rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-29520 
An OS command injection vulnerability exists in the console_main_loop :sys functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9Z. A specially-crafted XCMD can lead to arbitrary command execution. An attacker can send an XML payload to trigger this vulnerability.
Problem types: cwe_id: CWE-489
description: CWE-489: Leftover Debug Code
Affected products: vendor: abode systems, inc.
product: iota All-In-One Security Kit
Published: 2022-10-25T16:33:36.201Z
CVE-2022-29522 
Use after free vulnerability exists in the simulator module contained in the graphic editor 'V-SFT' versions prior to v6.1.6.0, which may allow an attacker to obtain information and/or execute arbitrary code by having a user to open a specially crafted image file.
Problem types: description: Use After Free
Affected products: vendor: FUJI ELECTRIC CO., LTD. / Hakko Electronics Co., Ltd.
product: V-SFT
Published: 2022-06-14T07:05:44.000Z
CVE-2022-29523 
Improper conditions check in the Open CAS software maintained by Intel(R) before version 22.3.1 may allow an authenticated user to potentially enable denial of service via local access.
Problem types: description: denial of service
Affected products: vendor: n/a
product: Open CAS software maintained by Intel(R)
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 3.3
baseSeverity: LOW
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: LOW
Published: 2023-02-16T20:00:20.422Z
CVE-2022-29524 
Out-of-bounds write vulnerability exists in V-Server v4.0.11.0 and earlier and V-Server Lite v4.0.13.0 and earlier, which may allow an attacker to obtain information and/or execute arbitrary code by having a user to open a specially crafted image file.
Problem types: description: Out-of-bounds Write
Affected products: vendor: FUJI ELECTRIC CO., LTD. / Hakko Electronics Co., Ltd.
product: V-Server and V-Server Lite
Published: 2022-06-14T07:05:45.000Z
CVE-2022-29525 
Rakuten Casa version AP_F_V1_4_1 or AP_F_V2_0_0 uses a hard-coded credential which may allow a remote unauthenticated attacker to log in with the root privilege and perform an arbitrary operation.
Problem types: description: Use of Hard-coded credentials
Affected products: vendor: Rakuten Mobile, Inc.
product: Rakuten Casa
Published: 2022-06-13T04:50:33.000Z
CVE-2022-29526 
Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Assignment. When called with a non-zero flags parameter, the Faccessat function could incorrectly report that a file is accessible.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-22T13:15:32.000Z
CVE-2022-29527 
Amazon AWS amazon-ssm-agent before 3.1.1208.0 creates a world-writable sudoers file, which allows local attackers to inject Sudo rules and escalate privileges to root. This occurs in certain situations involving a race condition.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-20T09:09:07.000Z
CVE-2022-29528 
An issue was discovered in MISP before 2.4.158. PHAR deserialization can occur.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-20T00:00:00.000Z
CVE-2022-29529 
An issue was discovered in MISP before 2.4.158. There is stored XSS via the LinOTP login field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-20T00:00:00.000Z
CVE-2022-29530 
An issue was discovered in MISP before 2.4.158. There is stored XSS in the galaxy clusters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-20T00:00:00.000Z
CVE-2022-29531 
An issue was discovered in MISP before 2.4.158. There is stored XSS in the event graph via a tag name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-20T00:00:00.000Z
CVE-2022-29532 
An issue was discovered in MISP before 2.4.158. There is XSS in the cerebrate view if one administrator puts a javascript: URL in the URL field, and another administrator clicks on it.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-20T00:00:00.000Z
CVE-2022-29533 
An issue was discovered in MISP before 2.4.158. There is XSS in app/Controller/OrganisationsController.php in a situation with a "weird single checkbox page."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-20T00:00:00.000Z
CVE-2022-29534 
An issue was discovered in MISP before 2.4.158. In UsersController.php, password confirmation can be bypassed via vectors involving an "Accept: application/json" header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-20T00:00:00.000Z
CVE-2022-29535 
Zoho ManageEngine OPManager through 125588 allows SQL Injection via a few default reports.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-05T22:17:40.000Z
CVE-2022-29536 
In GNOME Epiphany before 41.4 and 42.x before 42.2, an HTML document can trigger a client buffer overflow (in ephy_string_shorten in the UI process) via a long page title. The issue occurs because the number of bytes for a UTF-8 ellipsis character is not properly considered.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-20T22:37:09.000Z
CVE-2022-29537 
gp_rtp_builder_do_hevc in ietf/rtp_pck_mpeg4.c in GPAC 2.0.0 has a heap-based buffer over-read, as demonstrated by MP4Box.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-20T00:00:00.000Z
CVE-2022-29538 
RESI Gemini-Net Web 4.2 is affected by Improper Access Control in authorization logic. An unauthenticated user is able to access some critical resources.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-12T14:15:45.000Z
CVE-2022-29539 
resi-calltrace in RESI Gemini-Net 4.2 is affected by OS Command Injection. It does not properly check the parameters sent as input before they are processed on the server. Due to the lack of validation of user input, an unauthenticated attacker can bypass the syntax intended by the software (e.g., concatenate `&|;\r\ commands) and inject arbitrary system commands with the privileges of the application user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-12T14:15:42.000Z
CVE-2022-29540 
resi-calltrace in RESI Gemini-Net 4.2 is affected by Multiple XSS issues. Unauthenticated remote attackers can inject arbitrary web script or HTML into an HTTP GET parameter that reflects user input without sanitization. This exists on numerous application endpoints,
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-31T20:34:17.000Z
CVE-2022-29546 
HtmlUnit NekoHtml Parser before 2.61.0 suffers from a denial of service vulnerability. Crafted input associated with the parsing of Processing Instruction (PI) data leads to heap memory consumption. This is similar to CVE-2022-28366 but affects a much later version of the product.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-25T02:54:59.000Z
CVE-2022-29547 
The CreateRedirect extension before 2022-04-14 for MediaWiki does not properly check whether the user has permissions to edit the target page. This could lead to an unauthorised (or blocked) user being able to edit a page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-21T00:57:44.000Z
CVE-2022-29548 
A reflected XSS issue exists in the Management Console of several WSO2 products. This affects API Manager 2.2.0, 2.5.0, 2.6.0, 3.0.0, 3.1.0, 3.2.0, and 4.0.0; API Manager Analytics 2.2.0, 2.5.0, and 2.6.0; API Microgateway 2.2.0; Data Analytics Server 3.2.0; Enterprise Integrator 6.2.0, 6.3.0, 6.4.0, 6.5.0, and 6.6.0; IS as Key Manager 5.5.0, 5.6.0, 5.7.0, 5.9.0, and 5.10.0; Identity Server 5.5.0, 5.6.0, 5.7.0, 5.9.0, 5.10.0, and 5.11.0; Identity Server Analytics 5.5.0 and 5.6.0; and WSO2 Micro Integrator 1.0.0.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AC:L/AV:A/A:N/C:L/I:L/PR:N/S:U/UI:R
attackVector: ADJACENT_NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 4.6
baseSeverity: MEDIUM
Published: 2022-04-21T00:00:00.000Z
CVE-2022-29549 
An issue was discovered in Qualys Cloud Agent 4.8.0-49. It executes programs at various full pathnames without first making ownership and permission checks (e.g., to help ensure that a program was installed by root) and without integrity checks (e.g., a checksum comparison against known legitimate programs). Also, the vendor recommendation is to install this agent software with root privileges. Thus, privilege escalation is possible on systems where any of these pathnames is controlled by a non-root user. An example is /opt/firebird/bin/isql, where the /opt/firebird directory is often owned by the firebird user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-18T12:16:30.000Z
CVE-2022-29550 
An issue was discovered in Qualys Cloud Agent 4.8.0-49. It writes "ps auxwwe" output to the /var/log/qualys/qualys-cloud-agent-scan.log file. This may, for example, unexpectedly write credentials (from environment variables) to disk in cleartext. NOTE: there are no common circumstances in which qualys-cloud-agent-scan.log can be read by a user other than root; however, the file contents could be exposed through site-specific operational practices. The vendor does NOT characterize this as a vulnerability because the ps data collection is intentional, and would only capture credentials on a machine that was already affected by the CWE-214 weakness
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-18T12:16:18.000Z
CVE-2022-29555 
The Deviceconnect microservice through 1.3.0 in Northern.tech Mender Enterprise before 3.2.2. allows Cross-Origin Websocket Hijacking.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-28T19:44:49.000Z
CVE-2022-29556 
The iot-manager microservice 1.0.0 in Northern.tech Mender Enterprise before 3.2.2 allows SSRF because the Azure IoT Hub integration provides several SSRF primitives that can execute cross-tenant actions via internal API endpoints.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-28T19:48:39.000Z
CVE-2022-29557 
LexisNexis Firco Compliance Link 3.7 allows CSRF.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-14T00:00:00.000Z
CVE-2022-29558 
Realtek rtl819x-SDK before v3.6.1 allows command injection over the web interface.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-28T21:20:49.000Z
CVE-2022-29560 
A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < 2.15.1), RUGGEDCOM ROX MX5000RE (All versions < 2.15.1), RUGGEDCOM ROX RX1400 (All versions < 2.15.1), RUGGEDCOM ROX RX1500 (All versions < 2.15.1), RUGGEDCOM ROX RX1501 (All versions < 2.15.1), RUGGEDCOM ROX RX1510 (All versions < 2.15.1), RUGGEDCOM ROX RX1511 (All versions < 2.15.1), RUGGEDCOM ROX RX1512 (All versions < 2.15.1), RUGGEDCOM ROX RX1524 (All versions < 2.15.1), RUGGEDCOM ROX RX1536 (All versions < 2.15.1), RUGGEDCOM ROX RX5000 (All versions < 2.15.1). Affected devices do not properly validate user input, making them susceptible to command injection. An attacker with access to either the shell or the web CLI with administrator privileges could access the underlying operating system as the root user.
Problem types: cwe_id: CWE-77
description: CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
Affected products: vendor: Siemens
product: RUGGEDCOM ROX MX5000
vendor: Siemens
product: RUGGEDCOM ROX MX5000RE
vendor: Siemens
product: RUGGEDCOM ROX RX1400
vendor: Siemens
product: RUGGEDCOM ROX RX1500
vendor: Siemens
product: RUGGEDCOM ROX RX1501
vendor: Siemens
product: RUGGEDCOM ROX RX1510
vendor: Siemens
product: RUGGEDCOM ROX RX1511
vendor: Siemens
product: RUGGEDCOM ROX RX1512
vendor: Siemens
product: RUGGEDCOM ROX RX1524
vendor: Siemens
product: RUGGEDCOM ROX RX1536
vendor: Siemens
product: RUGGEDCOM ROX RX5000
Published: 2022-07-12T10:06:38.000Z
CVE-2022-29561 
A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.0), RUGGEDCOM ROX MX5000RE (All versions < V2.16.0), RUGGEDCOM ROX RX1400 (All versions < V2.16.0), RUGGEDCOM ROX RX1500 (All versions < V2.16.0), RUGGEDCOM ROX RX1501 (All versions < V2.16.0), RUGGEDCOM ROX RX1510 (All versions < V2.16.0), RUGGEDCOM ROX RX1511 (All versions < V2.16.0), RUGGEDCOM ROX RX1512 (All versions < V2.16.0), RUGGEDCOM ROX RX1524 (All versions < V2.16.0), RUGGEDCOM ROX RX1536 (All versions < V2.16.0), RUGGEDCOM ROX RX5000 (All versions < V2.16.0). The web interface of the affected devices are vulnerable to Cross-Site Request Forgery attacks. By tricking an authenticated victim user to click a malicious link, an attacker could perform arbitrary actions on the device on behalf of the victim user.
Problem types: cwe_id: CWE-352
description: CWE-352: Cross-Site Request Forgery (CSRF)
Affected products: vendor: Siemens
product: RUGGEDCOM ROX MX5000
default_status: unknown
vendor: Siemens
product: RUGGEDCOM ROX MX5000RE
default_status: unknown
vendor: Siemens
product: RUGGEDCOM ROX RX1400
default_status: unknown
vendor: Siemens
product: RUGGEDCOM ROX RX1500
default_status: unknown
vendor: Siemens
product: RUGGEDCOM ROX RX1501
default_status: unknown
vendor: Siemens
product: RUGGEDCOM ROX RX1510
default_status: unknown
vendor: Siemens
product: RUGGEDCOM ROX RX1511
default_status: unknown
vendor: Siemens
product: RUGGEDCOM ROX RX1512
default_status: unknown
vendor: Siemens
product: RUGGEDCOM ROX RX1524
default_status: unknown
vendor: Siemens
product: RUGGEDCOM ROX RX1536
default_status: unknown
vendor: Siemens
product: RUGGEDCOM ROX RX5000
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
baseScore: 7.5
baseSeverity: HIGH
Published: 2023-07-11T09:06:58.988Z
CVE-2022-29562 
A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.0), RUGGEDCOM ROX MX5000RE (All versions < V2.16.0), RUGGEDCOM ROX RX1400 (All versions < V2.16.0), RUGGEDCOM ROX RX1500 (All versions < V2.16.0), RUGGEDCOM ROX RX1501 (All versions < V2.16.0), RUGGEDCOM ROX RX1510 (All versions < V2.16.0), RUGGEDCOM ROX RX1511 (All versions < V2.16.0), RUGGEDCOM ROX RX1512 (All versions < V2.16.0), RUGGEDCOM ROX RX1524 (All versions < V2.16.0), RUGGEDCOM ROX RX1536 (All versions < V2.16.0), RUGGEDCOM ROX RX5000 (All versions < V2.16.0). Affected devices do not properly handle malformed HTTP packets. This could allow an unauthenticated remote attacker to send a malformed HTTP packet causing certain functions to fail in a controlled manner.
Problem types: cwe_id: CWE-20
description: CWE-20: Improper Input Validation
Affected products: vendor: Siemens
product: RUGGEDCOM ROX MX5000
default_status: unknown
vendor: Siemens
product: RUGGEDCOM ROX MX5000RE
default_status: unknown
vendor: Siemens
product: RUGGEDCOM ROX RX1400
default_status: unknown
vendor: Siemens
product: RUGGEDCOM ROX RX1500
default_status: unknown
vendor: Siemens
product: RUGGEDCOM ROX RX1501
default_status: unknown
vendor: Siemens
product: RUGGEDCOM ROX RX1510
default_status: unknown
vendor: Siemens
product: RUGGEDCOM ROX RX1511
default_status: unknown
vendor: Siemens
product: RUGGEDCOM ROX RX1512
default_status: unknown
vendor: Siemens
product: RUGGEDCOM ROX RX1524
default_status: unknown
vendor: Siemens
product: RUGGEDCOM ROX RX1536
default_status: unknown
vendor: Siemens
product: RUGGEDCOM ROX RX5000
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C
baseScore: 3.7
baseSeverity: LOW
Published: 2023-07-11T09:07:00.397Z
CVE-2022-29564 
Jamf Private Access before 2022-05-16 has Incorrect Access Control, in which an unauthorized user can reach a system in the internal infrastructure, aka WND-44801.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-07T13:23:11.000Z
CVE-2022-29566 
The Bulletproofs 2017/1066 paper mishandles Fiat-Shamir generation because the hash computation fails to include all of the public values from the Zero Knowledge proof statement as well as all of the public values computed in the proof, aka the Frozen Heart issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-21T18:47:20.000Z
CVE-2022-29567 Possible information disclosure inside TreeGrid component with default data provider
The default configuration of a TreeGrid component uses Object::toString as a key on the client-side and server communication in Vaadin 14.8.5 through 14.8.9, 22.0.6 through 22.0.14, 23.0.0.beta2 through 23.0.8 and 23.1.0.alpha1 through 23.1.0.alpha4, resulting in potential information disclosure of values that should not be available on the client-side.
Problem types: cwe_id: CWE-200
description: CWE-200 Information Exposure
Affected products: vendor: Vaadin
product: vaadin
vendor: Vaadin
product: vaadin-grid-flow
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.7
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
version: 3.1
Published: 2022-05-24T14:20:19.452Z
CVE-2022-29577 
OWASP AntiSamy before 1.6.7 allows XSS via HTML tag smuggling on STYLE content with crafted input. The output serializer does not properly encode the supposed Cascading Style Sheets (CSS) content. NOTE: this issue exists because of an incomplete fix for CVE-2022-28367.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-21T22:42:51.000Z
CVE-2022-29578 
Meridian Cooperative Utility Software versions 22.02 and 22.03 allows remote attackers to obtain sensitive information such as name, address, and daily energy usage.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-24T16:36:22.000Z
CVE-2022-29580 Path Traversal in Android Google Search App
There exists a path traversal vulnerability in the Android Google Search app. This is caused by the incorrect usage of uri.getLastPathSegment. A symbolic encoded string can bypass the path logic to get access to unintended directories. An attacker can manipulate paths that could lead to code execution on the device. We recommend upgrading beyond version 13.41
Problem types: cwe_id: CWE-427
description: CWE-427 Uncontrolled Search Path Element
Affected products: vendor: Google
product: Android Google Search App
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 8.9
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L
version: 3.1
Published: 2022-12-13T14:31:41.752Z
CVE-2022-29581 
Improper Update of Reference Count vulnerability in net/sched of Linux Kernel allows local attacker to cause privilege escalation to root. This issue affects: Linux Kernel versions prior to 5.18; version 4.14 and later versions.
Problem types: cwe_id: CWE-911
description: CWE-911 Improper Update of Reference Count
Affected products: vendor: Linux
product: Kernel
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: syzbot <syzkaller@googlegroups.com>
Published: 2022-05-17T16:50:12.000Z
CVE-2022-29582 
In the Linux kernel before 5.17.3, fs/io_uring.c has a use-after-free due to a race condition in io_uring timeouts. This can be triggered by a local user who has no access to any user namespace; however, the race condition perhaps can only be exploited infrequently.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-22T00:00:00.000Z
CVE-2022-29583 
service_windows.go in the kardianos service package for Go omits quoting that is sometimes needed for execution of a Windows service executable from the intended directory. NOTE: this finding could not be reproduced by its original reporter or by others.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-22T00:00:00.000Z
CVE-2022-29584 
Mahara before 20.10.5, 21.04.4, 21.10.2, and 22.04.0 allows stored XSS when a particular Cascading Style Sheets (CSS) class for embedly is used, and JavaScript code is constructed to perform an action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-28T15:26:15.000Z
CVE-2022-29585 
In Mahara before 20.10.5, 21.04.4, 21.10.2, and 22.04.0, a site using Isolated Institutions is vulnerable if more than ten groups are used. They are all shown from page 2 of the group results list (rather than only being shown for the institution that the viewer is a member of).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-28T15:29:25.000Z
CVE-2022-29586 
Konica Minolta bizhub MFP devices before 2022-04-14 allow a Sandbox Escape. An attacker must attach a keyboard to a USB port, press F12, and then escape from the kiosk mode.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-16T05:35:52.000Z
CVE-2022-29587 
Konica Minolta bizhub MFP devices before 2022-04-14 have an internal Chromium browser that executes with root (aka superuser) access privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-16T05:32:31.000Z
CVE-2022-29588 
Konica Minolta bizhub MFP devices before 2022-04-14 use cleartext password storage for the /var/log/nginx/html/ADMINPASS and /etc/shadow files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-16T05:30:58.000Z
CVE-2022-29589 
Crypt Server before 3.3.0 allows XSS in the index view. This is related to serial, computername, and username.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-22T16:17:27.000Z
CVE-2022-29591 
Tenda TX9 Pro 22.03.02.10 devices have a SetNetControlList buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-10T11:46:40.000Z
CVE-2022-29592 
Tenda TX9 Pro 22.03.02.10 devices allow OS command injection via set_route (called by doSystemCmd_route).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-05T15:51:44.000Z
CVE-2022-29593 
relay_cgi.cgi on Dingtian DT-R002 2CH relay devices with firmware 3.1.276A allows an attacker to replay HTTP post requests without the need for authentication or a valid signed/authorized request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-14T14:56:44.000Z
CVE-2022-29594 
eG Agent before 7.2 has weak file permissions that enable escalation of privileges to SYSTEM.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-02T22:43:08.000Z