Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-24366 State: PUBLISHED Published: 2022-02-18T19:52:21 Last Updated: 2024-08-03T04:07:02.534Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Foxit Products: PDF Reader Problem Types: CWE-416 Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.1.0.52543. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of AcroForms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attac
ue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15853. Additional Analyst Notes: - CVE Program Container: References: - https://www.foxit.com/support/security-bulletins.html - https://www.zerodayinitiative.com/advisories/ZDI-22-277/
CVE ID: CVE-2022-24367 State: PUBLISHED Published: 2022-02-18T19:52:22 Last Updated: 2024-08-03T04:07:02.578Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Foxit Products: PDF Reader Problem Types: CWE-416 Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.1.0.52543. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of AcroForms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attac
ue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15877. Additional Analyst Notes: - CVE Program Container: References: - https://www.foxit.com/support/security-bulletins.html - https://www.zerodayinitiative.com/advisories/ZDI-22-278/
CVE ID: CVE-2022-24368 State: PUBLISHED Published: 2022-02-18T19:52:24 Last Updated: 2024-08-03T04:07:02.468Z Severity: LOW (CVSS 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: Foxit Products: PDF Reader Problem Types: CWE-416 Description: This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader 11.1.0.52543. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of Doc objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object.
. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-16115. Additional Analyst Notes: - CVE Program Container: References: - https://www.foxit.com/support/security-bulletins.html - https://www.zerodayinitiative.com/advisories/ZDI-22-279/
CVE ID: CVE-2022-24369 State: PUBLISHED Published: 2022-02-18T19:52:25 Last Updated: 2024-08-03T04:07:02.540Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Foxit Products: PDF Reader Problem Types: CWE-787 Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.1.0.52543. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JP2 images. Crafted data in a JP2 image can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerabilit
data in a JP2 image can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-16087. Additional Analyst Notes: - CVE Program Container: References: - https://www.foxit.com/support/security-bulletins.html - https://www.zerodayinitiative.com/advisories/ZDI-22-280/
CVE ID: CVE-2022-24370 State: PUBLISHED Published: 2022-02-18T19:52:26 Last Updated: 2024-08-03T04:07:02.424Z Severity: LOW (CVSS 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: Foxit Products: PDF Reader Problem Types: CWE-125 Description: This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader Foxit reader 11.0.1.0719 macOS. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of XFA forms. The issue results from the lack of proper validation of user-supplied data, which can result in a read
ing of XFA forms. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-14819. Additional Analyst Notes: - CVE Program Container: References: - https://www.foxit.com/support/security-bulletins.html - https://www.zerodayinitiative.com/advisories/ZDI-22-266/
CVE ID: CVE-2022-24372 State: PUBLISHED Published: 2022-04-27T17:23:41 Last Updated: 2024-08-03T04:07:02.428Z Vendors: n/a Products: n/a Problem Types: n/a Description: Linksys MR9600 devices before 2.0.5 allow attackers to read arbitrary files via a symbolic link to the root directory of a NAS SMB share. Additional Analyst Notes: - CVE Program Container: References: - https://www.linksys.com/mesh-routers/linksys-dual-band-mesh-wifi-6-router-mr9600/p/p-mr9600/ - https://www.linksys.com/de/linksys-dual-band-mesh-wifi-6-router-mr9600/p/p-mr9600/ - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2021-046.txt
CVE ID: CVE-2022-24373 State: PUBLISHED Published: 2022-09-30T05:00:17.564Z Last Updated: 2025-05-20T20:15:02.309Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P) Vendors: n/a Products: react-native-reanimated Problem Types: Regular Expression Denial of Service (ReDoS) Description: The package react-native-reanimated before 3.0.0-rc.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper usage of regular expression in the parser of Colors.js. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-JS-REACTNATIVEREANIMATED-2949507 - https://github.com/software-mansion/rea
erences: - https://security.snyk.io/vuln/SNYK-JS-REACTNATIVEREANIMATED-2949507 - https://github.com/software-mansion/react-native-reanimated/pull/3382 - https://github.com/software-mansion/react-native-reanimated/pull/3382/commits/7adf06d0c59382d884a04be86a96eede3d0432fa - https://github.com/software-mansion/react-native-reanimated/releases/tag/3.0.0-rc.1
CVE ID: CVE-2022-24374 State: PUBLISHED Published: 2022-02-24T09:50:32 Last Updated: 2024-08-03T04:07:02.425Z Vendors: appleple inc. Products: a-blog cms Problem Types: Cross-site scripting Description: Cross-site scripting vulnerability in a-blog cms Ver.2.8.x series versions prior to Ver.2.8.75, Ver.2.9.x series versions prior to Ver.2.9.40, Ver.2.10.x series versions prior to Ver.2.10.44, Ver.2.11.x series versions prior to Ver.2.11.42, and Ver.3.0.x series versions prior to Ver.3.0.1 allows a remote authenticated attacker to inject an arbitrary script via unspecified vectors. This vulnerability is different from CVE-2022-23916. Additional Analyst Notes: - CVE Program Container: Reference
ctors. This vulnerability is different from CVE-2022-23916. Additional Analyst Notes: - CVE Program Container: References: - https://developer.a-blogcms.jp/blog/news/security-202202.html - https://jvn.jp/en/jp/JVN14706307/index.html
CVE ID: CVE-2022-24375 State: PUBLISHED Published: 2022-08-24T05:05:12.475839Z Last Updated: 2024-09-16T16:13:12.976Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P) Vendors: n/a Products: node-opcua Problem Types: Denial of Service (DoS) Description: The package node-opcua before 2.74.0 are vulnerable to Denial of Service (DoS) when bypassing the limitations for excessive memory consumption by sending multiple CloseSession requests with the deleteSubscription parameter equal to False. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/node-opcua/node-opcua/commit/7b5044b3f5866fbedc3efabd05e407352c07bd2f - https://github.com/node-op
- https://github.com/node-opcua/node-opcua/commit/7b5044b3f5866fbedc3efabd05e407352c07bd2f - https://github.com/node-opcua/node-opcua/pull/1182 - https://security.snyk.io/vuln/SNYK-JS-NODEOPCUA-2988725 - https://github.com/node-opcua/node-opcua/commit/3fd46ec156e7718a506be41f3916310b6bdd0407
CVE ID: CVE-2022-24376 State: PUBLISHED Published: 2022-06-10T20:05:25.958534Z Last Updated: 2024-09-16T20:11:49.507Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: n/a Products: git-promise Problem Types: Command Injection Description: All versions of package git-promise are vulnerable to Command Injection due to an inappropriate fix of a prior [vulnerability](https://security.snyk.io/vuln/SNYK-JS-GITPROMISE-567476) in this package. **Note:** Please note that the vulnerability will not be fixed. The README file was updated with a warning regarding this issue. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-GITPRO
garding this issue. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-GITPROMISE-2434310 - https://gist.github.com/lirantal/9da1fceb32f5279eb76a5fc1cb9707dd
CVE ID: CVE-2022-24377 State: PUBLISHED Published: 2022-12-15T03:44:03.964Z Last Updated: 2025-04-17T18:32:28.448Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P) Vendors: n/a Products: cycle-import-check Problem Types: Command Injection Description: The package cycle-import-check before 1.3.2 are vulnerable to Command Injection via the writeFileToTmpDirAndOpenIt function due to improper user-input sanitization. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-JS-CYCLEIMPORTCHECK-3157955 - https://github.com/Soontao/cycle-import-check/commit/1ca97b59df7e9c704471fcb4cf042ce76d7c9890
CVE ID: CVE-2022-24378 State: PUBLISHED Published: 2022-08-18T19:53:03.000Z Last Updated: 2025-05-05T16:24:21.434Z Vendors: n/a Products: Intel(R) Data Center Manager software Problem Types: denial of service Description: Improper initialization in the Intel(R) Data Center Manager software before version 4.1 may allow an authenticated user to potentially enable denial of service via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00662.html
CVE ID: CVE-2022-24379 State: PUBLISHED Published: 2023-11-14T19:05:10.089Z Last Updated: 2024-08-30T15:55:43.241Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) Server System M70KLP Family BIOS firmware Problem Types: escalation of privilege, CWE-20 Description: Improper input validation in some Intel(R) Server System M70KLP Family BIOS firmware before version 01.04.0029 may allow a privileged user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00719.html
CVE ID: CVE-2022-24381 State: PUBLISHED Published: 2022-08-23T05:08:09.708695Z Last Updated: 2024-09-16T17:18:30.181Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P) Vendors: n/a Products: ASNeG/OpcUaStack Problem Types: Denial of Service (DoS) Description: All versions of package asneg/opcuastack are vulnerable to Denial of Service (DoS) due to a missing limitation on the number of received chunks - per single session or in total for all concurrent sessions. An attacker can exploit this vulnerability by sending an unlimited number of huge chunks (e.g. 2GB each) without sending the Final closing chunk. Additional Analyst Notes: - CVE Program Container: References:
(e.g. 2GB each) without sending the Final closing chunk. Additional Analyst Notes: - CVE Program Container: References: - https://security.snyk.io/vuln/SNYK-UNMANAGED-ASNEGOPCUASTACK-2988735
CVE ID: CVE-2022-24382 State: PUBLISHED Published: 2022-05-12T16:35:51.000Z Last Updated: 2025-05-05T16:24:12.155Z Vendors: n/a Products: Intel(R) NUCs Problem Types: escalation of privilege Description: Improper input validation in firmware for some Intel(R) NUCs may allow a privileged user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00654.html
CVE ID: CVE-2022-24383 State: PUBLISHED Published: 2022-04-12T16:11:53.500Z Last Updated: 2025-04-16T17:55:50.569Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Fuji Electric Products: Alpha5 Problem Types: CWE-125 Description: The affected product is vulnerable to an out-of-bounds read, which may result in code execution Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-090-03
CVE ID: CVE-2022-24384 State: PUBLISHED Published: 2022-03-14T00:00:00Z Last Updated: 2025-03-11T13:40:41.607Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: SmarterTools Products: SmarterTrack Problem Types: CWE-79 Description: Cross-site Scripting (XSS) vulnerability in SmarterTools SmarterTrack This issue affects: SmarterTools SmarterTrack 100.0.8019.14010. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://csirt.divd.nl/DIVD-2021-00029 - https://csirt.divd.nl/CVE-2022-24384
CVE ID: CVE-2022-24385 State: PUBLISHED Published: 2022-03-14T00:00:00Z Last Updated: 2025-03-11T13:40:44.472Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: SmarterTools Products: SmarterTrack Problem Types: CWE-425 Description: A Direct Object Access vulnerability in SmarterTools SmarterTrack leads to information disclosure This issue affects: SmarterTools SmarterTrack 100.0.8019.14010. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://csirt.divd.nl/DIVD-2021-00029 - https://csirt.divd.nl/CVE-2022-24385
CVE ID: CVE-2022-24386 State: PUBLISHED Published: 2022-03-14T00:00:00Z Last Updated: 2025-03-11T13:40:43.047Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: SmarterTools Products: SmarterTrack Problem Types: CWE-79 Description: Stored XSS in SmarterTools SmarterTrack This issue affects: SmarterTools SmarterTrack 100.0.8019.14010. Additional Analyst Notes: - CVE Program Container: References: - https://csirt.divd.nl/DIVD-2021-00029 - https://csirt.divd.nl/CVE-2022-24386
CVE ID: CVE-2022-24387 State: PUBLISHED Published: 2022-03-14T12:15:59 Last Updated: 2025-03-11T13:39:25.911Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: SmarterTools Products: SmarterTrack Problem Types: CWE-434 Description: With administrator or admin privileges the application can be tricked into overwriting files in app_data/Config folder, e.g. the systemsettings.xml file. THis is possible in SmarterTrack v100.0.8019.14010 Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://csirt.divd.nl/DIVD-2021-00029 - https://csirt.divd.nl/CVE-2022-24387/
CVE ID: CVE-2022-24388 State: PUBLISHED Published: 2022-05-17T19:30:26.070523Z Last Updated: 2024-09-16T20:17:22.513Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Fidelis Cybersecurity Products: Fidelis Network, Fidelis Deception Problem Types: CWE-78 Description: Vulnerability in rconfig “date” enables an attacker with user level access to the CLI to inject root level commands into Fidelis Network and Deception CommandPost, Collector, Sensor, and Sandbox components as well as neighboring Fidelis components. The vulnerability is present in Fidelis Network and Deception versions prior to 9.4.5. Patches and updates are available to address this vulnerability.
Fidelis Network and Deception versions prior to 9.4.5. Patches and updates are available to address this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://fidelissecurity.zendesk.com/hc/en-us/articles/6211730139411
CVE ID: CVE-2022-24389 State: PUBLISHED Published: 2022-05-17T19:28:43.842733Z Last Updated: 2024-09-16T18:50:26.653Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Fidelis Cybersecurity Products: Fidelis Network, Fidelis Deception Problem Types: CWE-78 Description: Vulnerability in rconfig “cert_utils” enables an attacker with user level access to the CLI to inject root level commands into Fidelis Network and Deception CommandPost, Collector, Sensor, and Sandbox components as well as neighboring Fidelis components. The vulnerability is present in Fidelis Network and Deception versions prior to 9.4.5. Patches and updates are available to address this vulnerab
ent in Fidelis Network and Deception versions prior to 9.4.5. Patches and updates are available to address this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://fidelissecurity.zendesk.com/hc/en-us/articles/6211730139411
CVE ID: CVE-2022-24390 State: PUBLISHED Published: 2022-05-17T19:27:50.200006Z Last Updated: 2024-09-16T16:47:38.074Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Fidelis Cybersecurity Products: Fidelis Network, Fidelis Deception Problem Types: CWE-78 Description: Vulnerability in rconfig “remote_text_file” enables an attacker with user level access to the CLI to inject user level commands into Fidelis Network and Deception CommandPost, Collector, Sensor, and Sandbox components as well as neighboring Fidelis components. The vulnerability is present in Fidelis Network and Deception versions prior to 9.4.5. Patches and updates are available to address this vu
s present in Fidelis Network and Deception versions prior to 9.4.5. Patches and updates are available to address this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://fidelissecurity.zendesk.com/hc/en-us/articles/6211730139411
CVE ID: CVE-2022-24391 State: PUBLISHED Published: 2022-05-17T19:26:54.874649Z Last Updated: 2024-09-16T23:26:20.130Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Fidelis Cybersecurity Products: Fidelis Network, Fidelis Deception Problem Types: CWE-89 Description: Vulnerability in Fidelis Network and Deception CommandPost enables SQL injection through the web interface by an attacker with user level access. The vulnerability is present in Fidelis Network and Deception versions prior to 9.4.5. Patches and updates are available to address this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://fidelissecurity.zendesk.com/h
is vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://fidelissecurity.zendesk.com/hc/en-us/articles/6211730139411
CVE ID: CVE-2022-24392 State: PUBLISHED Published: 2022-05-17T19:26:01.470821Z Last Updated: 2024-09-16T16:12:26.172Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Fidelis Cybersecurity Products: Fidelis Network, Fidelis Deception Problem Types: CWE-78 Description: Vulnerability in Fidelis Network and Deception CommandPost enables authenticated command injection through the web interface using the “feed_comm_test” value for the “feed” parameter. The vulnerability could allow a specially crafted HTTP request to execute system commands on the CommandPost and return results in an HTTP response via an authenticated session. The vulnerability is present in Fideli
CommandPost and return results in an HTTP response via an authenticated session. The vulnerability is present in Fidelis Network and Deception versions prior to 9.4.5. Patches and updates are available to address this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://fidelissecurity.zendesk.com/hc/en-us/articles/6211730139411
CVE ID: CVE-2022-24393 State: PUBLISHED Published: 2022-05-17T19:24:36.438499Z Last Updated: 2024-09-16T23:00:32.129Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Fidelis Cybersecurity Products: Fidelis Network, Fidelis Deception Problem Types: CWE-78 Description: Vulnerability in Fidelis Network and Deception CommandPost enables authenticated command injection through the web interface using the “check_vertica_upgrade” value for the “cpIp” parameter. The vulnerability could allow a specially crafted HTTP request to execute system commands on the CommandPost and return results in an HTTP response via an authenticated session. The vulnerability is present in
on the CommandPost and return results in an HTTP response via an authenticated session. The vulnerability is present in Fidelis Network and Deception versions prior to 9.4.5. Patches and updates are available to address this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://fidelissecurity.zendesk.com/hc/en-us/articles/6211730139411
CVE ID: CVE-2022-24394 State: PUBLISHED Published: 2022-05-17T19:22:26.993211Z Last Updated: 2024-09-17T03:59:09.816Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Fidelis Cybersecurity Products: Fidelis Network, Fidelis Deception Problem Types: CWE-78 Description: Vulnerability in Fidelis Network and Deception CommandPost enables authenticated command injection through the web interface using the “update_checkfile” value for the “filename” parameter. The vulnerability could allow a specially crafted HTTP request to execute system commands on the CommandPost and return results in an HTTP response via an authenticated session. The vulnerability is present in
CVE ID: CVE-2022-24395 State: PUBLISHED Published: 2022-03-08T13:36:02 Last Updated: 2024-08-03T04:07:02.599Z Vendors: SAP SE Products: SAP NetWeaver Enterprise Portal Problem Types: CWE-79 Description: SAP NetWeaver Enterprise Portal - versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs, resulting in reflected Cross-Site Scripting (XSS) vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://dam.sap.com/mac/embed/public/pdf/a/ucQrx6G.htm?rc=10 - https://launchpad.support.sap.com/#/notes/3146261
CVE ID: CVE-2022-24396 State: PUBLISHED Published: 2022-03-08T13:35:46 Last Updated: 2024-08-03T04:07:02.528Z Vendors: SAP SE Products: SAP Focused Run (Simple Diagnostics Agent) Problem Types: CWE-306 Description: The Simple Diagnostics Agent - versions 1.0 up to version 1.57, does not perform any authentication checks for functionalities that can be accessed via localhost on http port 3005. Due to lack of authentication checks, an attacker could access administrative or other privileged functionalities and read, modify, or delete sensitive information and configurations. Additional Analyst Notes: - CVE Program Container: References: - https://dam.sap.com/mac/embed/public/pdf/a/ucQrx6G.htm?