Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-22300 State: PUBLISHED Published: 2022-03-01T18:25:16 Last Updated: 2024-10-22T21:01:00.396Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C) Vendors: Fortinet Products: Fortinet FortiManager, FortiAnalyzer Problem Types: Execute unauthorized code or commands Description: A improper handling of insufficient permissions or privileges in Fortinet FortiAnalyzer version 5.6.0 through 5.6.11, FortiAnalyzer version 6.0.0 through 6.0.11, FortiAnalyzer version 6.2.0 through 6.2.9, FortiAnalyzer version 6.4.0 through 6.4.7, FortiAnalyzer version 7.0.0 through 7 .0.2, FortiManager version 5.6.0 through 5.6.11, FortiManager version 6.0.0 through 6.
iAnalyzer version 7.0.0 through 7 .0.2, FortiManager version 5.6.0 through 5.6.11, FortiManager version 6.0.0 through 6.0.11, FortiManager version 6.2.0 through 6.2.9, FortiManager version 6.4.0 through 6.4.7, FortiManager version 7.0.0 through 7.0.2 allows attacker to bypass the device policy and force the password-change action for its user. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-21-255
CVE ID: CVE-2022-22301 State: PUBLISHED Published: 2022-03-02T10:00:19 Last Updated: 2024-10-25T13:34:36.011Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:U/RC:R) Vendors: Fortinet Products: Fortinet FortiAP-C Problem Types: Execute unauthorized code or commands Description: An improper neutralization of special elements used in an OS Command vulnerability [CWE-78] in FortiAP-C console 5.4.0 through 5.4.3, 5.2.0 through 5.2.1 may allow an authenticated attacker to execute unauthorized commands by running CLI commands with specifically crafted arguments. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard
arguments. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-21-227
CVE ID: CVE-2022-22302 State: PUBLISHED Published: 2023-07-11T08:54:00.679Z Last Updated: 2024-10-23T14:25:36.732Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:X/RC:X) Vendors: Fortinet Products: FortiAuthenticator, FortiOS Problem Types: CWE-312 Description: A clear text storage of sensitive information (CWE-312) vulnerability in both FortiGate version 6.4.0 through 6.4.1, 6.2.0 through 6.2.9 and 6.0.0 through 6.0.13 and FortiAuthenticator version 5.5.0 and all versions of 6.1 and 6.0 may allow a local unauthorized party to retrieve the Fortinet private keys used to establish secure communication with both Apple Push Notification and Google Cloud Messaging
rtinet private keys used to establish secure communication with both Apple Push Notification and Google Cloud Messaging services, via accessing the files on the filesystem. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-20-014
CVE ID: CVE-2022-22303 State: PUBLISHED Published: 2022-03-02T10:00:12 Last Updated: 2024-10-22T21:00:31.912Z Severity: LOW (CVSS 2.8 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N/E:F/RL:X/RC:X) Vendors: Fortinet Products: Fortinet FortiManager Problem Types: Information disclosure Description: An exposure of sensitive system information to an unauthorized control sphere vulnerability [CWE-497] in FortiManager versions prior to 7.0.2, 6.4.7 and 6.2.9 may allow a low privileged authenticated user to gain access to the FortiGate users credentials via the config conflict file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/F
Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-21-165
CVE ID: CVE-2022-22304 State: PUBLISHED Published: 2022-07-18T16:35:28 Last Updated: 2024-10-22T20:56:35.520Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:X/RL:X/RC:X) Vendors: Fortinet Products: Fortinet FortiAuthenticator OutlookAgent Problem Types: Information disclosure Description: An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiAuthenticator OWA Agent for Microsoft version 2.2 and 2.1 may allow an unauthenticated attacker to perform an XSS attack via crafted HTTP GET requests. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-22-021
CVE ID: CVE-2022-22305 State: PUBLISHED Published: 2023-09-01T11:43:03.878Z Last Updated: 2024-09-27T18:40:07.999Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:U/RC:C) Vendors: Fortinet Products: FortiAnalyzer, FortiSandbox, FortiManager Problem Types: CWE-297 Description: An improper certificate validation vulnerability [CWE-295] in FortiManager 7.0.1 and below, 6.4.6 and below; FortiAnalyzer 7.0.2 and below, 6.4.7 and below; FortiOS 6.2.x and 6.0.x; FortiSandbox 4.0.x, 3.2.x and 3.1.x may allow a network adjacent and unauthenticated attacker to man-in-the-middle the communication between the listed products and some external peers. Additional Analyst Notes
ker to man-in-the-middle the communication between the listed products and some external peers. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-18-292
CVE ID: CVE-2022-22306 State: PUBLISHED Published: 2022-05-24T14:35:10 Last Updated: 2024-10-22T20:56:45.562Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:U/RC:R) Vendors: Fortinet Products: Fortinet FortiOS Problem Types: Information disclosure Description: An improper certificate validation vulnerability [CWE-295] in FortiOS 6.0.0 through 6.0.14, 6.2.0 through 6.2.10, 6.4.0 through 6.4.8, 7.0.0 may allow a network adjacent and unauthenticated attacker to man-in-the-middle the communication between the FortiGate and some peers such as private SDNs and external cloud platforms. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Refer
ate SDNs and external cloud platforms. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-21-239
CVE ID: CVE-2022-22307 State: PUBLISHED Published: 2023-06-15T00:35:40.622Z Last Updated: 2024-12-12T21:26:50.535Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: IBM Products: Security Guardium Problem Types: CWE-863 Description: IBM Security Guardium 11.3, 11.4, and 11.5 could allow a local user to obtain elevated privileges due to incorrect authorization checks. IBM X-Force ID: 216753. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6999317 - https://exchange.xforce.ibmcloud.com/vulnerabilities/216753
CVE ID: CVE-2022-22308 State: PUBLISHED Published: 2022-02-21T18:10:10.356982Z Last Updated: 2024-09-16T18:13:10.537Z Severity: HIGH (CVSS 7.1 CVSS:3.0/S:U/PR:N/C:H/A:L/I:H/UI:R/AV:N/AC:H/RL:O/RC:C/E:U) Vendors: IBM Products: Planning Analytics, Planning Analytics Workspace Problem Types: Gain Access Description: IBM Planning Analytics 2.0 is vulnerable to a Remote File Include (RFI) attack. User input could be passed into file include commands and the web application could be tricked into including remote files with malicious code. IBM X-Force ID: 216891. Additional Analyst Notes: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/6557106 - https://exchange.xforce
t Notes: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/6557106 - https://exchange.xforce.ibmcloud.com/vulnerabilities/216891
CVE ID: CVE-2022-22309 State: PUBLISHED Published: 2022-05-24T16:20:18.499237Z Last Updated: 2024-09-16T16:52:49.070Z Severity: MEDIUM (CVSS 6.8 CVSS:3.0/AV:P/UI:N/A:H/C:H/S:U/AC:L/I:H/PR:N/RC:C/E:U/RL:O) Vendors: IBM Products: Power System S922 Server Problem Types: Gain Privileges Description: The POWER systems FSP is vulnerable to unauthenticated logins through the serial port/TTY interface. This vulnerability can be more critical if the serial port is connected to a serial-over-lan device. IBM X-Force ID: 217095. Additional Analyst Notes: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/6589099 - https://exchange.xforce.ibmcloud.com/vulnerabilities/217095
CVE ID: CVE-2022-22310 State: PUBLISHED Published: 2022-01-19T16:55:11.448521Z Last Updated: 2024-09-16T16:58:15.367Z Severity: MEDIUM (CVSS 4.8 CVSS:3.0/C:L/A:N/AC:H/PR:N/I:L/S:U/UI:N/AV:N/RC:C/RL:O/E:U) Vendors: IBM Products: WebSphere Application Server Liberty Problem Types: Gain Access Description: IBM WebSphere Application Server Liberty 21.0.0.10 through 21.0.0.12 could provide weaker than expected security. A remote attacker could exploit this weakness to obtain sensitive information and gain unauthorized access to JAX-WS applications. IBM X-Force ID: 217224. Additional Analyst Notes: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/6541530 - https://exch
onal Analyst Notes: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/6541530 - https://exchange.xforce.ibmcloud.com/vulnerabilities/217224
CVE ID: CVE-2022-22311 State: PUBLISHED Published: 2022-03-31T17:30:17.724311Z Last Updated: 2024-09-16T20:01:49.457Z Severity: MEDIUM (CVSS 4.8 CVSS:3.0/AC:H/PR:N/A:N/S:U/UI:N/I:L/AV:N/C:L/RL:O/RC:C/E:U) Vendors: IBM Products: Security Verify Access Problem Types: Gain Access Description: IBM Security Verify Access could allow a user, using man in the middle techniques, to obtain sensitive information or possibly change some information due to improper validiation of JWT tokens. Additional Analyst Notes: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/6568043 - https://exchange.xforce.ibmcloud.com/vulnerabilities/217226
CVE ID: CVE-2022-22312 State: PUBLISHED Published: 2022-04-27T15:20:38.340476Z Last Updated: 2024-09-17T02:57:23.442Z Severity: MEDIUM (CVSS 5.7 CVSS:3.0/AV:A/AC:L/C:N/UI:N/A:H/I:N/S:U/PR:L/RL:O/E:U/RC:C) Vendors: IBM Products: Security Verify Password Synchronization Plug-in for Windows AD Problem Types: Gain Privileges Description: IBM Security Identity Manager (IBM Security Verify Password Synchronization Plug-in for Windows AD 10.x) is vulnerable to a denial of service, caused by a heap-based buffer overflow in the Password Synch Plug-in. An authenticated attacker could exploit this vulnerability to cause a denial of service. IBM X-Force ID: 217369. Additional Analyst Notes: - CVE Progra
exploit this vulnerability to cause a denial of service. IBM X-Force ID: 217369. Additional Analyst Notes: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/6574671 - https://exchange.xforce.ibmcloud.com/vulnerabilities/217369
CVE ID: CVE-2022-22313 State: PUBLISHED Published: 2023-05-06T01:38:25.032Z Last Updated: 2025-01-29T15:43:16.310Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: QRadar Data Synchronization App Problem Types: CWE-327 Description: IBM QRadar Data Synchronization App 1.0 through 3.0.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 217370. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6980797 - https://exchange.xforce.ibmcloud.com/vulnerabilities/217370
CVE ID: CVE-2022-22314 State: PUBLISHED Published: 2022-09-08T16:00:14.234713Z Last Updated: 2024-09-16T16:48:24.901Z Severity: MEDIUM (CVSS 4 CVSS:3.0/UI:N/AC:L/I:N/PR:N/AV:L/A:N/S:U/C:L/RL:O/E:U/RC:C) Vendors: IBM Products: Planning Analytics Workspace Problem Types: Obtain Information Description: IBM Planning Analytics Local 2.0 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 217371. Additional Analyst Notes: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/6615289 - https://exchange.xforce.ibmcloud.com/vulnerabilities/217371
CVE ID: CVE-2022-22315 State: PUBLISHED Published: 2022-04-27T17:55:10.980354Z Last Updated: 2024-09-16T20:17:35.405Z Severity: MEDIUM (CVSS 5 CVSS:3.0/S:U/C:L/AC:H/UI:N/A:L/PR:L/I:L/AV:N/RC:C/RL:O/E:U) Vendors: IBM Products: UrbanCode Deploy Problem Types: Gain Privileges Description: IBM UrbanCode Deploy (UCD) 7.2.2.1 could allow an authenticated user with special permissions to obtain elevated privileges due to improper handling of permissions. IBM X-Force ID: 217955. Additional Analyst Notes: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/6575143 - https://exchange.xforce.ibmcloud.com/vulnerabilities/217955
CVE ID: CVE-2022-22316 State: PUBLISHED Published: 2022-03-23T16:20:12.777181Z Last Updated: 2024-09-16T18:44:16.061Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/PR:L/A:H/AC:H/AV:N/C:N/I:N/S:U/UI:N/E:U/RL:O/RC:C) Vendors: IBM Products: MQ Appliance Problem Types: Denial of Service Description: IBM MQ Appliance 9.2 CD and 9.2 LTS could allow an authenticated and authorized user to cause a denial of service due to incorrectly configured authorization checks. IBM X-Force ID: 218276. Additional Analyst Notes: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/6560040 - https://exchange.xforce.ibmcloud.com/vulnerabilities/218276
CVE ID: CVE-2022-22317 State: PUBLISHED Published: 2022-06-20T16:25:14.820349Z Last Updated: 2024-09-16T19:20:48.066Z Severity: MEDIUM (CVSS 5.9 CVSS:3.0/C:L/AC:L/UI:N/S:U/I:L/A:L/AV:L/PR:N/RL:O/RC:C/E:U) Vendors: IBM Products: Curam Social Program Management Problem Types: Gain Privileges Description: IBM Curam Social Program Management 8.0.0 and 8.0.1 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 218281. Additional Analyst Notes: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/6596049 - https://exchange.xforce.ibmcloud.com/vulnerabilities/218281
CVE ID: CVE-2022-22318 State: PUBLISHED Published: 2022-06-20T16:25:16.509209Z Last Updated: 2024-09-16T22:25:40.177Z Severity: MEDIUM (CVSS 5.9 CVSS:3.0/PR:N/AV:L/A:L/I:L/S:U/AC:L/UI:N/C:L/E:U/RL:O/RC:C) Vendors: IBM Products: Curam Social Program Management Problem Types: Gain Privileges Description: IBM Curam Social Program Management 8.0.0 and 8.0.1 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. Additional Analyst Notes: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/6596049 - https://exchange.xforce.ibmcloud.com/vulnerabilities/218283
CVE ID: CVE-2022-22319 State: PUBLISHED Published: 2022-05-09T16:35:19.996231Z Last Updated: 2024-09-17T03:23:09.905Z Severity: MEDIUM (CVSS 4.6 CVSS:3.0/A:L/C:N/AC:L/S:U/I:L/UI:N/PR:L/AV:A/RC:C/E:U/RL:O) Vendors: IBM Products: Robotic Process Automation as a Service, Robotic Process Automation Problem Types: Bypass Security Description: IBM Robotic Process Automation 21.0.1 could allow a register user on the system to physically delete a queue that could cause disruption for any scripts dependent on the queue. IBM X-Force ID: 218366. Additional Analyst Notes: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/6569203 - https://www.ibm.com/support/pages/node/658354
Container: References: - https://www.ibm.com/support/pages/node/6569203 - https://www.ibm.com/support/pages/node/6583547 - https://exchange.xforce.ibmcloud.com/vulnerabilities/218366
CVE ID: CVE-2022-22320 State: PUBLISHED Published: 2022-05-11T16:10:16.201925Z Last Updated: 2024-09-17T03:28:56.321Z Severity: MEDIUM (CVSS 4.8 CVSS:3.0/S:C/A:N/AC:L/UI:R/PR:H/I:L/AV:N/C:L/RC:C/E:H/RL:O) Vendors: IBM Products: QRadar SIEM Problem Types: Cross-Site Scripting Description: IBM QRadar SIEM 7.3 and 7.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 218367. Additional Analyst Notes: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/6584451 - https://exch
onal Analyst Notes: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/6584451 - https://exchange.xforce.ibmcloud.com/vulnerabilities/218367
CVE ID: CVE-2022-22321 State: PUBLISHED Published: 2022-03-01T16:45:26.994220Z Last Updated: 2024-09-16T18:03:45.740Z Severity: MEDIUM (CVSS 5.1 CVSS:3.0/A:N/AV:L/UI:N/C:H/PR:N/I:N/S:U/AC:H/RC:C/RL:O/E:U) Vendors: IBM Products: MQ Appliance Problem Types: Obtain Information Description: IBM MQ Appliance 9.2 CD and 9.2 LTS local messaging users stored with a password hash that provides insufficient protection. IBM X-Force ID: 218368. Additional Analyst Notes: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/6560042 - https://exchange.xforce.ibmcloud.com/vulnerabilities/218368
CVE ID: CVE-2022-22322 State: PUBLISHED Published: 2022-04-28T16:10:28.434801Z Last Updated: 2024-09-17T02:27:08.039Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/C:L/S:C/UI:R/AV:N/AC:L/I:L/PR:L/A:N/RC:C/E:H/RL:O) Vendors: IBM Products: InfoSphere Information Server Problem Types: Cross-Site Scripting Description: IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 218370. Additional Analyst Notes: - CVE Program Container: References: - https://www.ibm.com/support/page
BM X-Force ID: 218370. Additional Analyst Notes: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/6575567 - https://exchange.xforce.ibmcloud.com/vulnerabilities/218370
CVE ID: CVE-2022-22323 State: PUBLISHED Published: 2022-04-27T15:20:39.765456Z Last Updated: 2024-09-17T01:06:21.310Z Severity: MEDIUM (CVSS 5.7 CVSS:3.0/AV:A/AC:L/C:N/UI:N/A:H/S:U/PR:L/I:N/RL:O/E:U/RC:C) Vendors: IBM Products: Security Verify Password Synchronization Plug-in for Windows AD Problem Types: Denial of Service Description: IBM Security Identity Manager (IBM Security Verify Password Synchronization Plug-in for Windows AD 10.x) is vulnerable to a denial of service, caused by a heap-based buffer overflow in the Password Synch Plug-in. An authenticated attacker could exploit this vulnerability to cause a denial of service. IBM X-Force ID: 218379. Additional Analyst Notes: - CVE Prog
ld exploit this vulnerability to cause a denial of service. IBM X-Force ID: 218379. Additional Analyst Notes: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/6574671 - https://exchange.xforce.ibmcloud.com/vulnerabilities/218379
CVE ID: CVE-2022-22325 State: PUBLISHED Published: 2022-05-13T16:15:18.573004Z Last Updated: 2024-09-16T17:49:14.224Z Severity: MEDIUM (CVSS 5.1 CVSS:3.0/I:N/C:H/UI:N/AV:L/A:N/AC:H/PR:N/S:U/E:U/RL:O/RC:C) Vendors: IBM Products: MQ for HPE NonStop Problem Types: Obtain Information Description: IBM MQ (IBM MQ for HPE NonStop 8.1.0) can inadvertently disclose sensitive information under certain circumstances to a local user from a stack trace. IBM X-Force ID: 218853. Additional Analyst Notes: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/6585780 - https://exchange.xforce.ibmcloud.com/vulnerabilities/218853
CVE ID: CVE-2022-22326 State: PUBLISHED Published: 2022-07-31T16:05:25.070725Z Last Updated: 2024-09-16T18:03:08.743Z Severity: MEDIUM (CVSS 4 CVSS:3.0/A:N/S:U/AC:L/I:N/C:L/AV:L/UI:N/PR:N/E:U/RL:O/RC:C) Vendors: IBM Products: DataPower Gateway Problem Types: Obtain Information Description: IBM Datapower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.5, and 2018.4.1.0 through 2018.4.1.18 could allow unauthorized viewing of logs and files due to insufficient authorization checks. IBM X-Force ID: 218856. Additional Analyst Notes: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/6560048 - https://www.ibm.com/support/pages/node/6608598 - https://exchange.x
: - https://www.ibm.com/support/pages/node/6560048 - https://www.ibm.com/support/pages/node/6608598 - https://exchange.xforce.ibmcloud.com/vulnerabilities/218856
CVE ID: CVE-2022-22327 State: PUBLISHED Published: 2022-04-01T16:45:24.396189Z Last Updated: 2024-09-17T00:55:54.557Z Severity: MEDIUM (CVSS 5.9 CVSS:3.0/C:H/I:N/PR:N/AC:H/UI:N/AV:N/S:U/A:N/E:U/RL:O/RC:C) Vendors: IBM Products: UrbanCode Deploy Problem Types: Gain Privileges Description: IBM UrbanCode Deploy (UCD) 7.0.5, 7.1.0, 7.1.1, and 7.1.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 218859. Additional Analyst Notes: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/6568551 - https://exchange.xforce.ibmcloud.com/vulnerabilities/218859
CVE ID: CVE-2022-22328 State: PUBLISHED Published: 2022-04-01T16:45:25.953863Z Last Updated: 2024-09-16T20:48:12.104Z Severity: MEDIUM (CVSS 6.2 CVSS:3.0/A:N/PR:N/S:U/AV:L/UI:N/AC:L/I:H/C:N/RC:C/RL:O/E:U) Vendors: IBM Products: SterlingPartner Engagement Manager Problem Types: Gain Privileges Description: IBM SterlingPartner Engagement Manager 6.2.0 could allow a malicious user to elevate their privileges and perform unintended operations to another users data. IBM X-Force ID: 218871. Additional Analyst Notes: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/6568297 - https://exchange.xforce.ibmcloud.com/vulnerabilities/218871
CVE ID: CVE-2022-22329 State: PUBLISHED Published: 2022-09-13T20:45:22.231327Z Last Updated: 2024-09-16T19:01:39.529Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/A:N/C:L/I:N/S:U/PR:N/AC:L/AV:N/UI:R/RL:O/RC:C/E:U) Vendors: IBM Products: Control Desk Problem Types: Obtain Information Description: IBM Control Desk 7.6.1 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 219124. Additional Analyst Notes: - CVE
tacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 219124. Additional Analyst Notes: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/6619739 - https://exchange.xforce.ibmcloud.com/vulnerabilities/219124
CVE ID: CVE-2022-22330 State: PUBLISHED Published: 2022-09-13T20:45:23.168583Z Last Updated: 2024-09-16T16:54:01.304Z Severity: LOW (CVSS 3.7 CVSS:3.0/AV:N/UI:N/S:U/AC:H/PR:N/C:L/A:N/I:N/RC:C/E:U/RL:O) Vendors: IBM Products: Control Desk Problem Types: Obtain Information Description: IBM Control Desk 7.6.1 could allow a remote attacker to obtain sensitive information, caused by the failure to set the HTTPOnly flag. A remote attacker could exploit this vulnerability to obtain sensitive information from the cookie. IBM X-Force ID: 219126. Additional Analyst Notes: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/6619739 - https://exchange.xforce.ibmcloud.com/vulner
am Container: References: - https://www.ibm.com/support/pages/node/6619739 - https://exchange.xforce.ibmcloud.com/vulnerabilities/219126