https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 22:06:39 +0000 https://cve.radiocsirt.org/vuln/bdu:2022-04238 bdu:2022-04238 https://cve.radiocsirt.org/vuln/bdu:2022-04238 https://cve.radiocsirt.org/vuln/certfr-2022-avi-435 certfr-2022-avi-435 https://cve.radiocsirt.org/vuln/certfr-2022-avi-435 https://cve.radiocsirt.org/vuln/cnvd-2022-36378 cnvd-2022-36378 https://cve.radiocsirt.org/vuln/cnvd-2022-36378 https://cve.radiocsirt.org/vuln/euvd-2026-14005 EUVD-2026-14005 https://cve.radiocsirt.org/vuln/euvd-2026-14005 https://cve.radiocsirt.org/vuln/fkie_cve-2022-24040 <p>A vulnerability has been identified in Desigo DXR2 (All versions &lt; V01.21.142.5-22), Desigo PXC3 (All versions &lt; V01.21.142.4-18), Desigo PXC4 (All versions &lt; V02.20.142.10-10884), Desigo PXC5 (All versions &lt; V02.20.142.10-10884). The web application fails to enforce an upper bound to the cost factor of the PBKDF2 derived key during the creation or update of an account. An attacker with the user profile access privilege could cause a denial of service (DoS) condition through CPU consumption by setting a PBKDF2 derived key with a remarkably high cost effort and then attempting a login to the so-modified account.</p> <p>A vulnerability has been identified in Desigo DXR2 (All versions &lt; V01.21.142.5-22), Desigo PXC3 (All versions &lt; V01.21.142.4-18), Desigo PXC4 (All versions &lt; V02.20.142.10-10884), Desigo PXC5 (All versions &lt; V02.20.142.10-10884). The web application fails to enforce an upper bound to the cost factor of the PBKDF2 derived key during the creation or update of an account. An attacker with the user profile access privilege could cause a denial of service (DoS) condition through CPU consumption by setting a PBKDF2 derived key with a remarkably high cost effort and then attempting a login to the so-modified account.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2022-24040 https://cve.radiocsirt.org/vuln/ghsa-gvmv-rhmr-mw99 <p>A vulnerability has been identified in Desigo DXR2 (All versions &lt; V01.21.142.5-22), Desigo PXC3 (All versions &lt; V01.21.142.4-18), Desigo PXC4 (All versions &lt; V02.20.142.10-10884), Desigo PXC5 (All versions &lt; V02.20.142.10-10884). The web application fails to enforce an upper bound to the cost factor of the PBKDF2 derived key during the creation or update of an account. An attacker with the user profile access privilege could cause a denial of service (DoS) condition through CPU consumption by setting a PBKDF2 derived key with a remarkably high cost effort and then attempting a login to the so-modified account.</p> <p>A vulnerability has been identified in Desigo DXR2 (All versions &lt; V01.21.142.5-22), Desigo PXC3 (All versions &lt; V01.21.142.4-18), Desigo PXC4 (All versions &lt; V02.20.142.10-10884), Desigo PXC5 (All versions &lt; V02.20.142.10-10884). The web application fails to enforce an upper bound to the cost factor of the PBKDF2 derived key during the creation or update of an account. An attacker with the user profile access privilege could cause a denial of service (DoS) condition through CPU consumption by setting a PBKDF2 derived key with a remarkably high cost effort and then attempting a login to the so-modified account.</p> https://cve.radiocsirt.org/vuln/ghsa-gvmv-rhmr-mw99 https://cve.radiocsirt.org/vuln/gsd-2022-24040 gsd-2022-24040 https://cve.radiocsirt.org/vuln/gsd-2022-24040 https://cve.radiocsirt.org/vuln/icsa-22-132-10 <p>The addCell JavaScript function fails to properly sanitize user-controllable input before including it into the generated XML body of the XLS report document as it is possible to inject arbitrary content (e.g., XML tags) into the generated file. An attacker with restricted privileges could corrupt the content used to generate XLS reports to leverage the application to deliver malicious files against higher-privileged users and obtain remote code execution (RCE) against the administrator &#39;s workstation.CVE-2022-24039 has been assigned to this vulnerability. A CVSS v3 base score of 9.0 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H). The web application fails to enforce an upper bound to the cost factor of the PBKDF2 derived key during the creation or update of an account. An attacker with the user profile access privilege could cause a denial-of-service condition through CPU consumption by setting a PBKDF2 derived key with a high-cost effort, followed by a login attempt to the modified account.CVE-2022-24040 has been assigned to this vulnerability. A CVSS v3 base score of 6.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). The web application stores the PBKDF2 derived key of user &#39;s passwords with a low iteration count. An attacker with user profile access privilege can retrieve the stored password hashes of other accounts and then successfully perform an offline cracking attack and recover the plainte…</p> <p>The addCell JavaScript function fails to properly sanitize user-controllable input before including it into the generated XML body of the XLS report document as it is possible to inject arbitrary content (e.g., XML tags) into the generated file. An attacker with restricted privileges could corrupt the content used to generate XLS reports to leverage the application to deliver malicious files against higher-privileged users and obtain remote code execution (RCE) against the administrator &#39;s workstation.CVE-2022-24039 has been assigned to this vulnerability. A CVSS v3 base score of 9.0 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H). The web application fails to enforce an upper bound to the cost factor of the PBKDF2 derived key during the creation or update of an account. An attacker with the user profile access privilege could cause a denial-of-service condition through CPU consumption by setting a PBKDF2 derived key with a high-cost effort, followed by a login attempt to the modified account.CVE-2022-24040 has been assigned to this vulnerability. A CVSS v3 base score of 6.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). The web application stores the PBKDF2 derived key of user &#39;s passwords with a low iteration count. An attacker with user profile access privilege can retrieve the stored password hashes of other accounts and then successfully perform an offline cracking attack and recover the plainte…</p> https://cve.radiocsirt.org/vuln/icsa-22-132-10