CVE-2022-29540

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

resi-calltrace in RESI Gemini-Net 4.2 is affected by Multiple XSS issues. Unauthenticated remote attackers can inject arbitrary web script or HTML into an HTTP GET parameter that reflects user input without sanitization. This exists on numerous application endpoints,

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://www.gruppotim.it/it/footer/red-team.htmlThird Party Advisory
https://www.resi.it/prodotti-soluzioni-commerciali/gemini-network-service-monitoringProduct
https://www.gruppotim.it/it/footer/red-team.htmlThird Party Advisory
https://www.resi.it/prodotti-soluzioni-commerciali/gemini-network-service-monitoringProduct

Timeline

Published: Jun 2, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-295467.5HtmlUnit NekoHtml Parser before 2.61.0 suffers from a denial of service vulnerability. Crafted input associated with the parsing of Processi CVE-2022-295477.5The CreateRedirect extension before 2022-04-14 for MediaWiki does not properly check whether the user has permissions to edit the target pag CVE-2022-295486.1A reflected XSS issue exists in the Management Console of several WSO2 products. This affects API Manager 2.2.0, 2.5.0, 2.6.0, 3.0.0, 3.1.0,CVE-2022-295497.3An issue was discovered in Qualys Cloud Agent 4.8.0-49. It executes programs at various full pathnames without first making ownership and pe CVE-2022-295505.5An issue was discovered in Qualys Cloud Agent 4.8.0-49. It writes "ps auxwwe" output to the /var/log/qualys/qualys-cloud-agent-scan.log file CVE-2022-295558.8The Deviceconnect microservice through 1.3.0 in Northern.tech Mender Enterprise before 3.2.2. allows Cross-Origin Websocket Hijacking.CVE-2022-295569.8The iot-manager microservice 1.0.0 in Northern.tech Mender Enterprise before 3.2.2 allows SSRF because the Azure IoT Hub integration provide CVE-2022-295578.8LexisNexis Firco Compliance Link 3.7 allows CSRF.CVE-2022-295588.8Realtek rtl819x-SDK before v3.6.1 allows command injection over the web interface.CVE-2022-29566.1A vulnerability classified as problematic has been found in ConsoleTVs Noxen. Affected is an unknown function of the file /Noxen-master/user CVE-2022-295607.2A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < 2.15.1), RUGGEDCOM ROX MX5000RE (All versions < 2.15.1), RUGGEDC CVE-2022-295618.8A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.0), RUGGEDCOM ROX MX5000RE (All versions < V2.16.0), RUGGE