Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-22885 State: PUBLISHED Published: 2022-02-16T21:56:16 Last Updated: 2024-08-03T03:28:42.401Z Vendors: n/a Products: n/a Problem Types: n/a Description: Hutool v5.7.18's HttpRequest was discovered to ignore all TLS/SSL certificate validation. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/dromara/hutool/issues/2042 - https://apidoc.gitee.com/dromara/hutool/cn/hutool/http/ssl/DefaultSSLInfo.html
CVE ID: CVE-2022-22888 State: PUBLISHED Published: 2022-01-20T22:16:43 Last Updated: 2024-08-03T03:28:42.520Z Vendors: n/a Products: n/a Problem Types: n/a Description: Jerryscript 3.0.0 was discovered to contain a stack overflow via ecma_op_object_find_own in /ecma/operations/ecma-objects.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jerryscript-project/jerryscript/issues/4848
CVE ID: CVE-2022-22890 State: PUBLISHED Published: 2022-01-20T22:16:46 Last Updated: 2024-08-03T03:28:42.442Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is an Assertion 'arguments_type != SCANNER_ARGUMENTS_PRESENT && arguments_type != SCANNER_ARGUMENTS_PRESENT_NO_REG' failed at /jerry-core/parser/js/js-scanner-util.c in Jerryscript 3.0.0. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jerryscript-project/jerryscript/issues/4847
CVE ID: CVE-2022-22891 State: PUBLISHED Published: 2022-01-20T23:04:22 Last Updated: 2024-08-03T03:28:42.411Z Vendors: n/a Products: n/a Problem Types: n/a Description: Jerryscript 3.0.0 was discovered to contain a SEGV vulnerability via ecma_ref_object_inline in /jerry-core/ecma/base/ecma-gc.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jerryscript-project/jerryscript/issues/4871
CVE ID: CVE-2022-22892 State: PUBLISHED Published: 2022-01-20T23:04:22 Last Updated: 2024-08-03T03:28:42.392Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is an Assertion 'ecma_is_value_undefined (value) || ecma_is_value_null (value) || ecma_is_value_boolean (value) || ecma_is_value_number (value) || ecma_is_value_string (value) || ecma_is_value_bigint (value) || ecma_is_value_symbol (value) || ecma_is_value_object (value)' failed at jerry-core/ecma/base/ecma-helpers-value.c in Jerryscripts 3.0.0. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jerryscript-project/jerryscript/issues/4872
CVE ID: CVE-2022-22893 State: PUBLISHED Published: 2022-01-20T23:04:23 Last Updated: 2024-08-03T03:28:42.396Z Vendors: n/a Products: n/a Problem Types: n/a Description: Jerryscript 3.0.0 was discovered to contain a stack overflow via vm_loop.lto_priv.304 in /jerry-core/vm/vm.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jerryscript-project/jerryscript/issues/4901
CVE ID: CVE-2022-22894 State: PUBLISHED Published: 2022-01-20T23:04:24 Last Updated: 2024-08-03T03:28:42.568Z Vendors: n/a Products: n/a Problem Types: n/a Description: Jerryscript 3.0.0 was discovered to contain a stack overflow via ecma_lcache_lookup in /jerry-core/ecma/base/ecma-lcache.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jerryscript-project/jerryscript/issues/4890
CVE ID: CVE-2022-22895 State: PUBLISHED Published: 2022-01-20T23:04:25 Last Updated: 2024-08-03T03:28:42.573Z Vendors: n/a Products: n/a Problem Types: n/a Description: Jerryscript 3.0.0 was discovered to contain a heap-buffer-overflow via ecma_utf8_string_to_number_by_radix in /jerry-core/ecma/base/ecma-helpers-conversion.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jerryscript-project/jerryscript/issues/4882 - https://github.com/jerryscript-project/jerryscript/issues/4850
CVE ID: CVE-2022-22897 State: PUBLISHED Published: 2022-08-29T00:00:00 Last Updated: 2024-08-03T03:28:42.322Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection vulnerability in the product_all_one_img and image_product parameters of the ApolloTheme AP PageBuilder component through 2.4.4 for PrestaShop allows unauthenticated attackers to exfiltrate database data. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/168148/PrestaShop-Ap-Pagebuilder-2.4.4-SQL-Injection.html - https://friends-of-presta.github.io/security-advisories/modules/2023/01/05/appagebuilder.html
CVE ID: CVE-2022-22899 State: PUBLISHED Published: 2022-02-17T12:51:23 Last Updated: 2024-08-03T03:28:42.395Z Vendors: n/a Products: n/a Problem Types: n/a Description: Core FTP / SFTP Server v2 Build 725 was discovered to allow unauthenticated attackers to cause a Denial of Service (DoS) via a crafted packet through the SSH service. Additional Analyst Notes: - CVE Program Container: References: - http://coreftp.com/forums/viewtopic.php?f=15&t=4022509 - https://yoursecuritybores.me/coreftp-vulnerabilities/ - http://coreftp.com
CVE ID: CVE-2022-22901 State: PUBLISHED Published: 2022-02-17T02:40:13 Last Updated: 2024-08-03T03:28:42.362Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is an Assertion in 'context_p->next_scanner_info_p->type == SCANNER_TYPE_FUNCTION' failed at parser_parse_function_arguments in /js/js-parser.c of JerryScript commit a6ab5e9. Additional Analyst Notes: - CVE Program Container: References: - http://jerryscript.com - https://github.com/jerryscript-project/jerryscript - https://github.com/jerryscript-project/jerryscript/issues/4916
CVE ID: CVE-2022-22908 State: PUBLISHED Published: 2022-02-26T21:24:43 Last Updated: 2024-08-03T03:28:42.346Z Vendors: n/a Products: n/a Problem Types: n/a Description: SangforCSClient.exe in Sangfor VDI Client 5.4.2.1006 allows attackers, when they are able to read process memory, to discover the contents of the Username and Password fields. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/NF-Security-Team/CVEs/tree/main/CVE-2022-22908
CVE ID: CVE-2022-22909 State: PUBLISHED Published: 2022-03-02T23:49:47 Last Updated: 2024-08-03T03:28:42.355Z Vendors: n/a Products: n/a Problem Types: n/a Description: HotelDruid v3.0.3 was discovered to contain a remote code execution (RCE) vulnerability which is exploited via an attacker inserting a crafted payload into the name field under the Create New Room module. Additional Analyst Notes: - CVE Program Container: References: - https://www.hoteldruid.com - https://github.com/0z09e/CVE-2022-22909
CVE ID: CVE-2022-22912 State: PUBLISHED Published: 2022-02-17T18:50:43 Last Updated: 2024-08-03T03:28:42.584Z Vendors: n/a Products: n/a Problem Types: n/a Description: Prototype pollution vulnerability via .parse() in Plist before v3.0.4 allows attackers to cause a Denial of Service (DoS) and may lead to remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/TooTallNate/plist.js/issues/114
CVE ID: CVE-2022-22914 State: PUBLISHED Published: 2022-02-17T20:50:36 Last Updated: 2024-08-03T03:28:42.459Z Vendors: n/a Products: n/a Problem Types: n/a Description: An incorrect access control issue in the component FileManager of Ovidentia CMS 6.0 allows authenticated attackers to to view and download content in the upload directory via path traversal. Additional Analyst Notes: - CVE Program Container: References: - http://ovidentia.com - https://gitlab.com/albadotpy/ovidentia-information-disclosure-on-upload-directory-content
CVE ID: CVE-2022-22916 State: PUBLISHED Published: 2022-02-17T21:08:22 Last Updated: 2024-08-03T03:28:42.389Z Vendors: n/a Products: n/a Problem Types: n/a Description: O2OA v6.4.7 was discovered to contain a remote code execution (RCE) vulnerability via /x_program_center/jaxrs/invoke. Additional Analyst Notes: - CVE Program Container: References: - http://o2oa.com - https://github.com/wendell1224/O2OA-POC/blob/main/POC.md
CVE ID: CVE-2022-22919 State: PUBLISHED Published: 2022-01-30T01:13:30 Last Updated: 2024-08-03T03:28:42.484Z Vendors: n/a Products: n/a Problem Types: n/a Description: Adenza AxiomSL ControllerView through 10.8.1 allows redirection for SSO login URLs. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jdordonezn/CVE-2022-22919/issues/1
CVE ID: CVE-2022-22922 State: PUBLISHED Published: 2022-02-18T00:55:17 Last Updated: 2024-08-03T03:28:42.444Z Vendors: n/a Products: n/a Problem Types: n/a Description: TP-Link TL-WA850RE Wi-Fi Range Extender before v6_200923 was discovered to use highly predictable and easily detectable session keys, allowing attackers to gain administrative privileges. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/emremulazimoglu/cve/blob/main/CWE330-TL-WA850RE-v6.md - https://www.tp-link.com/us/support/download/tl-wa850re/v6/#Firmware
CVE ID: CVE-2022-22928 State: PUBLISHED Published: 2022-01-20T23:40:34 Last Updated: 2024-08-03T03:28:42.435Z Vendors: n/a Products: n/a Problem Types: n/a Description: MCMS v5.2.4 was discovered to have a hardcoded shiro-key, allowing attackers to exploit the key and execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://gitee.com/mingSoft/MCMS/issues/I4Q4RP
CVE ID: CVE-2022-22929 State: PUBLISHED Published: 2022-01-20T23:40:35 Last Updated: 2024-08-03T03:28:42.383Z Vendors: n/a Products: n/a Problem Types: n/a Description: MCMS v5.2.4 was discovered to have an arbitrary file upload vulnerability in the New Template module, which allows attackers to execute arbitrary code via a crafted ZIP file. Additional Analyst Notes: - CVE Program Container: References: - https://gitee.com/mingSoft/MCMS/issues/I4Q4NV
CVE ID: CVE-2022-22930 State: PUBLISHED Published: 2022-01-20T23:40:47 Last Updated: 2024-08-03T03:28:42.395Z Vendors: n/a Products: n/a Problem Types: n/a Description: A remote code execution (RCE) vulnerability in the Template Management function of MCMS v5.2.4 allows attackers to execute arbitrary code via a crafted payload. Additional Analyst Notes: - CVE Program Container: References: - https://gitee.com/mingSoft/MCMS/issues/I4Q4M6
CVE ID: CVE-2022-22931 State: PUBLISHED Published: 2022-02-07T18:50:10 Last Updated: 2024-08-03T03:28:42.456Z Vendors: Apache Software Foundation Products: Apache James Problem Types: CWE-22 Description: Fix of CVE-2021-40525 do not prepend delimiters upon valid directory validations. Affected implementations include: - maildir mailbox store - Sieve file repository This enables a user to access other users data stores (limited to user names being prefixed by the value of the username being used). Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread/bp8yql4wws56jlh0vxoowj7foothsmpr - https://www.openwall.com/lists/oss-security/2022/02/07/1
CVE ID: CVE-2022-22932 State: PUBLISHED Published: 2022-01-26T11:10:12 Last Updated: 2024-08-03T03:28:42.479Z Vendors: Apache Software Foundation Products: Apache Karaf Problem Types: Path traversal flaws Description: Apache Karaf obr:* commands and run goal on the karaf-maven-plugin have partial path traversal which allows to break out of expected folder. The risk is low as obr:* commands are not very used and the entry is set by user. This has been fixed in revision: https://gitbox.apache.org/repos/asf?p=karaf.git;h=36a2bc4 https://gitbox.apache.org/repos/asf?p=karaf.git;h=52b70cf Mitigation: Apache Karaf users should upgrade to 4.2.15 or 4.3.6 or later as soon as possible, or use correct
h=52b70cf Mitigation: Apache Karaf users should upgrade to 4.2.15 or 4.3.6 or later as soon as possible, or use correct path. JIRA Tickets: https://issues.apache.org/jira/browse/KARAF-7326 Additional Analyst Notes: - CVE Program Container: References: - https://karaf.apache.org/security/cve-2022-22932.txt
CVE ID: CVE-2022-22934 State: PUBLISHED Published: 2022-03-29T00:00:00 Last Updated: 2024-08-03T03:28:42.419Z Vendors: n/a Products: SaltStack Salt Problem Types: Salt Masters do not sign pillar data with the minion’s public key. Description: An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. Salt Masters do not sign pillar data with the minion’s public key, which can result in attackers substituting arbitrary pillar data. Additional Analyst Notes: - CVE Program Container: References: - https://saltproject.io/security_announcements/salt-security-advisory-release/%2C - https://github.com/saltstack/salt/releases%2C - https://repo.saltproject.io/ - https://secu
urity-advisory-release/%2C - https://github.com/saltstack/salt/releases%2C - https://repo.saltproject.io/ - https://security.gentoo.org/glsa/202310-22
CVE ID: CVE-2022-22935 State: PUBLISHED Published: 2022-03-29T00:00:00.000Z Last Updated: 2025-05-05T16:28:44.531Z Vendors: n/a Products: SaltStack Salt Problem Types: Minion authentication denial of service Description: An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. A minion authentication denial of service can cause a MiTM attacker to force a minion process to stop by impersonating a master. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://saltproject.io/security_announcements/salt-security-advisory-release/%2C - https://github.com/saltstack/salt/releases%2C - https://repo.saltproject.io/ - https://secur
rity-advisory-release/%2C - https://github.com/saltstack/salt/releases%2C - https://repo.saltproject.io/ - https://security.gentoo.org/glsa/202310-22
CVE ID: CVE-2022-22936 State: PUBLISHED Published: 2022-03-29T00:00:00.000Z Last Updated: 2025-05-05T16:28:34.495Z Vendors: n/a Products: SaltStack Salt Problem Types: Job publishes and file server replies are susceptible to replay attacks. Description: An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. Job publishes and file server replies are susceptible to replay attacks, which can result in an attacker replaying job publishes causing minions to run old jobs. File server replies can also be re-played. A sufficient craft attacker could gain root access on minion under certain scenarios. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrich
in root access on minion under certain scenarios. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://saltproject.io/security_announcements/salt-security-advisory-release/%2C - https://github.com/saltstack/salt/releases%2C - https://repo.saltproject.io/ - https://security.gentoo.org/glsa/202310-22
CVE ID: CVE-2022-22938 State: PUBLISHED Published: 2022-01-28T19:09:25 Last Updated: 2024-08-03T03:28:42.570Z Vendors: n/a Products: n/a Problem Types: n/a Description: VMware Workstation (16.x prior to 16.2.2) and Horizon Client for Windows (5.x prior to 5.5.3) contains a denial-of-service vulnerability in the Cortado ThinPrint component. The issue exists in TrueType font parser. A malicious actor with access to a virtual machine or remote desktop may exploit this issue to trigger a denial-of-service condition in the Thinprint service running on the host machine where VMware Workstation or Horizon Client for Windows is installed. Additional Analyst Notes: - CVE Program Container: References
re Workstation or Horizon Client for Windows is installed. Additional Analyst Notes: - CVE Program Container: References: - https://www.vmware.com/security/advisories/VMSA-2022-0002.html
CVE ID: CVE-2022-22939 State: PUBLISHED Published: 2022-02-04T22:29:14 Last Updated: 2024-08-03T03:28:42.385Z Vendors: n/a Products: VMware Cloud Foundation Problem Types: VMware Cloud Foundation updates address an information disclosure vulnerability. Description: VMware Cloud Foundation contains an information disclosure vulnerability due to logging of credentials in plain-text within multiple log files on the SDDC Manager. A malicious actor with root access on VMware Cloud Foundation SDDC Manager may be able to view credentials in plaintext within one or more log files. Additional Analyst Notes: - CVE Program Container: References: - https://www.vmware.com/security/advisories/VMSA-2022-00
Additional Analyst Notes: - CVE Program Container: References: - https://www.vmware.com/security/advisories/VMSA-2022-0003.html
CVE ID: CVE-2022-22941 State: PUBLISHED Published: 2022-03-29T00:00:00.000Z Last Updated: 2025-05-05T16:28:25.364Z Vendors: n/a Products: SaltStack Salt Problem Types: Salt Master allows configured users to target any of the minions connected to the syndic with their configured commands Description: An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. When configured as a Master-of-Masters, with a publisher_acl, if a user configured in the publisher_acl targets any minion connected to the Syndic, the Salt Master incorrectly interpreted no valid targets as valid, allowing configured users to target any of the minions connected to the syndic with their configure
id targets as valid, allowing configured users to target any of the minions connected to the syndic with their configured commands. This requires a syndic master combined with publisher_acl configured on the Master-of-Masters, allowing users specified in the publisher_acl to bypass permissions, publishing authorized commands to any configured minion. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://saltproject.io/security_announcements/salt-security-advisory-release/%2C - https://github.com/saltstack/salt/releases%2C - https://repo.saltproject.io/ - https://security.gentoo.org/glsa/202310-22
CVE ID: CVE-2022-22942 State: PUBLISHED Published: 2023-12-13T08:16:34.363Z Last Updated: 2024-08-03T03:28:42.652Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: n/a Products: Photon OS Problem Types: Privilege escalation Description: The vmwgfx driver contains a local privilege escalation vulnerability that allows unprivileged users to gain access to files opened by other processes on the system through a dangling 'file' pointer. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/vmware/photon/wiki/Security-Update-3.0-356 - https://github.com/vmware/photon/wiki/Security-Update-4.0-148 - https://www.openwall.com/lists/oss-secu
Update-3.0-356 - https://github.com/vmware/photon/wiki/Security-Update-4.0-148 - https://www.openwall.com/lists/oss-security/2022/01/27/4
CVE ID: CVE-2022-22943 State: PUBLISHED Published: 2022-03-03T21:59:08 Last Updated: 2024-08-03T03:28:42.476Z Vendors: n/a Products: VMware Tools for Windows Problem Types: Uncontrolled search path vulnerability Description: VMware Tools for Windows (11.x.y and 10.x.y prior to 12.0.0) contains an uncontrolled search path vulnerability. A malicious actor with local administrative privileges in the Windows guest OS, where VMware Tools is installed, may be able to execute code with system privileges in the Windows guest OS due to an uncontrolled search path element. Additional Analyst Notes: - CVE Program Container: References: - https://www.vmware.com/security/advisories/VMSA-2022-0007.html
CVE ID: CVE-2022-22944 State: PUBLISHED Published: 2022-03-02T20:50:17 Last Updated: 2024-08-03T03:28:42.379Z Vendors: n/a Products: VMware Workspace ONE Boxer Problem Types: Stored cross-site scripting (XSS) vulnerability Description: VMware Workspace ONE Boxer contains a stored cross-site scripting (XSS) vulnerability. Due to insufficient sanitization and validation, in VMware Workspace ONE Boxer calendar event descriptions, a malicious actor can inject script tags to execute arbitrary script within a user's window. Additional Analyst Notes: - CVE Program Container: References: - https://www.vmware.com/security/advisories/VMSA-2022-0006.html
CVE ID: CVE-2022-22945 State: PUBLISHED Published: 2022-02-16T16:38:35 Last Updated: 2024-08-03T03:28:42.325Z Vendors: n/a Products: VMware NSX Edge Problem Types: A CLI shell injection vulnerability affecting VMware NSX Edge Description: VMware NSX Edge contains a CLI shell injection vulnerability. A malicious actor with SSH access to an NSX-Edge appliance can execute arbitrary commands on the operating system as root. Additional Analyst Notes: - CVE Program Container: References: - https://www.vmware.com/security/advisories/VMSA-2022-0005.html
CVE ID: CVE-2022-22946 State: PUBLISHED Published: 2022-03-04T15:50:06 Last Updated: 2024-08-03T03:28:42.597Z Vendors: n/a Products: Spring Cloud Gateway Problem Types: OWASP Top Ten 2021 Category A05:2021 - Security Misconfiguration Description: In spring cloud gateway versions prior to 3.1.1+ , applications that are configured to enable HTTP2 and no key store or trusted certificates are set will be configured to use an insecure TrustManager. This makes the gateway able to connect to remote services with invalid or custom certificates. Additional Analyst Notes: - CVE Program Container: References: - https://tanzu.vmware.com/security/cve-2022-22946 - https://www.oracle.com/security-alerts/cp
am Container: References: - https://tanzu.vmware.com/security/cve-2022-22946 - https://www.oracle.com/security-alerts/cpujul2022.html
CVE ID: CVE-2022-22947 State: PUBLISHED Published: 2022-03-03T00:00:00.000Z Last Updated: 2025-10-21T23:15:45.220Z Vendors: n/a Products: Spring Cloud Gateway Problem Types: CWE-94 Description: In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote host. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tanzu.vmware.com/security/cve-2022-22947 - https://www.oracle.com/security-alerts/cpuapr2022.html
References: - https://tanzu.vmware.com/security/cve-2022-22947 - https://www.oracle.com/security-alerts/cpuapr2022.html - http://packetstormsecurity.com/files/166219/Spring-Cloud-Gateway-3.1.0-Remote-Code-Execution.html - https://www.oracle.com/security-alerts/cpujul2022.html - http://packetstormsecurity.com/files/168742/Spring-Cloud-Gateway-3.1.0-Remote-Code-Execution.html
CVE ID: CVE-2022-22948 State: PUBLISHED Published: 2022-03-29T17:24:33.000Z Last Updated: 2025-10-21T23:15:43.268Z Vendors: n/a Products: VMware vCenter Server and VMware Cloud Foundation Problem Types: Information disclosure vulnerability Description: The vCenter Server contains an information disclosure vulnerability due to improper permission of files. A malicious actor with non-administrative access to the vCenter Server may exploit this issue to gain access to sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.vmware.com/security/advisories/VMSA-2022-0009.html
CVE ID: CVE-2022-22950 State: PUBLISHED Published: 2022-04-01T22:17:32 Last Updated: 2024-08-03T03:28:42.433Z Vendors: n/a Products: Spring Framework Problem Types: CWE-770 Description: n Spring Framework versions 5.3.0 - 5.3.16 and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial of service condition. Additional Analyst Notes: - CVE Program Container: References: - https://tanzu.vmware.com/security/cve-2022-22950
CVE ID: CVE-2022-22951 State: PUBLISHED Published: 2022-03-23T19:46:46 Last Updated: 2024-08-03T03:28:42.678Z Vendors: n/a Products: VMware Carbon Black App Control (AppC) Problem Types: OS command injection vulnerability in VMware Carbon Black App Control Description: VMware Carbon Black App Control (8.5.x prior to 8.5.14, 8.6.x prior to 8.6.6, 8.7.x prior to 8.7.4 and 8.8.x prior to 8.8.2) contains an OS command injection vulnerability. An authenticated, high privileged malicious actor with network access to the VMware App Control administration interface may be able to execute commands on the server due to improper input validation leading to remote code execution. Additional Analyst Note
xecute commands on the server due to improper input validation leading to remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.vmware.com/security/advisories/VMSA-2022-0008.html