Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
hically strong and therefore not suitable as keying material. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://hackerone.com/reports/1690000 - https://cert-portal.siemens.com/productcert/pdf/ssa-332410.pdf - https://security.netapp.com/advisory/ntap-20230113-0002/ - https://www.debian.org/security/2023/dsa-5326
CVE ID: CVE-2022-35256 State: PUBLISHED Published: 2022-12-05T00:00:00.000Z Last Updated: 2025-04-30T22:24:47.709Z Vendors: NodeJS Products: Node Problem Types: CWE-444 Description: The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF. This may result in HTTP Request Smuggling. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://hackerone.com/reports/1675191 - https://cert-portal.siemens.com/productcert/pdf/ssa-332410.pdf - https://www.debian.org/security/2023/dsa-5326
CVE ID: CVE-2022-35257 State: PUBLISHED Published: 2022-09-23T13:37:28.000Z Last Updated: 2025-05-22T20:34:00.743Z Vendors: n/a Products: UI Desktop for Windows Problem Types: Privilege Escalation (CAPEC-233) Description: A local privilege escalation vulnerability in UI Desktop for Windows (Version 0.55.1.2 and earlier) allows a malicious actor with local access to a Windows device with UI Desktop to run arbitrary commands as SYSTEM. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://community.ui.com/releases/Security-Advisory-Bulletin-025-025/7fc92851-054d-46d3-bdb0-fbb8f7023fed
CVE ID: CVE-2022-35258 State: PUBLISHED Published: 2022-12-05T00:00:00 Last Updated: 2024-08-03T09:29:17.434Z Vendors: n/a Products: Ivanti Connect Secure (ICS), Ivanti Policy Secure (IPS), and Ivanti Neurons for Zero Trust Access Gateway Problem Types: CWE-128 Description: An unauthenticated attacker can cause a denial-of-service to the following products: Ivanti Connect Secure (ICS) in versions prior to 9.1R14.3, 9.1R15.2, 9.1R16.2, and 22.2R4, Ivanti Policy Secure (IPS) in versions prior to 9.1R17 and 22.3R1, and Ivanti Neurons for Zero-Trust Access in versions prior to 22.3R1. Additional Analyst Notes: - CVE Program Container: References: - https://kb.pulsesecure.net/articles/Pulse_Secur
22.3R1. Additional Analyst Notes: - CVE Program Container: References: - https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA45520/?kA23Z000000GH5OSAW
CVE ID: CVE-2022-35259 State: PUBLISHED Published: 2022-12-05T00:00:00.000Z Last Updated: 2025-04-24T13:20:21.012Z Vendors: n/a Products: Ivanti Endpoint Manager Problem Types: CWE-91 Description: XML Injection with Endpoint Manager 2022. 3 and below causing a download of a malicious file to run and possibly execute to gain unauthorized privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-for-Ivanti-Endpoint-Manager-Client-CVE-2022-35259?language=en_US
CVE ID: CVE-2022-35260 State: PUBLISHED Published: 2022-12-05T00:00:00 Last Updated: 2024-11-19T20:09:10.400Z Vendors: n/a Products: https://github.com/curl/curl Problem Types: CWE-125 Description: curl can be told to parse a `.netrc` file for credentials. If that file endsin a line with 4095 consecutive non-white space letters and no newline, curlwould first read past the end of the stack-based buffer, and if the readworks, write a zero byte beyond its boundary.This will in most cases cause a segfault or similar, but circumstances might also cause different outcomes.If a malicious user can provide a custom netrc file to an application or otherwise affect its contents, this flaw could be use
alicious user can provide a custom netrc file to an application or otherwise affect its contents, this flaw could be used as denial-of-service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://hackerone.com/reports/1721098 - https://security.gentoo.org/glsa/202212-01 - https://security.netapp.com/advisory/ntap-20230110-0006/ - https://support.apple.com/kb/HT213604 - https://support.apple.com/kb/HT213605 - http://seclists.org/fulldisclosure/2023/Jan/20 - http://seclists.org/fulldisclosure/2023/Jan/19
CVE ID: CVE-2022-35261 State: PUBLISHED Published: 2022-10-25T16:34:02.102Z Last Updated: 2025-04-15T18:44:56.941Z Severity: MEDIUM (CVSS 4.9 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: Robustel Products: R1510 Problem Types: CWE-125 Description: A denial of service vulnerability exists in the web_server hashFirst functionality of Robustel R1510 3.1.16 and 3.3.0. A specially-crafted network request can lead to denial of service. An attacker can send a sequence of requests to trigger this vulnerability.This denial of service is in the `/action/import_authorized_keys/` API. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelli
ys/` API. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2022-1575
CVE ID: CVE-2022-35262 State: PUBLISHED Published: 2022-10-25T16:34:03.185Z Last Updated: 2025-04-15T18:44:50.684Z Severity: MEDIUM (CVSS 4.9 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: Robustel Products: R1510 Problem Types: CWE-125 Description: A denial of service vulnerability exists in the web_server hashFirst functionality of Robustel R1510 3.1.16 and 3.3.0. A specially-crafted network request can lead to denial of service. An attacker can send a sequence of requests to trigger this vulnerability.This denial of service is in the `/action/import_xml_file/` API. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.c
I. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2022-1575
CVE ID: CVE-2022-35263 State: PUBLISHED Published: 2022-10-25T16:34:04.171Z Last Updated: 2025-04-15T18:44:43.700Z Severity: MEDIUM (CVSS 4.9 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: Robustel Products: R1510 Problem Types: CWE-125 Description: A denial of service vulnerability exists in the web_server hashFirst functionality of Robustel R1510 3.1.16 and 3.3.0. A specially-crafted network request can lead to denial of service. An attacker can send a sequence of requests to trigger this vulnerability.This denial of service is in the `/action/import_file/` API. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/v
dditional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2022-1575
CVE ID: CVE-2022-35264 State: PUBLISHED Published: 2022-10-25T16:34:05.198Z Last Updated: 2025-04-15T18:44:36.543Z Severity: MEDIUM (CVSS 4.9 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: Robustel Products: R1510 Problem Types: CWE-125 Description: A denial of service vulnerability exists in the web_server hashFirst functionality of Robustel R1510 3.1.16 and 3.3.0. A specially-crafted network request can lead to denial of service. An attacker can send a sequence of requests to trigger this vulnerability.This denial of service is in the `/action/import_aaa_cert_file/` API. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintellige
/` API. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2022-1575
CVE ID: CVE-2022-35265 State: PUBLISHED Published: 2022-10-25T16:34:06.240Z Last Updated: 2025-04-15T18:44:28.782Z Severity: MEDIUM (CVSS 4.9 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: Robustel Products: R1510 Problem Types: CWE-125 Description: A denial of service vulnerability exists in the web_server hashFirst functionality of Robustel R1510 3.1.16 and 3.3.0. A specially-crafted network request can lead to denial of service. An attacker can send a sequence of requests to trigger this vulnerability.This denial of service is in the `/action/import_nodejs_app/` API. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence
API. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2022-1575
CVE ID: CVE-2022-35266 State: PUBLISHED Published: 2022-10-25T16:34:07.220Z Last Updated: 2025-04-15T18:44:20.140Z Severity: MEDIUM (CVSS 4.9 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: Robustel Products: R1510 Problem Types: CWE-125 Description: A denial of service vulnerability exists in the web_server hashFirst functionality of Robustel R1510 3.1.16 and 3.3.0. A specially-crafted network request can lead to denial of service. An attacker can send a sequence of requests to trigger this vulnerability.This denial of service is in the `/action/import_firmware/` API. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.c
CVE ID: CVE-2022-35267 State: PUBLISHED Published: 2022-10-25T16:34:08.220Z Last Updated: 2025-04-15T18:44:12.717Z Severity: MEDIUM (CVSS 4.9 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: Robustel Products: R1510 Problem Types: CWE-125 Description: A denial of service vulnerability exists in the web_server hashFirst functionality of Robustel R1510 3.1.16 and 3.3.0. A specially-crafted network request can lead to denial of service. An attacker can send a sequence of requests to trigger this vulnerability.This denial of service is in the `/action/import_https_cert_file/` API. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelli
le/` API. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2022-1575
CVE ID: CVE-2022-35268 State: PUBLISHED Published: 2022-10-25T16:34:09.277Z Last Updated: 2025-04-15T18:44:03.218Z Severity: MEDIUM (CVSS 4.9 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: Robustel Products: R1510 Problem Types: CWE-125 Description: A denial of service vulnerability exists in the web_server hashFirst functionality of Robustel R1510 3.1.16 and 3.3.0. A specially-crafted network request can lead to denial of service. An attacker can send a sequence of requests to trigger this vulnerability.This denial of service is in the `/action/import_sdk_file/` API. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.c
CVE ID: CVE-2022-35269 State: PUBLISHED Published: 2022-10-25T16:34:10.287Z Last Updated: 2025-04-15T18:43:53.027Z Severity: MEDIUM (CVSS 4.9 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: Robustel Products: R1510 Problem Types: CWE-125 Description: A denial of service vulnerability exists in the web_server hashFirst functionality of Robustel R1510 3.1.16 and 3.3.0. A specially-crafted network request can lead to denial of service. An attacker can send a sequence of requests to trigger this vulnerability.This denial of service is in the `/action/import_e2c_json_file/` API. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintellige
CVE ID: CVE-2022-35270 State: PUBLISHED Published: 2022-10-25T16:34:11.273Z Last Updated: 2025-04-15T18:43:45.110Z Severity: MEDIUM (CVSS 4.9 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: Robustel Products: R1510 Problem Types: CWE-125 Description: A denial of service vulnerability exists in the web_server hashFirst functionality of Robustel R1510 3.1.16 and 3.3.0. A specially-crafted network request can lead to denial of service. An attacker can send a sequence of requests to trigger this vulnerability.This denial of service is in the `/action/import_wireguard_cert_file/` API. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosint
t_file/` API. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2022-1575
CVE ID: CVE-2022-35271 State: PUBLISHED Published: 2022-10-25T16:34:12.271Z Last Updated: 2025-04-15T18:43:37.520Z Severity: MEDIUM (CVSS 4.9 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: Robustel Products: R1510 Problem Types: CWE-125 Description: A denial of service vulnerability exists in the web_server hashFirst functionality of Robustel R1510 3.1.16 and 3.3.0. A specially-crafted network request can lead to denial of service. An attacker can send a sequence of requests to trigger this vulnerability.This denial of service is in the `/action/import_cert_file/` API. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.
PI. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2022-1575
CVE ID: CVE-2022-35272 State: PUBLISHED Published: 2022-08-04T17:49:42.631794Z Last Updated: 2024-09-17T03:18:33.743Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: F5 Products: BIG-IP Problem Types: CWE-404 Description: In BIG-IP Versions 17.0.x before 17.0.0.1 and 16.1.x before 16.1.3.1, when source-port preserve-strict is configured on an HTTP Message Routing Framework (MRF) virtual server, undisclosed traffic may cause the Traffic Management Microkernel (TMM) to produce a core file and the connection to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Additional Analyst Notes: - CVE Program Container
which have reached End of Technical Support (EoTS) are not evaluated. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K90024104
CVE ID: CVE-2022-35273 State: PUBLISHED Published: 2022-09-08T07:10:43 Last Updated: 2024-08-03T09:36:44.082Z Vendors: Allied Telesis K.K. Products: CentreCOM AR260S V2 Problem Types: OS Command Injection Description: OS command injection vulnerability in GUI setting page of CentreCOM AR260S V2 firmware versions prior to Ver.3.3.7 allows a remote authenticated attacker to execute an arbitrary OS command. Additional Analyst Notes: - CVE Program Container: References: - https://www.allied-telesis.co.jp/support/list/faq/vuls/20220829.html - https://jvn.jp/en/jp/JVN45473612/index.html
CVE ID: CVE-2022-35274 State: REJECTED Published: N/A Last Updated: 2025-05-28T18:20:12.361Z Description: No description available.
CVE ID: CVE-2022-35275 State: PUBLISHED Published: 2022-09-09T14:39:56.177Z Last Updated: 2025-02-20T20:06:17.663Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: AlgolPlus Products: Advanced Order Export For WooCommerce (WordPress plugin) Problem Types: CWE-79 Description: Authenticated (shop manager+) Reflected Cross-Site Scripting (XSS) vulnerability in AlgolPlus Advanced Order Export For WooCommerce plugin <= 3.3.1 at WordPress. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/woo-order-export-lite/wordpress-advanced-order-export-for-woocommerce-plugin-3-3-1-reflected-
com/database/vulnerability/woo-order-export-lite/wordpress-advanced-order-export-for-woocommerce-plugin-3-3-1-reflected-cross-site-scripting-xss-vulnerability/_s_id=cve - https://wordpress.org/plugins/woo-order-export-lite/
CVE ID: CVE-2022-35276 State: PUBLISHED Published: 2022-11-11T15:48:52.849Z Last Updated: 2025-02-05T15:39:40.338Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) NUC 8 Compute Elements Problem Types: escalation of privilege Description: Improper access control in BIOS firmware for some Intel(R) NUC 8 Compute Elements before version CBWHL357.0096 may allow a privileged user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00752.html
CVE ID: CVE-2022-35277 State: PUBLISHED Published: 2022-09-09T14:39:55.645Z Last Updated: 2025-02-20T20:06:31.778Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: GetResponse Products: GetResponse for WordPress (WordPress plugin) Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in GetResponse plugin <= 5.5.20 at WordPress. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/getresponse-integration/wordpress-getresponse-plugin-5-5-18-cross-site-request-forgery-csrf-vulnerability-leading-to-api-key-update/_s_id=cve - https://wordpress.org/plug
in-5-5-18-cross-site-request-forgery-csrf-vulnerability-leading-to-api-key-update/_s_id=cve - https://wordpress.org/plugins/getresponse-integration/
CVE ID: CVE-2022-35278 State: PUBLISHED Published: 2022-08-23T00:00:00 Last Updated: 2024-08-03T09:36:44.249Z Vendors: Apache Software Foundation Products: Apache ActiveMQ Artemis Problem Types: CWE-80 Description: In Apache ActiveMQ Artemis prior to 2.24.0, an attacker could show malicious content and/or redirect users to a malicious URL in the web console by using HTML in the name of an address or queue. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread/bh6y81wtotg75337bpvxcjy436zfgf3n - https://security.netapp.com/advisory/ntap-20221209-0005/
CVE ID: CVE-2022-35279 State: PUBLISHED Published: 2022-11-03T00:00:00.000Z Last Updated: 2025-05-02T20:22:24.213Z Vendors: n/a Products: IBM Business Automation Workflow Problem Types: Information Disclosure Description: "IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, 19.0.0.1, 19.0.0.2, 19.0.0.3, 20.0.0.1, 20.0.0.2, 21.0.2, 21.0.3, and 22.0.1 could disclose sensitive version information to authenticated users which could be used in further attacks against the system. IBM X-Force ID: 230537." Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6829847
CVE ID: CVE-2022-35280 State: PUBLISHED Published: 2022-08-10T16:50:30.987960Z Last Updated: 2024-09-17T02:41:15.892Z Severity: MEDIUM (CVSS 4.6 CVSS:3.0/AC:L/C:H/UI:N/AV:P/A:N/PR:N/S:U/I:N/E:U/RL:O/RC:C) Vendors: IBM Products: Robotic Process Automation Problem Types: Obtain Information Description: IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 230634. Additional Analyst Notes: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/6610393 - https://exchange.xforce.ibmcloud.com/vulnerabilities/230634
CVE ID: CVE-2022-35281 State: PUBLISHED Published: 2023-01-06T16:50:24.699Z Last Updated: 2025-04-09T13:54:57.055Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L) Vendors: IBM Products: Maximo Asset Management, Maximo Manage Problem Types: CWE-1236 Description: IBM Maximo Asset Management 7.6.1.1, 7.6.1.2, 7.6.1.3 and the IBM Maximo Manage 8.3, 8.4 application in IBM Maximo Application Suite are vulnerable to CSV injection. IBM X-Force ID: 2306335. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6852669 - https://exchange.xforce.ibmcloud.com/vulnerabilities/230635
CVE ID: CVE-2022-35282 State: PUBLISHED Published: 2022-09-28T15:55:14.406Z Last Updated: 2025-05-20T20:33:22.362Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:A/S:U/UI:N/I:N/AC:L/PR:N/A:N/C:L/RC:C/RL:O/E:U) Vendors: IBM Products: WebSphere Application Server Problem Types: Gain Access Description: IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to server-side request forgery (SSRF). By sending a specially crafted request, an attacker with local network access could exploit this vulnerability to obtain sensitive data. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6824179 - https://exchange.xfor
Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6824179 - https://exchange.xforce.ibmcloud.com/vulnerabilities/230809
CVE ID: CVE-2022-35283 State: PUBLISHED Published: 2022-07-14T16:25:27.157457Z Last Updated: 2024-09-16T18:43:18.627Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AC:L/A:H/I:N/UI:N/C:N/S:U/AV:N/PR:L/RC:C/RL:O/E:U) Vendors: IBM Products: Security Verify Information Queue Problem Types: Denial of Service Description: IBM Security Verify Information Queue 10.0.2 could allow an authenticated user to cause a denial of service with a specially crafted HTTP request. Additional Analyst Notes: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/6603445 - https://exchange.xforce.ibmcloud.com/vulnerabilities/230810
CVE ID: CVE-2022-35284 State: PUBLISHED Published: 2022-07-25T17:20:20.194796Z Last Updated: 2024-09-16T16:33:29.674Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/PR:N/UI:N/A:N/I:N/C:L/AV:N/AC:L/S:U/RC:C/RL:O/E:U) Vendors: IBM Products: Security Verify Information Queue Problem Types: Obtain Information Description: IBM Security Verify Information Queue 10.0.2 could disclose sensitive information due to a missing or insecure SameSite attribute for a sensitive cookie. IBM X-Force ID: 230811. Additional Analyst Notes: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/6606663 - https://exchange.xforce.ibmcloud.com/vulnerabilities/230811
CVE ID: CVE-2022-35285 State: PUBLISHED Published: 2022-07-25T17:20:30.678787Z Last Updated: 2024-09-16T16:52:51.056Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/I:N/A:N/PR:L/UI:N/C:H/AV:N/AC:L/S:U/E:U/RL:O/RC:C) Vendors: IBM Products: Security Verify Information Queue Problem Types: Data Manipulation Description: IBM Security Verify Information Queue 10.0.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 230812. Additional Analyst Notes: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/6606819 - https://exchange.xforce.ibmcloud.com/vul
ogram Container: References: - https://www.ibm.com/support/pages/node/6606819 - https://exchange.xforce.ibmcloud.com/vulnerabilities/230812
CVE ID: CVE-2022-35286 State: PUBLISHED Published: 2022-07-26T14:25:28.095679Z Last Updated: 2024-09-17T01:46:39.800Z Severity: LOW (CVSS 3.1 CVSS:3.0/AC:H/C:N/UI:R/PR:N/AV:N/S:U/I:L/A:N/RC:C/RL:O/E:U) Vendors: IBM Products: Security Verify Information Queue Problem Types: Gain Access Description: IBM Security Verify Information Queue 10.0.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 230814. Additional Analyst Notes: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/6607057 - https://exchange.xforce.ibmcloud.com/vulnerabilit
tainer: References: - https://www.ibm.com/support/pages/node/6607057 - https://exchange.xforce.ibmcloud.com/vulnerabilities/230814