com/ouqiang/gocron/issues/362
CVE ID: CVE-2022-40373 State: PUBLISHED Published: 2022-12-15T00:00:00.000Z Last Updated: 2025-04-21T14:41:15.356Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability in FeehiCMS 2.1.1 allows remote attackers to run arbitrary code via upload of crafted XML file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/liufee/cms/issues/67
CVE ID: CVE-2022-40402 State: PUBLISHED Published: 2022-09-26T13:00:04.000Z Last Updated: 2025-05-21T18:45:31.143Z Vendors: n/a Products: n/a Problem Types: n/a Description: Wedding Planner v1.0 was discovered to contain a SQL injection vulnerability via the booking parameter at /admin/client_assign.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/wshark00/Bug_report/blob/main/vendors/pushpam02/wedding-planner/SQLi-1.md
CVE ID: CVE-2022-40403 State: PUBLISHED Published: 2022-09-26T13:00:05.000Z Last Updated: 2025-05-21T18:44:29.264Z Vendors: n/a Products: n/a Problem Types: n/a Description: Wedding Planner v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/feature_edit.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/wshark00/Bug_report/blob/main/vendors/pushpam02/wedding-planner/SQLi-3.md
CVE ID: CVE-2022-40404 State: PUBLISHED Published: 2022-09-26T13:00:06.000Z Last Updated: 2025-05-21T18:43:35.694Z Vendors: n/a Products: n/a Problem Types: n/a Description: Wedding Planner v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/select.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/wshark00/Bug_report/blob/main/vendors/pushpam02/wedding-planner/SQLi-2.md