Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
The issue results from the lack of proper validation of a user-supplied value prior to dereferencing it as a pointer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18677. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.tracker-software.com/product/pdf-xchange-editor/history - https://www.zerodayinitiative.com/advisories/ZDI-22-1387/
CVE ID: CVE-2022-42419 State: PUBLISHED Published: 2023-01-26T00:00:00.000Z Last Updated: 2025-03-31T17:38:49.429Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: PDF-XChange Products: PDF-XChange Editor Problem Types: CWE-787 Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of TIF files. Crafted data in a TIF file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulner
Crafted data in a TIF file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18700. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.tracker-software.com/product/pdf-xchange-editor/history - https://www.zerodayinitiative.com/advisories/ZDI-22-1389/
CVE ID: CVE-2022-42420 State: PUBLISHED Published: 2023-01-26T00:00:00.000Z Last Updated: 2025-03-31T17:38:12.895Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: PDF-XChange Products: PDF-XChange Editor Problem Types: CWE-787 Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of TIF files. Crafted data in a TIF file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulner
Crafted data in a TIF file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18686. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.tracker-software.com/product/pdf-xchange-editor/history - https://www.zerodayinitiative.com/advisories/ZDI-22-1388/
CVE ID: CVE-2022-42421 State: PUBLISHED Published: 2023-01-26T00:00:00.000Z Last Updated: 2025-03-31T17:37:26.445Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: PDF-XChange Products: PDF-XChange Editor Problem Types: CWE-787 Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of TIF files. Crafted data in a TIF file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulner
Crafted data in a TIF file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18703. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.tracker-software.com/product/pdf-xchange-editor/history - https://www.zerodayinitiative.com/advisories/ZDI-22-1393/
CVE ID: CVE-2022-42423 State: PUBLISHED Published: 2023-01-26T00:00:00.000Z Last Updated: 2025-03-31T17:36:37.075Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: PDF-XChange Products: PDF-XChange Editor Problem Types: CWE-787 Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of TIF files. Crafted data in a TIF file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulner
Crafted data in a TIF file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18716. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.tracker-software.com/product/pdf-xchange-editor/history - https://www.zerodayinitiative.com/advisories/ZDI-22-1390/
CVE ID: CVE-2022-42424 State: PUBLISHED Published: 2023-03-29T00:00:00.000Z Last Updated: 2025-02-14T16:30:57.103Z Severity: HIGH (CVSS 7.2 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Centreon Products: Centreon Problem Types: CWE-89 Description: This vulnerability allows remote attackers to escalate privileges on affected installations of Centreon. Authentication is required to exploit this vulnerability. The specific flaw exists within the handling of requests to modify poller broker configuration. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to escalate privil
supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to escalate privileges to the level of an administrator. Was ZDI-CAN-18556. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-22-1395/
CVE ID: CVE-2022-42425 State: PUBLISHED Published: 2023-03-29T00:00:00.000Z Last Updated: 2025-02-14T16:32:24.022Z Severity: HIGH (CVSS 7.2 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Centreon Products: Centreon Problem Types: CWE-89 Description: This vulnerability allows remote attackers to escalate privileges on affected installations of Centreon. Authentication is required to exploit this vulnerability. The specific flaw exists within the handling of requests to modify poller broker configuration. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to escalate privil
supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to escalate privileges to the level of an administrator. Was ZDI-CAN-18555. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-22-1396/
CVE ID: CVE-2022-42426 State: PUBLISHED Published: 2023-03-29T00:00:00.000Z Last Updated: 2025-02-14T16:32:42.080Z Severity: HIGH (CVSS 7.2 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Centreon Products: Centreon Problem Types: CWE-89 Description: This vulnerability allows remote attackers to escalate privileges on affected installations of Centreon. Authentication is required to exploit this vulnerability. The specific flaw exists within the handling of requests to modify poller broker configuration. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to escalate privil
supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to escalate privileges to the level of an administrator. Was ZDI-CAN-18554. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-22-1397/
CVE ID: CVE-2022-42427 State: PUBLISHED Published: 2023-03-29T00:00:00.000Z Last Updated: 2025-02-14T16:33:03.975Z Severity: HIGH (CVSS 7.2 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Centreon Products: Centreon Problem Types: CWE-89 Description: This vulnerability allows remote attackers to escalate privileges on affected installations of Centreon. Authentication is required to exploit this vulnerability. The specific flaw exists within the contact groups configuration page. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to escalate privileges to the level of an a
ing it to construct SQL queries. An attacker can leverage this vulnerability to escalate privileges to the level of an administrator. Was ZDI-CAN-18541. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-22-1398/
CVE ID: CVE-2022-42428 State: PUBLISHED Published: 2023-03-29T00:00:00.000Z Last Updated: 2025-02-14T16:33:23.700Z Severity: HIGH (CVSS 7.2 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Centreon Products: Centreon Problem Types: CWE-89 Description: This vulnerability allows remote attackers to escalate privileges on affected installations of Centreon. Authentication is required to exploit this vulnerability. The specific flaw exists within the handling of requests to modify poller broker configuration. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to escalate privil
supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to escalate privileges to the level of an administrator. Was ZDI-CAN-18410. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-22-1399/
CVE ID: CVE-2022-42429 State: PUBLISHED Published: 2023-03-29T00:00:00.000Z Last Updated: 2025-02-14T16:33:47.283Z Severity: HIGH (CVSS 7.2 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Centreon Products: Centreon Problem Types: CWE-89 Description: This vulnerability allows remote attackers to escalate privileges on affected installations of Centreon. Authentication is required to exploit this vulnerability. The specific flaw exists within the handling of requests to modify poller broker configuration. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to escalate privil
supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to escalate privileges to the level of an administrator. Was ZDI-CAN-18557. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-22-1394/
CVE ID: CVE-2022-42430 State: PUBLISHED Published: 2023-03-29T00:00:00.000Z Last Updated: 2025-02-14T16:34:03.952Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Tesla Products: Model 3 Problem Types: CWE-416 Description: This vulnerability allows local attackers to escalate privileges on affected Tesla vehicles. An attacker must first obtain the ability to execute privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of the wowlan_config data structure. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can lever
om the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of root. Was ZDI-CAN-17543. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-22-1406/
CVE ID: CVE-2022-42431 State: PUBLISHED Published: 2023-03-29T00:00:00.000Z Last Updated: 2025-02-14T20:25:22.340Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Tesla Products: Model 3 Problem Types: CWE-120 Description: This vulnerability allows local attackers to escalate privileges on affected Tesla vehicles. An attacker must first obtain the ability to execute privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the bcmdhd driver. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a buffer. An attacker can leverage this vulnerability to es
n of the length of user-supplied data prior to copying it to a buffer. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of root. Was ZDI-CAN-17544. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-22-1407/
CVE ID: CVE-2022-42432 State: PUBLISHED Published: 2023-03-29T00:00:00.000Z Last Updated: 2025-02-14T20:25:02.820Z Severity: MEDIUM (CVSS 5.1 CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:L) Vendors: Linux Products: Kernel Problem Types: CWE-457 Description: This vulnerability allows local attackers to disclose sensitive information on affected installations of the Linux Kernel 6.0-rc2. An attacker must first obtain the ability to execute high-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the nft_osf_eval function. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this
The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the kernel. Was ZDI-CAN-18540. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-22-1457/ - https://patchwork.ozlabs.org/project/netfilter-devel/patch/20220907082618.1193201-1-pablo%40netfilter.org/
CVE ID: CVE-2022-42433 State: PUBLISHED Published: 2023-03-29T00:00:00.000Z Last Updated: 2025-02-14T20:24:33.071Z Severity: MEDIUM (CVSS 6.4 CVSS:3.0/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: TP-Link Products: TL-WR841N Problem Types: CWE-78 Description: This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link TL-WR841N TL-WR841N(US)_V14_220121 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the ated_tp service. The issue results from the lack of proper validation of a user-supplied string before using it to execute
ed_tp service. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-17356. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-22-1466/
CVE ID: CVE-2022-42435 State: PUBLISHED Published: 2023-01-03T23:16:13.875Z Last Updated: 2025-04-10T14:36:21.653Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: IBM Products: Business Automation Workflow Problem Types: CWE-352 Description: IBM Business Automation Workflow 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, and 22.0.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 238054. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - h
sts. IBM X-Force ID: 238054. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6852217 - https://exchange.xforce.ibmcloud.com/vulnerabilities/238054
CVE ID: CVE-2022-42436 State: PUBLISHED Published: 2023-02-08T19:28:52.753Z Last Updated: 2025-03-25T13:56:20.998Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: IBM Products: MQ Problem Types: n/a Description: IBM MQ 8.0.0, 9.0.0, 9.1.0, 9.2.0, 9.3.0 Managed File Transfer could allow a local user to obtain sensitive information from diagnostic files. IBM X-Force ID: 238206. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6909467 - https://exchange.xforce.ibmcloud.com/vulnerabilities/238206
CVE ID: CVE-2022-42438 State: PUBLISHED Published: 2023-02-08T18:59:02.733Z Last Updated: 2025-03-25T13:50:55.183Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: IBM Products: Cloud Pak for Multicloud Management Monitoring Problem Types: 264 Permissions, Privileges, Access Controls Description: IBM Cloud Pak for Multicloud Management Monitoring 2.0 and 2.3 allows users without admin roles access to admin functions by specifying direct URL paths. IBM X-Force ID: 238210. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6909427 - https://exchange.xforce.ibmcloud.com/vulnerabilities/2
t: References: - https://www.ibm.com/support/pages/node/6909427 - https://exchange.xforce.ibmcloud.com/vulnerabilities/238210
CVE ID: CVE-2022-42439 State: PUBLISHED Published: 2023-02-06T20:25:26.204Z Last Updated: 2025-03-25T17:35:13.105Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N) Vendors: IBM Products: App Connect Enterprise Problem Types: CWE-200 Description: IBM App Connect Enterprise 11.0.0.17 through 11.0.0.19 and 12.0.4.0 and 12.0.5.0 contains an unspecified vulnerability in the Discovery Connector nodes which may cause a 3rd party system’s credentials to be exposed to a privileged attacker. IBM X-Force ID: 238211. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6952435 - https://exchange.xforce.ib
iner: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6952435 - https://exchange.xforce.ibmcloud.com/vulnerabilities/238211
CVE ID: CVE-2022-42442 State: PUBLISHED Published: 2022-11-03T00:00:00.000Z Last Updated: 2025-05-05T13:21:08.523Z Vendors: IBM Products: Robotic Process Automation for Cloud Pak Problem Types: Information Disclosure Description: IBM Robotic Process Automation for Cloud Pak 21.0.1, 21.0.2, 21.0.3, 21.0.4, and 21.0.5 is vulnerable to exposure of the first tenant owner e-mail address to users with access to the container platform. IBM X-Force ID: 238214. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6831787 - https://exchange.xforce.ibmcloud.com/vulnerabilities/238214
CVE ID: CVE-2022-42443 State: PUBLISHED Published: 2024-02-17T16:10:43.683Z Last Updated: 2024-08-03T13:10:40.868Z Severity: LOW (CVSS 2.2 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N) Vendors: IBM Products: Trusteer iOS SDK, Trusteer Android SDK Problem Types: CWE-434 Description: An undisclosed issue in Trusteer iOS SDK for mobile versions prior to 5.7 and Trusteer Android SDK for mobile versions prior to 5.7 may allow uploading of files. IBM X-Force ID: 238535. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/6967785 - https://exchange.xforce.ibmcloud.com/vulnerabilities/238535
CVE ID: CVE-2022-42444 State: PUBLISHED Published: 2023-02-06T20:38:25.295Z Last Updated: 2025-03-25T15:54:27.425Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: IBM Products: App Connect Enterprise Problem Types: 121 Stack-based Buffer Overflow Description: IBM App Connect Enterprise 11.0.0.8 through 11.0.0.19 and 12.0.1.0 through 12.0.5.0 is vulnerable to a buffer overflow. A remote privileged user could overflow a buffer and cause the application to crash. IBM X-Force ID: 238538. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6890609 - https://exchange.xforce.ibmcloud.com/v
ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6890609 - https://exchange.xforce.ibmcloud.com/vulnerabilities/238538
CVE ID: CVE-2022-42445 State: PUBLISHED Published: 2022-11-28T14:54:28.817Z Last Updated: 2025-04-25T15:04:53.111Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: HCL Software Products: HCL Launch Problem Types: n/a Description: HCL Launch could allow a user with administrative privileges, including "Manage Security" permissions, the ability to recover a credential previously saved for performing authenticated LDAP searches. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0101208
CVE ID: CVE-2022-42446 State: PUBLISHED Published: 2022-11-30T22:54:26.060Z Last Updated: 2025-04-24T14:35:14.556Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L) Vendors: HCL Software Products: HCL Sametime Problem Types: n/a Description: Starting with Sametime 12, anonymous users are enabled by default. After logging in as an anonymous user, one has the ability to browse the User Directory and potentially create chats with internal users. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0101768
CVE ID: CVE-2022-42447 State: PUBLISHED Published: 2023-03-27T22:22:29.522Z Last Updated: 2025-02-19T15:48:15.353Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: HCL Software Products: HCL Compass2.0 Problem Types: n/a Description: HCL Compass is vulnerable to Cross-Origin Resource Sharing (CORS). This vulnerability can allow an unprivileged remote attacker to trick a legitimate user into accessing a special resource and executing a malicious request. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0103581
CVE ID: CVE-2022-42449 State: PUBLISHED Published: 2025-04-30T21:01:21.381Z Last Updated: 2025-05-01T15:35:09.396Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: HCL Software Products: HCL Domino Volt Problem Types: CWE-434 Description: Unsafe default file type filter policy in HCL Domino Volt allows upload of .html file and execution of unsafe JavaScript in deployed applications Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0120722
CVE ID: CVE-2022-42450 State: PUBLISHED Published: 2025-04-30T21:07:57.381Z Last Updated: 2025-05-01T15:34:58.510Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: HCL Software Products: HCL Domino Volt Problem Types: CWE-79 Description: Improper sanitization of SVG files in HCL Domino Volt allows client-side script injection in deployed applications. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0120722
CVE ID: CVE-2022-42451 State: PUBLISHED Published: 2023-10-11T05:01:31.062Z Last Updated: 2024-10-29T13:41:45.175Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: HCL Software Products: BigFix Patch Management Description: Certain credentials within the BigFix Patch Management Download Plug-ins are stored insecurely and could be exposed to a local privileged user. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0108007