Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
part.File interface type's documentation states, "If stored on disk, the File's underlying concrete type will be an *os.File.". This is no longer the case when a form contains more than one file part, due to this coalescing of parts into a single file. The previous behavior of using distinct files for each form part may be reenabled with the environment variable GODEBUG=multipartfiles=distinct. Users should be aware that multipart.ReadForm and the http.Request methods that call it do not limit the amount of disk consumed by temporary files. Callers can limit the size of form data with http.MaxBytesReader. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References:
m data with http.MaxBytesReader. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://go.dev/issue/58006 - https://go.dev/cl/468124 - https://groups.google.com/g/golang-announce/c/V0aBFqaFs_E - https://pkg.go.dev/vuln/GO-2023-1569 - https://security.gentoo.org/glsa/202311-09
CVE ID: CVE-2022-41726 State: REJECTED Published: N/A Last Updated: 2024-07-02T16:17:03.961Z Description: No description available.
CVE ID: CVE-2022-41727 State: PUBLISHED Published: 2023-02-28T17:19:47.090Z Last Updated: 2025-03-07T17:55:51.961Z Vendors: golang.org/x/image Products: golang.org/x/image/tiff Problem Types: CWE-400: Uncontrolled Resource Consumption Description: An attacker can craft a malformed TIFF image which will consume a significant amount of memory when passed to DecodeConfig. This could lead to a denial of service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://go.dev/issue/58003 - https://go.dev/cl/468195 - https://groups.google.com/g/golang-announce/c/ag-FiyjlD5o - https://pkg.go.dev/vuln/GO-2023-1572 - https://lists.fedoraproject.org/archives/li
com/g/golang-announce/c/ag-FiyjlD5o - https://pkg.go.dev/vuln/GO-2023-1572 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KO54NBDUJXKAZNGCFOEYL2LKK2RQP6K6/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XWH6Q7NVM4MV3GWFEU4PA67AWZHVFJQ2/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XZTEP6JYILRBNDTNWTEQ5D4QUUVQBESK/
CVE ID: CVE-2022-41728 State: REJECTED Published: N/A Last Updated: 2024-07-02T16:17:26.780Z Description: No description available.
CVE ID: CVE-2022-41729 State: REJECTED Published: N/A Last Updated: 2024-07-02T16:17:46.691Z Description: No description available.
CVE ID: CVE-2022-41730 State: REJECTED Published: N/A Last Updated: 2024-07-02T16:18:12.105Z Description: No description available.
CVE ID: CVE-2022-41731 State: PUBLISHED Published: 2023-02-06T20:09:15.879Z Last Updated: 2025-03-25T17:36:33.674Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L) Vendors: IBM Products: Watson Knowledge Catalog on-prem Problem Types: CWE-89 Description: IBM Watson Knowledge Catalog on Cloud Pak for Data 4.5.0 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 237402. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6890729 - https://
CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6890729 - https://exchange.xforce.ibmcloud.com/vulnerabilities/237402
CVE ID: CVE-2022-41732 State: PUBLISHED Published: 2022-11-28T16:30:28.318Z Last Updated: 2025-04-25T14:58:56.248Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: Maximo Mobile Problem Types: CWE-256 Description: IBM Maximo Mobile 8.7 and 8.8 stores user credentials in plain clear text which can be read by a local user. IBM X-Force ID: 237407. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6841617 - https://exchange.xforce.ibmcloud.com/vulnerabilities/237407
CVE ID: CVE-2022-41733 State: PUBLISHED Published: 2023-01-20T18:34:59.335Z Last Updated: 2025-04-01T18:51:22.223Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: IBM Products: InfoSphere Information Server Problem Types: CWE-20 Description: IBM InfoSphere Information Server 11.7 could allow a remote attacked to cause some of the components to be unusable until the process is restarted. IBM X-Force ID: 237583. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6840399 - https://exchange.xforce.ibmcloud.com/vulnerabilities/237583
CVE ID: CVE-2022-41734 State: PUBLISHED Published: 2023-02-17T17:38:24.048Z Last Updated: 2025-03-12T20:01:37.858Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: IBM Products: Maximo Asset Management Problem Types: CWE-200 Description: IBM Maximo Asset Management 7.6.1.2 and 7.6.1.3 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 237587. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6857605 - https://exchange.x
am Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6857605 - https://exchange.xforce.ibmcloud.com/vulnerabilities/237587
CVE ID: CVE-2022-41735 State: PUBLISHED Published: 2022-12-07T16:40:29.374Z Last Updated: 2025-04-22T19:54:47.022Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: IBM Products: Business Process Manager Problem Types: CWE-79 Description: IBM Business Process Manager 21.0.1 through 21.0.3.1, 20.0.0.1 through 20.0.0.2 19.0.0.1 through 19.0.0.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 65687. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnr
ure within a trusted session. IBM X-Force ID: 65687. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6845496 - https://exchange.xforce.ibmcloud.com/vulnerabilities/237809
CVE ID: CVE-2022-41736 State: PUBLISHED Published: 2023-04-29T02:02:26.366Z Last Updated: 2025-01-30T17:09:24.894Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: IBM Products: Spectrum Scale Container Native Storage Access Problem Types: 264 Permissions, Privileges, Access Controls Description: IBM Spectrum Scale Container Native Storage Access 5.1.2.1 through 5.1.6.0 contains an unspecified vulnerability that could allow a local user to obtain root privileges. IBM X-Force ID: 237810. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6964564 - https://exchange.xforce.ibmcloud.com/v
ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6964564 - https://exchange.xforce.ibmcloud.com/vulnerabilities/237810
CVE ID: CVE-2022-41737 State: PUBLISHED Published: 2024-02-17T16:25:25.240Z Last Updated: 2024-08-03T12:49:43.776Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N) Vendors: IBM Products: Storage Scale Container Native Storage Access Problem Types: CWE-287 Description: IBM Storage Scale Container Native Storage Access 5.1.2.1 through 5.1.7.0 could allow a local attacker to initiate connections from a container outside the current namespace. IBM X-Force ID: 237811. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7095312 - https://exchange.xforce.ibmcloud.com/vulnerabilities/237811
CVE ID: CVE-2022-41738 State: PUBLISHED Published: 2024-02-17T16:17:20.712Z Last Updated: 2024-08-29T20:11:03.403Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: IBM Products: Storage Scale Container Native Storage Access Problem Types: CWE-287 Description: IBM Storage Scale Container Native Storage Access 5.1.2.1 -through 5.1.7.0 could allow an attacker to initiate connections to containers from external networks. IBM X-Force ID: 237812. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7095312 - https://exchange.xforce.ibmcloud.com/vulnerabilities/237812
CVE ID: CVE-2022-41739 State: PUBLISHED Published: 2023-04-26T02:09:03.525Z Last Updated: 2025-01-31T16:14:25.449Z Severity: HIGH (CVSS 7.9 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N) Vendors: IBM Products: Spectrum Scale Container Native Storage Access Problem Types: 264 Permissions, Privileges, Access Controls Description: IBM Spectrum Scale (IBM Spectrum Scale Container Native Storage Access 5.1.2.1 through 5.1.6.0) could allow programs running inside the container to overcome isolation mechanism and gain additional capabilities or access sensitive information on the host. IBM X-Force ID: 237815. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - h
ost. IBM X-Force ID: 237815. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6964568 - https://exchange.xforce.ibmcloud.com/vulnerabilities/237815
CVE ID: CVE-2022-41740 State: PUBLISHED Published: 2023-01-05T17:30:38.568Z Last Updated: 2025-04-10T14:08:49.063Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: Robotic Process Automation Problem Types: 316 Cleartext Storage of Sensitive Information in Memory Description: IBM Robotic Process Automation 20.12 through 21.0.6 could allow an attacker with physical access to the system to obtain highly sensitive information from system memory. IBM X-Force ID: 238053. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6852657 - https://exchange.xforce.ibmcloud.com/vulnera
ulnrichment: References: - https://www.ibm.com/support/pages/node/6852657 - https://exchange.xforce.ibmcloud.com/vulnerabilities/238053
CVE ID: CVE-2022-41741 State: PUBLISHED Published: 2022-10-19T21:20:24.882Z Last Updated: 2025-05-08T18:12:10.565Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: F5 Products: NGINX, NGINX Plus, NGINX Open Source Subscription Problem Types: CWE-787 Description: NGINX Open Source before versions 1.23.2 and 1.22.1, NGINX Open Source Subscription before versions R2 P1 and R1 P1, and NGINX Plus before versions R27 P1 and R26 P1 have a vulnerability in the module ngx_http_mp4_module that might allow a local attacker to corrupt NGINX worker memory, resulting in its termination or potential other impact using a specially crafted audio or video file. The issue affects o
esulting in its termination or potential other impact using a specially crafted audio or video file. The issue affects only NGINX products that are built with the ngx_http_mp4_module, when the mp4 directive is used in the configuration file. Further, the attack is possible only if an attacker can trigger processing of a specially crafted audio or video file with the module ngx_http_mp4_module. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.f5.com/csp/article/K81926432 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BPRVYA4FS34VWB4FEFYNAD7Z2LFCJVEI/ - https://lists.fedoraproject.org/a
package-announce%40lists.fedoraproject.org/message/BPRVYA4FS34VWB4FEFYNAD7Z2LFCJVEI/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FD6M3PVVKO35WLAA7GLDBS6TEQ26SM64/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WBORRVG7VVXYOAIAD64ZHES2U2VIUKFQ/ - https://www.debian.org/security/2022/dsa-5281 - https://lists.debian.org/debian-lts-announce/2022/11/msg00031.html - https://security.netapp.com/advisory/ntap-20230120-0005/
CVE ID: CVE-2022-41742 State: PUBLISHED Published: 2022-10-19T21:20:50.106Z Last Updated: 2025-05-08T18:11:30.671Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H) Vendors: F5 Products: NGINX, NGINX Plus, NGINX Open Source Subscription Problem Types: CWE-787 Description: NGINX Open Source before versions 1.23.2 and 1.22.1, NGINX Open Source Subscription before versions R2 P1 and R1 P1, and NGINX Plus before versions R27 P1 and R26 P1 have a vulnerability in the module ngx_http_mp4_module that might allow a local attacker to cause a worker process crash, or might result in worker process memory disclosure by using a specially crafted audio or video file. The issue affect
, or might result in worker process memory disclosure by using a specially crafted audio or video file. The issue affects only NGINX products that are built with the module ngx_http_mp4_module, when the mp4 directive is used in the configuration file. Further, the attack is possible only if an attacker can trigger processing of a specially crafted audio or video file with the module ngx_http_mp4_module. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.f5.com/csp/article/K28112382 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BPRVYA4FS34VWB4FEFYNAD7Z2LFCJVEI/ - https://lists.fedorapro
ives/list/package-announce%40lists.fedoraproject.org/message/BPRVYA4FS34VWB4FEFYNAD7Z2LFCJVEI/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FD6M3PVVKO35WLAA7GLDBS6TEQ26SM64/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WBORRVG7VVXYOAIAD64ZHES2U2VIUKFQ/ - https://www.debian.org/security/2022/dsa-5281 - https://lists.debian.org/debian-lts-announce/2022/11/msg00031.html - https://security.netapp.com/advisory/ntap-20230120-0005/
CVE ID: CVE-2022-41743 State: PUBLISHED Published: 2022-10-19T21:21:29.045Z Last Updated: 2025-05-08T18:09:41.879Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: F5 Products: NGINX Plus Problem Types: CWE-787 Description: NGINX Plus before versions R27 P1 and R26 P1 have a vulnerability in the module ngx_http_hls_module that might allow a local attacker to corrupt NGINX worker memory, resulting in its crash or potential other impact using a specially crafted audio or video file. The issue affects only NGINX Plus when the hls directive is used in the configuration file. Further, the attack is possible only if an attacker can trigger processing of a specially cra
in the configuration file. Further, the attack is possible only if an attacker can trigger processing of a specially crafted audio or video file with the module ngx_http_hls_module. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.f5.com/csp/article/K01112063
CVE ID: CVE-2022-41744 State: PUBLISHED Published: 2022-10-10T00:00:00 Last Updated: 2024-08-03T12:49:43.722Z Vendors: Trend Micro Products: Trend Micro Apex One Problem Types: Time-of-Check Time-of-Use LPE Description: A Time-of-Check Time-Of-Use vulnerability in the Trend Micro Apex One Vulnerability Protection integrated component could allow a local attacker to escalate privileges and turn a specific working directory into a mount point on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://success.
n order to exploit this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://success.trendmicro.com/solution/000291645 - https://www.zerodayinitiative.com/advisories/ZDI-22-1404/
CVE ID: CVE-2022-41745 State: PUBLISHED Published: 2022-10-10T00:00:00 Last Updated: 2024-08-03T12:49:43.818Z Vendors: Trend Micro Products: Trend Micro Apex One Problem Types: OOB Access Description: An Out-of-Bounds access vulnerability in Trend Micro Apex One could allow a local attacker to create a specially crafted message to cause memory corruption on a certain service process which could lead to local privilege escalation on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://success.trendmicro.c
xploit this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://success.trendmicro.com/solution/000291645 - https://www.zerodayinitiative.com/advisories/ZDI-22-1401/
CVE ID: CVE-2022-41746 State: PUBLISHED Published: 2022-10-10T00:00:00 Last Updated: 2024-08-03T12:49:43.755Z Vendors: Trend Micro Products: Trend Micro Apex One Problem Types: Forced Browsing LPE Description: A forced browsing vulnerability in Trend Micro Apex One could allow an attacker with access to the Apex One console on affected installations to escalate privileges and modify certain agent groupings. Please note: an attacker must first obtain the ability to log onto the Apex One web console in order to exploit this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://success.trendmicro.com/solution/000291645 - https://www.zerodayinitiative.com/adviso
am Container: References: - https://success.trendmicro.com/solution/000291645 - https://www.zerodayinitiative.com/advisories/ZDI-22-1403/
CVE ID: CVE-2022-41747 State: PUBLISHED Published: 2022-10-10T00:00:00 Last Updated: 2024-08-03T12:49:43.590Z Vendors: Trend Micro Products: Trend Micro Apex One Problem Types: Improper Certification Validation Description: An improper certification validation vulnerability in Trend Micro Apex One agents could allow a local attacker to load a DLL file with system service privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://success.trendmicro.com/solution/000291645 - https://www.zerodayiniti
tes: - CVE Program Container: References: - https://success.trendmicro.com/solution/000291645 - https://www.zerodayinitiative.com/advisories/ZDI-22-1402/
CVE ID: CVE-2022-41748 State: PUBLISHED Published: 2022-10-10T00:00:00 Last Updated: 2024-08-03T12:49:44.167Z Vendors: Trend Micro Products: Trend Micro Apex One Problem Types: Registry Permissions Description: A registry permissions vulnerability in the Trend Micro Apex One Data Loss Prevention (DLP) module could allow a local attacker with administrative credentials to bypass certain elements of the product's anti-tampering mechanisms on affected installations. Please note: an attacker must first obtain administrative credentials on the target system in order to exploit this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://success.trendmicro.com/solut
his vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://success.trendmicro.com/solution/000291645
CVE ID: CVE-2022-41749 State: PUBLISHED Published: 2022-10-10T00:00:00 Last Updated: 2024-08-03T12:49:43.934Z Vendors: Trend Micro Products: Trend Micro Apex One Problem Types: Origin Validation Error Description: An origin validation error vulnerability in Trend Micro Apex One agents could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://success.trendmicro.com/solution/000291645 - https://www.zerodayinitiative.com/advisories/ZDI-22-1400/
CVE ID: CVE-2022-41751 State: PUBLISHED Published: 2022-10-17T00:00:00.000Z Last Updated: 2025-05-13T15:27:49.974Z Vendors: n/a Products: n/a Problem Types: n/a Description: Jhead 3.06.0.1 allows attackers to execute arbitrary OS commands by placing them in a JPEG filename and then using the regeneration -rgt50 option. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Matthias-Wandel/jhead - https://github.com/Matthias-Wandel/jhead/blob/63ce118c6a59ea64ac357236a11a47aaf569d622/jhead.c#L788 - https://github.com/Matthias-Wandel/jhead/pull/57 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/mess
ias-Wandel/jhead/pull/57 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EG26AD7KJAY5B6L6OERSGL4FRXJE3GOB/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TAVB3ZX7E5ULEXESU5NXZIAHY6CVGCHB/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5NM6FET4ZNWV4EQGKZTLZFWTNVODGVOK/ - https://lists.debian.org/debian-lts-announce/2022/12/msg00004.html - https://www.debian.org/security/2022/dsa-5294
CVE ID: CVE-2022-41757 State: PUBLISHED Published: 2022-11-08T00:00:00.000Z Last Updated: 2025-05-01T18:50:06.937Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Arm Mali GPU Kernel Driver. A non-privileged user can make improper GPU processing operations to obtain write access to read-only memory, or obtain access to already freed memory. This affects Valhall r29p0 through r38p1 before r38p2, and r39p0 before r40p0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities
CVE ID: CVE-2022-41760 State: PUBLISHED Published: 2023-12-25T00:00:00 Last Updated: 2024-08-03T12:49:44.007Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in NOKIA NFM-T R19.9. Relative Path Traversal can occur under /oms1350/data/cpb/log of the Network Element Manager via the filename parameter, allowing a remote authenticated attacker to read arbitrary files. Additional Analyst Notes: - CVE Program Container: References: - https://www.gruppotim.it/it/footer/red-team.html
CVE ID: CVE-2022-41761 State: PUBLISHED Published: 2023-12-25T00:00:00 Last Updated: 2024-08-03T12:49:44.036Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in NOKIA NFM-T R19.9. An Absolute Path Traversal vulnerability exists under /cgi-bin/R19.9/viewlog.pl of the VM Manager WebUI via the logfile parameter, allowing a remote authenticated attacker to read arbitrary files. Additional Analyst Notes: - CVE Program Container: References: - https://www.gruppotim.it/it/footer/red-team.html
CVE ID: CVE-2022-41762 State: PUBLISHED Published: 2023-12-25T00:00:00 Last Updated: 2024-08-03T12:49:43.563Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in NOKIA NFM-T R19.9. Multiple Reflected XSS vulnerabilities exist in the Network Element Manager via any parameter to log.pl, the bench or pid parameter to top.pl, or the id parameter to easy1350.pl. Additional Analyst Notes: - CVE Program Container: References: - https://www.gruppotim.it/it/footer/red-team.html