Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-28679 State: PUBLISHED Published: 2022-07-18T18:41:54 Last Updated: 2024-08-03T06:03:52.511Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Foxit Products: PDF Reader Problem Types: CWE-416 Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.2.1.53537. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of Annotation objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object.
. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-16861. Additional Analyst Notes: - CVE Program Container: References: - https://www.foxit.com/support/security-bulletins.html - https://www.zerodayinitiative.com/advisories/ZDI-22-770/
CVE ID: CVE-2022-28680 State: PUBLISHED Published: 2022-07-18T18:42:01 Last Updated: 2024-08-03T06:03:52.475Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Foxit Products: PDF Reader Problem Types: CWE-416 Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.2.1.53537. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of Annotation objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object.
. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-16821. Additional Analyst Notes: - CVE Program Container: References: - https://www.foxit.com/support/security-bulletins.html - https://www.zerodayinitiative.com/advisories/ZDI-22-771/
CVE ID: CVE-2022-28681 State: PUBLISHED Published: 2022-07-18T18:42:06 Last Updated: 2024-08-03T06:03:52.077Z Severity: LOW (CVSS 2.5 CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: Foxit Products: PDF Reader Problem Types: CWE-125 Description: This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader 11.2.1.53537. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the deletePages method. By performing actions in JavaScript, an attacker can trigger a read past the end of an allocated object. An attacker can le
performing actions in JavaScript, an attacker can trigger a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-16825. Additional Analyst Notes: - CVE Program Container: References: - https://www.foxit.com/support/security-bulletins.html - https://www.zerodayinitiative.com/advisories/ZDI-22-772/
CVE ID: CVE-2022-28682 State: PUBLISHED Published: 2022-07-18T18:42:11 Last Updated: 2024-08-03T06:03:52.013Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Foxit Products: PDF Reader Problem Types: CWE-125 Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.2.1.53537. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of Doc objects. By performing actions in JavaScript, an attacker can trigger a read past the end of an allocated object. An attacker can leve
rforming actions in JavaScript, an attacker can trigger a read past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-16778. Additional Analyst Notes: - CVE Program Container: References: - https://www.foxit.com/support/security-bulletins.html - https://www.zerodayinitiative.com/advisories/ZDI-22-773/
CVE ID: CVE-2022-28683 State: PUBLISHED Published: 2022-07-18T18:42:17 Last Updated: 2024-08-03T06:03:52.997Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Foxit Products: PDF Reader Problem Types: CWE-416 Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.2.1.53537. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the deletePages method. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker
results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-16828. Additional Analyst Notes: - CVE Program Container: References: - https://www.foxit.com/support/security-bulletins.html - https://www.zerodayinitiative.com/advisories/ZDI-22-774/
CVE ID: CVE-2022-28684 State: PUBLISHED Published: 2022-08-03T15:20:46 Last Updated: 2024-08-03T06:03:52.478Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: DevExpress Products: DevExpress Problem Types: CWE-502 Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of DevExpress. Authentication is required to exploit this vulnerability. The specific flaw exists within the SafeBinaryFormatter library. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of
ult in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-16710. Additional Analyst Notes: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-22-872/
CVE ID: CVE-2022-28685 State: PUBLISHED Published: 2023-03-29T00:00:00.000Z Last Updated: 2025-02-18T16:02:25.382Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: AVEVA Products: Edge Problem Types: CWE-502 Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of AVEVA Edge 2020 SP2 Patch 0(4201.2111.1802.0000). User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of APP files. The issue results from the lack of proper validation of user-supplied data, which can result in deserializatio
PP files. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17212. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-22-1124/ - https://www.aveva.com/content/dam/aveva/documents/support/cyber-security-updates/SecurityBulletin_AVEVA-2022-005.pdf
CVE ID: CVE-2022-28686 State: PUBLISHED Published: 2023-03-29T00:00:00.000Z Last Updated: 2025-02-18T16:27:51.948Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: AVEVA Products: Edge Problem Types: CWE-427 Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of AVEVA Edge 2020 SP2 Patch 0(4201.2111.1802.0000). User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of APP files. The process loads a library from an unsecured location. An attacker can leverage this vulnerability to execut
APP files. The process loads a library from an unsecured location. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17114. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.aveva.com/content/dam/aveva/documents/support/cyber-security-updates/SecurityBulletin_AVEVA-2022-005.pdf - https://www.zerodayinitiative.com/advisories/ZDI-22-1125/
CVE ID: CVE-2022-28687 State: PUBLISHED Published: 2023-03-29T00:00:00.000Z Last Updated: 2025-02-18T16:37:10.404Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: AVEVA Products: Edge Problem Types: CWE-427 Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of AVEVA Edge 2020 SP2 Patch 0(4201.2111.1802.0000). User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of APP files. The process loads a library from an unsecured location. An attacker can leverage this vulnerability to execut
APP files. The process loads a library from an unsecured location. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-16257. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.aveva.com/content/dam/aveva/documents/support/cyber-security-updates/SecurityBulletin_AVEVA-2022-005.pdf - https://www.zerodayinitiative.com/advisories/ZDI-22-1126/
CVE ID: CVE-2022-28688 State: PUBLISHED Published: 2023-03-29T00:00:00.000Z Last Updated: 2025-02-18T16:38:11.238Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: AVEVA Products: Edge Problem Types: CWE-427 Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of AVEVA Edge 2020 SP2 Patch 0(4201.2111.1802.0000). User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of APP files. The process loads a library from an unsecured location. An attacker can leverage this vulnerability to execut
APP files. The process loads a library from an unsecured location. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17201. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.aveva.com/content/dam/aveva/documents/support/cyber-security-updates/SecurityBulletin_AVEVA-2022-005.pdf - https://www.zerodayinitiative.com/advisories/ZDI-22-1127/
CVE ID: CVE-2022-28689 State: PUBLISHED Published: 2022-11-09T17:35:37.094Z Last Updated: 2025-04-15T18:41:03.059Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: InHand Networks Products: InRouter302 Problem Types: CWE-489 Description: A leftover debug code vulnerability exists in the console support functionality of InHand Networks InRouter302 V3.5.45. A specially-crafted network request can lead to arbitrary command execution. An attacker can send a sequence of requests to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://inhandnetworks.com/upload/attachment/202210/25/InHand-PSA-2
am Container: - CISA ADP Vulnrichment: References: - https://inhandnetworks.com/upload/attachment/202210/25/InHand-PSA-2022-02.pdf - https://talosintelligence.com/vulnerability_reports/TALOS-2022-1521
CVE ID: CVE-2022-28690 State: PUBLISHED Published: 2022-06-01T13:40:56.210Z Last Updated: 2025-04-16T17:52:52.158Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Horner Automation Products: Horner Automation Cscape Csfont Problem Types: CWE-787 Description: The affected product is vulnerable to an out-of-bounds write via uninitialized pointer, which may allow an attacker to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-146-02
CVE ID: CVE-2022-28691 State: PUBLISHED Published: 2022-05-05T16:33:24.244462Z Last Updated: 2024-09-16T23:31:08.124Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: F5 Products: BIG-IP Problem Types: CWE-400 Description: On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5, 14.1.x versions prior to 14.1.4.6, and 13.1.x versions prior to 13.1.5, when a Real Time Streaming Protocol (RTSP) profile is configured on a virtual server, undisclosed traffic can cause an increase in Traffic Management Microkernel (TMM) resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated Additional
rce utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K37155600
CVE ID: CVE-2022-28692 State: PUBLISHED Published: 2022-07-04T06:56:09 Last Updated: 2024-08-03T06:03:52.018Z Vendors: Cybozu, Inc. Products: Cybozu Garoon Problem Types: Improper Input Validation Description: Improper input validation vulnerability in Scheduler of Cybozu Garoon 4.0.0 to 5.5.1 allows a remote authenticated attacker to alter the data of Scheduler. Additional Analyst Notes: - CVE Program Container: References: - https://cs.cybozu.co.jp/2022/007429.html - https://jvn.jp/en/jp/JVN73897863/index.html
CVE ID: CVE-2022-28693 State: PUBLISHED Published: 2025-02-14T20:50:54.450Z Last Updated: 2025-02-14T20:55:26.699Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: n/a Products: Intel(R) Processors Problem Types: Information Disclosure, CWE-420 Description: Unprotected alternative channel of return branch target prediction in some Intel(R) Processors may allow an authorized user to potentially enable information disclosure via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://intel.com/content/www/us/en/security-center/advisory/intel-sa-00707.html
CVE ID: CVE-2022-28694 State: REJECTED Published: N/A Last Updated: 2025-05-28T18:19:19.258Z Description: No description available.
CVE ID: CVE-2022-28695 State: PUBLISHED Published: 2022-05-05T16:34:25.946676Z Last Updated: 2024-09-17T02:31:19.942Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: F5 Products: BIG-IP AFM Problem Types: CWE-20 Description: On F5 BIG-IP AFM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, and 13.1.x versions prior to 13.1.5, an authenticated attacker with high privileges can upload a maliciously crafted file to the BIG-IP AFM Configuration utility, which allows an attacker to run arbitrary commands. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated Additional An
ary commands. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K08510472
CVE ID: CVE-2022-28696 State: PUBLISHED Published: 2022-08-18T19:57:53.000Z Last Updated: 2025-05-05T16:21:40.833Z Vendors: n/a Products: Intel(R) Distribution for Python Problem Types: escalation of privilege Description: Uncontrolled search path in the Intel(R) Distribution for Python before version 2022.0.3 may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00684.html
CVE ID: CVE-2022-28697 State: PUBLISHED Published: 2022-08-18T00:00:00.000Z Last Updated: 2025-05-05T16:21:23.467Z Vendors: n/a Products: Intel(R) AMT and Intel(R) Standard Manageability Problem Types: escalation of privilege Description: Improper access control in firmware for Intel(R) AMT and Intel(R) Standard Manageability may allow an unauthenticated user to potentially enable escalation of privilege via physical access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00709.html - https://security.netapp.com/advisory/ntap-20221014-0004/
CVE ID: CVE-2022-28698 State: REJECTED Published: N/A Last Updated: 2025-05-28T18:19:20.451Z Description: No description available.
CVE ID: CVE-2022-28699 State: PUBLISHED Published: 2023-05-10T13:16:46.127Z Last Updated: 2025-01-27T18:09:29.351Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) NUC BIOS firmware Problem Types: escalation of privilege, CWE-20 Description: Improper input validation for some Intel(R) NUC BIOS firmware may allow a privileged user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00777.html
CVE ID: CVE-2022-28700 State: PUBLISHED Published: 2022-07-21T17:23:23.822Z Last Updated: 2025-02-20T20:17:01.112Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: GiveWP Products: GiveWP (WordPress plugin) Problem Types: Arbitrary File Creation Description: Authenticated Arbitrary File Creation via Export function vulnerability in GiveWP's GiveWP plugin <= 2.20.2 at WordPress. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/give/#developers - https://patchstack.com/database/vulnerability/give/wordpress-givewp-plugin-2-20-2-authenticated-arbitrary-file-creation-via-export-function-vulne
tabase/vulnerability/give/wordpress-givewp-plugin-2-20-2-authenticated-arbitrary-file-creation-via-export-function-vulnerability
CVE ID: CVE-2022-28701 State: PUBLISHED Published: 2022-05-05T16:35:15.967397Z Last Updated: 2024-09-17T02:15:51.167Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: F5 Products: BIG-IP Problem Types: CWE-400 Description: On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, when the stream profile is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K99123750
CVE ID: CVE-2022-28702 State: PUBLISHED Published: 2022-05-31T17:53:54.324806Z Last Updated: 2024-09-17T00:30:55.177Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H) Vendors: ABB Products: e-Design Problem Types: CWE-276 Description: Incorrect Default Permissions vulnerability in ABB e-Design allows attacker to install malicious software executing with SYSTEM permissions violating confidentiality, integrity, and availability of the target machine. Additional Analyst Notes: - CVE Program Container: References: - https://search.abb.com/library/Download.aspx?DocumentID=2%20CMT%200%200%206%200%208%206&LanguageCode=en&DocumentPartId=&Action=Launch
CVE ID: CVE-2022-28703 State: PUBLISHED Published: 2022-12-19T10:00:14.221Z Last Updated: 2025-04-15T18:39:02.214Z Severity: CRITICAL (CVSS 9.1 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Lansweeper Products: lansweeper Problem Types: CWE-80 Description: A stored cross-site scripting vulnerability exists in the HdConfigActions.aspx altertextlanguages functionality of Lansweeper lansweeper 10.1.1.0. A specially-crafted HTTP request can lead to arbitrary Javascript code injection. An attacker can send an HTTP request to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_rep
t Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2022-1532
CVE ID: CVE-2022-28704 State: PUBLISHED Published: 2022-06-13T04:50:32 Last Updated: 2024-08-03T06:03:52.147Z Vendors: Rakuten Mobile, Inc. Products: Rakuten Casa Problem Types: Improper Access Control Description: Improper access control vulnerability in Rakuten Casa version AP_F_V1_4_1 or AP_F_V2_0_0 allows a remote attacker to log in with the root privilege and perform an arbitrary operation if the product is in its default settings in which is set to accept SSH connections from the WAN side, and is also connected to the Internet with the authentication information unchanged from the default settings. Additional Analyst Notes: - CVE Program Container: References: - https://network.mobile.
nged from the default settings. Additional Analyst Notes: - CVE Program Container: References: - https://network.mobile.rakuten.co.jp/information/news/product/1033/ - https://jvn.jp/en/jp/JVN46892984/index.html
CVE ID: CVE-2022-28705 State: PUBLISHED Published: 2022-05-05T16:35:58.249651Z Last Updated: 2024-09-16T19:51:17.460Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: F5 Products: BIG-IP Problem Types: CWE-190 Description: On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, and 13.1.x versions prior to 13.1.5, on platforms with an ePVA and the pva.fwdaccel BigDB variable enabled, undisclosed requests to a virtual server with a FastL4 profile that has ePVA acceleration enabled can cause the Traffic Management Microkernel (TMM) process to terminate. Note: Software versions which have reached End of
n cause the Traffic Management Microkernel (TMM) process to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K52340447
CVE ID: CVE-2022-28706 State: PUBLISHED Published: 2022-05-05T16:37:03.542496Z Last Updated: 2024-09-17T01:26:21.319Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: F5 Products: BIG-IP Problem Types: CWE-754 Description: On F5 BIG-IP 16.1.x versions prior to 16.1.2 and 15.1.x versions prior to 15.1.5.1, when the DNS resolver configuration is used, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K03755971
CVE ID: CVE-2022-28707 State: PUBLISHED Published: 2022-05-05T16:37:48.043480Z Last Updated: 2024-09-17T03:03:23.310Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: F5 Products: BIG-IP Problem Types: CWE-79 Description: On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, and 14.1.x versions prior to 14.1.4.6, a stored cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility (also referred to as the BIG-IP TMUI) that allows an attacker to execute JavaScript in the context of the currently logged-in user. Note: Software versions which have reached End of Technical Support (EoTS) are
context of the currently logged-in user. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K70300233