Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-37601 State: PUBLISHED Published: 2022-10-12T00:00:00 Last Updated: 2024-10-28T19:41:38.297Z Vendors: n/a Products: n/a Problem Types: n/a Description: Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils via the name variable in parseQuery.js. This affects all versions prior to 1.4.1 and 2.0.3. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/webpack/loader-utils/blob/d9f4e23cf411d8556f8bac2d3bf05a6e0103b568/lib/parseQuery.js#L11 - https://github.com/webpack/loader-utils/blob/d9f4e23cf411d8556f8bac2d3bf05a6e0103b568/lib/parseQuery.js#L47 - https://github.com/webpack/load
bpack/loader-utils/blob/d9f4e23cf411d8556f8bac2d3bf05a6e0103b568/lib/parseQuery.js#L47 - https://github.com/webpack/loader-utils/issues/212 - https://github.com/webpack/loader-utils/issues/212#issuecomment-1319192884 - https://dl.acm.org/doi/abs/10.1145/3488932.3497769 - https://dl.acm.org/doi/pdf/10.1145/3488932.3497769 - http://users.encs.concordia.ca/~mmannan/publications/JS-vulnerability-aisaccs2022.pdf - https://github.com/xmldom/xmldom/issues/436#issuecomment-1319412826 - https://lists.debian.org/debian-lts-announce/2022/12/msg00044.html
CVE ID: CVE-2022-37602 State: PUBLISHED Published: 2022-10-14T00:00:00.000Z Last Updated: 2025-05-15T14:52:37.355Z Vendors: n/a Products: n/a Problem Types: n/a Description: Prototype pollution vulnerability in karma-runner grunt-karma 4.0.1 via the key variable in grunt-karma.js. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/karma-runner/grunt-karma/blob/45b925964f55870f375c6e670d9945b223c984f5/tasks/grunt-karma.js#L26 - https://github.com/karma-runner/grunt-karma/blob/45b925964f55870f375c6e670d9945b223c984f5/tasks/grunt-karma.js#L109 - https://github.com/karma-runner/grunt-karma/issues/311
CVE ID: CVE-2022-37603 State: PUBLISHED Published: 2022-10-14T00:00:00.000Z Last Updated: 2025-05-15T14:51:37.708Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.0 via the url variable in interpolateName.js. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/webpack/loader-utils/blob/d9f4e23cf411d8556f8bac2d3bf05a6e0103b568/lib/interpolateName.js#L38 - https://github.com/webpack/loader-utils/blob/d9f4e23cf411d8556f8bac2d3bf05a6e0103b568/lib/interpolateName.js#L107 - https://github.com/
com/webpack/loader-utils/blob/d9f4e23cf411d8556f8bac2d3bf05a6e0103b568/lib/interpolateName.js#L107 - https://github.com/webpack/loader-utils/issues/213 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KAC5KQ2SEWAMQ6UZAUBZ5KXKEOESH375/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ERN6YE3DS7NBW7UH44SCJBMNC2NWQ7SM/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VNV2GNZXOTEDAJRFH3ZYWRUBGIVL7BSU/
CVE ID: CVE-2022-37609 State: PUBLISHED Published: 2022-10-11T00:00:00 Last Updated: 2024-08-03T10:29:21.077Z Vendors: n/a Products: n/a Problem Types: n/a Description: Prototype pollution vulnerability in beautify-web js-beautify 1.13.7 via the name variable in options.js. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/beautify-web/js-beautify/blob/6fa891e982cc3d615eed9a1a20a4fc50721bff16/js/src/core/options.js#L167 - https://github.com/beautify-web/js-beautify/blob/6fa891e982cc3d615eed9a1a20a4fc50721bff16/js/src/core/options.js#L167.aa - https://github.com/beautify-web/js-beautify/issues/2106
CVE ID: CVE-2022-37611 State: PUBLISHED Published: 2022-10-12T00:00:00.000Z Last Updated: 2025-05-15T15:07:03.950Z Vendors: n/a Products: n/a Problem Types: n/a Description: Prototype pollution vulnerability in tschaub gh-pages 3.1.0 via the partial variable in util.js. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/tschaub/gh-pages/blob/e363b144defe8e555f5a54251a6f7f1297c0e3f6/lib/util.js#L11 - https://github.com/tschaub/gh-pages/blob/e363b144defe8e555f5a54251a6f7f1297c0e3f6/lib/util.js#L16 - https://github.com/tschaub/gh-pages/issues/446
CVE ID: CVE-2022-37614 State: PUBLISHED Published: 2022-10-12T00:00:00.000Z Last Updated: 2025-05-15T15:05:50.801Z Vendors: n/a Products: n/a Problem Types: n/a Description: Prototype pollution vulnerability in function enable in mockery.js in mfncooper mockery commit 822f0566fd6d72af8c943ae5ca2aa92e516aa2cf via the key variable in mockery.js. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/mfncooper/mockery/blob/822f0566fd6d72af8c943ae5ca2aa92e516aa2cf/mockery.js#L119 - https://github.com/mfncooper/mockery/blob/822f0566fd6d72af8c943ae5ca2aa92e516aa2cf/mockery.js#L62 - https://github.com/mfncooper/mockery/issues/77
CVE ID: CVE-2022-37616 State: PUBLISHED Published: 2022-10-11T00:00:00 Last Updated: 2024-08-03T10:29:21.029Z Vendors: n/a Products: n/a Problem Types: n/a Description: A prototype pollution vulnerability exists in the function copy in dom.js in the xmldom (published as @xmldom/xmldom) package before 0.8.3 for Node.js via the p variable. NOTE: the vendor states "we are in the process of marking this report as invalid"; however, some third parties takes the position that "A prototype injection/Prototype pollution is not just when global objects are polluted with recursive merge or deep cloning but also when a target object is polluted." Additional Analyst Notes: - CVE Program Container: Refer
rge or deep cloning but also when a target object is polluted." Additional Analyst Notes: - CVE Program Container: References: - https://github.com/xmldom/xmldom/blob/bc36efddf9948aba15618f85dc1addfc2ac9d7b2/lib/dom.js#L1 - https://github.com/xmldom/xmldom/blob/bc36efddf9948aba15618f85dc1addfc2ac9d7b2/lib/dom.js#L3 - https://github.com/xmldom/xmldom/issues/436 - https://github.com/xmldom/xmldom/security/advisories/GHSA-9pgh-qqpf-7wqj - https://lists.debian.org/debian-lts-announce/2022/10/msg00023.html - https://dl.acm.org/doi/abs/10.1145/3488932.3497769 - https://dl.acm.org/doi/pdf/10.1145/3488932.3497769 - http://users.encs.concordia.ca/~mmannan/publications/JS-vulnerability-aisaccs2022.pdf
/doi/pdf/10.1145/3488932.3497769 - http://users.encs.concordia.ca/~mmannan/publications/JS-vulnerability-aisaccs2022.pdf - https://github.com/xmldom/xmldom/issues/436#issuecomment-1319412826 - https://github.com/xmldom/xmldom/issues/436#issuecomment-1327776560
CVE ID: CVE-2022-37617 State: PUBLISHED Published: 2022-10-11T00:00:00 Last Updated: 2024-08-03T10:29:21.146Z Vendors: n/a Products: n/a Problem Types: n/a Description: Prototype pollution vulnerability in function resolveShims in resolve-shims.js in thlorenz browserify-shim 3.8.15 via the k variable in resolve-shims.js. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/thlorenz/browserify-shim/blob/464b32bbe142664cd9796059798f6c738ea3de8f/lib/resolve-shims.js#L158 - https://github.com/thlorenz/browserify-shim/blob/464b32bbe142664cd9796059798f6c738ea3de8f/lib/resolve-shims.js#L130 - https://github.com/thlorenz/browserify-shim/issues/245
CVE ID: CVE-2022-37620 State: PUBLISHED Published: 2022-10-31T00:00:00.000Z Last Updated: 2025-06-01T13:26:16.095Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Regular Expression Denial of Service (ReDoS) flaw was found in kangax html-minifier 4.0.0 because of the reCustomIgnore regular expression. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/kangax/html-minifier/blob/51ce10f4daedb1de483ffbcccecc41be1c873da2/src/htmlminifier.js#L1338 - https://github.com/kangax/html-minifier/blob/51ce10f4daedb1de483ffbcccecc41be1c873da2/src/htmlminifier.js#L294 - https://github.com/kangax/html-minifier/issues/1135 - https://secur
e483ffbcccecc41be1c873da2/src/htmlminifier.js#L294 - https://github.com/kangax/html-minifier/issues/1135 - https://security.snyk.io/vuln/SNYK-JS-HTMLMINIFIER-3091181
CVE ID: CVE-2022-37621 State: PUBLISHED Published: 2022-10-28T00:00:00.000Z Last Updated: 2025-05-07T14:52:54.551Z Vendors: n/a Products: n/a Problem Types: n/a Description: Prototype pollution vulnerability in function resolveShims in resolve-shims.js in thlorenz browserify-shim 3.8.15 via the fullPath variable in resolve-shims.js. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/thlorenz/browserify-shim/blob/464b32bbe142664cd9796059798f6c738ea3de8f/lib/resolve-shims.js#L158 - https://github.com/thlorenz/browserify-shim/blob/464b32bbe142664cd9796059798f6c738ea3de8f/lib/resolve-shims.js#L37 - https://github.com/thlorenz/browserify-s
y-shim/blob/464b32bbe142664cd9796059798f6c738ea3de8f/lib/resolve-shims.js#L37 - https://github.com/thlorenz/browserify-shim/issues/247
CVE ID: CVE-2022-37623 State: PUBLISHED Published: 2022-10-31T00:00:00.000Z Last Updated: 2025-05-06T15:49:33.554Z Vendors: n/a Products: n/a Problem Types: n/a Description: Prototype pollution vulnerability in function resolveShims in resolve-shims.js in thlorenz browserify-shim 3.8.15 via the shimPath variable in resolve-shims.js. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/thlorenz/browserify-shim/blob/464b32bbe142664cd9796059798f6c738ea3de8f/lib/resolve-shims.js#L158 - https://github.com/thlorenz/browserify-shim/blob/464b32bbe142664cd9796059798f6c738ea3de8f/lib/resolve-shims.js#L94 - https://github.com/thlorenz/browserify-s
y-shim/blob/464b32bbe142664cd9796059798f6c738ea3de8f/lib/resolve-shims.js#L94 - https://github.com/thlorenz/browserify-shim/issues/248
CVE ID: CVE-2022-37660 State: PUBLISHED Published: 2025-02-11T00:00:00.000Z Last Updated: 2025-11-03T19:27:21.731Z Vendors: n/a Products: n/a Problem Types: n/a Description: In hostapd 2.10 and earlier, the PKEX code remains active even after a successful PKEX association. An attacker that successfully bootstrapped public keys with another entity using PKEX in the past, will be able to subvert a future bootstrapping by passively observing public keys, re-using the encrypting element Qi and subtracting it from the captured message M (X = M - Qi). This will result in the public ephemeral key X; the only element required to subvert the PKEX association. Additional Analyst Notes: - CISA ADP Vuln
ic ephemeral key X; the only element required to subvert the PKEX association. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://w1.fi/cgit/hostap/commit/?id=15af83cf1846870873a011ed4d714732f01cd2e4 - https://link.springer.com/article/10.1007/s10207-025-00988-3
CVE ID: CVE-2022-37661 State: PUBLISHED Published: 2022-09-14T00:00:00 Last Updated: 2024-08-03T10:29:21.110Z Vendors: n/a Products: n/a Problem Types: n/a Description: SmartRG SR506n 2.5.15 and SR510n 2.6.13 routers are vulnerable to Remote Code Execution (RCE) via the ping host feature. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/168336/SmartRG-Router-2.6.13-Remote-Code-Execution.html - https://packetstormsecurity.com/files/cve/CVE-2022-37661 - https://cxsecurity.com/issue/WLB-2022090029 - http://packetstormsecurity.com/files/169816/SmartRG-Router-SR510n-2.6.13-Remote-Code-Execution.html
CVE ID: CVE-2022-37679 State: PUBLISHED Published: 2022-09-02T04:05:51 Last Updated: 2024-08-03T10:29:21.051Z Vendors: n/a Products: n/a Problem Types: n/a Description: Miniblog.Core v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /blog/edit. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Excerpt field. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/madskristensen/Miniblog.Core/issues/178
CVE ID: CVE-2022-37680 State: PUBLISHED Published: 2022-08-29T13:46:00.000Z Last Updated: 2025-02-13T16:32:55.711Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: n/a Products: n/a Problem Types: n/a Description: An improper authentication for critical function issue in Hitachi Kokusai Electric Network products for monitoring system (Camera, Decoder and Encoder) and bellow allows attckers to remotely reboot the device via a crafted POST request to the endpoint /ptipupgrade.cgi. Security information ID hitachi-sec-2022-001 contains fixes for the issue. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/Nwqda/5efea18c9142c6a
he issue. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/Nwqda/5efea18c9142c6a966d85c6be2c0c2b5 - https://www.hitachi-kokusai.co.jp/global/en/products/info/vulnerable/hitachi-sec-2022-001/index.html
CVE ID: CVE-2022-37681 State: PUBLISHED Published: 2022-08-29T13:46:00.000Z Last Updated: 2025-02-13T16:32:56.275Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: n/a Products: n/a Problem Types: n/a Description: Hitachi Kokusai Electric Newtork products for monitoring system (Camera, Decoder and Encoder) and below allows attckers to perform a directory traversal via a crafted GET request to the endpoint /ptippage.cgi. Security information ID hitachi-sec-2022-001 contains fixes for the issue. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/Nwqda/5efea18c9142c6a966d85c6be2c0c2b5 - https://www.hitachi-kokusai.co.jp/global
References: - https://gist.github.com/Nwqda/5efea18c9142c6a966d85c6be2c0c2b5 - https://www.hitachi-kokusai.co.jp/global/en/products/info/vulnerable/hitachi-sec-2022-001/index.html
CVE ID: CVE-2022-37700 State: PUBLISHED Published: 2022-09-19T15:58:51 Last Updated: 2024-08-03T10:29:21.025Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zentao Demo15 is vulnerable to Directory Traversal. The impact is: obtain sensitive information (remote). The component is: URL : view-source:https://demo15.zentao.pm/user-login.html/zentao/index.php?mode=getconfig. Additional Analyst Notes: - CVE Program Container: References: - http://zentao.com - https://demo15.zentao.pm/user-login.html/zentao/index.php?mode=getconfig - https://medium.com/%40sc0p3hacker/cve-2022-37700-directory-transversal-in-zentao-easy-soft-alm-2573c1f0fc21
CVE ID: CVE-2022-37703 State: PUBLISHED Published: 2022-09-13T00:00:00.000Z Last Updated: 2025-11-04T16:09:48.244Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Amanda 3.5.1, an information leak vulnerability was found in the calcsize SUID binary. An attacker can abuse this vulnerability to know if a directory exists or not anywhere in the fs. The binary will use `opendir()` as root directly without checking the path, letting the attacker provide an arbitrary path. Additional Analyst Notes: - CVE Program Container: References: - http://www.amanda.org/ - https://github.com/MaherAzzouzi/CVE-2022-37703 - https://bugs.gentoo.org/870037 - https://lists.fedoraproject.org/archives/l
s://github.com/MaherAzzouzi/CVE-2022-37703 - https://bugs.gentoo.org/870037 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ATMGMVS3QDN6OMKMHGUTUTU7NS7HR3BZ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JYREA6LFXF5M7K4WLNJV5VNQPS4MTBW2/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A5DCLSX5YYTWMKSMDL67M5STZ5ZDSOXK/ - https://github.com/zmanda/amanda/releases/tag/tag-community-3.5.3 - https://lists.debian.org/debian-lts-announce/2023/12/msg00003.html
CVE ID: CVE-2022-37704 State: PUBLISHED Published: 2023-04-16T00:00:00.000Z Last Updated: 2025-11-04T16:09:49.172Z Vendors: n/a Products: n/a Problem Types: n/a Description: Amanda 3.5.1 allows privilege escalation from the regular user backup to root. The SUID binary located at /lib/amanda/rundump will execute /usr/sbin/dump as root with controlled arguments from the attacker which may lead to escalation of privileges, denial of service, and information disclosure. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.amanda.org/ - https://github.com/MaherAzzouzi/CVE-2022-37704 - https://github.com/zmanda/amanda/issues/192 - https://marc.info/?
rg/ - https://github.com/MaherAzzouzi/CVE-2022-37704 - https://github.com/zmanda/amanda/issues/192 - https://marc.info/?l=amanda-hackers - https://lists.debian.org/debian-lts-announce/2023/02/msg00025.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ATMGMVS3QDN6OMKMHGUTUTU7NS7HR3BZ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JYREA6LFXF5M7K4WLNJV5VNQPS4MTBW2/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A5DCLSX5YYTWMKSMDL67M5STZ5ZDSOXK/ - https://github.com/zmanda/amanda/pull/197 - https://github.com/zmanda/amanda/pull/205 - https
YTWMKSMDL67M5STZ5ZDSOXK/ - https://github.com/zmanda/amanda/pull/197 - https://github.com/zmanda/amanda/pull/205 - https://github.com/zmanda/amanda/releases/tag/tag-community-3.5.3
CVE ID: CVE-2022-37705 State: PUBLISHED Published: 2023-04-16T00:00:00.000Z Last Updated: 2025-11-04T16:09:50.106Z Vendors: n/a Products: n/a Problem Types: n/a Description: A privilege escalation flaw was found in Amanda 3.5.1 in which the backup user can acquire root privileges. The vulnerable component is the runtar SUID program, which is a wrapper to run /usr/bin/tar with specific arguments that are controllable by the attacker. This program mishandles the arguments passed to tar binary (it expects that the argument name and value are separated with a space; however, separating them with an equals sign is also supported), Additional Analyst Notes: - CVE Program Container: - CISA ADP Vuln
parating them with an equals sign is also supported), Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.amanda.org/ - https://github.com/MaherAzzouzi/CVE-2022-37705 - https://github.com/zmanda/amanda/issues/192 - https://marc.info/?l=amanda-hackers - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ATMGMVS3QDN6OMKMHGUTUTU7NS7HR3BZ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JYREA6LFXF5M7K4WLNJV5VNQPS4MTBW2/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A5DCLSX5YYTWMKSMDL67M5STZ5ZDSOXK/ -
s.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A5DCLSX5YYTWMKSMDL67M5STZ5ZDSOXK/ - https://github.com/zmanda/amanda/pull/194 - https://github.com/zmanda/amanda/pull/196 - https://github.com/zmanda/amanda/pull/204 - https://github.com/zmanda/amanda/releases/tag/tag-community-3.5.3 - https://lists.debian.org/debian-lts-announce/2023/12/msg00003.html
CVE ID: CVE-2022-37706 State: PUBLISHED Published: 2022-12-25T00:00:00.000Z Last Updated: 2025-04-14T18:35:47.079Z Vendors: n/a Products: n/a Problem Types: n/a Description: enlightenment_sys in Enlightenment before 0.25.4 allows local users to gain privileges because it is setuid root, and the system library function mishandles pathnames that begin with a /dev/.. substring. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/MaherAzzouzi/CVE-2022-37706-LPE-exploit - https://git.enlightenment.org/enlightenment/enlightenment/commit/cc7faeccf77fef8b0ae70e312a21e4cde087e141 - https://git.enlightenment.org/enlightenment/enlightenment/commi
enment/commit/cc7faeccf77fef8b0ae70e312a21e4cde087e141 - https://git.enlightenment.org/enlightenment/enlightenment/commit/cae78cbb169f237862faef123e4abaf63a1f5064
CVE ID: CVE-2022-37708 State: REJECTED Published: N/A Last Updated: 2023-05-02T00:00:00 Description: No description available.
CVE ID: CVE-2022-37709 State: PUBLISHED Published: 2022-09-16T20:43:42 Last Updated: 2024-08-03T10:29:21.041Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tesla Model 3 V11.0(2022.4.5.1 6b701552d7a6) Tesla mobile app v4.23 is vulnerable to Authentication Bypass by spoofing. Tesla Model 3's Phone Key authentication is vulnerable to Man-in-the-middle attacks in the BLE channel. It allows attackers to open a door and drive the car away by leveraging access to a legitimate Phone Key. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/fmsh-seclab/TesMla - https://youtu.be/cPhYW5FzA9A - https://fmsh-seclab.github.io/
CVE ID: CVE-2022-37710 State: PUBLISHED Published: 2022-11-06T00:00:00.000Z Last Updated: 2025-05-02T18:43:09.624Z Vendors: n/a Products: n/a Problem Types: n/a Description: Patterson Dental Eaglesoft 21 has AES-256 encryption but there are two ways to obtain a keyfile: (1) keybackup.data > License > Encryption Key or (2) Eaglesoft.Server.Configuration.data > DbEncryptKeyPrimary > Encryption Key. Applicable files are encrypted with keys and salt that are hardcoded into a DLL or EXE file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://justinshafer.blogspot.com/2022/08/eaglesofts-automatic-aes-256-encryption.html
CVE ID: CVE-2022-37718 State: PUBLISHED Published: 2023-01-23T00:00:00.000Z Last Updated: 2025-04-02T15:58:17.102Z Vendors: n/a Products: n/a Problem Types: n/a Description: The management portal component of JetNexus/EdgeNexus ADC 4.2.8 was discovered to contain a command injection vulnerability. This vulnerability allows authenticated attackers to execute arbitrary commands through a specially crafted payload. This vulnerability can also be exploited from an unauthenticated context via unspecified vectors Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.edgenexus.io/products/load-balancer/ - https://www.cryptnetix.com/blog/2022/09/14/Edg
ichment: References: - https://www.edgenexus.io/products/load-balancer/ - https://www.cryptnetix.com/blog/2022/09/14/Edge-Nexus-Vulnerability-Disclosure.html
CVE ID: CVE-2022-37719 State: PUBLISHED Published: 2023-01-23T00:00:00.000Z Last Updated: 2025-04-02T15:57:23.857Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross-Site Request Forgery (CSRF) in the management portal of JetNexus/EdgeNexus ADC 4.2.8 allows attackers to escalate privileges and execute arbitrary code via unspecified vectors. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.edgenexus.io/products/load-balancer/ - https://www.cryptnetix.com/blog/2022/09/14/Edge-Nexus-Vulnerability-Disclosure.html
CVE ID: CVE-2022-37720 State: PUBLISHED Published: 2022-11-25T00:00:00.000Z Last Updated: 2025-04-25T17:29:39.336Z Vendors: n/a Products: n/a Problem Types: n/a Description: Orchardproject Orchard CMS 1.10.3 is vulnerable to Cross Site Scripting (XSS). When a low privileged user such as an author or publisher, injects a crafted html and javascript payload in a blog post, leading to full admin account takeover or privilege escalation when the malicious blog post is loaded in the victim's browser. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://orchard.com - http://orchardproject.com - https://labs.integrity.pt/advisories/cve-2022-37720/
CVE ID: CVE-2022-37721 State: PUBLISHED Published: 2022-11-25T00:00:00.000Z Last Updated: 2025-04-25T17:27:59.274Z Vendors: n/a Products: n/a Problem Types: n/a Description: PyroCMS 3.9 is vulnerable to a stored Cross Site Scripting (XSS_ when a low privileged user such as an author, injects a crafted html and javascript payload in a blog post, leading to full admin account takeover or privilege escalation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://pyrocms.com - https://labs.integrity.pt/advisories/cve-2022-37721/