Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
stem leading to a complete system compromise of Aruba EdgeConnect Enterprise Orchestration with versions 9.1.x branch only, Any 9.1.x Orchestrator instantiated as a new machine with a release prior to 9.1.3.40197, Orchestrators upgraded to 9.1.x were not affected. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-015.txt
CVE ID: CVE-2022-37916 State: PUBLISHED Published: 2022-12-08T00:00:00.000Z Last Updated: 2025-04-23T15:58:50.350Z Vendors: n/a Products: Aruba AirWave Management Platform Problem Types: Broken Access Control Description: Vulnerabilities in the AirWave Management Platform web-based management interface exist which expose some URLs to a lack of proper access controls. These vulnerabilities could allow a remote attacker with limited privileges to gain access to sensitive information and/or change network configurations with privileges at a higher effective level in Aruba AirWave Management Platform version(s): 8.2.15.0 and below. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vu
ave Management Platform version(s): 8.2.15.0 and below. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-019.txt
CVE ID: CVE-2022-37917 State: PUBLISHED Published: 2022-12-08T00:00:00.000Z Last Updated: 2025-04-23T15:57:51.161Z Vendors: n/a Products: Aruba AirWave Management Platform Problem Types: Broken Access Control Description: Vulnerabilities in the AirWave Management Platform web-based management interface exist which expose some URLs to a lack of proper access controls. These vulnerabilities could allow a remote attacker with limited privileges to gain access to sensitive information and/or change network configurations with privileges at a higher effective level in Aruba AirWave Management Platform version(s): 8.2.15.0 and below. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vu
CVE ID: CVE-2022-37918 State: PUBLISHED Published: 2022-12-08T00:00:00.000Z Last Updated: 2025-04-23T15:53:16.798Z Vendors: n/a Products: Aruba AirWave Management Platform Problem Types: Broken Access Control Description: Vulnerabilities in the AirWave Management Platform web-based management interface exist which expose some URLs to a lack of proper access controls. These vulnerabilities could allow a remote attacker with limited privileges to gain access to sensitive information and/or change network configurations with privileges at a higher effective level in Aruba AirWave Management Platform version(s): 8.2.15.0 and below. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vu
CVE ID: CVE-2022-37919 State: PUBLISHED Published: 2022-11-30T19:05:20.811Z Last Updated: 2025-04-24T18:44:22.441Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Hewlett Packard Enterprise (HPE) Products: Aruba EdgeConnect Enterprise Software Problem Types: n/a Description: A vulnerability exists in the API of Aruba EdgeConnect Enterprise. An unauthenticated attacker can exploit this condition via the web-based management interface to create a denial-of-service condition which prevents the appliance from properly responding to API requests in Aruba EdgeConnect Enterprise Software version(s): ECOS 9.2.1.0 and below; ECOS 9.1.3.0 and below; ECOS 9.0.7.0 and bel
n Aruba EdgeConnect Enterprise Software version(s): ECOS 9.2.1.0 and below; ECOS 9.1.3.0 and below; ECOS 9.0.7.0 and below; ECOS 8.3.7.1 and below; Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-018.txt
CVE ID: CVE-2022-37920 State: PUBLISHED Published: 2022-11-30T19:08:31.129Z Last Updated: 2025-04-24T18:50:29.890Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Hewlett Packard Enterprise (HPE) Products: Aruba EdgeConnect Enterprise Software Problem Types: n/a Description: Vulnerabilities in the Aruba EdgeConnect Enterprise command line interface allow remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complete system compromise in Aruba EdgeConnect Enterprise Software version(s): ECOS 9.2.1.0 and below; E
tem leading to complete system compromise in Aruba EdgeConnect Enterprise Software version(s): ECOS 9.2.1.0 and below; ECOS 9.1.3.0 and below; ECOS 9.0.7.0 and below; ECOS 8.3.7.1 and below. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-018.txt
CVE ID: CVE-2022-37921 State: PUBLISHED Published: 2022-11-30T19:13:33.318Z Last Updated: 2025-04-24T18:50:05.363Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Hewlett Packard Enterprise (HPE) Products: Aruba EdgeConnect Enterprise Software Problem Types: n/a Description: Vulnerabilities in the Aruba EdgeConnect Enterprise command line interface allow remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complete system compromise in Aruba EdgeConnect Enterprise Software version(s): ECOS 9.2.1.0 and below; E
CVE ID: CVE-2022-37922 State: PUBLISHED Published: 2022-11-30T19:15:08.091Z Last Updated: 2025-04-24T18:51:19.032Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Hewlett Packard Enterprise (HPE) Products: Aruba EdgeConnect Enterprise Software Problem Types: n/a Description: Vulnerabilities in the Aruba EdgeConnect Enterprise command line interface allow remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complete system compromise in Aruba EdgeConnect Enterprise Software version(s): ECOS 9.2.1.0 and below; E
CVE ID: CVE-2022-37923 State: PUBLISHED Published: 2022-11-30T19:16:16.680Z Last Updated: 2025-04-24T18:56:29.994Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Hewlett Packard Enterprise (HPE) Products: Aruba EdgeConnect Enterprise Software Problem Types: n/a Description: Vulnerabilities in the Aruba EdgeConnect Enterprise command line interface allow remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complete system compromise in Aruba EdgeConnect Enterprise Software version(s): ECOS 9.2.1.0 and below; E
CVE ID: CVE-2022-37924 State: PUBLISHED Published: 2022-11-30T19:19:47.752Z Last Updated: 2025-04-24T19:12:04.362Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Hewlett Packard Enterprise (HPE) Products: Aruba EdgeConnect Enterprise Software Problem Types: n/a Description: Vulnerabilities in the Aruba EdgeConnect Enterprise command line interface allow remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complete system compromise in Aruba EdgeConnect Enterprise Software version(s): ECOS 9.2.1.0 and below; E
CVE ID: CVE-2022-37925 State: PUBLISHED Published: 2022-11-30T19:22:47.051Z Last Updated: 2025-04-24T18:32:38.786Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Hewlett Packard Enterprise (HPE) Products: Aruba EdgeConnect Enterprise Software Problem Types: n/a Description: A vulnerability within the web-based management interface of Aruba EdgeConnect Enterprise could allow a remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the interface. A successful exploit could allow an attacker to execute arbitrary script code in a victim's browser in the context of the affected interface in Aruba EdgeConnect Enterprise Softwar
trary script code in a victim's browser in the context of the affected interface in Aruba EdgeConnect Enterprise Software version(s): ECOS 9.2.1.0 and below; ECOS 9.1.3.0 and below; ECOS 9.0.7.0 and below; ECOS 8.3.7.1 and below. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-018.txt
CVE ID: CVE-2022-37926 State: PUBLISHED Published: 2022-11-30T19:24:36.310Z Last Updated: 2025-04-24T18:32:00.258Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: Hewlett Packard Enterprise (HPE) Products: Aruba EdgeConnect Enterprise Software Problem Types: n/a Description: A vulnerability within the web-based management interface of EdgeConnect Enterprise could allow a remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface by uploading a specially crafted file. A successful exploit could allow an attacker to execute arbitrary script code in a victim's browser in the context of the affected interface in Aruba E
w an attacker to execute arbitrary script code in a victim's browser in the context of the affected interface in Aruba EdgeConnect Enterprise Software version(s): ECOS 9.2.1.0 and below; ECOS 9.1.3.0 and below; ECOS 9.0.7.0 and below; ECOS 8.3.7.1 and below. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-018.txt
CVE ID: CVE-2022-37927 State: PUBLISHED Published: 2022-11-03T14:53:01.153Z Last Updated: 2025-05-01T15:40:45.496Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Hewlett Packard Enterprise (HPE) Products: HPE OneView Global Dashboard (OVGD) Problem Types: n/a Description: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Hewlett Packard Enterprise HPE OneView Global Dashboard (OVGD). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=hpesbhf04370en_us
CVE ID: CVE-2022-37928 State: PUBLISHED Published: 2022-11-03T15:51:30.227Z Last Updated: 2025-05-02T19:31:43.460Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Hewlett Packard Enterprise (HPE) Products: HPE Nimble Storage Hybrid Flash Arrays; Nimble Storage Secondary Flash Arrays Problem Types: n/a Description: Insufficient Verification of Data Authenticity vulnerability in Hewlett Packard Enterprise HPE Nimble Storage Hybrid Flash Arrays and Nimble Storage Secondary Flash Arrays. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst04359en
Vulnrichment: References: - https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst04359en_us
CVE ID: CVE-2022-37929 State: PUBLISHED Published: 2022-11-03T15:37:25.244Z Last Updated: 2025-05-02T19:32:48.107Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Hewlett Packard Enterprise (HPE) Products: HPE Nimble Storage Hybrid Flash Arrays; Nimble Storage Secondary Flash Arrays Problem Types: n/a Description: Improper Privilege Management vulnerability in Hewlett Packard Enterprise Nimble Storage Hybrid Flash Arrays and Nimble Storage Secondary Flash Arrays. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst04360en_us
CVE ID: CVE-2022-37930 State: PUBLISHED Published: 2022-11-03T15:46:07.571Z Last Updated: 2025-05-02T19:32:22.733Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Hewlett Packard Enterprise (HPE) Products: HPE Nimble Storage Hybrid Flash Arrays; Nimble Storage Secondary Flash Arrays Problem Types: n/a Description: A security vulnerability has been identified in HPE Nimble Storage Hybrid Flash Arrays and HPE Nimble Storage Secondary Flash Arrays which could potentially allow local disclosure of sensitive information. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpsc/doc/public/display?docLoc
: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst04361en_us
CVE ID: CVE-2022-37931 State: PUBLISHED Published: 2022-11-22T04:39:30.511Z Last Updated: 2025-04-25T20:32:36.732Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L) Vendors: HPE Products: NetBatch-Plus software Problem Types: CWE-287 Description: A vulnerability in NetBatch-Plus software allows unauthorized access to the application. HPE has provided a workaround and fix. Please refer to HPE Security Bulletin HPESBNS04388 for details. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=hpesbns04388en_us
CVE ID: CVE-2022-37932 State: PUBLISHED Published: 2022-11-30T15:23:14.750Z Last Updated: 2025-04-24T18:42:08.233Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Hewlett Packard Enterprise (HPE) Products: Hewlett Packard Enterprise OfficeConnect 1820, 1850, and 1920S Network switches Problem Types: n/a Description: A potential security vulnerability has been identified in Hewlett Packard Enterprise OfficeConnect 1820, 1850, and 1920S Network switches. The vulnerability could be remotely exploited to allow authentication bypass. HPE has made the following software updates to resolve the vulnerability in Hewlett Packard Enterprise OfficeConnect 1820, 1850 and 1
the following software updates to resolve the vulnerability in Hewlett Packard Enterprise OfficeConnect 1820, 1850 and 1920S Network switches versions: Prior to PT.02.14; Prior to PC.01.22; Prior to PO.01.21; Prior to PD.02.22; Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbnw04383en_us
CVE ID: CVE-2022-37933 State: PUBLISHED Published: 2023-01-03T18:31:35.870Z Last Updated: 2025-04-10T15:45:08.304Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:L) Vendors: Hewlett Packard Enterprise (HPE) Products: HPE Superdome Flex Server; HPE Superdome Flex 280 Server Problem Types: n/a Description: A potential security vulnerability has been identified in HPE Superdome Flex and Superdome Flex 280 servers. The vulnerability could be exploited to allow local unauthorized data injection. HPE has made the following software updates to resolve the vulnerability in HPE Superdome Flex firmware 3.60.50 and below and Superdome Flex 280 servers firmware 1.40.60 and below. Ad
erability in HPE Superdome Flex firmware 3.60.50 and below and Superdome Flex 280 servers firmware 1.40.60 and below. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04400en_us
CVE ID: CVE-2022-37934 State: PUBLISHED Published: 2023-01-03T18:33:15.954Z Last Updated: 2025-04-10T15:42:45.470Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N) Vendors: Hewlett Packard Enterprise (HPE) Products: HPE OfficeConnect 1820 and 1850 Switch Series Problem Types: n/a Description: A potential security vulnerability has been identified in HPE OfficeConnect 1820, and 1850 switch series. The vulnerability could be remotely exploited to allow remote directory traversal in HPE OfficeConnect 1820 switch series version PT.02.17 and below, HPE OfficeConnect 1850 switch series version PC.01.23 and below, and HPE OfficeConnect 1850 (10G aggregator) switch version PO
ficeConnect 1850 switch series version PC.01.23 and below, and HPE OfficeConnect 1850 (10G aggregator) switch version PO.01.22 and below. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbnw04401en_us
CVE ID: CVE-2022-37935 State: PUBLISHED Published: 2023-02-18T01:27:45.128Z Last Updated: 2025-03-12T17:43:51.900Z Vendors: Hewlett Packard Enterprise (HPE) Products: HPE OneView for VMware vCenter, Problem Types: n/a Description: HPE OneView for VMware vCenter, in certain circumstances, may disclose the “HPE OneView” Username and Password. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=hpesbgn04449en_us
CVE ID: CVE-2022-37936 State: PUBLISHED Published: 2023-02-22T21:02:28.674Z Last Updated: 2025-03-17T18:28:59.547Z Vendors: Hewlett Packard Enterprise (HPE) Products: HPE Serviceguard for Linux Problem Types: n/a Description: Unauthenticated Java deserialization vulnerability in Serviceguard Manager Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=hpesbmu04452en_us
CVE ID: CVE-2022-37937 State: PUBLISHED Published: 2023-02-22T21:19:45.875Z Last Updated: 2025-03-17T18:29:27.240Z Vendors: Hewlett Packard Enterprise (HPE) Products: HPE Serviceguard for Linux Problem Types: n/a Description: Pre-auth memory corruption in HPE Serviceguard Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=hpesbmu04452en_us
CVE ID: CVE-2022-37938 State: PUBLISHED Published: 2023-02-22T21:21:21.535Z Last Updated: 2025-03-17T18:29:50.533Z Vendors: Hewlett Packard Enterprise (HPE) Products: HPE Serviceguard for Linux Problem Types: n/a Description: Unauthenticated server side request forgery in HPE Serviceguard Manager Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=hpesbmu04452en_us
CVE ID: CVE-2022-37939 State: PUBLISHED Published: 2023-03-08T20:48:26.082Z Last Updated: 2025-02-28T19:57:12.662Z Severity: LOW (CVSS 2.3 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N) Vendors: Hewlett Packard Enterprise (HPE) Products: HPE Superdome Flex Servers; HPE Superdome Flex 280 Servers Problem Types: n/a Description: A potential security vulnerability has been identified in HPE Superdome Flex and Superdome Flex 280 servers. The vulnerability could be locally exploited to allow disclosure of information. HPE has made the following software to resolve the vulnerability in HPE Superdome Flex Servers v3.65.8 and Superdome Flex 280 Servers v1.45.8. Additional Analyst Notes: - CVE Program
ty in HPE Superdome Flex Servers v3.65.8 and Superdome Flex 280 Servers v1.45.8. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04453en_us
CVE ID: CVE-2022-37940 State: PUBLISHED Published: 2023-03-15T15:43:18.713Z Last Updated: 2025-02-27T14:16:11.174Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Hewlett Packard Enterprise (HPE) Products: HPE FlexFabric 5700 Switch Series Problem Types: n/a Description: Potential security vulnerabilities have been identified in the HPE FlexFabric 5700 Switch Series. These vulnerabilities could be remotely exploited to allow host header injection and URL redirection. HPE has made the following software to resolve the vulnerability in HPE FlexFabric 5700 Switch Series version R2432P61 or later. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vul
exFabric 5700 Switch Series version R2432P61 or later. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbnw04398en_us
CVE ID: CVE-2022-37941 State: REJECTED Published: N/A Last Updated: 2023-03-13T19:36:52.407Z Description: No description available.
CVE ID: CVE-2022-37942 State: REJECTED Published: N/A Last Updated: 2023-03-13T19:37:09.373Z Description: No description available.
CVE ID: CVE-2022-37943 State: REJECTED Published: N/A Last Updated: 2023-03-13T19:37:40.546Z Description: No description available.
CVE ID: CVE-2022-37944 State: REJECTED Published: N/A Last Updated: 2023-03-13T19:37:52.022Z Description: No description available.
CVE ID: CVE-2022-37945 State: REJECTED Published: N/A Last Updated: 2023-03-13T19:38:02.144Z Description: No description available.
CVE ID: CVE-2022-37946 State: REJECTED Published: N/A Last Updated: 2023-03-13T19:38:15.478Z Description: No description available.
CVE ID: CVE-2022-37947 State: REJECTED Published: N/A Last Updated: 2023-03-13T19:38:29.943Z Description: No description available.
CVE ID: CVE-2022-37948 State: REJECTED Published: N/A Last Updated: 2023-03-13T19:38:48.980Z Description: No description available.
CVE ID: CVE-2022-37949 State: REJECTED Published: N/A Last Updated: 2023-03-13T19:39:03.292Z Description: No description available.
CVE ID: CVE-2022-37950 State: REJECTED Published: N/A Last Updated: 2023-03-13T19:39:16.220Z Description: No description available.
CVE ID: CVE-2022-37951 State: REJECTED Published: N/A Last Updated: 2023-03-13T19:39:29.645Z Description: No description available.
CVE ID: CVE-2022-37952 State: PUBLISHED Published: 2022-08-25T17:26:10.090096Z Last Updated: 2024-09-17T01:41:41.508Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: GE Gas Power Products: WorkstationST Problem Types: CWE-79 Description: A reflected cross-site scripting (XSS) vulnerability exists in the iHistorian Data Display of WorkstationST (<v07.09.15) could allow an attacker to compromise a victim's browser. WorkstationST is only deployed in specific, controlled environments rendering attack complexity significantly higher than if the attack were conducted on the software in isolation. WorkstationST v07.09.15 can be found in ControlST v07.09.07 SP8 and
attack were conducted on the software in isolation. WorkstationST v07.09.15 can be found in ControlST v07.09.07 SP8 and greater. Additional Analyst Notes: - CVE Program Container: References: - https://www.ge.com/content/dam/cyber_security/global/en_US/pdfs/2022-08-23_WorkstationST_Reflected_XSS.pdf
CVE ID: CVE-2022-37953 State: PUBLISHED Published: 2022-08-25T17:26:02.044195Z Last Updated: 2024-09-16T18:09:11.130Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: GE Gas Power Products: WorkstationST Problem Types: CWE-113 Description: An HTTP response splitting vulnerability exists in the AM Gateway Challenge-Response dialog of WorkstationST (<v07.09.15) and could allow an attacker to compromise a victim's browser/session. WorkstationST is only deployed in specific, controlled environments rendering attack complexity significantly higher than if the attack were conducted on the software in isolation. WorkstationST v07.09.15 can be found in ControlST v07.
r than if the attack were conducted on the software in isolation. WorkstationST v07.09.15 can be found in ControlST v07.09.07 SP8 and greater. Additional Analyst Notes: - CVE Program Container: References: - https://www.ge.com/content/dam/cyber_security/global/en_US/pdfs/2022-08-23_WorkstationST_Response_Splitting.pdf