rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-25273 
Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation. This could allow an attacker to inject disallowed values or overwrite data. Affected forms are uncommon, but in certain cases an attacker could alter critical or sensitive data.
Problem types: description: Improper input validation 
Affected products: vendor: Drupal
product: Core
Published: 2023-04-26T00:00:00.000Z
CVE-2022-25274 
Drupal 9.3 implemented a generic entity access API for entity revisions. However, this API was not completely integrated with existing permissions, resulting in some possible access bypass for users who have access to use revisions of content generally, but who do not have access to individual items of node and media content. This vulnerability only affects sites using Drupal's revision system.
Problem types: description:  Access bypass
Affected products: vendor: Drupal
product: Core
Published: 2023-04-26T00:00:00.000Z
CVE-2022-25275 
In some situations, the Image module does not correctly check access to image files not stored in the standard public files directory when generating derivative images using the image styles system. Access to a non-public file is checked only if it is stored in the "private" file system. However, some contributed modules provide additional file systems, or schemes, which may lead to this vulnerability. This vulnerability is mitigated by the fact that it only applies when the site sets (Drupal 9) $config['image.settings']['allow_insecure_derivatives'] or (Drupal 7) $conf['image_allow_insecure_derivatives'] to TRUE. The recommended and default setting is FALSE, and Drupal core does not provide a way to change that in the admin UI. Some sites may require configuration changes following this security release. Review the release notes for your Drupal version if you have issues accessing files or image styles after updating.
Problem types: description: Information Disclosure
Affected products: vendor: Drupal
product: Core
Published: 2023-04-26T00:00:00.000Z
CVE-2022-25276 
The Media oEmbed iframe route does not properly validate the iframe domain setting, which allows embeds to be displayed in the context of the primary domain. Under certain circumstances, this could lead to cross-site scripting, leaked cookies, or other vulnerabilities.
Problem types: description:  Multiple vulnerabilities
Affected products: vendor: Drupal
product: Core
Published: 2023-04-26T00:00:00.000Z
CVE-2022-25277 
Drupal core sanitizes filenames with dangerous extensions upon upload (reference: SA-CORE-2020-012) and strips leading and trailing dots from filenames to prevent uploading server configuration files (reference: SA-CORE-2019-010). However, the protections for these two vulnerabilities previously did not work correctly together. As a result, if the site were configured to allow the upload of files with an htaccess extension, these files' filenames would not be properly sanitized. This could allow bypassing the protections provided by Drupal core's default .htaccess files and possible remote code execution on Apache web servers. This issue is mitigated by the fact that it requires a field administrator to explicitly configure a file field to allow htaccess as an extension (a restricted permission), or a contributed module or custom code that overrides allowed file uploads.
Problem types: description: Arbitrary PHP code execution
Affected products: vendor: Drupal
product: Core
Published: 2023-04-26T00:00:00.000Z
CVE-2022-25278 
Under certain circumstances, the Drupal core form API evaluates form element access incorrectly. This may lead to a user being able to alter data they should not have access to. No forms provided by Drupal core are known to be vulnerable. However, forms added through contributed or custom modules or themes may be affected.
Problem types: description: Access Bypass
Affected products: vendor: Drupal
product: Core
Published: 2023-04-26T00:00:00.000Z
CVE-2022-25290 
WatchGuard Firebox and XTM appliances allow an authenticated remote attacker with unprivileged credentials to retrieve certificate private keys. This vulnerability impacts Fireware OS before 12.7.2_U2, 12.x before 12.1.3_U8, and 12.2.x through 12.5.x before 12.5.9_U2.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-24T04:56:49.000Z
CVE-2022-25291 
An integer overflow in WatchGuard Firebox and XTM appliances allows an authenticated remote attacker to trigger a heap-based buffer overflow and potentially execute arbitrary code by initiating a firmware update with a malicious upgrade image. This vulnerability impacts Fireware OS before 12.7.2_U2, 12.x before 12.1.3_U8, and 12.2.x through 12.5.x before 12.5.9_U2.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-24T04:57:04.000Z
CVE-2022-25292 
A wgagent stack-based buffer overflow in WatchGuard Firebox and XTM appliances allows an authenticated remote attacker to potentially execute arbitrary code by initiating a firmware update with a malicious upgrade image. This vulnerability impacts Fireware OS before 12.7.2_U2, 12.x before 12.1.3_U8, and 12.2.x through 12.5.x before 12.5.9_U2.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-24T04:55:17.000Z
CVE-2022-25293 
A systemd stack-based buffer overflow in WatchGuard Firebox and XTM appliances allows an authenticated remote attacker to potentially execute arbitrary code by initiating a firmware update with a malicious upgrade image. This vulnerability impacts Fireware OS before 12.7.2_U2, 12.x before 12.1.3_U8, and 12.2.x through 12.5.x before 12.5.9_U2.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-24T04:55:47.000Z
CVE-2022-25294 
Proofpoint Insider Threat Management Agent for Windows relies on an inherently dangerous function that could enable an unprivileged local Windows user to run arbitrary code with SYSTEM privileges. All versions prior to 7.12.1 are affected. Agents for MacOS and Linux and Cloud are unaffected. Proofpoint has released fixed software version 7.12.1. The fixed software versions are available through the customer support portal.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-07T17:54:08.000Z
CVE-2022-25295 Open Redirect
This affects the package github.com/gophish/gophish before 0.12.0. The Open Redirect vulnerability exists in the next query parameter. The application uses url.Parse(r.FormValue("next")) to extract path and eventually redirect user to a relative URL, but if next parameter starts with multiple backslashes like \\\\\\example.com, browser will redirect user to http://example.com.
Problem types: description: Open Redirect
Affected products: vendor: n/a
product: github.com/gophish/gophish
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
exploitCodeMaturity: PROOF_OF_CONCEPT
integrityImpact: LOW
privilegesRequired: NONE
remediationLevel: UNAVAILABLE
reportConfidence: CONFIRMED
scope: UNCHANGED
temporalScore: 5.1
temporalSeverity: MEDIUM
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:U/RC:C
version: 3.1
Credits: lang: en
value: Snyk Security Team
Published: 2022-09-11T13:45:20.564Z
CVE-2022-25296 Prototype Pollution
The package bodymen from 0.0.0 are vulnerable to Prototype Pollution via the handler function which could be tricked into adding or modifying properties of Object.prototype using a __proto__ payload. **Note:** This vulnerability derives from an incomplete fix to [CVE-2019-10792](https://security.snyk.io/vuln/SNYK-JS-BODYMEN-548897)
Problem types: description: Prototype Pollution
Affected products: vendor: n/a
product: bodymen
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
exploitCodeMaturity: PROOF_OF_CONCEPT
integrityImpact: LOW
privilegesRequired: LOW
remediationLevel: OFFICIAL_FIX
reportConfidence: CONFIRMED
scope: UNCHANGED
temporalScore: 5.7
temporalSeverity: MEDIUM
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
version: 3.1
Credits: lang: en
value: P.Adithya Srinivas
lang: en
value: Masudul Hasan Masud Bhuiyan
lang: en
value: Cristian-Alexandru Staicu
Published: 2022-03-17T11:20:16.628Z
CVE-2022-25297 Arbitrary File Write
This affects the package drogonframework/drogon before 1.7.5. The unsafe handling of file names during upload using HttpFile::save() method may enable attackers to write files to arbitrary locations outside the designated target folder.
Problem types: description: Arbitrary File Write
Affected products: vendor: n/a
product: drogonframework/drogon
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Snyk Security Team
Published: 2022-02-21T08:00:17.382Z
CVE-2022-25298 Path Traversal
This affects the package sprinfall/webcc before 0.3.0. It is possible to traverse directories to fetch arbitrary files from the server.
Problem types: description: Path Traversal
Affected products: vendor: n/a
product: sprinfall/webcc
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
exploitCodeMaturity: PROOF_OF_CONCEPT
integrityImpact: NONE
privilegesRequired: NONE
remediationLevel: UNAVAILABLE
reportConfidence: CONFIRMED
scope: UNCHANGED
temporalScore: 7.1
temporalSeverity: HIGH
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:U/RC:C
version: 3.1
Credits: lang: en
value: Snyk Security Team
Published: 2022-02-18T12:55:13.899Z
CVE-2022-25299 Arbitrary File Write
This affects the package cesanta/mongoose before 7.6. The unsafe handling of file names during upload using mg_http_upload() method may enable attackers to write files to arbitrary locations outside the designated target folder.
Problem types: description: Arbitrary File Write
Affected products: vendor: n/a
product: cesanta/mongoose
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Snyk Security Team
Published: 2022-02-18T12:55:21.998Z
CVE-2022-25301 Prototype Pollution
All versions of package jsgui-lang-essentials are vulnerable to Prototype Pollution due to allowing all Object attributes to be altered, including their magical attributes such as proto, constructor and prototype.
Problem types: description: Prototype Pollution
Affected products: vendor: n/a
product: jsgui-lang-essentials
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.7
baseSeverity: HIGH
confidentialityImpact: LOW
exploitCodeMaturity: PROOF_OF_CONCEPT
integrityImpact: HIGH
privilegesRequired: NONE
remediationLevel: NOT_DEFINED
reportConfidence: NOT_DEFINED
scope: UNCHANGED
temporalScore: 7.3
temporalSeverity: HIGH
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H/E:P
version: 3.1
Credits: lang: en
value: Yuhan Gao
lang: en
value: zpbrent(zhou
lang: en
value: peng@shu)
Published: 2022-05-01T16:25:12.415Z
CVE-2022-25302 Denial of Service (DoS)
All versions of package asneg/opcuastack are vulnerable to Denial of Service (DoS) due to a missing handler for failed casting when unvalidated data is forwarded to boost::get function in OpcUaNodeIdBase.h. Exploiting this vulnerability is possible when sending a specifically crafted OPC UA message with a special encoded NodeId.
Problem types: description: Denial of Service (DoS)
Affected products: vendor: n/a
product: ASNeG/OpcUaStack
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
exploitCodeMaturity: PROOF_OF_CONCEPT
integrityImpact: NONE
privilegesRequired: NONE
remediationLevel: NOT_DEFINED
reportConfidence: NOT_DEFINED
scope: UNCHANGED
temporalScore: 7.1
temporalSeverity: HIGH
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P
version: 3.1
Credits: lang: en
value: Vera Mens
lang: en
value: Uri Katz
lang: en
value: Sharon Brizinov of Team82 (Claroty Research)
Published: 2022-08-23T05:00:17.555Z
CVE-2022-25303 Cross-site Scripting (XSS)
The package whoogle-search before 0.7.2 are vulnerable to Cross-site Scripting (XSS) via the query string parameter q. In the case where it does not contain the http string, it is used to build the error_message that is then rendered in the error.html template, using the [flask.render_template](https://flask.palletsprojects.com/en/2.1.x/api/flask.render_template) function. However, the error_message is rendered using the [| safe filter](https://jinja.palletsprojects.com/en/3.1.x/templates/working-with-automatic-escaping), meaning the user input is not escaped.
Problem types: description: Cross-site Scripting (XSS)
Affected products: vendor: n/a
product: whoogle-search
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
exploitCodeMaturity: PROOF_OF_CONCEPT
integrityImpact: LOW
privilegesRequired: NONE
remediationLevel: NOT_DEFINED
reportConfidence: NOT_DEFINED
scope: UNCHANGED
temporalScore: 5.1
temporalSeverity: MEDIUM
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P
version: 3.1
Credits: lang: en
value: Alessio Della Libera of Snyk Security Team
Published: 2022-07-12T14:20:11.761Z
CVE-2022-25304 Denial of Service (DoS)
All versions of package opcua; all versions of package asyncua are vulnerable to Denial of Service (DoS) due to a missing limitation on the number of received chunks - per single session or in total for all concurrent sessions. An attacker can exploit this vulnerability by sending an unlimited number of huge chunks (e.g. 2GB each) without sending the Final closing chunk.
Problem types: description: Denial of Service (DoS)
Affected products: vendor: n/a
product: opcua
vendor: n/a
product: asyncua
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
exploitCodeMaturity: PROOF_OF_CONCEPT
integrityImpact: NONE
privilegesRequired: NONE
remediationLevel: NOT_DEFINED
reportConfidence: NOT_DEFINED
scope: UNCHANGED
temporalScore: 7.1
temporalSeverity: HIGH
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P
version: 3.1
Credits: lang: en
value: Vera Mens
lang: en
value: Uri Katz
lang: en
value: Sharon Brizinov of Team82 (Claroty Research)
Published: 2022-08-23T05:05:11.904Z
CVE-2022-25305 WP Statistics <= 13.1.5 Unauthenticated Stored Cross-Site Scripting via IP
The WP Statistics WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the IP parameter found in the ~/includes/class-wp-statistics-ip.php file which allows attackers to inject arbitrary web scripts onto several pages that execute when site administrators view a sites statistics, in versions up to and including 13.1.5.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: WP Statistics
product: WP Statistics
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.2
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: Muhammad Zeeshan (Xib3rR4dAr)
Published: 2022-02-24T18:27:11.000Z
CVE-2022-25306 WP Statistics <= 13.1.5 Unauthenticated Stored Cross-Site Scripting via browser
The WP Statistics WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the browser parameter found in the ~/includes/class-wp-statistics-visitor.php file which allows attackers to inject arbitrary web scripts onto several pages that execute when site administrators view a sites statistics, in versions up to and including 13.1.5.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: WP Statistics
product: WP Statistics
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.2
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: Muhammad Zeeshan (Xib3rR4dAr)
Published: 2022-02-24T18:27:09.000Z
CVE-2022-25307 WP Statistics <= 13.1.5 Unauthenticated Stored Cross-Site Scripting via platform
The WP Statistics WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the platform parameter found in the ~/includes/class-wp-statistics-hits.php file which allows attackers to inject arbitrary web scripts onto several pages that execute when site administrators view a sites statistics, in versions up to and including 13.1.5.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: WP Statistics
product: WP Statistics
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.2
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: Muhammad Zeeshan (Xib3rR4dAr)
Published: 2022-02-24T18:27:12.000Z
CVE-2022-25308 
A stack-based buffer overflow flaw was found in the Fribidi package. This flaw allows an attacker to pass a specially crafted file to the Fribidi application, which leads to a possible memory leak or a denial of service.
Problem types: cwe_id: CWE-121
description: CWE-121 - Stack-based Buffer Overflow.
Affected products: vendor: n/a
product: fribidi
Published: 2022-09-06T17:18:52.000Z
CVE-2022-25309 
A heap-based buffer overflow flaw was found in the Fribidi package and affects the fribidi_cap_rtl_to_unicode() function of the fribidi-char-sets-cap-rtl.c file. This flaw allows an attacker to pass a specially crafted file to the Fribidi application with the '--caprtl' option, leading to a crash and causing a denial of service.
Problem types: cwe_id: CWE-122
description: CWE-122 - Heap-based Buffer Overflow.
Affected products: vendor: n/a
product: fribidi
Published: 2022-09-06T17:18:52.000Z
CVE-2022-25310 
A segmentation fault (SEGV) flaw was found in the Fribidi package and affects the fribidi_remove_bidi_marks() function of the lib/fribidi.c file. This flaw allows an attacker to pass a specially crafted file to Fribidi, leading to a crash and causing a denial of service.
Problem types: cwe_id: CWE-119
description: CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer.
Affected products: vendor: n/a
product: fribidi
Published: 2022-09-06T17:18:52.000Z
CVE-2022-25311 
A vulnerability has been identified in SINEC NMS (All versions >= V1.0.3 < V2.0), SINEC NMS (All versions < V1.0.3), SINEMA Server V14 (All versions). The affected software do not properly check privileges between users during the same web browser session, creating an unintended sphere of control. This could allow an authenticated low privileged user to achieve privilege escalation.
Problem types: cwe_id: CWE-269
description: CWE-269: Improper Privilege Management
Affected products: vendor: Siemens
product: SINEC NMS
default_status: unknown
vendor: Siemens
product: SINEC NMS
default_status: unknown
vendor: Siemens
product: SINEMA Server V14
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:P/RL:T/RC:C
baseScore: 7.3
baseSeverity: HIGH
Published: 2022-03-08T00:00:00.000Z
CVE-2022-25312 An XML external entity (XXE) injection vulnerability exists in the Apache Any23 RDFa XSLTStylesheet extractor
An XML external entity (XXE) injection vulnerability was discovered in the Any23 RDFa XSLTStylesheet extractor and is known to affect Any23 versions < 2.7. XML external entity injection (also known as XXE) is a web security vulnerability that allows an attacker to interfere with an application's processing of XML data. It often allows an attacker to view files on the application server filesystem, and to interact with any back-end or external systems that the application itself can access. This issue is fixed in Apache Any23 2.7.
Problem types: description: An XML external entity (XXE) injection vulnerability exists in the Apache Any23 RDFa XSLTStylesheet extractor
Affected products: vendor: Apache Software Foundation
product: Apache Any23
Credits: lang: en
value: The Apache Any23 Project Management Committee would like to thank Lion Tree a.k.a liontree0110 for reporting this issue.
Published: 2022-03-04T23:25:08.000Z
CVE-2022-25313 
In Expat (aka libexpat) before 2.4.5, an attacker can trigger stack exhaustion in build_model via a large nesting depth in the DTD element.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-18T04:23:04.000Z
CVE-2022-25314 
In Expat (aka libexpat) before 2.4.5, there is an integer overflow in copyString.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-18T04:25:11.000Z
CVE-2022-25315 
In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-18T04:24:43.000Z
CVE-2022-25317 
An issue was discovered in Cerebrate through 1.4. genericForm allows reflected XSS in form descriptions via a user-controlled description.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-18T00:00:00.000Z
CVE-2022-25318 
An issue was discovered in Cerebrate through 1.4. An incorrect sharing group ACL allowed an unprivileged user to edit and modify sharing groups.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-18T00:00:00.000Z
CVE-2022-25319 
An issue was discovered in Cerebrate through 1.4. Endpoints could be open even when not enabled.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-18T00:00:00.000Z
CVE-2022-25320 
An issue was discovered in Cerebrate through 1.4. Username enumeration could occur.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-18T00:00:00.000Z
CVE-2022-25321 
An issue was discovered in Cerebrate through 1.4. XSS could occur in the bookmarks component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-18T00:00:00.000Z
CVE-2022-25322 
ZEROF Web Server 2.0 allows /HandleEvent SQL Injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-18T16:58:09.000Z
CVE-2022-25323 
ZEROF Web Server 2.0 allows /admin.back XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-18T16:19:28.000Z