Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-28997 State: PUBLISHED Published: 2022-05-23T13:35:17 Last Updated: 2024-08-03T06:10:57.489Z Vendors: n/a Products: n/a Problem Types: n/a Description: CSZCMS v1.3.0 allows attackers to execute a Server-Side Request Forgery (SSRF) which can be leveraged to leak sensitive data via a local file inclusion at /admin/filemanager/connector/. Additional Analyst Notes: - CVE Program Container: References: - https://packetstormsecurity.com/files/166613/CSZCMS-1.3.0-SSRF-LFI-Remote-Code-Execution.html - https://i.imgur.com/pzWjkXI.png - https://i.imgur.com/xxjxnGk.png - https://i.imgur.com/S1F7MaJ.png - https://i.imgur.com/BwWTfYU.png
CVE ID: CVE-2022-28998 State: PUBLISHED Published: 2022-05-23T13:35:18 Last Updated: 2024-08-03T06:10:58.496Z Vendors: n/a Products: n/a Problem Types: n/a Description: Xlight FTP v3.9.3.2 was discovered to contain a stack-based buffer overflow which allows attackers to leak sensitive information via crafted code. Additional Analyst Notes: - CVE Program Container: References: - https://packetstormsecurity.com/files/166381/Xlight-FTP-3.9.3.2-Buffer-Overflow.html - https://i.imgur.com/jMURHQF.png - https://i.imgur.com/aw6hZo2.png - https://streamable.com/gmqz5x
CVE ID: CVE-2022-28999 State: PUBLISHED Published: 2022-05-23T20:16:03 Last Updated: 2024-08-03T06:10:58.901Z Vendors: n/a Products: n/a Problem Types: n/a Description: Insecure permissions in the install directories and binaries of Dev-CPP v4.9.9.2 allows attackers to execute arbitrary code via overwriting the binary devcpp.exe. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ycdxsb/Vuln/blob/main/Dev-Cpp-BloodShed-Incorrect-Install-Permission
CVE ID: CVE-2022-29001 State: PUBLISHED Published: 2022-05-03T17:43:36 Last Updated: 2024-08-03T06:10:58.459Z Vendors: n/a Products: n/a Problem Types: n/a Description: In SpringBootMovie <=1.2, the uploaded file suffix parameter is not filtered, resulting in arbitrary file upload vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://github.com/lkmc2/SpringBootMovie/issues/4
CVE ID: CVE-2022-29002 State: PUBLISHED Published: 2022-05-23T20:50:39 Last Updated: 2024-08-03T06:10:57.917Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross-Site Request Forgery (CSRF) in XXL-Job v2.3.0 allows attackers to arbitrarily create administrator accounts via the component /gaia-job-admin/user/add. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/xuxueli/xxl-job/issues/2821
CVE ID: CVE-2022-29004 State: PUBLISHED Published: 2022-05-23T15:38:12 Last Updated: 2024-08-03T06:10:59.065Z Vendors: n/a Products: n/a Problem Types: n/a Description: Diary Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Name parameter in search-result.php. Additional Analyst Notes: - CVE Program Container: References: - http://phpgurukul.com - https://phpgurukul.com/e-diary-management-system-using-php-and-mysql/ - https://github.com/sudoninja-noob/CVE-2022-29004/blob/main/CVE-2022-29004.txt
CVE ID: CVE-2022-29005 State: PUBLISHED Published: 2022-05-23T15:31:49 Last Updated: 2024-08-03T06:10:58.380Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in the component /obcs/user/profile.php of Online Birth Certificate System v1.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the fname or lname parameters. Additional Analyst Notes: - CVE Program Container: References: - https://phpgurukul.com/online-birth-certificate-system-using-php-and-mysql/ - http://online.com - https://github.com/sudoninja-noob/CVE-2022-29005/blob/main/CVE-2022-29005.txt
CVE ID: CVE-2022-29006 State: PUBLISHED Published: 2022-05-11T13:08:00 Last Updated: 2024-08-03T06:10:58.867Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities via the username and password parameters in the Admin panel of Directory Management System v1.0 allows attackers to bypass authentication. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/50370 - https://github.com/sudoninja-noob/CVE-2022-29006/blob/main/CVE-2022-29006.txt
CVE ID: CVE-2022-29007 State: PUBLISHED Published: 2022-05-11T13:08:01 Last Updated: 2024-08-03T06:10:58.922Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities via the username and password parameters in the Admin panel of Dairy Farm Shop Management System v1.0 allows attackers to bypass authentication. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/50365 - https://github.com/sudoninja-noob/CVE-2022-29007/blob/main/CVE-2022-29007.txt
CVE ID: CVE-2022-29008 State: PUBLISHED Published: 2022-05-11T13:08:03 Last Updated: 2024-08-03T06:10:58.597Z Vendors: n/a Products: n/a Problem Types: n/a Description: An insecure direct object reference (IDOR) vulnerability in the viewid parameter of Bus Pass Management System v1.0 allows attackers to access sensitive information. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/50263 - https://github.com/sudoninja-noob/CVE-2022-29008/blob/main/CVE-2022-29008.txt
CVE ID: CVE-2022-29009 State: PUBLISHED Published: 2022-05-11T13:08:04 Last Updated: 2024-08-03T06:10:58.331Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities via the username and password parameters in the Admin panel of Cyber Cafe Management System Project v1.0 allows attackers to bypass authentication. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/50355 - https://github.com/sudoninja-noob/CVE-2022-29009/blob/main/CVE-2022-29009.txt
CVE ID: CVE-2022-29013 State: PUBLISHED Published: 2022-06-08T23:28:57 Last Updated: 2024-08-03T06:10:57.892Z Vendors: n/a Products: n/a Problem Types: n/a Description: A command injection in the command parameter of Razer Sila Gaming Router v2.0.441_api-2.0.418 allows attackers to execute arbitrary commands via a crafted POST request. Additional Analyst Notes: - CVE Program Container: References: - https://www2.razer.com/ap-en/desktops-and-networking/razer-sila - https://packetstormsecurity.com/files/166684/Razer-Sila-2.0.418-Command-Injection.html - https://www.exploit-db.com/exploits/50865
CVE ID: CVE-2022-29014 State: PUBLISHED Published: 2022-06-08T23:43:15 Last Updated: 2024-08-03T06:10:58.784Z Vendors: n/a Products: n/a Problem Types: n/a Description: A local file inclusion vulnerability in Razer Sila Gaming Router v2.0.441_api-2.0.418 allows attackers to read arbitrary files. Additional Analyst Notes: - CVE Program Container: References: - https://www2.razer.com/ap-en/desktops-and-networking/razer-sila - https://www.exploit-db.com/exploits/50864 - https://packetstormsecurity.com/files/166683/Razer-Sila-2.0.418-Local-File-Inclusion.html
CVE ID: CVE-2022-29017 State: PUBLISHED Published: 2022-05-16T13:26:09 Last Updated: 2024-08-03T06:10:58.612Z Vendors: n/a Products: n/a Problem Types: n/a Description: Bento4 v1.6.0.0 was discovered to contain a segmentation fault via the component /x86_64/multiarch/strlen-avx2.S. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/axiomatic-systems/Bento4/issues/691
CVE ID: CVE-2022-29020 State: PUBLISHED Published: 2022-04-15T23:25:00 Last Updated: 2024-08-03T06:10:59.262Z Vendors: n/a Products: n/a Problem Types: n/a Description: ForestBlog through 2022-02-16 allows admin/profile/save userAvatar XSS during addition of a user avatar. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/saysky/ForestBlog/issues/76
CVE ID: CVE-2022-29021 State: PUBLISHED Published: 2022-05-20T12:43:44.000Z Last Updated: 2025-11-03T19:26:57.884Z Vendors: n/a Products: n/a Problem Types: n/a Description: A buffer overflow vulnerability exists in the razerkbd driver of OpenRazer up to version v3.3.0 allows attackers to cause a Denial of Service (DoS) and possibly escalate their privileges via a crafted buffer sent to the matrix_custom_frame device. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/openrazer/openrazer/pull/1790 - https://www.cyberark.com/resources/threat-research-blog/colorful-vulnerabilities
CVE ID: CVE-2022-29022 State: PUBLISHED Published: 2022-05-20T12:43:50.000Z Last Updated: 2025-11-03T19:26:59.252Z Vendors: n/a Products: n/a Problem Types: n/a Description: A buffer overflow vulnerability exists in the razeraccessory driver of OpenRazer up to version v3.3.0 allows attackers to cause a Denial of Service (DoS) and possibly escalate their privileges via a crafted buffer sent to the matrix_custom_frame device. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/openrazer/openrazer/pull/1790 - https://www.cyberark.com/resources/threat-research-blog/colorful-vulnerabilities
CVE ID: CVE-2022-29023 State: PUBLISHED Published: 2022-05-20T12:43:46.000Z Last Updated: 2025-11-03T19:27:00.647Z Vendors: n/a Products: n/a Problem Types: n/a Description: A buffer overflow vulnerability exists in the razermouse driver of OpenRazer up to version v3.3.0 allows attackers to cause a Denial of Service (DoS) and possibly escalate their privileges via a crafted buffer sent to the matrix_custom_frame device. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/openrazer/openrazer/pull/1790 - https://www.cyberark.com/resources/threat-research-blog/colorful-vulnerabilities
CVE ID: CVE-2022-29028 State: PUBLISHED Published: 2022-05-10T09:47:05 Last Updated: 2024-08-03T06:10:58.706Z Vendors: Siemens Products: JT2Go, Teamcenter Visualization V13.3, Teamcenter Visualization V14.0 Problem Types: CWE-835 Description: A vulnerability has been identified in JT2Go (All versions < V13.3.0.3), Teamcenter Visualization V13.3 (All versions < V13.3.0.3), Teamcenter Visualization V14.0 (All versions < V14.0.0.1). The Tiff_Loader.dll is vulnerable to infinite loop condition while parsing specially crafted TIFF files. An attacker could leverage this vulnerability to crash the application causing denial of service condition. Additional Analyst Notes: - CVE Program Container: Re
lity to crash the application causing denial of service condition. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-553086.pdf
CVE ID: CVE-2022-29029 State: PUBLISHED Published: 2022-05-10T09:47:06 Last Updated: 2024-08-03T06:10:58.560Z Vendors: Siemens Products: JT2Go, Teamcenter Visualization V13.3, Teamcenter Visualization V14.0 Problem Types: CWE-476 Description: A vulnerability has been identified in JT2Go (All versions < V13.3.0.3), Teamcenter Visualization V13.3 (All versions < V13.3.0.3), Teamcenter Visualization V14.0 (All versions < V14.0.0.1). The CGM_NIST_Loader.dll contains a null pointer dereference vulnerability while parsing specially crafted CGM files. An attacker could leverage this vulnerability to crash the application causing denial of service condition. Additional Analyst Notes: - CVE Program C
is vulnerability to crash the application causing denial of service condition. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-553086.pdf
CVE ID: CVE-2022-29030 State: PUBLISHED Published: 2022-05-10T09:47:08 Last Updated: 2024-08-03T06:10:58.579Z Vendors: Siemens Products: JT2Go, Teamcenter Visualization V13.3, Teamcenter Visualization V14.0 Problem Types: CWE-680 Description: A vulnerability has been identified in JT2Go (All versions < V13.3.0.3), Teamcenter Visualization V13.3 (All versions < V13.3.0.3), Teamcenter Visualization V14.0 (All versions < V14.0.0.1). The Mono_Loader.dll library is vulnerable to integer overflow condition while parsing specially crafted TG4 files. An attacker could leverage this vulnerability to crash the application causing denial of service condition. Additional Analyst Notes: - CVE Program Con
vulnerability to crash the application causing denial of service condition. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-553086.pdf
CVE ID: CVE-2022-29031 State: PUBLISHED Published: 2022-05-10T09:47:09 Last Updated: 2024-08-03T06:10:58.678Z Vendors: Siemens Products: JT2Go, Teamcenter Visualization V13.3, Teamcenter Visualization V14.0 Problem Types: CWE-476 Description: A vulnerability has been identified in JT2Go (All versions < V13.3.0.3), Teamcenter Visualization V13.3 (All versions < V13.3.0.3), Teamcenter Visualization V14.0 (All versions < V14.0.0.1). The CGM_NIST_Loader.dll contains a null pointer dereference vulnerability while parsing specially crafted CGM files. An attacker could leverage this vulnerability to crash the application causing denial of service condition. Additional Analyst Notes: - CVE Program C
CVE ID: CVE-2022-29032 State: PUBLISHED Published: 2022-05-10T09:47:11 Last Updated: 2024-08-03T06:10:58.657Z Vendors: Siemens Products: JT2Go, Teamcenter Visualization V13.3, Teamcenter Visualization V14.0 Problem Types: CWE-415 Description: A vulnerability has been identified in JT2Go (All versions < V13.3.0.3), Teamcenter Visualization V13.3 (All versions < V13.3.0.3), Teamcenter Visualization V14.0 (All versions < V14.0.0.1). The CGM_NIST_Loader.dll library contains a double free vulnerability while parsing specially crafted CGM files. An attacker could leverage this vulnerability to execute code in the context of the current process. Additional Analyst Notes: - CVE Program Container: Re
lnerability to execute code in the context of the current process. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-553086.pdf
CVE ID: CVE-2022-29033 State: PUBLISHED Published: 2022-05-10T09:47:12 Last Updated: 2024-08-03T06:10:58.466Z Vendors: Siemens Products: JT2Go, Teamcenter Visualization V13.3, Teamcenter Visualization V14.0 Problem Types: CWE-824 Description: A vulnerability has been identified in JT2Go (All versions < V13.3.0.3), Teamcenter Visualization V13.3 (All versions < V13.3.0.3), Teamcenter Visualization V14.0 (All versions < V14.0.0.1). The CGM_NIST_Loader.dll library is vulnerable to uninitialized pointer free while parsing specially crafted CGM files. An attacker could leverage this vulnerability to execute code in the context of the current process. Additional Analyst Notes: - CVE Program Contai
this vulnerability to execute code in the context of the current process. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-553086.pdf
CVE ID: CVE-2022-29034 State: PUBLISHED Published: 2022-06-14T09:21:45 Last Updated: 2024-08-03T06:10:58.431Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:P/RL:O/RC:C) Vendors: Siemens Products: SINEMA Remote Connect Server Problem Types: CWE-79 Description: A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). An error message pop up window in the web interface of the affected application does not prevent injection of JavaScript code. This could allow attackers to perform reflected cross-site scripting (XSS) attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cert-portal.
attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf - http://seclists.org/fulldisclosure/2022/Jun/35 - http://packetstormsecurity.com/files/167554/SIEMENS-SINEMA-Remote-Connect-3.0.1.0-01.01.00.02-Cross-Site-Scripting.html - https://cert-portal.siemens.com/productcert/html/ssa-484086.html
CVE ID: CVE-2022-29035 State: PUBLISHED Published: 2022-04-11T18:12:43 Last Updated: 2024-08-03T06:10:58.321Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N) Vendors: JetBrains Products: Ktor Problem Types: CWE-330 Description: In JetBrains Ktor Native before version 2.0.0 random values used for nonce generation weren't using SecureRandom implementations Additional Analyst Notes: - CVE Program Container: References: - https://www.jetbrains.com/privacy-security/issues-fixed/ - https://github.com/ktorio/ktor/pull/2776
CVE ID: CVE-2022-29036 State: PUBLISHED Published: 2022-04-12T00:00:00 Last Updated: 2024-08-03T06:10:58.182Z Vendors: Jenkins project Products: Jenkins Credentials Plugin Description: Jenkins Credentials Plugin 1111.v35a_307992395 and earlier, except 1087.1089.v2f1b_9a_b_040e4, 1074.1076.v39c30cecb_0e2, and 2.6.1.1, does not escape the name and description of Credentials parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-2617
CVE ID: CVE-2022-29037 State: PUBLISHED Published: 2022-04-12T19:50:29 Last Updated: 2024-08-03T06:10:58.672Z Vendors: Jenkins project Products: Jenkins CVS Plugin Description: Jenkins CVS Plugin 2.19 and earlier does not escape the name and description of CVS Symbolic Name parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-2617
CVE ID: CVE-2022-29038 State: PUBLISHED Published: 2022-04-12T19:50:31 Last Updated: 2024-08-03T06:10:58.322Z Vendors: Jenkins project Products: Jenkins Extended Choice Parameter Plugin Description: Jenkins Extended Choice Parameter Plugin 346.vd87693c5a_86c and earlier does not escape the name and description of Extended Choice parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-2617
CVE ID: CVE-2022-29039 State: PUBLISHED Published: 2022-04-12T19:50:33 Last Updated: 2024-08-03T06:10:59.022Z Vendors: Jenkins project Products: Jenkins Gerrit Trigger Plugin Description: Jenkins Gerrit Trigger Plugin 2.35.2 and earlier does not escape the name and description of Base64 Encoded String parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-2617
CVE ID: CVE-2022-29040 State: PUBLISHED Published: 2022-04-12T19:50:35 Last Updated: 2024-08-03T06:10:58.702Z Vendors: Jenkins project Products: Jenkins Git Parameter Plugin Description: Jenkins Git Parameter Plugin 0.9.15 and earlier does not escape the name and description of Git parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-2617
CVE ID: CVE-2022-29041 State: PUBLISHED Published: 2022-04-12T19:50:36 Last Updated: 2024-08-03T06:10:58.714Z Vendors: Jenkins project Products: Jenkins Jira Plugin Description: Jenkins Jira Plugin 3.7 and earlier, except 3.6.1, does not escape the name and description of Jira Issue and Jira Release Version parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-2617
CVE ID: CVE-2022-29042 State: PUBLISHED Published: 2022-04-12T19:50:38 Last Updated: 2024-08-03T06:10:58.632Z Vendors: Jenkins project Products: Jenkins Job Generator Plugin Description: Jenkins Job Generator Plugin 1.22 and earlier does not escape the name and description of Generator Parameter and Generator Choice parameters on Job Generator jobs' Build With Parameters views, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-2617
CVE ID: CVE-2022-29043 State: PUBLISHED Published: 2022-04-12T19:50:39 Last Updated: 2024-08-03T06:10:58.614Z Vendors: Jenkins project Products: Jenkins Mask Passwords Plugin Description: Jenkins Mask Passwords Plugin 3.0 and earlier does not escape the name and description of Non-Stored Password parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-2617
CVE ID: CVE-2022-29044 State: PUBLISHED Published: 2022-04-12T19:50:41 Last Updated: 2024-08-03T06:10:58.796Z Vendors: Jenkins project Products: Jenkins Node and Label parameter Plugin Description: Jenkins Node and Label parameter Plugin 1.10.3 and earlier does not escape the name and description of Node and Label parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-2617
CVE ID: CVE-2022-29045 State: PUBLISHED Published: 2022-04-12T00:00:00 Last Updated: 2024-08-03T06:10:59.348Z Vendors: Jenkins project Products: Jenkins promoted builds Plugin Description: Jenkins promoted builds Plugin 873.v6149db_d64130 and earlier, except 3.10.1, does not escape the name and description of Promoted Build parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-2617
CVE ID: CVE-2022-29046 State: PUBLISHED Published: 2022-04-12T19:50:44 Last Updated: 2024-08-03T06:10:58.937Z Vendors: Jenkins project Products: Jenkins Subversion Plugin Description: Jenkins Subversion Plugin 2.15.3 and earlier does not escape the name and description of List Subversion tags (and more) parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-2617 - https://support.apple.com/kb/HT213345 - http://seclists.org/fulldisclosure/2022/Jul/18
CVE ID: CVE-2022-29047 State: PUBLISHED Published: 2022-04-12T19:50:46 Last Updated: 2024-11-20T15:35:52.801Z Vendors: Jenkins project Products: Jenkins Pipeline: Shared Groovy Libraries Plugin Description: Jenkins Pipeline: Shared Groovy Libraries Plugin 564.ve62a_4eb_b_e039 and earlier, except 2.21.3, allows attackers able to submit pull requests (or equivalent), but not able to commit directly to the configured SCM, to effectively change the Pipeline behavior by changing the definition of a dynamically retrieved library in their pull request, even if the Pipeline is configured to not trust them. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http
igured to not trust them. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-1951