Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-23072 State: PUBLISHED Published: 2022-06-21T08:10:11.137919Z Last Updated: 2024-09-16T17:57:56.973Z Vendors: recipes Products: recipes Problem Types: CWE-79 Description: In Recipes, versions 1.0.5 through 1.2.5 are vulnerable to Stored Cross-Site Scripting (XSS), in “Add to Cart” functionality. When a victim accesses the food list page, then adds a new Food with a malicious javascript payload in the ‘Name’ parameter and clicks on the Add to Shopping Cart icon, an XSS payload will trigger. A low privileged attacker will have the victim's API key and can lead to admin's account takeover. Additional Analyst Notes: - CVE Program Container: References: - https://www.mend.io/vuln
d to admin's account takeover. Additional Analyst Notes: - CVE Program Container: References: - https://www.mend.io/vulnerability-database/CVE-2022-23072 - https://github.com/TandoorRecipes/recipes/commit/7b2117c0190d4f541ba4cc7ee4122f04738c4ac6
CVE ID: CVE-2022-23073 State: PUBLISHED Published: 2022-06-21T08:50:09.781991Z Last Updated: 2024-09-16T17:38:44.584Z Vendors: recipes Products: recipes Problem Types: CWE-79 Description: In Recipes, versions 1.0.5 through 1.2.5 are vulnerable to Stored Cross-Site Scripting (XSS), in copy to clipboard functionality. When a victim accesses the food list page, then adds a new Food with a malicious javascript payload in the ‘Name’ parameter and clicks on the clipboard icon, an XSS payload will trigger. A low privileged attacker will have the victim's API key and can lead to admin's account takeover. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/TandoorRecip
min's account takeover. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/TandoorRecipes/recipes/commit/7b2117c0190d4f541ba4cc7ee4122f04738c4ac6 - https://www.mend.io/vulnerability-database/CVE-2022-23073
CVE ID: CVE-2022-23074 State: PUBLISHED Published: 2022-06-21T09:20:10.647066Z Last Updated: 2024-09-16T18:55:57.596Z Vendors: recipes Products: recipes Problem Types: CWE-79 Description: In Recipes, versions 0.17.0 through 1.2.5 are vulnerable to Stored Cross-Site Scripting (XSS), in the ‘Name’ field of Keyword, Food and Unit components. When a victim accesses the Keyword/Food/Unit endpoints, the XSS payload will trigger. A low privileged attacker will have the victim's API key and can lead to admin's account takeover. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/TandoorRecipes/recipes/commit/7b2117c0190d4f541ba4cc7ee4122f04738c4ac6 - https://www.mend.
erences: - https://github.com/TandoorRecipes/recipes/commit/7b2117c0190d4f541ba4cc7ee4122f04738c4ac6 - https://www.mend.io/vulnerability-database/CVE-2022-23074
CVE ID: CVE-2022-23077 State: PUBLISHED Published: 2022-06-22T11:30:16.489248Z Last Updated: 2024-09-17T02:16:28.576Z Vendors: habitica Products: habitica Problem Types: CWE-79 Description: In habitica versions v4.119.0 through v4.232.2 are vulnerable to DOM XSS via the login page. Additional Analyst Notes: - CVE Program Container: References: - https://www.mend.io/vulnerability-database/CVE-2022-23077 - https://github.com/HabitRPG/habitica/commit/5bcfdbe066e8c899f3ecf3fdcdbacc2ecba7f02f
CVE ID: CVE-2022-23078 State: PUBLISHED Published: 2022-06-22T12:00:17.050620Z Last Updated: 2024-09-17T02:15:32.574Z Vendors: habitica Products: habitica Problem Types: CWE-601 Description: In habitica versions v4.119.0 through v4.232.2 are vulnerable to open redirect via the login page. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/HabitRPG/habitica/commit/5bcfdbe066e8c899f3ecf3fdcdbacc2ecba7f02f - https://www.mend.io/vulnerability-database/CVE-2022-23078
CVE ID: CVE-2022-23079 State: PUBLISHED Published: 2022-06-22T13:05:10.447280Z Last Updated: 2024-09-16T23:52:11.614Z Vendors: motor-admin Products: motor-admin Problem Types: CWE-116 Description: In motor-admin versions 0.0.1 through 0.2.56 are vulnerable to host header injection in the password reset functionality where malicious actor can send fake password reset email to arbitrary victim. Additional Analyst Notes: - CVE Program Container: References: - https://www.mend.io/vulnerability-database/CVE-2022-23079 - https://github.com/motor-admin/motor-admin/commit/a461b7507940a1fa062836daa89c82404fe3ecf9
CVE ID: CVE-2022-23080 State: PUBLISHED Published: 2022-06-22T15:40:10.515121Z Last Updated: 2024-09-17T02:22:06.874Z Vendors: directus Products: directus Problem Types: CWE-918 Description: In directus versions v9.0.0-beta.2 through 9.6.0 are vulnerable to server-side request forgery (SSRF) in the media upload functionality which allows a low privileged user to perform internal network port scans. Additional Analyst Notes: - CVE Program Container: References: - https://www.mend.io/vulnerability-database/CVE-2022-23080 - https://github.com/directus/directus/commit/6da3f1ed5034115b1da00440008351bf0d808d83
CVE ID: CVE-2022-23081 State: PUBLISHED Published: 2022-06-22T17:20:12.255496Z Last Updated: 2024-09-17T02:02:42.442Z Vendors: openlibrary Products: openlibrary Problem Types: CWE-79 Description: In openlibrary versions deploy-2016-07-0 through deploy-2021-12-22 are vulnerable to Reflected XSS. Additional Analyst Notes: - CVE Program Container: References: - https://www.mend.io/vulnerability-database/CVE-2022-23081 - https://github.com/internetarchive/openlibrary/pull/6597/commits/5460c8e8b517ef83c6a3b33654ba43ef0cbf051e
CVE ID: CVE-2022-23082 State: PUBLISHED Published: 2022-05-31T14:40:10.184672Z Last Updated: 2024-09-17T02:42:40.198Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: WhiteSource Products: CureKit Problem Types: CWE-22 Description: In CureKit versions v1.0.1 through v1.1.3 are vulnerable to path traversal as the function isFileOutsideDir fails to sanitize the user input which may lead to path traversal. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/whitesource/CureKit/commit/af35e870ed09411d2f1fae6db1b04598cd1a31b6 - https://www.mend.io/vulnerability-database/CVE-2022-23082
CVE ID: CVE-2022-23083 State: PUBLISHED Published: 2022-01-18T16:52:35 Last Updated: 2024-08-03T03:28:43.277Z Vendors: n/a Products: NetMaster Network Management for TCP/IP and NetMaster File Transfer Management Problem Types: Cross-Site Scripting Description: NetMaster 12.2 Network Management for TCP/IP and NetMaster File Transfer Management contain a XSS (Cross-Site Scripting) vulnerability in ReportCenter UI due to insufficient input validation that could potentially allow an attacker to execute code on the affected machine. Additional Analyst Notes: - CVE Program Container: References: - https://support.broadcom.com/external/content/security-advisories/NetMaster-12.2-ReportCenter-Vulnera
ner: References: - https://support.broadcom.com/external/content/security-advisories/NetMaster-12.2-ReportCenter-Vulnerability-CVE-2022-23083/20049
CVE ID: CVE-2022-23084 State: PUBLISHED Published: 2024-02-15T04:52:09.645Z Last Updated: 2025-02-13T16:28:58.743Z Vendors: FreeBSD Products: FreeBSD Description: The total size of the user-provided nmreq to nmreq_copyin() was first computed and then trusted during the copyin. This time-of-check to time-of-use bug could lead to kernel memory corruption. On systems configured to include netmap in their devfs_ruleset, a privileged process running in a jail can affect the host environment. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.freebsd.org/advisories/FreeBSD-SA-22:04.netmap.asc - https://security.netapp.com/advisory/ntap-202404
- https://security.freebsd.org/advisories/FreeBSD-SA-22:04.netmap.asc - https://security.netapp.com/advisory/ntap-20240419-0003/
CVE ID: CVE-2022-23085 State: PUBLISHED Published: 2024-02-15T04:52:17.556Z Last Updated: 2025-02-13T16:28:59.297Z Vendors: FreeBSD Products: FreeBSD Description: A user-provided integer option was passed to nmreq_copyin() without checking if it would overflow. This insufficient bounds checking could lead to kernel memory corruption. On systems configured to include netmap in their devfs_ruleset, a privileged process running in a jail can affect the host environment. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://security.freebsd.org/advisories/FreeBSD-SA-22:04.netmap.asc - https://security.netapp.com/advisory/ntap-20240322-0004/
CVE ID: CVE-2022-23086 State: PUBLISHED Published: 2024-02-15T04:57:19.622Z Last Updated: 2025-02-13T16:28:59.871Z Vendors: FreeBSD Products: FreeBSD Description: Handlers for *_CFG_PAGE read / write ioctls in the mpr, mps, and mpt drivers allocated a buffer of a caller-specified size, but copied to it a fixed size header. Other heap content would be overwritten if the specified size was too small. Users with access to the mpr, mps or mpt device node may overwrite heap data, potentially resulting in privilege escalation. Note that the device node is only accessible to root and members of the operator group. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Reference
and members of the operator group. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.freebsd.org/advisories/FreeBSD-SA-22:06.ioctl.asc - https://security.netapp.com/advisory/ntap-20240419-0002/
CVE ID: CVE-2022-23087 State: PUBLISHED Published: 2024-02-15T05:01:00.770Z Last Updated: 2025-03-27T19:54:15.083Z Vendors: FreeBSD Products: FreeBSD Description: The e1000 network adapters permit a variety of modifications to an Ethernet packet when it is being transmitted. These include the insertion of IP and TCP checksums, insertion of an Ethernet VLAN header, and TCP segmentation offload ("TSO"). The e1000 device model uses an on-stack buffer to generate the modified packet header when simulating these modifications on transmitted packets. When checksum offload is requested for a transmitted packet, the e1000 device model used a guest-provided value to specify the checksum offset in the
ested for a transmitted packet, the e1000 device model used a guest-provided value to specify the checksum offset in the on-stack buffer. The offset was not validated for certain packet types. A misbehaving bhyve guest could overwrite memory in the bhyve process on the host, possibly leading to code execution in the host context. The bhyve process runs in a Capsicum sandbox, which (depending on the FreeBSD version and bhyve configuration) limits the impact of exploiting this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.freebsd.org/advisories/FreeBSD-SA-22:05.bhyve.asc - https://security.netapp.com/advisory/ntap-20240415-000
ps://security.freebsd.org/advisories/FreeBSD-SA-22:05.bhyve.asc - https://security.netapp.com/advisory/ntap-20240415-0005/
CVE ID: CVE-2022-23088 State: PUBLISHED Published: 2024-02-15T05:03:38.536Z Last Updated: 2025-04-24T15:15:14.536Z Vendors: FreeBSD Products: FreeBSD Description: The 802.11 beacon handling routine failed to validate the length of an IEEE 802.11s Mesh ID before copying it to a heap-allocated buffer. While a FreeBSD Wi-Fi client is in scanning mode (i.e., not associated with a SSID) a malicious beacon frame may overwrite kernel memory, leading to remote code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://security.freebsd.org/advisories/FreeBSD-SA-22:07.wifi_meshid.asc
CVE ID: CVE-2022-23089 State: PUBLISHED Published: 2024-02-15T05:07:13.996Z Last Updated: 2025-03-13T21:52:54.797Z Vendors: FreeBSD Products: FreeBSD Description: When dumping core and saving process information, proc_getargv() might return an sbuf which have a sbuf_len() of 0 or -1, which is not properly handled. An out-of-bound read can happen when user constructs a specially crafted ps_string, which in turn can cause the kernel to crash. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://security.freebsd.org/advisories/FreeBSD-SA-22:09.elf.asc - https://security.netapp.com/advisory/ntap-20240415-0006/
CVE ID: CVE-2022-23090 State: PUBLISHED Published: 2024-02-15T05:09:27.389Z Last Updated: 2025-03-28T23:57:52.965Z Vendors: FreeBSD Products: FreeBSD Description: The aio_aqueue function, used by the lio_listio system call, fails to release a reference to a credential in an error case. An attacker may cause the reference count to overflow, leading to a use after free (UAF). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.freebsd.org/advisories/FreeBSD-SA-22:10.aio.asc - https://security.netapp.com/advisory/ntap-20240415-0007/
CVE ID: CVE-2022-23091 State: PUBLISHED Published: 2024-02-15T05:11:35.101Z Last Updated: 2025-02-13T16:29:02.596Z Vendors: FreeBSD Products: FreeBSD Description: A particular case of memory sharing is mishandled in the virtual memory system. This is very similar to SA-21:08.vm, but with a different root cause. An unprivileged local user process can maintain a mapping of a page after it is freed, allowing that process to read private data belonging to other processes or the kernel. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://security.freebsd.org/advisories/FreeBSD-SA-22:11.vm.asc - https://security.netapp.com/advisory/ntap-20240415-0008/
CVE ID: CVE-2022-23092 State: PUBLISHED Published: 2024-02-15T05:13:50.356Z Last Updated: 2025-02-13T16:29:03.221Z Vendors: FreeBSD Products: FreeBSD Description: The implementation of lib9p's handling of RWALK messages was missing a bounds check needed when unpacking the message contents. The missing check means that the receipt of a specially crafted message will cause lib9p to overwrite unrelated memory. The bug can be triggered by a malicious bhyve guest kernel to overwrite memory in the bhyve(8) process. This could potentially lead to user-mode code execution on the host, subject to bhyve's Capsicum sandbox. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Ref
st, subject to bhyve's Capsicum sandbox. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.freebsd.org/advisories/FreeBSD-SA-22:12.lib9p.asc - https://security.netapp.com/advisory/ntap-20240415-0009/
CVE ID: CVE-2022-23093 State: PUBLISHED Published: 2024-02-15T05:18:44.628Z Last Updated: 2024-10-28T18:30:58.278Z Vendors: FreeBSD Products: FreeBSD Description: ping reads raw IP packets from the network to process responses in the pr_pack() function. As part of processing a response ping has to reconstruct the IP header, the ICMP header and if present a "quoted packet," which represents the packet that generated an ICMP error. The quoted packet again has an IP header and an ICMP header. The pr_pack() copies received IP and ICMP headers into stack buffers for further processing. In so doing, it fails to take into account the possible presence of IP option headers following the IP header in
essing. In so doing, it fails to take into account the possible presence of IP option headers following the IP header in either the response or the quoted packet. When IP options are present, pr_pack() overflows the destination buffer by up to 40 bytes. The memory safety bugs described above can be triggered by a remote host, causing the ping program to crash. The ping process runs in a capability mode sandbox on all affected versions of FreeBSD and is thus very constrained in how it can interact with the rest of the system at the point where the bug can occur. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://security.freebsd.org/advisories/Fr
nalyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://security.freebsd.org/advisories/FreeBSD-SA-22:15.ping.asc
CVE ID: CVE-2022-23094 State: PUBLISHED Published: 2022-01-15T01:37:32 Last Updated: 2024-08-03T03:28:43.512Z Vendors: n/a Products: n/a Problem Types: n/a Description: Libreswan 4.2 through 4.5 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted IKEv1 packet because pluto/ikev1.c wrongly expects that a state object exists. This is fixed in 4.6. Additional Analyst Notes: - CVE Program Container: References: - https://libreswan.org/security/CVE-2022-23094 - https://github.com/libreswan/libreswan/issues/585 - https://www.debian.org/security/2022/dsa-5048 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
www.debian.org/security/2022/dsa-5048 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UFZ7WP5LNNBW5ADIOPDSPQ23SXZJRNMP/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HPMIHAXWQUJAPCIGNJ5J5Q6ASWQBU7T5/
CVE ID: CVE-2022-23095 State: PUBLISHED Published: 2022-01-15T14:36:32.000Z Last Updated: 2025-05-05T16:28:04.492Z Vendors: n/a Products: n/a Problem Types: n/a Description: Open Design Alliance Drawings SDK before 2022.12.1 mishandles the loading of JPG files. Unchecked input data from a crafted JPG file leads to memory corruption. An attacker can leverage this vulnerability to execute code in the context of the current process. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.opendesign.com/security-advisories
CVE ID: CVE-2022-23096 State: PUBLISHED Published: 2022-01-28T00:00:00 Last Updated: 2024-10-15T15:12:52.871Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the DNS proxy in Connman through 1.40. The TCP server reply implementation lacks a check for the presence of sufficient Header Data, leading to an out-of-bounds read. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/pub/scm/network/connman/connman.git/log/ - https://www.openwall.com/lists/oss-security/2022/01/25/1 - https://lists.debian.org/debian-lts-announce/2022/02/msg00009.html - https://www.debian.org/security/2022/dsa-5231 - https
tps://lists.debian.org/debian-lts-announce/2022/02/msg00009.html - https://www.debian.org/security/2022/dsa-5231 - https://security.gentoo.org/glsa/202310-21
CVE ID: CVE-2022-23097 State: PUBLISHED Published: 2022-01-28T00:00:00 Last Updated: 2024-11-19T19:10:45.191Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the DNS proxy in Connman through 1.40. forward_dns_reply mishandles a strnlen call, leading to an out-of-bounds read. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/pub/scm/network/connman/connman.git/log/ - https://www.openwall.com/lists/oss-security/2022/01/25/1 - https://lists.debian.org/debian-lts-announce/2022/02/msg00009.html - https://www.debian.org/security/2022/dsa-5231 - https://security.gentoo.org/glsa/202310-21
CVE ID: CVE-2022-23098 State: PUBLISHED Published: 2022-01-28T00:00:00 Last Updated: 2024-08-03T03:28:43.511Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the DNS proxy in Connman through 1.40. The TCP server reply implementation has an infinite loop if no data is received. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/pub/scm/network/connman/connman.git/log/ - https://www.openwall.com/lists/oss-security/2022/01/25/1 - https://lists.debian.org/debian-lts-announce/2022/02/msg00009.html - https://www.debian.org/security/2022/dsa-5231 - https://security.gentoo.org/glsa/202310-21
CVE ID: CVE-2022-23099 State: PUBLISHED Published: 2022-07-27T13:25:54 Last Updated: 2024-08-03T03:36:19.073Z Vendors: n/a Products: n/a Problem Types: n/a Description: OX App Suite through 7.10.6 allows XSS by forcing block-wise read. Additional Analyst Notes: - CVE Program Container: References: - https://open-xchange.com - https://seclists.org/fulldisclosure/2022/Jul/11
CVE ID: CVE-2022-23100 State: PUBLISHED Published: 2022-07-27T13:23:24 Last Updated: 2024-08-03T03:36:19.073Z Vendors: n/a Products: n/a Problem Types: n/a Description: OX App Suite through 7.10.6 allows OS Command Injection via Documentconverter (e.g., through an email attachment). Additional Analyst Notes: - CVE Program Container: References: - https://open-xchange.com - https://seclists.org/fulldisclosure/2022/Jul/11
CVE ID: CVE-2022-23101 State: PUBLISHED Published: 2022-07-27T13:30:51 Last Updated: 2024-08-03T03:36:19.072Z Vendors: n/a Products: n/a Problem Types: n/a Description: OX App Suite through 7.10.6 allows XSS via appHandler in a deep link in an e-mail message. Additional Analyst Notes: - CVE Program Container: References: - https://open-xchange.com - https://seclists.org/fulldisclosure/2022/Jul/11
CVE ID: CVE-2022-23102 State: PUBLISHED Published: 2022-02-09T15:17:29 Last Updated: 2024-08-03T03:36:19.220Z Vendors: Siemens Products: SINEMA Remote Connect Server Problem Types: CWE-601 Description: A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V2.0). Affected products contain an open redirect vulnerability. An attacker could trick a valid authenticated user to the device into clicking a malicious link there by leading to phishing attacks. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-654775.pdf - http://seclists.org/fulldisclosure/2022/Feb/20 - http://packetstormsecurity.com/files
m/productcert/pdf/ssa-654775.pdf - http://seclists.org/fulldisclosure/2022/Feb/20 - http://packetstormsecurity.com/files/165966/SIEMENS-SINEMA-Remote-Connect-1.0-SP3-HF1-Open-Redirection.html
CVE ID: CVE-2022-23103 State: PUBLISHED Published: 2022-08-05T21:12:03.828Z Last Updated: 2025-04-15T18:58:24.988Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: TCL Products: LinkHub Mesh Wifi Problem Types: CWE-121 Description: A stack-based buffer overflow vulnerability exists in the confsrv confctl_set_app_language functionality of TCL LinkHub Mesh Wi-Fi MS1G_00_01.00_14. A specially-crafted network packet can lead to stack-based buffer overflow. An attacker can send a malicious packet to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports
tes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2022-1462
CVE ID: CVE-2022-23104 State: PUBLISHED Published: 2022-02-24T18:26:59.219Z Last Updated: 2025-04-16T16:44:41.517Z Severity: MEDIUM (CVSS 5.6 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:L) Vendors: WIN-911 Products: WIN-911 Problem Types: CWE-276 Description: WIN-911 2021 R1 and R2 are vulnerable to a permissions misconfiguration that may allow an attacker to locally write files to the program Operator Workspace directory, which holds DLL files and executables. A low-privilege attacker could write a malicious DLL file to the Operator Workspace directory to achieve privilege escalation and the permissions of the user running the program. Additional Analyst Notes: - CVE Program Container: - CIS
escalation and the permissions of the user running the program. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-053-03 - https://supportdesk.win911.com/support/solutions/articles/24000074683-win-911-2021-r1-r2-file-permission-vulnerability
CVE ID: CVE-2022-23105 State: PUBLISHED Published: 2022-01-12T19:06:02 Last Updated: 2024-08-03T03:36:19.191Z Vendors: Jenkins project Products: Jenkins Active Directory Plugin Description: Jenkins Active Directory Plugin 2.25 and earlier does not encrypt the transmission of data between the Jenkins controller and Active Directory servers in most configurations. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-01-12/#SECURITY-1389 - http://www.openwall.com/lists/oss-security/2022/01/12/6