Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-45409 State: PUBLISHED Published: 2022-12-22T00:00:00.000Z Last Updated: 2025-04-15T14:39:28.678Z Vendors: Mozilla Products: Firefox ESR, Thunderbird, Firefox Problem Types: Use-after-free in Garbage Collection Description: The garbage collector could have been aborted in several states and zones and <code>GCRuntime::finishCollection</code> may not have been called, leading to a use-after-free and potentially exploitable crash. This vulnerability affects Firefox ESR < 102.5, Thunderbird < 102.5, and Firefox < 107. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2022-47/ - https://www.mo
tainer: - CISA ADP Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2022-47/ - https://www.mozilla.org/security/advisories/mfsa2022-49/ - https://www.mozilla.org/security/advisories/mfsa2022-48/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1796901
CVE ID: CVE-2022-45410 State: PUBLISHED Published: 2022-12-22T00:00:00.000Z Last Updated: 2025-04-15T14:37:47.758Z Vendors: Mozilla Products: Firefox ESR, Thunderbird, Firefox Problem Types: ServiceWorker-intercepted requests bypassed SameSite cookie policy Description: When a ServiceWorker intercepted a request with <code>FetchEvent</code>, the origin of the request was lost after the ServiceWorker took ownership of it. This had the effect of negating SameSite cookie protections. This was addressed in the spec and then in browsers. This vulnerability affects Firefox ESR < 102.5, Thunderbird < 102.5, and Firefox < 107. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichmen
102.5, Thunderbird < 102.5, and Firefox < 107. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2022-47/ - https://www.mozilla.org/security/advisories/mfsa2022-49/ - https://www.mozilla.org/security/advisories/mfsa2022-48/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1658869
CVE ID: CVE-2022-45411 State: PUBLISHED Published: 2022-12-22T00:00:00.000Z Last Updated: 2025-04-15T15:08:19.288Z Vendors: Mozilla Products: Firefox ESR, Thunderbird, Firefox Problem Types: Cross-Site Tracing was possible via non-standard override headers Description: Cross-Site Tracing occurs when a server will echo a request back via the Trace method, allowing an XSS attack to access to authorization headers and cookies inaccessible to JavaScript (such as cookies protected by HTTPOnly). To mitigate this attack, browsers placed limits on <code>fetch()</code> and XMLHttpRequest; however some webservers have implemented non-standard headers such as <code>X-Http-Method-Override</code> that ov
quest; however some webservers have implemented non-standard headers such as <code>X-Http-Method-Override</code> that override the HTTP method, and made this attack possible again. Thunderbird has applied the same mitigations to the use of this and similar headers. This vulnerability affects Firefox ESR < 102.5, Thunderbird < 102.5, and Firefox < 107. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2022-47/ - https://www.mozilla.org/security/advisories/mfsa2022-49/ - https://www.mozilla.org/security/advisories/mfsa2022-48/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1790311
CVE ID: CVE-2022-45412 State: PUBLISHED Published: 2022-12-22T00:00:00.000Z Last Updated: 2025-04-15T15:05:32.152Z Vendors: Mozilla Products: Firefox ESR, Thunderbird, Firefox Problem Types: Symlinks may resolve to partially uninitialized buffers Description: When resolving a symlink such as <code>file:///proc/self/fd/1</code>, an error message may be produced where the symlink was resolved to a string containing unitialized memory in the buffer. <br>*This bug only affects Thunderbird on Unix-based operated systems (Android, Linux, MacOS). Windows is unaffected.*. This vulnerability affects Firefox ESR < 102.5, Thunderbird < 102.5, and Firefox < 107. Additional Analyst Notes: - CVE Program C
erability affects Firefox ESR < 102.5, Thunderbird < 102.5, and Firefox < 107. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2022-47/ - https://www.mozilla.org/security/advisories/mfsa2022-49/ - https://www.mozilla.org/security/advisories/mfsa2022-48/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1791029
CVE ID: CVE-2022-45413 State: PUBLISHED Published: 2022-12-22T00:00:00.000Z Last Updated: 2025-04-15T15:01:46.739Z Vendors: Mozilla Products: Firefox Problem Types: SameSite=Strict cookies could have been sent cross-site via intent URLs Description: Using the <code>S.browser_fallback_url parameter</code> parameter, an attacker could redirect a user to a URL and cause SameSite=Strict cookies to be sent.<br>*This issue only affects Firefox for Android. Other operating systems are not affected.*. This vulnerability affects Firefox < 107. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2022-47/ - https://bu
Container: - CISA ADP Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2022-47/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1791201
CVE ID: CVE-2022-45414 State: PUBLISHED Published: 2022-12-22T00:00:00.000Z Last Updated: 2025-04-15T14:56:05.405Z Vendors: Mozilla Products: Thunderbird Problem Types: Quoting from an HTML email with certain tags will trigger network requests and load remote content, regardless of a configuration to block remote content Description: If a Thunderbird user quoted from an HTML email, for example by replying to the email, and the email contained either a VIDEO tag with the POSTER attribute or an OBJECT tag with a DATA attribute, a network request to the referenced remote URL was performed, regardless of a configuration to block remote content. An image loaded from the POSTER attribute was shown
as performed, regardless of a configuration to block remote content. An image loaded from the POSTER attribute was shown in the composer window. These issues could have given an attacker additional capabilities when targetting releases that did not yet have a fix for CVE-2022-3033 which was reported around three months ago. This vulnerability affects Thunderbird < 102.5.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2022-50/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1788096
CVE ID: CVE-2022-45415 State: PUBLISHED Published: 2022-12-22T00:00:00.000Z Last Updated: 2025-04-15T14:54:04.486Z Vendors: Mozilla Products: Firefox Problem Types: Downloaded file may have been saved with malicious extension Description: When downloading an HTML file, if the title of the page was formatted as a filename with a malicious extension, Firefox may have saved the file with that extension, leading to possible system compromise if the downloaded file was later ran. This vulnerability affects Firefox < 107. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2022-47/ - https://bugzilla.mozilla.org/
ADP Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2022-47/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1793551
CVE ID: CVE-2022-45416 State: PUBLISHED Published: 2022-12-22T00:00:00.000Z Last Updated: 2025-04-15T14:51:49.870Z Vendors: Mozilla Products: Firefox ESR, Thunderbird, Firefox Problem Types: Keystroke Side-Channel Leakage Description: Keyboard events reference strings like "KeyA" that were at fixed, known, and widely-spread addresses. Cache-based timing attacks such as Prime+Probe could have possibly figured out which keys were being pressed. This vulnerability affects Firefox ESR < 102.5, Thunderbird < 102.5, and Firefox < 107. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2022-47/ - https://www.mozi
iner: - CISA ADP Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2022-47/ - https://www.mozilla.org/security/advisories/mfsa2022-49/ - https://www.mozilla.org/security/advisories/mfsa2022-48/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1793676
CVE ID: CVE-2022-45417 State: PUBLISHED Published: 2022-12-22T00:00:00.000Z Last Updated: 2025-04-15T14:48:45.545Z Vendors: Mozilla Products: Firefox Problem Types: Service Workers in Private Browsing Mode may have been written to disk Description: Service Workers did not detect Private Browsing Mode correctly in all cases, which could have led to Service Workers being written to disk for websites visited in Private Browsing Mode. This would not have persisted them in a state where they would run again, but it would have leaked Private Browsing Mode details to disk. This vulnerability affects Firefox < 107. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Reference
lnerability affects Firefox < 107. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2022-47/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1794508
CVE ID: CVE-2022-45418 State: PUBLISHED Published: 2022-12-22T00:00:00.000Z Last Updated: 2025-04-15T14:46:57.753Z Vendors: Mozilla Products: Firefox ESR, Thunderbird, Firefox Problem Types: Custom mouse cursor could have been drawn over browser UI Description: If a custom mouse cursor is specified in CSS, under certain circumstances the cursor could have been drawn over the browser UI, resulting in potential user confusion or spoofing attacks. This vulnerability affects Firefox ESR < 102.5, Thunderbird < 102.5, and Firefox < 107. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2022-47/ - https://www.mo
tainer: - CISA ADP Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2022-47/ - https://www.mozilla.org/security/advisories/mfsa2022-49/ - https://www.mozilla.org/security/advisories/mfsa2022-48/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1795815
CVE ID: CVE-2022-45419 State: PUBLISHED Published: 2022-12-22T00:00:00.000Z Last Updated: 2025-04-15T14:21:36.669Z Vendors: Mozilla Products: Firefox Problem Types: Deleting a security exception did not take effect immediately Description: If the user added a security exception for an invalid TLS certificate, opened an ongoing TLS connection with a server that used that certificate, and then deleted the exception, Firefox would have kept the connection alive, making it seem like the certificate was still trusted. This vulnerability affects Firefox < 107. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2
Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2022-47/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1716082
CVE ID: CVE-2022-45420 State: PUBLISHED Published: 2022-12-22T00:00:00.000Z Last Updated: 2025-04-15T14:17:39.583Z Vendors: Mozilla Products: Firefox ESR, Thunderbird, Firefox Problem Types: Iframe contents could be rendered outside the iframe Description: Use tables inside of an iframe, an attacker could have caused iframe contents to be rendered outside the boundaries of the iframe, resulting in potential user confusion or spoofing attacks. This vulnerability affects Firefox ESR < 102.5, Thunderbird < 102.5, and Firefox < 107. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2022-47/ - https://www.mozi
iner: - CISA ADP Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2022-47/ - https://www.mozilla.org/security/advisories/mfsa2022-49/ - https://www.mozilla.org/security/advisories/mfsa2022-48/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1792643
CVE ID: CVE-2022-45421 State: PUBLISHED Published: 2022-12-22T00:00:00.000Z Last Updated: 2025-04-15T14:15:19.416Z Vendors: Mozilla Products: Firefox ESR, Thunderbird, Firefox Problem Types: Memory safety bugs fixed in Thunderbird 102.5 Description: Mozilla developers Andrew McCreight and Gabriele Svelto reported memory safety bugs present in Thunderbird 102.4. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 102.5, Thunderbird < 102.5, and Firefox < 107. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: -
d < 102.5, and Firefox < 107. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2022-47/ - https://www.mozilla.org/security/advisories/mfsa2022-49/ - https://www.mozilla.org/security/advisories/mfsa2022-48/ - https://bugzilla.mozilla.org/buglist.cgi?bug_id=1767920%2C1789808%2C1794061
CVE ID: CVE-2022-45422 State: PUBLISHED Published: 2022-11-21T00:00:00.000Z Last Updated: 2025-04-28T14:42:12.211Z Vendors: n/a Products: LG PC Problem Types: CWE-427 Description: When LG SmartShare is installed, local privilege escalation is possible through DLL Hijacking attack. The LG ID is LVE-HOT-220005. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lgsecurity.lge.com/bulletins/pc
CVE ID: CVE-2022-45423 State: PUBLISHED Published: 2022-12-27T00:00:00.000Z Last Updated: 2025-04-14T13:00:23.939Z Vendors: n/a Products: DSS Professional, DSS Express, DHI-DSS7016D-S2/DHI-DSS7016DR-S2, DHI-DSS4004-S2 Problem Types: Missing Authorization Description: Some Dahua software products have a vulnerability of unauthenticated request of MQTT credentials. An attacker can obtain encrypted MQTT credentials by sending a specific crafted packet to the vulnerable interface (the credentials cannot be directly exploited). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.dahuasecurity.com/support/cybersecurity/details/1137
CVE ID: CVE-2022-45424 State: PUBLISHED Published: 2022-12-27T00:00:00.000Z Last Updated: 2025-04-14T13:23:36.216Z Vendors: n/a Products: DSS Professional, DSS Express, DHI-DSS7016D-S2/DHI-DSS7016DR-S2, DHI-DSS4004-S2 Problem Types: Missing Authorization Description: Some Dahua software products have a vulnerability of unauthenticated request of AES crypto key. An attacker can obtain the AES crypto key by sending a specific crafted packet to the vulnerable interface. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.dahuasecurity.com/support/cybersecurity/details/1137
CVE ID: CVE-2022-45425 State: PUBLISHED Published: 2022-12-27T00:00:00.000Z Last Updated: 2025-04-14T13:22:30.367Z Vendors: n/a Products: DSS Professional, DSS Express, DHI-DSS7016D-S2/DHI-DSS7016DR-S2, DHI-DSS4004-S2 Problem Types: Use of Hard-coded Cryptographic Key Description: Some Dahua software products have a vulnerability of using of hard-coded cryptographic key. An attacker can obtain the AES crypto key by exploiting this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.dahuasecurity.com/support/cybersecurity/details/1137
CVE ID: CVE-2022-45426 State: PUBLISHED Published: 2022-12-27T00:00:00.000Z Last Updated: 2025-04-14T13:19:12.304Z Vendors: n/a Products: DSS Professional, DSS Express, DHI-DSS7016D-S2/DHI-DSS7016DR-S2, DHI-DSS4004-S2 Problem Types: External Control of File Name or Path Description: Some Dahua software products have a vulnerability of unrestricted download of file. After obtaining the permissions of ordinary users, by sending a specific crafted packet to the vulnerable interface, an attacker can download arbitrary files. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.dahuasecurity.com/support/cybersecurity/details/1137
CVE ID: CVE-2022-45427 State: PUBLISHED Published: 2022-12-27T00:00:00.000Z Last Updated: 2025-04-14T13:18:05.574Z Vendors: n/a Products: DSS Professional, DSS Express, DHI-DSS7016D-S2/DHI-DSS7016DR-S2, DHI-DSS4004-S2 Problem Types: Unrestricted Upload of File with Dangerous Type Description: Some Dahua software products have a vulnerability of unrestricted upload of file. After obtaining the permissions of administrators, by sending a specific crafted packet to the vulnerable interface, an attacker can upload arbitrary files. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.dahuasecurity.com/support/cybersecurity/details/1137
CVE ID: CVE-2022-45428 State: PUBLISHED Published: 2022-12-27T00:00:00.000Z Last Updated: 2025-04-14T13:16:52.157Z Vendors: n/a Products: DSS Professional, DSS Express, DHI-DSS7016D-S2/DHI-DSS7016DR-S2, DHI-DSS4004-S2 Problem Types: Exposure of Sensitive Information to an Unauthorized Actor Description: Some Dahua software products have a vulnerability of sensitive information leakage. After obtaining the permissions of administrators, by sending a specific crafted packet to the vulnerable interface, an attacker can obtain the debugging information. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.dahuasecurity.com/support/cybersecurity/de
: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.dahuasecurity.com/support/cybersecurity/details/1137
CVE ID: CVE-2022-45429 State: PUBLISHED Published: 2022-12-27T00:00:00.000Z Last Updated: 2025-04-11T23:11:09.562Z Vendors: n/a Products: DSS Professional, DSS Express, DHI-DSS7016D-S2/DHI-DSS7016DR-S2, DHI-DSS4004-S2 Problem Types: Server-Side Request Forgery (SSRF) Description: Some Dahua software products have a vulnerability of server-side request forgery (SSRF). An Attacker can access internal resources by concatenating links (URL) that conform to specific rules. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.dahuasecurity.com/support/cybersecurity/details/1137
CVE ID: CVE-2022-45430 State: PUBLISHED Published: 2022-12-27T00:00:00.000Z Last Updated: 2025-04-11T23:08:54.667Z Vendors: n/a Products: DSS Professional, DSS Express, DHI-DSS7016D-S2/DHI-DSS7016DR-S2, DHI-DSS4004-S2 Problem Types: Improper Access Control Description: Some Dahua software products have a vulnerability of unauthenticated enable or disable SSHD service. After bypassing the firewall access control policy, by sending a specific crafted packet to the vulnerable interface, an attacker could enable or disable the SSHD service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.dahuasecurity.com/support/cybersecurity/details/1137
CVE ID: CVE-2022-45431 State: PUBLISHED Published: 2022-12-27T00:00:00.000Z Last Updated: 2025-04-11T23:07:11.025Z Vendors: n/a Products: DSS Professional, DSS Express, DHI-DSS7016D-S2/DHI-DSS7016DR-S2, DHI-DSS4004-S2 Problem Types: Improper Access Control Description: Some Dahua software products have a vulnerability of unauthenticated restart of remote DSS Server. After bypassing the firewall access control policy, by sending a specific crafted packet to the vulnerable interface, an attacker could unauthenticated restart of remote DSS Server. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.dahuasecurity.com/support/cybersecurity/details
VE Program Container: - CISA ADP Vulnrichment: References: - https://www.dahuasecurity.com/support/cybersecurity/details/1137
CVE ID: CVE-2022-45432 State: PUBLISHED Published: 2022-12-27T00:00:00.000Z Last Updated: 2025-04-14T13:08:12.283Z Vendors: n/a Products: DSS Professional、DSS Express、DHI-DSS7016D-S2/DHI-DSS7016DR-S2、DHI-DSS4004-S2 Problem Types: Improper Access Control Description: Some Dahua software products have a vulnerability of unauthenticated search for devices. After bypassing the firewall access control policy, by sending a specific crafted packet to the vulnerable interface, an attacker could unauthenticated search for devices in range of IPs from remote DSS Server. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.dahuasecurity.com/support/cyber
alyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.dahuasecurity.com/support/cybersecurity/details/1137
CVE ID: CVE-2022-45433 State: PUBLISHED Published: 2022-12-27T00:00:00.000Z Last Updated: 2025-04-14T13:05:43.020Z Vendors: n/a Products: DSS Professional, DSS Express, DHI-DSS7016D-S2/DHI-DSS7016DR-S2, DHI-DSS4004-S2 Problem Types: Improper Access Control Description: Some Dahua software products have a vulnerability of unauthenticated traceroute host from remote DSS Server. After bypassing the firewall access control policy, by sending a specific crafted packet to the vulnerable interface, an attacker could get the traceroute results. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.dahuasecurity.com/support/cybersecurity/details/1137
CVE ID: CVE-2022-45434 State: PUBLISHED Published: 2022-12-27T00:00:00.000Z Last Updated: 2025-04-14T12:59:11.203Z Vendors: n/a Products: DSS Professional, DSS Express, DHI-DSS7016D-S2/DHI-DSS7016DR-S2, DHI-DSS4004-S2 Problem Types: Allocation of Resources Without Limits or Throttling Description: Some Dahua software products have a vulnerability of unauthenticated un-throttled ICMP requests on remote DSS Server. After bypassing the firewall access control policy, by sending a specific crafted packet to the vulnerable interface, an attacker could exploit the victim server to launch ICMP request attack to the designated target host. Additional Analyst Notes: - CVE Program Container: - CISA AD
o launch ICMP request attack to the designated target host. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.dahuasecurity.com/support/cybersecurity/details/1137
CVE ID: CVE-2022-45435 State: PUBLISHED Published: 2023-01-31T00:00:00.000Z Last Updated: 2025-03-27T18:28:39.509Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: SailPoint Products: IdentityIQ Problem Types: CWE-863 Description: IdentityIQ 8.3 and all 8.3 patch levels prior to 8.3p2, IdentityIQ 8.2 and all 8.2 patch levels prior to 8.2p5, IdentityIQ 8.1 and all 8.1 patch levels prior to 8.1p7, IdentityIQ 8.0 and all 8.0 patch levels prior to 8.0p6, and all prior versions allow authenticated users assigned the Identity Administrator capability or any custom capability that contains the SetIdentityForwarding right to modify the work item forwarding configurat
ity or any custom capability that contains the SetIdentityForwarding right to modify the work item forwarding configuration for identities other than the ones that should be allowed by Lifecycle Manager Quicklink Population configuration. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.sailpoint.com/security-advisories/sailpoint-identityiq-identity-forwarding-vulnerability-cve-2022-45435/
CVE ID: CVE-2022-45436 State: PUBLISHED Published: 2023-02-15T00:00:00.000Z Last Updated: 2025-03-18T19:21:22.938Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N) Vendors: Artica PFMS Products: Pandora FMS Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Artica PFMS Pandora FMS v765 on all platforms, allows Cross-Site Scripting (XSS). As a manager privilege user , create a network map containing name as xss payload. Once created, admin user must click on the edit network maps and XSS payload will be executed, which could be used for stealing admin users cookie value. Additional An