rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-48312 
The HwPCAssistant module has the out-of-bounds read/write vulnerability. Successful exploitation of this vulnerability may affect confidentiality and integrity.
Problem types: description: out-of-bounds read/write vulnerability
Affected products: vendor: Huawei
product: HarmonyOS
default_status: unaffected
vendor: Huawei
product: EMUI
default_status: unaffected
Published: 2023-04-16T06:01:46.922Z
CVE-2022-48313 
The Bluetooth module has a vulnerability of bypassing the user confirmation in the pairing process. Successful exploitation of this vulnerability may affect confidentiality.
Problem types: description: Business Logic Errors
Affected products: vendor: Huawei
product: HarmonyOS
default_status: unaffected
vendor: Huawei
product: EMUI
default_status: unaffected
Published: 2023-04-16T07:07:28.234Z
CVE-2022-48314 
The Bluetooth module has a vulnerability of bypassing the user confirmation in the pairing process. Successful exploitation of this vulnerability may affect confidentiality.
Problem types: description: Bluetooth vulnerability  confidentiality
Affected products: vendor: Huawei
product: HarmonyOS
default_status: unaffected
vendor: Huawei
product: EMUI
default_status: unaffected
Published: 2023-04-16T07:11:54.749Z
CVE-2022-48317 Insecure Termination of RestAPI Session Tokens
Expired sessions were not securely terminated in the RestAPI for Tribe29's Checkmk <= 2.1.0p10 and Checkmk <= 2.0.0p28 allowing an attacker to use expired session tokens when communicating with the RestAPI.
Problem types: cwe_id: CWE-613
description: CWE-613 Insufficient Session Expiration
Affected products: vendor: Tribe29
product: Checkmk
default_status: unaffected
CVSS v3.1: baseScore: 5.6
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
version: 3.1
Published: 2023-02-20T16:55:28.000Z
CVE-2022-48318 Insecure access control mechanisms for RestAPI documentation
No authorisation controls in the RestAPI documentation for Tribe29's Checkmk <= 2.1.0p13 and Checkmk <= 2.0.0p29 which may lead to unintended information disclosure through automatically generated user specific tags within Rest API documentation.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: Tribe29
product: Checkmk
default_status: unaffected
CVSS v3.1: baseScore: 5.3
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Published: 2023-02-20T16:55:53.162Z
CVE-2022-48319 Host secret disclosed in Checkmk logs
Sensitive host secret disclosed in cmk-update-agent.log file in Tribe29's Checkmk <= 2.1.0p13, Checkmk <= 2.0.0p29, and all versions of Checkmk 1.6.0 (EOL) allows an attacker to gain access to the host secret through the unprotected agent updater log file.
Problem types: cwe_id: CWE-200
description: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: Tribe29
product: Checkmk
default_status: unaffected
CVSS v3.1: baseScore: 6.5
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
version: 3.1
Published: 2023-02-20T16:56:18.397Z
CVE-2022-48320 CSRF in add-visual endpoint
Cross-site Request Forgery (CSRF) in Tribe29's Checkmk <= 2.1.0p17, Checkmk <= 2.0.0p31, and all versions of Checkmk 1.6.0 (EOL) allow an attacker to add new visual elements to multiple pages.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Tribe29
product: Checkmk
default_status: unaffected
CVSS v3.1: baseScore: 5.4
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
version: 3.1
Credits: lang: en
value: Jan Hörsch (SSE – Secure Systems Engineering GmbH)
Published: 2023-02-20T16:56:40.889Z
CVE-2022-48321 SSRF in agent-receiver API
Limited Server-Side Request Forgery (SSRF) in agent-receiver in Tribe29's Checkmk <= 2.1.0p11 allows an attacker to communicate with local network restricted endpoints by use of the host registration API.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Tribe29
product: Checkmk
default_status: unaffected
CVSS v3.1: baseScore: 6.8
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Stefan Schiller (SonarSource)
Published: 2023-02-20T16:54:44.369Z
CVE-2022-48322 
NETGEAR Nighthawk WiFi Mesh systems and routers are affected by a stack-based buffer overflow vulnerability. This affects MR60 before 1.1.7.132, MS60 before 1.1.7.132, R6900P before 1.3.3.154, R7000P before 1.3.3.154, R7960P before 1.4.4.94, and R8000P before 1.4.4.94.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-13T00:00:00.000Z
CVE-2022-48323 
Sunlogin Sunflower Simplified (aka Sunflower Simple and Personal) 1.0.1.43315 is vulnerable to a path traversal issue. A remote and unauthenticated attacker can execute arbitrary programs on the victim host by sending a crafted HTTP request, as demonstrated by /check?cmd=ping../ followed by the pathname of the powershell.exe program.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-13T00:00:00.000Z
CVE-2022-48324 
Multiple Cross Site Scripting (XSS) vulnerabilities in Mapos 4.39.0 allow attackers to execute arbitrary code. Affects the following parameters: (1) pesquisa, (2) data, (3) data2, (4) nome, (5) descricao, (6) idDocumentos, (7) id in file application/controllers/Arquivos.php; (8) senha, (9) nomeCliente, (10) contato, (11) documento, (12) telefone, (13) celular, (14) email, (15) rua, (16) numero, (17) complemento, (18) bairro, (19) cidade, (20) estado, (21) cep, (22) idClientes, (23) id in file application/controllers/Clientes.php; (24) id, (25) tipo, (26) forma_pagamento, (27) gateway_de_pagamento, (28) excluir_id, (29) confirma_id, (30) cancela_id in file application/controllers/Cobrancas.php; (31) vencimento_de, (32) vencimento_ate, (33) cliente, (34) tipo, (35) status, (36) valor_desconto, (37) desconto, (38) periodo, (39) per_page, (40) urlAtual, (41) vencimento, (42) recebimento, (43) valor, (44) recebido, (45) formaPgto, (46) desconto_parc, (47) entrada, (48) qtdparcelas_parc, (49) valor_parc, (50) dia_pgto, (51) dia_base_pgto, (52) comissao, (53) descricao_parc, (54) cliente_parc, (55) observacoes_parc, (56) formaPgto_parc, (57) tipo_parc, (58) pagamento, (59) pago, (60) valor_desconto_editar, (61) descricao, (62) fornecedor, (63) observacoes, (64) id in file application/controllers/Financeiro.php; (65) refGarantia, (66) textoGarantia, (67) idGarantias in file application/controllers/Garantias.php; (68) email, (69) senha in file application/controllers/Login.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-16T00:00:00.000Z
CVE-2022-48325 
Multiple Cross Site Scripting (XSS) vulnerabilities in Mapos 4.39.0 allow attackers to execute arbitrary code. Affects the following parameters: (1) year, (2) oldSenha, (3) novaSenha, (4) termo, (5) nome, (6) cnpj, (7) ie, (8) cep, (9) logradouro, (10) numero, (11) bairro, (12) cidade, (13) uf, (14) telefone, (15) email, (16) id, (17) app_name, (18) per_page, (19) app_theme, (20) os_notification, (21) email_automatico, (22) control_estoque, (23) notifica_whats, (24) control_baixa, (25) control_editos, (26) control_edit_vendas, (27) control_datatable, (28) pix_key, (29) os_status_list, (30) control_2vias, (31) status, (32) start, (33) end in file application/controllers/Mapos.php; (34) token, (35) senha, (36) email, (37) nomeCliente, (38) documento, (39) telefone, (40) celular, (41) rua, (42) numero, (43) complemento, (44) bairro, (45) cidade, (46) estado, (47) cep, (48) idClientes, (49) descricaoProduto, (50) defeito in file application/controllers/Mine.php; (51) pesquisa, (52) status, (53) data, (54) data2, (55) dataInicial, (56) dataFinal, (57) termoGarantia, (58) garantias_id, (59) clientes_id, (60) usuarios_id, (61) idOs, (62) garantia, (63) descricaoProduto, (64) defeito, (65) observacoes, (66) laudoTecnico, (67) id, (68) preco, (69) quantidade, (70) idProduto, (71) idOsProduto, (72) produto, (73) idServico, (74) idOsServico, (75) desconto, (76) tipoDesconto, (77) resultado, (78) vencimento, (79) recebimento, (80) os_id, (81) valor, (82) recebido, (83) formaPgto, (84) tipo, (85) anotacao, (86) idAnotacao in file application/controllers/Os.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-16T00:00:00.000Z
CVE-2022-48326 
Multiple Cross Site Scripting (XSS) vulnerabilities in Mapos 4.39.0 allow attackers to execute arbitrary code. Affects the following parameters: (1) nome, (2) aCliente, (3) eCliente, (4) dCliente, (5) vCliente, (6) aProduto, (7) eProduto, (8) dProduto, (9) vProduto, (10) aServico, (11) eServico, (12) dServico, (13) vServico, (14) aOs, (15) eOs, (16) dOs, (17) vOs, (18) aVenda, (19) eVenda, (20) dVenda, (21) vVenda, (22) aGarantia, (23) eGarantia, (24) dGarantia, (25) vGarantia, (26) aArquivo, (27) eArquivo, (28) dArquivo, (29) vArquivo, (30) aPagamento, (31) ePagamento, (32) dPagamento, (33) vPagamento, (34) aLancamento, (35) eLancamento, (36) dLancamento, (37) vLancamento, (38) cUsuario, (39) cEmitente, (40) cPermissao, (41) cBackup, (42) cAuditoria, (43) cEmail, (44) cSistema, (45) rCliente, (46) rProduto, (47) rServico, (48) rOs, (49) rVenda, (50) rFinanceiro, (51) aCobranca, (52) eCobranca, (53) dCobranca, (54) vCobranca, (55) situacao, (56) idPermissao, (57) id in file application/controllers/Permissoes.php; (58) precoCompra, (59) precoVenda, (60) descricao, (61) unidade, (62) estoque, (63) estoqueMinimo, (64) idProdutos, (65) id, (66) estoqueAtual in file application/controllers/Produtos.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-16T00:00:00.000Z
CVE-2022-48327 
Multiple Cross Site Scripting (XSS) vulnerabilities in Mapos 4.39.0 allow attackers to execute arbitrary code. Affects the following parameters: (1) dataInicial, (2) dataFinal, (3) tipocliente, (4) format, (5) precoInicial, (6) precoFinal, (7) estoqueInicial, (8) estoqueFinal, (9) de_id, (10) ate_id, (11) clientes_id, (12) origem, (13) cliente, (14) responsavel, (15) status, (16) tipo, (17) situacao in file application/controllers/Relatorios.php; (18) preco, (19) nome, (20) descricao, (21) idServicos, (22) id in file application/controllers/Servicos.php; (23) senha, (24) permissoes_id, (25) idUsuarios, (26) situacao, (27) nome, (28) rg, (29) cpf, (30) cep, (31) rua, (32) numero, (33) bairro, (34) cidade, (35) estado, (36) email, (37) telefone, (38) celular in file application/controllers/Usuarios.php; (39) dataVenda, (40) observacoes, (41) observacoes_cliente, (42) clientes_id, (43) usuarios_id, (44) idVendas, (45) id, (46) idVendasProduto, (47) preco, (48) quantidade, (49) idProduto, (50) produto, (51) desconto, (52) tipoDesconto, (53) resultado, (54) vendas_id, (55) vencimento, (56) recebimento, (57) valor, (58) recebido, (59) formaPgto, (60) tipo in file application/controllers/Vendas.php; (61) situacao, (62) periodo, (63) vencimento_de, (64) vencimento_ate, (65) tipo, (66) status, (67) cliente in file application/views/financeiro/lancamentos.php; (68) year in file application/views/mapos/painel.php; (69) pesquisa in file application/views/os/os.php; (70) etiquetaCode in file application/views/relatorios/imprimir/imprimirEtiquetas.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-16T00:00:00.000Z
CVE-2022-48328 
app/Controller/Component/IndexFilterComponent.php in MISP before 2.4.167 mishandles ordered_url_params and additional_delimiters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-20T00:00:00.000Z
CVE-2022-48329 
MISP before 2.4.166 unsafely allows users to use the order parameter, related to app/Model/Attribute.php, app/Model/GalaxyCluster.php, app/Model/Workflow.php, and app/Plugin/Assets/models/behaviors/LogableBehavior.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-20T00:00:00.000Z
CVE-2022-48330 
A Huawei sound box product has an out-of-bounds write vulnerability. Attackers can exploit this vulnerability to cause buffer overflow. Affected product versions include:FLMG-10 versions FLMG-10 10.0.1.0(H100SP22C00).
Problem types: description: Out-of-Bounds Write
Affected products: vendor: Huawei
product: FLMG-10
default_status: unaffected
Published: 2023-06-16T12:51:41.699Z
CVE-2022-48331 
Widevine Trusted Application (TA) 5.0.0 through 5.1.1 has a drm_save_keys feature_name_len integer overflow and resultant buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-06-26T00:00:00.000Z
CVE-2022-48332 
Widevine Trusted Application (TA) 5.0.0 through 5.1.1 has a drm_save_keys file_name_len integer overflow and resultant buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-06-26T00:00:00.000Z
CVE-2022-48333 
Widevine Trusted Application (TA) 5.0.0 through 5.1.1 has a drm_verify_keys prefix_len+feature_name_len integer overflow and resultant buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-06-26T00:00:00.000Z
CVE-2022-48334 
Widevine Trusted Application (TA) 5.0.0 through 5.1.1 has a drm_verify_keys total_len+file_name_len integer overflow and resultant buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-06-26T00:00:00.000Z
CVE-2022-48335 
Widevine Trusted Application (TA) 5.0.0 through 7.1.1 has a PRDiagVerifyProvisioning integer overflow and resultant buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-06-26T00:00:00.000Z
CVE-2022-48336 
Widevine Trusted Application (TA) 5.0.0 through 7.1.1 has a PRDiagParseAndStoreData integer overflow and resultant buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-06-26T00:00:00.000Z
CVE-2022-48337 
GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file, because lib-src/etags.c uses the system C library function in its implementation of the etags program. For example, a victim may use the "etags -u *" command (suggested in the etags documentation) in a situation where the current working directory has contents that depend on untrusted input.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-20T00:00:00.000Z
CVE-2022-48338 
An issue was discovered in GNU Emacs through 28.2. In ruby-mode.el, the ruby-find-library-file function has a local command injection vulnerability. The ruby-find-library-file function is an interactive function, and bound to C-c C-f. Inside the function, the external command gem is called through shell-command-to-string, but the feature-name parameters are not escaped. Thus, malicious Ruby source files may cause commands to be executed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-20T00:00:00.000Z
CVE-2022-48339 
An issue was discovered in GNU Emacs through 28.2. htmlfontify.el has a command injection vulnerability. In the hfy-istext-command function, the parameter file and parameter srcdir come from external input, and parameters are not escaped. If a file name or directory name contains shell metacharacters, code may be executed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-20T00:00:00.000Z
CVE-2022-48340 
In Gluster GlusterFS 11.0, there is an xlators/cluster/dht/src/dht-common.c dht_setxattr_mds_cbk use-after-free.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-21T00:00:00.000Z
CVE-2022-48341 
ThingsBoard 3.4.1 could allow a remote authenticated attacker to achieve Vertical Privilege Escalation. A Tenant Administrator can obtain System Administrator dashboard access by modifying the scope via the scopes parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-23T00:00:00.000Z
CVE-2022-48342 
In JetBrains TeamCity before 2022.10.2 jVMTI was enabled by default on agents.
Problem types: cwe_id: CWE-1188
description: CWE-1188
Affected products: vendor: JetBrains
product: TeamCity
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 5.2
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Published: 2023-02-23T15:44:23.524Z
CVE-2022-48343 
In JetBrains TeamCity before 2022.10.2 there was an XSS vulnerability in the user creation process.
Problem types: cwe_id: CWE-79
description: CWE-79
Affected products: vendor: JetBrains
product: TeamCity
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Published: 2023-02-23T15:44:23.994Z
CVE-2022-48344 
In JetBrains TeamCity before 2022.10.2 there was an XSS vulnerability in the group creation process.
Problem types: cwe_id: CWE-79
description: CWE-79
Affected products: vendor: JetBrains
product: TeamCity
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Published: 2023-02-23T15:44:24.533Z
CVE-2022-48345 
sanitize-url (aka @braintree/sanitize-url) before 6.0.2 allows XSS via HTML entities.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-24T00:00:00.000Z
CVE-2022-48346 
The HwContacts module has a logic bypass vulnerability. Successful exploitation of this vulnerability may affect confidentiality.
Problem types: description: Logic bypass vulnerability
Affected products: vendor: Huawei
product: HarmonyOS
vendor: Huawei
product: EMUI
Published: 2023-03-27T00:00:00.000Z
CVE-2022-48347 
The MediaProvider module has a vulnerability in permission verification. Successful exploitation of this vulnerability may affect confidentiality.
Problem types: description: Permission verification vulnerability
Affected products: vendor: Huawei
product: HarmonyOS
vendor: Huawei
product: EMUI
Published: 2023-03-27T00:00:00.000Z
CVE-2022-48348 
The MediaProvider module has a vulnerability of unauthorized data read. Successful exploitation of this vulnerability may affect confidentiality and integrity.
Problem types: description: Unauthorized data read vulnerability
Affected products: vendor: Huawei
product: HarmonyOS
vendor: Huawei
product: EMUI
Published: 2023-03-27T00:00:00.000Z
CVE-2022-48349 
The control component has a spoofing vulnerability. Successful exploitation of this vulnerability may affect confidentiality and availability.
Problem types: description: Spoofing vulnerability
Affected products: vendor: Huawei
product: HarmonyOS
vendor: Huawei
product: EMUI
Published: 2023-03-27T00:00:00.000Z
CVE-2022-48350 
The HUAWEI Messaging app has a vulnerability of unauthorized file access. Successful exploitation of this vulnerability may affect confidentiality.
Problem types: description: Unauthorized file access vulnerability
Affected products: vendor: Huawei
product: HarmonyOS
vendor: Huawei
product: EMUI
Published: 2023-03-27T00:00:00.000Z
CVE-2022-48351 
The secure OS module has configuration defects. Successful exploitation of this vulnerability may affect availability.
Problem types: description: Configuration defect
Affected products: vendor: Huawei
product: HarmonyOS
vendor: Huawei
product: EMUI
Published: 2023-03-27T00:00:00.000Z
CVE-2022-48352 
Some smartphones have data initialization issues. Successful exploitation of this vulnerability may cause a system panic.
Problem types: description: Data initialization vulnerability
Affected products: vendor: Huawei
product: HarmonyOS
vendor: Huawei
product: EMUI
Published: 2023-03-27T00:00:00.000Z
CVE-2022-48353 
Some smartphones have configuration issues. Successful exploitation of this vulnerability may cause kernel privilege escalation, which results in system service exceptions.
Problem types: description: Configuration defect
Affected products: vendor: Huawei
product: HarmonyOS
vendor: Huawei
product: EMUI
Published: 2023-03-27T00:00:00.000Z
CVE-2022-48354 
The Bluetooth module has a heap out-of-bounds write vulnerability. Successful exploitation of this vulnerability can cause the Bluetooth process to crash.
Problem types: description: Heap out-of-bounds write vulnerability
Affected products: vendor: Huawei
product: HarmonyOS
vendor: Huawei
product: EMUI
Published: 2023-03-27T00:00:00.000Z
CVE-2022-48355 
The Bluetooth module has a heap out-of-bounds read vulnerability. Successful exploitation of this vulnerability can cause the Bluetooth process to crash.
Problem types: description: Heap out-of-bounds read vulnerability
Affected products: vendor: Huawei
product: HarmonyOS
vendor: Huawei
product: EMUI
Published: 2023-03-27T00:00:00.000Z
CVE-2022-48356 
The facial recognition module has a vulnerability in input parameter verification. Successful exploitation of this vulnerability may cause failed facial recognition.
Problem types: description: Input parameter verification vulnerability
Affected products: vendor: Huawei
product: HarmonyOS
vendor: Huawei
product: EMUI
Published: 2023-03-27T00:00:00.000Z
CVE-2022-48357 
Some products have the double fetch vulnerability. Successful exploitation of this vulnerability may cause denial of service (DoS) attacks to the kernel.
Problem types: description: Double fetch vulnerability
Affected products: vendor: Huawei
product: HarmonyOS
vendor: Huawei
product: EMUI
Published: 2023-03-27T00:00:00.000Z
CVE-2022-48358 
The BatteryHealthActivity has a redirection vulnerability. Successful exploitation of this vulnerability by a malicious app can cause service exceptions.
Problem types: description: Redirection vulnerability
Affected products: vendor: Huawei
product: HarmonyOS
vendor: Huawei
product: EMUI
Published: 2023-03-27T00:00:00.000Z
CVE-2022-48359 
The recovery mode for updates has a vulnerability that causes arbitrary disk modification. Successful exploitation of this vulnerability may affect confidentiality.
Problem types: description: Arbitrary disk modification vulnerability
Affected products: vendor: Huawei
product: HarmonyOS
vendor: Huawei
product: EMUI
Published: 2023-03-27T00:00:00.000Z
CVE-2022-48360 
The facial recognition module has a vulnerability in file permission control. Successful exploitation of this vulnerability may affect confidentiality.
Problem types: description: Improper permission control vulnerability
Affected products: vendor: Huawei
product: HarmonyOS
vendor: Huawei
product: EMUI
Published: 2023-03-27T00:00:00.000Z
CVE-2022-48361 
The Always On Display (AOD) has a path traversal vulnerability in theme files. Successful exploitation of this vulnerability may cause a failure in reading AOD theme resources.
Problem types: description: Path traversal vulnerability
Affected products: vendor: Huawei
product: HarmonyOS
vendor: Huawei
product: EMUI
Published: 2023-03-27T00:00:00.000Z
CVE-2022-48362 
Zoho ManageEngine Desktop Central and Desktop Central MSP before 10.1.2137.2 allow directory traversal via computerName to AgentLogUploadServlet. A remote, authenticated attacker could upload arbitrary code that would be executed when Desktop Central is restarted. (The attacker could authenticate by exploiting CVE-2021-44515.)
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-25T00:00:00.000Z