Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-33113 State: PUBLISHED Published: 2022-06-23T12:44:59 Last Updated: 2024-08-03T08:01:19.583Z Vendors: n/a Products: n/a Problem Types: n/a Description: Jfinal CMS v5.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the keyword text field under the publish blog module. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jflyfox/jfinal_cms/issues/39
CVE ID: CVE-2022-33114 State: PUBLISHED Published: 2022-06-23T12:45:00 Last Updated: 2024-08-03T08:01:19.572Z Vendors: n/a Products: n/a Problem Types: n/a Description: Jfinal CMS v5.1.0 was discovered to contain a SQL injection vulnerability via the attrVal parameter at /jfinal_cms/system/dict/list. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jflyfox/jfinal_cms/issues/38
CVE ID: CVE-2022-33116 State: PUBLISHED Published: 2022-06-27T20:42:01 Last Updated: 2024-08-03T08:01:19.579Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in the jmpath variable in /modules/mindmap/index.php of GUnet Open eClass Platform (aka openeclass) v3.12.4 and below allows attackers to read arbitrary files via a directory traversal. Additional Analyst Notes: - CVE Program Container: References: - https://www.openeclass.org/en/ - https://github.com/gunet/openeclass - https://hg.gunet.gr/openeclass/diff/cbfc90094d51/modules/mindmap/index.php - https://emaragkos.gr/gunet-open-eclass-authenticated-path-traversal/
CVE ID: CVE-2022-33119 State: PUBLISHED Published: 2022-06-21T13:00:39 Last Updated: 2024-08-03T08:01:20.016Z Vendors: n/a Products: n/a Problem Types: n/a Description: NUUO Network Video Recorder NVRsolo v03.06.02 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via login.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/badboycxcc/nuuo-xss/blob/main/README.md
CVE ID: CVE-2022-33121 State: PUBLISHED Published: 2022-06-24T20:59:07 Last Updated: 2024-08-03T08:01:20.170Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross-Site Request Forgery (CSRF) in MiniCMS v1.11 allows attackers to arbitrarily delete local .dat files via clicking on a malicious link. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/bg5sbk/MiniCMS/issues/45
CVE ID: CVE-2022-33122 State: PUBLISHED Published: 2022-06-24T20:59:08 Last Updated: 2024-08-03T08:01:20.231Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability in eyoucms v1.5.6 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the URL field under the login page. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/eyoucms/eyoucms/issues/24
CVE ID: CVE-2022-33124 State: PUBLISHED Published: 2022-06-22T19:44:19 Last Updated: 2024-08-03T08:01:20.340Z Vendors: n/a Products: n/a Problem Types: n/a Description: AIOHTTP 3.8.1 can report a "ValueError: Invalid IPv6 URL" outcome, which can lead to a Denial of Service (DoS). NOTE: multiple third parties dispute this issue because there is no example of a context in which denial of service would occur, and many common contexts have exception handing in the calling application Additional Analyst Notes: - CVE Program Container: References: - https://github.com/aio-libs/aiohttp/issues/6772
CVE ID: CVE-2022-33127 State: PUBLISHED Published: 2022-06-22T19:31:51 Last Updated: 2024-08-03T08:01:20.337Z Vendors: n/a Products: n/a Problem Types: n/a Description: The function that calls the diff tool in Diffy 3.4.1 does not properly handle double quotes in a filename when run in a windows environment. This allows attackers to execute arbitrary commands via a crafted string. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/samg/diffy/blob/56fd935aea256742f7352b050592542d3d153bf6/CHANGELOG#L1 - https://github.com/samg/diffy/commit/478f392082b66d38f54a02b4bb9c41be32fd6593
CVE ID: CVE-2022-33128 State: PUBLISHED Published: 2022-06-25T01:13:59 Last Updated: 2024-08-03T08:01:19.945Z Vendors: n/a Products: n/a Problem Types: n/a Description: RG-EG series gateway EG350 EG_RGOS 11.1(6) was discovered to contain a SQL injection vulnerability via the function get_alarmAction at /alarm_pi/alarmService.php. Additional Analyst Notes: - CVE Program Container: References: - http://blog.mo60.cn/index.php/archives/ruijie.html
CVE ID: CVE-2022-33137 State: PUBLISHED Published: 2022-07-12T10:06:44 Last Updated: 2024-08-03T08:01:19.904Z Vendors: Siemens Products: SIMATIC MV540 H, SIMATIC MV540 S, SIMATIC MV550 H, SIMATIC MV550 S, SIMATIC MV560 U, SIMATIC MV560 X Problem Types: CWE-613 Description: A vulnerability has been identified in SIMATIC MV540 H (All versions < V3.3), SIMATIC MV540 S (All versions < V3.3), SIMATIC MV550 H (All versions < V3.3), SIMATIC MV550 S (All versions < V3.3), SIMATIC MV560 U (All versions < V3.3), SIMATIC MV560 X (All versions < V3.3). The web session management of affected devices does not invalidate session ids in certain logout scenarios. This could allow an authenticated remote atta
ected devices does not invalidate session ids in certain logout scenarios. This could allow an authenticated remote attacker to hijack other users' sessions. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-348662.pdf
CVE ID: CVE-2022-33138 State: PUBLISHED Published: 2022-07-12T10:06:46 Last Updated: 2024-08-03T08:01:19.531Z Vendors: Siemens Products: SIMATIC MV540 H, SIMATIC MV540 S, SIMATIC MV550 H, SIMATIC MV550 S, SIMATIC MV560 U, SIMATIC MV560 X Problem Types: CWE-306 Description: A vulnerability has been identified in SIMATIC MV540 H (All versions < V3.3), SIMATIC MV540 S (All versions < V3.3), SIMATIC MV550 H (All versions < V3.3), SIMATIC MV550 S (All versions < V3.3), SIMATIC MV560 U (All versions < V3.3), SIMATIC MV560 X (All versions < V3.3). Affected devices do not perform authentication for several web API endpoints. This could allow an unauthenticated remote attacker to read and download da
uthentication for several web API endpoints. This could allow an unauthenticated remote attacker to read and download data from the device. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-348662.pdf
CVE ID: CVE-2022-33139 State: PUBLISHED Published: 2022-06-21T00:00:00 Last Updated: 2024-08-03T08:01:20.028Z Vendors: Siemens Products: Cerberus DMS, Desigo CC, Desigo CC Compact, SIMATIC WinCC OA V3.16, SIMATIC WinCC OA V3.17, SIMATIC WinCC OA V3.18 Problem Types: CWE-603 Description: A vulnerability has been identified in Cerberus DMS (All versions), Desigo CC (All versions), Desigo CC Compact (All versions), SIMATIC WinCC OA V3.16 (All versions in default configuration), SIMATIC WinCC OA V3.17 (All versions in non-default configuration), SIMATIC WinCC OA V3.18 (All versions in non-default configuration). Affected applications use client-side only authentication, when neither server-side
ions in non-default configuration). Affected applications use client-side only authentication, when neither server-side authentication (SSA) nor Kerberos authentication is enabled. In this configuration, attackers could impersonate other users or exploit the client-server protocol without being authenticated. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-111512.pdf - https://cert-portal.siemens.com/productcert/pdf/ssa-836027.pdf
CVE ID: CVE-2022-33140 State: PUBLISHED Published: 2022-06-15T14:25:15 Last Updated: 2024-08-03T08:01:19.873Z Vendors: Apache Software Foundation Products: Apache NiFi, Apache NiFi Registry Problem Types: CWE-78 Description: The optional ShellUserGroupProvider in Apache NiFi 1.10.0 to 1.16.2 and Apache NiFi Registry 0.6.0 to 1.16.2 does not neutralize arguments for group resolution commands, allowing injection of operating system commands on Linux and macOS platforms. The ShellUserGroupProvider is not included in the default configuration. Command injection requires ShellUserGroupProvider to be one of the enabled User Group Providers in the Authorizers configuration. Command injection also r
erGroupProvider to be one of the enabled User Group Providers in the Authorizers configuration. Command injection also requires an authenticated user with elevated privileges. Apache NiFi requires an authenticated user with authorization to modify access policies in order to execute the command. Apache NiFi Registry requires an authenticated user with authorization to read user groups in order to execute the command. The resolution removes command formatting based on user-provided arguments. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread/bzs2pcdjsdrh5039oslmfr9mbs9qqdhr - https://nifi.apache.org/security.html#CVE-2022-33140
CVE ID: CVE-2022-33141 State: REJECTED Published: N/A Last Updated: 2025-05-28T18:19:40.612Z Description: No description available.
CVE ID: CVE-2022-33142 State: PUBLISHED Published: 2022-08-23T15:46:18.683Z Last Updated: 2025-02-20T20:11:55.370Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H) Vendors: WordPlus Products: Better Messages (WordPress plugin) Problem Types: Denial Of Service (DoS) Description: Authenticated (subscriber+) Denial Of Service (DoS) vulnerability in WordPlus WordPress Better Messages plugin <= 1.9.10.57 at WordPress. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/bp-better-messages/#developers - https://patchstack.com/database/vulnerability/bp-better-messages/wordpress-better-messages-plugin-1-9-10-57-
evelopers - https://patchstack.com/database/vulnerability/bp-better-messages/wordpress-better-messages-plugin-1-9-10-57-denial-of-service-dos-vulnerability
CVE ID: CVE-2022-33143 State: REJECTED Published: N/A Last Updated: 2025-05-28T18:19:41.829Z Description: No description available.
CVE ID: CVE-2022-33144 State: REJECTED Published: N/A Last Updated: 2025-05-28T18:19:43.036Z Description: No description available.
CVE ID: CVE-2022-33145 State: REJECTED Published: N/A Last Updated: 2025-05-28T18:19:44.274Z Description: No description available.
CVE ID: CVE-2022-33146 State: PUBLISHED Published: 2022-06-27T00:20:17 Last Updated: 2024-08-03T08:01:20.099Z Vendors: web2py Products: web2py Problem Types: Open Redirect Description: Open redirect vulnerability in web2py versions prior to 2.22.5 allows a remote attacker to redirect a user to an arbitrary web site and conduct a phishing attack by having a user to access a specially crafted URL. Additional Analyst Notes: - CVE Program Container: References: - http://web2py.com/ - https://github.com/web2py/web2py/commit/d9805606f88f00c0be56438247605cefde73e14e#diff-c1d01f37ee54d813815718760b9c4d7b274e2be7ad18f65552cd564336ab593bR110 - https://github.com/web2py/web2py/commit/a181b855a43cb8b479
e54d813815718760b9c4d7b274e2be7ad18f65552cd564336ab593bR110 - https://github.com/web2py/web2py/commit/a181b855a43cb8b479d276b082cfcde385768451 - https://jvn.jp/en/jp/JVN02158640/index.html
CVE ID: CVE-2022-33147 State: PUBLISHED Published: 2022-08-22T18:29:10.678Z Last Updated: 2025-04-15T18:49:53.529Z Severity: HIGH (CVSS 8.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H) Vendors: WWBN Products: AVideo Problem Types: CWE-89 Description: A sql injection vulnerability exists in the ObjectYPT functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to a SQL injection. An attacker can send an HTTP request to trigger this vulnerability.This vulnerability exists in the aVideoEncoder functionality which can be used to add new videos, allowing an attacker to inject SQL by manipulating the videoDownloadedLink or duration parameter. Add
to add new videos, allowing an attacker to inject SQL by manipulating the videoDownloadedLink or duration parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/WWBN/AVideo/blob/e04b1cd7062e16564157a82bae389eedd39fa088/updatedb/updateDb.v12.0.sql - https://talosintelligence.com/vulnerability_reports/TALOS-2022-1551
CVE ID: CVE-2022-33148 State: PUBLISHED Published: 2022-08-22T18:29:35.981Z Last Updated: 2025-04-15T18:49:46.519Z Severity: HIGH (CVSS 8.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H) Vendors: WWBN Products: AVideo Problem Types: CWE-89 Description: A sql injection vulnerability exists in the ObjectYPT functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to a SQL injection. An attacker can send an HTTP request to trigger this vulnerability.This vulnerability exists in the Live Schedules plugin, allowing an attacker to inject SQL by manipulating the title parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichm
inject SQL by manipulating the title parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/WWBN/AVideo/blob/e04b1cd7062e16564157a82bae389eedd39fa088/updatedb/updateDb.v12.0.sql - https://talosintelligence.com/vulnerability_reports/TALOS-2022-1551
CVE ID: CVE-2022-33149 State: PUBLISHED Published: 2022-08-22T18:29:57.518Z Last Updated: 2025-04-15T18:49:38.033Z Severity: HIGH (CVSS 8.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H) Vendors: WWBN Products: AVideo Problem Types: CWE-89 Description: A sql injection vulnerability exists in the ObjectYPT functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to a SQL injection. An attacker can send an HTTP request to trigger this vulnerability.This vulnerability exists in the CloneSite plugin, allowing an attacker to inject SQL by manipulating the url parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Re
ct SQL by manipulating the url parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/WWBN/AVideo/blob/e04b1cd7062e16564157a82bae389eedd39fa088/updatedb/updateDb.v12.0.sql - https://talosintelligence.com/vulnerability_reports/TALOS-2022-1551
CVE ID: CVE-2022-33150 State: PUBLISHED Published: 2022-10-25T16:33:47.057Z Last Updated: 2025-04-15T18:46:55.068Z Severity: CRITICAL (CVSS 9.1 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Robustel Products: R1510 Problem Types: CWE-78 Description: An OS command injection vulnerability exists in the js_package install functionality of Robustel R1510 3.1.16. A specially-crafted network request can lead to arbitrary command execution. An attacker can send a sequence of requests to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2022-1577
CVE ID: CVE-2022-33151 State: PUBLISHED Published: 2022-08-18T07:14:25 Last Updated: 2024-08-03T08:01:20.171Z Vendors: Cybozu, Inc. Products: Cybozu Office Problem Types: Cross-site scripting Description: Cross-site scripting vulnerability in the specific parameters of Cybozu Office 10.0.0 to 10.8.5 allows remote attackers to inject an arbitrary script via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://cs.cybozu.co.jp/2022/007584.html - https://jvn.jp/en/jp/JVN20573662/index.html
CVE ID: CVE-2022-33154 State: PUBLISHED Published: 2022-07-12T21:56:37 Last Updated: 2024-08-03T08:01:19.652Z Vendors: n/a Products: n/a Problem Types: n/a Description: The schema (aka Embedding schema.org vocabulary) extension before 1.13.1 and 2.x before 2.5.1 for TYPO3 allows XSS. Additional Analyst Notes: - CVE Program Container: References: - https://typo3.org/security/advisory/typo3-ext-sa-2022-012
CVE ID: CVE-2022-33155 State: PUBLISHED Published: 2022-07-12T21:59:13 Last Updated: 2024-08-03T08:01:20.145Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ameos_tarteaucitron (aka AMEOS - TarteAuCitron GDPR cookie banner and tracking management / French RGPD compatible) extension before 1.2.23 for TYPO3 allows XSS. Additional Analyst Notes: - CVE Program Container: References: - https://typo3.org/security/advisory/typo3-ext-sa-2022-013
CVE ID: CVE-2022-33156 State: PUBLISHED Published: 2022-07-12T22:45:07 Last Updated: 2024-08-03T08:01:19.510Z Vendors: n/a Products: n/a Problem Types: n/a Description: The matomo_integration (aka Matomo Integration) extension before 1.3.2 for TYPO3 allows XSS. Additional Analyst Notes: - CVE Program Container: References: - https://typo3.org/security/advisory/typo3-ext-sa-2022-011
CVE ID: CVE-2022-33157 State: PUBLISHED Published: 2022-07-12T22:36:56 Last Updated: 2024-08-03T08:01:20.242Z Vendors: n/a Products: n/a Problem Types: n/a Description: The libconnect extension before 7.0.8 and 8.x before 8.1.0 for TYPO3 allows XSS. Additional Analyst Notes: - CVE Program Container: References: - https://typo3.org/security/advisory/typo3-ext-sa-2022-010
CVE ID: CVE-2022-33158 State: PUBLISHED Published: 2022-07-29T23:15:23 Last Updated: 2024-08-03T08:01:19.490Z Vendors: Trend Micro Products: Trend Micro VPN Proxy One Pro (Consumer) Problem Types: Incorrect Permission Assignment Description: Trend Micro VPN Proxy Pro version 5.2.1026 and below contains a vulnerability involving some overly permissive folders in a key directory which could allow a local attacker to obtain privilege escalation on an affected system. Additional Analyst Notes: - CVE Program Container: References: - https://helpcenter.trendmicro.com/en-us/article/tmka-11042 - https://www.zerodayinitiative.com/advisories/ZDI-22-853/
CVE ID: CVE-2022-33159 State: PUBLISHED Published: 2023-06-15T01:43:19.811Z Last Updated: 2024-12-12T21:37:44.315Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: Security Directory Suite VA Problem Types: CWE-200 Description: IBM Security Directory Suite VA 8.0.1 through 8.0.1.19 stores user credentials in plain clear text which can be read by an authenticated user. IBM X-Force ID: 228567. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7001693 - https://exchange.xforce.ibmcloud.com/vulnerabilities/228567
CVE ID: CVE-2022-33160 State: PUBLISHED Published: 2023-10-06T21:09:11.698Z Last Updated: 2024-09-19T16:24:51.751Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: IBM Products: Security Directory Suite Problem Types: CWE-757 Description: IBM Security Directory Suite 8.0.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 228568. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7047071 - https://exchange.xforce.ibmcloud.com/vulnerabilities/228568
CVE ID: CVE-2022-33161 State: PUBLISHED Published: 2023-10-14T14:14:04.692Z Last Updated: 2024-09-16T20:11:01.240Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: IBM Products: Security Directory Server Problem Types: CWE-311 Description: IBM Security Directory Server 6.4.0 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. X-Force ID: 228569. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/page
ditional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7047116 - https://www.ibm.com/support/pages/node/7047428 - https://exchange.xforce.ibmcloud.com/vulnerabilities/228569
CVE ID: CVE-2022-33162 State: PUBLISHED Published: 2024-08-16T18:33:35.966Z Last Updated: 2024-09-07T13:11:02.131Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: IBM Products: Security Directory Integrator, Security Verify Directory Integrator Problem Types: CWE-119 Description: IBM Security Directory Integrator 7.2.0 and Security Verify Directory Integrator 10.0.0 does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources, at the privilege level of a standard unprivileged user. IBM X-Force ID: 228570. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ib
privileged user. IBM X-Force ID: 228570. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7161442 - https://exchange.xforce.ibmcloud.com/vulnerabilities/228570
CVE ID: CVE-2022-33163 State: PUBLISHED Published: 2023-06-15T01:10:45.993Z Last Updated: 2024-12-12T21:30:09.045Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: Security Directory Suite VA Problem Types: CWE-732 Description: IBM Security Directory Suite VA 8.0.1 specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. IBM X-Force ID: 228571. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7001885 - https://exchange.xforce.ibmcloud.com/vulnerabilities/228571
CVE ID: CVE-2022-33164 State: PUBLISHED Published: 2023-09-08T19:58:51.729Z Last Updated: 2024-09-26T14:16:29.565Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:H) Vendors: IBM Products: Security Directory Integrator Problem Types: CWE-22 Description: IBM Security Directory Server 7.2.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view or write to arbitrary files on the system. IBM X-Force ID: 228579. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7031021 - https://exchan
rogram Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7031021 - https://exchange.xforce.ibmcloud.com/vulnerabilities/228579
CVE ID: CVE-2022-33165 State: PUBLISHED Published: 2023-10-14T14:16:33.333Z Last Updated: 2024-09-17T16:24:52.064Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N) Vendors: IBM Products: Security Directory Server Problem Types: CWE-22 Description: IBM Security Directory Server 6.4.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system. IBM X-Force ID: 228582. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7047116 - https://www.ibm.com/support/
er: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7047116 - https://www.ibm.com/support/pages/node/7047428 - https://exchange.xforce.ibmcloud.com/vulnerabilities/228582
CVE ID: CVE-2022-33166 State: PUBLISHED Published: 2023-06-15T02:33:33.518Z Last Updated: 2024-12-12T21:38:47.174Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: IBM Products: Security Directory Suite VA Problem Types: CWE-434 Description: IBM Security Directory Suite VA 8.0.1 through 8.0.1.19 could allow a privileged user to upload malicious files of dangerous types that can be automatically processed within the product's environment. IBM X-Force ID: 228586. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7001693 - https://exchange.xforce.ibmcloud.com/vulnerabilities/228586