Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-40151 State: PUBLISHED Published: 2022-09-16T10:00:20.584Z Last Updated: 2025-04-21T13:49:35.282Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: xstream Products: xstream Problem Types: CWE-121 Description: Those using Xstream to seralize XML data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47367 - https://gith
ainer: - CISA ADP Vulnrichment: References: - https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47367 - https://github.com/x-stream/xstream/issues/304
CVE ID: CVE-2022-40152 State: PUBLISHED Published: 2022-09-16T10:00:22.101Z Last Updated: 2025-04-21T13:49:26.700Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: xstream Products: Woodstox Problem Types: CWE-121 Description: Those using Woodstox to parse XML data may be vulnerable to Denial of Service attacks (DOS) if DTD support is enabled. If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/x-stream/xstream/issues/304 -
Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/x-stream/xstream/issues/304 - https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47434
CVE ID: CVE-2022-40153 State: REJECTED Published: N/A Last Updated: 2022-11-25T00:00:00 Description: No description available.
CVE ID: CVE-2022-40154 State: REJECTED Published: N/A Last Updated: 2022-11-25T00:00:00 Description: No description available.
CVE ID: CVE-2022-40155 State: REJECTED Published: N/A Last Updated: 2022-11-25T00:00:00 Description: No description available.
CVE ID: CVE-2022-40156 State: REJECTED Published: N/A Last Updated: 2022-11-25T00:00:00 Description: No description available.
CVE ID: CVE-2022-40157 State: REJECTED Published: 2022-10-06T17:14:54.507Z Last Updated: 2025-02-13T15:46:32.088Z Description: No description available.
CVE ID: CVE-2022-40158 State: REJECTED Published: 2022-10-06T17:14:55.546Z Last Updated: 2025-02-13T15:46:32.611Z Description: No description available.
CVE ID: CVE-2022-40159 State: PUBLISHED Published: 2022-10-06T00:00:00 Last Updated: 2024-08-03T12:14:39.803Z Vendors: jxpath Products: jxpath Problem Types: CWE-121 Description: ** DISPUTED ** This record was originally reported by the oss-fuzz project who failed to consider the security context in which JXPath is intended to be used and failed to contact the JXPath maintainers prior to requesting the CVE allocation. The CVE was then allocated by Google in breach of the CNA rules. After review by the JXPath maintainers, the original report was found to be invalid. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47057
CVE ID: CVE-2022-40160 State: PUBLISHED Published: 2022-10-06T00:00:00 Last Updated: 2024-08-03T12:14:39.660Z Vendors: jxpath Products: jxpath Problem Types: CWE-121 Description: ** DISPUTED ** This record was originally reported by the oss-fuzz project who failed to consider the security context in which JXPath is intended to be used and failed to contact the JXPath maintainers prior to requesting the CVE allocation. The CVE was then allocated by Google in breach of the CNA rules. After review by the JXPath maintainers, the original report was found to be invalid. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47053
CVE ID: CVE-2022-40161 State: REJECTED Published: 2022-10-06T17:14:58.785Z Last Updated: 2025-02-13T15:46:33.166Z Description: No description available.
CVE ID: CVE-2022-40162 State: REJECTED Published: N/A Last Updated: 2023-01-26T00:00:00 Description: No description available.
CVE ID: CVE-2022-40163 State: REJECTED Published: N/A Last Updated: 2023-01-26T00:00:00 Description: No description available.
CVE ID: CVE-2022-40164 State: REJECTED Published: N/A Last Updated: 2023-01-26T00:00:00 Description: No description available.
CVE ID: CVE-2022-40165 State: REJECTED Published: N/A Last Updated: 2023-01-26T00:00:00 Description: No description available.
CVE ID: CVE-2022-40166 State: REJECTED Published: N/A Last Updated: 2023-01-26T00:00:00 Description: No description available.
CVE ID: CVE-2022-40167 State: REJECTED Published: N/A Last Updated: 2023-01-26T00:00:00 Description: No description available.
CVE ID: CVE-2022-40168 State: REJECTED Published: N/A Last Updated: 2023-01-26T00:00:00 Description: No description available.
CVE ID: CVE-2022-40169 State: REJECTED Published: N/A Last Updated: 2023-01-26T00:00:00 Description: No description available.
CVE ID: CVE-2022-40170 State: REJECTED Published: N/A Last Updated: 2023-01-26T00:00:00 Description: No description available.
CVE ID: CVE-2022-40171 State: REJECTED Published: N/A Last Updated: 2023-01-26T00:00:00 Description: No description available.
CVE ID: CVE-2022-40172 State: REJECTED Published: N/A Last Updated: 2023-01-26T00:00:00 Description: No description available.
CVE ID: CVE-2022-40173 State: REJECTED Published: N/A Last Updated: 2023-01-26T00:00:00 Description: No description available.
CVE ID: CVE-2022-40174 State: REJECTED Published: N/A Last Updated: 2023-01-26T00:00:00 Description: No description available.
CVE ID: CVE-2022-40175 State: REJECTED Published: N/A Last Updated: 2023-01-26T00:00:00 Description: No description available.
CVE ID: CVE-2022-40176 State: PUBLISHED Published: 2022-10-11T00:00:00 Last Updated: 2024-08-03T12:14:39.805Z Vendors: Siemens Products: Desigo PXM30-1, Desigo PXM30.E, Desigo PXM40-1, Desigo PXM40.E, Desigo PXM50-1, Desigo PXM50.E, PXG3.W100-1, PXG3.W100-2, PXG3.W200-1, PXG3.W200-2 Problem Types: CWE-78 Description: A vulnerability has been identified in Desigo PXM30-1 (All versions < V02.20.126.11-41), Desigo PXM30.E (All versions < V02.20.126.11-41), Desigo PXM40-1 (All versions < V02.20.126.11-41), Desigo PXM40.E (All versions < V02.20.126.11-41), Desigo PXM50-1 (All versions < V02.20.126.11-41), Desigo PXM50.E (All versions < V02.20.126.11-41), PXG3.W100-1 (All versions < V02.20.126.11-
rsions < V02.20.126.11-41), Desigo PXM50.E (All versions < V02.20.126.11-41), PXG3.W100-1 (All versions < V02.20.126.11-37), PXG3.W100-2 (All versions < V02.20.126.11-41), PXG3.W200-1 (All versions < V02.20.126.11-37), PXG3.W200-2 (All versions < V02.20.126.11-41). There exists an Improper Neutralization of Special Elements used in an OS Command with root privileges during a restore operation due to the missing validation of the names of files included in the input package. By restoring a specifically crafted package, a remote low-privileged attacker can execute arbitrary system commands with root privileges on the device, leading to a full compromise. Additional Analyst Notes: - CVE Program
ystem commands with root privileges on the device, leading to a full compromise. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-360783.pdf
CVE ID: CVE-2022-40177 State: PUBLISHED Published: 2022-10-11T00:00:00 Last Updated: 2024-08-03T12:14:39.963Z Vendors: Siemens Products: Desigo PXM30-1, Desigo PXM30.E, Desigo PXM40-1, Desigo PXM40.E, Desigo PXM50-1, Desigo PXM50.E, PXG3.W100-1, PXG3.W100-2, PXG3.W200-1, PXG3.W200-2 Problem Types: CWE-200 Description: A vulnerability has been identified in Desigo PXM30-1 (All versions < V02.20.126.11-41), Desigo PXM30.E (All versions < V02.20.126.11-41), Desigo PXM40-1 (All versions < V02.20.126.11-41), Desigo PXM40.E (All versions < V02.20.126.11-41), Desigo PXM50-1 (All versions < V02.20.126.11-41), Desigo PXM50.E (All versions < V02.20.126.11-41), PXG3.W100-1 (All versions < V02.20.126.11
ersions < V02.20.126.11-41), Desigo PXM50.E (All versions < V02.20.126.11-41), PXG3.W100-1 (All versions < V02.20.126.11-37), PXG3.W100-2 (All versions < V02.20.126.11-41), PXG3.W200-1 (All versions < V02.20.126.11-37), PXG3.W200-2 (All versions < V02.20.126.11-41). Endpoints of the “Operation” web application that interpret and execute Axon language queries allow file read access to the device file system with root privileges. By supplying specific I/O related Axon queries, a remote low-privileged attacker can read sensitive files on the device. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-360783.pdf
CVE ID: CVE-2022-40178 State: PUBLISHED Published: 2022-10-11T00:00:00 Last Updated: 2024-08-03T12:14:39.821Z Vendors: Siemens Products: Desigo PXM30-1, Desigo PXM30.E, Desigo PXM40-1, Desigo PXM40.E, Desigo PXM50-1, Desigo PXM50.E, PXG3.W100-1, PXG3.W100-2, PXG3.W200-1, PXG3.W200-2 Problem Types: CWE-79 Description: A vulnerability has been identified in Desigo PXM30-1 (All versions < V02.20.126.11-41), Desigo PXM30.E (All versions < V02.20.126.11-41), Desigo PXM40-1 (All versions < V02.20.126.11-41), Desigo PXM40.E (All versions < V02.20.126.11-41), Desigo PXM50-1 (All versions < V02.20.126.11-41), Desigo PXM50.E (All versions < V02.20.126.11-41), PXG3.W100-1 (All versions < V02.20.126.11-
rsions < V02.20.126.11-41), Desigo PXM50.E (All versions < V02.20.126.11-41), PXG3.W100-1 (All versions < V02.20.126.11-37), PXG3.W100-2 (All versions < V02.20.126.11-41), PXG3.W200-1 (All versions < V02.20.126.11-37), PXG3.W200-2 (All versions < V02.20.126.11-41). Improper Neutralization of Input During Web Page Generation exists in the “Import Files“ functionality of the “Operation” web application, due to the missing validation of the titles of files included in the input package. By uploading a specifically crafted graphics package, a remote low-privileged attacker can execute arbitrary JavaScript code. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.
execute arbitrary JavaScript code. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-360783.pdf
CVE ID: CVE-2022-40179 State: PUBLISHED Published: 2022-10-11T00:00:00 Last Updated: 2024-08-03T12:14:39.953Z Vendors: Siemens Products: Desigo PXM30-1, Desigo PXM30.E, Desigo PXM40-1, Desigo PXM40.E, Desigo PXM50-1, Desigo PXM50.E, PXG3.W100-1, PXG3.W100-2, PXG3.W200-1, PXG3.W200-2 Problem Types: CWE-352 Description: A vulnerability has been identified in Desigo PXM30-1 (All versions < V02.20.126.11-41), Desigo PXM30.E (All versions < V02.20.126.11-41), Desigo PXM40-1 (All versions < V02.20.126.11-41), Desigo PXM40.E (All versions < V02.20.126.11-41), Desigo PXM50-1 (All versions < V02.20.126.11-41), Desigo PXM50.E (All versions < V02.20.126.11-41), PXG3.W100-1 (All versions < V02.20.126.11
ersions < V02.20.126.11-41), Desigo PXM50.E (All versions < V02.20.126.11-41), PXG3.W100-1 (All versions < V02.20.126.11-37), PXG3.W100-2 (All versions < V02.20.126.11-41), PXG3.W200-1 (All versions < V02.20.126.11-37), PXG3.W200-2 (All versions < V02.20.126.11-41). A Cross-Site Request Forgery exists in endpoints of the “Operation” web application that interpret and execute Axon language queries, due to the missing validation of anti-CSRF tokens or other origin checks. By convincing a victim to click on a malicious link or visit a specifically crafted webpage while logged-in to the device web application, a remote unauthenticated attacker can execute arbitrary Axon queries against the devic
in to the device web application, a remote unauthenticated attacker can execute arbitrary Axon queries against the device. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-360783.pdf
CVE ID: CVE-2022-40180 State: PUBLISHED Published: 2022-10-11T00:00:00 Last Updated: 2024-08-03T12:14:39.639Z Vendors: Siemens Products: Desigo PXM30-1, Desigo PXM30.E, Desigo PXM40-1, Desigo PXM40.E, Desigo PXM50-1, Desigo PXM50.E, PXG3.W100-1, PXG3.W100-2, PXG3.W200-1, PXG3.W200-2 Problem Types: CWE-352 Description: A vulnerability has been identified in Desigo PXM30-1 (All versions < V02.20.126.11-41), Desigo PXM30.E (All versions < V02.20.126.11-41), Desigo PXM40-1 (All versions < V02.20.126.11-41), Desigo PXM40.E (All versions < V02.20.126.11-41), Desigo PXM50-1 (All versions < V02.20.126.11-41), Desigo PXM50.E (All versions < V02.20.126.11-41), PXG3.W100-1 (All versions < V02.20.126.11
ersions < V02.20.126.11-41), Desigo PXM50.E (All versions < V02.20.126.11-41), PXG3.W100-1 (All versions < V02.20.126.11-37), PXG3.W100-2 (All versions < V02.20.126.11-41), PXG3.W200-1 (All versions < V02.20.126.11-37), PXG3.W200-2 (All versions < V02.20.126.11-41). A Cross-Site Request Forgery exists in the “Import Files“ functionality of the “Operation” web application due to the missing validation of anti-CSRF tokens or other origin checks. A remote unauthenticated attacker can upload and enable permanent arbitrary JavaScript code into the device just by convincing a victim to visit a specifically crafted webpage while logged-in to the device web application. Additional Analyst Notes: - C
tim to visit a specifically crafted webpage while logged-in to the device web application. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-360783.pdf
CVE ID: CVE-2022-40181 State: PUBLISHED Published: 2022-10-11T00:00:00 Last Updated: 2024-08-03T12:14:39.647Z Vendors: Siemens Products: Desigo PXM30-1, Desigo PXM30.E, Desigo PXM40-1, Desigo PXM40.E, Desigo PXM50-1, Desigo PXM50.E, PXG3.W100-1, PXG3.W100-2, PXG3.W200-1, PXG3.W200-2 Problem Types: CWE-84 Description: A vulnerability has been identified in Desigo PXM30-1 (All versions < V02.20.126.11-41), Desigo PXM30.E (All versions < V02.20.126.11-41), Desigo PXM40-1 (All versions < V02.20.126.11-41), Desigo PXM40.E (All versions < V02.20.126.11-41), Desigo PXM50-1 (All versions < V02.20.126.11-41), Desigo PXM50.E (All versions < V02.20.126.11-41), PXG3.W100-1 (All versions < V02.20.126.11-
rsions < V02.20.126.11-41), Desigo PXM50.E (All versions < V02.20.126.11-41), PXG3.W100-1 (All versions < V02.20.126.11-37), PXG3.W100-2 (All versions < V02.20.126.11-41), PXG3.W200-1 (All versions < V02.20.126.11-37), PXG3.W200-2 (All versions < V02.20.126.11-41). The device embedded browser does not prevent interaction with alternative URI schemes when redirected to corresponding resources by web application code. By setting the homepage URI, the favorite URIs, or redirecting embedded browser users via JavaScript code to alternative scheme resources, a remote low privileged attacker can perform a range of attacks against the device, such as read arbitrary files on the filesystem, execute a
ed attacker can perform a range of attacks against the device, such as read arbitrary files on the filesystem, execute arbitrary JavaScript code in order to steal or manipulate the information on the screen, or trigger denial of service conditions. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-360783.pdf
CVE ID: CVE-2022-40182 State: PUBLISHED Published: 2022-10-11T00:00:00 Last Updated: 2024-08-03T12:14:40.080Z Vendors: Siemens Products: Desigo PXM30-1, Desigo PXM30.E, Desigo PXM40-1, Desigo PXM40.E, Desigo PXM50-1, Desigo PXM50.E, PXG3.W100-1, PXG3.W100-2, PXG3.W200-1, PXG3.W200-2 Problem Types: CWE-250 Description: A vulnerability has been identified in Desigo PXM30-1 (All versions < V02.20.126.11-41), Desigo PXM30.E (All versions < V02.20.126.11-41), Desigo PXM40-1 (All versions < V02.20.126.11-41), Desigo PXM40.E (All versions < V02.20.126.11-41), Desigo PXM50-1 (All versions < V02.20.126.11-41), Desigo PXM50.E (All versions < V02.20.126.11-41), PXG3.W100-1 (All versions < V02.20.126.11
ersions < V02.20.126.11-41), Desigo PXM50.E (All versions < V02.20.126.11-41), PXG3.W100-1 (All versions < V02.20.126.11-37), PXG3.W100-2 (All versions < V02.20.126.11-41), PXG3.W200-1 (All versions < V02.20.126.11-37), PXG3.W200-2 (All versions < V02.20.126.11-41). The device embedded Chromium-based browser is launched as root with the “--no-sandbox” option. Attackers can add arbitrary JavaScript code inside “Operation” graphics and successfully exploit any number of publicly known vulnerabilities against the version of the embedded Chromium-based browser. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-360783.pdf
CVE ID: CVE-2022-40183 State: PUBLISHED Published: 2022-10-27T00:00:00.000Z Last Updated: 2025-05-05T19:04:45.654Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Bosch Products: VIDEOJET multi 4000 Problem Types: CWE-79 Description: An error in the URL handler of the VIDEOJET multi 4000 may lead to a reflected cross site scripting (XSS) in the web-based interface. An attacker with knowledge of the encoder address can send a crafted link to a user, which will execute JavaScript code in the context of the user. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://psirt.bosch.com/security-advisories/bosch-sa-454166-
E Program Container: - CISA ADP Vulnrichment: References: - https://psirt.bosch.com/security-advisories/bosch-sa-454166-bt.html
CVE ID: CVE-2022-40184 State: PUBLISHED Published: 2022-10-27T00:00:00.000Z Last Updated: 2025-05-09T19:15:40.818Z Severity: MEDIUM (CVSS 5.1 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Bosch Products: VIDEOJET multi 4000 Problem Types: CWE-79 Description: Incomplete filtering of JavaScript code in different configuration fields of the web based interface of the VIDEOJET multi 4000 allows an attacker with administrative credentials to store JavaScript code which will be executed for all administrators accessing the same configuration option. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://psirt.bosch.com/security-advisories/bosch-s
tes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://psirt.bosch.com/security-advisories/bosch-sa-454166-bt.html
CVE ID: CVE-2022-40186 State: PUBLISHED Published: 2022-09-22T00:00:00.000Z Last Updated: 2025-05-27T18:11:29.644Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in HashiCorp Vault and Vault Enterprise before 1.11.3. A vulnerability in the Identity Engine was found where, in a deployment where an entity has multiple mount accessors with shared alias names, Vault may overwrite metadata to the wrong alias due to an issue with checking the proper alias assigned to an entity. This may allow for unintended access to key/value paths using that metadata in Vault. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://dis
metadata in Vault. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://discuss.hashicorp.com - https://discuss.hashicorp.com/t/hcsec-2022-18-vault-entity-alias-metadata-may-leak-between-aliases-with-the-same-name-assigned-to-the-same-entity/44550 - https://security.netapp.com/advisory/ntap-20221111-0008/
CVE ID: CVE-2022-40187 State: PUBLISHED Published: 2022-10-13T00:00:00.000Z Last Updated: 2025-05-15T14:45:29.334Z Vendors: n/a Products: n/a Problem Types: n/a Description: Foresight GC3 Launch Monitor 1.3.15.68 ships with a Target Communication Framework (TCF) service enabled. This service listens on a TCP port on all interfaces and allows for process debugging, file system modification, and terminal access as the root user. In conjunction with a hosted wireless access point and the known passphrase of FSSPORTS, an attacker could use this service to modify a device and steal intellectual property. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - htt
eal intellectual property. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wiki.eclipse.org/TCF - https://www.foresightsports.com/gc3 - https://github.com/atredispartners/advisories/blob/master/ATREDIS-2022-0003.md - https://www.bushnellgolf.com/products/launch-monitors/launch-pro/
CVE ID: CVE-2022-40188 State: PUBLISHED Published: 2022-09-23T00:00:00.000Z Last Updated: 2025-05-27T14:55:35.830Z Vendors: n/a Products: n/a Problem Types: n/a Description: Knot Resolver before 5.5.3 allows remote attackers to cause a denial of service (CPU consumption) because of algorithmic complexity. During an attack, an authoritative server must return large NS sets or address sets. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.nic.cz/knot/knot-resolver/-/merge_requests/1343#note_262558 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/S2VE5K3VDUHJOIA2IGT3G5R76IBADMNE/ - https://
roject.org/archives/list/package-announce%40lists.fedoraproject.org/message/S2VE5K3VDUHJOIA2IGT3G5R76IBADMNE/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HIMDNIUI7GTUEKIBBYYW7OCTJQFPDNXL/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XO6LIVQS62MI5GG4OVYB5RHVZMYNHAHG/ - https://lists.debian.org/debian-lts-announce/2022/10/msg00008.html
CVE ID: CVE-2022-40189 State: PUBLISHED Published: 2022-11-22T00:00:00.000Z Last Updated: 2025-04-29T04:25:48.603Z Vendors: Apache Software Foundation Products: Apache Airlfow Pig Provider, Apache Airflow Problem Types: CWE-78 Description: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airflow Pig Provider, Apache Airflow allows an attacker to control commands executed in the task execution context, without write access to DAG files. This issue affects Pig Provider versions prior to 4.0.0. It also impacts any Apache Airflow versions prior to 2.3.0 in case Pig Provider is installed (Pig Provider 4.0.0 can only be installed fo
ny Apache Airflow versions prior to 2.3.0 in case Pig Provider is installed (Pig Provider 4.0.0 can only be installed for Airflow 2.3.0+). Note that you need to manually install the Pig Provider version 4.0.0 in order to get rid of the vulnerability on top of Airflow 2.3.0+ version. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/apache/airflow/pull/27644 - https://lists.apache.org/thread/yxnfzfw2w9pj5s785k3rlyly4y44sd15
CVE ID: CVE-2022-40190 State: PUBLISHED Published: 2022-10-31T20:14:59.780Z Last Updated: 2025-04-16T17:43:26.696Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: SAUTER Controls Products: moduWeb Problem Types: CWE-79 Description: SAUTER Controls moduWeb firmware version 2.7.1 is vulnerable to reflective cross-site scripting (XSS). The web application does not adequately sanitize request strings of malicious JavaScript. An attacker utilizing XSS could then execute malicious code in users’ browsers and steal sensitive information, including user credentials. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.c
ser credentials. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-300-02