rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-40855 
Tenda W20E router V15.11.0.6 contains a stack overflow in the function formSetPortMapping with post request 'goform/setPortMapping/'. This vulnerability allows attackers to cause a Denial of Service (DoS) or Remote Code Execution (RCE) via the portMappingServer, portMappingProtocol, portMappingWan, porMappingtInternal, and portMappingExternal parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-23T14:29:36.000Z
CVE-2022-40860 
Tenda AC15 router V15.03.05.19 contains a stack overflow vulnerability in the function formSetQosBand->FUN_0007dd20 with request /goform/SetNetControlList
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-23T13:47:20.000Z
CVE-2022-40861 
Tenda AC18 router V15.03.05.19 contains a stack overflow vulnerability in the formSetQosBand->FUN_0007db78 function with the request /goform/SetNetControlList/
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-23T14:37:09.000Z
CVE-2022-40862 
Tenda AC15 and AC18 router V15.03.05.19 contains stack overflow vulnerability in the function fromNatStaticSetting with the request /goform/NatStaticSetting
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-23T13:45:25.000Z
CVE-2022-40864 
Tenda AC15 and AC18 routers V15.03.05.19 contain stack overflow vulnerabilities in the function setSmartPowerManagement with the request /goform/PowerSaveSet
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-23T13:38:53.000Z
CVE-2022-40865 
Tenda AC15 and AC18 routers V15.03.05.19 contain heap overflow vulnerabilities in the function setSchedWifi with the request /goform/openSchedWifi/
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-23T13:35:42.000Z
CVE-2022-40866 
Tenda W20E router V15.11.0.6 (US_W20EV4.0br_V15.11.0.6(1068_1546_841)_CN_TDC) contains a stack overflow vulnerability in the function formSetDebugCfg with request /goform/setDebugCfg/
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-23T14:26:40.000Z
CVE-2022-40867 
Tenda W20E router V15.11.0.6 (US_W20EV4.0br_V15.11.0.6(1068_1546_841)_CN_TDC) contains a stack overflow vulnerability in the function formIPMacBindDel with the request /goform/delIpMacBind/
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-23T14:25:04.000Z
CVE-2022-40868 
Tenda W20E router V15.11.0.6 (US_W20EV4.0br_V15.11.0.6(1068_1546_841)_CN_TDC) contains a stack overflow vulnerability in the function formDelDhcpRule with the request /goform/delDhcpRules/
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-23T14:22:47.000Z
CVE-2022-40869 
Tenda AC15 and AC18 routers V15.03.05.19 contain stack overflow vulnerabilities in the function fromDhcpListClient with a combined parameter "list*" ("%s%d","list").
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-23T13:32:22.000Z
CVE-2022-40870 
The Web Client of Parallels Remote Application Server v18.0 is vulnerable to Host Header Injection attacks. This vulnerability allows attackers to execute arbitrary commands via a crafted payload injected into the Host header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-22T00:00:00.000Z
CVE-2022-40871 
Dolibarr ERP & CRM <=15.0.3 is vulnerable to Eval injection. By default, any administrator can be added to the installation page of dolibarr, and if successfully added, malicious code can be inserted into the database and then execute it by eval.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-12T00:00:00.000Z
CVE-2022-40872 
An SQL injection vulnerability issue was discovered in Sourcecodester Simple E-Learning System 1.0., in /vcs/classRoom.php?classCode=, classCode.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-07T00:00:00.000Z
CVE-2022-40874 
Tenda AX1803 v1.0.0.1 was discovered to contain a heap overflow vulnerability in the GetParentControlInfo function, which can cause a denial of service attack through a carefully constructed http request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-27T00:00:00.000Z
CVE-2022-40875 
Tenda AX1803 v1.0.0.1 was discovered to contain a heap overflow in the function GetParentControlInfo.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-27T00:00:00.000Z
CVE-2022-40876 
In Tenda ax1803 v1.0.0.1, the http requests handled by the fromAdvSetMacMtuWan functions, wanSpeed, cloneType, mac, can cause a stack overflow and enable remote code execution (RCE).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-27T00:00:00.000Z
CVE-2022-40877 
Exam Reviewer Management System 1.0 is vulnerable to SQL Injection via the ‘id’ parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-27T16:04:01.000Z
CVE-2022-40878 
In Exam Reviewer Management System 1.0, an authenticated attacker can upload a web-shell php file in profile page to achieve Remote Code Execution (RCE).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-27T16:01:40.000Z
CVE-2022-40879 
kkFileView v4.1.0 is vulnerable to Cross Site Scripting (XSS) via the parameter 'errorMsg.'
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-29T16:22:54.000Z
CVE-2022-40881 
SolarView Compact 6.00 was discovered to contain a command injection vulnerability via network_test.php
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-17T00:00:00.000Z
CVE-2022-40884 
Bento4 1.6.0 has memory leaks via the mp4fragment.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-19T00:00:00.000Z
CVE-2022-40885 
Bento4 v1.6.0-639 has a memory allocation issue that can cause denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-19T00:00:00.000Z
CVE-2022-40886 
DedeCMS 5.7.98 has a file upload vulnerability in the background.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-03T01:08:01.000Z
CVE-2022-40887 
SourceCodester Best Student Result Management System 1.0 is vulnerable to SQL Injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-29T16:08:36.000Z
CVE-2022-40889 
Phpok 6.1 has a deserialization vulnerability via framework/phpok_call.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-18T00:00:00.000Z
CVE-2022-40890 
A vulnerability in /src/amf/amf-context.c in Open5GS 2.4.10 and earlier leads to AMF denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-29T12:48:36.000Z
CVE-2022-40895 
In certain Nedi products, a vulnerability in the web UI of NeDi login & Community login could allow an unauthenticated, remote attacker to affect the integrity of a device via a User Enumeration vulnerability. The vulnerability is due to insecure design, where a difference in forgot password utility could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users. This affects NeDi 1.0.7 for OS X 1.0.7 <= and NeDi for Suse 1.0.7 <= and NeDi for FreeBSD 1.0.7 <=.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-06T00:00:00.000Z
CVE-2022-40896 
A ReDoS issue was discovered in pygments/lexers/smithy.py in pygments through 2.15.0 via SmithyLexer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-07-19T00:00:00.000Z
CVE-2022-40897 
Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service (ReDoS) in package_index.py.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-22T00:00:00.000Z
CVE-2022-40898 
An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlier allows remote attackers to cause a denial of service via attacker controlled input to wheel cli.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-22T00:00:00.000Z
CVE-2022-40899 
An issue discovered in Python Charmers Future 0.18.2 and earlier allows remote attackers to cause a denial of service via crafted Set-Cookie header from malicious web server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-22T00:00:00.000Z
CVE-2022-40903 
Aiphone GT-DMB-N 3-in-1 Video Entrance Station with NFC Reader 1.0.3 does not mitigate against repeated failed access attempts, which allows an attacker to gain administrative privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-14T00:00:00.000Z
CVE-2022-40912 
ETAP Lighting International NV ETAP Safety Manager 1.0.0.32 is vulnerable to Cross Site Scripting (XSS). Input passed to the GET parameter 'action' is not properly sanitized before being returned to the user. This can be exploited to execute arbitrary HTML/JS code in a user's browser session in context of an affected site.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-28T13:50:27.000Z
CVE-2022-40916 
Tiny File Manager v2.4.7 and below is vulnerable to session fixation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-06T00:00:00.000Z
CVE-2022-40918 
Buffer overflow in firmware lewei_cam binary version 2.0.10 in Force 1 Discovery Wifi U818A HD+ FPV Drone allows attacker to gain remote code execution as root user via a specially crafted UDP packet. Please update the Reference section to these links > http://thiscomputer.com/ > https://www.bostoncyber.org/ > https://medium.com/@meekworth/exploiting-the-lw9621-drone-camera-module-773f00081368
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-05T00:00:00.000Z
CVE-2022-40921 
DedeCMS V5.7.99 was discovered to contain an arbitrary file upload vulnerability via the component /dede/file_manage_control.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-11T00:00:00.000Z
CVE-2022-40922 
A vulnerability in the LIEF::MachO::BinaryParser::init_and_parse function of LIEF v0.12.1 allows attackers to cause a denial of service (DOS) through a segmentation fault via a crafted MachO file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-03T12:45:20.000Z
CVE-2022-40923 
A vulnerability in the LIEF::MachO::SegmentCommand::virtual_address function of LIEF v0.12.1 allows attackers to cause a denial of service (DOS) through a segmentation fault via a crafted MachO file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-30T18:36:33.000Z
CVE-2022-40924 
Zoo Management System v1.0 has an arbitrary file upload vulnerability in the picture upload point of the "save_animal" file of the "Animals" module in the background management system.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-26T12:03:15.000Z
CVE-2022-40925 
Zoo Management System v1.0 has an arbitrary file upload vulnerability in the picture upload point of the "save_event" file of the "Events" module in the background management system.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-26T12:04:33.000Z
CVE-2022-40926 
Online Leave Management System v1.0 is vulnerable to SQL Injection via /leave_system/classes/Master.php?f=delete_leave_type.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-26T12:25:53.000Z
CVE-2022-40927 
Online Leave Management System v1.0 is vulnerable to SQL Injection via /leave_system/classes/Master.php?f=delete_designation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-26T12:29:18.000Z
CVE-2022-40928 
Online Leave Management System v1.0 is vulnerable to SQL Injection via /leave_system/classes/Master.php?f=delete_application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-26T12:09:53.000Z
CVE-2022-40929 
XXL-JOB 2.2.0 has a Command execution vulnerability in background tasks. NOTE: this is disputed because the issues/4929 report is about an intended and supported use case (running arbitrary Bash scripts on behalf of users).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-28T00:00:00.000Z
CVE-2022-40931 
dutchcoders Transfer.sh 1.4.0 is vulnerable to Cross Site Scripting (XSS).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-29T15:31:45.000Z
CVE-2022-40932 
In Zoo Management System v1.0, there is an arbitrary file upload vulnerability in the picture upload point of the "gallery" file of the "Gallery" module in the background management system.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-22T15:59:43.000Z
CVE-2022-40933 
Online Pet Shop We App v1.0 by oretnom23 is vulnerable to SQL injection via /pet_shop/classes/Master.php?f=delete_order,id.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-22T16:03:23.000Z
CVE-2022-40934 
Online Pet Shop We App v1.0 is vulnerable to SQL injection via /pet_shop/classes/Master.php?f=delete_sub_category,id
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-22T16:05:38.000Z
CVE-2022-40935 
Online Pet Shop We App v1.0 is vulnerable to SQL Injection via /pet_shop/classes/Master.php?f=delete_category,id.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-22T16:07:07.000Z
CVE-2022-40939 
In certain Secustation products the administrator account password can be read. This affects V2.5.5.3116-S50-SMA-B20171107A, V2.3.4.1301-M20-TSA-B20150617A, V2.5.5.3116-S50-RXA-B20180502A, V2.5.5.3116-S50-SMA-B20190723A, V2.5.5.3116-S50-SMB-B20161012A, V2.3.4.2103-S50-NTD-B20170508B, V2.5.5.3116-S50-SMB-B20160601A, V2.5.5.2601-S50-TSA-B20151229A, and V2.5.5.3116-S50-SMA-B20170217.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-08T00:00:00.000Z
CVE-2022-40942 
Tenda TX3 US_TX3V1.0br_V16.03.13.11 is vulnerable to stack overflow via compare_parentcontrol_time.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-28T14:16:55.000Z
CVE-2022-40943 
Dairy Farm Shop Management System 1.0 is vulnerable to SQL Injection via bwdate-report-ds.php file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-30T18:29:38.000Z
CVE-2022-40944 
Dairy Farm Shop Management System 1.0 is vulnerable to SQL Injection via sales-report-ds.php file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-30T17:11:04.000Z
CVE-2022-40946 
On D-Link DIR-819 Firmware Version 1.06 Hardware Version A1 devices, it is possible to trigger a Denial of Service via the sys_token parameter in a cgi-bin/webproc?getpage=html/index.html request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-16T00:00:00.000Z
CVE-2022-40954 Apache Airflow Spark Provider RCE that bypass restrictions to read arbitrary files
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airflow Spark Provider, Apache Airflow allows an attacker to read arbtrary files in the task execution context, without write access to DAG files. This issue affects Spark Provider versions prior to 4.0.0. It also impacts any Apache Airflow versions prior to 2.3.0 in case Spark Provider is installed (Spark Provider 4.0.0 can only be installed for Airflow 2.3.0+). Note that you need to manually install the Spark Provider version 4.0.0 in order to get rid of the vulnerability on top of Airflow 2.3.0+ version that has lower version of the Spark Provider installed).
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: Apache Software Foundation
product: Apache Airflow Spark Provider
vendor: Apache Software Foundation
product: Apache Airflow
Credits: lang: en
value: Apache Airflow PMC wants to thank id_No2015429 of 3H Security Team for reporting the issue.
Published: 2022-11-22T00:00:00.000Z
CVE-2022-40955 Deserialization attack in Apache InLong prior to version 1.3.0 allows RCE via JDBC
In versions of Apache InLong prior to 1.3.0, an attacker with sufficient privileges to specify MySQL JDBC connection URL parameters and to write arbitrary data to the MySQL database, could cause this data to be deserialized by Apache InLong, potentially leading to Remote Code Execution on the Apache InLong server. Users are advised to upgrade to Apache InLong 1.3.0 or newer.
Problem types: cwe_id: CWE-502
description: CWE-502: Deserialization of Untrusted Data
Affected products: vendor: Apache Software Foundation
product: Apache InLong
Credits: lang: en
value: This issue was discovered by 4ra1n of Chaitin Tech.
Published: 2022-09-20T13:50:08.000Z
CVE-2022-40956 
When injecting an HTML base element, some requests would ignore the CSP's base-uri settings and accept the injected element's base instead. This vulnerability affects Firefox ESR < 102.3, Thunderbird < 102.3, and Firefox < 105.
Problem types: description: Content-Security-Policy base-uri bypass
Affected products: vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Thunderbird
vendor: Mozilla
product: Firefox
Published: 2022-12-22T00:00:00.000Z
CVE-2022-40957 
Inconsistent data in instruction and data cache when creating wasm code could lead to a potentially exploitable crash.<br>*This bug only affects Firefox on ARM64 platforms.*. This vulnerability affects Firefox ESR < 102.3, Thunderbird < 102.3, and Firefox < 105.
Problem types: description: Incoherent instruction cache when building WASM on ARM64
Affected products: vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Thunderbird
vendor: Mozilla
product: Firefox
Published: 2022-12-22T00:00:00.000Z
CVE-2022-40958 
By injecting a cookie with certain special characters, an attacker on a shared subdomain which is not a secure context could set and thus overwrite cookies from a secure context, leading to session fixation and other attacks. This vulnerability affects Firefox ESR < 102.3, Thunderbird < 102.3, and Firefox < 105.
Problem types: description: Bypassing Secure Context restriction for cookies with __Host and __Secure prefix
Affected products: vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Thunderbird
vendor: Mozilla
product: Firefox
Published: 2022-12-22T00:00:00.000Z
CVE-2022-40959 
During iframe navigation, certain pages did not have their FeaturePolicy fully initialized leading to a bypass that leaked device permissions into untrusted subdocuments. This vulnerability affects Firefox ESR < 102.3, Thunderbird < 102.3, and Firefox < 105.
Problem types: description: Bypassing FeaturePolicy restrictions on transient pages
Affected products: vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Thunderbird
vendor: Mozilla
product: Firefox
Published: 2022-12-22T00:00:00.000Z
CVE-2022-40960 
Concurrent use of the URL parser with non-UTF-8 data was not thread-safe. This could lead to a use-after-free causing a potentially exploitable crash. This vulnerability affects Firefox ESR < 102.3, Thunderbird < 102.3, and Firefox < 105.
Problem types: description: Data-race when parsing non-UTF-8 URLs in threads
Affected products: vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Thunderbird
vendor: Mozilla
product: Firefox
Published: 2022-12-22T00:00:00.000Z
CVE-2022-40961 
During startup, a graphics driver with an unexpected name could lead to a stack-buffer overflow causing a potentially exploitable crash.<br>*This issue only affects Firefox for Android. Other operating systems are not affected.*. This vulnerability affects Firefox < 105.
Problem types: description: Stack-buffer overflow when initializing Graphics
Affected products: vendor: Mozilla
product: Firefox
Published: 2022-12-22T00:00:00.000Z
CVE-2022-40962 
Mozilla developers Nika Layzell, Timothy Nikkel, Sebastian Hengst, Andreas Pehrson, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 104 and Firefox ESR 102.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 102.3, Thunderbird < 102.3, and Firefox < 105.
Problem types: description: Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3
Affected products: vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Thunderbird
vendor: Mozilla
product: Firefox
Published: 2022-12-22T00:00:00.000Z
CVE-2022-40963 WordPress WP Page Builder plugin <= 1.2.6 - Multiple Auth. Stored Cross-Site Scripting (XSS) vulnerabilities
Multiple Auth. (author+) Stored Cross-Site Scripting (XSS) vulnerabilities in WP Page Builder plugin <= 1.2.6 on WordPress.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Themeum
product: WP Page Builder (WordPress plugin)
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.8
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: Vulnerability discovered by Ngo Van Thien (Patchstack Alliance)
Published: 2022-11-18T22:19:45.378Z
CVE-2022-40964 
Improper access control for some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi software may allow a privileged user to potentially enable escalation of privilege via local access.
Problem types: description: escalation of privilege
cwe_id: CWE-284
description: Improper access control
Affected products: vendor: n/a
product: Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi software
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 7.9
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: CHANGED
confidentialityImpact: NONE
integrityImpact: HIGH
availabilityImpact: HIGH
Published: 2023-08-11T02:36:53.959Z
CVE-2022-40965 Delta Electronics DIAEnergie
The affected product DIAEnergie (versions prior to v1.9.01.002) is vulnerable to a stored cross-site scripting vulnerability through the PostEnergyType API.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Delta Electronics
product: DIAEnergie
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: NONE
baseScore: 8.7
baseSeverity: HIGH
Credits: lang: en
value: Michael Heinzl reported these vulnerabilities to CISA.
Published: 2022-10-27T20:15:37.542Z