Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-34294 State: PUBLISHED Published: 2022-08-15T11:53:52 Last Updated: 2024-08-03T09:07:16.040Z Vendors: n/a Products: n/a Problem Types: n/a Description: totd 1.5.3 uses a fixed UDP source port in upstream queries sent to DNS resolvers. This allows DNS cache poisoning because there is not enough entropy to prevent traffic injection attacks. Additional Analyst Notes: - CVE Program Container: References: - https://www.usenix.org/conference/usenixsecurity22/presentation/jeitner - https://github.com/fwdillema/totd - https://www.blackhat.com/presentations/bh-jp-08/bh-jp-08-Kaminsky/BlackHat-Japan-08-Kaminsky-DNS08-BlackOps.pdf - https://www.openwall.com/lists/oss-security/2022/08/1
/bh-jp-08-Kaminsky/BlackHat-Japan-08-Kaminsky-DNS08-BlackOps.pdf - https://www.openwall.com/lists/oss-security/2022/08/14/2
CVE ID: CVE-2022-34295 State: PUBLISHED Published: 2022-06-22T14:46:35 Last Updated: 2024-08-03T09:07:15.818Z Vendors: n/a Products: n/a Problem Types: n/a Description: totd before 1.5.3 does not properly randomize mesg IDs. Additional Analyst Notes: - CVE Program Container: References: - https://www.usenix.org/conference/usenixsecurity22/presentation/jeitner - http://www.hit.bme.hu/~lencse/publications/JCST-Apr14-2.pdf - https://github.com/fwdillema/totd/commit/afd8a10a6a21f82a70940d1b43cff48143250399 - https://github.com/fwdillema/totd/releases/tag/1.5.3
CVE ID: CVE-2022-34296 State: PUBLISHED Published: 2022-06-22T12:57:53 Last Updated: 2024-08-03T09:07:15.958Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Zalando Skipper before 0.13.218, a query predicate could be bypassed via a prepared request. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/zalando/skipper/releases/tag/v0.13.218
CVE ID: CVE-2022-34297 State: PUBLISHED Published: 2022-12-09T00:00:00.000Z Last Updated: 2025-04-22T20:25:45.861Z Vendors: n/a Products: n/a Problem Types: n/a Description: Yii Yii2 Gii through 2.2.4 allows stored XSS by injecting a payload into any field. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gist.github.com/be4r/b5c48d97ef6726d3ee37f995ee5aac81
CVE ID: CVE-2022-34298 State: PUBLISHED Published: 2022-06-22T13:18:27 Last Updated: 2024-08-03T09:07:16.133Z Vendors: n/a Products: n/a Problem Types: n/a Description: The NT auth module in OpenAM before 14.6.6 allows a "replace Samba username attack." Additional Analyst Notes: - CVE Program Container: References: - https://github.com/OpenIdentityPlatform/OpenAM/pull/514 - https://github.com/OpenIdentityPlatform/OpenAM/compare/14.6.5...14.6.6 - https://github.com/OpenIdentityPlatform/OpenAM/releases/tag/14.6.6
CVE ID: CVE-2022-34299 State: PUBLISHED Published: 2022-06-22T14:35:21 Last Updated: 2024-08-03T09:07:16.067Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is a heap-based buffer over-read in libdwarf 0.4.0. This issue is related to dwarf_global_formref_b. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/davea42/libdwarf-code/issues/119 - https://github.com/davea42/libdwarf-code/commit/7ef09e1fc9ba07653dd078edb2408631c7969162
CVE ID: CVE-2022-34300 State: PUBLISHED Published: 2022-06-22T00:00:00 Last Updated: 2024-08-03T09:07:15.665Z Vendors: n/a Products: n/a Problem Types: n/a Description: In tinyexr 1.0.1, there is a heap-based buffer over-read in tinyexr::DecodePixelData. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/syoyo/tinyexr/issues/167 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LQCZL36LTOHWCQ25R5WTRSD5QMM436Q6/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I4YMGAN6AV4H4HPDINUHBKX7XE4T5THF/ - https://lists.fedoraproject.org/archives/list/package-announce%40lis
ect.org/message/I4YMGAN6AV4H4HPDINUHBKX7XE4T5THF/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JFCXR2EJGIE24DV45AWX6JJM7RQAT5CY/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HSGENQ3UEQ6QEKW45FLZFGXPCD5IHXFM/
CVE ID: CVE-2022-34301 State: PUBLISHED Published: 2022-08-26T00:00:00 Last Updated: 2024-08-03T09:07:16.121Z Vendors: n/a Products: n/a Problem Types: n/a Description: A flaw was found in CryptoPro Secure Disk bootloaders before 2022-06-01. An attacker may use this bootloader to bypass or tamper with Secure Boot protections. In order to load and execute arbitrary code in the pre-boot stage, an attacker simply needs to replace the existing signed bootloader currently in use with this bootloader. Access to the EFI System Partition is required for booting using external media. Additional Analyst Notes: - CVE Program Container: References: - https://edk2-docs.gitbook.io/understanding-the-uefi-s
. Additional Analyst Notes: - CVE Program Container: References: - https://edk2-docs.gitbook.io/understanding-the-uefi-secure-boot-chain/secure_boot_chain_in_uefi/uefi_secure_boot - https://www.kb.cert.org/vuls/id/309662 - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01001.html
CVE ID: CVE-2022-34302 State: PUBLISHED Published: 2022-08-26T00:00:00 Last Updated: 2024-08-03T09:07:16.375Z Vendors: n/a Products: n/a Problem Types: n/a Description: A flaw was found in New Horizon Datasys bootloaders before 2022-06-01. An attacker may use this bootloader to bypass or tamper with Secure Boot protections. In order to load and execute arbitrary code in the pre-boot stage, an attacker simply needs to replace the existing signed bootloader currently in use with this bootloader. Access to the EFI System Partition is required for booting using external media. Additional Analyst Notes: - CVE Program Container: References: - https://edk2-docs.gitbook.io/understanding-the-uefi-sec
Additional Analyst Notes: - CVE Program Container: References: - https://edk2-docs.gitbook.io/understanding-the-uefi-secure-boot-chain/secure_boot_chain_in_uefi/uefi_secure_boot - https://www.kb.cert.org/vuls/id/309662 - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01001.html
CVE ID: CVE-2022-34303 State: PUBLISHED Published: 2022-08-26T00:00:00 Last Updated: 2024-08-03T09:07:16.053Z Vendors: n/a Products: n/a Problem Types: n/a Description: A flaw was found in Eurosoft bootloaders before 2022-06-01. An attacker may use this bootloader to bypass or tamper with Secure Boot protections. In order to load and execute arbitrary code in the pre-boot stage, an attacker simply needs to replace the existing signed bootloader currently in use with this bootloader. Access to the EFI System Partition is required for booting using external media. Additional Analyst Notes: - CVE Program Container: References: - https://edk2-docs.gitbook.io/understanding-the-uefi-secure-boot-ch
Analyst Notes: - CVE Program Container: References: - https://edk2-docs.gitbook.io/understanding-the-uefi-secure-boot-chain/secure_boot_chain_in_uefi/uefi_secure_boot - https://www.kb.cert.org/vuls/id/309662 - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01001.html
CVE ID: CVE-2022-34305 State: PUBLISHED Published: 2022-06-23T10:30:16 Last Updated: 2024-08-03T09:07:16.126Z Vendors: Apache Software Foundation Products: Apache Tomcat Problem Types: CWE-79 Description: In Apache Tomcat 10.1.0-M1 to 10.1.0-M16, 10.0.0-M1 to 10.0.22, 9.0.30 to 9.0.64 and 8.5.50 to 8.5.81 the Form authentication example in the examples web application displayed user provided data without filtering, exposing a XSS vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread/k04zk0nq6w57m72w5gb0r6z9ryhmvr4k - http://www.openwall.com/lists/oss-security/2022/06/23/1 - https://security.netapp.com/advisory/ntap-20220729-0006/ - ht
http://www.openwall.com/lists/oss-security/2022/06/23/1 - https://security.netapp.com/advisory/ntap-20220729-0006/ - https://security.gentoo.org/glsa/202208-34
CVE ID: CVE-2022-34306 State: PUBLISHED Published: 2022-07-08T17:00:42.126606Z Last Updated: 2024-09-17T02:00:33.442Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AC:L/C:L/I:L/A:N/UI:N/PR:L/S:U/AV:N/RC:C/RL:O/E:U) Vendors: IBM Products: CICS TX Advanced, CICS TX Standard Problem Types: Gain Access Description: IBM CICS TX Standard and Advanced 11.1 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking. IBM X-Force ID: 229435. Additional Analyst Notes: - CVE Program Container: References: - https://www.
session hijacking. IBM X-Force ID: 229435. Additional Analyst Notes: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/6601663 - https://www.ibm.com/support/pages/node/6601659 - https://exchange.xforce.ibmcloud.com/vulnerabilities/229435
CVE ID: CVE-2022-34307 State: PUBLISHED Published: 2022-08-01T15:41:36.575201Z Last Updated: 2024-09-16T17:02:43.509Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/I:N/C:L/AV:N/PR:N/UI:R/AC:L/S:U/A:N/RC:C/E:U/RL:O) Vendors: IBM Products: CICS TX Advanced, CICS TX Standard Problem Types: Obtain Information Description: IBM CICS TX 11.1 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 229436. Additional Anal
link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 229436. Additional Analyst Notes: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/6608210 - https://www.ibm.com/support/pages/node/6608208 - https://exchange.xforce.ibmcloud.com/vulnerabilities/229436
CVE ID: CVE-2022-34308 State: PUBLISHED Published: 2022-10-07T17:00:29.224952Z Last Updated: 2024-09-16T23:10:38.081Z Severity: MEDIUM (CVSS 6.2 CVSS:3.0/I:N/AC:L/S:U/A:H/UI:N/PR:N/AV:L/C:N/E:U/RC:C/RL:O) Vendors: IBM Products: CICS TX Standard, CICS TX Advanced Problem Types: Denial of Service Description: IBM CICS TX 11.1 could allow a local user to cause a denial of service due to improper load handling. IBM X-Force ID: 229437. Additional Analyst Notes: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/6826645 - https://www.ibm.com/support/pages/node/6826647 - https://exchange.xforce.ibmcloud.com/vulnerabilities/229437
CVE ID: CVE-2022-34309 State: PUBLISHED Published: 2024-02-12T19:06:07.762Z Last Updated: 2024-08-03T09:07:15.959Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: CICS TX Standard, CICS TX Advanced Problem Types: CWE-327 Description: IBM CICS TX Standard and Advanced 11.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 229440. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/6832814 - https://www.ibm.com/support/pages/node/6832918 - https://exchange.xforce.ibmcloud.com/vulnerabi
ort/pages/node/6832814 - https://www.ibm.com/support/pages/node/6832918 - https://exchange.xforce.ibmcloud.com/vulnerabilities/229440
CVE ID: CVE-2022-34310 State: PUBLISHED Published: 2024-02-12T17:46:44.982Z Last Updated: 2025-04-24T15:41:48.692Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: CICS TX Standard, CICS TX Advanced Problem Types: CWE-327 Description: IBM CICS TX Standard and Advanced 11.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 229441. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/6832922 - https://www.ibm.com/support/pages/node/6832924 - https://exchange.xforce.ibmcloud.com/vulnerabi
ort/pages/node/6832922 - https://www.ibm.com/support/pages/node/6832924 - https://exchange.xforce.ibmcloud.com/vulnerabilities/229441
CVE ID: CVE-2022-34311 State: PUBLISHED Published: 2024-02-12T18:12:26.359Z Last Updated: 2025-05-06T18:45:29.095Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: IBM Products: CICS TX Standard, CICS TX Advanced Problem Types: CWE-522 Description: IBM CICS TX Standard and Advanced 11.1 could allow a user with physical access to the web browser to gain access to the user's session due to insufficiently protected credentials. IBM X-Force ID: 229446. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6832930 - https://exchange.xforce.ibmcloud.com/vulnerabilities/229446 - https://www.i
s://www.ibm.com/support/pages/node/6832930 - https://exchange.xforce.ibmcloud.com/vulnerabilities/229446 - https://www.ibm.com/support/pages/node/6832928
CVE ID: CVE-2022-34312 State: PUBLISHED Published: 2022-11-14T17:49:55.297Z Last Updated: 2025-04-30T19:52:00.296Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: IBM Products: CICS TX Problem Types: CWE-200 Description: IBM CICS TX 11.1 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 229447. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6833156 - https://www.ibm.com/support/pages/node/6833150 - https://exchange.xforce.ibmcloud.com/vulnerabilities/229447
CVE ID: CVE-2022-34313 State: PUBLISHED Published: 2022-11-14T17:05:53.923Z Last Updated: 2025-04-30T13:43:26.937Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: IBM Products: CICS TX Problem Types: CWE-200 Description: IBM CICS TX 11.1 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. X-Force ID: 229449. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment
by snooping the traffic. X-Force ID: 229449. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6833158 - https://www.ibm.com/support/pages/node/6833164 - https://exchange.xforce.ibmcloud.com/vulnerabilities/229449
CVE ID: CVE-2022-34314 State: PUBLISHED Published: 2022-11-14T18:38:50.824Z Last Updated: 2025-04-30T15:06:05.007Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: IBM Products: CICS TX Problem Types: CWE-200 Description: IBM CICS TX 11.1 could disclose sensitive information to a local user due to insecure permission settings. IBM X-Force ID: 229450. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6833170 - https://www.ibm.com/support/pages/node/6833166 - https://exchange.xforce.ibmcloud.com/vulnerabilities/229450
CVE ID: CVE-2022-34315 State: PUBLISHED Published: 2022-11-14T18:18:58.661Z Last Updated: 2025-04-30T15:42:05.614Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: IBM Products: CICS TX Problem Types: CWE-79 Description: IBM CICS TX 11.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 229451. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6833172 - https://www.ibm.com/support/pages
CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6833172 - https://www.ibm.com/support/pages/node/6833174 - https://exchange.xforce.ibmcloud.com/vulnerabilities/229451
CVE ID: CVE-2022-34316 State: PUBLISHED Published: 2022-11-14T18:47:00.784Z Last Updated: 2025-04-30T15:05:23.387Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: IBM Products: CICS TX Problem Types: CWE-644, The application does not neutralize or incorrectly neutralizes web scripting syntax in HTTP headers that can be used by web browser components that can process raw headers, such as Flash. Description: IBM CICS TX 11.1 does not neutralize or incorrectly neutralizes web scripting syntax in HTTP headers that can be used by web browser components that can process raw headers. IBM X-Force ID: 229452. Additional Analyst Notes: - CVE Program Container: - CISA ADP
ents that can process raw headers. IBM X-Force ID: 229452. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6833176 - https://www.ibm.com/support/pages/node/6833178 - https://exchange.xforce.ibmcloud.com/vulnerabilities/229452
CVE ID: CVE-2022-34317 State: PUBLISHED Published: 2022-11-14T19:10:14.891Z Last Updated: 2025-04-29T19:32:17.395Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: IBM Products: CICS TX Problem Types: CWE-79 Description: IBM CICS TX 11.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 229459. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6833182 - https://www.ibm.com/support/pages
CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6833182 - https://www.ibm.com/support/pages/node/6833180 - https://exchange.xforce.ibmcloud.com/vulnerabilities/229459
CVE ID: CVE-2022-34318 State: PUBLISHED Published: 2022-11-14T19:04:12.560Z Last Updated: 2025-04-30T15:02:45.539Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: IBM Products: CICS TX Problem Types: n/a Description: IBM CICS TX 11.1 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim. IBM X-Force ID: 229461. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/683318
yst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6833186 - https://www.ibm.com/support/pages/node/6833188 - https://exchange.xforce.ibmcloud.com/vulnerabilities/229461
CVE ID: CVE-2022-34319 State: PUBLISHED Published: 2022-11-14T17:23:21.220Z Last Updated: 2025-04-29T19:36:52.586Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: CICS TX Problem Types: CWE-327 Description: IBM CICS TX 11.7 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 229463. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6833192 - https://www.ibm.com/support/pages/node/6833190 - https://exchange.xforce.ibmcloud.com/vulnerabilities/229463
CVE ID: CVE-2022-34320 State: PUBLISHED Published: 2022-11-14T19:27:46.033Z Last Updated: 2025-04-29T14:53:09.027Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: CICS TX Problem Types: CWE-327 Description: IBM CICS TX 11.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 229464. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6833204 - https://www.ibm.com/support/pages/node/6833206 - https://exchange.xforce.ibmcloud.com/vulnerabilities/229464
CVE ID: CVE-2022-34321 State: PUBLISHED Published: 2024-03-12T18:17:06.236Z Last Updated: 2025-02-13T16:32:45.878Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L) Vendors: Apache Software Foundation Products: Apache Pulsar Problem Types: CWE-306 Description: Improper Authentication vulnerability in Apache Pulsar Proxy allows an attacker to connect to the /proxy-stats endpoint without authentication. The vulnerable endpoint exposes detailed statistics about live connections, along with the capability to modify the logging level of proxied connections without requiring proper authentication credentials. This issue affects Apache Pulsar versions from 2.6.0 to 2.10.5, from
ithout requiring proper authentication credentials. This issue affects Apache Pulsar versions from 2.6.0 to 2.10.5, from 2.11.0 to 2.11.2, from 3.0.0 to 3.0.1, and 3.1.0. The known risks include exposing sensitive information such as connected client IP and unauthorized logging level manipulation which could lead to a denial-of-service condition by significantly increasing the proxy's logging overhead. When deployed via the Apache Pulsar Helm chart within Kubernetes environments, the actual client IP might not be revealed through the load balancer's default behavior, which typically obscures the original source IP addresses when externalTrafficPolicy is being configured to "Cluster" by defau
typically obscures the original source IP addresses when externalTrafficPolicy is being configured to "Cluster" by default. The /proxy-stats endpoint contains topic level statistics, however, in the default configuration, the topic level statistics aren't known to be exposed. 2.10 Pulsar Proxy users should upgrade to at least 2.10.6. 2.11 Pulsar Proxy users should upgrade to at least 2.11.3. 3.0 Pulsar Proxy users should upgrade to at least 3.0.2. 3.1 Pulsar Proxy users should upgrade to at least 3.1.1. Users operating versions prior to those listed above should upgrade to the aforementioned patched versions or newer versions. Additionally, it's imperative to recognize that the Apache Pulsar
the aforementioned patched versions or newer versions. Additionally, it's imperative to recognize that the Apache Pulsar Proxy is not intended for direct exposure to the internet. The architectural design of Pulsar Proxy assumes that it will operate within a secured network environment, safeguarded by appropriate perimeter defenses. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/ods5tq2hpl390hvjnvxv0bcg4rfpgjj8 - https://pulsar.apache.org/security/CVE-2022-34321/ - http://www.openwall.com/lists/oss-security/2024/03/12/8
CVE ID: CVE-2022-34322 State: PUBLISHED Published: 2023-01-01T00:00:00.000Z Last Updated: 2025-04-10T20:16:39.911Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple XSS issues were discovered in Sage Enterprise Intelligence 2021 R1.1 that allow an attacker to execute JavaScript code in the context of users' browsers. The attacker needs to be authenticated to reach the vulnerable features. An issue is present in the Notify Users About Modification menu and the Notifications feature. A user can send malicious notifications and execute JavaScript code in the browser of every user who has enabled notifications. This is a stored XSS, and can lead to privilege escalation in the c