rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-24989 
TerraMaster NAS through 4.2.30 allows remote WAN attackers to execute arbitrary code as root via the raidtype and diskstring parameters for PHP Object Instantiation to the api.php?mobile/createRaid URI. (Shell metacharacters can be placed in raidtype because popen is used without any sanitization.) The credentials from CVE-2022-24990 exploitation can be used.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-20T00:00:00.000Z
CVE-2022-24990 
TerraMaster NAS 4.2.29 and earlier allows remote attackers to discover the administrative password by sending "User-Agent: TNAS" to module/api.php?mobile/webNasIPS and then reading the PWD field in the response.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-07T00:00:00.000Z
CVE-2022-24992 
A vulnerability in the component process.php of QR Code Generator v5.2.7 allows attackers to perform directory traversal.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-25T17:39:35.000Z
CVE-2022-24995 
Tenda AX3 v16.03.12.10_CN was discovered to contain a stack overflow in the function fromSetSysTime. This vulnerability allows attackers to cause a Denial of Service (DoS) via the time parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-09T18:54:53.000Z
CVE-2022-24999 
qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. In many typical Express use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as a[__proto__]=b&a[__proto__]&a[length]=100000000. The fix was backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4 (and therefore Express 4.17.3, which has "deps: qs@6.9.7" in its release description, is not vulnerable).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-26T00:00:00.000Z
CVE-2022-25003 
Hospital Patient Record Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter in /admin/doctors/view_doctor.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-24T18:17:57.000Z
CVE-2022-25004 
Hospital Patient Record Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter in /admin/doctors/manage_doctor.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-24T18:17:59.000Z
CVE-2022-25008 
totolink EX300_v2 V4.0.3c.140_B20210429 and EX1200T V4.1.2cu.5230_B20210706 does not contain an authentication mechanism.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-30T22:27:00.000Z
CVE-2022-25010 
The component /rootfs in RageFile of Stepmania v5.1b2 and below allows attackers access to the entire file system.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-01T22:24:03.000Z
CVE-2022-25012 
Argus Surveillance DVR v4.0 employs weak password encryption.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-01T22:38:47.000Z
CVE-2022-25013 
Ice Hrm 30.0.0.OS was discovered to contain multiple reflected cross-site scripting (XSS) vulnerabilities via the "key" and "fm" parameters in the component login.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-28T18:57:30.000Z
CVE-2022-25014 
Ice Hrm 30.0.0.OS was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the "m" parameter in the Dashboard of the current user. This vulnerability allows attackers to compromise session credentials via user interaction with a crafted link.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-28T18:57:32.000Z
CVE-2022-25015 
A stored cross-site scripting (XSS) vulnerability in Ice Hrm 30.0.0.OS allows attackers to steal cookies via a crafted payload inserted into the First Name field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-28T18:57:33.000Z
CVE-2022-25016 
Home Owners Collection Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via the component /student_attendance/index.php. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-02T16:41:52.000Z
CVE-2022-25017 
Hitron CHITA 7.2.2.0.3b6-CD devices contain a command injection vulnerability via the Device/DDNS ddnsUsername field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.1
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:H/S:C/UI:N
version: 3.1
Published: 2022-04-01T05:41:29.000Z
CVE-2022-25018 
Pluxml v5.8.7 was discovered to allow attackers to execute arbitrary code via crafted PHP code inserted into static pages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-01T01:25:11.000Z
CVE-2022-25020 
A cross-site scripting (XSS) vulnerability in Pluxml v5.8.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the thumbnail path of a blog post.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-01T01:26:20.000Z
CVE-2022-25022 
A cross-site scripting (XSS) vulnerability in Htmly v2.8.1 allows attackers to excute arbitrary web scripts HTML via a crafted payload in the content field of a blog post.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-01T01:27:34.000Z
CVE-2022-25023 
Audio File commit 004065d was discovered to contain a heap-buffer overflow in the function fouBytesToInt():AudioFile.h.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-28T18:33:48.000Z
CVE-2022-25024 
The json2xml package through 3.12.0 for Python allows an error in typecode decoding enabling a remote attack that can lead to an exception, causing a denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-22T00:00:00.000Z
CVE-2022-25026 
A Server-Side Request Forgery (SSRF) in Rocket TRUfusion Portal v7.9.2.1 allows remote attackers to gain access to sensitive resources on the internal network via a crafted HTTP request to /trufusionPortal/upDwModuleProxy.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-01-12T00:00:00.000Z
CVE-2022-25027 
The Forgotten Password functionality of Rocket TRUfusion Portal v7.9.2.1 allows remote attackers to bypass authentication and access restricted pages by validating the user's session token when the "Password forgotten?" button is clicked.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-01-12T00:00:00.000Z
CVE-2022-25028 
Home Owners Collection Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the collected_by parameter under the List of Collections module.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-28T22:55:16.000Z
CVE-2022-25031 
Remote Desktop Commander Suite Agent before v4.8 contains an unquoted service path which allows attackers to escalate privileges to the system level.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-03T14:04:56.000Z
CVE-2022-25037 
An issue in wanEditor v4.7.11 and fixed in v.4.7.12 and v.5 was discovered to contain a cross-site scripting (XSS) vulnerability via the image upload function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-31T16:05:30.670Z
CVE-2022-25038 
wanEditor v4.7.11 was discovered to contain a cross-site scripting (XSS) vulnerability via the video upload function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-31T16:02:57.143Z
CVE-2022-25041 
OpenEMR v6.0.0 was discovered to contain an incorrect access control issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-23T21:27:00.000Z
CVE-2022-25044 
Espruino 2v11.251 was discovered to contain a stack buffer overflow via src/jsvar.c in jsvNewFromString.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-05T01:01:56.000Z
CVE-2022-25045 
Home Owners Collection Management System v1.0 was discovered to contain hardcoded credentials which allows attackers to escalate privileges and access the admin panel.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-02T20:51:03.000Z
CVE-2022-25046 
A path traversal vulnerability in loader.php of CWP v0.9.8.1122 allows attackers to execute arbitrary code via a crafted POST request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-07T11:28:59.000Z
CVE-2022-25047 
The password reset token in CWP v0.9.8.1126 is generated using known or predictable values.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-07T11:29:09.000Z
CVE-2022-25048 
Command injection vulnerability in CWP v0.9.8.1126 that allows normal users to run commands as the root user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-07T11:29:20.000Z
CVE-2022-25050 
rtl_433 21.12 was discovered to contain a stack overflow in the function somfy_iohc_decode(). This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-01T23:46:52.000Z
CVE-2022-25051 
An Off-by-one Error occurs in cmr113_decode of rtl_433 21.12 when decoding a crafted file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-01T23:47:09.000Z
CVE-2022-25060 
TP-LINK TL-WR840N(ES)_V6.20_180709 was discovered to contain a command injection vulnerability via the component oal_startPing.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-25T19:38:56.000Z
CVE-2022-25061 
TP-LINK TL-WR840N(ES)_V6.20_180709 was discovered to contain a command injection vulnerability via the component oal_setIp6DefaultRoute.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-25T19:39:02.000Z
CVE-2022-25062 
TP-LINK TL-WR840N(ES)_V6.20_180709 was discovered to contain an integer overflow via the function dm_checkString. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-25T19:38:58.000Z
CVE-2022-25064 
TP-LINK TL-WR840N(ES)_V6.20_180709 was discovered to contain a remote code execution (RCE) vulnerability via the function oal_wan6_setIpAddr.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-25T19:38:59.000Z
CVE-2022-25069 
Mark Text v0.16.3 was discovered to contain a DOM-based cross-site scripting (XSS) vulnerability which allows attackers to perform remote code execution (RCE) via injecting a crafted payload into /lib/contentState/pasteCtrl.js.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-05T00:29:01.000Z
CVE-2022-25072 
TP-Link Archer A54 Archer A54(US)_V1_210111 routers were discovered to contain a stack overflow in the function DM_ Fillobjbystr(). This vulnerability allows unauthenticated attackers to execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-22T22:44:05.000Z
CVE-2022-25073 
TL-WR841Nv14_US_0.9.1_4.18 routers were discovered to contain a stack overflow in the function dm_fillObjByStr(). This vulnerability allows unauthenticated attackers to execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-22T22:44:05.000Z
CVE-2022-25074 
TP-Link TL-WR902AC(US)_V3_191209 routers were discovered to contain a stack overflow in the function DM_ Fillobjbystr(). This vulnerability allows unauthenticated attackers to execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-22T22:44:06.000Z
CVE-2022-25075 
TOTOLink A3000RU V5.9c.2280_B20180512 was discovered to contain a command injection vulnerability in the "Main" function. This vulnerability allows attackers to execute arbitrary commands via the QUERY_STRING parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-22T22:44:07.000Z
CVE-2022-25076 
TOTOLink A800R V4.1.2cu.5137_B20200730 was discovered to contain a command injection vulnerability in the "Main" function. This vulnerability allows attackers to execute arbitrary commands via the QUERY_STRING parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-22T22:44:07.000Z
CVE-2022-25077 
TOTOLink A3100R V4.1.2cu.5050_B20200504 was discovered to contain a command injection vulnerability in the "Main" function. This vulnerability allows attackers to execute arbitrary commands via the QUERY_STRING parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-22T22:44:08.000Z
CVE-2022-25078 
TOTOLink A3600R V4.1.2cu.5182_B20201102 was discovered to contain a command injection vulnerability in the "Main" function. This vulnerability allows attackers to execute arbitrary commands via the QUERY_STRING parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-22T22:44:08.000Z
CVE-2022-25079 
TOTOLink A810R V4.1.2cu.5182_B20201026 was discovered to contain a command injection vulnerability in the "Main" function. This vulnerability allows attackers to execute arbitrary commands via the QUERY_STRING parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-22T22:44:09.000Z
CVE-2022-25080 
TOTOLink A830R V5.9c.4729_B20191112 was discovered to contain a command injection vulnerability in the "Main" function. This vulnerability allows attackers to execute arbitrary commands via the QUERY_STRING parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-22T22:44:10.000Z
CVE-2022-25081 
TOTOLink T10 V5.9c.5061_B20200511 was discovered to contain a command injection vulnerability in the "Main" function. This vulnerability allows attackers to execute arbitrary commands via the QUERY_STRING parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-22T22:44:10.000Z
CVE-2022-25082 
TOTOLink A950RG V5.9c.4050_B20190424 and V4.1.2cu.5204_B20210112 were discovered to contain a command injection vulnerability in the "Main" function. This vulnerability allows attackers to execute arbitrary commands via the QUERY_STRING parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-22T22:44:11.000Z
CVE-2022-25083 
TOTOLink A860R V4.1.2cu.5182_B20201027 was discovered to contain a command injection vulnerability in the "Main" function. This vulnerability allows attackers to execute arbitrary commands via the QUERY_STRING parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-22T22:44:12.000Z
CVE-2022-25084 
TOTOLink T6 V5.9c.4085_B20190428 was discovered to contain a command injection vulnerability in the "Main" function. This vulnerability allows attackers to execute arbitrary commands via the QUERY_STRING parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-22T22:44:12.000Z
CVE-2022-25089 
Printix Secure Cloud Print Management through 1.3.1106.0 incorrectly uses Privileged APIs to modify values in HKEY_LOCAL_MACHINE via UITasks.PersistentRegistryData.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-02T23:19:15.000Z
CVE-2022-25090 
Printix Secure Cloud Print Management through 1.3.1106.0 creates a temporary temp.ini file in a directory with insecure permissions, leading to privilege escalation because of a race condition.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-09T15:36:48.000Z
CVE-2022-25091 
Infopop Ultimate Bulletin Board up to v5.47a was discovered to allow all messages posted inside private forums to be disclosed by unauthenticated users via the quote reply feature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-27T00:00:00.000Z
CVE-2022-25094 
Home Owners Collection Management System v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the parameter "cover" in SystemSettings.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-25T23:22:08.000Z
CVE-2022-25095 
Home Owners Collection Management System v1.0 allows unauthenticated attackers to compromise user accounts via a crafted POST request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-25T23:22:10.000Z
CVE-2022-25096 
Home Owners Collection Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter in /members/view_member.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-25T23:22:11.000Z
CVE-2022-25098 
ECTouch v2 suffers from arbitrary file deletion due to insufficient filtering of the filename parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-23T21:11:25.000Z
CVE-2022-25099 
A vulnerability in the component /languages/index.php of WBCE CMS v1.5.2 allows attackers to execute arbitrary code via a crafted PHP file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-23T21:11:25.000Z
CVE-2022-25101 
A vulnerability in the component /templates/install.php of WBCE CMS v1.5.2 allows attackers to execute arbitrary code via a crafted PHP file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-23T21:11:24.000Z
CVE-2022-25104 
HorizontCMS v1.0.0-beta.2 was discovered to contain an arbitrary file download vulnerability via the component /admin/file-manager/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-23T21:11:23.000Z
CVE-2022-25106 
D-Link DIR-859 v1.05 was discovered to contain a stack-based buffer overflow via the function genacgi_main. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted payload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-04T19:20:01.000Z
CVE-2022-25108 
Foxit PDF Reader and Editor before 11.2.1 and PhantomPDF before 10.1.7 allow a NULL pointer dereference during PDF parsing because the pointer is used without proper validation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-07T04:15:57.000Z
CVE-2022-25114 
Event Management v1.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the full_name parameter under register.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-02T22:39:24.000Z
CVE-2022-25115 
A remote code execution (RCE) vulnerability in the Avatar parameter under /admin/?page=user/manage_user of Home Owners Collection Management System v1.0 allows attackers to execute arbitrary code via a crafted PNG file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-02T22:39:25.000Z
CVE-2022-25125 
MCMS v5.2.4 was discovered to contain a SQL injection vulnerability via search.do in the file /mdiy/dict/listExcludeApp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-03T18:01:35.000Z
CVE-2022-25130 
A command injection vulnerability in the function updateWifiInfo of TOTOLINK Technology routers T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 and T10 V2_Firmware V4.1.8cu.5207_B20210320 allows attackers to execute arbitrary commands via a crafted MQTT packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-18T23:09:17.000Z
CVE-2022-25131 
A command injection vulnerability in the function recvSlaveCloudCheckStatus of TOTOLINK Technology routers T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 and T10 V2_Firmware V4.1.8cu.5207_B20210320 allows attackers to execute arbitrary commands via a crafted MQTT packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-18T23:09:17.000Z
CVE-2022-25132 
A command injection vulnerability in the function meshSlaveDlfw of TOTOLINK Technology router T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 allows attackers to execute arbitrary commands via a crafted MQTT packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-18T23:09:18.000Z
CVE-2022-25133 
A command injection vulnerability in the function isAssocPriDevice of TOTOLINK Technology router T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 allows attackers to execute arbitrary commands via a crafted MQTT packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-18T23:09:19.000Z
CVE-2022-25134 
A command injection vulnerability in the function setUpgradeFW of TOTOLINK Technology router T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 allows attackers to execute arbitrary commands via a crafted MQTT packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-18T23:09:19.000Z
CVE-2022-25135 
A command injection vulnerability in the function recv_mesh_info_sync of TOTOLINK Technology router T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 allows attackers to execute arbitrary commands via a crafted MQTT packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-18T23:09:20.000Z
CVE-2022-25136 
A command injection vulnerability in the function meshSlaveUpdate of TOTOLINK Technology routers T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 and T10 V2_Firmware V4.1.8cu.5207_B20210320 allows attackers to execute arbitrary commands via a crafted MQTT packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-18T23:09:21.000Z
CVE-2022-25137 
A command injection vulnerability in the function recvSlaveUpgstatus of TOTOLINK Technology routers T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 and T10 V2_Firmware V4.1.8cu.5207_B20210320 allows attackers to execute arbitrary commands via a crafted MQTT packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-18T23:09:22.000Z
CVE-2022-25138 
Axelor Open Suite v5.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Name parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-03T16:56:35.000Z
CVE-2022-25139 
njs through 0.7.0, used in NGINX, was discovered to contain a heap use-after-free in njs_await_fulfilled.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-14T21:47:20.000Z