Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-33968 State: PUBLISHED Published: 2022-08-04T17:47:03.087620Z Last Updated: 2024-09-16T23:56:23.500Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: F5 Products: BIG-IP Problem Types: CWE-125 Description: In BIG-IP Versions 17.0.x before 17.0.0.1, 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5.1, and all versions of 13.1.x, when an LTM monitor or APM SSO is configured on a virtual server, and NTLM challenge-response is in use, undisclosed traffic can cause a buffer over-read. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Additional Analyst Notes: - CVE Program Container: Refe
have reached End of Technical Support (EoTS) are not evaluated. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K23465404
CVE ID: CVE-2022-33969 State: PUBLISHED Published: 2022-07-25T17:45:56.209Z Last Updated: 2025-02-20T20:15:12.189Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Biplob Adhikari Products: Flipbox (WordPress plugin) Problem Types: CWE-264 Description: Authenticated WordPress Options Change vulnerability in Biplob Adhikari's Flipbox plugin <= 2.6.0 at WordPress. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://plugins.trac.wordpress.org/changeset/2648808 - https://patchstack.com/database/vulnerability/image-hover-effects-ultimate-visual-composer/wordpress-flipbox-plugin-2-6-0-authenticated-wordpress-options-chang
bility/image-hover-effects-ultimate-visual-composer/wordpress-flipbox-plugin-2-6-0-authenticated-wordpress-options-change-vulnerability
CVE ID: CVE-2022-33970 State: PUBLISHED Published: 2022-07-27T13:28:14.480Z Last Updated: 2025-02-20T20:14:57.998Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Biplob018 Products: Shortcode Addons (WordPress plugin) Problem Types: CWE-264 Description: Authenticated WordPress Options Change vulnerability in Biplob018 Shortcode Addons plugin <= 3.1.2 at WordPress. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/shortcode-addons/#developers - https://patchstack.com/database/vulnerability/shortcode-addons/wordpress-shortcode-addons-plugin-3-1-2-authenticated-wordpress-options-change-vulnera
se/vulnerability/shortcode-addons/wordpress-shortcode-addons-plugin-3-1-2-authenticated-wordpress-options-change-vulnerability
CVE ID: CVE-2022-33971 State: PUBLISHED Published: 2022-07-04T01:50:54 Last Updated: 2024-08-03T08:16:16.110Z Vendors: OMRON Corporation Products: Machine automation controller NJ series, Machine automation controller NX series, Automation software 'Sysmac Studio', and Programmable Terminal (PT) NA series Problem Types: Authentication Bypass by Capture-replay Description: Authentication bypass by capture-replay vulnerability exists in Machine automation controller NX7 series all models V1.28 and earlier, Machine automation controller NX1 series all models V1.48 and earlier, and Machine automation controller NJ series all models V 1.48 and earlier, which may allow an adjacent attacker who can
and Machine automation controller NJ series all models V 1.48 and earlier, which may allow an adjacent attacker who can analyze the communication between the controller and the specific software used by OMRON internally to cause a denial-of-service (DoS) condition or execute a malicious program. Additional Analyst Notes: - CVE Program Container: References: - https://jvn.jp/en/vu/JVNVU97050784/index.html - https://www.ia.omron.com/product/vulnerability/OMSR-2022-002_en.pdf
CVE ID: CVE-2022-33972 State: PUBLISHED Published: 2023-02-16T20:00:14.994Z Last Updated: 2025-01-27T18:17:12.816Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:N) Vendors: n/a Products: 3rd Generation Intel(R) Xeon(R) Scalable Processors Problem Types: information disclosure Description: Incorrect calculation in microcode keying mechanism for some 3rd Generation Intel(R) Xeon(R) Scalable Processors may allow a privileged user to potentially enable information disclosure via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00730.html
CVE ID: CVE-2022-33973 State: PUBLISHED Published: 2022-11-11T15:49:13.303Z Last Updated: 2025-01-29T21:12:46.660Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: n/a Products: Intel(R) WAPI Security software for Windows 10/11 Problem Types: information disclosure Description: Improper access control in the Intel(R) WAPI Security software for Windows 10/11 before version 22.2150.0.1 may allow an authenticated user to potentially enable information disclosure via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00720.html
CVE ID: CVE-2022-33974 State: PUBLISHED Published: 2023-05-29T00:10:22.015Z Last Updated: 2024-11-01T13:01:21.286Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: Smash Balloon Products: Custom Twitter Feeds (Tweets Widget) Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Smash Balloon Custom Twitter Feeds (Tweets Widget) plugin <= 1.8.4 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/custom-twitter-feeds/wordpress-custom-twitter-feeds-plugin-1-8-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2022-33976 State: REJECTED Published: N/A Last Updated: 2025-05-28T18:19:56.629Z Description: No description available.
CVE ID: CVE-2022-33977 State: PUBLISHED Published: 2022-07-26T05:10:44 Last Updated: 2024-08-03T08:16:16.078Z Vendors: Christian Stefanescu Products: untangle Problem Types: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion') Description: untangle is a python library to convert XML data to python objects. untangle versions 1.2.0 and earlier improperly restricts recursive entity references in DTDs. By exploiting this vulnerability, a remote unauthenticated attacker may cause a denial-of-service (DoS) condition on the server where the product is running. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/stchris/untangle - https
is running. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/stchris/untangle - https://github.com/stchris/untangle/releases/tag/1.2.1 - https://jvn.jp/en/jp/JVN30454777/
CVE ID: CVE-2022-33978 State: PUBLISHED Published: 2022-10-11T17:00:20.153Z Last Updated: 2025-02-20T19:59:38.096Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Sayontan Sinha Products: FontMeister (WordPress plugin) Problem Types: CWE-79 Description: Reflected Cross-Site Scripting (XSS) vulnerability FontMeister plugin <= 1.08 at WordPress. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/fontmeister/wordpress-fontmeister-plugin-1-08-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve - https://wordpress.org/plugins/fontmeister/
CVE ID: CVE-2022-33979 State: REJECTED Published: N/A Last Updated: 2025-05-28T18:19:57.884Z Description: No description available.
CVE ID: CVE-2022-33980 State: PUBLISHED Published: 2022-07-06T00:00:00 Last Updated: 2024-08-03T08:16:16.672Z Vendors: Apache Software Foundation Products: Apache Commons Configuration Problem Types: Insecure interpolation defaults Description: Apache Commons Configuration performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "${prefix:name}", where "prefix" is used to locate an instance of org.apache.commons.configuration2.interpol.Lookup that performs the interpolation. Starting with version 2.4 and continuing through 2.7, the set of default Lookup instances included interpolators that could result in arbitra
2.4 and continuing through 2.7, the set of default Lookup instances included interpolators that could result in arbitrary code execution or contact with remote servers. These lookups are: - "script" - execute expressions using the JVM script execution engine (javax.script) - "dns" - resolve dns records - "url" - load values from urls, including from remote servers Applications using the interpolation defaults in the affected versions may be vulnerable to remote code execution or unintentional contact with remote servers if untrusted configuration values are used. Users are recommended to upgrade to Apache Commons Configuration 2.8.0, which disables the problematic interpolators by default.
recommended to upgrade to Apache Commons Configuration 2.8.0, which disables the problematic interpolators by default. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread/tdf5n7j80lfxdhs2764vn0xmpfodm87s - http://www.openwall.com/lists/oss-security/2022/07/06/5 - https://security.netapp.com/advisory/ntap-20221028-0015/ - http://www.openwall.com/lists/oss-security/2022/11/15/4 - https://www.debian.org/security/2022/dsa-5290
CVE ID: CVE-2022-33981 State: PUBLISHED Published: 2022-06-18T15:27:32.000Z Last Updated: 2025-05-05T16:15:03.996Z Vendors: n/a Products: n/a Problem Types: n/a Description: drivers/block/floppy.c in the Linux kernel before 5.17.6 is vulnerable to a denial of service, because of a concurrency use-after-free flaw after deallocating raw_cmd in the raw_cmd_ioctl function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/torvalds/linux/commit/233087ca063686964a53c829d547c7571e3f67bf - https://exchange.xforce.ibmcloud.com/vulnerabilities/225362 - https://seclists.org/oss-sec/2022/q2/66 - https://cdn.kernel.org/pub/linux/kernel/v5.x/Chang
om/vulnerabilities/225362 - https://seclists.org/oss-sec/2022/q2/66 - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.17.6 - https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html - https://www.debian.org/security/2022/dsa-5173
CVE ID: CVE-2022-33982 State: PUBLISHED Published: 2022-11-14T00:00:00.000Z Last Updated: 2025-04-30T20:18:26.671Z Vendors: n/a Products: n/a Problem Types: n/a Description: DMA attacks on the parameter buffer used by the Int15ServiceSmm software SMI handler could lead to a TOCTOU attack on the SMI handler and lead to corruption of SMRAM. DMA attacks on the parameter buffer used by the software SMI handler used by the driver Int15ServiceSmm could lead to a TOCTOU attack on the SMI handler and lead to corruption of SMRAM. This issue was discovered by Insyde engineering during a security review. This issue is fixed in Kernel 5.2: 05.27.23, Kernel 5.3: 05.36.23, Kernel 5.4: 05.44.23 and Kernel
g a security review. This issue is fixed in Kernel 5.2: 05.27.23, Kernel 5.3: 05.36.23, Kernel 5.4: 05.44.23 and Kernel 5.5: 05.52.23 CWE-367 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.insyde.com/security-pledge - https://www.insyde.com/security-pledge/SA-2022052 - https://cert-portal.siemens.com/productcert/pdf/ssa-450613.pdf
CVE ID: CVE-2022-33983 State: PUBLISHED Published: 2022-11-14T00:00:00.000Z Last Updated: 2025-04-30T20:14:00.981Z Vendors: n/a Products: n/a Problem Types: n/a Description: DMA transactions which are targeted at input buffers used for the NvmExpressLegacy software SMI handler could cause SMRAM corruption through a TOCTOU attack. DMA transactions which are targeted at input buffers used for the software SMI handler used by the NvmExpressLegacy driver could cause SMRAM corruption through a TOCTOU attack. This issue was discovered by Insyde engineering based on the general description provided by Intel's iSTARE group. This issue was fixed in kernel 5.2: 05.27.25, kernel 5.3: 05.36.25, kernel 5
scription provided by Intel's iSTARE group. This issue was fixed in kernel 5.2: 05.27.25, kernel 5.3: 05.36.25, kernel 5.4: 05.44.25, kernel 5.5: 05.52.25 https://www.insyde.com/security-pledge/SA-2022053 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.insyde.com/security-pledge - https://www.insyde.com/security-pledge/SA-2022053
CVE ID: CVE-2022-33984 State: PUBLISHED Published: 2022-11-14T00:00:00.000Z Last Updated: 2025-04-30T20:02:19.323Z Vendors: n/a Products: n/a Problem Types: n/a Description: DMA transactions which are targeted at input buffers used for the SdMmcDevice software SMI handler could cause SMRAM corruption through a TOCTOU attack. DMA transactions which are targeted at input buffers used for the software SMI handler used by the SdMmcDevice driver could cause SMRAM corruption through a TOCTOU attack. This issue was discovered by Insyde engineering based on the general description provided by Intel's iSTARE group. This was fixed in kernel 5.2: 05.27.25, kernel 5.3: 05.36.25, kernel 5.4: 05.44.25, ke
provided by Intel's iSTARE group. This was fixed in kernel 5.2: 05.27.25, kernel 5.3: 05.36.25, kernel 5.4: 05.44.25, kernel 5.5: 05.52.25 https://www.insyde.com/security-pledge/SA-2022054 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.insyde.com/security-pledge - https://www.insyde.com/security-pledge/SA-2022054 - https://cert-portal.siemens.com/productcert/pdf/ssa-450613.pdf
CVE ID: CVE-2022-33985 State: PUBLISHED Published: 2022-11-14T00:00:00.000Z Last Updated: 2025-04-30T20:00:25.064Z Vendors: n/a Products: n/a Problem Types: n/a Description: DMA transactions which are targeted at input buffers used for the NvmExpressDxe software SMI handler could cause SMRAM corruption through a TOCTOU attack. DMA transactions which are targeted at input buffers used for the software SMI handler used by the NvmExpressDxe driver could cause SMRAM corruption through a TOCTOU attack. This issue was discovered by Insyde engineering based on the general description provided by Intel's iSTARE group. This issue was fixed in kernel 5.2: 05.27.25, kernel 5.3: 05.36.25, kernel 5.4: 05
ion provided by Intel's iSTARE group. This issue was fixed in kernel 5.2: 05.27.25, kernel 5.3: 05.36.25, kernel 5.4: 05.44.25, kernel 5.5: 05.52.25 https://www.insyde.com/security-pledge/SA-2022055 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.insyde.com/security-pledge - https://www.insyde.com/security-pledge/SA-2022055
CVE ID: CVE-2022-33986 State: PUBLISHED Published: 2022-11-14T00:00:00.000Z Last Updated: 2025-04-30T19:56:45.263Z Vendors: n/a Products: n/a Problem Types: n/a Description: DMA attacks on the parameter buffer used by the VariableRuntimeDxe software SMI handler could lead to a TOCTOU attack. DMA attacks on the parameter buffer used by the software SMI handler used by the driver VariableRuntimeDxe could lead to a TOCTOU attack on the SMI handler and lead to corruption of SMRAM. This issue was discovered by Insyde engineering during a security review. This issue is fixed in Kernel 5.4: 05.44.23 and Kernel 5.5: 05.52.23. CWE-367 CWE-367 Report at: https://www.insyde.com/security-pledge/SA-20220
ernel 5.4: 05.44.23 and Kernel 5.5: 05.52.23. CWE-367 CWE-367 Report at: https://www.insyde.com/security-pledge/SA-2022056 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.insyde.com/security-pledge - https://www.insyde.com/security-pledge/SA-2022056
CVE ID: CVE-2022-33987 State: PUBLISHED Published: 2022-06-18T20:51:12 Last Updated: 2024-08-03T08:16:16.308Z Vendors: n/a Products: n/a Problem Types: n/a Description: The got package before 12.1.0 (also fixed in 11.8.5) for Node.js allows a redirect to a UNIX socket. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sindresorhus/got/pull/2047 - https://github.com/sindresorhus/got/compare/v12.0.3...v12.1.0 - https://github.com/sindresorhus/got/releases/tag/v11.8.5
CVE ID: CVE-2022-33988 State: PUBLISHED Published: 2022-08-15T12:09:50 Last Updated: 2024-08-03T08:16:16.348Z Vendors: n/a Products: n/a Problem Types: n/a Description: dproxy-nexgen (aka dproxy nexgen) re-uses the DNS transaction id (TXID) value from client queries, which allows attackers (able to send queries to the resolver) to conduct DNS cache-poisoning attacks because the TXID value is known to the attacker. Additional Analyst Notes: - CVE Program Container: References: - https://sourceforge.net/projects/dproxy/ - https://www.usenix.org/conference/usenixsecurity22/presentation/jeitner - https://www.openwall.com/lists/oss-security/2022/08/14/3
CVE ID: CVE-2022-33989 State: PUBLISHED Published: 2022-08-15T12:10:15 Last Updated: 2024-08-03T08:16:16.328Z Vendors: n/a Products: n/a Problem Types: n/a Description: dproxy-nexgen (aka dproxy nexgen) uses a static UDP source port (selected randomly only at boot time) in upstream queries sent to DNS resolvers. This allows DNS cache poisoning because there is not enough entropy to prevent traffic injection attacks. Additional Analyst Notes: - CVE Program Container: References: - https://sourceforge.net/projects/dproxy/ - https://www.usenix.org/conference/usenixsecurity22/presentation/jeitner - https://www.openwall.com/lists/oss-security/2022/08/14/3
CVE ID: CVE-2022-33990 State: PUBLISHED Published: 2022-08-15T12:10:15 Last Updated: 2024-08-03T08:16:16.186Z Vendors: n/a Products: n/a Problem Types: n/a Description: Misinterpretation of special domain name characters in dproxy-nexgen (aka dproxy nexgen) leads to cache poisoning because domain names and their associated IP addresses are cached in their misinterpreted form. Additional Analyst Notes: - CVE Program Container: References: - https://www.usenix.org/conference/usenixsecurity21/presentation/jeitner - https://sourceforge.net/projects/dproxy/ - https://www.usenix.org/conference/usenixsecurity22/presentation/jeitner - https://www.openwall.com/lists/oss-security/2022/08/14/3
CVE ID: CVE-2022-33991 State: PUBLISHED Published: 2022-08-15T12:10:15 Last Updated: 2024-08-03T08:16:16.334Z Vendors: n/a Products: n/a Problem Types: n/a Description: dproxy-nexgen (aka dproxy nexgen) forwards and caches DNS queries with the CD (aka checking disabled) bit set to 1. This leads to disabling of DNSSEC protection provided by upstream resolvers. Additional Analyst Notes: - CVE Program Container: References: - https://sourceforge.net/projects/dproxy/ - https://www.usenix.org/conference/usenixsecurity22/presentation/jeitner - https://www.openwall.com/lists/oss-security/2022/08/14/3
CVE ID: CVE-2022-33992 State: PUBLISHED Published: 2022-08-15T11:46:12 Last Updated: 2024-08-03T08:16:16.327Z Vendors: n/a Products: n/a Problem Types: n/a Description: DNRD (aka Domain Name Relay Daemon) 2.20.3 forwards and caches DNS queries with the CD (aka checking disabled) bit set to 1. This leads to disabling of DNSSEC protection provided by upstream resolvers. Additional Analyst Notes: - CVE Program Container: References: - https://www.usenix.org/conference/usenixsecurity22/presentation/jeitner - http://dnrd.sourceforge.net/ - https://www.openwall.com/lists/oss-security/2022/08/14/1
CVE ID: CVE-2022-33993 State: PUBLISHED Published: 2022-08-15T11:45:47 Last Updated: 2024-08-03T08:16:16.573Z Vendors: n/a Products: n/a Problem Types: n/a Description: Misinterpretation of special domain name characters in DNRD (aka Domain Name Relay Daemon) 2.20.3 leads to cache poisoning because domain names and their associated IP addresses are cached in their misinterpreted form. Additional Analyst Notes: - CVE Program Container: References: - https://www.usenix.org/conference/usenixsecurity21/presentation/jeitner - https://www.usenix.org/conference/usenixsecurity22/presentation/jeitner - http://dnrd.sourceforge.net/ - https://www.openwall.com/lists/oss-security/2022/08/14/1
CVE ID: CVE-2022-33994 State: PUBLISHED Published: 2022-07-30T19:27:56 Last Updated: 2024-08-03T08:16:16.108Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Gutenberg plugin through 13.7.3 for WordPress allows stored XSS by the Contributor role via an SVG document to the "Insert from URL" feature. NOTE: the XSS payload does not execute in the context of the WordPress instance's domain; however, analogous attempts by low-privileged users to reference SVG documents are blocked by some similar products, and this behavioral difference might have security relevance to some WordPress site administrators. Additional Analyst Notes: - CVE Program Container: References: - https://blog.
ce to some WordPress site administrators. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jitendrapatro.me/cve-2022-33994-stored-xss-in-wordpress/ - https://patchstack.com/articles/patchstack-weekly-svg-xss-reported-in-gutenberg/
CVE ID: CVE-2022-33995 State: PUBLISHED Published: 2022-06-21T14:37:46 Last Updated: 2024-08-03T08:16:15.966Z Vendors: n/a Products: n/a Problem Types: n/a Description: A path traversal issue in entry attachments in Devolutions Remote Desktop Manager before 2022.2 allows attackers to create or overwrite files in an arbitrary location. Additional Analyst Notes: - CVE Program Container: References: - https://devolutions.net
CVE ID: CVE-2022-33996 State: PUBLISHED Published: 2022-07-07T11:19:54 Last Updated: 2024-08-03T08:16:16.062Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect permission management in Devolutions Server before 2022.2 allows a new user with a preexisting username to inherit the permissions of that previous user. Additional Analyst Notes: - CVE Program Container: References: - https://devolutions.net - https://devolutions.net/security/advisories/DEVO-2022-0006
CVE ID: CVE-2022-34000 State: PUBLISHED Published: 2022-06-19T00:00:00 Last Updated: 2024-08-03T08:16:15.912Z Vendors: n/a Products: n/a Problem Types: n/a Description: libjxl 0.6.1 has an assertion failure in LowMemoryRenderPipeline::Init() in render_pipeline/low_memory_render_pipeline.cc. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/libjxl/libjxl/issues/1477 - https://security.gentoo.org/glsa/202210-36
CVE ID: CVE-2022-34001 State: PUBLISHED Published: 2022-07-19T16:17:45 Last Updated: 2024-08-03T08:16:16.213Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unit4 ERP through 7.9 allows XXE via ExecuteServerProcessAsynchronously. Additional Analyst Notes: - CVE Program Container: References: - https://prisminfosec.com/cve-2022-34001/
CVE ID: CVE-2022-34002 State: PUBLISHED Published: 2022-09-16T01:55:07 Last Updated: 2024-08-03T08:16:16.124Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ‘document’ parameter of PDS Vista 7’s /application/documents/display.aspx page is vulnerable to a Local File Inclusion vulnerability which allows an low-privileged authenticated attacker to leak the configuration files and source code of the web application. Additional Analyst Notes: - CVE Program Container: References: - https://assurainc.com - https://assura.atlassian.net/wiki/spaces/VULNS/pages/1843134469/CVE-2022-34002+Personnel+Data+Systems+PDS+Vista+7+-+Local+File+Inclusion
CVE ID: CVE-2022-34005 State: PUBLISHED Published: 2022-06-19T20:26:01 Last Updated: 2024-08-03T08:16:16.056Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in TitanFTP (aka Titan FTP) NextGen before 1.2.1050. There is Remote Code Execution due to a hardcoded password for the sa account on the Microsoft SQL Express 2019 instance installed by default during TitanFTP NextGen installation, aka NX-I674 (sub-issue 1). NOTE: as of 2022-06-21, the 1.2.1050 release corrects this vulnerability in a new installation, but not in an upgrade installation. Additional Analyst Notes: - CVE Program Container: References: - https://www.southrivertech.com/software/nextgen/ti
ion. Additional Analyst Notes: - CVE Program Container: References: - https://www.southrivertech.com/software/nextgen/titanftp/en/relnotes.pdf