Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-24254 State: PUBLISHED Published: 2022-03-01T23:00:26 Last Updated: 2024-08-03T04:07:01.869Z Vendors: n/a Products: n/a Problem Types: n/a Description: An unrestricted file upload vulnerability in the Backup/Restore Archive component of Extensis Portfolio v4.0 allows remote attackers to execute arbitrary code via a crafted ZIP file. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/research/zip-slip-vulnerability - http://extensis.com - http://portfolio.com - https://www.whiteoaksecurity.com/blog/extensis-portfolio-vulnerability-disclosure/
CVE ID: CVE-2022-24255 State: PUBLISHED Published: 2022-03-01T23:00:32 Last Updated: 2024-08-03T04:07:02.319Z Vendors: n/a Products: n/a Problem Types: n/a Description: Extensis Portfolio v4.0 was discovered to contain hardcoded credentials which allows attackers to gain administrator privileges. Additional Analyst Notes: - CVE Program Container: References: - http://extensis.com - http://portfolio.com - https://www.whiteoaksecurity.com/blog/extensis-portfolio-vulnerability-disclosure/
CVE ID: CVE-2022-24259 State: PUBLISHED Published: 2022-02-04T16:10:29 Last Updated: 2024-08-03T04:07:02.341Z Vendors: n/a Products: n/a Problem Types: n/a Description: An incorrect check in the component cdr.php of Voipmonitor GUI before v24.96 allows unauthenticated attackers to escalate privileges via a crafted request. Additional Analyst Notes: - CVE Program Container: References: - https://www.voipmonitor.org/changelog-gui?major=5 - https://kerbit.io/research/read/blog/3
CVE ID: CVE-2022-24260 State: PUBLISHED Published: 2022-02-04T16:10:29 Last Updated: 2024-08-03T04:07:02.339Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection vulnerability in Voipmonitor GUI before v24.96 allows attackers to escalate privileges to the Administrator level. Additional Analyst Notes: - CVE Program Container: References: - https://www.voipmonitor.org/changelog-gui?major=5 - https://kerbit.io/research/read/blog/3
CVE ID: CVE-2022-24262 State: PUBLISHED Published: 2022-02-04T16:10:31 Last Updated: 2024-08-03T04:07:02.305Z Vendors: n/a Products: n/a Problem Types: n/a Description: The config restore function of Voipmonitor GUI before v24.96 does not properly check files sent as restore archives, allowing remote attackers to execute arbitrary commands via a crafted file in the web root. Additional Analyst Notes: - CVE Program Container: References: - https://www.voipmonitor.org/changelog-gui?major=5 - https://kerbit.io/research/read/blog/3
CVE ID: CVE-2022-24263 State: PUBLISHED Published: 2022-01-31T21:27:00 Last Updated: 2024-08-03T04:07:02.335Z Vendors: n/a Products: n/a Problem Types: n/a Description: Hospital Management System v4.0 was discovered to contain a SQL injection vulnerability in /Hospital-Management-System-master/func.php via the email parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/truonghuuphuc/CVE - https://github.com/kishan0725/Hospital-Management-System/issues/17 - http://packetstormsecurity.com/files/165882/Hospital-Management-System-4.0-SQL-Injection.html - https://github.com/nu11secur1ty/CVE-mitre/tree/main/2022/CVE-2022-24263 - https://www.nu11secur1ty.com
-Injection.html - https://github.com/nu11secur1ty/CVE-mitre/tree/main/2022/CVE-2022-24263 - https://www.nu11secur1ty.com/2022/02/cve-2022-24263.html
CVE ID: CVE-2022-24264 State: PUBLISHED Published: 2022-01-31T21:27:00 Last Updated: 2024-08-03T04:07:02.332Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cuppa CMS v1.0 was discovered to contain a SQL injection vulnerability in /administrator/components/table_manager/ via the search_word parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/truonghuuphuc/CVE - https://github.com/CuppaCMS/CuppaCMS/issues/13
CVE ID: CVE-2022-24265 State: PUBLISHED Published: 2022-01-31T21:27:01 Last Updated: 2024-08-03T04:07:02.323Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cuppa CMS v1.0 was discovered to contain a SQL injection vulnerability in /administrator/components/menu/ via the path=component/menu/&menu_filter=3 parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/truonghuuphuc/CVE - https://github.com/CuppaCMS/CuppaCMS/issues/14
CVE ID: CVE-2022-24266 State: PUBLISHED Published: 2022-01-31T21:27:02 Last Updated: 2024-08-03T04:07:02.312Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cuppa CMS v1.0 was discovered to contain a SQL injection vulnerability in /administrator/components/table_manager/ via the order_by parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/truonghuuphuc/CVE - https://github.com/CuppaCMS/CuppaCMS/issues/17
CVE ID: CVE-2022-24272 State: PUBLISHED Published: 2022-04-21T10:45:11.960475Z Last Updated: 2024-09-16T16:27:52.675Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: MongoDB Inc. Products: MongoDB Server Problem Types: CWE-617 Description: An authenticated user may trigger an invariant assertion during command dispatch due to incorrect validation on the $external database. This may result in mongod denial of service or server crash. This issue affects: MongoDB Inc. MongoDB Server v5.0 versions, prior to and including v5.0.6. Additional Analyst Notes: - CVE Program Container: References: - https://jira.mongodb.org/browse/SERVER-63968
CVE ID: CVE-2022-24278 State: PUBLISHED Published: 2022-06-10T20:05:32.272232Z Last Updated: 2024-09-16T19:46:21.054Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P) Vendors: n/a Products: convert-svg-core Problem Types: Directory Traversal Description: The package convert-svg-core before 0.6.4 are vulnerable to Directory Traversal due to improper sanitization of SVG tags. Exploiting this vulnerability is possible by using a specially crafted SVG file. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-CONVERTSVGCORE-2859830 - https://github.com/neocotic/convert-svg/commit/2bbc498c5029238637206661dbac9e44d37d17c5 - https:/
NVERTSVGCORE-2859830 - https://github.com/neocotic/convert-svg/commit/2bbc498c5029238637206661dbac9e44d37d17c5 - https://github.com/neocotic/convert-svg/pull/87 - https://github.com/neocotic/convert-svg/issues/86
CVE ID: CVE-2022-24279 State: PUBLISHED Published: 2022-04-15T20:00:22.203608Z Last Updated: 2024-09-17T00:40:52.163Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P) Vendors: n/a Products: madlib-object-utils Problem Types: Prototype Pollution Description: The package madlib-object-utils before 0.1.8 are vulnerable to Prototype Pollution via the setValue method, as it allows an attacker to merge object prototypes into it. *Note:* This vulnerability derives from an incomplete fix of [CVE-2020-7701](https://security.snyk.io/vuln/SNYK-JS-MADLIBOBJECTUTILS-598676) Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-MADLIBOBJECT
UTILS-598676) Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-MADLIBOBJECTUTILS-2388572 - https://github.com/Qwerios/madlib-object-utils/commit/8d5d54c11c8fb9a7980a99778329acd13e3ef98f
CVE ID: CVE-2022-24280 State: PUBLISHED Published: 2022-09-23T09:25:12.000Z Last Updated: 2025-05-22T20:39:48.210Z Vendors: Apache Software Foundation Products: Apache Pulsar Problem Types: CWE-20 Description: Improper Input Validation vulnerability in Proxy component of Apache Pulsar allows an attacker to make TCP/IP connection attempts that originate from the Pulsar Proxy's IP address. When the Apache Pulsar Proxy component is used, it is possible to attempt to open TCP/IP connections to any IP address and port that the Pulsar Proxy can connect to. An attacker could use this as a way for DoS attacks that originate from the Pulsar Proxy's IP address. It hasn’t been detected that the Pulsar
his as a way for DoS attacks that originate from the Pulsar Proxy's IP address. It hasn’t been detected that the Pulsar Proxy authentication can be bypassed. The attacker will have to have a valid token to a properly secured Pulsar Proxy. This issue affects Apache Pulsar Proxy versions 2.7.0 to 2.7.4; 2.8.0 to 2.8.2; 2.9.0 to 2.9.1; 2.6.4 and earlier. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/ghs9jtjfbpy4c6xcftyvkl6swznlom1v
CVE ID: CVE-2022-24281 State: PUBLISHED Published: 2022-03-08T00:00:00.000Z Last Updated: 2025-04-21T13:55:44.864Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: SINEC NMS, SINEMA Server V14 Problem Types: CWE-89 Description: A vulnerability has been identified in SINEC NMS (All versions < V1.0.3), SINEMA Server V14 (All versions). A privileged authenticated attacker could execute arbitrary commands in the local database by sending specially crafted requests to the webserver of the affected application. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/prod
onal Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-250085.pdf
CVE ID: CVE-2022-24282 State: PUBLISHED Published: 2022-03-08T00:00:00.000Z Last Updated: 2025-04-21T13:55:36.584Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:T/RC:C) Vendors: Siemens Products: SINEC NMS, SINEMA Server V14 Problem Types: CWE-502 Description: A vulnerability has been identified in SINEC NMS (All versions >= V1.0.3 < V2.0), SINEC NMS (All versions < V1.0.3), SINEMA Server V14 (All versions). The affected system allows to upload JSON objects that are deserialized to Java objects. Due to insecure deserialization of user-supplied content by the affected software, a privileged attacker could exploit this vulnerability by sending a maliciously craft
content by the affected software, a privileged attacker could exploit this vulnerability by sending a maliciously crafted serialized Java object. This could allow the attacker to execute arbitrary code on the device with root privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-250085.pdf
CVE ID: CVE-2022-24285 State: PUBLISHED Published: 2022-03-08T22:45:37 Last Updated: 2024-08-03T04:07:02.336Z Vendors: n/a Products: n/a Problem Types: n/a Description: Acer Care Center 4.00.30xx before 4.00.3042 contains a local privilege escalation vulnerability. The user process communicates with a service of system authority called ACCsvc through a named pipe. In this case, the Named Pipe is also given Read and Write rights to the general user. In addition, the service program does not verify the user when communicating. A thread may exist with a specific command. When the path of the program to be executed is sent, there is a local privilege escalation in which the service program execu
the path of the program to be executed is sent, there is a local privilege escalation in which the service program executes the path with system privileges. Additional Analyst Notes: - CVE Program Container: References: - https://community.acer.com/en/kb/articles/14761
CVE ID: CVE-2022-24286 State: PUBLISHED Published: 2022-03-08T22:32:50 Last Updated: 2024-08-03T04:07:02.361Z Vendors: n/a Products: n/a Problem Types: n/a Description: Acer QuickAccess 2.01.300x before 2.01.3030 and 3.00.30xx before 3.00.3038 contains a local privilege escalation vulnerability. The user process communicates with a service of system authority through a named pipe. In this case, the Named Pipe is also given Read and Write rights to the general user. In addition, the service program does not verify the user when communicating. A thread may exist with a specific command. When the path of the program to be executed is sent, there is a local privilege escalation in which the serv
ic command. When the path of the program to be executed is sent, there is a local privilege escalation in which the service program executes the path with system privileges. Additional Analyst Notes: - CVE Program Container: References: - https://community.acer.com/en/kb/articles/14762
CVE ID: CVE-2022-24287 State: PUBLISHED Published: 2022-05-10T09:46:57.000Z Last Updated: 2025-04-21T13:53:48.015Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: SIMATIC PCS 7 V8.2, SIMATIC PCS 7 V9.0, SIMATIC PCS 7 V9.1, SIMATIC WinCC Runtime Professional V16 and earlier, SIMATIC WinCC Runtime Professional V17, SIMATIC WinCC V7.3, SIMATIC WinCC V7.4, SIMATIC WinCC V7.5 Problem Types: CWE-1188 Description: A vulnerability has been identified in SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions < V9.0 SP3 UC06), SIMATIC PCS 7 V9.1 (All versions < V9.1 SP1 UC01), SIMATIC WinCC Runtime Professional V16 and earlie
s < V9.0 SP3 UC06), SIMATIC PCS 7 V9.1 (All versions < V9.1 SP1 UC01), SIMATIC WinCC Runtime Professional V16 and earlier (All versions), SIMATIC WinCC Runtime Professional V17 (All versions < V17 Upd4), SIMATIC WinCC V7.3 (All versions), SIMATIC WinCC V7.4 (All versions < V7.4 SP1 Update 21), SIMATIC WinCC V7.5 (All versions < V7.5 SP2 Update 8). A missing printer configuration on the host could allow an authenticated attacker to escape the WinCC Kiosk Mode. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-363107.pdf
CVE ID: CVE-2022-24288 State: PUBLISHED Published: 2022-02-25T08:30:16 Last Updated: 2024-08-03T04:07:02.359Z Vendors: Apache Software Foundation Products: Apache Airflow Problem Types: CWE-78 Description: In Apache Airflow, prior to version 2.2.4, some example DAGs did not properly sanitize user-provided params, making them susceptible to OS Command Injection from the web UI. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread/dbw5ozcmr0h0lhs0yjph7xdc64oht23t
CVE ID: CVE-2022-24289 State: PUBLISHED Published: 2022-02-11T12:20:15 Last Updated: 2024-08-03T04:07:02.369Z Vendors: Apache Software Foundation Products: Apache Cayenne Problem Types: CWE-502 Description: Hessian serialization is a network protocol that supports object-based transmission. Apache Cayenne's optional Remote Object Persistence (ROP) feature is a web services-based technology that provides object persistence and query functionality to 'remote' applications. In Apache Cayenne 4.1 and earlier, running on non-current patch versions of Java, an attacker with client access to Cayenne ROP can transmit a malicious payload to any vulnerable third-party dependency on the server. This ca
t access to Cayenne ROP can transmit a malicious payload to any vulnerable third-party dependency on the server. This can result in arbitrary code execution. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread/zthjy83t3o66x7xcbygn2vg3yjvlc9vc - http://www.openwall.com/lists/oss-security/2022/02/11/1
CVE ID: CVE-2022-24290 State: PUBLISHED Published: 2022-05-10T09:46:58 Last Updated: 2024-08-03T04:07:02.458Z Vendors: Siemens Products: Teamcenter V12.4, Teamcenter V13.0, Teamcenter V13.1, Teamcenter V13.2, Teamcenter V13.3, Teamcenter V14.0 Problem Types: CWE-121 Description: A vulnerability has been identified in Teamcenter V12.4 (All versions < V12.4.0.13), Teamcenter V13.0 (All versions < V13.0.0.9), Teamcenter V13.1 (All versions), Teamcenter V13.2 (All versions < V13.2.0.8), Teamcenter V13.3 (All versions < V13.3.0.3), Teamcenter V14.0 (All versions < V14.0.0.2). The tcserver.exe binary in affected applications is vulnerable to a stack overflow condition during the parsing of user in
e tcserver.exe binary in affected applications is vulnerable to a stack overflow condition during the parsing of user input that may lead the binary to crash. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-789162.pdf
CVE ID: CVE-2022-24291 State: PUBLISHED Published: 2022-03-23T19:46:18 Last Updated: 2024-08-03T04:07:02.376Z Vendors: n/a Products: HP LaserJet Pro Printers; HP Pagewide Pro Printers; HP Officejet Printers Problem Types: Information disclosure, Denial of service, Buffer overflow Description: Certain HP Print devices may be vulnerable to potential information disclosure, denial of service, or remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://support.hp.com/us-en/document/ish_5950417-5950443-16
CVE ID: CVE-2022-24292 State: PUBLISHED Published: 2022-03-23T19:46:17 Last Updated: 2024-08-03T04:07:02.453Z Vendors: n/a Products: HP LaserJet Pro Printers; HP Pagewide Pro Printers; HP Officejet Printers Problem Types: Information disclosure, Denial of service, Buffer overflow Description: Certain HP Print devices may be vulnerable to potential information disclosure, denial of service, or remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://support.hp.com/us-en/document/ish_5950417-5950443-16
CVE ID: CVE-2022-24293 State: PUBLISHED Published: 2022-03-23T19:46:19 Last Updated: 2024-08-03T04:07:02.315Z Vendors: n/a Products: HP LaserJet Pro Printers; HP Pagewide Pro Printers; HP Officejet Printers Problem Types: Information disclosure, Denial of service, Buffer overflow Description: Certain HP Print devices may be vulnerable to potential information disclosure, denial of service, or remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://support.hp.com/us-en/document/ish_5950417-5950443-16
CVE ID: CVE-2022-24294 State: PUBLISHED Published: 2022-07-24T17:45:12 Last Updated: 2024-08-03T04:07:02.340Z Vendors: Apache Software Foundation Products: Apache MXNet Problem Types: CWE-400 Description: A regular expression used in Apache MXNet (incubating) is vulnerable to a potential denial-of-service by excessive resource consumption. The bug could be exploited when loading a model in Apache MXNet that has a specially crafted operator name that would cause the regular expression evaluation to use excessive resources to attempt a match. This issue affects Apache MXNet versions prior to 1.9.1. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread
ersions prior to 1.9.1. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread/b1fbfmvzlr2bbp95lqoh3mtovclfcl3o - http://www.openwall.com/lists/oss-security/2022/07/24/2
CVE ID: CVE-2022-24295 State: PUBLISHED Published: 2022-02-21T17:49:32 Last Updated: 2024-08-03T04:07:02.428Z Vendors: Okta Products: Okta Advanced Server Access Client Problem Types: Code Execution Description: Okta Advanced Server Access Client for Windows prior to version 1.57.0 was found to be vulnerable to command injection via a specially crafted URL. Additional Analyst Notes: - CVE Program Container: References: - https://trust.okta.com/security-advisories/okta-advanced-server-access-client-cve-2022-24295
CVE ID: CVE-2022-24296 State: PUBLISHED Published: 2022-06-08T14:11:50 Last Updated: 2024-08-03T04:07:02.409Z Vendors: n/a Products: Air Conditioning System G-150AD; Air Conditioning System AG-150A-A; Air Conditioning System AG-150A-J; Air Conditioning System GB-50AD; Air Conditioning System GB-50ADA-A; Air Conditioning System GB-50ADA-J; Air Conditioning System EB-50GU-A; Air Conditioning System EB-50GU-J; Air Conditioning System AE-200J; Air Conditioning System AE-200A; Air Conditioning System AE-200E; Air Conditioning System AE-50J; Air Conditioning System AE-50A; Air Conditioning System AE-50E; Air Conditioning System EW-50J; Air Conditioning System EW-50A; Air Conditioning System EW-50E
nditioning System AE-50E; Air Conditioning System EW-50J; Air Conditioning System EW-50A; Air Conditioning System EW-50E; Air Conditioning System TE-200A; Air Conditioning System TE-50A; Air Conditioning System TW-50A Problem Types: Use of a Broken or Risky Cryptographic Algorithm Description: Use of a Broken or Risky Cryptographic Algorithm vulnerability in Air Conditioning System G-150AD Ver. 3.21 and prior, Air Conditioning System AG-150A-A Ver. 3.21 and prior, Air Conditioning System AG-150A-J Ver. 3.21 and prior, Air Conditioning System GB-50AD Ver. 3.21 and prior, Air Conditioning System GB-50ADA-A Ver. 3.21 and prior, Air Conditioning System GB-50ADA-J Ver. 3.21 and prior, Air Conditi
Conditioning System GB-50ADA-A Ver. 3.21 and prior, Air Conditioning System GB-50ADA-J Ver. 3.21 and prior, Air Conditioning System EB-50GU-A Ver. 7.10 and prior, Air Conditioning System EB-50GU-J Ver. 7.10 and prior, Air Conditioning System AE-200J Ver. 7.97 and prior, Air Conditioning System AE-200A Ver. 7.97 and prior, Air Conditioning System AE-200E Ver. 7.97 and prior, Air Conditioning System AE-50J Ver. 7.97 and prior, Air Conditioning System AE-50A Ver. 7.97 and prior, Air Conditioning System AE-50E Ver. 7.97 and prior, Air Conditioning System EW-50J Ver. 7.97 and prior, Air Conditioning System EW-50A Ver. 7.97 and prior, Air Conditioning System EW-50E Ver. 7.97 and prior, Air Condit
rior, Air Conditioning System EW-50A Ver. 7.97 and prior, Air Conditioning System EW-50E Ver. 7.97 and prior, Air Conditioning System TE-200A Ver. 7.97 and prior, Air Conditioning System TE-50A Ver. 7.97 and prior and Air Conditioning System TW-50A Ver. 7.97 and prior allows a remote unauthenticated attacker to cause a disclosure of encrypted message of the air conditioning systems by sniffing encrypted communications. Additional Analyst Notes: - CVE Program Container: References: - https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-005_en.pdf - https://www.mee.co.jp/psirt/vulnerability/pdf/2022-001.pdf - https://jvn.jp/vu/JVNVU95298925/index.html
CVE ID: CVE-2022-24297 State: PUBLISHED Published: 2022-05-12T16:35:52.000Z Last Updated: 2025-05-05T16:24:31.198Z Vendors: n/a Products: Intel(R) NUCs Problem Types: escalation of privilege Description: Improper buffer restrictions in firmware for some Intel(R) NUCs may allow a privileged user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00654.html
CVE ID: CVE-2022-24298 State: PUBLISHED Published: 2022-08-23T05:06:46.768078Z Last Updated: 2024-09-17T03:52:58.910Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P) Vendors: n/a Products: FreeOpcUa/freeopcua Problem Types: Denial of Service (DoS) Description: All versions of package freeopcua/freeopcua are vulnerable to Denial of Service (DoS) when bypassing the limitations for excessive memory consumption by sending multiple CloseSession requests with the deleteSubscription parameter equal to False. Additional Analyst Notes: - CVE Program Container: References: - https://security.snyk.io/vuln/SNYK-UNMANAGED-FREEOPCUAFREEOPCUA-2988720 - https://github.com/FreeOpcU
ner: References: - https://security.snyk.io/vuln/SNYK-UNMANAGED-FREEOPCUAFREEOPCUA-2988720 - https://github.com/FreeOpcUa/freeopcua/issues/391
CVE ID: CVE-2022-24299 State: PUBLISHED Published: 2022-03-31T07:21:07 Last Updated: 2024-08-03T04:07:02.366Z Vendors: pfSense Products: pfSense CE and pfSense Plus Problem Types: Improper Input Validation Description: Improper input validation vulnerability in pfSense CE and pfSense Plus (pfSense CE software versions prior to 2.6.0 and pfSense Plus software versions prior to 22.01) allows a remote attacker with the privilege to change OpenVPN client or server settings to execute an arbitrary command. Additional Analyst Notes: - CVE Program Container: References: - https://jvn.jp/en/jp/JVN87751554/index.html - https://docs.netgate.com/downloads/pfSense-SA-22_03.webgui.asc