Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-32211 State: PUBLISHED Published: 2022-09-23T18:28:14.000Z Last Updated: 2025-05-27T18:26:56.738Z Vendors: n/a Products: Rocket.Chat Problem Types: CWE-89 Description: A SQL injection vulnerability exists in Rocket.Chat <v3.18.6, <v4.4.4 and <v4.7.3 which can allow an attacker to retrieve a reset password token through or a 2fa secret. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://hackerone.com/reports/1581059
CVE ID: CVE-2022-32212 State: PUBLISHED Published: 2022-07-14T00:00:00 Last Updated: 2025-04-30T22:24:44.217Z Vendors: NodeJS Products: Node Problem Types: CWE-284 Description: A OS Command Injection vulnerability exists in Node.js versions <14.20.0, <16.20.0, <18.5.0 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid before making DBS requests allowing rebinding attacks. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/1632921
CVE ID: CVE-2022-32213 State: PUBLISHED Published: 2022-07-14T00:00:00 Last Updated: 2025-04-30T22:24:45.103Z Vendors: NodeJS Products: Node Problem Types: CWE-444 Description: The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly parse and validate Transfer-Encoding headers and can lead to HTTP Request Smuggling (HRS). Additional Analyst Notes: - CVE Program Container: References: - https://nodejs.org/en/blog/vulnerability/july-2022-security-releases/ - https://hackerone.com/reports/1524555 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VMQK5L5SBYD47QQZ67LEMHNQ662GH3OY/ - https://lists.fedorap
chives/list/package-announce%40lists.fedoraproject.org/message/VMQK5L5SBYD47QQZ67LEMHNQ662GH3OY/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QCNN3YG2BCLS4ZEKJ3CLSUT6AS7AXTH3/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2ICG6CSIB3GUWH5DUSQEVX53MOJW7LYK/ - https://cert-portal.siemens.com/productcert/pdf/ssa-332410.pdf - https://www.debian.org/security/2023/dsa-5326
CVE ID: CVE-2022-32214 State: PUBLISHED Published: 2022-07-14T00:00:00 Last Updated: 2025-04-30T22:24:43.342Z Vendors: NodeJS Products: Node Problem Types: CWE-444 Description: The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS). Additional Analyst Notes: - CVE Program Container: References: - https://nodejs.org/en/blog/vulnerability/july-2022-security-releases/ - https://hackerone.com/reports/1524692 - https://www.debian.org/security/2023/dsa-5326
CVE ID: CVE-2022-32215 State: PUBLISHED Published: 2022-07-14T00:00:00 Last Updated: 2025-04-30T22:24:42.485Z Vendors: NodeJS Products: Node Problem Types: CWE-444 Description: The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly handle multi-line Transfer-Encoding headers. This can lead to HTTP Request Smuggling (HRS). Additional Analyst Notes: - CVE Program Container: References: - https://nodejs.org/en/blog/vulnerability/july-2022-security-releases/ - https://hackerone.com/reports/1501679 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VMQK5L5SBYD47QQZ67LEMHNQ662GH3OY/ - https://lists.fedora
rchives/list/package-announce%40lists.fedoraproject.org/message/VMQK5L5SBYD47QQZ67LEMHNQ662GH3OY/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QCNN3YG2BCLS4ZEKJ3CLSUT6AS7AXTH3/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2ICG6CSIB3GUWH5DUSQEVX53MOJW7LYK/ - https://cert-portal.siemens.com/productcert/pdf/ssa-332410.pdf - https://www.debian.org/security/2023/dsa-5326
CVE ID: CVE-2022-32217 State: PUBLISHED Published: 2022-09-23T18:28:14.000Z Last Updated: 2025-05-22T18:11:56.384Z Vendors: n/a Products: Rocket.chat Problem Types: CWE-312 Description: A cleartext storage of sensitive information exists in Rocket.Chat <v4.6.4 due to Oauth token being leaked in plaintext in Rocket.chat logs. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://hackerone.com/reports/1394399
CVE ID: CVE-2022-32218 State: PUBLISHED Published: 2022-09-23T18:28:13.000Z Last Updated: 2025-05-22T18:27:06.860Z Vendors: n/a Products: Rocket.chat Problem Types: CWE-200 Description: An information disclosure vulnerability exists in Rocket.Chat <v5, <v4.8.2 and <v4.7.5 due to the actionLinkHandler method was found to allow Message ID Enumeration with Regex MongoDB queries. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://hackerone.com/reports/1406953
CVE ID: CVE-2022-32219 State: PUBLISHED Published: 2022-09-23T18:28:14.000Z Last Updated: 2025-05-22T15:05:22.340Z Vendors: n/a Products: Rocket.Chat Problem Types: CWE-200 Description: An information disclosure vulnerability exists in Rocket.Chat <v4.7.5 which allowed the "users.list" REST endpoint gets a query parameter from JSON and runs Users.find(queryFromClientSide). This means virtually any authenticated user can access any data (except password hashes) of any user authenticated. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://hackerone.com/reports/1140631
CVE ID: CVE-2022-32220 State: PUBLISHED Published: 2022-09-23T18:28:14.000Z Last Updated: 2025-05-22T15:06:35.639Z Vendors: n/a Products: Rocket.Chat Problem Types: CWE-200 Description: An information disclosure vulnerability exists in Rocket.Chat <v5 due to the getUserMentionsByChannel meteor server method discloses messages from private channels and direct messages regardless of the users access permission to the room. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://hackerone.com/reports/1410246
CVE ID: CVE-2022-32221 State: PUBLISHED Published: 2022-12-05T00:00:00 Last Updated: 2024-08-03T07:32:56.010Z Vendors: n/a Products: https://github.com/curl/curl Problem Types: CWE-200 Description: When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been set, if the same handle previously was used to issue a `PUT` request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the subsequent `POST` request. The problem exists in the logic for a reused handle when i
emory after free or similar in the subsequent `POST` request. The problem exists in the logic for a reused handle when it is changed from a PUT to a POST. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/1704017 - https://security.gentoo.org/glsa/202212-01 - https://security.netapp.com/advisory/ntap-20230110-0006/ - https://support.apple.com/kb/HT213604 - https://support.apple.com/kb/HT213605 - http://seclists.org/fulldisclosure/2023/Jan/20 - http://seclists.org/fulldisclosure/2023/Jan/19 - https://www.debian.org/security/2023/dsa-5330 - https://lists.debian.org/debian-lts-announce/2023/01/msg00028.html - https://security.netapp.com/advisory/ntap
sa-5330 - https://lists.debian.org/debian-lts-announce/2023/01/msg00028.html - https://security.netapp.com/advisory/ntap-20230208-0002/ - http://www.openwall.com/lists/oss-security/2023/05/17/4
CVE ID: CVE-2022-32222 State: PUBLISHED Published: 2022-07-14T00:00:00 Last Updated: 2025-04-30T22:24:46.826Z Vendors: NodeJS Products: Node Problem Types: CWE-310 Description: A cryptographic vulnerability exists on Node.js on linux in versions of 18.x prior to 18.40.0 which allowed a default path for openssl.cnf that might be accessible under some circumstances to a non-admin user instead of /etc/ssl as was the case in versions prior to the upgrade to OpenSSL 3. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/1695596
CVE ID: CVE-2022-32223 State: PUBLISHED Published: 2022-07-14T14:51:18 Last Updated: 2025-04-30T22:24:45.953Z Vendors: NodeJS Products: Node Problem Types: CWE-427 Description: Node.js is vulnerable to Hijack Execution Flow: DLL Hijacking under certain conditions on Windows platforms.This vulnerability can be exploited if the victim has the following dependencies on a Windows machine:* OpenSSL has been installed and “C:\Program Files\Common Files\SSL\openssl.cnf” exists.Whenever the above conditions are present, `node.exe` will search for `providers.dll` in the current user directory.After that, `node.exe` will try to search for `providers.dll` by the DLL Search Order in Windows.It is possib
directory.After that, `node.exe` will try to search for `providers.dll` by the DLL Search Order in Windows.It is possible for an attacker to place the malicious file `providers.dll` under a variety of paths and exploit this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://nodejs.org/en/blog/vulnerability/july-2022-security-releases/ - https://hackerone.com/reports/1447455 - https://security.netapp.com/advisory/ntap-20220915-0001/
CVE ID: CVE-2022-32224 State: PUBLISHED Published: 2022-12-05T00:00:00.000Z Last Updated: 2025-04-24T15:17:29.382Z Vendors: n/a Products: https://github.com/rails/rails Problem Types: CWE-502 Description: A possible escalation to RCE vulnerability exists when using YAML serialized columns in Active Record < 7.0.3.1, <6.1.6.1, <6.0.5.1 and <5.2.8.1 which could allow an attacker, that can manipulate data in the database (via means like SQL injection), the ability to escalate to an RCE. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/advisories/GHSA-3hhc-qp5v-9p2j - https://groups.google.com/g/rubyonrails-security/c/MmFO3LYQE8U
CVE ID: CVE-2022-32225 State: PUBLISHED Published: 2022-07-14T14:51:29 Last Updated: 2024-08-03T07:39:49.582Z Vendors: n/a Products: Veeam Management Pack for Microsoft System Center Problem Types: CWE-79 Description: A reflected DOM-Based XSS vulnerability has been discovered in the Help directory of Veeam Management Pack for Microsoft System Center 8.0. This vulnerability could be exploited by an attacker by convincing a legitimate user to visit a crafted URL on a Veeam Management Pack for Microsoft System Center server, allowing for the execution of arbitrary scripts. Additional Analyst Notes: - CVE Program Container: References: - https://www.veeam.com/kb4338
CVE ID: CVE-2022-32226 State: PUBLISHED Published: 2022-09-23T18:28:13.000Z Last Updated: 2025-05-22T18:14:07.429Z Vendors: n/a Products: Rocket.Chat Problem Types: CWE-284 Description: An improper access control vulnerability exists in Rocket.Chat <v5, <v4.8.2 and <v4.7.5 due to input data in the getUsersOfRoom Meteor server method is not type validated, so that MongoDB query operator objects are accepted by the server, so that instead of a matching rid String a$regex query can be executed, bypassing the room access permission check for every but the first matching room. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://hackerone.com/reports/1
dditional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://hackerone.com/reports/1410357
CVE ID: CVE-2022-32227 State: PUBLISHED Published: 2022-09-23T18:28:13.000Z Last Updated: 2025-05-22T18:25:17.049Z Vendors: n/a Products: Rocket.Chat Problem Types: CWE-319 Description: A cleartext transmission of sensitive information exists in Rocket.Chat <v5, <v4.8.2 and <v4.7.5 relating to Oauth tokens by having the permission "view-full-other-user-info", this could cause an oauth token leak in the product. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://hackerone.com/reports/1517377
CVE ID: CVE-2022-32228 State: PUBLISHED Published: 2022-09-23T18:28:13.000Z Last Updated: 2025-05-22T18:13:24.968Z Vendors: n/a Products: Rocket.Chat Problem Types: CWE-200 Description: An information disclosure vulnerability exists in Rocket.Chat <v5, <v4.8.2 and <v4.7.5 since the getReadReceipts Meteor server method does not properly filter user inputs that are passed to MongoDB queries, allowing $regex queries to enumerate arbitrary Message IDs. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://hackerone.com/reports/1377105
CVE ID: CVE-2022-32229 State: PUBLISHED Published: 2022-09-23T18:28:13.000Z Last Updated: 2025-05-22T17:53:40.713Z Vendors: n/a Products: Rocket.Chat Problem Types: CWE-200 Description: A information disclosure vulnerability exists in Rockert.Chat <v5 due to /api/v1/chat.getThreadsList lack of sanitization of user inputs and can therefore leak private thread messages to unauthorized users via Mongo DB injection. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://hackerone.com/reports/1446767
CVE ID: CVE-2022-32230 State: PUBLISHED Published: 2022-06-14T21:40:12.731452Z Last Updated: 2024-09-16T23:36:08.130Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Microsoft Products: Windows 10 Version 20H2, Windows Server Version 20H2, Windows 10 Version 21H1, Windows 10 Version 21H2 Problem Types: CWE-476 Description: Microsoft Windows SMBv3 suffers from a null pointer dereference in versions of Windows prior to the April, 2022 patch set. By sending a malformed FileNormalizedNameInformation SMBv3 request over a named pipe, an attacker can cause a Blue Screen of Death (BSOD) crash of the Windows kernel. For most systems, this attack requires authentication
n cause a Blue Screen of Death (BSOD) crash of the Windows kernel. For most systems, this attack requires authentication, except in the special case of Windows Domain Controllers, where unauthenticated users can always open named pipes as long as they can establish an SMB session. Typically, after the BSOD, the victim SMBv3 server will reboot. Additional Analyst Notes: - CVE Program Container: References: - https://www.rapid7.com/blog/post/2022/06/14/cve-2022-32230-windows-smb-denial-of-service-vulnerability-fixed/ - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-32230 - https://github.com/zeroSteiner/metasploit-framework/blob/feat/mod/cve-2022-32230/modules/auxiliary/dos/smb
-2022-32230 - https://github.com/zeroSteiner/metasploit-framework/blob/feat/mod/cve-2022-32230/modules/auxiliary/dos/smb/smb_filenormalizednameinformation.rb - https://support.microsoft.com/en-us/topic/may-10-2022-kb5013942-os-builds-19042-1706-19043-1706-and-19044-1706-60b51119-85be-4a34-9e21-8954f6749504
CVE ID: CVE-2022-32231 State: PUBLISHED Published: 2023-02-16T19:59:57.497Z Last Updated: 2025-01-27T18:21:45.382Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) Processors Problem Types: escalation of privilege Description: Improper initialization in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00717.html
CVE ID: CVE-2022-32232 State: REJECTED Published: N/A Last Updated: 2025-05-28T18:19:32.192Z Description: No description available.
CVE ID: CVE-2022-32233 State: REJECTED Published: N/A Last Updated: 2025-05-28T17:22:10.667Z Description: No description available.
CVE ID: CVE-2022-32234 State: PUBLISHED Published: 2022-10-11T00:00:00 Last Updated: 2024-08-03T07:39:49.627Z Vendors: Facebook Products: Hermes Problem Types: CWE-787 Description: An out of bounds write in hermes, while handling large arrays, prior to commit 06eaec767e376bfdb883d912cb15e987ddf2bda1 allows attackers to potentially execute arbitrary code via crafted JavaScript. Note that this is only exploitable if the application using Hermes permits evaluation of untrusted JavaScript. Hence, most React Native applications are not affected. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/facebook/hermes/commit/06eaec767e376bfdb883d912cb15e987ddf2bda1 - htt
rogram Container: References: - https://github.com/facebook/hermes/commit/06eaec767e376bfdb883d912cb15e987ddf2bda1 - https://www.facebook.com/security/advisories/CVE-2022-32234
CVE ID: CVE-2022-32235 State: PUBLISHED Published: 2022-06-14T18:48:02 Last Updated: 2024-08-03T07:39:49.607Z Vendors: SAP SE Products: SAP 3D Visual Enterprise Viewer Problem Types: CWE-20 Description: When a user opens manipulated AutoCAD (.dwg, TeighaTranslator.exe) files received from untrusted sources in SAP 3D Visual Enterprise Viewer, the application crashes and becomes temporarily unavailable to the user until restart of the application. Additional Analyst Notes: - CVE Program Container: References: - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html - https://launchpad.support.sap.com/#/notes/3206271
CVE ID: CVE-2022-32236 State: PUBLISHED Published: 2022-06-14T19:15:48 Last Updated: 2024-08-03T07:39:50.128Z Vendors: SAP SE Products: SAP 3D Visual Enterprise Viewer Problem Types: CWE-20 Description: When a user opens manipulated Windows Bitmap (.bmp, 2d.x3d) files received from untrusted sources in SAP 3D Visual Enterprise Viewer, the application crashes and becomes temporarily unavailable to the user until restart of the application. Additional Analyst Notes: - CVE Program Container: References: - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html - https://launchpad.support.sap.com/#/notes/3206271
CVE ID: CVE-2022-32237 State: PUBLISHED Published: 2022-06-14T19:16:31 Last Updated: 2024-08-03T07:39:49.604Z Vendors: SAP SE Products: SAP 3D Visual Enterprise Viewer Problem Types: CWE-20 Description: When a user opens manipulated Computer Graphics Metafile (.cgm, CgmCore.dll) files received from untrusted sources in SAP 3D Visual Enterprise Viewer, the application crashes and becomes temporarily unavailable to the user until restart of the application. Additional Analyst Notes: - CVE Program Container: References: - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html - https://launchpad.support.sap.com/#/notes/3206271
CVE ID: CVE-2022-32238 State: PUBLISHED Published: 2022-06-14T19:17:48 Last Updated: 2024-08-03T07:39:49.645Z Vendors: SAP SE Products: SAP 3D Visual Enterprise Viewer Problem Types: CWE-20 Description: When a user opens manipulated Encapsulated Post Script (.eps, ai.x3d) files received from untrusted sources in SAP 3D Visual Enterprise Viewer, the application crashes and becomes temporarily unavailable to the user until restart of the application. Additional Analyst Notes: - CVE Program Container: References: - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html - https://launchpad.support.sap.com/#/notes/3206271
CVE ID: CVE-2022-32239 State: PUBLISHED Published: 2022-06-14T19:27:06 Last Updated: 2024-08-03T07:39:50.223Z Vendors: SAP SE Products: SAP 3D Visual Enterprise Viewer Problem Types: CWE-20 Description: When a user opens manipulated JPEG 2000 (.jp2, jp2k.x3d) files received from untrusted sources in SAP 3D Visual Enterprise Viewer, the application crashes and becomes temporarily unavailable to the user until restart of the application. Additional Analyst Notes: - CVE Program Container: References: - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html - https://launchpad.support.sap.com/#/notes/3206271
CVE ID: CVE-2022-32240 State: PUBLISHED Published: 2022-06-14T22:30:35 Last Updated: 2024-08-03T07:39:49.593Z Vendors: SAP SE Products: SAP 3D Visual Enterprise Viewer Problem Types: CWE-20 Description: When a user opens manipulated Jupiter Tesselation (.jt, JTReader.x3d) files received from untrusted sources in SAP 3D Visual Enterprise Viewer, the application crashes and becomes temporarily unavailable to the user until restart of the application. Additional Analyst Notes: - CVE Program Container: References: - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html - https://launchpad.support.sap.com/#/notes/3206271
CVE ID: CVE-2022-32241 State: PUBLISHED Published: 2022-06-14T22:31:27 Last Updated: 2024-08-03T07:39:50.309Z Vendors: SAP SE Products: SAP 3D Visual Enterprise Viewer Problem Types: CWE-20 Description: When a user opens manipulated Portable Document Format (.pdf, PDFView.x3d) files received from untrusted sources in SAP 3D Visual Enterprise Viewer, the application crashes and becomes temporarily unavailable to the user until restart of the application. Additional Analyst Notes: - CVE Program Container: References: - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html - https://launchpad.support.sap.com/#/notes/3206271
CVE ID: CVE-2022-32242 State: PUBLISHED Published: 2022-06-14T22:32:12 Last Updated: 2024-08-03T07:39:49.593Z Vendors: SAP SE Products: SAP 3D Visual Enterprise Viewer Problem Types: CWE-20 Description: When a user opens manipulated Radiance Picture (.hdr, hdr.x3d) files received from untrusted sources in SAP 3D Visual Enterprise Viewer, the application crashes and becomes temporarily unavailable to the user until restart of the application. Additional Analyst Notes: - CVE Program Container: References: - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html - https://launchpad.support.sap.com/#/notes/3206271
CVE ID: CVE-2022-32243 State: PUBLISHED Published: 2022-06-14T22:32:55 Last Updated: 2024-08-03T07:39:50.180Z Vendors: SAP SE Products: SAP 3D Visual Enterprise Viewer Problem Types: CWE-20 Description: When a user opens manipulated Scalable Vector Graphics (.svg, svg.x3d) files received from untrusted sources in SAP 3D Visual Enterprise Viewer, the application crashes and becomes temporarily unavailable to the user until restart of the application. Additional Analyst Notes: - CVE Program Container: References: - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html - https://launchpad.support.sap.com/#/notes/3206271
CVE ID: CVE-2022-32244 State: PUBLISHED Published: 2022-09-13T19:24:35 Last Updated: 2024-08-03T07:39:50.380Z Vendors: SAP SE Products: SAP BusinessObjects Business Intelligence Platform (Commentary DB) Problem Types: CWE-200 Description: Under certain conditions an attacker authenticated as a CMS administrator access the BOE Commentary database and retrieve (non-personal) system data, modify system data but can't make the system unavailable. This needs the attacker to have high privilege access to the same physical/logical network to access information which would otherwise be restricted, leading to low impact on confidentiality and high impact on integrity of the application. Additional An
e be restricted, leading to low impact on confidentiality and high impact on integrity of the application. Additional Analyst Notes: - CVE Program Container: References: - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html - https://launchpad.support.sap.com/#/notes/3213524
CVE ID: CVE-2022-32245 State: PUBLISHED Published: 2022-08-09T20:13:29 Last Updated: 2024-08-03T07:39:50.342Z Vendors: SAP SE Products: SAP BusinessObjects Business Intelligence Platform (Open Document) Problem Types: CWE-319 Description: SAP BusinessObjects Business Intelligence Platform (Open Document) - versions 420, 430, allows an unauthenticated attacker to retrieve sensitive information plain text over the network. On successful exploitation, the attacker can view any data available for a business user and put load on the application by an automated attack. Thus, completely compromising confidentiality but causing a limited impact on the availability of the application. Additional Anal