Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-29580 State: PUBLISHED Published: 2022-12-13T14:31:41.752Z Last Updated: 2025-04-18T15:49:38.365Z Severity: HIGH (CVSS 8.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L) Vendors: Google Products: Android Google Search App Problem Types: CWE-427 Description: There exists a path traversal vulnerability in the Android Google Search app. This is caused by the incorrect usage of uri.getLastPathSegment. A symbolic encoded string can bypass the path logic to get access to unintended directories. An attacker can manipulate paths that could lead to code execution on the device. We recommend upgrading beyond version 13.41 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vu
the device. We recommend upgrading beyond version 13.41 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.google.com/faqs/answer/7496913?hl=en
CVE ID: CVE-2022-29581 State: PUBLISHED Published: 2022-05-17T16:50:12.000Z Last Updated: 2025-04-21T13:53:27.216Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Linux Products: Kernel Problem Types: CWE-911 Description: Improper Update of Reference Count vulnerability in net/sched of Linux Kernel allows local attacker to cause privilege escalation to root. This issue affects: Linux Kernel versions prior to 5.18; version 4.14 and later versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3db09e762dc79584a69c10d74a6b98f89a9979f8 - https:
/git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3db09e762dc79584a69c10d74a6b98f89a9979f8 - https://kernel.dance/#3db09e762dc79584a69c10d74a6b98f89a9979f8 - http://www.openwall.com/lists/oss-security/2022/05/18/2 - http://packetstormsecurity.com/files/167386/Kernel-Live-Patch-Security-Notice-LSN-0086-1.html - https://security.netapp.com/advisory/ntap-20220629-0005/ - https://www.debian.org/security/2022/dsa-5173 - http://packetstormsecurity.com/files/168191/Kernel-Live-Patch-Security-Notice-LSN-0089-1.html
CVE ID: CVE-2022-29582 State: PUBLISHED Published: 2022-04-22T00:00:00 Last Updated: 2024-08-03T06:26:06.279Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the Linux kernel before 5.17.3, fs/io_uring.c has a use-after-free due to a race condition in io_uring timeouts. This can be triggered by a local user who has no access to any user namespace; however, the race condition perhaps can only be exploited infrequently. Additional Analyst Notes: - CVE Program Container: References: - https://www.openwall.com/lists/oss-security/2022/04/22/3 - https://github.com/torvalds/linux/commit/e677edbcabee849bfdd43f1602bccbecf736a646 - https://git.kernel.org/cgit/linux/kernel/git/torvalds/li
orvalds/linux/commit/e677edbcabee849bfdd43f1602bccbecf736a646 - https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=e677edbcabee849bfdd43f1602bccbecf736a646 - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.17.3 - http://www.openwall.com/lists/oss-security/2022/04/22/4 - https://www.debian.org/security/2022/dsa-5127 - http://www.openwall.com/lists/oss-security/2022/08/08/3 - https://ruia-ruia.github.io/2022/08/05/CVE-2022-29582-io-uring/ - https://github.com/Ruia-ruia/CVE-2022-29582-Exploit - http://www.openwall.com/lists/oss-security/2024/04/24/3
CVE ID: CVE-2022-29583 State: PUBLISHED Published: 2022-04-22T00:00:00 Last Updated: 2024-08-03T06:26:06.281Z Vendors: n/a Products: n/a Problem Types: n/a Description: service_windows.go in the kardianos service package for Go omits quoting that is sometimes needed for execution of a Windows service executable from the intended directory. NOTE: this finding could not be reproduced by its original reporter or by others. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/kardianos/service/pull/290
CVE ID: CVE-2022-29584 State: PUBLISHED Published: 2022-04-28T15:26:15 Last Updated: 2024-08-03T06:26:06.377Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mahara before 20.10.5, 21.04.4, 21.10.2, and 22.04.0 allows stored XSS when a particular Cascading Style Sheets (CSS) class for embedly is used, and JavaScript code is constructed to perform an action. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.launchpad.net/mahara/+bug/1968920 - https://mahara.org/interaction/forum/topic.php?id=9095
CVE ID: CVE-2022-29585 State: PUBLISHED Published: 2022-04-28T15:29:25 Last Updated: 2024-08-03T06:26:06.318Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Mahara before 20.10.5, 21.04.4, 21.10.2, and 22.04.0, a site using Isolated Institutions is vulnerable if more than ten groups are used. They are all shown from page 2 of the group results list (rather than only being shown for the institution that the viewer is a member of). Additional Analyst Notes: - CVE Program Container: References: - https://bugs.launchpad.net/mahara/+bug/1922226 - https://mahara.org/interaction/forum/topic.php?id=9093
CVE ID: CVE-2022-29586 State: PUBLISHED Published: 2022-05-16T05:35:52 Last Updated: 2024-08-03T06:26:06.552Z Vendors: n/a Products: n/a Problem Types: n/a Description: Konica Minolta bizhub MFP devices before 2022-04-14 allow a Sandbox Escape. An attacker must attach a keyboard to a USB port, press F12, and then escape from the kiosk mode. Additional Analyst Notes: - CVE Program Container: References: - https://sec-consult.com/vulnerability-lab/ - https://sec-consult.com/vulnerability-lab/advisory/sandbox-escape-with-root-access-clear-text-passwords-in-konica-minolta-bizhub-mfp-printer-terminals/
CVE ID: CVE-2022-29587 State: PUBLISHED Published: 2022-05-16T05:32:31 Last Updated: 2024-08-03T06:26:06.532Z Vendors: n/a Products: n/a Problem Types: n/a Description: Konica Minolta bizhub MFP devices before 2022-04-14 have an internal Chromium browser that executes with root (aka superuser) access privileges. Additional Analyst Notes: - CVE Program Container: References: - https://sec-consult.com/vulnerability-lab/ - https://sec-consult.com/vulnerability-lab/advisory/sandbox-escape-with-root-access-clear-text-passwords-in-konica-minolta-bizhub-mfp-printer-terminals/
CVE ID: CVE-2022-29588 State: PUBLISHED Published: 2022-05-16T05:30:58 Last Updated: 2024-08-03T06:26:06.602Z Vendors: n/a Products: n/a Problem Types: n/a Description: Konica Minolta bizhub MFP devices before 2022-04-14 use cleartext password storage for the /var/log/nginx/html/ADMINPASS and /etc/shadow files. Additional Analyst Notes: - CVE Program Container: References: - https://sec-consult.com/vulnerability-lab/ - http://packetstormsecurity.com/files/167166/Konica-Minolta-bizhub-MFP-Printer-Terminal-Sandbox-Escape.html
CVE ID: CVE-2022-29589 State: PUBLISHED Published: 2022-04-22T16:17:27 Last Updated: 2024-08-03T06:26:06.634Z Vendors: n/a Products: n/a Problem Types: n/a Description: Crypt Server before 3.3.0 allows XSS in the index view. This is related to serial, computername, and username. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/grahamgilbert/Crypt-Server/releases/tag/3.3.0 - https://github.com/grahamgilbert/Crypt-Server/pull/109
CVE ID: CVE-2022-29591 State: PUBLISHED Published: 2022-05-10T11:46:40 Last Updated: 2024-08-03T06:26:06.610Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda TX9 Pro 22.03.02.10 devices have a SetNetControlList buffer overflow. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/H4niz/Vulnerability/blob/main/Tenda-TX9-V22.03.02.10-19042022
CVE ID: CVE-2022-29592 State: PUBLISHED Published: 2022-05-05T15:51:44 Last Updated: 2024-08-03T06:26:06.548Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda TX9 Pro 22.03.02.10 devices allow OS command injection via set_route (called by doSystemCmd_route). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/H4niz/Vulnerability/blob/main/Tenda-TX9-V22.03.02.10-19042022-3.md
CVE ID: CVE-2022-29593 State: PUBLISHED Published: 2022-07-14T14:56:44.000Z Last Updated: 2025-05-05T16:21:01.060Z Vendors: n/a Products: n/a Problem Types: n/a Description: relay_cgi.cgi on Dingtian DT-R002 2CH relay devices with firmware 3.1.276A allows an attacker to replay HTTP post requests without the need for authentication or a valid signed/authorized request. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.trustwave.com/en-us/resources/security-resources/security-advisories/ - https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/cve-2022-29593-authentication-bypass-by-capture-replay-dingtian-dt-r002/ - http://packetsto
ources/blogs/spiderlabs-blog/cve-2022-29593-authentication-bypass-by-capture-replay-dingtian-dt-r002/ - http://packetstormsecurity.com/files/167868/Dingtian-DT-R002-3.1.276A-Authentication-Bypass.html
CVE ID: CVE-2022-29594 State: PUBLISHED Published: 2022-06-02T22:43:08 Last Updated: 2024-08-03T06:26:06.618Z Vendors: n/a Products: n/a Problem Types: n/a Description: eG Agent before 7.2 has weak file permissions that enable escalation of privileges to SYSTEM. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2022/MNDT-2022-0028/MNDT-2022-0028.md
CVE ID: CVE-2022-29596 State: PUBLISHED Published: 2022-05-11T19:03:24 Last Updated: 2024-08-03T06:26:06.650Z Vendors: n/a Products: n/a Problem Types: n/a Description: MicroStrategy Enterprise Manager 2022 allows authentication bypass by triggering a login failure and then entering the Uid=/../../../../../../../../../../../windows/win.ini%00.jpg&Pwd=_any_password_&ConnMode=1&3054=Login substring for directory traversal. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/haxpunk1337/Microstrategy-Poc/blob/main/poc
CVE ID: CVE-2022-29597 State: PUBLISHED Published: 2022-06-02T17:12:51 Last Updated: 2024-08-03T06:26:06.599Z Vendors: n/a Products: n/a Problem Types: n/a Description: Solutions Atlantic Regulatory Reporting System (RRS) v500 is vulnerable to Local File Inclusion (LFI). Any authenticated user has the ability to reference internal system files within requests made to the RRSWeb/maint/ShowDocument/ShowDocument.aspx page. The server will successfully respond with the file contents of the internal system file requested. This ability could allow for adversaries to extract sensitive data and/or files from the underlying file system, gain knowledge about the internal workings of the system, or acc
tive data and/or files from the underlying file system, gain knowledge about the internal workings of the system, or access source code of the application. Additional Analyst Notes: - CVE Program Container: References: - https://solutions-atlantic.com/rrs/ - https://github.com/TheGetch/CVE-2022-29597
CVE ID: CVE-2022-29598 State: PUBLISHED Published: 2022-05-27T17:07:00 Last Updated: 2024-08-03T06:26:06.556Z Vendors: n/a Products: n/a Problem Types: n/a Description: Solutions Atlantic Regulatory Reporting System (RRS) v500 is vulnerable to an reflected Cross-Site Scripting (XSS) vulnerability via RRSWeb/maint/ShowDocument/ShowDocument.aspx . Additional Analyst Notes: - CVE Program Container: References: - https://solutions-atlantic.com/rrs/ - https://github.com/TheGetch/CVE-2022-29598
CVE ID: CVE-2022-29599 State: PUBLISHED Published: 2022-05-23T10:25:10 Last Updated: 2024-08-03T06:26:06.558Z Vendors: Apache Software Foundation Products: Apache Maven Problem Types: CWE-116 Description: In Apache Maven maven-shared-utils prior to version 3.3.3, the Commandline class can emit double-quoted strings without proper escaping, allowing shell injection attacks. Additional Analyst Notes: - CVE Program Container: References: - https://issues.apache.org/jira/browse/MSHARED-297 - https://github.com/apache/maven-shared-utils/pull/40 - http://www.openwall.com/lists/oss-security/2022/05/23/3 - https://lists.debian.org/debian-lts-announce/2022/08/msg00018.html - https://www.debian.org/se
s-security/2022/05/23/3 - https://lists.debian.org/debian-lts-announce/2022/08/msg00018.html - https://www.debian.org/security/2022/dsa-5242
CVE ID: CVE-2022-29600 State: PUBLISHED Published: 2022-07-12T21:41:39 Last Updated: 2024-08-03T06:26:06.633Z Vendors: n/a Products: n/a Problem Types: n/a Description: The oelib (aka One is Enough Library) extension through 4.1.5 for TYPO3 allows SQL Injection. Additional Analyst Notes: - CVE Program Container: References: - https://typo3.org/help/security-advisories - https://typo3.org/security/advisory/typo3-ext-sa-2022-007
CVE ID: CVE-2022-29601 State: PUBLISHED Published: 2022-07-12T21:31:29 Last Updated: 2024-08-03T06:26:06.646Z Vendors: n/a Products: n/a Problem Types: n/a Description: The seminars (aka Seminar Manager) extension through 4.1.3 for TYPO3 allows SQL Injection. Additional Analyst Notes: - CVE Program Container: References: - https://typo3.org/help/security-advisories - https://typo3.org/security/advisory/typo3-ext-sa-2022-006
CVE ID: CVE-2022-29602 State: PUBLISHED Published: 2022-07-12T22:48:28 Last Updated: 2024-08-03T06:26:06.552Z Vendors: n/a Products: n/a Problem Types: n/a Description: The gridelements (aka Grid Elements) extension through 7.6.1, 8.x through 8.7.0, 9.x through 9.7.0, and 10.x through 10.2.0 extension for TYPO3 allows XSS. Additional Analyst Notes: - CVE Program Container: References: - https://typo3.org/help/security-advisories - https://typo3.org/security/advisory/typo3-ext-sa-2022-009
CVE ID: CVE-2022-29603 State: PUBLISHED Published: 2022-04-25T03:50:46 Last Updated: 2024-08-03T06:26:06.603Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL Injection vulnerability exists in UniverSIS UniverSIS-API through 1.2.1 via the $select parameter to multiple API endpoints. A remote authenticated attacker could send crafted SQL statements to a vulnerable endpoint (such as /api/students/me/messages/) to, for example, retrieve personal information or change grades. Additional Analyst Notes: - CVE Program Container: References: - https://suumcuique.org/blog/posts/sql-injection-vulnerability-universis/ - https://gitlab.com/universis/universis-api/-/commit/39e47d7f4654c83
/blog/posts/sql-injection-vulnerability-universis/ - https://gitlab.com/universis/universis-api/-/commit/39e47d7f4654c83296b8de61b243b510c375d3fb
CVE ID: CVE-2022-29604 State: PUBLISHED Published: 2023-04-20T00:00:00.000Z Last Updated: 2025-02-05T15:11:34.223Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in ONOS 2.5.1. An intent with an uppercase letter in a device ID shows the CORRUPT state, which is misleading to a network operator. Improper handling of case sensitivity causes inconsistency between intent and flow rules in the network. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wiki.onosproject.org/display/ONOS/Intent+Framework - https://www.usenix.org/system/files/sec23fall-prepub-285_kim-jiwon.pdf
CVE ID: CVE-2022-29605 State: PUBLISHED Published: 2023-04-20T00:00:00.000Z Last Updated: 2025-02-05T15:10:50.629Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in ONOS 2.5.1. IntentManager attempts to install the IPv6 flow rules of an intent into an OpenFlow 1.0 switch that does not support IPv6. Improper handling of the difference in capabilities of the intent and switch is misleading to a network operator. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wiki.onosproject.org/display/ONOS/Intent+Framework - https://www.usenix.org/system/files/sec23fall-prepub-285_kim-jiwon.pdf
CVE ID: CVE-2022-29606 State: PUBLISHED Published: 2023-04-20T00:00:00.000Z Last Updated: 2025-02-05T15:06:56.235Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in ONOS 2.5.1. An intent with a large port number shows the CORRUPT state, which is misleading to a network operator. Improper handling of such port numbers causes inconsistency between intent and flow rules in the network. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wiki.onosproject.org/display/ONOS/Intent+Framework - https://www.usenix.org/system/files/sec23fall-prepub-285_kim-jiwon.pdf
CVE ID: CVE-2022-29607 State: PUBLISHED Published: 2023-04-20T00:00:00.000Z Last Updated: 2025-02-05T15:05:58.719Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in ONOS 2.5.1. Modification of an existing intent to have the same source and destination shows the INSTALLED state without any flow rule. Improper handling of such an intent is misleading to a network operator. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wiki.onosproject.org/display/ONOS/Intent+Framework - https://www.usenix.org/system/files/sec23fall-prepub-285_kim-jiwon.pdf
CVE ID: CVE-2022-29608 State: PUBLISHED Published: 2023-04-20T00:00:00.000Z Last Updated: 2025-02-05T15:31:35.030Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in ONOS 2.5.1. An intent with a port that is an intermediate point of its path installs an invalid flow rule, causing a network loop. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wiki.onosproject.org/display/ONOS/Intent+Framework - https://www.usenix.org/system/files/sec23fall-prepub-285_kim-jiwon.pdf
CVE ID: CVE-2022-29609 State: PUBLISHED Published: 2023-04-20T00:00:00.000Z Last Updated: 2025-02-05T15:30:36.408Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in ONOS 2.5.1. An intent with the same source and destination shows the INSTALLING state, indicating that its flow rules are installing. Improper handling of such an intent is misleading to a network operator. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wiki.onosproject.org/display/ONOS/Intent+Framework - https://www.usenix.org/system/files/sec23fall-prepub-285_kim-jiwon.pdf
CVE ID: CVE-2022-29610 State: PUBLISHED Published: 2022-05-11T14:56:23 Last Updated: 2024-08-03T06:26:06.616Z Vendors: SAP SE Products: SAP NetWeaver Application Server ABAP Problem Types: CWE-79 Description: SAP NetWeaver Application Server ABAP allows an authenticated attacker to upload malicious files and delete (theme) data, which could result in Stored Cross-Site Scripting (XSS) attack. Additional Analyst Notes: - CVE Program Container: References: - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html - https://launchpad.support.sap.com/#/notes/3146336
CVE ID: CVE-2022-29611 State: PUBLISHED Published: 2022-05-11T14:57:20 Last Updated: 2024-08-03T06:26:06.632Z Vendors: SAP SE Products: SAP NetWeaver Application Server for ABAP and ABAP Platform Problem Types: CWE-862 Description: SAP NetWeaver Application Server for ABAP and ABAP Platform do not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. Additional Analyst Notes: - CVE Program Container: References: - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html - https://launchpad.support.sap.com/#/notes/3165801
CVE ID: CVE-2022-29612 State: PUBLISHED Published: 2022-06-14T16:59:05 Last Updated: 2024-08-03T06:26:06.711Z Vendors: SAP SE Products: SAP NetWeaver, ABAP Platform and SAP Host Agent Problem Types: CWE-918 Description: SAP NetWeaver, ABAP Platform and SAP Host Agent - versions KERNEL 7.22, 7.49, 7.53, 7.77, 7.81, 7.85, 7.86, 7.87, 7.88, 8.04, KRNL64NUC 7.22, 7.22EXT, 7.49, KRNL64UC 7.22, 7.22EXT, 7.49, 7.53, 8.04, SAPHOSTAGENT 7.22, allows an authenticated user to misuse a function of sapcontrol webfunctionality(startservice) in Kernel which enables malicious users to retrieve information. On successful exploitation, an attacker can obtain technical information like system number or physica
ieve information. On successful exploitation, an attacker can obtain technical information like system number or physical address, which is otherwise restricted, causing a limited impact on the confidentiality of the application. Additional Analyst Notes: - CVE Program Container: References: - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html - https://launchpad.support.sap.com/#/notes/3194674
CVE ID: CVE-2022-29613 State: PUBLISHED Published: 2022-05-11T14:57:56 Last Updated: 2024-08-03T06:26:06.562Z Vendors: SAP SE Products: SAP Employee Self Service (Fiori My Leave Request) Problem Types: CWE-20 Description: Due to insufficient input validation, SAP Employee Self Service allows an authenticated attacker with user privileges to alter employee number. On successful exploitation, the attacker can view personal details of other users causing a limited impact on confidentiality of the application. Additional Analyst Notes: - CVE Program Container: References: - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html - https://launchpad.support.sap.com/#/notes
ps://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html - https://launchpad.support.sap.com/#/notes/3164677
CVE ID: CVE-2022-29614 State: PUBLISHED Published: 2022-06-14T18:27:16 Last Updated: 2024-08-03T06:26:06.621Z Vendors: SAP SE Products: SAP NetWeaver AS ABAP, AS Java, ABAP Platform and HANA Database Problem Types: CWE-269 Description: SAP startservice - of SAP NetWeaver Application Server ABAP, Application Server Java, ABAP Platform and HANA Database - versions KERNEL 7.22, 7.49, 7.53, 7.77, 7.81, 7.85, 7.86, 7.87, 7.88, KRNL64NUC 7.22, 7.22EXT, 7.49, KRNL64UC 7.22, 7.22EXT, 7.49, 7.53, SAPHOSTAGENT 7.22, - on Unix systems, s-bit helper program sapuxuserchk, can be abused physically resulting in a privilege escalation of an attacker leading to low impact on confidentiality and integrity, bu
physically resulting in a privilege escalation of an attacker leading to low impact on confidentiality and integrity, but a profound impact on availability. Additional Analyst Notes: - CVE Program Container: References: - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html - https://launchpad.support.sap.com/#/notes/3158619 - http://seclists.org/fulldisclosure/2022/Sep/18 - http://packetstormsecurity.com/files/168409/SAP-SAPControl-Web-Service-Interface-Local-Privilege-Escalation.html
CVE ID: CVE-2022-29615 State: PUBLISHED Published: 2022-06-14T18:34:07 Last Updated: 2024-08-03T06:26:06.624Z Vendors: SAP SE Products: SAP NetWeaver Developer Studio (NWDS) Problem Types: CWE-502 Description: SAP NetWeaver Developer Studio (NWDS) - version 7.50, is based on Eclipse, which contains the logging framework log4j in version 1.x. The application's confidentiality and integrity could have a low impact due to the vulnerabilities associated with version 1.x. Additional Analyst Notes: - CVE Program Container: References: - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html - https://launchpad.support.sap.com/#/notes/3202846
CVE ID: CVE-2022-29616 State: PUBLISHED Published: 2022-05-11T15:08:03 Last Updated: 2024-08-03T06:26:06.653Z Vendors: SAP SE Products: SAP NetWeaver and ABAP Platform, SAP Host Agent Problem Types: CWE-787 Description: SAP Host Agent, SAP NetWeaver and ABAP Platform allow an attacker to leverage logical errors in memory management to cause a memory corruption. Additional Analyst Notes: - CVE Program Container: References: - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html - https://launchpad.support.sap.com/#/notes/3145702
CVE ID: CVE-2022-29617 State: PUBLISHED Published: 2022-06-06T19:38:53 Last Updated: 2024-08-03T06:26:06.578Z Vendors: SAP SE Products: CLA Assistant Problem Types: CWE-755 Description: Due to improper error handling an authenticated user can crash CLA assistant instance. This could impact the availability of the application. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/cla-assistant/cla-assistant/security/advisories/GHSA-jjjv-grgr-v8h3