Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-38085 State: PUBLISHED Published: 2022-09-23T14:35:42.873Z Last Updated: 2025-02-20T20:02:44.053Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: Adam Skaat Products: Read more By Adam (WordPress plugin) Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Read more By Adam plugin <= 1.1.8 at WordPress. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/read-more/wordpress-read-more-by-adam-plugin-1-1-8-cross-site-request-forgery-csrf-vulnerability/_s_id=cve - https://wordpress.org/plugins/read-more/
CVE ID: CVE-2022-38086 State: PUBLISHED Published: 2022-10-11T19:35:28.650Z Last Updated: 2025-02-20T19:58:51.900Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: Vladimir Anokhin Products: Shortcodes Ultimate (WordPress plugin) Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Shortcodes Ultimate plugin <= 5.12.0 at WordPress leading to plugin preset settings change. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/shortcodes-ultimate/wordpress-shortcodes-ultimate-plugin-5-12-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve -
ortcodes-ultimate/wordpress-shortcodes-ultimate-plugin-5-12-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve - https://wordpress.org/plugins/shortcodes-ultimate/#developers
CVE ID: CVE-2022-38087 State: PUBLISHED Published: 2023-05-10T13:17:15.583Z Last Updated: 2025-02-13T16:32:57.990Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: n/a Products: Intel(R) Processors Problem Types: information disclosure, CWE-668 Description: Exposure of resource to wrong sphere in BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable information disclosure via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00807.html - https://security.netapp.com/advisory/ntap-20231124-0006/
CVE ID: CVE-2022-38088 State: PUBLISHED Published: 2023-01-26T21:24:49.199Z Last Updated: 2024-08-03T10:45:52.470Z Severity: MEDIUM (CVSS 4.9 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: Siretta Products: QUARTZ-GOLD Problem Types: CWE-22 Description: A directory traversal vulnerability exists in the httpd downfile.cgi functionality of Siretta QUARTZ-GOLD G5.0.1.5-210720-141020. A specially-crafted HTTP request can lead to arbitrary file read. An attacker can send an HTTP request to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2022-1609
CVE ID: CVE-2022-38089 State: PUBLISHED Published: 2022-08-24T08:41:29 Last Updated: 2024-08-03T10:45:52.456Z Vendors: Kajitori Co.,Ltd Products: Exment Problem Types: Cross-site scripting Description: Stored cross-site scripting vulnerability in Exment ((PHP8) exceedone/exment v5.0.2 and earlier and exceedone/laravel-admin v3.0.0 and earlier, (PHP7) exceedone/exment v4.4.2 and earlier and exceedone/laravel-admin v2.2.2 and earlier) allows a remote authenticated attacker to inject an arbitrary script. Additional Analyst Notes: - CVE Program Container: References: - https://exment.net/docs/#/weakness/20220817 - https://exment.net/docs/#/release_note?id=v503-20220817 - https://jvn.jp/en/jp/JVN
exment.net/docs/#/weakness/20220817 - https://exment.net/docs/#/release_note?id=v503-20220817 - https://jvn.jp/en/jp/JVN46239102/index.html
CVE ID: CVE-2022-38090 State: PUBLISHED Published: 2023-02-16T20:00:29.274Z Last Updated: 2025-01-28T15:19:13.236Z Severity: MEDIUM (CVSS 6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N) Vendors: n/a Products: Intel(R) Processors with Intel(R) Software Guard Extensions (SGX) Problem Types: information disclosure Description: Improper isolation of shared resources in some Intel(R) Processors when using Intel(R) Software Guard Extensions may allow a privileged user to potentially enable information disclosure via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00767.h
- CISA ADP Vulnrichment: References: - http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00767.html
CVE ID: CVE-2022-38092 State: REJECTED Published: N/A Last Updated: 2025-05-28T17:22:16.850Z Description: No description available.
CVE ID: CVE-2022-38093 State: PUBLISHED Published: 2022-09-09T14:39:53.769Z Last Updated: 2025-02-20T20:07:34.855Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: All in One SEO Team Products: All in One SEO (WordPress plugin) Problem Types: CWE-352 Description: Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in All in One SEO plugin <= 4.2.3.1 at WordPress. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/all-in-one-seo-pack/wordpress-all-in-one-seo-plugin-4-2-3-1-multiple-cross-site-request-forgery-csrf-vulnerabilities?_s_id=cve
CVE ID: CVE-2022-38094 State: PUBLISHED Published: 2022-09-08T07:10:45 Last Updated: 2024-08-03T10:45:52.657Z Vendors: Allied Telesis K.K. Products: CentreCOM AR260S V2 Problem Types: OS Command Injection Description: OS command injection vulnerability in the telnet function of CentreCOM AR260S V2 firmware versions prior to Ver.3.3.7 allows a remote authenticated attacker to execute an arbitrary OS command. Additional Analyst Notes: - CVE Program Container: References: - https://www.allied-telesis.co.jp/support/list/faq/vuls/20220829.html - https://jvn.jp/en/jp/JVN45473612/index.html
CVE ID: CVE-2022-38095 State: PUBLISHED Published: 2022-09-23T13:41:53.453Z Last Updated: 2025-02-20T20:04:15.332Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: AlgolPlus Products: Advanced Dynamic Pricing for WooCommerce (WordPress plugin) Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in AlgolPlus Advanced Dynamic Pricing for WooCommerce plugin <= 4.1.3 at WordPress. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/advanced-dynamic-pricing-for-woocommerce/wordpress-advanced-dynamic-pricing-for-woocommerce-plugin-4-1-3-cross-site-req
/advanced-dynamic-pricing-for-woocommerce/wordpress-advanced-dynamic-pricing-for-woocommerce-plugin-4-1-3-cross-site-request-forgery-csrf-vulnerability - https://wordpress.org/plugins/advanced-dynamic-pricing-for-woocommerce/#developers
CVE ID: CVE-2022-38096 State: PUBLISHED Published: 2022-09-09T14:39:51.163117Z Last Updated: 2024-09-16T19:46:43.355Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:H) Vendors: Linux Products: kernel Problem Types: CWE-476 Description: A NULL pointer dereference vulnerability was found in vmwgfx driver in drivers/gpu/vmxgfx/vmxgfx_execbuf.c in GPU component of Linux kernel with device file '/dev/dri/renderD128 (or Dxxx)'. This flaw allows a local attacker with a user account on the system to gain privilege, causing a denial of service(DoS). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.openanolis.cn/show_bug.
Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.openanolis.cn/show_bug.cgi?id=2073 - https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html
CVE ID: CVE-2022-38097 State: PUBLISHED Published: 2022-11-21T16:05:37.153Z Last Updated: 2025-04-15T18:40:02.047Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Foxit Products: Foxit Reader Problem Types: CWE-416 Description: A use-after-free vulnerability exists in the JavaScript engine of Foxit Software's PDF Reader, version 12.0.1.12430. By prematurely destroying annotation objects, a specially-crafted PDF document can trigger the reuse of previously freed memory, which can lead to arbitrary code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a sp
user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially-crafted, malicious site if the browser plugin extension is enabled. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2022-1601
CVE ID: CVE-2022-38099 State: PUBLISHED Published: 2022-11-11T15:48:53.346Z Last Updated: 2025-02-05T15:38:43.308Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) NUC 11 Compute Elements Problem Types: escalation of privilege Description: Improper input validation in BIOS firmware for some Intel(R) NUC 11 Compute Elements before version EBTGL357.0065 may allow a privileged user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00752.html
CVE ID: CVE-2022-38100 State: PUBLISHED Published: 2022-09-13T14:54:50.356Z Last Updated: 2025-04-16T16:10:19.613Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Contec Health Products: CMS8000 CONTEC ICU CCU Vital Signs Patient Monitor Problem Types: CWE-400 Description: The CMS800 device fails while attempting to parse malformed network data sent by a threat actor. A threat actor with network access can remotely issue a specially formatted UDP request that will cause the entire device to crash and require a physical reboot. A UDP broadcast request could be sent that causes a mass denial-of-service attack on all CME8000 devices connected to the same network.
request could be sent that causes a mass denial-of-service attack on all CME8000 devices connected to the same network. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsma-22-244-01
CVE ID: CVE-2022-38101 State: PUBLISHED Published: 2023-05-10T13:17:19.808Z Last Updated: 2025-01-24T17:44:11.775Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) NUC Chaco Canyon BIOS update software Problem Types: escalation of privilege, CWE-427 Description: Uncontrolled search path in some Intel(R) NUC Chaco Canyon BIOS update software before version iFlashV Windows 5.13.00.2105 may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-
ontainer: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00780.html
CVE ID: CVE-2022-38102 State: PUBLISHED Published: 2023-08-11T02:36:56.232Z Last Updated: 2025-02-13T16:32:58.515Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:H) Vendors: n/a Products: Intel(R) Converged Security and Management Engine Problem Types: denial of service, CWE-20 Description: Improper Input validation in firmware for some Intel(R) Converged Security and Management Engine before versions 15.0.45, and 16.1.27 may allow a privileged user to potentially enable denial of service via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-0078
er: - CISA ADP Vulnrichment: References: - http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00783.html - https://security.netapp.com/advisory/ntap-20230824-0002/
CVE ID: CVE-2022-38103 State: PUBLISHED Published: 2023-05-10T13:17:01.881Z Last Updated: 2025-01-27T18:04:15.799Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) NUC Software Studio Service installer Problem Types: escalation of privilege, CWE-277 Description: Insecure inherited permissions in the Intel(R) NUC Software Studio Service installer before version 1.17.38.0 may allow an authenticated user to potentially enable escalation of privilege via local access Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00854.html
CVE ID: CVE-2022-38104 State: PUBLISHED Published: 2022-10-21T15:33:17.747Z Last Updated: 2025-02-20T19:58:12.769Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Biplob Adhikari Products: Accordions – Multiple Accordions or FAQs Builder (WordPress plugin) Problem Types: CWE-264 Description: Auth. WordPress Options Change (siteurl, users_can_register, default_role, admin_email and new_admin_email) vulnerability in Biplob Adhikari's Accordions – Multiple Accordions or FAQs Builder plugin (versions <= 2.0.3 on WordPress. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/accordions-or-faqs/#dev
s: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/accordions-or-faqs/#developers - https://patchstack.com/database/vulnerability/accordions-or-faqs/wordpress-accordions-plugin-2-0-3-authenticated-wordpress-options-change-vulnerability?_s_id=cve
CVE ID: CVE-2022-38105 State: PUBLISHED Published: 2023-01-10T20:44:26.241Z Last Updated: 2024-08-03T10:45:52.594Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Asus Products: RT-AX82U Problem Types: CWE-119 Description: An information disclosure vulnerability exists in the cm_processREQ_NC opcode of Asus RT-AX82U 3.0.0.4.386_49674-ge182230 router's configuration service. A specially-crafted network packets can lead to a disclosure of sensitive information. An attacker can send a network request to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_
lyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2022-1590
CVE ID: CVE-2022-38106 State: PUBLISHED Published: 2022-12-16T00:00:00 Last Updated: 2024-08-03T10:45:52.842Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: SolarWinds Products: Serv-U File Server Problem Types: CWE-79 Description: This vulnerability happens in the web client versions 15.3.0 to Serv-U 15.3.1. This vulnerability affects the directory creation function. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.solarwinds.com/trust-center/security-advisories/CVE-2022-38106 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=%20CVE-2022-38106 - https://documentation.solarwinds.com/en/success_center/servu
/cve.mitre.org/cgi-bin/cvename.cgi?name=%20CVE-2022-38106 - https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_15-3-2_release_notes.htm
CVE ID: CVE-2022-38107 State: PUBLISHED Published: 2022-10-19T21:03:23.635Z Last Updated: 2025-05-08T18:15:55.195Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: SolarWinds Products: SQL Sentry Problem Types: CWE-209 Description: Sensitive information could be displayed when a detailed technical error message is posted. This information could disclose environmental details. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.solarwinds.com/trust-center/security-advisories/CVE-2022-38107 - https://docs.sentryone.com/help/sentryone-platform-release-notes
CVE ID: CVE-2022-38108 State: PUBLISHED Published: 2022-10-20T20:11:25.181Z Last Updated: 2025-05-08T15:22:21.153Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: SolarWinds Products: SolarWinds Platform, Orion Platform Problem Types: CWE-502 Description: SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Orion admin-level account access to SolarWinds Web Console to execute arbitrary commands. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.solarwinds.com/trust-center/security-advisories/CVE-2022-38108 - https://www.zerodayinitiati
: References: - https://www.solarwinds.com/trust-center/security-advisories/CVE-2022-38108 - https://www.zerodayinitiative.com/advisories/ZDI-CAN-17531 - http://packetstormsecurity.com/files/171567/SolarWinds-Information-Service-SWIS-Remote-Command-Execution.html
CVE ID: CVE-2022-38110 State: PUBLISHED Published: 2023-01-20T00:00:00.000Z Last Updated: 2025-04-03T12:59:03.185Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: SolarWinds Products: Database Performance Analyzer (DPA) Problem Types: CWE-79 Description: In Database Performance Analyzer (DPA) 2022.4 and older releases, certain URL vectors are susceptible to authenticated reflected cross-site scripting. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://documentation.solarwinds.com/en/success_center/dpa/content/release_notes/dpa_2023-1_release_notes.htm - https://www.solarwinds.com/trust-center/security-advisorie
nter/dpa/content/release_notes/dpa_2023-1_release_notes.htm - https://www.solarwinds.com/trust-center/security-advisories/CVE-2022-38110
CVE ID: CVE-2022-38111 State: PUBLISHED Published: 2023-02-15T00:00:00.000Z Last Updated: 2025-03-19T19:46:50.100Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: SolarWinds Products: SolarWinds Platform Problem Types: CWE-502 Description: SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Orion admin-level account access to SolarWinds Web Console to execute arbitrary commands. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2023-1_re
https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2023-1_release_notes.htm - https://www.solarwinds.com/trust-center/security-advisories/CVE-2022-38111
CVE ID: CVE-2022-38112 State: PUBLISHED Published: 2023-01-20T00:00:00.000Z Last Updated: 2025-04-03T17:36:42.832Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: SolarWinds Products: Database Performance Analyzer (DPA) Problem Types: CWE-312 Description: In DPA 2022.4 and older releases, generated heap memory dumps contain sensitive information in cleartext. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://documentation.solarwinds.com/en/success_center/dpa/content/release_notes/dpa_2023-1_release_notes.htm - https://www.solarwinds.com/trust-center/security-advisories/CVE-2022-38112
CVE ID: CVE-2022-38113 State: PUBLISHED Published: 2022-11-23T00:00:00.000Z Last Updated: 2025-04-25T20:29:42.075Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: SolarWinds Products: SolarWinds SEM Problem Types: CWE-200 Description: This vulnerability discloses build and services versions in the server response header. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://documentation.solarwinds.com/en/success_center/sem/content/release_notes/sem_2022-4_release_notes.htm - https://www.solarwinds.com/trust-center/security-advisories/CVE-2022-38113
CVE ID: CVE-2022-38114 State: PUBLISHED Published: 2022-11-23T00:00:00.000Z Last Updated: 2025-04-25T20:28:24.632Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: SolarWinds Products: SolarWinds SEM Problem Types: CWE-444, CWE-79 Description: This vulnerability occurs when a web server fails to correctly process the Content-Length of POST requests. This can lead to HTTP request smuggling or XSS. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://documentation.solarwinds.com/en/success_center/sem/content/release_notes/sem_2022-4_release_notes.htm - https://www.solarwinds.com/trust-center/security-advisories/CVE-2
m/content/release_notes/sem_2022-4_release_notes.htm - https://www.solarwinds.com/trust-center/security-advisories/CVE-2022-38114
CVE ID: CVE-2022-38115 State: PUBLISHED Published: 2022-11-23T00:00:00.000Z Last Updated: 2025-04-24T19:20:55.843Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: SolarWinds Products: SolarWinds SEM Problem Types: CWE-650 Description: Insecure method vulnerability in which allowed HTTP methods are disclosed. E.g., OPTIONS, DELETE, TRACE, and PUT Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://documentation.solarwinds.com/en/success_center/sem/content/release_notes/sem_2022-4_release_notes.htm - https://www.solarwinds.com/trust-center/security-advisories/CVE-2022-38115
CVE ID: CVE-2022-38116 State: PUBLISHED Published: 2022-08-30T04:25:27.430888Z Last Updated: 2024-09-16T19:19:15.549Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Le-yan Co., Ltd. Products: Personnel and Salary Management System Problem Types: CWE-798 Description: Le-yan Personnel and Salary Management System has hard-coded database account and password within the website source code. An unauthenticated remote attacker can access, modify system data or disrupt service. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-6460-2bb02-1.html
CVE ID: CVE-2022-38117 State: PUBLISHED Published: 2022-10-24T13:21:03.691Z Last Updated: 2025-05-07T13:34:07.470Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:P/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N) Vendors: Juiker Products: Juiker app Problem Types: CWE-798 Description: Juiker app hard-coded its AES key in the source code. A physical attacker, after getting the Android root privilege, can use the AES key to decrypt users’ ciphertext and tamper with it. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-6630-d4d2f-1.html
CVE ID: CVE-2022-38118 State: PUBLISHED Published: 2022-08-30T04:25:28.204191Z Last Updated: 2024-09-16T17:29:10.368Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: HGiga Products: OAKlouds Problem Types: CWE-89 Description: OAKlouds Portal website’s Meeting Room has insufficient validation for user input. A remote attacker with general user privilege can perform SQL-injection to access, modify, delete database, perform system operations and disrupt service. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-6461-25c4b-1.html - https://www.chtsecurity.com/news/0a893178-5c64-4f1c-87f1-95cbf1e17c87
CVE ID: CVE-2022-38119 State: PUBLISHED Published: 2022-11-10T02:20:40.193Z Last Updated: 2025-05-01T19:09:13.578Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: POWERCOM CO., LTD. Products: UPSMON PRO Problem Types: CWE-287 Description: UPSMON Pro login function has insufficient authentication. An unauthenticated remote attacker can exploit this vulnerability to bypass authentication and get administrator privilege to access, control system or disrupt service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-6678-e9fbe-1.html