Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-25230 State: PUBLISHED Published: 2022-03-07T09:00:40 Last Updated: 2024-08-03T04:36:06.681Z Vendors: OMRON Corporation Products: CX-Programmer Problem Types: Use after free Description: Use after free vulnerability in CX-Programmer v9.76.1 and earlier which is a part of CX-One (v4.60) suite allows an attacker to cause information disclosure and/or arbitrary code execution by having a user to open a specially crafted CXP file. This vulnerability is different from CVE-2022-25325. Additional Analyst Notes: - CVE Program Container: References: - https://jvn.jp/en/vu/JVNVU90121984/index.html
CVE ID: CVE-2022-25231 State: PUBLISHED Published: 2022-08-23T05:05:45.808546Z Last Updated: 2024-09-16T23:46:37.049Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P) Vendors: n/a Products: node-opcua Problem Types: Denial of Service (DoS) Description: The package node-opcua before 2.74.0 are vulnerable to Denial of Service (DoS) by sending a specifically crafted OPC UA message with a special OPC UA NodeID, when the requested memory allocation exceeds the v8’s memory limit. Additional Analyst Notes: - CVE Program Container: References: - https://security.snyk.io/vuln/SNYK-JS-NODEOPCUA-2988724 - https://github.com/node-opcua/node-opcua/commit/7b5044b3f5866fbedc3efabd
curity.snyk.io/vuln/SNYK-JS-NODEOPCUA-2988724 - https://github.com/node-opcua/node-opcua/commit/7b5044b3f5866fbedc3efabd05e407352c07bd2f - https://github.com/node-opcua/node-opcua/pull/1182
CVE ID: CVE-2022-25234 State: PUBLISHED Published: 2022-03-07T09:00:41 Last Updated: 2024-08-03T04:36:06.429Z Vendors: OMRON Corporation Products: CX-Programmer Problem Types: Out-of-bounds write Description: Out-of-bounds write vulnerability in CX-Programmer v9.76.1 and earlier which is a part of CX-One (v4.60) suite allows an attacker to cause information disclosure and/or arbitrary code execution by having a user to open a specially crafted CXP file. This vulnerability is different from CVE-2022-21124. Additional Analyst Notes: - CVE Program Container: References: - https://jvn.jp/en/vu/JVNVU90121984/index.html
CVE ID: CVE-2022-25235 State: PUBLISHED Published: 2022-02-16T00:40:20.000Z Last Updated: 2025-05-05T16:23:52.716Z Vendors: n/a Products: n/a Problem Types: n/a Description: xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is valid in a certain context. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/libexpat/libexpat/pull/562 - http://www.openwall.com/lists/oss-security/2022/02/19/1 - https://www.debian.org/security/2022/dsa-5085 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3UFRBA3UQVIQKXTBUQXD
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3UFRBA3UQVIQKXTBUQXDWQOVWNBKLERU/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y27XO3JMKAOMQZVPS3B4MJGEAHCZF5OM/ - https://lists.debian.org/debian-lts-announce/2022/03/msg00007.html - https://www.oracle.com/security-alerts/cpuapr2022.html - https://security.netapp.com/advisory/ntap-20220303-0008/ - https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf - https://security.gentoo.org/glsa/202209-24
CVE ID: CVE-2022-25236 State: PUBLISHED Published: 2022-02-16T00:39:16.000Z Last Updated: 2025-05-05T16:23:43.998Z Vendors: n/a Products: n/a Problem Types: n/a Description: xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/libexpat/libexpat/pull/561 - http://www.openwall.com/lists/oss-security/2022/02/19/1 - https://www.debian.org/security/2022/dsa-5085 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3UFRBA3UQVIQKXTBUQXDWQOVWNBKLERU/ - https://lists.fedorapr
hives/list/package-announce%40lists.fedoraproject.org/message/3UFRBA3UQVIQKXTBUQXDWQOVWNBKLERU/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y27XO3JMKAOMQZVPS3B4MJGEAHCZF5OM/ - https://lists.debian.org/debian-lts-announce/2022/03/msg00007.html - https://www.oracle.com/security-alerts/cpuapr2022.html - https://security.netapp.com/advisory/ntap-20220303-0008/ - http://packetstormsecurity.com/files/167238/Zoom-XMPP-Stanza-Smuggling-Remote-Code-Execution.html - https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf - https://security.gentoo.org/glsa/202209-24
CVE ID: CVE-2022-25237 State: PUBLISHED Published: 2022-05-27T16:48:43 Last Updated: 2024-08-03T04:36:06.493Z Vendors: n/a Products: n/a Problem Types: n/a Description: Bonita Web 2021.2 is affected by a authentication/authorization bypass vulnerability due to an overly broad exclude pattern used in the RestAPIAuthorizationFilter. By appending ;i18ntranslation or /../i18ntranslation/ to the end of a URL, users with no privileges can access privileged API endpoints. This can lead to remote code execution by abusing the privileged API actions. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/bonitasoft/bonita-web - https://rhinosecuritylabs.com/application-se
Program Container: References: - https://github.com/bonitasoft/bonita-web - https://rhinosecuritylabs.com/application-security/cve-2022-25237-bonitasoft-authorization-bypass/
CVE ID: CVE-2022-25238 State: PUBLISHED Published: 2022-06-28T21:39:48 Last Updated: 2024-08-03T04:36:06.421Z Vendors: n/a Products: n/a Problem Types: n/a Description: Silverstripe silverstripe/framework through 4.10.0 allows XSS, inside of script tags that can can be added to website content via XHR by an authenticated CMS user if the cwp-core module is not installed on the sanitise_server_side contig is not set to true in project code. Additional Analyst Notes: - CVE Program Container: References: - https://www.silverstripe.org/download/security-releases/ - https://www.silverstripe.org/blog/tag/release - https://forum.silverstripe.org/c/releases - https://docs.silverstripe.org/en/4/change
ilverstripe.org/blog/tag/release - https://forum.silverstripe.org/c/releases - https://docs.silverstripe.org/en/4/changelogs/4.10.1/
CVE ID: CVE-2022-25241 State: PUBLISHED Published: 2022-02-16T01:26:06 Last Updated: 2024-08-03T04:36:06.534Z Vendors: n/a Products: n/a Problem Types: n/a Description: In FileCloud before 21.3, the CSV user import functionality is vulnerable to Cross-Site Request Forgery (CSRF). Additional Analyst Notes: - CVE Program Container: References: - https://herolab.usd.de/security-advisories/ - https://www.filecloud.com/supportdocs/display/cloud/Advisory+2022-01-3+Threat+of+CSRF+via+User+Creation - http://packetstormsecurity.com/files/166074/FileCloud-21.2-Cross-Site-Request-Forgery.html
CVE ID: CVE-2022-25242 State: PUBLISHED Published: 2022-02-16T01:25:53 Last Updated: 2024-08-03T04:36:06.544Z Vendors: n/a Products: n/a Problem Types: n/a Description: In FileCloud before 21.3, file upload is not protected against Cross-Site Request Forgery (CSRF). Additional Analyst Notes: - CVE Program Container: References: - https://herolab.usd.de/security-advisories/ - https://www.filecloud.com/supportdocs/display/cloud/Advisory+2022-01-2+Threat+of+CSRF+via+File+Upload
CVE ID: CVE-2022-25243 State: PUBLISHED Published: 2022-03-07T21:45:16 Last Updated: 2024-08-03T04:36:06.555Z Vendors: n/a Products: n/a Problem Types: n/a Description: "Vault and Vault Enterprise 1.8.0 through 1.8.8, and 1.9.3 allowed the PKI secrets engine under certain configurations to issue wildcard certificates to authorized users for a specified domain, even if the PKI role policy attribute allow_subdomains is set to false. Fixed in Vault Enterprise 1.8.9 and 1.9.4. Additional Analyst Notes: - CVE Program Container: References: - https://discuss.hashicorp.com - https://discuss.hashicorp.com/t/hcsec-2022-09-vault-pki-secrets-engine-policy-results-in-incorrect-wildcard-certificate-issua
://discuss.hashicorp.com/t/hcsec-2022-09-vault-pki-secrets-engine-policy-results-in-incorrect-wildcard-certificate-issuance/36600 - https://security.gentoo.org/glsa/202207-01
CVE ID: CVE-2022-25244 State: PUBLISHED Published: 2022-03-07T21:41:52 Last Updated: 2024-08-03T04:36:06.580Z Vendors: n/a Products: n/a Problem Types: n/a Description: Vault Enterprise clusters using the tokenization transform feature can expose the tokenization key through the tokenization key configuration endpoint to authorized operators with `read` permissions on this endpoint. Fixed in Vault Enterprise 1.9.4, 1.8.9 and 1.7.10. Additional Analyst Notes: - CVE Program Container: References: - https://discuss.hashicorp.com - https://discuss.hashicorp.com/t/hcsec-2022-08-vault-enterprise-s-tokenization-transform-configuration-endpoint-may-expose-transform-key/36599
CVE ID: CVE-2022-25245 State: PUBLISHED Published: 2022-04-05T18:27:38 Last Updated: 2024-08-03T04:36:06.533Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine ServiceDesk Plus before 13001 allows anyone to know the organisation's default currency name. Additional Analyst Notes: - CVE Program Container: References: - https://manageengine.com - https://www.manageengine.com/products/service-desk/cve-2022-25245.html - https://raxis.com/blog/cve-2022-25245
CVE ID: CVE-2022-25246 State: PUBLISHED Published: 2022-03-16T14:03:31.142Z Last Updated: 2025-04-16T16:42:53.542Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: PTC Products: Axeda agent, Axeda Desktop Server for Windows Problem Types: CWE-798 Description: Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) uses hard-coded credentials for its UltraVNC installation. Successful exploitation of this vulnerability could allow a remote authenticated attacker to take full remote control of the host operating system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/i
Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-067-01 - https://www.ptc.com/en/support/article/CS363561
CVE ID: CVE-2022-25247 State: PUBLISHED Published: 2022-03-16T14:03:29.947Z Last Updated: 2025-04-16T16:43:03.219Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: PTC Products: Axeda agent, Axeda Desktop Server for Windows Problem Types: CWE-306 Description: Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) may allow an attacker to send certain commands to a specific port without authentication. Successful exploitation of this vulnerability could allow a remote unauthenticated attacker to obtain full file-system access and remote code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Referen
em access and remote code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-067-01 - https://www.ptc.com/en/support/article/CS363561
CVE ID: CVE-2022-25248 State: PUBLISHED Published: 2022-03-16T14:03:32.150Z Last Updated: 2025-04-16T16:42:45.374Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: PTC Products: Axeda agent, Axeda Desktop Server for Windows Problem Types: CWE-200 Description: When connecting to a certain port Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) supplies the event log of the specific service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-067-01 - https://www.ptc.com/en/support/article/CS363561
CVE ID: CVE-2022-25249 State: PUBLISHED Published: 2022-03-16T14:03:33.369Z Last Updated: 2025-04-16T16:42:33.948Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: PTC Products: Axeda agent, Axeda Desktop Server for Windows Problem Types: CWE-22 Description: When connecting to a certain port Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) (disregarding Axeda agent v6.9.2 and v6.9.3) is vulnerable to directory traversal, which could allow a remote unauthenticated attacker to obtain file system read access via web server.. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/
server.. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-067-01 - https://www.ptc.com/en/support/article/CS363561
CVE ID: CVE-2022-25250 State: PUBLISHED Published: 2022-03-16T14:03:34.493Z Last Updated: 2025-04-16T16:42:25.954Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: PTC Products: Axeda agent, Axeda Desktop Server for Windows Problem Types: CWE-306 Description: When connecting to a certain port Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) may allow an attacker to send a certain command to a specific port without authentication. Successful exploitation of this vulnerability could allow a remote unauthenticated attacker to shut down a specific service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Refe
tacker to shut down a specific service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-067-01 - https://www.ptc.com/en/support/article/CS363561
CVE ID: CVE-2022-25251 State: PUBLISHED Published: 2022-03-16T14:03:36.591Z Last Updated: 2025-04-16T16:42:06.086Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: PTC Products: Axeda agent, Axeda Desktop Server for Windows Problem Types: CWE-306 Description: When connecting to a certain port Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) may allow an attacker to send certain XML messages to a specific port without proper authentication. Successful exploitation of this vulnerability could allow a remote unauthenticated attacker to read and modify the affected product’s configuration. Additional Analyst Notes: - CVE Program Co
thenticated attacker to read and modify the affected product’s configuration. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-067-01 - https://www.ptc.com/en/support/article/CS363561
CVE ID: CVE-2022-25252 State: PUBLISHED Published: 2022-03-16T14:03:35.553Z Last Updated: 2025-04-16T16:42:15.447Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: PTC Products: Axeda agent, Axeda Desktop Server for Windows Problem Types: CWE-703 Description: When connecting to a certain port Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) when receiving certain input throws an exception. Services using said function do not handle the exception. Successful exploitation of this vulnerability could allow a remote unauthenticated attacker to crash the affected product. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vul
nauthenticated attacker to crash the affected product. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-067-01 - https://www.ptc.com/en/support/article/CS363561
CVE ID: CVE-2022-25255 State: PUBLISHED Published: 2022-02-16T18:48:35 Last Updated: 2024-08-03T04:36:06.650Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Qt 5.9.x through 5.15.x before 5.15.9 and 6.x before 6.2.4 on Linux and UNIX, QProcess could execute a binary from the current working directory when not found in the PATH. Additional Analyst Notes: - CVE Program Container: References: - https://codereview.qt-project.org/c/qt/qtbase/+/393113 - https://codereview.qt-project.org/c/qt/qtbase/+/394914 - https://download.qt.io/official_releases/qt/6.2/qprocess6-2.diff - https://download.qt.io/official_releases/qt/5.15/qprocess5-15.diff - https://codereview.qt-project.org/c/qt/q
6-2.diff - https://download.qt.io/official_releases/qt/5.15/qprocess5-15.diff - https://codereview.qt-project.org/c/qt/qtbase/+/396020
CVE ID: CVE-2022-25256 State: PUBLISHED Published: 2022-02-19T00:17:15 Last Updated: 2024-08-03T04:36:06.574Z Vendors: n/a Products: n/a Problem Types: n/a Description: SAS Web Report Studio 4.4 allows XSS. /SASWebReportStudio/logonAndRender.do has two parameters: saspfs_request_backlabel_list and saspfs_request_backurl_list. The first one affects the content of the button placed in the top left. The second affects the page to which the user is directed after pressing the button, e.g., a malicious web page. In addition, the second parameter executes JavaScript, which means XSS is possible by adding a javascript: URL. Additional Analyst Notes: - CVE Program Container: References: - https://sa
XSS is possible by adding a javascript: URL. Additional Analyst Notes: - CVE Program Container: References: - https://sas.com - https://github.com/RobertDra/CVE-2022-25256 - https://support.sas.com/kb/62/972.html
CVE ID: CVE-2022-25258 State: PUBLISHED Published: 2022-02-16T00:00:00 Last Updated: 2024-08-03T04:36:06.563Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in drivers/usb/gadget/composite.c in the Linux kernel before 5.16.10. The USB Gadget subsystem lacks certain validation of interface OS descriptor requests (ones with a large array index and ones associated with NULL function pointer retrieval). Memory corruption might occur. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/torvalds/linux/commit/75e5b4849b81e19e9efe1654b30d7f3151c33c2c - https://github.com/szymonh/d-os-descriptor - https://cdn.kernel.org/pub/linux/ker
b4849b81e19e9efe1654b30d7f3151c33c2c - https://github.com/szymonh/d-os-descriptor - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.16.10 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TCW2KZYJ2H6BKZE3CVLHRIXYDGNYYC5P/ - https://www.debian.org/security/2022/dsa-5092 - https://lists.debian.org/debian-lts-announce/2022/03/msg00011.html - https://lists.debian.org/debian-lts-announce/2022/03/msg00012.html - https://www.debian.org/security/2022/dsa-5096 - https://security.netapp.com/advisory/ntap-20221028-0007/
CVE ID: CVE-2022-25259 State: PUBLISHED Published: 2022-02-25T20:01:27 Last Updated: 2024-08-03T04:36:06.557Z Vendors: n/a Products: n/a Problem Types: n/a Description: JetBrains Hub before 2021.1.14276 was vulnerable to reflected XSS. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jetbrains.com - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2022-25260 State: PUBLISHED Published: 2022-02-25T20:01:18 Last Updated: 2024-08-03T04:36:06.544Z Vendors: n/a Products: n/a Problem Types: n/a Description: JetBrains Hub before 2021.1.14276 was vulnerable to blind Server-Side Request Forgery (SSRF). Additional Analyst Notes: - CVE Program Container: References: - https://blog.jetbrains.com - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2022-25261 State: PUBLISHED Published: 2022-02-25T19:59:36 Last Updated: 2024-08-03T04:36:06.572Z Vendors: n/a Products: n/a Problem Types: n/a Description: JetBrains TeamCity before 2021.2.2 was vulnerable to reflected XSS. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jetbrains.com - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2022-25262 State: PUBLISHED Published: 2022-02-25T19:59:29 Last Updated: 2024-08-03T04:36:06.652Z Vendors: n/a Products: n/a Problem Types: n/a Description: In JetBrains Hub before 2022.1.14434, SAML request takeover was possible. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jetbrains.com - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2022-25263 State: PUBLISHED Published: 2022-02-25T19:59:20 Last Updated: 2024-08-03T04:36:06.577Z Vendors: n/a Products: n/a Problem Types: n/a Description: JetBrains TeamCity before 2021.2.3 was vulnerable to OS command injection in the Agent Push feature configuration. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jetbrains.com - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2022-25264 State: PUBLISHED Published: 2022-02-25T19:59:05 Last Updated: 2024-08-03T04:36:06.534Z Vendors: n/a Products: n/a Problem Types: n/a Description: In JetBrains TeamCity before 2021.2.3, environment variables of the "password" type could be logged in some cases. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jetbrains.com - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2022-25265 State: PUBLISHED Published: 2022-02-16T20:30:51 Last Updated: 2024-08-03T04:36:06.561Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the Linux kernel through 5.16.10, certain binary files may have the exec-all attribute if they were built in approximately 2003 (e.g., with GCC 3.2.2 and Linux kernel 2.4.20). This can cause execution of bytes located in supposedly non-executable regions of a file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/x0reaxeax/exec-prot-bypass - https://github.com/torvalds/linux/blob/1c33bb0507508af24fd754dd7123bd8e997fab2f/arch/x86/include/asm/elf.h#L281-L294 - https://security.netapp.com/ad
inux/blob/1c33bb0507508af24fd754dd7123bd8e997fab2f/arch/x86/include/asm/elf.h#L281-L294 - https://security.netapp.com/advisory/ntap-20220318-0005/
CVE ID: CVE-2022-25266 State: PUBLISHED Published: 2022-03-23T22:06:54 Last Updated: 2024-08-03T04:36:06.671Z Vendors: n/a Products: n/a Problem Types: n/a Description: Passwork On-Premise Edition before 4.6.13 allows migration/downloadExportFile Directory Traversal (to read files). Additional Analyst Notes: - CVE Program Container: References: - https://passwork.me - https://gist.github.com/garakh/e0e2fe6d6e234f0595dea6a8141568f2
CVE ID: CVE-2022-25267 State: PUBLISHED Published: 2022-03-23T22:06:24 Last Updated: 2024-08-03T04:36:06.570Z Vendors: n/a Products: n/a Problem Types: n/a Description: Passwork On-Premise Edition before 4.6.13 allows migration/uploadExportFile Directory Traversal (to upload files). Additional Analyst Notes: - CVE Program Container: References: - https://passwork.me - https://gist.github.com/garakh/e0e2fe6d6e234f0595dea6a8141568f2
CVE ID: CVE-2022-25268 State: PUBLISHED Published: 2022-03-23T22:06:32 Last Updated: 2024-08-03T04:36:06.572Z Vendors: n/a Products: n/a Problem Types: n/a Description: Passwork On-Premise Edition before 4.6.13 allows CSRF via the groups, password, and history subsystems. Additional Analyst Notes: - CVE Program Container: References: - https://passwork.me - https://gist.github.com/garakh/e0e2fe6d6e234f0595dea6a8141568f2
CVE ID: CVE-2022-25269 State: PUBLISHED Published: 2022-03-23T22:06:43 Last Updated: 2024-08-03T04:36:06.583Z Vendors: n/a Products: n/a Problem Types: n/a Description: Passwork On-Premise Edition before 4.6.13 has multiple XSS issues. Additional Analyst Notes: - CVE Program Container: References: - https://passwork.me - https://gist.github.com/garakh/e0e2fe6d6e234f0595dea6a8141568f2
CVE ID: CVE-2022-25270 State: PUBLISHED Published: 2022-02-16T23:15:11 Last Updated: 2024-08-03T04:36:06.648Z Vendors: Drupal Products: Core Problem Types: Information disclosure Description: The Quick Edit module does not properly check entity access in some circumstances. This could result in users with the "access in-place editing" permission viewing some content they are are not authorized to access. Sites are only affected if the QuickEdit module (which comes with the Standard profile) is installed. Additional Analyst Notes: - CVE Program Container: References: - https://www.drupal.org/sa-core-2022-004