Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-31686 State: PUBLISHED Published: 2022-11-09T00:00:00.000Z Last Updated: 2025-05-01T17:25:16.409Z Vendors: n/a Products: VMware Workspace ONE Assist Problem Types: Broken Authentication Method Description: VMware Workspace ONE Assist prior to 22.10 contains a Broken Authentication Method vulnerability. A malicious actor with network access to Workspace ONE Assist may be able to obtain administrative access without the need to authenticate to the application. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.vmware.com/security/advisories/VMSA-2022-0028.html
CVE ID: CVE-2022-31687 State: PUBLISHED Published: 2022-11-09T00:00:00.000Z Last Updated: 2025-05-01T15:59:11.008Z Vendors: n/a Products: VMware Workspace ONE Assist Problem Types: Broken Access Control Description: VMware Workspace ONE Assist prior to 22.10 contains a Broken Access Control vulnerability. A malicious actor with network access to Workspace ONE Assist may be able to obtain administrative access without the need to authenticate to the application. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.vmware.com/security/advisories/VMSA-2022-0028.html
CVE ID: CVE-2022-31688 State: PUBLISHED Published: 2022-11-09T00:00:00.000Z Last Updated: 2025-05-01T15:58:16.402Z Vendors: n/a Products: VMware Workspace ONE Assist Problem Types: Reflected cross-site scripting (XSS) Description: VMware Workspace ONE Assist prior to 22.10 contains a Reflected cross-site scripting (XSS) vulnerability. Due to improper user input sanitization, a malicious actor with some user interaction may be able to inject javascript code in the target user's window. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.vmware.com/security/advisories/VMSA-2022-0028.html
CVE ID: CVE-2022-31689 State: PUBLISHED Published: 2022-11-09T00:00:00.000Z Last Updated: 2025-05-01T15:54:24.740Z Vendors: n/a Products: VMware Workspace ONE Assist Problem Types: Session fixation Description: VMware Workspace ONE Assist prior to 22.10 contains a Session fixation vulnerability. A malicious actor who obtains a valid session token may be able to authenticate to the application using that token. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.vmware.com/security/advisories/VMSA-2022-0028.html
CVE ID: CVE-2022-31690 State: PUBLISHED Published: 2022-10-31T00:00:00.000Z Last Updated: 2025-05-08T18:47:35.924Z Vendors: n/a Products: Spring Security Problem Types: Privilege Escalation in spring-security-oauth2-client Description: Spring Security, versions 5.7 prior to 5.7.5, and 5.6 prior to 5.6.9, and older unsupported versions could be susceptible to a privilege escalation under certain conditions. A malicious user or attacker can modify a request initiated by the Client (via the browser) to the Authorization Server which can lead to a privilege escalation on the subsequent approval. This scenario can happen if the Authorization Server responds with an OAuth2 Access Token Response co
bsequent approval. This scenario can happen if the Authorization Server responds with an OAuth2 Access Token Response containing an empty scope list (per RFC 6749, Section 5.1) on the subsequent request to the token endpoint to obtain the access token. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tanzu.vmware.com/security/cve-2022-31690 - https://security.netapp.com/advisory/ntap-20221215-0010/
CVE ID: CVE-2022-31691 State: PUBLISHED Published: 2022-11-04T00:00:00.000Z Last Updated: 2025-05-02T19:00:39.593Z Vendors: n/a Products: Spring by VMware Problem Types: Potential Remote Code Execution Description: Spring Tools 4 for Eclipse version 4.16.0 and below as well as VSCode extensions such as Spring Boot Tools, Concourse CI Pipeline Editor, Bosh Editor and Cloudfoundry Manifest YML Support version 1.39.0 and below all use Snakeyaml library for YAML editing support. This library allows for some special syntax in the YAML that under certain circumstances allows for potentially harmful remote code execution by the attacker. Additional Analyst Notes: - CVE Program Container: - CISA ADP
potentially harmful remote code execution by the attacker. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tanzu.vmware.com/security/cve-2022-31691
CVE ID: CVE-2022-31692 State: PUBLISHED Published: 2022-10-31T00:00:00.000Z Last Updated: 2025-05-06T15:53:54.566Z Vendors: n/a Products: Spring by VMware Problem Types: Spring is susceptible to authorization rules bypass via forward or include dispatcher types. Description: Spring Security, versions 5.7 prior to 5.7.5 and 5.6 prior to 5.6.9 could be susceptible to authorization rules bypass via forward or include dispatcher types. Specifically, an application is vulnerable when all of the following are true: The application expects that Spring Security applies security to forward and include dispatcher types. The application uses the AuthorizationFilter either manually or via the authorizeH
forward and include dispatcher types. The application uses the AuthorizationFilter either manually or via the authorizeHttpRequests() method. The application configures the FilterChainProxy to apply to forward and/or include requests (e.g. spring.security.filter.dispatcher-types = request, error, async, forward, include). The application may forward or include the request to a higher privilege-secured endpoint.The application configures Spring Security to apply to every dispatcher type via authorizeHttpRequests().shouldFilterAllDispatcherTypes(true) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tanzu.vmware.com/security/cve-2022-31692 - htt
: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tanzu.vmware.com/security/cve-2022-31692 - https://security.netapp.com/advisory/ntap-20221215-0010/
CVE ID: CVE-2022-31693 State: PUBLISHED Published: 2023-06-07T00:00:00 Last Updated: 2025-01-07T17:07:51.941Z Vendors: n/a Products: n/a Problem Types: n/a Description: VMware Tools for Windows (12.x.y prior to 12.1.5, 11.x.y and 10.x.y) contains a denial-of-service vulnerability in the VM3DMP driver. A malicious actor with local user privileges in the Windows guest OS, where VMware Tools is installed, can trigger a PANIC in the VM3DMP driver leading to a denial-of-service condition in the Windows guest OS. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.vmware.com/security/advisories/VMSA-2022-0029.html - https://security.netapp.com/advi
ichment: References: - https://www.vmware.com/security/advisories/VMSA-2022-0029.html - https://security.netapp.com/advisory/ntap-20221223-0009/ - https://security.netapp.com/advisory/ntap-20230824-0009/
CVE ID: CVE-2022-31694 State: PUBLISHED Published: 2022-11-18T00:00:00.000Z Last Updated: 2025-04-29T14:25:24.579Z Vendors: n/a Products: VMware InstallBuilder Problem Types: Uncontrolled Search Path Element Description: InstallBuilder Qt installers built with versions previous to 22.10 try to load DLLs from the installer binary parent directory when displaying popups. This may allow an attacker to plant a malicious DLL in the installer parent directory to allow executing code with the privileges of the installer (when the popup triggers the loading of the library). Exploiting these type of vulnerabilities generally require that an attacker has access to a vulnerable machine to plant the mal
ing these type of vulnerabilities generally require that an attacker has access to a vulnerable machine to plant the malicious DLL. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://blog.installbuilder.com/2022/11/installbuilder-22100-released.html
CVE ID: CVE-2022-31696 State: PUBLISHED Published: 2022-12-13T00:00:00.000Z Last Updated: 2025-04-22T15:51:48.328Z Vendors: n/a Products: VMware ESXi, VMware Cloud Foundation Problem Types: Memory corruption vulnerability Description: VMware ESXi contains a memory corruption vulnerability that exists in the way it handles a network socket. A malicious actor with local access to ESXi may exploit this issue to corrupt memory leading to an escape of the ESXi sandbox. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.vmware.com/security/advisories/VMSA-2022-0030.html
CVE ID: CVE-2022-31697 State: PUBLISHED Published: 2022-12-13T00:00:00.000Z Last Updated: 2025-04-22T15:50:24.431Z Vendors: n/a Products: VMware vCenter Server, VMware Cloud Foundation Problem Types: Information disclosure vulnerability Description: The vCenter Server contains an information disclosure vulnerability due to the logging of credentials in plaintext. A malicious actor with access to a workstation that invoked a vCenter Server Appliance ISO operation (Install/Upgrade/Migrate/Restore) can access plaintext passwords used during that operation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.vmware.com/security/advisories/VMSA-20
otes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.vmware.com/security/advisories/VMSA-2022-0030.html
CVE ID: CVE-2022-31698 State: PUBLISHED Published: 2022-12-13T00:00:00.000Z Last Updated: 2025-04-22T03:26:59.398Z Vendors: n/a Products: VMware vCenter Server, VMware Cloud Foundation Problem Types: Denial of service vulnerability Description: The vCenter Server contains a denial-of-service vulnerability in the content library service. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to trigger a denial-of-service condition by sending a specially crafted header. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.vmware.com/security/advisories/VMSA-2022-0030.html - https://www.talosintelligence.com/v
ment: References: - https://www.vmware.com/security/advisories/VMSA-2022-0030.html - https://www.talosintelligence.com/vulnerability_reports/TALOS-2022-1588
CVE ID: CVE-2022-31699 State: PUBLISHED Published: 2022-12-13T00:00:00.000Z Last Updated: 2025-04-22T15:47:15.962Z Vendors: n/a Products: VMware ESXi, VMware Cloud Foundation Problem Types: Heap overflow issues via vulnerability Description: VMware ESXi contains a heap-overflow vulnerability. A malicious local actor with restricted privileges within a sandbox process may exploit this issue to achieve a partial information disclosure. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.vmware.com/security/advisories/VMSA-2022-0030.html
CVE ID: CVE-2022-31700 State: PUBLISHED Published: 2022-12-14T00:00:00.000Z Last Updated: 2025-04-22T16:06:25.180Z Vendors: n/a Products: VMware Workspace ONE Access (Access), VMware Identity Manager (vIDM) Problem Types: Authenticated Remote Code Execution Vulnerability Description: VMware Workspace ONE Access and Identity Manager contain an authenticated remote code execution vulnerability. VMware has evaluated the severity of this issue to be in the Important severity range with a maximum CVSSv3 base score of 7.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.vmware.com/security/advisories/VMSA-2022-0032.html
CVE ID: CVE-2022-31701 State: PUBLISHED Published: 2022-12-14T00:00:00.000Z Last Updated: 2025-04-22T16:05:05.601Z Vendors: n/a Products: VMware Workspace ONE Access (Access), VMware Identity Manager (vIDM) Problem Types: Broken Authentication Vulnerability Description: VMware Workspace ONE Access and Identity Manager contain a broken authentication vulnerability. VMware has evaluated the severity of this issue to be in the Moderate severity range with a maximum CVSSv3 base score of 5.3. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.vmware.com/security/advisories/VMSA-2022-0032.html
CVE ID: CVE-2022-31702 State: PUBLISHED Published: 2022-12-14T00:00:00.000Z Last Updated: 2025-04-22T16:03:44.213Z Vendors: n/a Products: VMware vRealize Network Insight (vRNI) Problem Types: VMware vRealize Network Insight (vRNI) contains command injection vulnerability Description: vRealize Network Insight (vRNI) contains a command injection vulnerability present in the vRNI REST API. A malicious actor with network access to the vRNI REST API can execute commands without authentication. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.vmware.com/security/advisories/VMSA-2022-0031.html
CVE ID: CVE-2022-31703 State: PUBLISHED Published: 2022-12-14T00:00:00.000Z Last Updated: 2025-04-22T16:02:51.382Z Vendors: n/a Products: vRealize Log Insight (vRLI) Problem Types: VMware vRealize Log Insight Directory Traversal Vulnerability Description: The vRealize Log Insight contains a Directory Traversal Vulnerability. An unauthenticated, malicious actor can inject files into the operating system of an impacted appliance which can result in remote code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.vmware.com/security/advisories/VMSA-2023-0001.html
CVE ID: CVE-2022-31704 State: PUBLISHED Published: 2023-01-25T00:00:00.000Z Last Updated: 2025-04-02T13:26:58.952Z Vendors: n/a Products: vRealize Log Insight (vRLI) Problem Types: VMware vRealize Log Insight broken access control Vulnerability Description: The vRealize Log Insight contains a broken access control vulnerability. An unauthenticated malicious actor can remotely inject code into sensitive files of an impacted appliance which can result in remote code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.vmware.com/security/advisories/VMSA-2023-0001.html - http://packetstormsecurity.com/files/174606/VMware-vRealize-Log-I
w.vmware.com/security/advisories/VMSA-2023-0001.html - http://packetstormsecurity.com/files/174606/VMware-vRealize-Log-Insight-Unauthenticated-Remote-Code-Execution.html
CVE ID: CVE-2022-31705 State: PUBLISHED Published: 2022-12-14T00:00:00.000Z Last Updated: 2025-04-18T15:03:03.117Z Vendors: n/a Products: VMware ESXi, VMware Workstation Pro / Player, VMware Fusion Pro / Fusion (Fusion), VMware Cloud Foundation Problem Types: Heap out-of-bounds write vulnerability Description: VMware ESXi, Workstation, and Fusion contain a heap out-of-bounds write vulnerability in the USB 2.0 controller (EHCI). A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host. On ESXi, the exploitation is contained within the VMX sandbox whereas, on Workstation and Fusio
ess running on the host. On ESXi, the exploitation is contained within the VMX sandbox whereas, on Workstation and Fusion, this may lead to code execution on the machine where Workstation or Fusion is installed. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.vmware.com/security/advisories/VMSA-2022-0033.html
CVE ID: CVE-2022-31706 State: PUBLISHED Published: 2023-01-25T00:00:00.000Z Last Updated: 2025-04-02T13:25:27.733Z Vendors: n/a Products: vRealize Log Insight (vRLI) Problem Types: VMware vRealize Log Insight Directory Traversal Vulnerability Description: The vRealize Log Insight contains a Directory Traversal Vulnerability. An unauthenticated, malicious actor can inject files into the operating system of an impacted appliance which can result in remote code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.vmware.com/security/advisories/VMSA-2023-0001.html - http://packetstormsecurity.com/files/174606/VMware-vRealize-Log-Insight
re.com/security/advisories/VMSA-2023-0001.html - http://packetstormsecurity.com/files/174606/VMware-vRealize-Log-Insight-Unauthenticated-Remote-Code-Execution.html
CVE ID: CVE-2022-31707 State: PUBLISHED Published: 2022-12-16T00:00:00.000Z Last Updated: 2025-04-18T13:29:00.580Z Vendors: n/a Products: VMware vRealize Operations (vROps) Problem Types: VMware vRealize Operations (vROps) privilege escalation vulnerability Description: vRealize Operations (vROps) contains a privilege escalation vulnerability. VMware has evaluated the severity of this issue to be in the Important severity range with a maximum CVSSv3 base score of 7.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.vmware.com/security/advisories/VMSA-2022-0034.html
CVE ID: CVE-2022-31708 State: PUBLISHED Published: 2022-12-16T00:00:00.000Z Last Updated: 2025-04-18T13:27:34.388Z Vendors: n/a Products: VMware vRealize Operations (vROps) Problem Types: VMware vRealize Operations (vROps) contains an access control vulnerability Description: vRealize Operations (vROps) contains a broken access control vulnerability. VMware has evaluated the severity of this issue to be in the Moderate severity range with a maximum CVSSv3 base score of 4.4. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.vmware.com/security/advisories/VMSA-2022-0034.html
CVE ID: CVE-2022-31710 State: PUBLISHED Published: 2023-01-25T00:00:00.000Z Last Updated: 2025-04-01T15:28:35.065Z Vendors: n/a Products: vRealize Log Insight (vRLI) Problem Types: VMware vRealize Log Insight Deserialization Vulnerability Description: vRealize Log Insight contains a deserialization vulnerability. An unauthenticated malicious actor can remotely trigger the deserialization of untrusted data which could result in a denial of service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.vmware.com/security/advisories/VMSA-2023-0001.html
CVE ID: CVE-2022-31711 State: PUBLISHED Published: 2023-01-25T00:00:00.000Z Last Updated: 2025-04-01T15:27:39.781Z Vendors: n/a Products: vRealize Log Insight (vRLI) Problem Types: VMware vRealize Log Insight Information Disclosure Vulnerability Description: VMware vRealize Log Insight contains an Information Disclosure Vulnerability. A malicious actor can remotely collect sensitive session and application information without authentication. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.vmware.com/security/advisories/VMSA-2023-0001.html - http://packetstormsecurity.com/files/174606/VMware-vRealize-Log-Insight-Unauthenticated-Remote-Code
MSA-2023-0001.html - http://packetstormsecurity.com/files/174606/VMware-vRealize-Log-Insight-Unauthenticated-Remote-Code-Execution.html
CVE ID: CVE-2022-31733 State: PUBLISHED Published: 2023-02-03T00:00:00.000Z Last Updated: 2025-03-25T19:11:41.312Z Vendors: n/a Products: Cloud Foundry Diego and CF Deployment Problem Types: Unsecured application port Description: Starting with diego-release 2.55.0 and up to 2.69.0, and starting with CF Deployment 17.1 and up to 23.2.0, apps are accessible via another port on diego cells, allowing application ingress without a client certificate. If mTLS route integrity is enabled AND unproxied ports are turned off, then an attacker could connect to an application that should be only reachable via mTLS, without presenting a client certificate. Additional Analyst Notes: - CVE Program Containe
ld be only reachable via mTLS, without presenting a client certificate. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cloudfoundry.org/blog/cve-2022-31733-unsecured-application-port
CVE ID: CVE-2022-31734 State: PUBLISHED Published: 2022-06-20T09:50:09 Last Updated: 2024-08-03T07:26:01.103Z Vendors: Cisco Systems, Inc. Products: Cisco Catalyst 2940 Series Switches Problem Types: Cross-site scripting Description: Cisco Catalyst 2940 Series Switches provided by Cisco Systems, Inc. contain a reflected cross-site scripting vulnerability regarding error page generation. An arbitrary script may be executed on the web browser of the user who is using the product. The affected firmware is prior to 12.2(50)SY released in 2011, and Cisco Catalyst 2940 Series Switches have been retired since January 2015 Additional Analyst Notes: - CVE Program Container: References: - https://www.
tches have been retired since January 2015 Additional Analyst Notes: - CVE Program Container: References: - https://www.cisco.com/c/en/us/obsolete/switches/cisco-catalyst-2940-series-switches.html - https://jvn.jp/en/jp/JVN94363766/index.html
CVE ID: CVE-2022-31735 State: PUBLISHED Published: 2022-09-15T04:25:08 Last Updated: 2024-08-03T07:26:01.191Z Vendors: OpenAM consortium Products: OpenAM (OpenAM Consortium Edition) Problem Types: CWE-601 Description: OpenAM Consortium Edition version 14.0.0 provided by OpenAM Consortium contains an open redirect vulnerability (CWE-601). When accessing an affected server through some specially crafted URL, the user may be redirected to an arbitrary website. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/openam-jp/openam/issues/259 - https://jvn.jp/en/vu/JVNVU99326969/
CVE ID: CVE-2022-31736 State: PUBLISHED Published: 2022-12-22T00:00:00.000Z Last Updated: 2025-04-15T14:58:07.022Z Vendors: Mozilla Products: Thunderbird, Firefox, Firefox ESR Problem Types: Cross-Origin resource's length leaked Description: A malicious website could have learned the size of a cross-origin resource that supported Range requests. This vulnerability affects Thunderbird < 91.10, Firefox < 101, and Firefox ESR < 91.10. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2022-20/ - https://www.mozilla.org/security/advisories/mfsa2022-22/ - https://www.mozilla.org/security/advisories/mfsa2022-21/
0/ - https://www.mozilla.org/security/advisories/mfsa2022-22/ - https://www.mozilla.org/security/advisories/mfsa2022-21/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1735923
CVE ID: CVE-2022-31737 State: PUBLISHED Published: 2022-12-22T00:00:00.000Z Last Updated: 2025-04-16T13:56:25.976Z Vendors: Mozilla Products: Thunderbird, Firefox, Firefox ESR Problem Types: Heap buffer overflow in WebGL Description: A malicious webpage could have caused an out-of-bounds write in WebGL, leading to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 91.10, Firefox < 101, and Firefox ESR < 91.10. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2022-20/ - https://www.mozilla.org/security/advisories/mfsa2022-22/ - https://www.mozilla.org/security/
y/advisories/mfsa2022-20/ - https://www.mozilla.org/security/advisories/mfsa2022-22/ - https://www.mozilla.org/security/advisories/mfsa2022-21/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1743767
CVE ID: CVE-2022-31738 State: PUBLISHED Published: 2022-12-22T00:00:00.000Z Last Updated: 2025-04-16T13:54:09.514Z Vendors: Mozilla Products: Thunderbird, Firefox, Firefox ESR Problem Types: Browser window spoof using fullscreen mode Description: When exiting fullscreen mode, an iframe could have confused the browser about the current state of fullscreen, resulting in potential user confusion or spoofing attacks. This vulnerability affects Thunderbird < 91.10, Firefox < 101, and Firefox ESR < 91.10. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2022-20/ - https://www.mozilla.org/security/advisories/mf
References: - https://www.mozilla.org/security/advisories/mfsa2022-20/ - https://www.mozilla.org/security/advisories/mfsa2022-22/ - https://www.mozilla.org/security/advisories/mfsa2022-21/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1756388