Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-29048 State: PUBLISHED Published: 2022-04-12T19:50:48 Last Updated: 2024-11-20T15:28:46.877Z Vendors: Jenkins project Products: Jenkins Subversion Plugin Description: A cross-site request forgery (CSRF) vulnerability in Jenkins Subversion Plugin 2.15.3 and earlier allows attackers to connect to an attacker-specified URL. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-2075 - https://support.apple.com/kb/HT213345 - http://seclists.org/fulldisclosure/2022/Jul/18
CVE ID: CVE-2022-29049 State: PUBLISHED Published: 2022-04-12T00:00:00 Last Updated: 2024-08-03T06:10:58.886Z Vendors: Jenkins project Products: Jenkins promoted builds Plugin Description: Jenkins promoted builds Plugin 873.v6149db_d64130 and earlier, except 3.10.1, does not validate the names of promotions defined in Job DSL, allowing attackers with Job/Configure permission to create a promotion with an unsafe name. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-2655
CVE ID: CVE-2022-29050 State: PUBLISHED Published: 2022-04-12T19:50:51 Last Updated: 2024-08-03T06:10:58.717Z Vendors: Jenkins project Products: Jenkins Publish Over FTP Plugin Description: A cross-site request forgery (CSRF) vulnerability in Jenkins Publish Over FTP Plugin 1.16 and earlier allows attackers to connect to an FTP server using attacker-specified credentials. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-2321
CVE ID: CVE-2022-29051 State: PUBLISHED Published: 2022-04-12T19:50:52 Last Updated: 2024-08-03T06:10:59.203Z Vendors: Jenkins project Products: Jenkins Publish Over FTP Plugin Description: Missing permission checks in Jenkins Publish Over FTP Plugin 1.16 and earlier allow attackers with Overall/Read permission to connect to an FTP server using attacker-specified credentials. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-2321
CVE ID: CVE-2022-29052 State: PUBLISHED Published: 2022-04-12T19:50:54 Last Updated: 2024-10-15T17:13:31.123Z Vendors: Jenkins project Products: Jenkins Google Compute Engine Plugin Description: Jenkins Google Compute Engine Plugin 4.3.8 and earlier stores private keys unencrypted in cloud agent config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-2045
CVE ID: CVE-2022-29053 State: PUBLISHED Published: 2022-09-06T15:10:19 Last Updated: 2024-10-22T20:54:37.001Z Severity: LOW (CVSS 2.3 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N/E:U/RL:U/RC:C) Vendors: Fortinet Products: Fortinet FortiOS Problem Types: Information disclosure Description: A missing cryptographic steps vulnerability [CWE-325] in the functions that encrypt the keytab files in FortiOS version 7.2.0, 7.0.0 through 7.0.5 and below 7.0.0 may allow an attacker in possession of the encrypted file to decipher it. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-22-158
CVE ID: CVE-2022-29054 State: PUBLISHED Published: 2023-02-16T18:07:34.488Z Last Updated: 2024-10-22T20:49:05.910Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:U/RL:U/RC:X) Vendors: Fortinet Products: FortiOS, FortiProxy Problem Types: CWE-329 Description: A missing cryptographic steps vulnerability [CWE-325] in the functions that encrypt the DHCP and DNS keys in Fortinet FortiOS version 7.2.0, 7.0.0 through 7.0.5, 6.4.0 through 6.4.9, 6.2.x and 6.0.x may allow an attacker in possession of the encrypted key to decipher it. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-22-080
CVE ID: CVE-2022-29055 State: PUBLISHED Published: 2022-10-10T00:00:00 Last Updated: 2024-10-25T13:29:37.823Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:F/RL:U/RC:C) Vendors: Fortinet Products: Fortinet FortiOS, FortiProxy Problem Types: Denial of service Description: A access of uninitialized pointer in Fortinet FortiOS version 7.2.0, 7.0.0 through 7.0.5, 6.4.0 through 6.4.8, 6.2.0 through 6.2.10, 6.0.x, FortiProxy version 7.0.0 through 7.0.4, 2.0.0 through 2.0.9, 1.2.x allows a remote unauthenticated or authenticated attacker to crash the sslvpn daemon via an HTTP GET request. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Reference
pn daemon via an HTTP GET request. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-22-086
CVE ID: CVE-2022-29056 State: PUBLISHED Published: 2023-03-09T14:54:52.009Z Last Updated: 2024-10-22T20:48:02.279Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:X) Vendors: Fortinet Products: FortiMail Problem Types: CWE-307 Description: A improper restriction of excessive authentication attempts vulnerability [CWE-307] in Fortinet FortiMail version 6.4.0, version 6.2.0 through 6.2.4 and before 6.0.9 allows a remote unauthenticated attacker to partially exhaust CPU and memory via sending numerous HTTP requests to the login form. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-20-07
Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-20-078
CVE ID: CVE-2022-29057 State: PUBLISHED Published: 2022-07-18T16:41:12 Last Updated: 2024-10-22T20:55:20.971Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:P/RL:U/RC:C) Vendors: Fortinet Products: Fortinet FortiEDR Problem Types: Execute unauthorized code or commands Description: A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiEDR version 5.1.0, 5.0.0 through 5.0.3 Patch 6 and 4.0.0 allows a remote authenticated attacker to perform a reflected cross site scripting attack (XSS) by injecting malicious payload into the Management Console via various endpoints. Additional Analyst Notes: - CVE Program Container: -
alicious payload into the Management Console via various endpoints. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-22-077
CVE ID: CVE-2022-29058 State: PUBLISHED Published: 2022-09-06T15:10:15 Last Updated: 2024-10-25T13:30:21.436Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:U/RC:C) Vendors: Fortinet Products: Fortinet FortiAP, FortiAP-S, FortiAP-W2, FortiAP-U Problem Types: Execute unauthorized code or commands Description: An improper neutralization of special elements [CWE-89] used in an OS command vulnerability [CWE-78] in the command line interpreter of FortiAP 6.0.0 through 6.4.7, 7.0.0 through 7.0.3, 7.2.0, FortiAP-S 6.0.0 through 6.4.7, FortiAP-W2 6.0.0 through 6.4.7, 7.0.0 through 7.0.3, 7.2.0 and FortiAP-U 5.4.0 through 6.2.3 may allow an authenticated attacker to exec
through 6.4.7, 7.0.0 through 7.0.3, 7.2.0 and FortiAP-U 5.4.0 through 6.2.3 may allow an authenticated attacker to execute unauthorized commands via specifically crafted arguments to existing commands. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-21-163
CVE ID: CVE-2022-29059 State: PUBLISHED Published: 2025-03-14T15:45:33.731Z Last Updated: 2025-03-14T17:52:08.746Z Severity: LOW (CVSS 2.6 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N/E:P/RL:U/RC:C) Vendors: Fortinet Products: FortiWeb Problem Types: CWE-89 Description: An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] in FortiWeb version 7.0.1 and below, 6.4.2 and below, 6.3.20 and below, 6.2.7 and below may allow a privileged attacker to execute SQL commands over the log database via specifically crafted strings parameters. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-22-140
CVE ID: CVE-2022-29060 State: PUBLISHED Published: 2022-07-18T16:35:37 Last Updated: 2024-10-25T13:31:23.884Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:X/RL:U/RC:R) Vendors: Fortinet Products: Fortinet FortiDDoS Problem Types: Improper access control Description: A use of hard-coded cryptographic key vulnerability [CWE-321] in FortiDDoS API 5.5.0 through 5.5.1, 5.4.0 through 5.4.2, 5.3.0 through 5.3.1, 5.2.0, 5.1.0 may allow an attacker who managed to retrieve the key from one device to sign JWT tokens for any device. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-22-071
CVE ID: CVE-2022-29061 State: PUBLISHED Published: 2022-09-09T06:55:08 Last Updated: 2024-10-25T13:29:59.848Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C) Vendors: Fortinet Products: Fortinet FortiSOAR Problem Types: Execute unauthorized code or commands Description: An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in Fortinet FortiSOAR before 7.2.1 allows an authenticated attacker to execute unauthorized code or commands via crafted HTTP GET requests. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-22-156
CVE ID: CVE-2022-29062 State: PUBLISHED Published: 2022-09-06T15:10:24 Last Updated: 2024-10-22T20:54:27.903Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:F/RL:X/RC:C) Vendors: Fortinet Products: Fortinet FortiSOAR Problem Types: Improper access control Description: Multiple relative path traversal vulnerabilities [CWE-23] in Fortinet FortiSOAR before 7.2.1 allows an authenticated attacker to write to the underlying filesystem with nginx permissions via crafted HTTP requests. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-22-154
CVE ID: CVE-2022-29063 State: PUBLISHED Published: 2022-09-02T07:10:19 Last Updated: 2024-08-03T06:10:59.274Z Vendors: Apache Software Foundation Products: Apache OFBiz Problem Types: CWE-502 Description: The Solr plugin of Apache OFBiz is configured by default to automatically make a RMI request on localhost, port 1099. In version 18.12.05 and earlier, by hosting a malicious RMI server on localhost, an attacker may exploit this behavior, at server start-up or on a server restart, in order to run arbitrary code. Upgrade to at least 18.12.06 or apply patches at https://issues.apache.org/jira/browse/OFBIZ-12646. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apa
s.apache.org/jira/browse/OFBIZ-12646. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread/ytzrjc16pf357zntwk8tjby13kbx9105 - http://www.openwall.com/lists/oss-security/2022/09/02/6
CVE ID: CVE-2022-29071 State: PUBLISHED Published: 2022-08-05T16:47:17.137211Z Last Updated: 2024-09-16T16:27:53.198Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Arista Networks Products: CloudVision Portal Problem Types: CWE-200 Description: This advisory documents an internally found vulnerability in the on premises deployment model of Arista CloudVision Portal (CVP) where under a certain set of conditions, user passwords can be leaked in the Audit and System logs. The impact of this vulnerability is that the CVP user login passwords might be leaked to other authenticated users. Additional Analyst Notes: - CVE Program Container: References: - https://www
ght be leaked to other authenticated users. Additional Analyst Notes: - CVE Program Container: References: - https://www.arista.com/en/support/advisories-notices/security-advisory/15865-security-advisory-0079
CVE ID: CVE-2022-29072 State: PUBLISHED Published: 2022-04-15T19:54:15.000Z Last Updated: 2025-06-09T14:47:09.625Z Vendors: n/a Products: n/a Problem Types: n/a Description: 7-Zip through 21.07 on Windows allows privilege escalation and command execution when a file with the .7z extension is dragged to the Help>Contents area. This is caused by misconfiguration of 7z.dll and a heap overflow. The command runs in a child process under the 7zFM.exe process. NOTE: multiple third parties have reported that no privilege escalation can occur Additional Analyst Notes: - CISA ADP Vulnrichment: There is no public evidence of a heap overflow or privilege escalation. CVE-2022-29072 is marked as "disputed
nrichment: There is no public evidence of a heap overflow or privilege escalation. CVE-2022-29072 is marked as "disputed" and should be REJECTED. - CVE Program Container: References: - https://sourceforge.net/p/sevenzip/bugs/2337/ - https://www.youtube.com/watch?v=sT1cvbu7ZTA - https://github.com/kagancapar/CVE-2022-29072 - https://news.ycombinator.com/item?id=31070256 - http://packetstormsecurity.com/files/166763/7-Zip-21.07-Code-Execution-Privilege-Escalation.html
CVE ID: CVE-2022-29077 State: PUBLISHED Published: 2022-04-25T02:59:00 Last Updated: 2024-08-03T06:10:59.076Z Vendors: n/a Products: n/a Problem Types: n/a Description: A heap-based buffer overflow exists in rippled before 1.8.5. The vulnerability allows attackers to cause a crash or execute commands remotely on a rippled node, which may lead to XRPL mainnet DoS or compromise. This exposes all digital assets on the XRPL to a security threat. Additional Analyst Notes: - CVE Program Container: References: - https://ripple.com/ - https://github.com/ripple/rippled/compare/1.8.4...1.8.5 - https://xrpl.org/blog/2022/rippled-1.8.5.html
CVE ID: CVE-2022-29078 State: PUBLISHED Published: 2022-04-25T14:13:32 Last Updated: 2024-08-03T06:10:58.967Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view options][outputFunctionName]. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS command (which is executed upon template compilation). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mde/ejs/releases - https://eslam.io/posts/ejs-server-side-template-injection-rce/ - https://security.netapp.com/advisory/ntap-2022080
ses - https://eslam.io/posts/ejs-server-side-template-injection-rce/ - https://security.netapp.com/advisory/ntap-20220804-0001/
CVE ID: CVE-2022-29080 State: PUBLISHED Published: 2022-04-12T04:45:34 Last Updated: 2024-08-03T06:10:59.380Z Vendors: n/a Products: n/a Problem Types: n/a Description: The npm-dependency-versions package through 0.3.0 for Node.js allows command injection if an attacker is able to call dependencyVersions with a JSON object in which pkgs is a key, and there are shell metacharacters in a value. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/barneycarroll/npm-dependency-versions/issues/6 - https://www.npmjs.com/package/npm-dependency-versions
CVE ID: CVE-2022-29081 State: PUBLISHED Published: 2022-04-28T19:16:57 Last Updated: 2024-08-03T06:10:59.435Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine Access Manager Plus before 4302, Password Manager Pro before 12007, and PAM360 before 5401 are vulnerable to access-control bypass on a few Rest API URLs (for SSOutAction. SSLAction. LicenseMgr. GetProductDetails. GetDashboard. FetchEvents. and Synchronize) via the ../RestAPI substring. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2022-14 - https://www.manageengine.com/privileged-session-management/advisory/cve-2022-29081.html
CVE ID: CVE-2022-29082 State: PUBLISHED Published: 2022-05-26T15:20:26.354614Z Last Updated: 2024-09-16T22:56:57.975Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: Dell Products: NetWorker Problem Types: CWE-297 Description: Dell EMC NetWorker versions 19.1.x, 19.1.0.x, 19.1.1.x, 19.2.x, 19.2.0.x, 19.2.1.x 19.3.x, 19.3.0.x, 19.4.x, 19.4.0.x, 19.5.x,19.5.0.x, 19.6 and 19.6.0.1 and 19.6.0.2 contain an Improper Validation of Certificate with Host Mismatch vulnerability in Rabbitmq port 5671 which could allow remote attackers to spoof certificates. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/000198987
CVE ID: CVE-2022-29083 State: PUBLISHED Published: 2022-08-09T20:15:15.536716Z Last Updated: 2024-09-17T00:01:08.670Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Dell Products: CPG BIOS Problem Types: CWE-287 Description: Prior Dell BIOS versions contain an Improper Authentication vulnerability. An unauthenticated attacker with physical access to the system could potentially exploit this vulnerability by bypassing drive security mechanisms in order to gain access to the system. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/000201396
CVE ID: CVE-2022-29084 State: PUBLISHED Published: 2022-06-02T21:00:29.612791Z Last Updated: 2024-09-17T01:21:14.297Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Dell Products: Unity Problem Types: CWE-307 Description: Dell Unity, Dell UnityVSA, and Dell Unity XT versions before 5.2.0.0.5.173 do not restrict excessive authentication attempts in Unisphere GUI. A remote unauthenticated attacker may potentially exploit this vulnerability to brute-force passwords and gain access to the system as the victim. Account takeover is possible if weak passwords are used by users. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/sup
k passwords are used by users. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/000199050
CVE ID: CVE-2022-29085 State: PUBLISHED Published: 2022-06-02T21:00:31.054830Z Last Updated: 2024-09-17T03:23:38.857Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Dell Products: Unity Problem Types: CWE-256 Description: Dell Unity, Dell UnityVSA, and Dell Unity XT versions prior to 5.2.0.0.5.173 contain a plain-text password storage vulnerability when certain off-array tools are run on the system. The credentials of a user with high privileges are stored in plain text. A local malicious user with high privileges may use the exposed password to gain access with the privileges of the compromised user. Additional Analyst Notes: - CVE Program Container: Refer
ord to gain access with the privileges of the compromised user. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/000199050
CVE ID: CVE-2022-29086 State: REJECTED Published: N/A Last Updated: 2023-05-12T00:00:00 Description: No description available.
CVE ID: CVE-2022-29087 State: REJECTED Published: N/A Last Updated: 2023-05-12T00:00:00 Description: No description available.
CVE ID: CVE-2022-29088 State: REJECTED Published: N/A Last Updated: 2023-05-12T00:00:00 Description: No description available.
CVE ID: CVE-2022-29089 State: PUBLISHED Published: 2022-09-28T20:30:16.847Z Last Updated: 2025-05-20T20:01:34.091Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H) Vendors: Dell Products: Dell Networking OS10 Problem Types: CWE-522 Description: Dell Networking OS10, versions prior to October 2021 with Smart Fabric Services enabled, contains an information disclosure vulnerability. A remote, unauthenticated attacker could potentially exploit this vulnerability by reverse engineering to retrieve sensitive information and access the REST API with admin privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.dell.c
privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000202971/dsa-2022-135-dell-emc-smartfabric-os10-security-update-for-multiple-security-vulnerabilities
CVE ID: CVE-2022-29090 State: PUBLISHED Published: 2022-08-10T16:30:27.158574Z Last Updated: 2024-09-17T02:37:35.608Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N) Vendors: Dell Products: Wyse Management Suite Problem Types: CWE-317 Description: Dell Wyse Management Suite 3.6.1 and below contains a Sensitive Data Exposure vulnerability. A low privileged malicious user could potentially exploit this vulnerability in order to obtain credentials. The attacker may be able to use the exposed credentials to access the target device and perform unauthorized actions. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/en-us/000
d actions. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/en-us/000201383/dsa-2022-134-dell-wyse-management-suite-security-update-for-multiple-vulnerabilities
CVE ID: CVE-2022-29091 State: PUBLISHED Published: 2022-05-26T15:20:27.703351Z Last Updated: 2024-09-16T22:40:13.543Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Dell Products: Unity Problem Types: CWE-79 Description: Dell Unity, Dell UnityVSA, and Dell UnityXT versions prior to 5.2.0.0.5.173 contain a Reflected Cross-Site Scripting Vulnerability in Unisphere GUI. An Unauthenticated Remote Attacker could potentially exploit this vulnerability, leading to the execution of malicious HTML or JavaScript code in a victim user's web browser in the context of the vulnerable web application. Exploitation may lead to information disclosure, session theft, or clie
n the context of the vulnerable web application. Exploitation may lead to information disclosure, session theft, or client-side request forgery. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/000199446
CVE ID: CVE-2022-29092 State: PUBLISHED Published: 2022-06-10T20:05:15.326356Z Last Updated: 2024-09-17T02:06:40.292Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Dell Products: SupportAssist Consumer Problem Types: CWE-427 Description: Dell SupportAssist Client Consumer versions (3.11.0 and versions prior) and Dell SupportAssist Client Commercial versions (3.2.0 and versions prior) contain a privilege escalation vulnerability. A non-admin user can exploit the vulnerability and gain admin access to the system. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/en-us/000200456/dsa-2022-139-dell-supportassist-f
VE Program Container: References: - https://www.dell.com/support/kbdoc/en-us/000200456/dsa-2022-139-dell-supportassist-for-home-pcs-and-business-pcs-security-update-for-multiple-security-vulnerabilities
CVE ID: CVE-2022-29093 State: PUBLISHED Published: 2022-06-10T20:05:16.999373Z Last Updated: 2024-09-17T04:14:51.831Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) Vendors: Dell Products: SupportAssist Client Commercial Problem Types: CWE-22 Description: Dell SupportAssist Client Consumer versions (3.10.4 and versions prior) and Dell SupportAssist Client Commercial versions (3.1.1 and versions prior) contain an arbitrary file deletion vulnerability. Authenticated non-admin user could exploit the issue and delete arbitrary files on the system. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/en-us/000200456/dsa-2022-1
onal Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/en-us/000200456/dsa-2022-139-dell-supportassist-for-home-pcs-and-business-pcs-security-update-for-multiple-security-vulnerabilities