Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
rsing of IFC files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-16367. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0006 - https://www.zerodayinitiative.com/advisories/ZDI-22-606/
CVE ID: CVE-2022-28316 State: PUBLISHED Published: 2023-03-29T00:00:00.000Z Last Updated: 2025-02-18T16:31:37.755Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Bentley Products: MicroStation CONNECT Problem Types: CWE-787 Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.02.34. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of IFC files. Crafted data in an IFC file can trigger a write past the end of an allocated buffer. An attacker can
rsing of IFC files. Crafted data in an IFC file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-16368. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0006 - https://www.zerodayinitiative.com/advisories/ZDI-22-607/
CVE ID: CVE-2022-28317 State: PUBLISHED Published: 2023-03-29T00:00:00.000Z Last Updated: 2025-02-18T16:32:58.090Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Bentley Products: MicroStation CONNECT Problem Types: CWE-457 Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.02.34. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of IFC files. The issue results from the lack of proper initialization of memory prior to accessing it. An attacke
rsing of IFC files. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-16369. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0006 - https://www.zerodayinitiative.com/advisories/ZDI-22-604/
CVE ID: CVE-2022-28318 State: PUBLISHED Published: 2023-03-29T00:00:00.000Z Last Updated: 2025-04-04T20:37:23.764Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Bentley Products: MicroStation CONNECT Problem Types: CWE-787 Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.02.34. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of IFC files. Crafted data in an IFC file can trigger a write past the end of an allocated buffer. An attacker can
rsing of IFC files. Crafted data in an IFC file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-16379. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0006 - https://www.zerodayinitiative.com/advisories/ZDI-22-618/
CVE ID: CVE-2022-28319 State: PUBLISHED Published: 2023-03-29T00:00:00.000Z Last Updated: 2025-02-18T17:35:05.854Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Bentley Products: MicroStation CONNECT Problem Types: CWE-457 Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.02.034. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of 3DM files. The issue results from the lack of proper initialization of memory prior to accessing it. An attack
arsing of 3DM files. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-16340. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-22-591/ - https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0002
CVE ID: CVE-2022-28320 State: PUBLISHED Published: 2023-03-29T00:00:00.000Z Last Updated: 2025-02-18T16:58:09.837Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Bentley Products: View Problem Types: CWE-457 Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.16.02.022. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of 3DM files. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this vulnerabili
esults from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-16282. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0002 - https://www.zerodayinitiative.com/advisories/ZDI-22-597/
CVE ID: CVE-2022-28321 State: PUBLISHED Published: 2022-09-19T21:10:22.000Z Last Updated: 2025-05-29T15:30:36.688Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Linux-PAM package before 1.5.2-6.1 for openSUSE Tumbleweed allows authentication bypass for SSH logins. The pam_access.so module doesn't correctly restrict login if a user tries to connect from an IP address that is not resolvable via DNS. In such conditions, a user with denied access to a machine can still get access. NOTE: the relevance of this issue is largely limited to openSUSE Tumbleweed and openSUSE Factory; it does not affect Linux-PAM upstream. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vu
penSUSE Factory; it does not affect Linux-PAM upstream. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://download.opensuse.org/source/distribution/openSUSE-current/repo/oss/src/ - https://www.suse.com/security/cve/CVE-2022-28321.html - https://bugzilla.suse.com/show_bug.cgi?id=1197654
CVE ID: CVE-2022-28323 State: PUBLISHED Published: 2022-04-30T15:05:46 Last Updated: 2024-08-03T05:48:37.903Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in MediaWiki through 1.37.2. The SecurePoll extension allows a leak because sorting by timestamp is supported, Additional Analyst Notes: - CVE Program Container: References: - https://phabricator.wikimedia.org/T298434 - https://gerrit.wikimedia.org/r/q/I9d3b9a942ea71d777ec32121fa36262f549d283d - https://gerrit.wikimedia.org/r/q/93758c4c13b972d240a6313e0472df1667118893
CVE ID: CVE-2022-28327 State: PUBLISHED Published: 2022-04-20T00:00:00 Last Updated: 2024-08-03T05:48:38.092Z Vendors: n/a Products: n/a Problem Types: n/a Description: The generic P-256 feature in crypto/elliptic in Go before 1.17.9 and 1.18.x before 1.18.1 allows a panic via long scalar input. Additional Analyst Notes: - CVE Program Container: References: - https://groups.google.com/g/golang-announce - https://groups.google.com/g/golang-announce/c/oecdBNLOml8 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/42TYZC4OAY54TO75FBEFAPV5G7O4D5TM/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NY
5FBEFAPV5G7O4D5TM/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NY6GEAJMNKKMU5H46QO4D7D6A24KSPXE/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F3BMW5QGX53CMIJIZWKXFKBJX2C5GWTY/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RCRSABD6CUDIZULZPZL5BJ3ET3A2NEJP/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZY2SLWOQR4ZURQ7UBRZ7JIX6H6F5JHJR/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z55VUVGO7E5PJFXIOVAY373NZRHBNCI5/ - https://securi
.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z55VUVGO7E5PJFXIOVAY373NZRHBNCI5/ - https://security.gentoo.org/glsa/202208-02 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RQXU752ALW53OJAF5MG3WMR5CCZVLWW6/ - https://security.netapp.com/advisory/ntap-20220915-0010/ - https://cert-portal.siemens.com/productcert/pdf/ssa-744259.pdf
CVE ID: CVE-2022-28328 State: PUBLISHED Published: 2022-04-12T09:08:06 Last Updated: 2024-08-03T05:48:38.169Z Vendors: Siemens Products: SCALANCE W1788-1 M12, SCALANCE W1788-2 EEC M12, SCALANCE W1788-2 M12, SCALANCE W1788-2IA M12 Problem Types: CWE-20 Description: A vulnerability has been identified in SCALANCE W1788-1 M12 (All versions < V3.0.0), SCALANCE W1788-2 EEC M12 (All versions < V3.0.0), SCALANCE W1788-2 M12 (All versions < V3.0.0), SCALANCE W1788-2IA M12 (All versions < V3.0.0). Affected devices do not properly handle malformed Multicast LLC frames. This could allow an attacker to trigger a denial of service condition. Additional Analyst Notes: - CVE Program Container: References:
ow an attacker to trigger a denial of service condition. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-392912.pdf
CVE ID: CVE-2022-28329 State: PUBLISHED Published: 2022-04-12T09:08:07 Last Updated: 2024-08-03T05:48:38.032Z Vendors: Siemens Products: SCALANCE W1788-1 M12, SCALANCE W1788-2 EEC M12, SCALANCE W1788-2 M12, SCALANCE W1788-2IA M12 Problem Types: CWE-20 Description: A vulnerability has been identified in SCALANCE W1788-1 M12 (All versions < V3.0.0), SCALANCE W1788-2 EEC M12 (All versions < V3.0.0), SCALANCE W1788-2 M12 (All versions < V3.0.0), SCALANCE W1788-2IA M12 (All versions < V3.0.0). Affected devices do not properly handle malformed TCP packets received over the RemoteCapture feature. This could allow an attacker to lead to a denial of service condition which only affects the port used
Capture feature. This could allow an attacker to lead to a denial of service condition which only affects the port used by the RemoteCapture feature. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-392912.pdf
CVE ID: CVE-2022-28330 State: PUBLISHED Published: 2022-06-08T10:00:34 Last Updated: 2024-08-03T05:48:37.891Z Vendors: Apache Software Foundation Products: Apache HTTP Server Problem Types: CWE-125 Description: Apache HTTP Server 2.4.53 and earlier on Windows may read beyond bounds when configured to process requests with the mod_isapi module. Additional Analyst Notes: - CVE Program Container: References: - https://httpd.apache.org/security/vulnerabilities_24.html - http://www.openwall.com/lists/oss-security/2022/06/08/3 - https://security.netapp.com/advisory/ntap-20220624-0005/
CVE ID: CVE-2022-28331 State: PUBLISHED Published: 2023-01-31T15:55:21.488Z Last Updated: 2025-03-27T14:31:30.494Z Vendors: Apache Software Foundation Products: Apache Portable Runtime (APR) Problem Types: CWE-190 Description: On Windows, Apache Portable Runtime 1.7.0 and earlier may write beyond the end of a stack based buffer in apr_socket_sendv(). This is a result of integer overflow. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/5pfdfn7h0vsdo5xzjn97vghp0x42jj2r
CVE ID: CVE-2022-28339 State: PUBLISHED Published: 2025-02-22T20:51:10.611Z Last Updated: 2025-02-24T12:25:17.568Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Trend Micro, Inc. Products: Trend Micro HouseCall for Home Networks Description: Trend Micro HouseCall for Home Networks version 5.3.1302 and below contains an uncontrolled search patch element vulnerability that could allow an attacker with low user privileges to create a malicious DLL that could lead to escalated privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpcenter.trendmicro.com/en-us/article/tmka-21734 - https://www.zerodayinitiative.com/advisories/ZDI-2
ences: - https://helpcenter.trendmicro.com/en-us/article/tmka-21734 - https://www.zerodayinitiative.com/advisories/ZDI-22-620/
CVE ID: CVE-2022-28345 State: PUBLISHED Published: 2022-04-15T05:28:57 Last Updated: 2024-08-03T05:56:14.765Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Signal app before 5.34 for iOS allows URI spoofing via RTLO injection. It incorrectly renders RTLO encoded URLs beginning with a non-breaking space, when there is a hash character in the URL. This technique allows a remote unauthenticated attacker to send legitimate looking links, appearing to be any website URL, by abusing the non-http/non-https automatic rendering of URLs. An attacker can spoof, for example, example.com, and masquerade any URL with a malicious destination. An attacker requires a subdomain such as gepj,
ample, example.com, and masquerade any URL with a malicious destination. An attacker requires a subdomain such as gepj, txt, fdp, or xcod, which would appear backwards as jpeg, txt, pdf, and docx respectively. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/zadewg/RIUS - https://sick.codes/sick-2022-42 - https://github.com/sickcodes/security/blob/master/advisories/SICK-2022-42.md - https://blog.malwarebytes.com/social-engineering/2022/03/uri-spoofing-flaw-could-phish-whatsapp-signal-instagram-and-imessage-users/
CVE ID: CVE-2022-28346 State: PUBLISHED Published: 2022-04-12T00:00:00.000Z Last Updated: 2025-02-13T16:32:33.638Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. QuerySet.annotate(), aggregate(), and extra() methods are subject to SQL injection in column aliases via a crafted dictionary (with dictionary expansion) as the passed **kwargs. Additional Analyst Notes: - CVE Program Container: References: - https://groups.google.com/forum/#%21forum/django-announce - https://docs.djangoproject.com/en/4.0/releases/security/ - http://www.openwall.com/lists/oss-security/2022/04/11/1 - https://www.
ocs.djangoproject.com/en/4.0/releases/security/ - http://www.openwall.com/lists/oss-security/2022/04/11/1 - https://www.djangoproject.com/weblog/2022/apr/11/security-releases/ - https://lists.debian.org/debian-lts-announce/2022/04/msg00013.html - https://security.netapp.com/advisory/ntap-20220609-0002/ - https://www.debian.org/security/2022/dsa-5254 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HWY6DQWRVBALV73BPUVBXC3QIYUM24IK/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LTZVAKU5ALQWOKFTPISE257VCVIYGFQI/
CVE ID: CVE-2022-28347 State: PUBLISHED Published: 2022-04-12T00:00:00.000Z Last Updated: 2025-02-13T16:32:34.174Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection issue was discovered in QuerySet.explain() in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. This occurs by passing a crafted dictionary (with dictionary expansion) as the **options argument, and placing the injection payload in an option name. Additional Analyst Notes: - CVE Program Container: References: - https://groups.google.com/forum/#%21forum/django-announce - https://docs.djangoproject.com/en/4.0/releases/security/ - http://www.openwall.com/lists/oss-security/2022/04/11/1 - htt
https://docs.djangoproject.com/en/4.0/releases/security/ - http://www.openwall.com/lists/oss-security/2022/04/11/1 - https://www.djangoproject.com/weblog/2022/apr/11/security-releases/ - https://www.debian.org/security/2022/dsa-5254 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HWY6DQWRVBALV73BPUVBXC3QIYUM24IK/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LTZVAKU5ALQWOKFTPISE257VCVIYGFQI/
CVE ID: CVE-2022-28348 State: PUBLISHED Published: 2022-05-19T01:01:06 Last Updated: 2024-08-03T05:56:14.891Z Vendors: n/a Products: n/a Problem Types: n/a Description: Arm Mali GPU Kernel Driver (Midgard r4p0 through r31p0, Bifrost r0p0 through r36p0 before r37p0, and Valhall r19p0 through r36p0 before r37p0) allows improper GPU memory operations to reach a use-after-free situation. Additional Analyst Notes: - CVE Program Container: References: - https://developer.arm.com/support/arm-security-updates - https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities
CVE ID: CVE-2022-28349 State: PUBLISHED Published: 2022-05-19T01:04:36 Last Updated: 2024-08-03T05:56:14.859Z Vendors: n/a Products: n/a Problem Types: n/a Description: Arm Mali GPU Kernel Driver has a use-after-free: Midgard r28p0 through r29p0 before r30p0, Bifrost r17p0 through r23p0 before r24p0, and Valhall r19p0 through r23p0 before r24p0. Additional Analyst Notes: - CVE Program Container: References: - https://developer.arm.com/support/arm-security-updates - https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities
CVE ID: CVE-2022-28350 State: PUBLISHED Published: 2022-05-19T01:04:14 Last Updated: 2024-08-03T05:56:14.915Z Vendors: n/a Products: n/a Problem Types: n/a Description: Arm Mali GPU Kernel Driver allows improper GPU operations in Valhall r29p0 through r36p0 before r37p0 to reach a use-after-free situation. Additional Analyst Notes: - CVE Program Container: References: - https://developer.arm.com/support/arm-security-updates - https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities
CVE ID: CVE-2022-28352 State: PUBLISHED Published: 2022-04-02T16:36:02 Last Updated: 2024-08-03T05:56:14.871Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AC:L/AV:N/A:N/C:L/I:N/PR:N/S:U/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: WeeChat (aka Wee Enhanced Environment for Chat) 3.2 to 3.4 before 3.4.1 does not properly verify the TLS certificate of the server, after certain GnuTLS options are changed, which allows man-in-the-middle attackers to spoof a TLS chat server via an arbitrary certificate. NOTE: this only affects situations where weechat.network.gnutls_ca_system or weechat.network.gnutls_ca_user is changed without a WeeChat restart. Additional Analyst Notes: - CVE Program
_system or weechat.network.gnutls_ca_user is changed without a WeeChat restart. Additional Analyst Notes: - CVE Program Container: References: - https://weechat.org/doc/security/WSA-2022-1/ - https://github.com/weechat/weechat/issues/1763
CVE ID: CVE-2022-28353 State: PUBLISHED Published: 2023-04-16T00:00:00.000Z Last Updated: 2025-02-06T19:09:37.891Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the External Redirect Warning Plugin 1.3 for MyBB, the redirect URL (aka external.php?url=) is vulnerable to XSS. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://community.mybb.com/mods.php?action=view&pid=493 - http://packetstormsecurity.com/files/171403/MyBB-External-Redirect-Warning-1.3-Cross-Site-Scripting.html
CVE ID: CVE-2022-28354 State: PUBLISHED Published: 2023-04-24T00:00:00.000Z Last Updated: 2025-02-04T16:40:32.925Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the Active Threads Plugin 1.3.0 for MyBB, the activethreads.php date parameter is vulnerable to XSS when setting a time period. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://community.mybb.com/mods.php?action=view&pid=1336 - http://packetstormsecurity.com/files/171402/MyBB-Active-Threads-1.3.0-Cross-Site-Scripting.html
CVE ID: CVE-2022-28355 State: PUBLISHED Published: 2022-04-02T20:22:16 Last Updated: 2024-08-03T05:56:14.853Z Vendors: n/a Products: n/a Problem Types: n/a Description: randomUUID in Scala.js before 1.10.0 generates predictable values. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/scala-js/scala-js/issues/4657 - https://github.com/scala-js/scala-js/releases - https://www.scala-js.org/news/2022/04/04/announcing-scalajs-1.10.0/ - https://github.com/scala-js/scala-js/security/advisories/GHSA-j2f9-w8wh-9ww4
CVE ID: CVE-2022-28356 State: PUBLISHED Published: 2022-04-02T20:36:34.000Z Last Updated: 2025-05-05T16:22:03.799Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the Linux kernel before 5.17.1, a refcount leak bug was found in net/llc/af_llc.c. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/torvalds/linux/commit/764f4eb6846f5475f1244767d24d25dd86528a4a - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.17.1 - http://www.openwall.com/lists/oss-security/2022/04/06/1 - https://www.debian.org/security/2022/dsa-5127 - https://security.netapp.com/advisory/ntap-20220506-0006/ - https://lists.debian.org/debian-lts-a
ecurity/2022/dsa-5127 - https://security.netapp.com/advisory/ntap-20220506-0006/ - https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html - https://www.debian.org/security/2022/dsa-5173
CVE ID: CVE-2022-28357 State: PUBLISHED Published: 2023-09-19T00:00:00 Last Updated: 2024-09-25T14:53:01.458Z Vendors: n/a Products: n/a Problem Types: n/a Description: NATS nats-server 2.2.0 through 2.7.4 allows directory traversal because of an unintended path to a management action from a management account. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/nats-io/nats-server/releases - https://advisories.nats.io/CVE/CVE-2022-28357.txt
CVE ID: CVE-2022-28363 State: PUBLISHED Published: 2022-04-09T16:26:45 Last Updated: 2024-08-03T05:56:15.115Z Vendors: n/a Products: n/a Problem Types: n/a Description: Reprise License Manager 14.2 is affected by a reflected cross-site scripting vulnerability (XSS) in the /goform/login_process username parameter via GET. No authentication is required. Additional Analyst Notes: - CVE Program Container: References: - https://www.reprisesoftware.com/products/software-license-management.php - http://packetstormsecurity.com/files/166647/Reprise-License-Manager-14.2-Cross-Site-Scripting-Information-Disclosure.html - https://seclists.org/fulldisclosure/2022/Apr/1
CVE ID: CVE-2022-28364 State: PUBLISHED Published: 2022-04-09T16:27:44 Last Updated: 2024-08-03T05:56:14.967Z Vendors: n/a Products: n/a Problem Types: n/a Description: Reprise License Manager 14.2 is affected by a reflected cross-site scripting vulnerability (XSS) in the /goform/rlmswitchr_process file parameter via GET. Authentication is required. Additional Analyst Notes: - CVE Program Container: References: - https://www.reprisesoftware.com/products/software-license-management.php - http://packetstormsecurity.com/files/166647/Reprise-License-Manager-14.2-Cross-Site-Scripting-Information-Disclosure.html - https://seclists.org/fulldisclosure/2022/Apr/1