Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-38685 State: PUBLISHED Published: 2023-05-09T01:21:32.813Z Last Updated: 2024-08-03T11:02:14.530Z Vendors: Unisoc (Shanghai) Technologies Co., Ltd. Products: SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 Description: In bluetooth service, there is a possible missing permission check. This could lead to local denial of service in bluetooth service with no additional execution privileges needed. Additional Analyst Notes: - CVE Program Container: References: - https://www.unisoc.com/en_us/secy/announcementDetail/1654776866982133761
CVE ID: CVE-2022-38686 State: PUBLISHED Published: 2023-02-06T05:27:35.576Z Last Updated: 2025-03-26T14:24:11.945Z Vendors: Unisoc (Shanghai) Technologies Co., Ltd. Products: SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 Problem Types: n/a Description: In wlan driver, there is a possible missing params check. This could lead to local denial of service in wlan services. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.unisoc.com/en_us/secy/announcementDetail/1621031430231134210
CVE ID: CVE-2022-38687 State: PUBLISHED Published: 2022-10-14T00:00:00.000Z Last Updated: 2025-05-15T14:15:02.096Z Vendors: Unisoc (Shanghai) Technologies Co., Ltd. Products: SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 Problem Types: CWE-400 Description: In messaging service, there is a missing permission check. This could lead to local denial of service in messaging service with no additional execution privileges needed. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.unisoc.com/en_us/secy/announcementDetail/1575654905820020738
CVE ID: CVE-2022-38688 State: PUBLISHED Published: 2022-10-14T00:00:00.000Z Last Updated: 2025-05-15T14:12:21.172Z Vendors: Unisoc (Shanghai) Technologies Co., Ltd. Products: SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 Problem Types: CWE-200 Description: In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.unisoc.com/en_us/secy/announcementDetail/1575654905820020738
CVE ID: CVE-2022-38689 State: PUBLISHED Published: 2022-10-14T00:00:00.000Z Last Updated: 2025-05-15T14:46:46.638Z Vendors: Unisoc (Shanghai) Technologies Co., Ltd. Products: SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 Problem Types: CWE-200 Description: In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.unisoc.com/en_us/secy/announcementDetail/1575654905820020738
CVE ID: CVE-2022-38690 State: PUBLISHED Published: 2022-10-14T00:00:00.000Z Last Updated: 2025-05-15T14:46:09.061Z Vendors: Unisoc (Shanghai) Technologies Co., Ltd. Products: SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 Problem Types: CWE-119 Description: In camera driver, there is a possible memory corruption due to improper locking. This could lead to local denial of service in kernel. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.unisoc.com/en_us/secy/announcementDetail/1575654905820020738
CVE ID: CVE-2022-38691 State: PUBLISHED Published: 2025-09-01T07:28:10.876Z Last Updated: 2025-09-02T13:48:33.151Z Vendors: Unisoc (Shanghai) Technologies Co., Ltd. Products: SC9863A//T310/T610/T618/ Description: In BootROM, there is a possible missing validation for Certificate Type 0. This could lead to local escalation of privilege with no additional execution privileges needed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nccgroup.com/research-blog/there-s-another-hole-in-your-soc-unisoc-rom-vulnerabilities/
CVE ID: CVE-2022-38692 State: PUBLISHED Published: 2025-09-01T07:28:11.880Z Last Updated: 2025-09-02T13:47:08.245Z Vendors: Unisoc (Shanghai) Technologies Co., Ltd. Products: SC9863A/T310/T610/T618/T606/T612/T616/T760/T770/T820/S8000/ Description: In BootROM, there is a missing size check for RSA keys in Certificate Type 0 validation. This could lead to memory buffer overflow without requiring additional execution privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nccgroup.com/research-blog/there-s-another-hole-in-your-soc-unisoc-rom-vulnerabilities/
CVE ID: CVE-2022-38693 State: PUBLISHED Published: 2025-09-01T07:28:12.889Z Last Updated: 2025-09-02T13:44:24.612Z Vendors: Unisoc (Shanghai) Technologies Co., Ltd. Products: SC9863A//T310/T610/T618/T606/T612/T616/T760/T770/T820/S8000/T750/T765 Description: In FDL1, there is a possible missing payload size check. This could lead to memory buffer overflow without requiring additional execution privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nccgroup.com/research-blog/there-s-another-hole-in-your-soc-unisoc-rom-vulnerabilities/
CVE ID: CVE-2022-38694 State: PUBLISHED Published: 2025-09-01T07:28:13.890Z Last Updated: 2025-09-02T13:42:44.172Z Vendors: Unisoc (Shanghai) Technologies Co., Ltd. Products: SC9863A//T310/T610/T618/ Description: In BootRom, there is a possible unchecked write address. This could lead to local escalation of privilege with no additional execution privileges needed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nccgroup.com/research-blog/there-s-another-hole-in-your-soc-unisoc-rom-vulnerabilities/
CVE ID: CVE-2022-38695 State: PUBLISHED Published: 2025-09-01T07:28:14.841Z Last Updated: 2025-09-02T13:41:07.997Z Vendors: Unisoc (Shanghai) Technologies Co., Ltd. Products: SC9863A/T310/T610/T618/T606/T612/T616/T760/T770/T820/S8000/ Description: In BootRom, there's a possible unchecked command index. This could lead to local escalation of privilege with no additional execution privileges needed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nccgroup.com/research-blog/there-s-another-hole-in-your-soc-unisoc-rom-vulnerabilities/
CVE ID: CVE-2022-38696 State: PUBLISHED Published: 2025-09-01T07:28:15.805Z Last Updated: 2025-09-02T13:37:56.800Z Vendors: Unisoc (Shanghai) Technologies Co., Ltd. Products: SC9863A/T310/T610/T618/T606/T612/T616/T760/T770/T820/S8000/T750/T765 Description: In BootRom, there's a possible missing payload size check. This could lead to memory buffer overflow without requiring additional execution privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nccgroup.com/research-blog/there-s-another-hole-in-your-soc-unisoc-rom-vulnerabilities/
CVE ID: CVE-2022-38697 State: PUBLISHED Published: 2022-10-14T00:00:00.000Z Last Updated: 2025-05-15T14:34:48.926Z Vendors: Unisoc (Shanghai) Technologies Co., Ltd. Products: SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 Problem Types: CWE-862 Description: In messaging service, there is a missing permission check. This could lead to access unexpected provider in contacts service with no additional execution privileges needed. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.unisoc.com/en_us/secy/announcementDetail/1575654905820020738
CVE ID: CVE-2022-38698 State: PUBLISHED Published: 2022-10-14T00:00:00.000Z Last Updated: 2025-05-15T14:34:12.519Z Vendors: Unisoc (Shanghai) Technologies Co., Ltd. Products: SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 Problem Types: CWE-862 Description: In messaging service, there is a missing permission check. This could lead to elevation of privilege in contacts service with no additional execution privileges needed. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.unisoc.com/en_us/secy/announcementDetail/1575654905820020738
CVE ID: CVE-2022-38699 State: PUBLISHED Published: 2022-09-28T03:25:34.591Z Last Updated: 2025-05-21T14:54:16.472Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) Vendors: ASUS Products: Armoury Crate Service Problem Types: CWE-59 Description: Armoury Crate Service’s logging function has insufficient validation to check if the log file is a symbolic link. A physical attacker with general user privilege can modify the log file property to a symbolic link that points to arbitrary system file, causing the logging function to overwrite the system file and disrupt the system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https:/
nd disrupt the system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-6522-4eacb-1.html
CVE ID: CVE-2022-38700 State: PUBLISHED Published: 2022-09-09T14:39:56.696153Z Last Updated: 2024-09-16T16:48:02.064Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: OpenHarmony Products: OpenHarmony Problem Types: CWE-305 Description: OpenHarmony-v3.1.1 and prior versions have a permission bypass vulnerability. LAN attackers can bypass permission control and get control of camera service. Additional Analyst Notes: - CVE Program Container: References: - https://gitee.com/openharmony/security/blob/master/en/security-disclosure/2022/2022-09.md
CVE ID: CVE-2022-38701 State: PUBLISHED Published: 2022-09-09T14:39:57.040763Z Last Updated: 2024-09-16T19:10:47.330Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: OpenHarmony Products: OpenHarmony Problem Types: CWE-122 Description: OpenHarmony-v3.1.2 and prior versions have a heap overflow vulnerability. Local attackers can trigger a heap overflow and get network sensitive information. Additional Analyst Notes: - CVE Program Container: References: - https://gitee.com/openharmony/security/blob/master/en/security-disclosure/2022/2022-09.md
CVE ID: CVE-2022-38702 State: PUBLISHED Published: 2023-11-07T17:14:12.146Z Last Updated: 2024-09-04T16:04:04.571Z Vendors: Nakashima Masahiro Products: WP CSV Exporter Problem Types: CWE-1236 Description: Improper Neutralization of Formula Elements in a CSV File vulnerability in Nakashima Masahiro WP CSV Exporter.This issue affects WP CSV Exporter: from n/a through 2.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wp-csv-exporter/wordpress-wp-csv-exporter-plugin-1-3-6-authenticated-csv-injection-vulnerability?_s_id=cve
CVE ID: CVE-2022-38703 State: PUBLISHED Published: 2022-09-23T13:52:19.181Z Last Updated: 2025-02-20T20:04:00.226Z Severity: LOW (CVSS 3.4 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:L/A:N) Vendors: Max Foundry Products: WordPress Button Plugin MaxButtons (WordPress plugin) Problem Types: CWE-79 Description: Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Max Foundry Button Plugin MaxButtons plugin <= 9.2 at WordPress Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/maxbuttons/#developers - https://patchstack.com/database/vulnerability/maxbuttons/wordpress-wordpress-button-plugin-maxbuttons-plugin-9-2
opers - https://patchstack.com/database/vulnerability/maxbuttons/wordpress-wordpress-button-plugin-maxbuttons-plugin-9-2-authenticated-stored-cross-site-scripting-xss-vulnerability/_s_id=cve
CVE ID: CVE-2022-38704 State: PUBLISHED Published: 2022-09-23T18:32:54.735Z Last Updated: 2025-02-20T20:00:56.938Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: WP-buy Products: SEO Redirection Plugin – 301 Redirect Manager (WordPress plugin) Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in SEO Redirection plugin <= 8.9 at WordPress, leading to deletion of 404 errors and redirection history. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/seo-redirection/wordpress-seo-redirection-plugin-8-9-cross-site-request-forgery-csrf-vulnerabil
m/database/vulnerability/seo-redirection/wordpress-seo-redirection-plugin-8-9-cross-site-request-forgery-csrf-vulnerability/_s_id=cve - https://wordpress.org/plugins/seo-redirection/#developers
CVE ID: CVE-2022-38705 State: PUBLISHED Published: 2022-11-14T17:56:59.006Z Last Updated: 2025-04-30T19:50:53.598Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N) Vendors: IBM Products: CICS TX Problem Types: 1022 Description: IBM CICS TX 11.1 Standard and Advanced could allow a remote attacker to bypass security restrictions, caused by a reverse tabnabbing flaw. An attacker could exploit this vulnerability and redirect a victim to a phishing site. IBM X-Force ID: 234172. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6833216 - https://www.ibm.com/support/pages/node/6833218 - https://ex
ferences: - https://www.ibm.com/support/pages/node/6833216 - https://www.ibm.com/support/pages/node/6833218 - https://exchange.xforce.ibmcloud.com/vulnerabilities/234172
CVE ID: CVE-2022-38707 State: PUBLISHED Published: 2023-05-05T13:54:45.562Z Last Updated: 2025-01-29T16:56:04.168Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: IBM Products: Cognos Command Center Problem Types: CWE-613 Description: IBM Cognos Command Center 10.2.4.1 could allow a local attacker to obtain sensitive information due to insufficient session expiration. IBM X-Force ID: 234179. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6983274 - https://exchange.xforce.ibmcloud.com/vulnerabilities/234179
CVE ID: CVE-2022-38708 State: PUBLISHED Published: 2022-12-19T20:12:17.865Z Last Updated: 2025-04-17T13:55:13.679Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: IBM Products: Cognos Analytics Problem Types: CWE-918 Description: IBM Cognos Analytics 11.1.7 11.2.0, and 11.2.1 could be vulnerable to a Server-Side Request Forgery Attack (SSRF) attack by constructing URLs from user-controlled data. This could enable attackers to make arbitrary requests to the internal network or to the local file system. IBM X-Force ID: 234180. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/684180
yst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6841801 - https://exchange.xforce.ibmcloud.com/vulnerabilities/234180
CVE ID: CVE-2022-38709 State: PUBLISHED Published: 2022-10-06T17:15:27.395601Z Last Updated: 2024-09-17T04:13:54.023Z Severity: MEDIUM (CVSS 6.1 CVSS:3.0/A:N/PR:N/UI:R/S:C/I:L/C:L/AC:L/AV:N/RC:C/RL:O/E:H) Vendors: IBM Products: Robotic Process Automation Problem Types: Cross-Site Scripting Description: IBM Robotic Process Automation 21.0.1, 21.0.2, and 21.0.3 for Cloud Pak is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 234291. Additional Analyst Notes: - CVE Program Container: References: - ht
re within a trusted session. IBM X-Force ID: 234291. Additional Analyst Notes: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/6826011 - https://exchange.xforce.ibmcloud.com/vulnerabilities/234291
CVE ID: CVE-2022-38710 State: PUBLISHED Published: 2022-11-03T00:00:00 Last Updated: 2024-09-25T18:15:08.879Z Vendors: IBM Products: Robotic Process Automation Problem Types: CWE-497 Description: IBM Robotic Process Automation 21.0.1 and 21.0.2 could disclose sensitive version to an unauthorized control sphere information that could aid in further attacks against the system. IBM X-Force ID: 234292. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/6831681 - https://exchange.xforce.ibmcloud.com/vulnerabilities/234292
CVE ID: CVE-2022-38712 State: PUBLISHED Published: 2022-11-03T00:00:00.000Z Last Updated: 2025-05-02T20:15:45.552Z Vendors: n/a Products: IBM WebSphere Application Server Problem Types: Command Execution Description: "IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Web services could allow a man-in-the-middle attacker to conduct SOAPAction spoofing to execute unwanted or unauthorized operations. IBM X-Force ID: 234762." Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6829907
CVE ID: CVE-2022-38714 State: PUBLISHED Published: 2024-02-12T17:41:24.984Z Last Updated: 2025-03-18T19:56:08.800Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: DataStage on Cloud Pak for Data Problem Types: 256 Plaintext Storage of a Password Description: IBM DataStage on Cloud Pak for Data 4.0.6 to 4.5.2 stores sensitive credential information that can be read by a privileged user. IBM X-Force ID: 235060. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/6618039 - https://exchange.xforce.ibmcloud.com/vulnerabilities/235060
CVE ID: CVE-2022-38715 State: PUBLISHED Published: 2023-01-26T21:24:48.787Z Last Updated: 2024-08-03T11:02:14.519Z Severity: HIGH (CVSS 7.2 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Siretta Products: QUARTZ-GOLD Problem Types: CWE-489 Description: A leftover debug code vulnerability exists in the httpd shell.cgi functionality of Siretta QUARTZ-GOLD G5.0.1.5-210720-141020. A specially-crafted HTTP request can lead to remote code execution. An attacker can send an HTTP request to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2022-1610
CVE ID: CVE-2022-38716 State: PUBLISHED Published: 2023-05-25T10:28:42.253Z Last Updated: 2025-01-08T21:58:55.810Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: StylemixThemes Products: Motors – Car Dealer, Classifieds & Listing Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in StylemixThemes Motors – Car Dealer, Classifieds & Listing plugin <= 1.4.4 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/motors-car-dealership-classified-listings/wordpress-motors-plugin-1-4-4-multiple-cross-site-request-forgery-csrf-vulnerabilities
ar-dealership-classified-listings/wordpress-motors-plugin-1-4-4-multiple-cross-site-request-forgery-csrf-vulnerabilities?_s_id=cve
CVE ID: CVE-2022-38723 State: PUBLISHED Published: 2023-01-03T00:00:00.000Z Last Updated: 2025-04-10T15:50:36.492Z Vendors: n/a Products: n/a Problem Types: n/a Description: Gravitee API Management before 3.15.13 allows path traversal through HTML injection. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://community.gravitee.io/t/whats-new-in-access-management-3-15-lts/164 - https://gist.github.com/garatc/d86cdb1fa2e35a7ee719d9a0de0b5ca3
CVE ID: CVE-2022-38724 State: PUBLISHED Published: 2022-11-22T00:00:00.000Z Last Updated: 2025-04-29T04:34:39.080Z Vendors: n/a Products: n/a Problem Types: n/a Description: Silverstripe silverstripe/framework through 4.11.0, silverstripe/assets through 1.11.0, and silverstripe/asset-admin through 1.11.0 allow XSS. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.silverstripe.org/download/security-releases/ - https://www.silverstripe.org/blog/tag/release - https://forum.silverstripe.org/c/releases - https://www.silverstripe.org/download/security-releases/CVE-2022-38724
CVE ID: CVE-2022-38725 State: PUBLISHED Published: 2023-01-23T00:00:00.000Z Last Updated: 2025-04-03T14:35:47.853Z Vendors: n/a Products: n/a Problem Types: n/a Description: An integer overflow in the RFC3164 parser in One Identity syslog-ng 3.0 through 3.37 allows remote attackers to cause a Denial of Service via crafted syslog input that is mishandled by the tcp or network function. syslog-ng Premium Edition 7.0.30 and syslog-ng Store Box 6.10.0 are also affected. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.balabit.hu/pipermail/syslog-ng/ - https://github.com/syslog-ng/syslog-ng/security/advisories/GHSA-7932-4fc6-pvmc - https://li
it.hu/pipermail/syslog-ng/ - https://github.com/syslog-ng/syslog-ng/security/advisories/GHSA-7932-4fc6-pvmc - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J3TZ7U2GQTAHVHJXSSEHQS5D2Q5T6SZB/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QU36HCM3VZYANUYFC6XFYEYJEKQPA2Q7/ - https://lists.debian.org/debian-lts-announce/2023/02/msg00043.html - https://www.debian.org/security/2023/dsa-5369 - https://security.gentoo.org/glsa/202305-09
CVE ID: CVE-2022-38730 State: PUBLISHED Published: 2023-04-27T00:00:00.000Z Last Updated: 2025-01-31T19:10:39.528Z Vendors: n/a Products: n/a Problem Types: n/a Description: Docker Desktop for Windows before 4.6 allows attackers to overwrite any file through the windowscontainers/start dockerBackendV2 API by controlling the data-root field inside the DaemonJSON field in the WindowsContainerStartRequest class. This allows exploiting a symlink vulnerability in ..\dataRoot\network\files\local-kv.db because of a TOCTOU race condition. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://docs.docker.com/desktop/release-notes/#docker-desktop-460 - https
tainer: - CISA ADP Vulnrichment: References: - https://docs.docker.com/desktop/release-notes/#docker-desktop-460 - https://www.cyberark.com/resources/threat-research-blog/breaking-docker-named-pipes-systematically-docker-desktop-privilege-escalation-part-2
CVE ID: CVE-2022-38731 State: PUBLISHED Published: 2023-02-16T00:00:00.000Z Last Updated: 2025-03-19T14:51:05.923Z Vendors: n/a Products: n/a Problem Types: n/a Description: Qaelum DOSE 18.08 through 21.1 before 21.2 allows Directory Traversal via the loadimages name parameter. It allows a user to specify an arbitrary location on the server's filesystem from which to load an image. (Only images are displayed to the attacker. All other files are loaded but not displayed.) The Content-Type response header reflects the actual content type of the file being requested. This allows an attacker to enumerate files on the local system. Additionally, remote resources can be requested via a UNC path, a
ws an attacker to enumerate files on the local system. Additionally, remote resources can be requested via a UNC path, allowing an attacker to coerce authentication out from the server to the attackers machine. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://qaelum.com/solutions/dose - https://www.pwc.co.uk/issues/cyber-security-services/research/ethical-hacking-team-discovered-zero-day-vulnerability.html
CVE ID: CVE-2022-38732 State: PUBLISHED Published: 2022-09-29T14:36:58.000Z Last Updated: 2025-05-20T17:54:33.941Z Vendors: n/a Products: SnapCenter Problem Types: Missing Content Security Policy Description: SnapCenter versions prior to 4.7 shipped without Content Security Policy (CSP) implemented which could allow certain types of attacks that otherwise would be prevented. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.netapp.com/advisory/NTAP-20220926-0001/