Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-165073.pdf
CVE ID: CVE-2022-29881 State: PUBLISHED Published: 2022-05-10T09:47:26 Last Updated: 2024-08-03T06:33:43.149Z Vendors: Siemens Products: SICAM P850, SICAM P855 Problem Types: CWE-306 Description: A vulnerability has been identified in SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850
versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00). The web based management interface of affected devices does not employ special access protection for certain internal developer views. This could allow unauthenticated users to extract internal configuration details. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-165073.pdf
CVE ID: CVE-2022-29882 State: PUBLISHED Published: 2022-05-10T09:47:28 Last Updated: 2024-08-03T06:33:43.184Z Vendors: Siemens Products: SICAM P850, SICAM P855 Problem Types: CWE-79 Description: A vulnerability has been identified in SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850
versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00). Affected devices do not handle uploaded files correctly. An unauthenticated attacker could take advantage of this situation to store an XSS attack, which could - when a legitimate user accesses the error logs - perform arbitrary actions in the name of the user. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/product
me of the user. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-165073.pdf
CVE ID: CVE-2022-29883 State: PUBLISHED Published: 2022-05-10T09:47:29 Last Updated: 2024-08-03T06:33:43.144Z Vendors: Siemens Products: SICAM P850, SICAM P855 Problem Types: CWE-287 Description: A vulnerability has been identified in SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850
versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00). Affected devices do not restrict unauthenticated access to certain pages of the web interface. This could allow an attacker to delete log files without authentication. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-165073.pdf
CVE ID: CVE-2022-29884 State: PUBLISHED Published: 2022-07-12T10:06:40 Last Updated: 2024-08-03T06:33:43.055Z Vendors: Siemens Products: CP-8000 MASTER MODULE WITH I/O -25/+70°C, CP-8000 MASTER MODULE WITH I/O -40/+70°C, CP-8021 MASTER MODULE, CP-8022 MASTER MODULE WITH GPRS Problem Types: CWE-772 Description: A vulnerability has been identified in CP-8000 MASTER MODULE WITH I/O -25/+70°C (All versions < CPC80 V16.30), CP-8000 MASTER MODULE WITH I/O -40/+70°C (All versions < CPC80 V16.30), CP-8021 MASTER MODULE (All versions < CPC80 V16.30), CP-8022 MASTER MODULE WITH GPRS (All versions < CPC80 V16.30). When using the HTTPS server under specific conditions, affected devices do not properly f
(All versions < CPC80 V16.30). When using the HTTPS server under specific conditions, affected devices do not properly free resources. This could allow an unauthenticated remote attacker to put the device into a denial of service condition. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-491621.pdf
CVE ID: CVE-2022-29885 State: PUBLISHED Published: 2022-05-12T00:00:00 Last Updated: 2024-08-03T06:33:42.950Z Vendors: Apache Software Foundation Products: Apache Tomcat Problem Types: CWE-400 Description: The documentation of Apache Tomcat 10.1.0-M1 to 10.1.0-M14, 10.0.0-M1 to 10.0.20, 9.0.13 to 9.0.62 and 8.5.38 to 8.5.78 for the EncryptInterceptor incorrectly stated it enabled Tomcat clustering to run over an untrusted network. This was not correct. While the EncryptInterceptor does provide confidentiality and integrity protection, it does not protect against all risks associated with running over any untrusted network, particularly DoS risks. Additional Analyst Notes: - CVE Program Conta
ssociated with running over any untrusted network, particularly DoS risks. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread/2b4qmhbcyqvc7dyfpjyx54c03x65vhcv - https://www.oracle.com/security-alerts/cpujul2022.html - https://security.netapp.com/advisory/ntap-20220629-0002/ - https://lists.debian.org/debian-lts-announce/2022/10/msg00029.html - https://www.debian.org/security/2022/dsa-5265 - http://packetstormsecurity.com/files/171728/Apache-Tomcat-10.1-Denial-Of-Service.html
CVE ID: CVE-2022-29886 State: PUBLISHED Published: 2022-08-05T21:20:38.092Z Last Updated: 2025-04-15T18:52:41.009Z Severity: HIGH (CVSS 7.3 CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: ESTsoft Products: Alyac Problem Types: CWE-680 Description: An integer overflow vulnerability exists in the way ESTsoft Alyac 2.5.8.544 parses OLE files. A specially-crafted OLE file can lead to a heap buffer overflow, which can result in arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2022-1533
CVE ID: CVE-2022-29887 State: PUBLISHED Published: 2023-08-11T02:37:20.811Z Last Updated: 2024-10-10T15:12:16.638Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) Vendors: n/a Products: Intel(R) Manageability Commander software Problem Types: escalation of privilege, CWE-79 Description: Cross-site Scripting (XSS) in some Intel(R) Manageability Commander software before version 2.3 may allow an unauthenticated user to potentially enable escalation of privilege via network access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00893.html
CVE ID: CVE-2022-29888 State: PUBLISHED Published: 2022-11-09T17:35:39.230Z Last Updated: 2025-04-15T18:40:44.532Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H) Vendors: InHand Networks Products: InRouter302 Problem Types: CWE-489 Description: A leftover debug code vulnerability exists in the httpd port 4444 upload.cgi functionality of InHand Networks InRouter302 V3.5.45. A specially-crafted HTTP request can lead to arbitrary file deletion. An attacker can send an HTTP request to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://inhandnetworks.com/upload/attachment/202210/25/InHand-PSA-2022
Container: - CISA ADP Vulnrichment: References: - https://inhandnetworks.com/upload/attachment/202210/25/InHand-PSA-2022-02.pdf - https://talosintelligence.com/vulnerability_reports/TALOS-2022-1522
CVE ID: CVE-2022-29889 State: PUBLISHED Published: 2022-10-25T16:33:37.204Z Last Updated: 2025-04-15T18:48:16.696Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: abode systems, inc. Products: iota All-In-One Security Kit Problem Types: CWE-798 Description: A hard-coded password vulnerability exists in the telnet functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9Z. Use of a hard-coded root password can lead to arbitrary command execution. An attacker can authenticate with hard-coded credentials to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligenc
lity. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2022-1569
CVE ID: CVE-2022-29890 State: PUBLISHED Published: 2022-07-15T07:40:16 Last Updated: 2024-08-03T06:33:43.062Z Vendors: Octopus Deploy Products: Octopus Server Problem Types: Stored Cross-Site Scripting (XSS) Description: In affected versions of Octopus Server the help sidebar can be customized to include a Cross-Site Scripting payload in the support link. Additional Analyst Notes: - CVE Program Container: References: - https://advisories.octopus.com/post/2022/sa2022-07/
CVE ID: CVE-2022-29891 State: PUBLISHED Published: 2022-08-18T07:11:37 Last Updated: 2024-08-03T06:33:43.067Z Vendors: Cybozu, Inc. Products: Cybozu Office Problem Types: Improper Access Control Description: Browse restriction bypass vulnerability in Custom Ap of Cybozu Office 10.0.0 to 10.8.5 allows a remote authenticated attacker to obtain the data of Custom App via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://cs.cybozu.co.jp/2022/007584.html - https://jvn.jp/en/jp/JVN20573662/index.html
CVE ID: CVE-2022-29892 State: PUBLISHED Published: 2022-07-04T06:56:42 Last Updated: 2024-08-03T06:33:43.160Z Vendors: Cybozu, Inc. Products: Cybozu Garoon Problem Types: Improper Input Validation Description: Improper input validation vulnerability in Space of Cybozu Garoon 4.0.0 to 5.5.1 allows a remote authenticated attacker to repeatedly display errors in certain functions and cause a denial-of-service (DoS). Additional Analyst Notes: - CVE Program Container: References: - https://cs.cybozu.co.jp/2022/007429.html - https://jvn.jp/en/jp/JVN73897863/index.html
CVE ID: CVE-2022-29893 State: PUBLISHED Published: 2022-11-11T15:48:36.224Z Last Updated: 2025-02-05T20:54:17.483Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: n/a Products: Intel(R) AMT Problem Types: escalation of privilege Description: Improper authentication in firmware for Intel(R) AMT before versions 11.8.93, 11.22.93, 11.12.93, 12.0.92, 14.1.67, 15.0.42, 16.1.25 may allow an authenticated user to potentially enable escalation of privilege via network access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00610.html
CVE ID: CVE-2022-29894 State: PUBLISHED Published: 2022-06-13T04:50:35 Last Updated: 2024-08-03T06:33:42.954Z Vendors: Strapi Products: Strapi Problem Types: Cross-site scripting Description: Strapi v3.x.x versions and earlier contain a stored cross-site scripting vulnerability in file upload function. By exploiting this vulnerability, an arbitrary script may be executed on the web browser of the user who is logging in to the product with the administrative privilege. Additional Analyst Notes: - CVE Program Container: References: - https://strapi.io/ - https://github.com/strapi/strapi - https://jvn.jp/en/jp/JVN44550983/index.html
CVE ID: CVE-2022-29895 State: REJECTED Published: N/A Last Updated: 2025-05-28T18:19:25.123Z Description: No description available.
CVE ID: CVE-2022-29896 State: REJECTED Published: N/A Last Updated: 2025-05-28T18:19:26.299Z Description: No description available.
CVE ID: CVE-2022-29897 State: PUBLISHED Published: 2022-05-11T14:25:22.545206Z Last Updated: 2024-09-17T04:03:58.341Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: PHOENIX CONTACT Products: RAD-ISM-900-EN-BD/B, RAD-ISM-900-EN-BD, RAD-ISM-900-EN-BD-BUS Problem Types: CWE-20 Description: On various RAD-ISM-900-EN-* devices by PHOENIX CONTACT an admin user could use the traceroute utility integrated in the WebUI to execute arbitrary code with root privileges on the OS due to an improper input validation in all versions of the firmware. Additional Analyst Notes: - CVE Program Container: References: - https://cert.vde.com/en/advisories/VDE-2022-018/
CVE ID: CVE-2022-29898 State: PUBLISHED Published: 2022-05-11T14:25:24.072292Z Last Updated: 2024-09-16T19:15:11.050Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: PHOENIX CONTACT Products: RAD-ISM-900-EN-BD/B, RAD-ISM-900-EN-BD, RAD-ISM-900-EN-BD-BUS Problem Types: CWE-354 Description: On various RAD-ISM-900-EN-* devices by PHOENIX CONTACT an admin user could use the configuration file uploader in the WebUI to execute arbitrary code with root privileges on the OS due to an improper validation of an integrity check value in all versions of the firmware. Additional Analyst Notes: - CVE Program Container: References: - https://cert.vde.com/en/advisories/VD
of the firmware. Additional Analyst Notes: - CVE Program Container: References: - https://cert.vde.com/en/advisories/VDE-2022-018/
CVE ID: CVE-2022-29899 State: REJECTED Published: N/A Last Updated: 2023-01-04T00:00:00 Description: No description available.
CVE ID: CVE-2022-29900 State: PUBLISHED Published: 2022-07-12T15:50:10.585306Z Last Updated: 2024-11-20T16:13:31.449Z Vendors: AMD Products: AMD Processors Problem Types: NA Description: Mis-trained branch predictions for return instructions may allow arbitrary speculative code execution under certain microarchitecture-dependent conditions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1037 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MYI3OMJ7RIZNL3C6GUWNANNPEUUID6FM/ - https://www.debian.org/security/2022/dsa-5207 - https://lists
oraproject.org/message/MYI3OMJ7RIZNL3C6GUWNANNPEUUID6FM/ - https://www.debian.org/security/2022/dsa-5207 - https://lists.debian.org/debian-lts-announce/2022/09/msg00011.html - https://www.secpod.com/blog/retbleed-intel-and-amd-processor-information-disclosure-vulnerability/ - https://security.gentoo.org/glsa/202402-07
CVE ID: CVE-2022-29901 State: PUBLISHED Published: 2022-07-12T00:00:00 Last Updated: 2024-08-03T06:33:43.000Z Severity: MEDIUM (CVSS 5.6 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: Intel Products: Intel Microprocessors Problem Types: CWE-200 Description: Intel microprocessor generations 6 to 8 are affected by a new Spectre variant that is able to bypass their retpoline mitigation in the kernel to leak arbitrary data. An attacker with unprivileged user access can hijack return instructions to achieve arbitrary speculative code execution under certain microarchitecture-dependent conditions. Additional Analyst Notes: - CVE Program Container: References: - https://comsec.ethz.ch/retbl
ture-dependent conditions. Additional Analyst Notes: - CVE Program Container: References: - https://comsec.ethz.ch/retbleed - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00702.html - http://www.openwall.com/lists/oss-security/2022/07/12/2 - http://www.openwall.com/lists/oss-security/2022/07/12/4 - http://www.openwall.com/lists/oss-security/2022/07/12/5 - http://www.openwall.com/lists/oss-security/2022/07/13/1 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M27MB3QFNIJV4EQQSXWARHP3OGX6CR6K/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D4RW5FCIYFNCQOEFJEUIRW3DG
tps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D4RW5FCIYFNCQOEFJEUIRW3DGYW7CWBG/ - https://www.debian.org/security/2022/dsa-5207 - https://lists.debian.org/debian-lts-announce/2022/09/msg00011.html - https://security.netapp.com/advisory/ntap-20221007-0007/ - https://lists.debian.org/debian-lts-announce/2022/12/msg00034.html - https://www.secpod.com/blog/retbleed-intel-and-amd-processor-information-disclosure-vulnerability/ - https://security.gentoo.org/glsa/202402-07
CVE ID: CVE-2022-29903 State: PUBLISHED Published: 2022-04-29T03:44:15 Last Updated: 2024-08-03T06:33:43.184Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Private Domains extension for MediaWiki through 1.37.2 (before 1ad65d4c1c199b375ea80988d99ab51ae068f766) allows CSRF for editing pages that store the extension's configuration. The attacker must trigger a POST request to Special:PrivateDomains. Additional Analyst Notes: - CVE Program Container: References: - https://phabricator.wikimedia.org/T306290 - https://gerrit.wikimedia.org/r/c/mediawiki/extensions/PrivateDomains/+/783416
CVE ID: CVE-2022-29904 State: PUBLISHED Published: 2022-04-29T03:43:51 Last Updated: 2024-08-03T06:33:43.149Z Vendors: n/a Products: n/a Problem Types: n/a Description: The SemanticDrilldown extension for MediaWiki through 1.37.2 (before e688bdba6434591b5dff689a45e4d53459954773) allows SQL injection with certain '-' and '_' constraints. Additional Analyst Notes: - CVE Program Container: References: - https://phabricator.wikimedia.org/T306463 - https://gerrit.wikimedia.org/r/c/mediawiki/extensions/SemanticDrilldown/+/785213
CVE ID: CVE-2022-29905 State: PUBLISHED Published: 2022-04-29T03:43:22 Last Updated: 2024-08-03T06:33:42.956Z Vendors: n/a Products: n/a Problem Types: n/a Description: The FanBoxes extension for MediaWiki through 1.37.2 (before 027ffb0b9d6fe0d823810cf03f5b562a212162d4) allows Special:UserBoxes CSRF. Additional Analyst Notes: - CVE Program Container: References: - https://phabricator.wikimedia.org/T306741 - https://gerrit.wikimedia.org/r/c/mediawiki/extensions/FanBoxes/+/786327
CVE ID: CVE-2022-29906 State: PUBLISHED Published: 2022-04-29T03:42:52 Last Updated: 2024-08-03T06:33:43.164Z Vendors: n/a Products: n/a Problem Types: n/a Description: The admin API module in the QuizGame extension for MediaWiki through 1.37.2 (before 665e33a68f6fa1167df99c0aa18ed0157cdf9f66) omits a check for the quizadmin user. Additional Analyst Notes: - CVE Program Container: References: - https://phabricator.wikimedia.org/T302199 - https://gerrit.wikimedia.org/r/c/mediawiki/extensions/QuizGame/+/765651
CVE ID: CVE-2022-29907 State: PUBLISHED Published: 2022-04-29T03:42:28 Last Updated: 2024-08-03T06:33:43.175Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Nimbus skin for MediaWiki through 1.37.2 (before 6f9c8fb868345701d9544a54d9752515aace39df) allows XSS in Advertise link messages. Additional Analyst Notes: - CVE Program Container: References: - https://phabricator.wikimedia.org/T306815 - https://gerrit.wikimedia.org/r/c/786959
CVE ID: CVE-2022-29908 State: PUBLISHED Published: 2022-09-19T15:16:46 Last Updated: 2024-08-03T06:33:43.193Z Vendors: n/a Products: n/a Problem Types: n/a Description: The folioupdate service in Fabasoft Cloud Enterprise Client 22.4.0043 allows Local Privilege Escalation. Additional Analyst Notes: - CVE Program Container: References: - https://help.cloud.fabasoft.com/index.php?topic=doc/Technical-Information-eng/the-fabasoft-cloud-enterprise-client.htm - https://www.compass-security.com/fileadmin/Research/Advisories/2022_13_CSNC-2022-010_LPE_Cloud_Client.txt
CVE ID: CVE-2022-29909 State: PUBLISHED Published: 2022-12-22T00:00:00.000Z Last Updated: 2025-04-16T13:47:38.937Z Vendors: Mozilla Products: Thunderbird, Firefox ESR, Firefox Problem Types: Bypassing permission prompt in nested browsing contexts Description: Documents in deeply-nested cross-origin browsing contexts could have obtained permissions granted to the top-level origin, bypassing the existing prompt and wrongfully inheriting the top-level permissions. This vulnerability affects Thunderbird < 91.9, Firefox ESR < 91.9, and Firefox < 100. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2022-16/ -
CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2022-16/ - https://www.mozilla.org/security/advisories/mfsa2022-18/ - https://www.mozilla.org/security/advisories/mfsa2022-17/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1755081
CVE ID: CVE-2022-29910 State: PUBLISHED Published: 2022-12-22T00:00:00.000Z Last Updated: 2025-04-16T13:46:13.237Z Vendors: Mozilla Products: Firefox Problem Types: Firefox for Android forgot HTTP Strict Transport Security settings Description: When closed or sent to the background, Firefox for Android would not properly record and persist HSTS settings.<br>*Note: This issue only affected Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 100. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2022-16/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1757138
CVE ID: CVE-2022-29911 State: PUBLISHED Published: 2022-12-22T00:00:00.000Z Last Updated: 2025-04-16T13:58:35.577Z Vendors: Mozilla Products: Thunderbird, Firefox ESR, Firefox Problem Types: iframe Sandbox bypass Description: An improper implementation of the new iframe sandbox keyword <code>allow-top-navigation-by-user-activation</code> could lead to script execution without <code>allow-scripts</code> being present. This vulnerability affects Thunderbird < 91.9, Firefox ESR < 91.9, and Firefox < 100. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2022-16/ - https://www.mozilla.org/security/advisories/
t: References: - https://www.mozilla.org/security/advisories/mfsa2022-16/ - https://www.mozilla.org/security/advisories/mfsa2022-18/ - https://www.mozilla.org/security/advisories/mfsa2022-17/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1761981
CVE ID: CVE-2022-29912 State: PUBLISHED Published: 2022-12-22T00:00:00.000Z Last Updated: 2025-04-15T20:05:41.479Z Vendors: Mozilla Products: Thunderbird, Firefox ESR, Firefox Problem Types: Reader mode bypassed SameSite cookies Description: Requests initiated through reader mode did not properly omit cookies with a SameSite attribute. This vulnerability affects Thunderbird < 91.9, Firefox ESR < 91.9, and Firefox < 100. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2022-16/ - https://www.mozilla.org/security/advisories/mfsa2022-18/ - https://www.mozilla.org/security/advisories/mfsa2022-17/ - https://b
/www.mozilla.org/security/advisories/mfsa2022-18/ - https://www.mozilla.org/security/advisories/mfsa2022-17/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1692655