rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-38465 
A vulnerability has been identified in SIMATIC Drive Controller family (All versions < V2.9.2), SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants) (All versions), SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) (All versions < V21.9), SIMATIC S7-1200 CPU family (incl. SIPLUS variants) (All versions < V4.5.0), SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants) (All versions < V2.9.2), SIMATIC S7-1500 Software Controller (All versions < V21.9), SIMATIC S7-PLCSIM Advanced (All versions < V4.0), SINUMERIK MC (All versions < V6.21), SINUMERIK ONE (All versions < V6.21). Affected products  protect the built-in global private key in a way that cannot be considered sufficient any longer. The key is used for the legacy protection of confidential configuration data and the legacy PG/PC and HMI communication.

This could allow attackers to discover the private key of a CPU product family by an offline attack against a single CPU of the family. Attackers could then use this knowledge to extract confidential configuration data from projects that are protected by that key or to perform attacks against legacy PG/PC and HMI communication.
Problem types: cwe_id: CWE-522
description: CWE-522: Insufficiently Protected Credentials
Affected products: vendor: Siemens
product: SIMATIC Drive Controller family
default_status: unknown
vendor: Siemens
product: SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants)
default_status: unknown
vendor: Siemens
product: SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants)
default_status: unknown
vendor: Siemens
product: SIMATIC S7-1200 CPU family (incl. SIPLUS variants)
default_status: unknown
vendor: Siemens
product: SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants)
default_status: unknown
vendor: Siemens
product: SIMATIC S7-1500 Software Controller
default_status: unknown
vendor: Siemens
product: SIMATIC S7-PLCSIM Advanced
default_status: unknown
vendor: Siemens
product: SINUMERIK MC
default_status: unknown
vendor: Siemens
product: SINUMERIK ONE
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C
baseScore: 9.3
baseSeverity: CRITICAL
Published: 2022-10-11T00:00:00.000Z
CVE-2022-38466 
A vulnerability has been identified in CoreShield One-Way Gateway (OWG) Software (All versions < V2.2). The default installation sets insecure file permissions that could allow a local attacker to escalate privileges to local administrator.
Problem types: cwe_id: CWE-284
description: CWE-284: Improper Access Control
Affected products: vendor: Siemens
product: CoreShield One-Way Gateway (OWG) Software
Published: 2022-09-13T09:40:53.000Z
CVE-2022-38467 WordPress CRM Perks Forms Plugin <= 1.1.0 is vulnerable to Reflected Cross Site Scripting (XSS) vulnerability
Reflected Cross-Site Scripting (XSS) vulnerability in CRM Perks Forms – WordPress Form Builder <= 1.1.0 ver.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: CRM Perks
product: CRM Perks Forms – WordPress Form Builder
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: Tien Nguyen Anh (Patchstack Alliance)
Published: 2023-01-14T10:14:12.393Z
CVE-2022-38468 WordPress NextGEN Gallery Plugin <= 3.28 is vulnerable to Cross Site Request Forgery (CSRF)
Cross-Site Request Forgery (CSRF) vulnerability in Imagely WordPress Gallery Plugin – NextGEN Gallery plugin <= 3.28 leading to thumbnail alteration.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Imagely
product: WordPress Gallery Plugin – NextGEN Gallery
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: Lana Codes (Patchstack Alliance)
Published: 2023-03-01T13:02:01.753Z
CVE-2022-38469 




An unauthorized user with network access and the decryption key could decrypt sensitive data, such as usernames and passwords. 

 

 

 

 


Problem types: cwe_id: CWE-261
description: CWE-261 Weak Encoding for Password
Affected products: vendor: GE Digital 
product: Proficy Historian
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Uri Katz of Claroty Research reported these vulnerabilities to GE. 
Published: 2023-01-17T23:50:53.642Z
CVE-2022-38470 WordPress Customer Reviews for WooCommerce plugin <= 5.3.5 - Cross-Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in Customer Reviews for WooCommerce plugin <= 5.3.5 at WordPress.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: CusRev
product: Customer Reviews for WooCommerce (WordPress plugin)
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: Vulnerability discovered by Muhammad Daffa (Patchstack Alliance)
Published: 2022-09-23T15:08:22.696Z
CVE-2022-38472 
An attacker could have abused XSLT error handling to associate attacker-controlled content with another origin which was displayed in the address bar. This could have been used to fool the user into submitting data intended for the spoofed origin. This vulnerability affects Thunderbird < 102.2, Thunderbird < 91.13, Firefox ESR < 91.13, Firefox ESR < 102.2, and Firefox < 104.
Problem types: description: Address bar spoofing via XSLT error handling
Affected products: vendor: Mozilla
product: Thunderbird
vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Firefox
Published: 2022-12-22T00:00:00.000Z
CVE-2022-38473 
A cross-origin iframe referencing an XSLT document would inherit the parent domain's permissions (such as microphone or camera access). This vulnerability affects Thunderbird < 102.2, Thunderbird < 91.13, Firefox ESR < 91.13, Firefox ESR < 102.2, and Firefox < 104.
Problem types: description: Cross-origin XSLT Documents would have inherited the parent's permissions
Affected products: vendor: Mozilla
product: Thunderbird
vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Firefox
Published: 2022-12-22T00:00:00.000Z
CVE-2022-38474 
A website that had permission to access the microphone could record audio without the audio notification being shown. This bug does not allow the attacker to bypass the permission prompt - it only affects the notification shown once permission has been granted.<br />*This bug only affects Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 104.
Problem types: description: Recording notification not shown when microphone was recording on Android
Affected products: vendor: Mozilla
product: Firefox
Published: 2022-12-22T00:00:00.000Z
CVE-2022-38475 
An attacker could have written a value to the first element in a zero-length JavaScript array. Although the array was zero-length, the value was not written to an invalid memory address. This vulnerability affects Firefox < 104.
Problem types: description: Attacker could write a value to a zero-length array
Affected products: vendor: Mozilla
product: Firefox
Published: 2022-12-22T00:00:00.000Z
CVE-2022-38476 
A data race could occur in the <code>PK11_ChangePW</code> function, potentially leading to a use-after-free vulnerability. In Firefox, this lock protected the data when a user changed their master password. This vulnerability affects Firefox ESR < 102.2 and Thunderbird < 102.2.
Problem types: description: Data race and potential use-after-free in PK11_ChangePW
Affected products: vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Thunderbird
Published: 2022-12-22T00:00:00.000Z
CVE-2022-38477 
Mozilla developer Nika Layzell and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 103 and Firefox ESR 102.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 102.2, Thunderbird < 102.2, and Firefox < 104.
Problem types: description: Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2
Affected products: vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Thunderbird
vendor: Mozilla
product: Firefox
Published: 2022-12-22T00:00:00.000Z
CVE-2022-38478 
Members the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 103, Firefox ESR 102.1, and Firefox ESR 91.12. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 102.2, Thunderbird < 91.13, Firefox ESR < 91.13, Firefox ESR < 102.2, and Firefox < 104.
Problem types: description: Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2, and Firefox ESR 91.13
Affected products: vendor: Mozilla
product: Thunderbird
vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Firefox
Published: 2022-12-22T00:00:00.000Z
CVE-2022-38481 
An issue was discovered in Mega HOPEX 15.2.0.6110 before V5CP2. The application is prone to reflected Cross-site Scripting (XSS) in several features.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AC:L/AV:N/A:N/C:L/I:L/PR:N/S:C/UI:R
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
Published: 2023-01-10T00:00:00.000Z
CVE-2022-38482 
A link-manipulation issue was discovered in Mega HOPEX 15.2.0.6110 before V5CP4.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AC:L/AV:N/A:N/C:L/I:N/PR:N/S:U/UI:R
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
Published: 2023-01-10T00:00:00.000Z
CVE-2022-38484 
An arbitrary file upload and directory traversal vulnerability exist in the file upload functionality of the System Setup menu in AgeVolt Portal prior to version 0.1. A remote authenticated attacker could leverage this vulnerability to upload files to any location on the target operating system with web server privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-24T00:00:00.000Z
CVE-2022-38485 
A directory traversal vulnerability exists in the AgeVolt Portal prior to version 0.1 that leads to Information Disclosure. A remote authenticated attacker could leverage this vulnerability to read files from any location on the target operating system with web server privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-24T00:00:00.000Z
CVE-2022-38488 
logrocket-oauth2-example through 2020-05-27 allows SQL injection via the /auth/register username parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-14T00:00:00.000Z
CVE-2022-38489 
An issue was discovered in EasyVista 2020.2.125.3 and 2022.1.109.0.03 It is prone to stored Cross-site Scripting (XSS). Version 2022.1.110.1.02 fixes the vulnerably.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AC:L/AV:N/A:N/C:L/I:L/PR:H/S:C/UI:R
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 4.8
baseSeverity: MEDIUM
Published: 2023-01-10T00:00:00.000Z
CVE-2022-38490 
An issue was discovered in EasyVista 2020.2.125.3 and 2022.1.109.0.03. Some parameters allow SQL injection. Version 2022.1.110.1.02 corrects this issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AC:L/AV:N/A:N/C:H/I:H/PR:L/S:C/UI:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: NONE
baseScore: 9.6
baseSeverity: CRITICAL
Published: 2023-01-10T00:00:00.000Z
CVE-2022-38491 
An issue was discovered in EasyVista 2020.2.125.3 and 2022.1.109.0.03. Part of the application does not implement protection against brute-force attacks. Version 2022.1.133.0 corrects this issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AC:L/AV:N/A:N/C:H/I:L/PR:N/S:U/UI:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 8.2
baseSeverity: HIGH
Published: 2023-01-10T00:00:00.000Z
CVE-2022-38492 
An issue was discovered in EasyVista 2020.2.125.3 and 2022.1.109.0.03. One parameter allows SQL injection. Version 2022.1.110.1.02 fixes the vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AC:L/AV:N/A:N/C:H/I:N/PR:L/S:C/UI:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
baseScore: 7.7
baseSeverity: HIGH
Published: 2023-01-10T00:00:00.000Z
CVE-2022-38493 
Rhonabwy 0.9.99 through 1.1.x before 1.1.7 doesn't check the RSA private key length before RSA-OAEP decryption. This allows attackers to cause a Denial of Service via a crafted JWE (JSON Web Encryption) token.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-20T19:41:15.000Z
CVE-2022-38495 
LIEF commit 365a16a was discovered to contain a heap-buffer overflow via the function print_binary at /c/macho_reader.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-13T20:16:46.000Z
CVE-2022-38496 
LIEF commit 365a16a was discovered to contain a reachable assertion abort via the component BinaryStream.hpp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-13T20:16:47.000Z
CVE-2022-38497 
LIEF commit 365a16a was discovered to contain a segmentation violation via the component CoreFile.tcc:69.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-13T20:16:48.000Z
CVE-2022-38509 
Wedding Planner v1.0 was discovered to contain a SQL injection vulnerability via the booking_id parameter at /admin/budget.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-19T21:01:51.000Z
CVE-2022-38510 
Tenda_TX9pro V22.03.02.10 was discovered to contain a buffer overflow via the component httpd/SetNetControlList.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-28T23:58:58.000Z
CVE-2022-38511 
TOTOLINK A810R V5.9c.4050_B20190424 was discovered to contain a command injection vulnerability via the component downloadFile.cgi.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-28T23:58:59.000Z
CVE-2022-38512 
The Translation module in Liferay Portal v7.4.3.12 through v7.4.3.36, and Liferay DXP 7.4 update 8 through 36 does not check permissions before allowing a user to export a web content for translation, allowing attackers to download a web content page's XLIFF translation file via crafted URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-22T00:17:41.000Z
CVE-2022-38527 
UCMS v1.6.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Import function under the Site Management page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-19T21:16:03.000Z
CVE-2022-38528 
Open Asset Import Library (assimp) commit 3c253ca was discovered to contain a segmentation violation via the component Assimp::XFileImporter::CreateMeshes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-06T21:08:26.000Z
CVE-2022-38529 
tinyexr commit 0647fb3 was discovered to contain a heap-buffer overflow via the component rleUncompress.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-06T21:08:27.000Z
CVE-2022-38530 
GPAC v2.1-DEV-rev232-gfcaa01ebb-master was discovered to contain a stack overflow when processing ISOM_IOD.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-06T00:00:00.000Z
CVE-2022-38531 
FPT G-97RG6M R4.2.98.035 and G-97RG3 R4.2.43.078 are vulnerable to Remote Command Execution in the ping function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-07T23:17:34.000Z
CVE-2022-38532 
Micro-Star International Co., Ltd MSI Center 1.0.50.0 was discovered to contain a vulnerability in the component C_Features of MSI.CentralServer.exe. This vulnerability allows attackers to escalate privileges via running a crafted executable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-19T21:41:38.000Z
CVE-2022-38533 
In GNU Binutils before 2.40, there is a heap-buffer-overflow in the error function bfd_getl32 when called from the strip_main function in strip-new via a crafted file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-25T00:00:00.000Z
CVE-2022-38534 
TOTOLINK-720R v4.1.5cu.374 was discovered to contain a remote code execution (RCE) vulnerability via the setdiagnosicfg function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-15T17:58:19.000Z
CVE-2022-38535 
TOTOLINK-720R v4.1.5cu.374 was discovered to contain a remote code execution (RCE) vulnerability via the setTracerouteCfg function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-15T17:58:20.000Z
CVE-2022-38537 
Archery v1.4.5 to v1.8.5 was discovered to contain multiple SQL injection vulnerabilities via the start_file, end_file, start_time, and stop_time parameters in the binlog2sql interface.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-13T00:00:00.000Z
CVE-2022-38538 
Archery v1.7.0 to v1.8.5 was discovered to contain a SQL injection vulnerability via the checksum parameter in the report module.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-13T00:00:00.000Z
CVE-2022-38539 
Archery v1.7.5 to v1.8.5 was discovered to contain a SQL injection vulnerability via the where parameter at /archive/apply.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-13T14:45:19.000Z
CVE-2022-38540 
Archery v1.4.0 to v1.8.5 was discovered to contain a SQL injection vulnerability via the ThreadIDs parameter in the create_kill_session interface.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-13T00:00:00.000Z
CVE-2022-38541 
Archery v1.8.3 to v1.8.5 was discovered to contain multiple SQL injection vulnerabilities via the start_time and stop_time parameters in the my2sql interface.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-13T00:00:00.000Z
CVE-2022-38542 
Archery v1.4.0 to v1.8.5 was discovered to contain a SQL injection vulnerability via the ThreadIDs parameter in the kill_session interface. The project has released an update, please upgrade to v1.9.0 and above.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-13T14:45:22.000Z
CVE-2022-38545 
Valine v1.4.18 was discovered to contain a remote code execution (RCE) vulnerability which allows attackers to execute arbitrary code via a crafted POST request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-19T22:32:56.000Z
CVE-2022-38546 
A DNS misconfiguration was found in Zyxel NBG7510 firmware versions prior to V1.00(ABZY.3)C0, which could allow an unauthenticated attacker to access the DNS server when the device is switched to the AP mode.
Problem types: cwe_id: CWE-284
description: CWE-284: Improper Access Control
Affected products: vendor: Zyxel
product: NBG7510 firmware
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: LOW
baseScore: 5.3
baseSeverity: MEDIUM
Published: 2022-12-21T00:00:00.000Z
CVE-2022-38547 
A post-authentication command injection vulnerability in the CLI command of Zyxel ZyWALL/USG series firmware versions 4.20 through 4.72, VPN series firmware versions 4.30 through 5.32, USG FLEX series firmware versions 4.50 through 5.32, and ATP series firmware versions 4.32 through 5.32, which could allow an authenticated attacker with administrator privileges to execute OS commands.
Problem types: cwe_id: CWE-78
description: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: Zyxel
product: ZyWALL/USG series firmware
vendor: Zyxel
product: VPN series firmware
vendor: Zyxel
product: USG FLEX series firmware
vendor: Zyxel
product: ATP series firmware
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 7.2
baseSeverity: HIGH
Published: 2023-02-07T00:00:00.000Z
CVE-2022-38550 
A stored cross-site scripting (XSS) vulnerability in the /weibo/list component of Jeesns v2.0.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-19T22:51:09.000Z
CVE-2022-38553 
Academy Learning Management System before v5.9.1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the Search parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-26T09:59:06.000Z
CVE-2022-38555 
Linksys E1200 v1.0.04 is vulnerable to Buffer Overflow via ej_get_web_page_name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-28T16:17:46.000Z
CVE-2022-38556 
Trendnet TEW733GR v1.03B01 contains a Static Default Credential vulnerability in /etc/init0.d/S80telnetd.sh.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-28T15:52:57.000Z