Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-22952 State: PUBLISHED Published: 2022-03-23T19:46:47 Last Updated: 2024-08-03T03:28:42.445Z Vendors: n/a Products: VMware Carbon Black App Control (AppC) Problem Types: HFile upload vulnerability in VMware Carbon Black App Control Description: VMware Carbon Black App Control (8.5.x prior to 8.5.14, 8.6.x prior to 8.6.6, 8.7.x prior to 8.7.4 and 8.8.x prior to 8.8.2) contains a file upload vulnerability. A malicious actor with administrative access to the VMware App Control administration interface may be able to execute code on the Windows instance where AppC Server is installed by uploading a specially crafted file. Additional Analyst Notes: - CVE Program Container: Refere
ppC Server is installed by uploading a specially crafted file. Additional Analyst Notes: - CVE Program Container: References: - https://www.vmware.com/security/advisories/VMSA-2022-0008.html
CVE ID: CVE-2022-22953 State: PUBLISHED Published: 2022-06-16T15:54:54 Last Updated: 2024-08-03T03:28:42.834Z Vendors: n/a Products: VMware HCX Problem Types: VMware HCX update addresses an information disclosure vulnerability Description: VMware HCX update addresses an information disclosure vulnerability. A malicious actor with network user access to the VMware HCX appliance may be able to gain access to sensitive information. Additional Analyst Notes: - CVE Program Container: References: - https://www.vmware.com/security/advisories/VMSA-2022-0017.html
CVE ID: CVE-2022-22954 State: PUBLISHED Published: 2022-04-11T19:37:39.000Z Last Updated: 2025-10-21T23:15:42.493Z Vendors: n/a Products: VMware Workspace ONE Access and Identity Manager Problem Types: Remote code execution Description: VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side template injection. A malicious actor with network access can trigger a server-side template injection that may result in remote code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.vmware.com/security/advisories/VMSA-2022-0011.html - http://packetstormsecurity.com/files/166935/VMwar
es: - https://www.vmware.com/security/advisories/VMSA-2022-0011.html - http://packetstormsecurity.com/files/166935/VMware-Workspace-ONE-Access-Template-Injection-Command-Execution.html
CVE ID: CVE-2022-22955 State: PUBLISHED Published: 2022-04-13T17:05:58 Last Updated: 2024-08-03T03:28:42.571Z Vendors: n/a Products: VMware Workspace ONE Access Problem Types: Authentication bypass Description: VMware Workspace ONE Access has two authentication bypass vulnerabilities (CVE-2022-22955 & CVE-2022-22956) in the OAuth2 ACS framework. A malicious actor may bypass the authentication mechanism and execute any operation due to exposed endpoints in the authentication framework. Additional Analyst Notes: - CVE Program Container: References: - https://www.vmware.com/security/advisories/VMSA-2022-0011.html
CVE ID: CVE-2022-22956 State: PUBLISHED Published: 2022-04-13T00:00:00.000Z Last Updated: 2025-02-13T16:28:57.648Z Vendors: n/a Products: VMware Workspace ONE Access Problem Types: Authentication bypass Description: VMware Workspace ONE Access has two authentication bypass vulnerabilities (CVE-2022-22955 & CVE-2022-22956) in the OAuth2 ACS framework. A malicious actor may bypass the authentication mechanism and execute any operation due to exposed endpoints in the authentication framework. Additional Analyst Notes: - CVE Program Container: References: - https://www.vmware.com/security/advisories/VMSA-2022-0011.html - http://packetstormsecurity.com/files/171918/Mware-Workspace-ONE-Remote-Code
om/security/advisories/VMSA-2022-0011.html - http://packetstormsecurity.com/files/171918/Mware-Workspace-ONE-Remote-Code-Execution.html - http://packetstormsecurity.com/files/171918/VMware-Workspace-ONE-Remote-Code-Execution.html
CVE ID: CVE-2022-22957 State: PUBLISHED Published: 2022-04-13T00:00:00.000Z Last Updated: 2025-02-13T16:28:58.209Z Vendors: n/a Products: VMware Workspace ONE Access, Identity Manager and vRealize Automation. Problem Types: Remote code execution Description: VMware Workspace ONE Access, Identity Manager and vRealize Automation contain two remote code execution vulnerabilities (CVE-2022-22957 & CVE-2022-22958). A malicious actor with administrative access can trigger deserialization of untrusted data through malicious JDBC URI which may result in remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.vmware.com/security/advisories/VMSA-2022-0011.ht
ional Analyst Notes: - CVE Program Container: References: - https://www.vmware.com/security/advisories/VMSA-2022-0011.html - http://packetstormsecurity.com/files/171918/Mware-Workspace-ONE-Remote-Code-Execution.html - http://packetstormsecurity.com/files/171918/VMware-Workspace-ONE-Remote-Code-Execution.html
CVE ID: CVE-2022-22958 State: PUBLISHED Published: 2022-04-13T17:05:58 Last Updated: 2024-08-03T03:28:42.552Z Vendors: n/a Products: VMware Workspace ONE Access, Identity Manager and vRealize Automation. Problem Types: Remote code execution Description: VMware Workspace ONE Access, Identity Manager and vRealize Automation contain two remote code execution vulnerabilities (CVE-2022-22957 & CVE-2022-22958). A malicious actor with administrative access can trigger deserialization of untrusted data through malicious JDBC URI which may result in remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.vmware.com/security/advisories/VMSA-2022-0011.html
CVE ID: CVE-2022-22959 State: PUBLISHED Published: 2022-04-13T17:05:54 Last Updated: 2024-08-03T03:28:42.618Z Vendors: n/a Products: VMware Workspace ONE Access, Identity Manager and vRealize Automation Problem Types: Cross site request forgery Description: VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a cross site request forgery vulnerability. A malicious actor can trick a user through a cross site request forgery to unintentionally validate a malicious JDBC URI. Additional Analyst Notes: - CVE Program Container: References: - https://www.vmware.com/security/advisories/VMSA-2022-0011.html
CVE ID: CVE-2022-22960 State: PUBLISHED Published: 2022-04-13T00:00:00.000Z Last Updated: 2025-10-21T23:15:42.338Z Vendors: n/a Products: VMware Workspace ONE Access, Identity Manager and vRealize Automation Problem Types: Privilege escalation Description: VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a privilege escalation vulnerability due to improper permissions in support scripts. A malicious actor with local access can escalate privileges to 'root'. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.vmware.com/security/advisories/VMSA-2022-0011.html - http://packetstormsecurity.com/files/171918/Mware-Work
https://www.vmware.com/security/advisories/VMSA-2022-0011.html - http://packetstormsecurity.com/files/171918/Mware-Workspace-ONE-Remote-Code-Execution.html - http://packetstormsecurity.com/files/171918/VMware-Workspace-ONE-Remote-Code-Execution.html - http://packetstormsecurity.com/files/171935/VMware-Workspace-ONE-Access-Privilege-Escalation.html
CVE ID: CVE-2022-22961 State: PUBLISHED Published: 2022-04-13T17:05:56 Last Updated: 2024-08-03T03:28:42.477Z Vendors: n/a Products: VMware Workspace ONE Access, Identity Manager and vRealize Automation Problem Types: Information disclosure Description: VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an information disclosure vulnerability due to returning excess information. A malicious actor with remote access may leak the hostname of the target system. Successful exploitation of this issue can lead to targeting victims. Additional Analyst Notes: - CVE Program Container: References: - https://www.vmware.com/security/advisories/VMSA-2022-0011.html
CVE ID: CVE-2022-22962 State: PUBLISHED Published: 2022-04-11T19:38:28 Last Updated: 2024-08-03T03:28:42.567Z Vendors: VMware Products: VMware Horizon Agent for Linux Problem Types: Local privilege escalation due to vulnerable symbolic link Description: VMware Horizon Agent for Linux (prior to 22.x) contains a local privilege escalation as a user is able to change the default shared folder location due to a vulnerable symbolic link. Successful exploitation can result in linking to a root owned file. Additional Analyst Notes: - CVE Program Container: References: - https://www.vmware.com/security/advisories/VMSA-2022-0012.html
CVE ID: CVE-2022-22963 State: PUBLISHED Published: 2022-04-01T00:00:00.000Z Last Updated: 2025-10-21T23:15:42.941Z Vendors: n/a Products: Spring Cloud Function Problem Types: CWE-94 Description: In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tanzu.vmware.com/security/cve-2022-22963 - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-java-spring-scf
security/cve-2022-22963 - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-java-spring-scf-rce-DQrHhJxH - https://www.oracle.com/security-alerts/cpuapr2022.html - https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0005 - https://www.oracle.com/security-alerts/cpujul2022.html - http://packetstormsecurity.com/files/173430/Spring-Cloud-3.2.2-Remote-Command-Execution.html
CVE ID: CVE-2022-22964 State: PUBLISHED Published: 2022-04-11T19:38:29 Last Updated: 2024-08-03T03:28:42.580Z Vendors: VMware Products: VMware Horizon Agent for Linux Problem Types: Local privilege escalation due to vulnerable configuration file Description: VMware Horizon Agent for Linux (prior to 22.x) contains a local privilege escalation that allows a user to escalate to root due to a vulnerable configuration file. Additional Analyst Notes: - CVE Program Container: References: - https://www.vmware.com/security/advisories/VMSA-2022-0012.html
CVE ID: CVE-2022-22965 State: PUBLISHED Published: 2022-04-01T22:17:30.000Z Last Updated: 2025-10-21T23:15:42.792Z Vendors: n/a Products: Spring Framework Problem Types: CWE-94 Description: A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Re
nd there may be other ways to exploit it. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tanzu.vmware.com/security/cve-2022-22965 - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-java-spring-rce-Zx9GUc67 - https://www.oracle.com/security-alerts/cpuapr2022.html - https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0005 - http://packetstormsecurity.com/files/166713/Spring4Shell-Code-Execution.html - https://cert-portal.siemens.com/productcert/pdf/ssa-254054.pdf - https://www.oracle.com/security-alerts/cpujul2022.html - http://packetstormsecurity.com/files/167011/Spring4Shell-Spring-Framework-Class-Propert
ecurity-alerts/cpujul2022.html - http://packetstormsecurity.com/files/167011/Spring4Shell-Spring-Framework-Class-Property-Remote-Code-Execution.html
CVE ID: CVE-2022-22966 State: PUBLISHED Published: 2022-04-14T20:05:49 Last Updated: 2024-08-03T03:28:42.631Z Vendors: n/a Products: VMware Cloud Director Problem Types: Remote code execution Description: An authenticated, high privileged malicious actor with network access to the VMware Cloud Director tenant or provider may be able to exploit a remote code execution vulnerability to gain access to the server. Additional Analyst Notes: - CVE Program Container: References: - https://www.vmware.com/security/advisories/VMSA-2022-0013.html
CVE ID: CVE-2022-22967 State: PUBLISHED Published: 2022-06-22T00:00:00.000Z Last Updated: 2025-05-05T16:28:14.931Z Vendors: n/a Products: SaltStack Salt Problem Types: PAM auth fails to reject locked accounts. Description: An issue was discovered in SaltStack Salt in versions before 3002.9, 3003.5, 3004.2. PAM auth fails to reject locked accounts, which allows a previously authorized user whose account is locked still run Salt commands when their account is locked. This affects both local shell accounts with an active session and salt-api users that authenticate via PAM eauth. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://repo.saltproject.i
th. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://repo.saltproject.io/ - https://saltproject.io/security_announcements/salt-security-advisory-release-june-21st-2022/%2C - https://security.gentoo.org/glsa/202310-22
CVE ID: CVE-2022-22968 State: PUBLISHED Published: 2022-04-14T20:05:50 Last Updated: 2024-08-03T03:28:42.847Z Vendors: n/a Products: Spring Framework Problem Types: Data Binding Rules Vulnerability Description: In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions, the patterns for disallowedFields on a DataBinder are case sensitive which means a field is not effectively protected unless it is listed with both upper and lower case for the first character of the field, including upper and lower case for the first character of all nested fields within the property path. Additional Analyst Notes: - CVE Program Container: References: - https://tanzu.vmware.c
fields within the property path. Additional Analyst Notes: - CVE Program Container: References: - https://tanzu.vmware.com/security/cve-2022-22968 - https://www.oracle.com/security-alerts/cpujul2022.html - https://security.netapp.com/advisory/ntap-20220602-0004/
CVE ID: CVE-2022-22969 State: PUBLISHED Published: 2022-04-21T18:16:02 Last Updated: 2024-08-03T03:28:42.679Z Vendors: n/a Products: Spring Security OAuth Problem Types: Denial of Service (DoS) Description: <Issue Description> Spring Security OAuth versions 2.5.x prior to 2.5.2 and older unsupported versions are susceptible to a Denial-of-Service (DoS) attack via the initiation of the Authorization Request in an OAuth 2.0 Client application. A malicious user or attacker can send multiple requests initiating the Authorization Request for the Authorization Code Grant, which has the potential of exhausting system resources using a single session. This vulnerability exposes OAuth 2.0 Client appl
as the potential of exhausting system resources using a single session. This vulnerability exposes OAuth 2.0 Client applications only. Additional Analyst Notes: - CVE Program Container: References: - https://tanzu.vmware.com/security/cve-2022-22969 - https://www.oracle.com/security-alerts/cpujul2022.html
CVE ID: CVE-2022-22970 State: PUBLISHED Published: 2022-05-12T19:28:47 Last Updated: 2024-08-03T03:28:42.399Z Vendors: n/a Products: Spring Framework Problem Types: CWE-770 Description: In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, applications that handle file uploads are vulnerable to DoS attack if they rely on data binding to set a MultipartFile or javax.servlet.Part to a field in a model object. Additional Analyst Notes: - CVE Program Container: References: - https://tanzu.vmware.com/security/cve-2022-22970 - https://www.oracle.com/security-alerts/cpujul2022.html - https://security.netapp.com/advisory/ntap-20220616-0006/
CVE ID: CVE-2022-22971 State: PUBLISHED Published: 2022-05-12T19:30:49 Last Updated: 2024-08-03T03:28:42.583Z Vendors: n/a Products: Spring Framework Problem Types: CWE-770 Description: In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, application with a STOMP over WebSocket endpoint is vulnerable to a denial of service attack by an authenticated user. Additional Analyst Notes: - CVE Program Container: References: - https://tanzu.vmware.com/security/cve-2022-22971 - https://www.oracle.com/security-alerts/cpujul2022.html - https://security.netapp.com/advisory/ntap-20220616-0003/
CVE ID: CVE-2022-22972 State: PUBLISHED Published: 2022-05-20T20:18:39 Last Updated: 2024-08-03T03:28:42.716Z Vendors: n/a Products: VMware Workspace ONE Access, Identity Manager and vRealize Automation Problem Types: Authentication Bypass Description: VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an authentication bypass vulnerability affecting local domain users. A malicious actor with network access to the UI may be able to obtain administrative access without the need to authenticate. Additional Analyst Notes: - CVE Program Container: References: - https://www.vmware.com/security/advisories/VMSA-2022-0014.html
CVE ID: CVE-2022-22973 State: PUBLISHED Published: 2022-05-20T20:18:27 Last Updated: 2024-08-03T03:28:42.587Z Vendors: n/a Products: VMware Workspace ONE Access and Identity Manager. Problem Types: Privilege escalation Description: VMware Workspace ONE Access and Identity Manager contain a privilege escalation vulnerability. A malicious actor with local access can escalate privileges to 'root'. Additional Analyst Notes: - CVE Program Container: References: - https://www.vmware.com/security/advisories/VMSA-2022-0014.html
CVE ID: CVE-2022-22975 State: PUBLISHED Published: 2022-05-11T15:13:50 Last Updated: 2024-08-03T03:28:42.637Z Vendors: n/a Products: Pinniped Problem Types: LDAP query injection in Pinniped Supervisor before v0.17.0 causes a malicious user to escalate privileges by changing Kubernetes group memberships when the attacker is also able to edit their own LDAP user entry Description: An issue was discovered in the Pinniped Supervisor with either LADPIdentityProvider or ActiveDirectoryIdentityProvider resources. An attack would involve the malicious user changing the common name (CN) of their user entry on the LDAP or AD server to include special characters, which could be used to perform LDAP que
(CN) of their user entry on the LDAP or AD server to include special characters, which could be used to perform LDAP query injection on the Supervisor's LDAP query which determines their Kubernetes group membership. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/vmware-tanzu/pinniped/security/advisories/GHSA-hvrf-5hhv-4348
CVE ID: CVE-2022-22976 State: PUBLISHED Published: 2022-05-19T14:50:46 Last Updated: 2024-08-03T03:28:42.454Z Vendors: n/a Products: Spring Security Problem Types: CWE-190 Description: Spring Security versions 5.5.x prior to 5.5.7, 5.6.x prior to 5.6.4, and earlier unsupported versions contain an integer overflow vulnerability. When using the BCrypt class with the maximum work factor (31), the encoder does not perform any salt rounds, due to an integer overflow error. The default settings are not affected by this CVE. Additional Analyst Notes: - CVE Program Container: References: - https://tanzu.vmware.com/security/cve-2022-22976 - https://www.oracle.com/security-alerts/cpujul2022.html - htt
ences: - https://tanzu.vmware.com/security/cve-2022-22976 - https://www.oracle.com/security-alerts/cpujul2022.html - https://security.netapp.com/advisory/ntap-20220707-0003/
CVE ID: CVE-2022-22977 State: PUBLISHED Published: 2022-05-24T18:15:38 Last Updated: 2024-08-03T03:28:42.478Z Vendors: n/a Products: VMware Tools for Windows Problem Types: XML External Entity (XXE) vulnerability Description: VMware Tools for Windows(12.0.0, 11.x.y and 10.x.y) contains an XML External Entity (XXE) vulnerability. A malicious actor with non-administrative local user privileges in the Windows guest OS, where VMware Tools is installed, may exploit this issue leading to a denial-of-service condition or unintended information disclosure. Additional Analyst Notes: - CVE Program Container: References: - https://www.vmware.com/security/advisories/VMSA-2022-0015.html
CVE ID: CVE-2022-22978 State: PUBLISHED Published: 2022-05-19T00:00:00 Last Updated: 2024-08-03T03:28:42.507Z Vendors: n/a Products: Spring Security Problem Types: CWE-863 Description: In spring security versions prior to 5.4.11+, 5.5.7+ , 5.6.4+ and older unsupported versions, RegexRequestMatcher can easily be misconfigured to be bypassed on some servlet containers. Applications using RegexRequestMatcher with `.` in the regular expression are possibly vulnerable to an authorization bypass. Additional Analyst Notes: - CVE Program Container: References: - https://spring.io/security/cve-2022-22978
CVE ID: CVE-2022-22979 State: PUBLISHED Published: 2022-06-21T14:23:38 Last Updated: 2024-08-03T03:28:42.859Z Vendors: n/a Products: Spring Cloud Function Problem Types: Denial-of-service vulnerability Description: In Spring Cloud Function versions prior to 3.2.6, it is possible for a user who directly interacts with framework provided lookup functionality to cause a denial-of-service condition due to the caching issue in the Function Catalog component of the framework. Additional Analyst Notes: - CVE Program Container: References: - https://tanzu.vmware.com/security/cve-2022-22979
CVE ID: CVE-2022-22980 State: PUBLISHED Published: 2022-06-22T13:56:00 Last Updated: 2024-08-03T03:28:42.620Z Vendors: n/a Products: Spring Data MongoDB Problem Types: Spring Data MongoDB SpEL Expression injection vulnerability through annotated repository query methods Description: A Spring Data MongoDB application is vulnerable to SpEL Injection when using @Query or @Aggregation-annotated query methods with SpEL expressions that contain query parameter placeholders for value binding if the input is not sanitized. Additional Analyst Notes: - CVE Program Container: References: - https://tanzu.vmware.com/security/cve-2022-22980
CVE ID: CVE-2022-22982 State: PUBLISHED Published: 2022-07-13T18:18:58 Last Updated: 2024-08-03T03:28:42.512Z Vendors: n/a Products: VMware vCenter Server Problem Types: Server-side request forgery vulnerability Description: The vCenter Server contains a server-side request forgery (SSRF) vulnerability. A malicious actor with network access to 443 on the vCenter Server may exploit this issue by accessing a URL request outside of vCenter Server or accessing an internal service. Additional Analyst Notes: - CVE Program Container: References: - https://www.vmware.com/security/advisories/VMSA-2022-0018.html
CVE ID: CVE-2022-22983 State: PUBLISHED Published: 2022-08-09T20:19:57 Last Updated: 2024-08-03T03:28:42.870Z Vendors: n/a Products: VMware Workstation Problem Types: Unprotected storage of credentials vulnerability Description: VMware Workstation (16.x prior to 16.2.4) contains an unprotected storage of credentials vulnerability. A malicious actor with local user privileges to the victim machine may exploit this vulnerability leading to the disclosure of user passwords of the remote server connected through VMware Workstation. Additional Analyst Notes: - CVE Program Container: References: - https://www.vmware.com/security/advisories/VMSA-2022-0023.html
CVE ID: CVE-2022-22984 State: PUBLISHED Published: 2022-11-30T00:00:00.000Z Last Updated: 2025-04-25T14:34:22.605Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P) Vendors: n/a Products: snyk, snyk-mvn-plugin, snyk-gradle-plugin, @snyk/snyk-cocoapods-plugin, snyk-sbt-plugin, snyk-python-plugin, snyk-docker-plugin, @snyk/snyk-hex-plugin Problem Types: Command Injection Description: The package snyk before 1.1064.0; the package snyk-mvn-plugin before 2.31.3; the package snyk-gradle-plugin before 3.24.5; the package @snyk/snyk-cocoapods-plugin before 2.5.3; the package snyk-sbt-plugin before 2.16.2; the package snyk-python-plugin before 1.24.2; the package snyk-docker-