Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-41539 State: PUBLISHED Published: 2022-10-14T00:00:00.000Z Last Updated: 2025-05-14T15:08:14.678Z Vendors: n/a Products: n/a Problem Types: n/a Description: Wedding Planner v1.0 was discovered to contain an arbitrary file upload vulnerability in the component /admin/users_add.php. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/gougou123-hash/bug_report/blob/main/vendors/pushpam02/wedding-planner/RCE-2.md
CVE ID: CVE-2022-41540 State: PUBLISHED Published: 2022-10-18T00:00:00.000Z Last Updated: 2025-05-15T14:59:23.252Z Vendors: n/a Products: n/a Problem Types: n/a Description: The web app client of TP-Link AX10v1 V1_211117 uses hard-coded cryptographic keys when communicating with the router. Attackers who are able to intercept the communications between the web client and router through a man-in-the-middle attack can then obtain the sequence key via a brute-force attack, and access sensitive information. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.tp-link.com/us/support/download/archer-ax10/v1/#Firmware - https://github.com/efchatz/eas
ent: References: - https://www.tp-link.com/us/support/download/archer-ax10/v1/#Firmware - https://github.com/efchatz/easy-exploits/tree/main/Web/TP-Link/Offline-decryption
CVE ID: CVE-2022-41541 State: PUBLISHED Published: 2022-10-18T00:00:00.000Z Last Updated: 2025-05-15T14:58:08.480Z Vendors: n/a Products: n/a Problem Types: n/a Description: TP-Link AX10v1 V1_211117 allows attackers to execute a replay attack by using a previously transmitted encrypted authentication message and valid authentication token. Attackers are able to login to the web application as an admin user. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.tp-link.com/us/support/download/archer-ax10/v1/#Firmware - https://github.com/efchatz/easy-exploits/tree/main/Web/TP-Link/Replay
CVE ID: CVE-2022-41542 State: PUBLISHED Published: 2022-10-17T00:00:00.000Z Last Updated: 2025-05-13T15:32:39.643Z Vendors: n/a Products: n/a Problem Types: n/a Description: devhub 0.102.0 was discovered to contain a broken session control. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://devhub.com - https://app.devhubapp.com/ - https://devhubapp.com/ - https://medium.com/%40sc0p3hacker/cve-2022-41542-session-mis-configuration-in-devhub-application-ca956bb9027a
CVE ID: CVE-2022-41544 State: PUBLISHED Published: 2022-10-18T00:00:00.000Z Last Updated: 2025-05-13T19:23:50.244Z Vendors: n/a Products: n/a Problem Types: n/a Description: GetSimple CMS v3.3.16 was discovered to contain a remote code execution (RCE) vulnerability via the edited_file parameter in admin/theme-edit.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/GetSimpleCMS/GetSimpleCMS/issues/1352 - http://packetstormsecurity.com/files/172553/GetSimple-CMS-3.3.16-Shell-Upload.html
CVE ID: CVE-2022-41545 State: PUBLISHED Published: 2025-02-18T00:00:00.000Z Last Updated: 2025-03-20T17:08:00.247Z Vendors: n/a Products: n/a Problem Types: n/a Description: The administrative web interface of a Netgear C7800 Router running firmware version 6.01.07 (and possibly others) authenticates users via basic authentication, with an HTTP header containing a base64 value of the plaintext username and password. Because the web server also does not utilize transport security by default, this renders the administrative credentials vulnerable to eavesdropping by an adversary during every authenticated request made by a client to the router over a WLAN, or a LAN, should the adversary be abl
ary during every authenticated request made by a client to the router over a WLAN, or a LAN, should the adversary be able to perform a man-in-the-middle attack. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.netgear.com/about/security/ - https://www.netgear.com/images/datasheet/networking/cablemodems/C7800.pdf - https://seclists.org/fulldisclosure/2025/Feb/12
CVE ID: CVE-2022-41547 State: PUBLISHED Published: 2022-10-18T00:00:00.000Z Last Updated: 2025-05-10T02:47:17.849Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mobile Security Framework (MobSF) v0.9.2 and below was discovered to contain a local file inclusion (LFI) vulnerability in the StaticAnalyzer/views.py script. This vulnerability allows attackers to read arbitrary files via a crafted HTTP request. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/MobSF/Mobile-Security-Framework-MobSF/pull/166 - https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/b9cdd1f52bdf127cf33bb1be369e374a2855f8e6#diff-69d2e38f6bb
ttps://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/b9cdd1f52bdf127cf33bb1be369e374a2855f8e6#diff-69d2e38f6bba208c333da6a09a83ca65056fcb60f4e10d23f67c01bcc1ffb58c
CVE ID: CVE-2022-41550 State: PUBLISHED Published: 2022-10-11T00:00:00.000Z Last Updated: 2025-05-20T15:58:10.747Z Vendors: n/a Products: n/a Problem Types: n/a Description: GNU oSIP v5.3.0 was discovered to contain an integer overflow via the component osip_body_parse_header. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://savannah.gnu.org/bugs/?63103
CVE ID: CVE-2022-41551 State: PUBLISHED Published: 2022-11-02T00:00:00.000Z Last Updated: 2025-05-02T20:54:51.642Z Vendors: n/a Products: n/a Problem Types: n/a Description: Garage Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /garage/editorder.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Happyd99/bug_report/blob/main/vendors/mayuri_k/garage-management-system/SQLi-1.md
CVE ID: CVE-2022-41552 State: PUBLISHED Published: 2022-11-01T02:10:22.868Z Last Updated: 2025-05-01T19:54:37.952Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Hitachi Products: Hitachi Infrastructure Analytics Advisor, Hitachi Ops Center Analyzer Problem Types: CWE-918 Description: Server-Side Request Forgery (SSRF) vulnerability in Hitachi Infrastructure Analytics Advisor on Linux (Data Center Analytics, Analytics probe components), Hitachi Ops Center Analyzer on Linux (Hitachi Ops Center Analyzer detail view, Hitachi Ops Center Analyzer probe components) allows Server Side Request Forgery. This issue affects Hitachi Infrastructure Analytics Advisor:
yzer probe components) allows Server Side Request Forgery. This issue affects Hitachi Infrastructure Analytics Advisor: from 2.0.0-00 through 4.4.0-00; Hitachi Ops Center Analyzer: from 10.0.0-00 before 10.9.0-00. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2022-134/index.html
CVE ID: CVE-2022-41553 State: PUBLISHED Published: 2022-11-01T02:11:01.157Z Last Updated: 2025-05-05T14:09:20.015Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: Hitachi Products: Hitachi Infrastructure Analytics Advisor, Hitachi Ops Center Analyzer Problem Types: CWE-532 Description: Insertion of Sensitive Information into Temporary File vulnerability in Hitachi Infrastructure Analytics Advisor on Linux (Analytics probe component), Hitachi Ops Center Analyzer on Linux (Hitachi Ops Center Analyzer probe component) allows local users to gain sensitive information. This issue affects Hitachi Infrastructure Analytics Advisor: from 2.0.0-00 through 4.4.0-00; Hi
n sensitive information. This issue affects Hitachi Infrastructure Analytics Advisor: from 2.0.0-00 through 4.4.0-00; Hitachi Ops Center Analyzer: from 10.0.0-00 before 10.9.0-00. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2022-134/index.html
CVE ID: CVE-2022-41554 State: PUBLISHED Published: 2023-03-16T09:02:55.310Z Last Updated: 2025-01-13T15:51:00.940Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: John West Products: Slideshow SE Problem Types: CWE-79 Description: Stored Cross-Site Scripting (XSS) vulnerability in John West Slideshow SE plugin <= 2.5.5 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/slideshow-se/wordpress-slideshow-se-plugin-2-5-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2022-41555 State: PUBLISHED Published: 2022-10-27T20:15:37.817Z Last Updated: 2025-04-16T17:45:48.514Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N) Vendors: Delta Electronics Products: DIAEnergie Problem Types: CWE-79 Description: The affected product DIAEnergie (versions prior to v1.9.01.002) is vulnerable to a stored cross-site scripting vulnerability through the PutLineMessageSetting API. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-298-06
CVE ID: CVE-2022-41556 State: PUBLISHED Published: 2022-10-06T00:00:00 Last Updated: 2024-08-03T12:42:46.654Z Vendors: n/a Products: n/a Problem Types: n/a Description: A resource leak in gw_backend.c in lighttpd 1.4.56 through 1.4.66 could lead to a denial of service (connection-slot exhaustion) after a large amount of anomalous TCP behavior by clients. It is related to RDHUP mishandling in certain HTTP/1.1 chunked situations. Use of mod_fastcgi is, for example, affected. This is fixed in 1.4.67. Additional Analyst Notes: - CVE Program Container: References: - https://git.lighttpd.net/lighttpd/lighttpd1.4/commit/b18de6f9264f914f7bf493abd3b6059343548e50 - https://github.com/lighttpd/lighttpd
lighttpd.net/lighttpd/lighttpd1.4/commit/b18de6f9264f914f7bf493abd3b6059343548e50 - https://github.com/lighttpd/lighttpd1.4/pull/115 - https://github.com/lighttpd/lighttpd1.4/compare/lighttpd-1.4.66...lighttpd-1.4.67 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OVOSBSCMLGCHH2Z74H64ZWVDFJFQTBC2/ - https://security.gentoo.org/glsa/202210-12
CVE ID: CVE-2022-41558 State: PUBLISHED Published: 2022-11-15T18:15:12.527Z Last Updated: 2025-04-29T20:08:32.390Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: TIBCO Software Inc. Products: TIBCO Spotfire Analyst, TIBCO Spotfire Analytics Platform for AWS Marketplace, TIBCO Spotfire Desktop, TIBCO Spotfire Server Problem Types: Successful execution of these vulnerabilities will result in an attacker being able to execute commands with the privileges of the affected user. Description: The Visualizations component of TIBCO Software Inc.'s TIBCO Spotfire Analyst, TIBCO Spotfire Analyst, TIBCO Spotfire Analyst, TIBCO Spotfire Analytics Platform for AWS Market
TIBCO Spotfire Analyst, TIBCO Spotfire Analyst, TIBCO Spotfire Analyst, TIBCO Spotfire Analytics Platform for AWS Marketplace, TIBCO Spotfire Desktop, TIBCO Spotfire Desktop, TIBCO Spotfire Desktop, TIBCO Spotfire Server, TIBCO Spotfire Server, and TIBCO Spotfire Server contains an easily exploitable vulnerability that allows a low privileged attacker with network access to execute Stored Cross Site Scripting (XSS) on the affected system. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.'s TIBCO Spotfire Analyst: versions 11.4.4 and below, TIBCO Spotfire Analyst: versions 11.5.0, 11.6.0, 11
O Software Inc.'s TIBCO Spotfire Analyst: versions 11.4.4 and below, TIBCO Spotfire Analyst: versions 11.5.0, 11.6.0, 11.7.0, 11.8.0, 12.0.0, and 12.0.1, TIBCO Spotfire Analyst: version 12.1.0, TIBCO Spotfire Analytics Platform for AWS Marketplace: versions 12.1.0 and below, TIBCO Spotfire Desktop: versions 11.4.4 and below, TIBCO Spotfire Desktop: versions 11.5.0, 11.6.0, 11.7.0, 11.8.0, 12.0.0, and 12.0.1, TIBCO Spotfire Desktop: version 12.1.0, TIBCO Spotfire Server: versions 11.4.8 and below, TIBCO Spotfire Server: versions 11.5.0, 11.6.0, 11.6.1, 11.6.2, 11.6.3, 11.7.0, 11.8.0, 11.8.1, 12.0.0, and 12.0.1, and TIBCO Spotfire Server: version 12.1.0. Additional Analyst Notes: - CVE Program
, 11.8.0, 11.8.1, 12.0.0, and 12.0.1, and TIBCO Spotfire Server: version 12.1.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.tibco.com/services/support/advisories - https://www.tibco.com/support/advisories/2022/11/tibco-security-advisory-november-15-2022-tibco-spotfire-cve-2022-41558
CVE ID: CVE-2022-41559 State: PUBLISHED Published: 2022-12-12T01:49:10.008Z Last Updated: 2025-04-22T20:14:04.667Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N) Vendors: TIBCO Software Inc. Products: TIBCO Nimbus Problem Types: Successful execution of these vulnerabilities will result in an attacker being able to execute commands with the privileges of the affected user. Description: The Web Client component of TIBCO Software Inc.'s TIBCO Nimbus contains an easily exploitable vulnerability that allows an unauthenticated attacker with network access to exploit an open redirect on the affected system. A successful attack using this vulnerability requires human inte
ess to exploit an open redirect on the affected system. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.'s TIBCO Nimbus: version 10.5.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.tibco.com/services/support/advisories
CVE ID: CVE-2022-41560 State: PUBLISHED Published: 2022-12-12T01:49:10.008Z Last Updated: 2025-04-22T19:29:48.505Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: TIBCO Software Inc. Products: TIBCO Nimbus Problem Types: Successful execution of this vulnerability can result in an unauthorized hang or frequently repeatable crash (complete DOS) of the affected system. Description: The Statement Set Upload via the Web Client component of TIBCO Software Inc.'s TIBCO Nimbus contains an easily exploitable vulnerability that allows a low privileged attacker with network access to execute a Denial of Service Attack on the affected system. Affected releases are TIBCO
d attacker with network access to execute a Denial of Service Attack on the affected system. Affected releases are TIBCO Software Inc.'s TIBCO Nimbus: version 10.5.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.tibco.com/services/support/advisories
CVE ID: CVE-2022-41561 State: PUBLISHED Published: 2022-12-15T03:44:03.964951Z Last Updated: 2024-09-17T02:05:41.937Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: TIBCO Software Inc. Products: TIBCO JasperReports Server, TIBCO JasperReports Server - Community Edition, TIBCO JasperReports Server - Developer Edition, TIBCO JasperReports Server for AWS Marketplace, TIBCO JasperReports Server for Microsoft Azure Problem Types: Successful execution of this vulnerability can result in an attacker gaining full user access to the affected system. Description: The JNDI Data Sources component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReport
em. Description: The JNDI Data Sources component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server - Community Edition, TIBCO JasperReports Server - Developer Edition, TIBCO JasperReports Server for AWS Marketplace, TIBCO JasperReports Server for AWS Marketplace, TIBCO JasperReports Server for Microsoft Azure, and TIBCO JasperReports Server for Microsoft Azure contains an easily exploitable vulnerability that allows a privileged/administrative attacker with network access to execute Remote Code Execution to obtain a reverse shell on the affected system. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Server: versions 8
reverse shell on the affected system. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Server: versions 8.0.2 and below, TIBCO JasperReports Server: version 8.1.0, TIBCO JasperReports Server - Community Edition: versions 8.1.0 and below, TIBCO JasperReports Server - Developer Edition: versions 8.1.0 and below, TIBCO JasperReports Server for AWS Marketplace: versions 8.0.2 and below, TIBCO JasperReports Server for AWS Marketplace: version 8.1.0, TIBCO JasperReports Server for Microsoft Azure: versions 8.0.2 and below, and TIBCO JasperReports Server for Microsoft Azure: version 8.1.0. Additional Analyst Notes: - CVE Program Container: References: - https://www.tibco.com/services
ft Azure: version 8.1.0. Additional Analyst Notes: - CVE Program Container: References: - https://www.tibco.com/services/support/advisories - https://www.tibco.com/support/advisories/2022/12/tibco-security-advisory-december-13-2022-tibco-jasperreports-server-cve-2022-41561
CVE ID: CVE-2022-41562 State: PUBLISHED Published: 2022-12-15T03:44:03.964951Z Last Updated: 2024-09-16T22:01:43.407Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H) Vendors: TIBCO Software Inc. Products: TIBCO JasperReports Server, TIBCO JasperReports Server - Community Edition, TIBCO JasperReports Server - Developer Edition, TIBCO JasperReports Server for AWS Marketplace, TIBCO JasperReports Server for Microsoft Azure Problem Types: Successful execution of this vulnerability can result in unauthorized read, update, insert or delete access to JasperReports Server and hang or frequently repeatable crash (complete DOS) of the affected system. This vulnerability can allo
eports Server and hang or frequently repeatable crash (complete DOS) of the affected system. This vulnerability can allow the attacker to exploit associated resources other than the affected system. Description: The HTML escaping component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server - Community Edition, TIBCO JasperReports Server - Developer Edition, TIBCO JasperReports Server for AWS Marketplace, TIBCO JasperReports Server for AWS Marketplace, TIBCO JasperReports Server for Microsoft Azure, and TIBCO JasperReports Server for Microsoft Azure contains an easily exploitable vulnerability that allows a privileged/administrative att
orts Server for Microsoft Azure contains an easily exploitable vulnerability that allows a privileged/administrative attacker with network access to execute an XSS attack on the affected system. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Server: versions 8.0.2 and below, TIBCO JasperReports Server: version 8.1.0, TIBCO JasperReports Server - Community Edition: versions 8.1.0 and below, TIBCO JasperReports Server - Developer Edition: versions 8.1.0 and below, TIBCO JasperReports Server for AWS Marketplace: versions 8.0.2 and below, TIBCO JasperReports Server for
1.0 and below, TIBCO JasperReports Server for AWS Marketplace: versions 8.0.2 and below, TIBCO JasperReports Server for AWS Marketplace: version 8.1.0, TIBCO JasperReports Server for Microsoft Azure: versions 8.0.2 and below, and TIBCO JasperReports Server for Microsoft Azure: version 8.1.0. Additional Analyst Notes: - CVE Program Container: References: - https://www.tibco.com/services/support/advisories - https://www.tibco.com/support/advisories/2022/12/tibco-security-advisory-december-13-2022-tibco-jasperreports-server-cve-2022-41562
CVE ID: CVE-2022-41563 State: PUBLISHED Published: 2022-12-15T03:44:03.964951Z Last Updated: 2024-09-16T19:36:24.781Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: TIBCO Software Inc. Products: TIBCO JasperReports Server, TIBCO JasperReports Server - Developer Edition, TIBCO JasperReports Server for AWS Marketplace, TIBCO JasperReports Server for Microsoft Azure Problem Types: Successful execution of these vulnerabilities will result in an attacker being able to execute commands with the privileges of the affected user. This vulnerability can allow the attacker to exploit associated resources other than the affected system. Description: The Dashboard compo
can allow the attacker to exploit associated resources other than the affected system. Description: The Dashboard component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server - Developer Edition, TIBCO JasperReports Server for AWS Marketplace, TIBCO JasperReports Server for AWS Marketplace, TIBCO JasperReports Server for Microsoft Azure, and TIBCO JasperReports Server for Microsoft Azure contains an easily exploitable vulnerability that allows a low privileged attacker with network access to execute Stored Cross Site Scripting (XSS) on the affected system. A successful attack using this vulnerability requires human interaction from a
Scripting (XSS) on the affected system. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Server: versions 8.0.2 and below, TIBCO JasperReports Server: version 8.1.0, TIBCO JasperReports Server - Developer Edition: versions 8.1.0 and below, TIBCO JasperReports Server for AWS Marketplace: versions 8.0.2 and below, TIBCO JasperReports Server for AWS Marketplace: version 8.1.0, TIBCO JasperReports Server for Microsoft Azure: versions 8.0.2 and below, and TIBCO JasperReports Server for Microsoft Azure: version 8.1.0. Additional Analyst Notes: - CVE Program Container: Refe
d TIBCO JasperReports Server for Microsoft Azure: version 8.1.0. Additional Analyst Notes: - CVE Program Container: References: - https://www.tibco.com/services/support/advisories - https://www.tibco.com/support/advisories/2022/12/tibco-security-advisory-december-13-2022-tibco-jasperreports-server-cve-2022-41563
CVE ID: CVE-2022-41564 State: PUBLISHED Published: 2023-02-14T00:00:00.000Z Last Updated: 2025-03-20T20:41:27.858Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N) Vendors: TIBCO Software Inc. Products: TIBCO Hawk, TIBCO Operational Intelligence Hawk RedTail Problem Types: The impact of this vulnerability includes the theoretical possibility of an authenticated Hawk Console user gaining administrative access to the EMS server. Description: The Hawk Console component of TIBCO Software Inc.'s TIBCO Hawk and TIBCO Operational Intelligence Hawk RedTail contains a vulnerability that will return the EMS transport password and EMS SSL password to a privileged user. Affected
ontains a vulnerability that will return the EMS transport password and EMS SSL password to a privileged user. Affected releases are TIBCO Software Inc.'s TIBCO Hawk: versions 6.1.0 through 6.2.1 and TIBCO Operational Intelligence Hawk RedTail: versions 7.0.0 through 7.2.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.tibco.com/services/support/advisories
CVE ID: CVE-2022-41565 State: PUBLISHED Published: 2023-02-22T00:00:00 Last Updated: 2024-08-03T12:49:43.191Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N) Vendors: TIBCO Software Inc. Products: TIBCO EBX, TIBCO Product and Service Catalog powered by TIBCO EBX Problem Types: The impact of this vulnerability includes the theoretical possibility resulting in unauthorized ability to update, insert or delete TIBCO EBX data. Description: The Web Application component of TIBCO Software Inc.'s TIBCO EBX and TIBCO Product and Service Catalog powered by TIBCO EBX contains an easily exploitable vulnerability that allows a low privileged attacker with network access to execute