Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ly handle partial HTTP requests which makes them vulnerable to slowloris attacks. This could allow a remote attacker to create a denial of service condition that persists until the attack ends. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-459643.pdf - https://cert-portal.siemens.com/productcert/pdf/ssa-787941.pdf - https://cert-portal.siemens.com/productcert/html/ssa-459643.html - https://cert-portal.siemens.com/productcert/html/ssa-787941.html
CVE ID: CVE-2022-39159 State: REJECTED Published: N/A Last Updated: 2022-12-30T00:00:00 Description: No description available.
CVE ID: CVE-2022-39160 State: PUBLISHED Published: 2022-12-19T20:57:35.505Z Last Updated: 2025-04-17T13:54:03.000Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: IBM Products: Cognos Analytics Problem Types: CWE-79 Description: IBM Cognos Analytics 11.2.1, 11.2.0, and 11.1.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 235064. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/684
nalyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6841801 - https://exchange.xforce.ibmcloud.com/vulnerabilities/235064
CVE ID: CVE-2022-39161 State: PUBLISHED Published: 2023-05-03T19:56:41.894Z Last Updated: 2025-02-12T16:05:35.202Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: WebSphere Application Server Problem Types: CWE-295 Description: IBM WebSphere Application Server 7.0, 8.0, 8.5, 9.0, and IBM WebSphere Application Server Liberty, when configured to communicate with the Web Server Plug-ins for IBM WebSphere Application Server, could allow an authenticated user to conduct spoofing attacks. A man-in-the-middle attacker could exploit this vulnerability using a certificate issued by a trusted authority to obtain sensitive information. IBM X-Force ID: 235
his vulnerability using a certificate issued by a trusted authority to obtain sensitive information. IBM X-Force ID: 235069. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6987779 - https://exchange.xforce.ibmcloud.com/vulnerabilities/235069
CVE ID: CVE-2022-39163 State: PUBLISHED Published: 2025-03-26T13:51:51.469Z Last Updated: 2025-08-15T15:22:17.140Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: IBM Products: Cognos Controller, Controller Problem Types: CWE-444 Description: IBM Cognos Controller 11.0.0 through 11.1.0 is vulnerable to a Client-Side Desync (CSD) attack where an attacker could exploit a desynchronized browser connection that could lead to further cross-site scripting (XSS) attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7192746
CVE ID: CVE-2022-39164 State: PUBLISHED Published: 2022-12-23T19:26:58.929Z Last Updated: 2025-04-10T18:46:12.078Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: IBM Products: AIX Problem Types: CWE-400 Description: IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1could allow a non-privileged local user to exploit a vulnerability in the AIX kernel to cause a denial of service. IBM X-Force ID: 235181. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6847947 - https://exchange.xforce.ibmcloud.com/vulnerabilities/235181
CVE ID: CVE-2022-39165 State: PUBLISHED Published: 2022-12-23T18:48:01.722Z Last Updated: 2025-04-15T13:47:17.247Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: IBM Products: AIX Problem Types: CWE-400 Description: IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1could allow a non-privileged local user to exploit a vulnerability in CAA to cause a denial of service. IBM X-Force ID: 235183. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6847947 - https://exchange.xforce.ibmcloud.com/vulnerabilities/235183
CVE ID: CVE-2022-39166 State: PUBLISHED Published: 2022-12-20T20:17:33.714Z Last Updated: 2025-04-15T20:05:01.040Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: Security Guardium Problem Types: CWE-200 Description: IBM Security Guardium 11.4 could allow a privileged user to obtain sensitive information inside of an HTTP response. IBM X-Force ID: 235405. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6848317 - https://exchange.xforce.ibmcloud.com/vulnerabilities/235405
CVE ID: CVE-2022-39167 State: PUBLISHED Published: 2023-01-19T16:44:30.107Z Last Updated: 2025-04-02T14:54:00.216Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: Spectrum Virtualize Problem Types: CWE-200 Description: IBM Spectrum Virtualize 8.5, 8.4, 8.3, 8.2, and 7.8, under certain configurations, could disclose sensitive information to an attacker using man-in-the-middle techniques. IBM X-Force ID: 235408. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6622025 - https://exchange.xforce.ibmcloud.com/vulnerabilities/235408
CVE ID: CVE-2022-39168 State: PUBLISHED Published: 2022-09-29T15:40:09.460Z Last Updated: 2025-05-20T17:46:35.793Z Severity: MEDIUM (CVSS 4.6 CVSS:3.0/PR:N/S:U/UI:N/I:N/C:H/AV:P/A:N/AC:L/RL:O/E:U/RC:C) Vendors: IBM Products: Robotic Process Automation Problem Types: Obtain Information Description: IBM Robotic Process Automation Clients are vulnerable to proxy credentials being exposed in upgrade logs. IBM X-Force ID: 235422. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6824885 - https://exchange.xforce.ibmcloud.com/vulnerabilities/235422
CVE ID: CVE-2022-39170 State: PUBLISHED Published: 2022-09-02T02:28:53 Last Updated: 2024-08-03T12:00:42.570Z Vendors: n/a Products: n/a Problem Types: n/a Description: libdwarf 0.4.1 has a double free in _dwarf_exec_frame_instr in dwarf_frame.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/davea42/libdwarf-code/issues/132 - https://github.com/davea42/libdwarf-code/commit/60303eb80ecc7747bf29776d545e2a5c5a76f6f8 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IKUE4XT62AEZ3H5D6GMREYOSCMMRFXBH/
CVE ID: CVE-2022-39172 State: PUBLISHED Published: 2023-10-30T00:00:00 Last Updated: 2024-09-09T20:01:17.433Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored XSS in the process overview (bersicht zugewiesener Vorgaenge) in mbsupport openVIVA c2 20220101 allows a remote, authenticated, low-privileged attacker to execute arbitrary code in the victim's browser via name field of a process. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://sec-consult.com/vulnerability-lab/advisory/stored-cross-site-scripting-in-mb-support-broker-management-solution-openviva-c2/
CVE ID: CVE-2022-39173 State: PUBLISHED Published: 2022-09-29T00:00:00.000Z Last Updated: 2025-05-20T19:43:18.920Z Vendors: n/a Products: n/a Problem Types: n/a Description: In wolfSSL before 5.5.1, malicious clients can cause a buffer overflow during a TLS 1.3 handshake. This occurs when an attacker supposedly resumes a previous TLS session. During the resumption Client Hello a Hello Retry Request must be triggered. Both Client Hellos are required to contain a list of duplicate cipher suites to trigger the buffer overflow. In total, two Client Hellos have to be sent: one in the resumed session, and a second one as a response to a Hello Retry Request message. Additional Analyst Notes: - CVE
n the resumed session, and a second one as a response to a Hello Retry Request message. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wolfssl.com/docs/security-vulnerabilities/ - https://github.com/wolfSSL/wolfssl/releases - http://seclists.org/fulldisclosure/2022/Oct/24 - http://packetstormsecurity.com/files/169600/wolfSSL-Buffer-Overflow.html - https://blog.trailofbits.com/2023/01/12/wolfssl-vulnerabilities-tlspuffin-fuzzing-ssh/
CVE ID: CVE-2022-39176 State: PUBLISHED Published: 2022-09-02T00:00:00.000Z Last Updated: 2025-11-04T16:09:51.043Z Vendors: n/a Products: n/a Problem Types: n/a Description: BlueZ before 5.59 allows physically proximate attackers to obtain sensitive information because profiles/audio/avrcp.c does not validate params_len. Additional Analyst Notes: - CVE Program Container: References: - https://ubuntu.com/security/notices/USN-5481-1 - https://bugs.launchpad.net/ubuntu/+source/bluez/+bug/1977968 - https://security.netapp.com/advisory/ntap-20221020-0002/ - https://lists.debian.org/debian-lts-announce/2022/10/msg00026.html
CVE ID: CVE-2022-39177 State: PUBLISHED Published: 2022-09-02T00:00:00.000Z Last Updated: 2025-11-04T16:09:51.979Z Vendors: n/a Products: n/a Problem Types: n/a Description: BlueZ before 5.59 allows physically proximate attackers to cause a denial of service because malformed and invalid capabilities can be processed in profiles/audio/avdtp.c. Additional Analyst Notes: - CVE Program Container: References: - https://ubuntu.com/security/notices/USN-5481-1 - https://bugs.launchpad.net/ubuntu/+source/bluez/+bug/1977968 - https://security.netapp.com/advisory/ntap-20221020-0002/ - https://lists.debian.org/debian-lts-announce/2022/10/msg00026.html
CVE ID: CVE-2022-39178 State: PUBLISHED Published: 2022-11-17T22:27:54.987Z Last Updated: 2025-04-28T18:18:31.941Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: webvendome Products: webvendome Problem Types: Internal Server IP Disclosure Description: Webvendome - webvendome Internal Server IP Disclosure. Send GET Request to the request which is shown in the picture. Internal Server IP and Full path disclosure. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.gov.il/en/Departments/faq/cve_advisories
CVE ID: CVE-2022-39179 State: PUBLISHED Published: 2022-11-17T22:27:55.603Z Last Updated: 2025-04-28T18:14:25.817Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: College Management Products: College Management System v1.0 Problem Types: Authenticated remote code execution Description: College Management System v1.0 - Authenticated remote code execution. An admin user (the authentication can be bypassed using SQL Injection that mentioned in my other report) can upload .php file that contains malicious code via student.php file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.gov.il/en/Departments/faq/cve_ad
lyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.gov.il/en/Departments/faq/cve_advisories
CVE ID: CVE-2022-39180 State: PUBLISHED Published: 2022-11-17T22:27:54.746Z Last Updated: 2025-04-29T19:47:56.238Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: College Management Products: College Management System v1.0 Problem Types: CWE-89 Description: College Management System v1.0 - SQL Injection (SQLi). By inserting SQL commands to the username and password fields in the login.php page Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.gov.il/en/Departments/faq/cve_advisories
CVE ID: CVE-2022-39181 State: PUBLISHED Published: 2022-11-17T22:27:54.504Z Last Updated: 2025-04-29T19:48:20.822Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: GLPI Products: Reports plugin for GLPI Problem Types: CWE-79 Description: GLPI - Reports plugin for GLPI Reflected Cross-Site-Scripting (RXSS). Type 1: Reflected XSS (or Non-Persistent) - The server reads data directly from the HTTP request and reflects it back in the HTTP response. Reflected XSS exploits occur when an attacker causes a victim to supply dangerous content to a vulnerable web application, which is then reflected back to the victim and executed by the web browser. The most common mech
erable web application, which is then reflected back to the victim and executed by the web browser. The most common mechanism for delivering malicious content is to include it as a parameter in a URL that is posted publicly or emailed directly to the victim. URLs constructed in this manner constitute the core of many phishing schemes, whereby an attacker convinces a victim to visit a URL that refers to a vulnerable site. After the site reflects the attacker's content back to the victim, the content is executed by the victim's browser. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.gov.il/en/Departments/faq/cve_advisories
CVE ID: CVE-2022-39182 State: PUBLISHED Published: 2023-01-12T00:00:00.000Z Last Updated: 2025-04-08T14:12:15.148Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L) Vendors: H C Mingham-Smith Ltd Products: Tardis 2000 Problem Types: Privilege escalation Description: H C Mingham-Smith Ltd - Tardis 2000 Privilege escalation.Version 1.6 is vulnerable to privilege escalation which may allow a malicious actor to gain system privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.gov.il/en/Departments/faq/cve_advisories
CVE ID: CVE-2022-39183 State: PUBLISHED Published: 2023-01-12T00:00:00.000Z Last Updated: 2025-04-08T14:09:07.702Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: Moodle Plugin - SAML Auth Products: Moodle Plugin - SAML Auth Problem Types: CWE-601 Description: Moodle Plugin - SAML Auth may allow Open Redirect through unspecified vectors. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.gov.il/en/Departments/faq/cve_advisories
CVE ID: CVE-2022-39184 State: PUBLISHED Published: 2023-01-12T00:00:00.000Z Last Updated: 2025-04-08T14:08:06.480Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: EXFO Products: BV-10 Performance Endpoint Unit Problem Types: Authentication bypass Description: EXFO - BV-10 Performance Endpoint Unit authentication bypass User can manually manipulate access enabling authentication bypass. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.gov.il/en/Departments/faq/cve_advisories
CVE ID: CVE-2022-39185 State: PUBLISHED Published: 2023-01-12T00:00:00.000Z Last Updated: 2025-04-08T14:04:28.914Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: EXFO Products: BV-10 Performance Endpoint Unit Problem Types: Undocumented privileged user Description: EXFO - BV-10 Performance Endpoint Unit Undocumented privileged user. Unit has an undocumented hard-coded privileged user. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.gov.il/en/Departments/faq/cve_advisories
CVE ID: CVE-2022-39186 State: PUBLISHED Published: 2023-01-12T00:00:00.000Z Last Updated: 2025-04-08T14:00:14.246Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: EXFO Products: BV-10 Performance Endpoint Unit Problem Types: misconfiguration Description: EXFO - BV-10 Performance Endpoint Unit misconfiguration. System configuration file has misconfigured permissions Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.gov.il/en/Departments/faq/cve_advisories
CVE ID: CVE-2022-39187 State: PUBLISHED Published: 2023-01-12T00:00:00.000Z Last Updated: 2025-04-08T13:39:37.993Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H) Vendors: Rumpus Products: FTP server Problem Types: CWE-79 Description: Rumpus - FTP server version 9.0.7.1 has a Reflected cross-site scripting (RXSS) vulnerability through unspecified vectors. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.gov.il/en/Departments/faq/cve_advisories
CVE ID: CVE-2022-39188 State: PUBLISHED Published: 2022-09-02T00:00:00 Last Updated: 2024-08-03T12:00:42.380Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in include/asm-generic/tlb.h in the Linux kernel before 5.19. Because of a race condition (unmap_mapping_range versus munmap), a device driver can free a page while it still has stale TLB entries. This only occurs in situations with VM_PFNMAP VMAs. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.chromium.org/p/project-zero/issues/detail?id=2329 - https://lore.kernel.org/stable/CAG48ez3SEqOPcPCYGHVZv4iqEApujD5VtM3Re-tCKLDEFdEdbg%40mail.gmail.com/ - https://cdn.kernel.org/pu
lore.kernel.org/stable/CAG48ez3SEqOPcPCYGHVZv4iqEApujD5VtM3Re-tCKLDEFdEdbg%40mail.gmail.com/ - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.19 - https://github.com/torvalds/linux/commit/b67fbebd4cf980aecbcc750e1462128bffe8ae15 - https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=b67fbebd4cf980aecbcc750e1462128bffe8ae15 - https://lists.debian.org/debian-lts-announce/2022/10/msg00000.html - https://www.debian.org/security/2022/dsa-5257 - https://lists.debian.org/debian-lts-announce/2022/11/msg00001.html
CVE ID: CVE-2022-39189 State: PUBLISHED Published: 2022-09-02T00:00:00.000Z Last Updated: 2025-05-05T16:13:17.022Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered the x86 KVM subsystem in the Linux kernel before 5.18.17. Unprivileged guest users can compromise the guest kernel because TLB flush operations are mishandled in certain KVM_VCPU_PREEMPTED situations. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugs.chromium.org/p/project-zero/issues/detail?id=2309 - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.18.17 - https://github.com/torvalds/linux/commit/6cd88243c7e03845a450795e134b488fc2afb736
/linux/kernel/v5.x/ChangeLog-5.18.17 - https://github.com/torvalds/linux/commit/6cd88243c7e03845a450795e134b488fc2afb736 - https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=6cd88243c7e03845a450795e134b488fc2afb736 - https://security.netapp.com/advisory/ntap-20230214-0007/ - https://www.debian.org/security/2023/dsa-5480 - https://lists.debian.org/debian-lts-announce/2023/10/msg00027.html
CVE ID: CVE-2022-39190 State: PUBLISHED Published: 2022-09-02T00:00:00 Last Updated: 2024-08-03T12:00:42.525Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in net/netfilter/nf_tables_api.c in the Linux kernel before 5.19.6. A denial of service can occur upon binding to an already bound chain. Additional Analyst Notes: - CVE Program Container: References: - https://twitter.com/pr0Ln - https://lore.kernel.org/all/20220824220330.64283-12-pablo%40netfilter.org/ - https://github.com/torvalds/linux/commit/e02f0d3970404bfea385b6edb86f2d936db0ea2b - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.19.6 - https://lists.debian.org/debian-lts-announce/2022/1
2b - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.19.6 - https://lists.debian.org/debian-lts-announce/2022/11/msg00001.html
CVE ID: CVE-2022-39193 State: PUBLISHED Published: 2023-01-20T00:00:00.000Z Last Updated: 2025-04-03T16:11:19.802Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the CheckUser extension for MediaWiki through 1.39.x. Various components of this extension can expose information on the performer of edits and logged actions. This information should not allow public viewing: it is supposed to be viewable only by users with suppression rights. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://phabricator.wikimedia.org/T311337
CVE ID: CVE-2022-39194 State: PUBLISHED Published: 2022-09-02T04:45:37 Last Updated: 2024-08-03T12:00:43.589Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the MediaWiki through 1.38.2. The community configuration pages for the GrowthExperiments extension could cause a site to become unavailable due to insufficient validation when certain actions (including page moves) were performed. Additional Analyst Notes: - CVE Program Container: References: - https://phabricator.wikimedia.org/T313205
CVE ID: CVE-2022-39195 State: PUBLISHED Published: 2023-01-17T00:00:00.000Z Last Updated: 2025-04-04T15:56:41.399Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in the LISTSERV 17 web interface allows remote attackers to inject arbitrary JavaScript or HTML via the c parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://peach.ease.lsoft.com/scripts/wa-PEACH.exe?A0=LSTSRV-L - https://packetstormsecurity.com/2301-exploits/listserv17-xss.txt
CVE ID: CVE-2022-39196 State: PUBLISHED Published: 2022-09-04T00:00:00 Last Updated: 2024-08-03T12:00:43.671Z Vendors: n/a Products: n/a Problem Types: n/a Description: Blackboard Learn 1.10.1 allows remote authenticated users to read unintended files by entering student credentials and then directly visiting a certain webapps/bbcms/execute/ URL. Note: The vendor disputes this stating this cannot be reproduced. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/DayiliWaseem/CVE-2022-39196-
CVE ID: CVE-2022-39197 State: PUBLISHED Published: 2022-09-22T00:43:41.000Z Last Updated: 2025-10-21T23:15:34.953Z Vendors: n/a Products: n/a Problem Types: n/a Description: An XSS (Cross Site Scripting) vulnerability was found in HelpSystems Cobalt Strike through 4.7 that allowed a remote attacker to execute HTML on the Cobalt Strike teamserver. To exploit the vulnerability, one must first inspect a Cobalt Strike payload, and then modify the username field in the payload (or create a new payload with the extracted information and then modify that username field to be malformed). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cobaltstrik
rmed). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cobaltstrike.com/blog/tag/release/ - https://www.cobaltstrike.com/blog/out-of-band-update-cobalt-strike-4-7-1/
CVE ID: CVE-2022-39198 State: PUBLISHED Published: 2022-10-18T00:00:00.000Z Last Updated: 2025-05-13T14:48:42.604Z Vendors: Apache Software Foundation Products: Apache Dubbo Problem Types: CWE-502 Description: A deserialization vulnerability existed in dubbo hessian-lite 3.2.12 and its earlier versions, which could lead to malicious code execution. This issue affects Apache Dubbo 2.7.x version 2.7.17 and prior versions; Apache Dubbo 3.0.x version 3.0.11 and prior versions; Apache Dubbo 3.1.x version 3.1.0 and prior versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/8d3zqrkoy4jh8dy37j4rd7g9jodzlvkk
CVE ID: CVE-2022-39199 State: PUBLISHED Published: 2022-11-22T00:00:00.000Z Last Updated: 2025-04-23T16:36:36.932Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N) Vendors: codenotary Products: immudb Problem Types: CWE-345 Description: immudb is a database with built-in cryptographic proof and verification. immudb client SDKs use server's UUID to distinguish between different server instance so that the client can connect to different immudb instances and keep the state for multiple servers. SDK does not validate this uuid and can accept any value reported by the server. A malicious server can change the reported UUID tricking the client to treat it as a different se