Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-26516 State: PUBLISHED Published: 2022-04-20T15:30:33.553Z Last Updated: 2025-04-16T17:55:19.628Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H) Vendors: Red Lion Products: DA50N Problem Types: CWE-345 Description: Authorized users may install a maliciously modified package file when updating the device via the web user interface. The user may inadvertently use a package file obtained from an unauthorized source or a file that was compromised between download and deployment. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-104-03
CVE ID: CVE-2022-26517 State: PUBLISHED Published: 2022-05-05T16:28:23.095617Z Last Updated: 2024-09-17T01:46:37.644Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: F5 Products: BIG-IP Problem Types: CWE-682 Description: On F5 BIG-IP 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, and 13.1.x versions prior to 13.1.5, when the BIG-IP CGNAT Large Scale NAT (LSN) pool is configured on a virtual server and packet filtering is enabled, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated Additional Analyst Notes: - C
te: Software versions which have reached End of Technical Support (EoTS) are not evaluated Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K54082580
CVE ID: CVE-2022-26518 State: PUBLISHED Published: 2022-05-12T17:01:49.718Z Last Updated: 2025-04-15T19:02:08.321Z Severity: CRITICAL (CVSS 9.9 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: InHand Networks Products: InRouter302 Problem Types: CWE-78 Description: An OS command injection vulnerability exists in the console infactory_net functionality of InHand Networks InRouter302 V3.5.37. A specially-crafted series of network requests can lead to remote code execution. An attacker can send a sequence of requests to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.inhandnetworks.com/upload/attachment/2022
s: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.inhandnetworks.com/upload/attachment/202205/10/InHand-PSA-2022-01.pdf - https://talosintelligence.com/vulnerability_reports/TALOS-2022-1501
CVE ID: CVE-2022-26519 State: PUBLISHED Published: 2022-04-20T15:30:36.000Z Last Updated: 2025-04-16T16:28:15.650Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Interlogix Products: Hills ComNav Problem Types: CWE-307 Description: There is no limit to the number of attempts to authenticate for the local configuration pages for the Hills ComNav Version 3002-19 interface, which allows local attackers to brute-force credentials. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.corporate.carrier.com/Images/CARR-PSA-Hills-ComNav-002-1121_tcm558-149392.pdf
CVE ID: CVE-2022-26520 State: PUBLISHED Published: 2022-03-07T17:00:37 Last Updated: 2024-08-03T05:03:32.964Z Vendors: n/a Products: n/a Problem Types: n/a Description: In pgjdbc before 42.3.3, an attacker (who controls the jdbc URL or properties) can call java.util.logging.FileHandler to write to arbitrary files through the loggerFile and loggerLevel connection properties. An example situation is that an attacker could create an executable JSP file under a Tomcat web root. NOTE: the vendor's position is that there is no pgjdbc vulnerability; instead, it is a vulnerability for any application to use the pgjdbc driver with untrusted connection properties Additional Analyst Notes: - CVE Progra
for any application to use the pgjdbc driver with untrusted connection properties Additional Analyst Notes: - CVE Program Container: References: - https://jdbc.postgresql.org/documentation/changelog.html#version_42.3.3 - https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-673j-qm5f-xpv8 - https://github.com/pgjdbc/pgjdbc/pull/2454/commits/017b929977b4f85795f9ad2fa5de6e80978b8ccc - https://jdbc.postgresql.org/documentation/head/tomcat.html - https://www.debian.org/security/2022/dsa-5196
CVE ID: CVE-2022-26521 State: PUBLISHED Published: 2022-03-07T00:00:00 Last Updated: 2024-08-03T05:03:32.753Z Vendors: n/a Products: n/a Problem Types: n/a Description: Abantecart through 1.3.2 allows remote authenticated administrators to execute arbitrary code by uploading an executable file, because the Catalog>Media Manager>Images settings can be changed by an administrator (e.g., by configuring .php to be a valid image file type). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sartlabs/0days/blob/main/Abantecart/Exploit.txt - http://packetstormsecurity.com/files/171487/Abantecart-1.3.2-Remote-Code-Execution.html
CVE ID: CVE-2022-26526 State: PUBLISHED Published: 2022-03-17T14:57:36 Last Updated: 2024-08-03T05:03:32.786Z Vendors: n/a Products: n/a Problem Types: n/a Description: Anaconda Anaconda3 (Anaconda Distribution) through 2021.11.0.0 and Miniconda3 through 4.11.0.0 can create a world-writable directory under %PROGRAMDATA% and place that directory into the system PATH environment variable. Thus, for example, local users can gain privileges by placing a Trojan horse file into that directory. (This problem can only happen in a non-default installation. The person who installs the product must specify that it is being installed for all users. Also, the person who installs the product must specify
e product must specify that it is being installed for all users. Also, the person who installs the product must specify that the system PATH should be changed. Additional Analyst Notes: - CVE Program Container: References: - https://docs.conda.io/en/latest/miniconda.html - https://github.com/continuumio/anaconda-issues/issues - https://improsec.com/tech-blog/privilege-escalation-vulnerability-in-anaconda3-and-miniconda3 - https://repo.anaconda.com/miniconda/
CVE ID: CVE-2022-26527 State: PUBLISHED Published: 2022-08-30T04:25:24.948684Z Last Updated: 2024-09-16T17:02:52.276Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Realtek Products: Linux/Android Bluetooth Mesh SDK Problem Types: CWE-120 Description: Realtek Linux/Android Bluetooth Mesh SDK has a buffer overflow vulnerability due to insufficient validation for the size of segmented packets’ reference parameter. An unauthenticated attacker in the adjacent network can exploit this vulnerability to cause buffer overflow and disrupt service. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-6457-66bc9-1.html
CVE ID: CVE-2022-26528 State: PUBLISHED Published: 2022-08-30T04:25:25.740110Z Last Updated: 2024-09-16T20:27:50.200Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Realtek Products: Linux/Android Bluetooth Mesh SDK Problem Types: CWE-120 Description: Realtek Linux/Android Bluetooth Mesh SDK has a buffer overflow vulnerability due to insufficient validation for the length of segmented packets’ shift parameter. An unauthenticated attacker in the adjacent network can exploit this vulnerability to cause buffer overflow and disrupt service. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-6458-5052f-1.html
CVE ID: CVE-2022-26529 State: PUBLISHED Published: 2022-08-30T04:25:26.637787Z Last Updated: 2024-09-17T01:46:15.626Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Realtek Products: Linux/Android Bluetooth Mesh SDK Problem Types: CWE-120 Description: Realtek Linux/Android Bluetooth Mesh SDK has a buffer overflow vulnerability due to insufficient validation for segmented packets’ link parameter. An unauthenticated attacker in the adjacent network can exploit this vulnerability to cause buffer overflow and disrupt service. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-6459-09c82-1.html
CVE ID: CVE-2022-26530 State: PUBLISHED Published: 2022-04-03T22:11:23 Last Updated: 2024-08-03T05:03:33.197Z Vendors: n/a Products: n/a Problem Types: n/a Description: swaylock before 1.6 allows attackers to trigger a crash and achieve unlocked access to a Wayland compositor. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/swaywm/swaylock/pull/219 - https://github.com/swaywm/swaylock/commit/1d1c75b6316d21933069a9d201f966d84099f6ca - https://bugzilla.redhat.com/show_bug.cgi?id=2066596
CVE ID: CVE-2022-26531 State: PUBLISHED Published: 2022-05-24T00:00:00 Last Updated: 2024-08-03T05:03:33.155Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H) Vendors: Zyxel Products: USG/ZyWALL series firmware, USG FLEX series firmware, ATP series firmware, VPN series firmware, NSG series firmware, NXC2500 firmware, NAP203 firmware, NWA50AX firmware, WAC500 firmware, WAX510D firmware Problem Types: CWE-20 Description: Multiple improper input validation flaws were identified in some CLI commands of Zyxel USG/ZyWALL series firmware versions 4.09 through 4.71, USG FLEX series firmware versions 4.50 through 5.21, ATP series firmware versions 4.32 through 5.21, VPN series
gh 4.71, USG FLEX series firmware versions 4.50 through 5.21, ATP series firmware versions 4.32 through 5.21, VPN series firmware versions 4.30 through 5.21, NSG series firmware versions 1.00 through 1.33 Patch 4, NXC2500 firmware version 6.10(AAIG.3) and earlier versions, NAP203 firmware version 6.25(ABFA.7) and earlier versions, NWA50AX firmware version 6.25(ABYW.5) and earlier versions, WAC500 firmware version 6.30(ABVS.2) and earlier versions, and WAX510D firmware version 6.30(ABTF.2) and earlier versions, that could allow a local authenticated attacker to cause a buffer overflow or a system crash via a crafted payload. Additional Analyst Notes: - CVE Program Container: References: - htt
r overflow or a system crash via a crafted payload. Additional Analyst Notes: - CVE Program Container: References: - https://www.zyxel.com/support/multiple-vulnerabilities-of-firewalls-AP-controllers-and-APs.shtml - http://seclists.org/fulldisclosure/2022/Jun/15 - http://packetstormsecurity.com/files/167464/Zyxel-Buffer-Overflow-Format-String-Command-Injection.html - http://packetstormsecurity.com/files/177036/Zyxel-zysh-Format-String-Proof-Of-Concept.html
CVE ID: CVE-2022-26532 State: PUBLISHED Published: 2022-05-24T05:20:09 Last Updated: 2024-08-03T05:03:32.963Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Zyxel Products: USG/ZyWALL series firmware, USG FLEX series firmware, ATP series firmware, VPN series firmware, NSG series firmware, NXC2500 firmware, NAP203 firmware, NWA50AX firmware, WAC500 firmware, WAX510D firmware Problem Types: CWE-88 Description: A argument injection vulnerability in the 'packet-trace' CLI command of Zyxel USG/ZyWALL series firmware versions 4.09 through 4.71, USG FLEX series firmware versions 4.50 through 5.21, ATP series firmware versions 4.32 through 5.21, VPN series firmware v
G FLEX series firmware versions 4.50 through 5.21, ATP series firmware versions 4.32 through 5.21, VPN series firmware versions 4.30 through 5.21, NSG series firmware versions 1.00 through 1.33 Patch 4, NXC2500 firmware version 6.10(AAIG.3) and earlier versions, NAP203 firmware version 6.25(ABFA.7) and earlier versions, NWA50AX firmware version 6.25(ABYW.5) and earlier versions, WAC500 firmware version 6.30(ABVS.2) and earlier versions, and WAX510D firmware version 6.30(ABTF.2) and earlier versions, that could allow a local authenticated attacker to execute arbitrary OS commands by including crafted arguments to the CLI command. Additional Analyst Notes: - CVE Program Container: References:
mands by including crafted arguments to the CLI command. Additional Analyst Notes: - CVE Program Container: References: - https://www.zyxel.com/support/multiple-vulnerabilities-of-firewalls-AP-controllers-and-APs.shtml - http://seclists.org/fulldisclosure/2022/Jun/15 - http://packetstormsecurity.com/files/167464/Zyxel-Buffer-Overflow-Format-String-Command-Injection.html
CVE ID: CVE-2022-26533 State: PUBLISHED Published: 2022-03-12T00:29:32 Last Updated: 2024-08-03T05:03:32.964Z Vendors: n/a Products: n/a Problem Types: n/a Description: Alist v2.1.0 and below was discovered to contain a cross-site scripting (XSS) vulnerability via /i/:data/ipa.plist. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Xhofe/alist/issues/645
CVE ID: CVE-2022-26534 State: PUBLISHED Published: 2022-03-16T23:02:08 Last Updated: 2024-08-03T05:03:32.952Z Vendors: n/a Products: n/a Problem Types: n/a Description: FISCO-BCOS release-3.0.0-rc2 was discovered to contain an issue where a malicious node, via a malicious viewchange packet, will cause normal nodes to change view excessively and stop generating blocks. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/FISCO-BCOS/FISCO-BCOS/issues/2211
CVE ID: CVE-2022-26536 State: PUBLISHED Published: 2022-03-23T23:24:59 Last Updated: 2024-08-03T05:03:32.687Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/setFixTools. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/GD008/vuln/blob/main/tenda_M3_setFixTools/M3_setFixTools.md
CVE ID: CVE-2022-26546 State: PUBLISHED Published: 2022-03-31T20:18:44 Last Updated: 2024-08-03T05:03:32.950Z Vendors: n/a Products: n/a Problem Types: n/a Description: Hospital Management System v1.0 was discovered to lack an authorization component, allowing attackers to access sensitive information and obtain the admin password. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/kabirkhyrul/HMS - https://github.com/kabirkhyrul/HMS/discussions/12
CVE ID: CVE-2022-26555 State: PUBLISHED Published: 2022-03-20T18:35:01 Last Updated: 2024-08-03T05:03:32.806Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability in the Add a Button function of Eova v1.6.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the button name text box. Additional Analyst Notes: - CVE Program Container: References: - https://gitee.com/eova/eova/issues/I4VRE9
CVE ID: CVE-2022-26562 State: PUBLISHED Published: 2022-04-01T00:00:00 Last Updated: 2024-08-03T05:03:32.956Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in provider/libserver/ECKrbAuth.cpp of Kopano Core <= v11.0.2.51 contains an issue which allows attackers to authenticate even if the user account or password is expired. It also exists in the predecessor Zarafa Collaboration Platform (ZCP) in provider/libserver/ECPamAuth.cpp of Zarafa >= 6.30 (introduced between 6.30.0 RC1e and 6.30.8 final). Additional Analyst Notes: - CVE Program Container: References: - https://kopano.com/ - https://stash.kopano.io/projects/KC/repos/kopanocore/browse/provider/libserver/ECKrbAuth.
ences: - https://kopano.com/ - https://stash.kopano.io/projects/KC/repos/kopanocore/browse/provider/libserver/ECKrbAuth.cpp#137 - https://lists.debian.org/debian-lts-announce/2023/03/msg00006.html - https://jira.kopano.io/browse/KC-2021 - https://github.com/Kopano-dev/kopano-core/blob/master/provider/libserver/ECKrbAuth.cpp#L137 - https://bugzilla.redhat.com/show_bug.cgi?id=2192126 - https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2023-342b96903b - https://src.fedoraproject.org/rpms/zarafa/c/a5a8366ccf07f248fae6edffb5123cfda579bfdb?branch=epel7
CVE ID: CVE-2022-26563 State: PUBLISHED Published: 2023-07-18T00:00:00 Last Updated: 2024-10-28T16:52:03.178Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Tildeslash Monit before 5.31.0, allows remote attackers to gain escilated privlidges due to improper PAM-authorization. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://man7.org/linux/man-pages/man3/pam_acct_mgmt.3.html - https://bitbucket.org/tildeslash/monit/commits/6ecaab1d375f33165fe98d06d92f36c949c0ea11
CVE ID: CVE-2022-26564 State: PUBLISHED Published: 2022-04-26T22:30:17 Last Updated: 2024-08-03T05:03:32.908Z Vendors: n/a Products: n/a Problem Types: n/a Description: HotelDruid Hotel Management Software v3.0.3 contains a cross-site scripting (XSS) vulnerability via the prezzoperiodo4 parameter in creaprezzi.php. Additional Analyst Notes: - CVE Program Container: References: - https://www.hoteldruid.com - https://rydzak.me/2022/04/cve-2022-26564/
CVE ID: CVE-2022-26565 State: PUBLISHED Published: 2022-04-01T21:24:11 Last Updated: 2024-08-03T05:03:32.792Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in Totaljs all versions before commit 95f54a5commit, allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Page Name text field when creating a new page. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/totaljs/cms/issues/35 - https://bug.pocas.kr/2022/03/01/2022-03-05-CVE-2022-26565/
CVE ID: CVE-2022-26572 State: PUBLISHED Published: 2022-04-04T18:31:13 Last Updated: 2024-08-03T05:03:33.190Z Vendors: n/a Products: n/a Problem Types: n/a Description: Xerox ColorQube 8580 was discovered to contain an access control issue which allows attackers to print, view the status, and obtain sensitive information. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/yj12341/ColorQube-8580-/blob/main/README.md
CVE ID: CVE-2022-26573 State: PUBLISHED Published: 2022-03-25T18:50:12 Last Updated: 2024-08-03T05:03:32.901Z Vendors: n/a Products: n/a Problem Types: n/a Description: Maccms v10 was discovered to contain multiple reflected cross-site scripting (XSS) vulnerabilities in /admin.php/admin/art/data.html via the select and input parameters. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/magicblack/maccms10/issues/840
CVE ID: CVE-2022-26579 State: PUBLISHED Published: 2022-12-16T00:00:00 Last Updated: 2024-10-27T14:47:24.717Z Vendors: n/a Products: n/a Problem Types: n/a Description: PAX A930 device with PayDroid_7.1.1_Virgo_V04.3.26T1_20210419 can allow a root privileged attacker to install unsigned packages. The attacker must have shell access to the device and gain root privileges in order to exploit this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cyshield.com/e077d6c3-adff-49a1-afc3-71e10140f95c - https://github.com/wr3nchsr/PAX-Paydroid-Advisories/blob/master/advisories/2022/CVEs/CVE-2022-26579.md - https://wr3nchsr.github.io/pax-p
m/wr3nchsr/PAX-Paydroid-Advisories/blob/master/advisories/2022/CVEs/CVE-2022-26579.md - https://wr3nchsr.github.io/pax-paydroid-vulnerabilities-advisory-2022/
CVE ID: CVE-2022-26580 State: PUBLISHED Published: 2022-12-16T00:00:00 Last Updated: 2024-10-28T19:44:55.919Z Vendors: n/a Products: n/a Problem Types: n/a Description: PAX A930 device with PayDroid_7.1.1_Virgo_V04.3.26T1_20210419 can allow the execution of specific command injections on selected binaries in the ADB daemon shell service. The attacker must have physical USB access to the device in order to exploit this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cyshield.com/e077d6c3-adff-49a1-afc3-71e10140f95c - https://github.com/wr3nchsr/PAX-Paydroid-Advisories/blob/master/advisories/2022/CVEs/CVE-2022-26580.md - https://
f95c - https://github.com/wr3nchsr/PAX-Paydroid-Advisories/blob/master/advisories/2022/CVEs/CVE-2022-26580.md - https://wr3nchsr.github.io/pax-paydroid-vulnerabilities-advisory-2022/
CVE ID: CVE-2022-26581 State: PUBLISHED Published: 2022-12-16T00:00:00 Last Updated: 2024-11-20T14:39:59.183Z Vendors: n/a Products: n/a Problem Types: n/a Description: PAX A930 device with PayDroid_7.1.1_Virgo_V04.3.26T1_20210419 can allow an unauthorized attacker to perform privileged actions through the execution of specific binaries listed in ADB daemon. The attacker must have physical USB access to the device in order to exploit this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cyshield.com/e077d6c3-adff-49a1-afc3-71e10140f95c - https://github.com/wr3nchsr/PAX-Paydroid-Advisories/blob/master/advisories/2022/CVEs/CVE-202
ff-49a1-afc3-71e10140f95c - https://github.com/wr3nchsr/PAX-Paydroid-Advisories/blob/master/advisories/2022/CVEs/CVE-2022-26581.md - https://wr3nchsr.github.io/pax-paydroid-vulnerabilities-advisory-2022/
CVE ID: CVE-2022-26582 State: PUBLISHED Published: 2022-12-16T00:00:00 Last Updated: 2024-08-03T05:03:33.250Z Vendors: n/a Products: n/a Problem Types: n/a Description: PAX A930 device with PayDroid_7.1.1_Virgo_V04.3.26T1_20210419 can allow an attacker to gain root access through command injection in systool client. The attacker must have shell access to the device in order to exploit this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cyshield.com/e077d6c3-adff-49a1-afc3-71e10140f95c - https://github.com/wr3nchsr/PAX-Paydroid-Advisories/blob/master/advisories/2022/CVEs/CVE-2022-26582.md - https://wr3nchsr.github.io/pax-paydro
nchsr/PAX-Paydroid-Advisories/blob/master/advisories/2022/CVEs/CVE-2022-26582.md - https://wr3nchsr.github.io/pax-paydroid-vulnerabilities-advisory-2022/
CVE ID: CVE-2022-26585 State: PUBLISHED Published: 2022-04-05T00:16:57 Last Updated: 2024-08-03T05:03:32.789Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mingsoft MCMS v5.2.7 was discovered to contain a SQL injection vulnerability via /cms/content/list. Additional Analyst Notes: - CVE Program Container: References: - https://gitee.com/mingSoft/MCMS/issues/I4W1S9
CVE ID: CVE-2022-26588 State: PUBLISHED Published: 2022-04-08T20:12:28 Last Updated: 2024-08-03T05:03:33.115Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross-Site Request Forgery (CSRF) in IceHrm 31.0.0.OS allows attackers to delete arbitrary users or achieve account takeover via the app/service.php URI. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/166627/ICEHRM-31.0.0.0S-Cross-Site-Request-Forgery.html - https://medium.com/%40devansh3008/csrf-in-icehrm-31-0-0-0s-in-delete-user-endpoint-86a39ecf253f
CVE ID: CVE-2022-26589 State: PUBLISHED Published: 2022-04-12T23:32:09 Last Updated: 2024-08-03T05:03:32.981Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross-Site Request Forgery (CSRF) in Pluck CMS v4.7.15 allows attackers to delete arbitrary pages. Additional Analyst Notes: - CVE Program Container: References: - https://owasp.org/www-community/attacks/csrf - https://medium.com/%40devansh3008/pluck-cms-v4-7-15-csrf-vulnerability-at-delete-page-9fff0309f9c
CVE ID: CVE-2022-26591 State: PUBLISHED Published: 2022-04-06T19:42:27 Last Updated: 2024-08-03T05:03:32.958Z Vendors: n/a Products: n/a Problem Types: n/a Description: FANTEC GmbH MWiD25-DS Firmware v2.000.030 allows unauthenticated attackers to access and download arbitrary files via a crafted GET request. Additional Analyst Notes: - CVE Program Container: References: - https://drive.google.com/file/d/1aY4LYjUskte8Z3grdbjCnPh8nMEAtH2v/view?usp=sharing
CVE ID: CVE-2022-26592 State: PUBLISHED Published: 2023-08-22T00:00:00 Last Updated: 2024-10-03T17:44:23.315Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stack Overflow vulnerability in libsass 3.6.5 via the CompoundSelector::has_real_parent_ref function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/sass/libsass/issues/3174