Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-21215 State: PUBLISHED Published: 2022-02-18T17:50:15.950Z Last Updated: 2025-04-16T16:46:02.036Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Airspan Networks Products: MMP, PTP C-series, PTMP C-series and A5x Problem Types: CWE-918 Description: This vulnerability could allow an attacker to force the server to create and execute a web request granting access to backend APIs that are only accessible to the Mimosa MMP server, or request pages that could perform some actions themselves. The attacker could force the server into accessing routes on those cloud-hosting platforms, accessing secret keys, changing configurations, etc. Affecting
into accessing routes on those cloud-hosting platforms, accessing secret keys, changing configurations, etc. Affecting MMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device versions prior to v2.5.4.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-034-02
CVE ID: CVE-2022-21216 State: PUBLISHED Published: 2023-02-16T19:59:52.954Z Last Updated: 2025-02-13T16:28:52.941Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:L) Vendors: n/a Products: Intel(R) Atom and Intel Xeon Scalable Processors Problem Types: escalation of privilege Description: Insufficient granularity of access control in out-of-band management in some Intel(R) Atom and Intel Xeon Scalable Processors may allow a privileged user to potentially enable escalation of privilege via adjacent network access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.intel.com/content/www/us/en/security-center/advisory/intel-s
ontainer: - CISA ADP Vulnrichment: References: - http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00700.html - https://security.netapp.com/advisory/ntap-20230601-0005/
CVE ID: CVE-2022-21217 State: PUBLISHED Published: 2022-01-28T19:10:09.000Z Last Updated: 2025-04-15T19:21:09.020Z Severity: CRITICAL (CVSS 9.1 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: n/a Products: n/a Problem Types: CWE-457 Description: An out-of-bounds write vulnerability exists in the device TestEmail functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted network request can lead to an out-of-bounds write. An attacker can send an HTTP request to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2021-1445
CVE ID: CVE-2022-21218 State: PUBLISHED Published: 2022-02-09T22:04:55.000Z Last Updated: 2025-05-05T16:35:28.485Z Vendors: n/a Products: Intel(R) Trace Analyzer and Collector Problem Types: information disclosure Description: Uncaught exception in the Intel(R) Trace Analyzer and Collector before version 2021.5 may allow an authenticated user to potentially enable information disclosure via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00639.html
CVE ID: CVE-2022-21219 State: PUBLISHED Published: 2022-03-07T09:00:38 Last Updated: 2024-08-03T02:31:59.068Z Vendors: OMRON Corporation Products: CX-Programmer Problem Types: Out-of-bounds read Description: Out-of-bounds read vulnerability in CX-Programmer v9.76.1 and earlier which is a part of CX-One (v4.60) suite allows an attacker to cause information disclosure and/or arbitrary code execution by having a user to open a specially crafted CXP file. Additional Analyst Notes: - CVE Program Container: References: - https://jvn.jp/en/vu/JVNVU90121984/index.html
CVE ID: CVE-2022-21220 State: PUBLISHED Published: 2022-02-09T22:04:56.000Z Last Updated: 2025-05-05T16:35:19.184Z Vendors: n/a Products: Intel(R) Quartus(R) Prime Pro Edition Problem Types: escalation of privilege Description: Improper restriction of XML external entity for Intel(R) Quartus(R) Prime Pro Edition before version 21.3 may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00632.html
CVE ID: CVE-2022-21221 State: PUBLISHED Published: 2022-03-17T11:21:09.487780Z Last Updated: 2024-09-16T18:34:58.514Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: n/a Products: github.com/valyala/fasthttp Problem Types: Directory Traversal Description: The package github.com/valyala/fasthttp before 1.34.0 are vulnerable to Directory Traversal via the ServeFile function, due to improper sanitization. It is possible to be exploited by using a backslash %5c character in the path. **Note:** This security issue impacts Windows users only. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMVALYALAFASTHTTP-
itional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMVALYALAFASTHTTP-2407866 - https://github.com/valyala/fasthttp/issues/1226 - https://github.com/valyala/fasthttp/commit/6b5bc7bb304975147b4af68df54ac214ed2554c1 - https://github.com/valyala/fasthttp/commit/15262ecf3c602364639d465daba1e7f3604d00e8 - https://github.com/valyala/fasthttp/releases/tag/v1.34.0
CVE ID: CVE-2022-21222 State: PUBLISHED Published: 2022-09-30T05:05:11.059Z Last Updated: 2025-05-20T16:04:07.202Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P) Vendors: n/a Products: css-what Problem Types: Regular Expression Denial of Service (ReDoS) Description: The package css-what before 2.1.3 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the usage of insecure regular expression in the re_attr variable of index.js. The exploitation of this vulnerability could be triggered via the parse function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-JS-CSSWHAT-303
Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-JS-CSSWHAT-3035488 - https://github.com/fb55/css-what/blob/a38effd5a8f5506d75c7f8f13cbd8c76248a3860/index.js%23L12 - https://lists.debian.org/debian-lts-announce/2023/03/msg00001.html
CVE ID: CVE-2022-21223 State: PUBLISHED Published: 2022-04-01T17:35:21.022818Z Last Updated: 2024-09-17T00:42:09.592Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: n/a Products: cocoapods-downloader Problem Types: Command Injection Description: The package cocoapods-downloader before 1.6.2 are vulnerable to Command Injection via hg argument injection. When calling the download function (when using hg), the url (and/or revision, tag, branch) is passed to the hg clone command in a way that additional flags can be set. The additional flags can be used to perform a command injection. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.i
be used to perform a command injection. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-RUBY-COCOAPODSDOWNLOADER-2414280 - https://github.com/CocoaPods/cocoapods-downloader/pull/127
CVE ID: CVE-2022-21224 State: REJECTED Published: N/A Last Updated: 2023-03-07T22:16:03.871Z Description: No description available.
CVE ID: CVE-2022-21225 State: PUBLISHED Published: 2022-08-18T00:00:00.000Z Last Updated: 2025-05-05T16:35:10.228Z Vendors: n/a Products: Intel(R) Data Center Manager software Problem Types: escalation of privilege Description: Improper neutralization in the Intel(R) Data Center Manager software before version 4.1 may allow an authenticated user to potentially enable escalation of privilege via adjacent access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00662.html - http://seclists.org/fulldisclosure/2022/Dec/1 - http://packetstormsecurity.com/files/170180/Intel-Data-Cente
0662.html - http://seclists.org/fulldisclosure/2022/Dec/1 - http://packetstormsecurity.com/files/170180/Intel-Data-Center-Manager-4.1-SQL-Injection.html
CVE ID: CVE-2022-21226 State: PUBLISHED Published: 2022-02-09T22:04:54.000Z Last Updated: 2025-05-05T16:34:59.905Z Vendors: n/a Products: Intel(R) Trace Analyzer and Collector Problem Types: information disclosure Description: Out-of-bounds read in the Intel(R) Trace Analyzer and Collector before version 2021.5 may allow an authenticated user to potentially enable information disclosure via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00639.html
CVE ID: CVE-2022-21227 State: PUBLISHED Published: 2022-05-01T15:25:15.734329Z Last Updated: 2024-09-16T18:48:34.205Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P) Vendors: n/a Products: sqlite3 Problem Types: Denial of Service (DoS) Description: The package sqlite3 before 5.0.3 are vulnerable to Denial of Service (DoS) which will invoke the toString function of the passed parameter. If passed an invalid Function object it will throw and crash the V8 engine. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-SQLITE3-2388645 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2805470 - https://github.com/TryGhost/node-sqlite3/
YK-JS-SQLITE3-2388645 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2805470 - https://github.com/TryGhost/node-sqlite3/commit/593c9d498be2510d286349134537e3bf89401c4a
CVE ID: CVE-2022-21228 State: PUBLISHED Published: 2022-04-12T16:11:52.740Z Last Updated: 2025-04-16T17:55:58.282Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Fuji Electric Products: Alpha5 Problem Types: CWE-121 Description: The affected product is vulnerable to a stack-based buffer overflow, which may allow an attacker to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-090-03
CVE ID: CVE-2022-21229 State: PUBLISHED Published: 2022-08-18T00:00:00.000Z Last Updated: 2025-05-05T16:34:51.110Z Vendors: n/a Products: Intel(R) NUC 9 Extreme Laptop Kit drivers Problem Types: escalation of privilege Description: Improper buffer restrictions for some Intel(R) NUC 9 Extreme Laptop Kit drivers before version 2.2.0.22 may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00665.html - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00809.html
CVE ID: CVE-2022-21230 State: PUBLISHED Published: 2022-05-01T15:20:21.538486Z Last Updated: 2024-09-16T23:31:10.779Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: n/a Products: org.nanohttpd:nanohttpd Problem Types: Information Exposure Description: This affects all versions of package org.nanohttpd:nanohttpd. Whenever an HTTP Session is parsing the body of an HTTP request, the body of the request is written to a RandomAccessFile when the it is larger than 1024 bytes. This file is created with insecure permissions that allow its contents to be viewed by all users on the host machine. **Workaround:** Manually specifying the -Djava.io.tmpdir= argument when
to be viewed by all users on the host machine. **Workaround:** Manually specifying the -Djava.io.tmpdir= argument when launching Java to set the temporary directory to a directory exclusively controlled by the current user can fix this issue. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JAVA-ORGNANOHTTPD-2422798 - https://github.com/NanoHttpd/nanohttpd/blob/efb2ebf85a2b06f7c508aba9eaad5377e3a01e81/core/src/main/java/org/nanohttpd/protocols/http/tempfiles/DefaultTempFile.java%23L58 - https://github.com/NanoHttpd/nanohttpd/blob/efb2ebf85a2b06f7c508aba9eaad5377e3a01e81/core/src/main/java/org/nanohttpd/protocols/http/tempfiles/DefaultTempFileManager
fb2ebf85a2b06f7c508aba9eaad5377e3a01e81/core/src/main/java/org/nanohttpd/protocols/http/tempfiles/DefaultTempFileManager.java%23L60 - https://github.com/JLLeitschuh/security-research/security/advisories/GHSA-2r85-x9cf-8fcg
CVE ID: CVE-2022-21231 State: PUBLISHED Published: 2022-06-24T20:00:17.480032Z Last Updated: 2024-09-17T02:53:31.155Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P) Vendors: n/a Products: deep-get-set Problem Types: Prototype Pollution Description: All versions of package deep-get-set are vulnerable to Prototype Pollution via the 'deep' function. **Note:** This vulnerability derives from an incomplete fix of [CVE-2020-7715](https://security.snyk.io/vuln/SNYK-JS-DEEPGETSET-598666) Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-DEEPGETSET-2342655
CVE ID: CVE-2022-21233 State: PUBLISHED Published: 2022-08-18T00:00:00.000Z Last Updated: 2025-05-05T16:34:42.536Z Vendors: n/a Products: Intel(R) Processors Problem Types: information disclosure Description: Improper isolation of shared resources in some Intel(R) Processors may allow a privileged user to potentially enable information disclosure via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00657.html - https://security.netapp.com/advisory/ntap-20220923-0002/ - https://lists.debian.org/debian-lts-announce/2023/04/msg00000.html
CVE ID: CVE-2022-21234 State: PUBLISHED Published: 2022-04-14T19:56:38.657Z Last Updated: 2025-04-15T19:05:43.441Z Severity: CRITICAL (CVSS 9.1 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Lansweeper Products: lansweeper Problem Types: CWE-89 Description: An SQL injection vulnerability exists in the EchoAssets.aspx functionality of Lansweeper lansweeper 9.1.20.2. A specially-crafted HTTP request can cause SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.lansweeper.com/changelog/ - https://talosintelligence.com/vulnerability_reports/TA
lnrichment: References: - https://www.lansweeper.com/changelog/ - https://talosintelligence.com/vulnerability_reports/TALOS-2022-1443
CVE ID: CVE-2022-21235 State: PUBLISHED Published: 2022-04-01T15:55:10.738304Z Last Updated: 2024-09-17T00:20:56.794Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: n/a Products: github.com/Masterminds/vcs Problem Types: Command Injection Description: The package github.com/masterminds/vcs before 1.13.3 are vulnerable to Command Injection via argument injection. When hg is executed, argument strings are passed to hg in a way that additional flags can be set. The additional flags can be used to perform a command injection. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMMASTERMINDSVCS-2437078 - https:/
Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMMASTERMINDSVCS-2437078 - https://github.com/Masterminds/vcs/pull/105
CVE ID: CVE-2022-21236 State: PUBLISHED Published: 2022-01-28T19:10:01.000Z Last Updated: 2025-04-15T19:22:14.714Z Severity: HIGH (CVSS 8.1 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: n/a Products: n/a Problem Types: CWE-219 Description: An information disclosure vulnerability exists due to a web server misconfiguration in the Reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a disclosure of sensitive information. An attacker can send an HTTP request to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2022-1446
CVE ID: CVE-2022-21237 State: PUBLISHED Published: 2022-05-12T16:35:53.000Z Last Updated: 2025-05-05T16:34:30.936Z Vendors: n/a Products: Intel(R) NUCs Problem Types: escalation of privilege Description: Improper buffer access in firmware for some Intel(R) NUCs may allow a privileged user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00654.html
CVE ID: CVE-2022-21238 State: PUBLISHED Published: 2022-05-12T17:01:29.716Z Last Updated: 2025-04-15T19:03:45.606Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: InHand Networks Products: InRouter302 Problem Types: CWE-80 Description: A cross-site scripting (xss) vulnerability exists in the info.jsp functionality of InHand Networks InRouter302 V3.5.4. A specially-crafted HTTP request can lead to arbitrary Javascript execution. An attacker can send an HTTP request to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.inhandnetworks.com/upload/attachment/202205/10/InHand-PSA-2022-0
ner: - CISA ADP Vulnrichment: References: - https://www.inhandnetworks.com/upload/attachment/202205/10/InHand-PSA-2022-01.pdf - https://talosintelligence.com/vulnerability_reports/TALOS-2022-1469
CVE ID: CVE-2022-21239 State: PUBLISHED Published: 2023-05-10T13:16:55.105Z Last Updated: 2025-01-27T18:06:31.164Z Severity: MEDIUM (CVSS 5.6 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: n/a Products: Intel QAT Driver for Windows Problem Types: information disclosure, CWE-125 Description: Out-of-bounds read in software for the Intel QAT Driver for Windows before version 1.9.0-0008 may allow an authenticated user to potentially enable information disclosure via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00809.html
CVE ID: CVE-2022-21240 State: PUBLISHED Published: 2022-08-18T19:40:34.000Z Last Updated: 2025-05-05T16:34:20.601Z Vendors: n/a Products: Intel(R) PROSet/Wireless WiFi products Problem Types: information disclosure Description: Out of bounds read for some Intel(R) PROSet/Wireless WiFi products may allow a privileged user to potentially enable information disclosure via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00621.html
CVE ID: CVE-2022-21241 State: PUBLISHED Published: 2022-02-08T10:30:35 Last Updated: 2024-08-03T02:31:59.057Z Vendors: Plus one Products: CSV+ Problem Types: Cross-site scripting Description: Cross-site scripting vulnerability in CSV+ prior to 0.8.1 allows a remote unauthenticated attacker to inject an arbitrary script or an arbitrary OS command via a specially crafted CSV file that contains HTML a tag. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/plusone-masaki/csv-plus/releases/tag/v0.8.1 - https://jvn.jp/en/jp/JVN67396225/index.html
CVE ID: CVE-2022-21242 State: PUBLISHED Published: 2022-01-19T11:21:49 Last Updated: 2024-09-24T20:32:59.044Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Oracle Corporation Products: Primavera Portfolio Management Problem Types: Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Primavera Portfolio Management. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Primavera Portfolio Management, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delet
impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Primavera Portfolio Management accessible data as well as unauthorized read access to a subset of Primavera Portfolio Management accessible data. Description: Vulnerability in the Primavera Portfolio Management product of Oracle Construction and Engineering (component: Web Access). Supported versions that are affected are 18.0.0.0-18.0.3.0, 19.0.0.0-19.0.1.2, 20.0.0.0 and 20.0.0.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Primavera Portfolio Management. Successful attacks require human int
attacker with network access via HTTP to compromise Primavera Portfolio Management. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Primavera Portfolio Management, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Primavera Portfolio Management accessible data as well as unauthorized read access to a subset of Primavera Portfolio Management accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N). Additional Analyst Notes: - CV
lity and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.oracle.com/security-alerts/cpujan2022.html
CVE ID: CVE-2022-21243 State: PUBLISHED Published: 2022-01-19T11:21:52 Last Updated: 2024-09-24T20:32:50.776Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: Oracle Corporation Products: Primavera Portfolio Management Problem Types: Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Primavera Portfolio Management. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Primavera Portfolio Management. Description: Vulnerability in the Primavera Portfolio Management product of Oracle Construction and Engineering (component: Web Acce
Vulnerability in the Primavera Portfolio Management product of Oracle Construction and Engineering (component: Web Access). Supported versions that are affected are 18.0.0.0-18.0.3.0, 19.0.0.0-19.0.1.2, 20.0.0.0 and 20.0.0.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Primavera Portfolio Management. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Primavera Portfolio Management. CVSS 3.1 Base Score 4.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L). Additional Analyst Notes: - CVE Program Container: - CISA ADP V
Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.oracle.com/security-alerts/cpujan2022.html
CVE ID: CVE-2022-21244 State: PUBLISHED Published: 2022-01-19T11:21:53 Last Updated: 2024-09-24T20:32:44.087Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Oracle Corporation Products: Primavera Portfolio Management Problem Types: Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera Portfolio Management. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Primavera Portfolio Management accessible data. Description: Vulnerability in the Primavera Portfo