Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-29495 State: PUBLISHED Published: 2022-07-22T16:39:03.757Z Last Updated: 2025-02-20T20:16:27.863Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: Sygnoos Products: Popup Builder (WordPress plugin) Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Sygnoos Popup Builder plugin <= 4.1.11 at WordPress allows an attacker to update plugin settings. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/popup-builder/#developers - https://patchstack.com/database/vulnerability/popup-builder/wordpress-popup-builder-plugin-4-1-11-cross-site-request-fo
https://patchstack.com/database/vulnerability/popup-builder/wordpress-popup-builder-plugin-4-1-11-cross-site-request-forgery-csrf-leading-to-plugin-settings-update
CVE ID: CVE-2022-29496 State: PUBLISHED Published: 2022-06-17T17:40:15.112Z Last Updated: 2025-04-15T19:00:23.847Z Severity: CRITICAL (CVSS 9 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Blynk Products: Blynk-Library Problem Types: CWE-121 Description: A stack-based buffer overflow vulnerability exists in the BlynkConsole.h runCommand functionality of Blynk -Library v1.0.1. A specially-crafted network request can lead to command execution. An attacker can send a network request to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2022-1524
CVE ID: CVE-2022-29498 State: PUBLISHED Published: 2022-04-21T04:26:16 Last Updated: 2024-08-03T06:26:06.075Z Vendors: n/a Products: n/a Problem Types: n/a Description: Blazer before 2.6.0 allows SQL Injection. In certain circumstances, an attacker could get a user to run a query they would not have normally run. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ankane/blazer/issues/392
CVE ID: CVE-2022-29499 State: PUBLISHED Published: 2022-04-26T01:13:58.000Z Last Updated: 2025-10-21T23:15:40.565Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Service Appliance component in Mitel MiVoice Connect through 19.2 SP3 allows remote code execution because of incorrect data validation. The Service Appliances are SA 100, SA 400, and Virtual SA. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-22-0002
CVE ID: CVE-2022-29500 State: PUBLISHED Published: 2022-05-05T16:14:04 Last Updated: 2024-08-03T06:26:05.935Z Vendors: n/a Products: n/a Problem Types: n/a Description: SchedMD Slurm 21.08.x through 20.11.x has Incorrect Access Control that leads to Information Disclosure. Additional Analyst Notes: - CVE Program Container: References: - https://www.schedmd.com/news.php - https://lists.schedmd.com/pipermail/slurm-announce/ - https://www.schedmd.com/news.php?id=260 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y6B7OWVNVCJUDE6VDWGCBUWMRCRETAO3/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/
E6VDWGCBUWMRCRETAO3/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YBI4NFDGGMBKWG4EMSZL5UHATDCLPCQW/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HXLOI3ERTKMZR2KWNRN7OR5S55VPWENH/ - https://www.debian.org/security/2022/dsa-5166
CVE ID: CVE-2022-29501 State: PUBLISHED Published: 2022-05-05T16:13:56 Last Updated: 2024-08-03T06:26:05.998Z Vendors: n/a Products: n/a Problem Types: n/a Description: SchedMD Slurm 21.08.x through 20.11.x has Incorrect Access Control that leads to Escalation of Privileges and code execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.schedmd.com/news.php - https://lists.schedmd.com/pipermail/slurm-announce/ - https://www.schedmd.com/news.php?id=260 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y6B7OWVNVCJUDE6VDWGCBUWMRCRETAO3/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedor
message/Y6B7OWVNVCJUDE6VDWGCBUWMRCRETAO3/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YBI4NFDGGMBKWG4EMSZL5UHATDCLPCQW/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HXLOI3ERTKMZR2KWNRN7OR5S55VPWENH/ - https://www.debian.org/security/2022/dsa-5166
CVE ID: CVE-2022-29502 State: PUBLISHED Published: 2022-05-05T16:13:50 Last Updated: 2024-08-03T06:26:05.875Z Vendors: n/a Products: n/a Problem Types: n/a Description: SchedMD Slurm 21.08.x through 20.11.x has Incorrect Access Control that leads to Escalation of Privileges. Additional Analyst Notes: - CVE Program Container: References: - https://www.schedmd.com/news.php - https://lists.schedmd.com/pipermail/slurm-announce/ - https://www.schedmd.com/news.php?id=260 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y6B7OWVNVCJUDE6VDWGCBUWMRCRETAO3/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/messag
UDE6VDWGCBUWMRCRETAO3/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YBI4NFDGGMBKWG4EMSZL5UHATDCLPCQW/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HXLOI3ERTKMZR2KWNRN7OR5S55VPWENH/
CVE ID: CVE-2022-29503 State: PUBLISHED Published: 2022-09-29T16:35:09.040Z Last Updated: 2025-04-15T18:49:23.011Z Severity: HIGH (CVSS 8.1 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Anker, uClibC, uClibC-ng Products: Eufy Homebase 2, uClibC, uClibC-ng Problem Types: CWE-119 Description: A memory corruption vulnerability exists in the libpthread linuxthreads functionality of uClibC 0.9.33.2 and uClibC-ng 1.0.40. Thread allocation can lead to memory corruption. An attacker can create threads to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2022-1517
CVE ID: CVE-2022-29504 State: REJECTED Published: 2022-09-29T16:35:09 Last Updated: 2022-09-29T16:35:09 Description: No description available.
CVE ID: CVE-2022-29505 State: PUBLISHED Published: 2022-04-27T14:28:30 Last Updated: 2024-08-03T06:26:05.981Z Vendors: LINE Corporation Products: LINE for Windows Problem Types: n/a Description: Due to build misconfiguration in openssl dependency, LINE for Windows before 7.8 is vulnerable to DLL injection that could lead to privilege escalation. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/1423049
CVE ID: CVE-2022-29506 State: PUBLISHED Published: 2022-06-14T07:05:41 Last Updated: 2024-08-03T06:26:06.231Z Vendors: FUJI ELECTRIC CO., LTD. / Hakko Electronics Co., Ltd. Products: V-SFT Problem Types: Out-of-bounds Read Description: Out-of-bounds read vulnerability exist in the simulator module contained in the graphic editor 'V-SFT' v6.1.3.0 and earlier, which may allow an attacker to obtain information and/or execute arbitrary code by having a user to open a specially crafted image file. Additional Analyst Notes: - CVE Program Container: References: - https://monitouch.fujielectric.com/site/download-e/09vsft6_inf/Search.php - https://monitouch.fujielectric.com/site/download-eu/03tellus_
.fujielectric.com/site/download-e/09vsft6_inf/Search.php - https://monitouch.fujielectric.com/site/download-eu/03tellus_inf/index.php - https://jvn.jp/en/vu/JVNVU93134398/index.html
CVE ID: CVE-2022-29507 State: PUBLISHED Published: 2022-08-18T19:59:44.000Z Last Updated: 2025-02-18T15:29:27.931Z Vendors: n/a Products: version Problem Types: information disclosure Description: Insufficiently protected credentials in the Intel(R) Team Blue mobile application in all versions may allow an authenticated user to potentially enable information disclosure via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00705.html
CVE ID: CVE-2022-29508 State: PUBLISHED Published: 2023-05-10T13:16:51.664Z Last Updated: 2025-01-27T18:07:35.068Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H) Vendors: n/a Products: Intel(R) VROC software Problem Types: escalation of privilege, CWE-395 Description: Null pointer dereference in the Intel(R) VROC software before version 7.7.6.1003 may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00692.html
CVE ID: CVE-2022-29509 State: PUBLISHED Published: 2022-06-14T07:05:42 Last Updated: 2024-08-03T06:26:05.979Z Vendors: T&D Corporation Products: T&D Data Server and THERMO RECORDER DATA SERVER Problem Types: Directory traversal Description: Directory traversal vulnerability in T&D Data Server (Japanese Edition) Ver.2.22 and earlier, T&D Data Server (English Edition) Ver.2.30 and earlier, THERMO RECORDER DATA SERVER (Japanese Edition) Ver.2.13 and earlier, and THERMO RECORDER DATA SERVER (English Edition) Ver.2.13 and earlier allows a remote attacker to view an arbitrary file on the server via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://tandd.
e on the server via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://tandd.com/news/detail.html?id=696 - https://www.tandd.co.jp/news/detail.html?id=522 - https://jvn.jp/en/jp/JVN28659051/index.html
CVE ID: CVE-2022-29510 State: PUBLISHED Published: 2023-11-14T19:05:10.662Z Last Updated: 2024-08-03T06:26:06.561Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) Server Board M10JNP2SB BIOS firmware Problem Types: escalation of privilege, CWE-92 Description: Improper buffer restrictions in some Intel(R) Server Board M10JNP2SB BIOS firmware before version 7.219 may allow a privileged user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00719.html
CVE ID: CVE-2022-29511 State: PUBLISHED Published: 2022-12-19T10:00:14.221Z Last Updated: 2025-04-15T18:38:53.155Z Severity: CRITICAL (CVSS 9.1 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Lansweeper Products: lansweeper Problem Types: CWE-22 Description: A directory traversal vulnerability exists in the KnowledgebasePageActions.aspx ImportArticles functionality of Lansweeper lansweeper 10.1.1.0. A specially-crafted HTTP request can lead to arbitrary file read. An attacker can send an HTTP request to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2022-153
ram Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2022-1530
CVE ID: CVE-2022-29512 State: PUBLISHED Published: 2022-07-11T00:40:21 Last Updated: 2024-08-03T06:26:06.155Z Vendors: Cybozu, Inc. Products: Cybozu Garoon Problem Types: Exposure of Sensitive Information to an Unauthorized Actor Description: Exposure of sensitive information to an unauthorized actor issue in multiple applications of Cybozu Garoon 4.0.0 to 5.9.1 allows a remote authenticated attacker to obtain the data without the viewing privilege. Additional Analyst Notes: - CVE Program Container: References: - https://cs.cybozu.co.jp/2022/007682.html - https://jvn.jp/en/jp/JVN14077132/index.html
CVE ID: CVE-2022-29513 State: PUBLISHED Published: 2022-07-04T06:56:38 Last Updated: 2024-08-03T06:26:06.276Z Vendors: Cybozu, Inc. Products: Cybozu Garoon Problem Types: Cross-site scripting Description: Cross-site scripting vulnerability in Scheduler of Cybozu Garoon 4.10.0 to 5.5.1 allows a remote authenticated attacker with an administrative privilege to execute an arbitrary script. Additional Analyst Notes: - CVE Program Container: References: - https://cs.cybozu.co.jp/2022/007429.html - https://jvn.jp/en/jp/JVN73897863/index.html
CVE ID: CVE-2022-29514 State: PUBLISHED Published: 2023-02-16T20:00:10.247Z Last Updated: 2025-01-27T18:18:52.247Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H) Vendors: n/a Products: Intel(R) SUR software Problem Types: escalation of privilege Description: Improper access control in the Intel(R) SUR software before version 2.4.8902 may allow an unauthenticated user to potentially enable escalation of privilege via network access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00729.html
CVE ID: CVE-2022-29515 State: PUBLISHED Published: 2022-11-11T15:48:37.745Z Last Updated: 2025-02-05T20:53:46.770Z Severity: MEDIUM (CVSS 6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H) Vendors: n/a Products: Intel(R) SPS Problem Types: denial of service Description: Missing release of memory after effective lifetime in firmware for Intel(R) SPS before versions SPS_E3_06.00.03.035.0 may allow a privileged user to potentially enable denial of service via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00610.html
CVE ID: CVE-2022-29516 State: PUBLISHED Published: 2022-05-18T09:50:24 Last Updated: 2024-08-03T06:26:06.087Z Vendors: FUJITSU LIMITED Products: IPCOM EX2 series, IPCOM EX series, IPCOM VE2 series, and IPCOM VA2/VE1 series Problem Types: OS Command Injection Description: The web console of FUJITSU Network IPCOM series (IPCOM EX2 IN(3200, 3500), IPCOM EX2 LB(1100, 3200, 3500), IPCOM EX2 SC(1100, 3200, 3500), IPCOM EX2 NW(1100, 3200, 3500), IPCOM EX2 DC, IPCOM EX2 DC, IPCOM EX IN(2300, 2500, 2700), IPCOM EX LB(1100, 1300, 2300, 2500, 2700), IPCOM EX SC(1100, 1300, 2300, 2500, 2700), and IPCOM EX NW(1100, 1300, 2300, 2500, 2700)) allows a remote attacker to execute an arbitrary OS command via u
2700), and IPCOM EX NW(1100, 1300, 2300, 2500, 2700)) allows a remote attacker to execute an arbitrary OS command via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://www.fujitsu.com/jp/products/network/support/2022/ipcom-01/ - https://jvn.jp/en/jp/JVN96561229/index.html
CVE ID: CVE-2022-29517 State: PUBLISHED Published: 2022-12-19T10:00:14.221Z Last Updated: 2025-04-15T18:38:44.384Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Lansweeper Products: lansweeper Problem Types: CWE-22 Description: A directory traversal vulnerability exists in the HelpdeskActions.aspx edittemplate functionality of Lansweeper lansweeper 10.1.1.0. A specially-crafted HTTP request can lead to arbitrary file upload. An attacker can send an HTTP request to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2022-1529
CVE ID: CVE-2022-29518 State: PUBLISHED Published: 2022-05-18T09:50:26 Last Updated: 2024-08-03T06:26:06.156Z Vendors: KOYO ELECTRONICS INDUSTRIES CO., LTD. Products: Screen Creator Advance2, HMI GC-A2 series, and Real time remote monitoring and control tool Problem Types: Reliance on Untrusted Inputs in a Security Decision Description: Screen Creator Advance2, HMI GC-A2 series, and Real time remote monitoring and control tool Screen Creator Advance2 versions prior to Ver.0.1.1.3 Build01, HMI GC-A2 series(GC-A22W-CW, GC-A24W-C(W), GC-A26W-C(W), GC-A24, GC-A24-M, GC-A25, GC-A26, and GC-A26-J2), and Real time remote monitoring and control tool(Remote GC) allows a local attacker to bypass authe
A26, and GC-A26-J2), and Real time remote monitoring and control tool(Remote GC) allows a local attacker to bypass authentication due to the improper check for the Remote control setting's account names. This may allow attacker who can access the HMI from Real time remote monitoring and control tool may perform arbitrary operations on the HMI. As a result, the information stored in the HMI may be disclosed, deleted or altered, and/or the equipment may be illegally operated via the HMI. Additional Analyst Notes: - CVE Program Container: References: - https://www.koyoele.co.jp/en/topics/202205095016/ - https://jvn.jp/en/jp/JVN50337155/index.html
CVE ID: CVE-2022-29519 State: PUBLISHED Published: 2022-06-28T10:05:31 Last Updated: 2024-08-03T06:26:05.949Z Vendors: Yokogawa Electric Corporation Products: STARDOM Controller Problem Types: Cleartext Transmission of Sensitive Information Description: Cleartext transmission of sensitive information vulnerability exists in STARDOM FCN Controller and FCJ Controller R1.01 to R4.31, which may allow an adjacent attacker to login the affected products and alter device configuration settings or tamper with device firmware. Additional Analyst Notes: - CVE Program Container: References: - https://web-material3.yokogawa.com/1/32885/files/YSAR-22-0007-E.pdf - https://web-material3.yokogawa.com/19/328
ences: - https://web-material3.yokogawa.com/1/32885/files/YSAR-22-0007-E.pdf - https://web-material3.yokogawa.com/19/32885/files/YSAR-22-0007-J.pdf - https://jvn.jp/vu/JVNVU95452299/index.html - https://www.cisa.gov/uscert/ics/advisories/icsa-22-174-01
CVE ID: CVE-2022-29520 State: PUBLISHED Published: 2022-10-25T16:33:36.201Z Last Updated: 2025-04-15T18:48:26.587Z Severity: HIGH (CVSS 8.1 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: abode systems, inc. Products: iota All-In-One Security Kit Problem Types: CWE-489 Description: An OS command injection vulnerability exists in the console_main_loop :sys functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9Z. A specially-crafted XCMD can lead to arbitrary command execution. An attacker can send an XML payload to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerabil
Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2022-1561
CVE ID: CVE-2022-29522 State: PUBLISHED Published: 2022-06-14T07:05:44 Last Updated: 2024-08-03T06:26:06.350Z Vendors: FUJI ELECTRIC CO., LTD. / Hakko Electronics Co., Ltd. Products: V-SFT Problem Types: Use After Free Description: Use after free vulnerability exists in the simulator module contained in the graphic editor 'V-SFT' versions prior to v6.1.6.0, which may allow an attacker to obtain information and/or execute arbitrary code by having a user to open a specially crafted image file. Additional Analyst Notes: - CVE Program Container: References: - https://monitouch.fujielectric.com/site/download-e/09vsft6_inf/Search.php - https://jvn.jp/en/vu/JVNVU99188133/index.html
CVE ID: CVE-2022-29523 State: PUBLISHED Published: 2023-02-16T20:00:20.422Z Last Updated: 2025-01-27T18:15:30.931Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: n/a Products: Open CAS software maintained by Intel(R) Problem Types: denial of service Description: Improper conditions check in the Open CAS software maintained by Intel(R) before version 22.3.1 may allow an authenticated user to potentially enable denial of service via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00736.html
CVE ID: CVE-2022-29524 State: PUBLISHED Published: 2022-06-14T07:05:45 Last Updated: 2024-08-03T06:26:06.068Z Vendors: FUJI ELECTRIC CO., LTD. / Hakko Electronics Co., Ltd. Products: V-Server and V-Server Lite Problem Types: Out-of-bounds Write Description: Out-of-bounds write vulnerability exists in V-Server v4.0.11.0 and earlier and V-Server Lite v4.0.13.0 and earlier, which may allow an attacker to obtain information and/or execute arbitrary code by having a user to open a specially crafted image file. Additional Analyst Notes: - CVE Program Container: References: - https://monitouch.fujielectric.com/site/download-e/09vsft6_inf/Search.php - https://monitouch.fujielectric.com/site/download
s://monitouch.fujielectric.com/site/download-e/09vsft6_inf/Search.php - https://monitouch.fujielectric.com/site/download-eu/03tellus_inf/index.php - https://jvn.jp/en/vu/JVNVU93134398/index.html
CVE ID: CVE-2022-29525 State: PUBLISHED Published: 2022-06-13T04:50:33 Last Updated: 2024-08-03T06:26:05.961Z Vendors: Rakuten Mobile, Inc. Products: Rakuten Casa Problem Types: Use of Hard-coded credentials Description: Rakuten Casa version AP_F_V1_4_1 or AP_F_V2_0_0 uses a hard-coded credential which may allow a remote unauthenticated attacker to log in with the root privilege and perform an arbitrary operation. Additional Analyst Notes: - CVE Program Container: References: - https://network.mobile.rakuten.co.jp/information/news/product/1033/ - https://jvn.jp/en/jp/JVN46892984/index.html
CVE ID: CVE-2022-29526 State: PUBLISHED Published: 2022-06-22T13:15:32 Last Updated: 2024-08-03T06:26:06.342Z Vendors: n/a Products: n/a Problem Types: n/a Description: Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Assignment. When called with a non-zero flags parameter, the Faccessat function could incorrectly report that a file is accessible. Additional Analyst Notes: - CVE Program Container: References: - https://groups.google.com/g/golang-announce - https://github.com/golang/go/issues/52313 - https://groups.google.com/g/golang-announce/c/Y5qrqw_lWdU - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZY2SLWOQR4ZURQ7UBRZ7
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZY2SLWOQR4ZURQ7UBRZ7JIX6H6F5JHJR/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q6GE5EQGE4L2KRVGW4T75QVIYAXCLO5X/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z55VUVGO7E5PJFXIOVAY373NZRHBNCI5/ - https://security.netapp.com/advisory/ntap-20220729-0001/ - https://security.gentoo.org/glsa/202208-02 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RQXU752ALW53OJAF5MG3WMR5CCZVLWW6/
CVE ID: CVE-2022-29527 State: PUBLISHED Published: 2022-04-20T09:09:07 Last Updated: 2024-08-03T06:26:05.924Z Vendors: n/a Products: n/a Problem Types: n/a Description: Amazon AWS amazon-ssm-agent before 3.1.1208.0 creates a world-writable sudoers file, which allows local attackers to inject Sudo rules and escalate privileges to root. This occurs in certain situations involving a race condition. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/aws/amazon-ssm-agent/releases/tag/3.1.1208.0 - https://github.com/aws/amazon-ssm-agent/commit/0fe8ae99b2ff25649c7b86d3bc05fc037400aca7 - https://bugzilla.suse.com/show_bug.cgi?id=1196556
CVE ID: CVE-2022-29528 State: PUBLISHED Published: 2022-04-20T00:00:00 Last Updated: 2024-08-03T06:26:06.034Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in MISP before 2.4.158. PHAR deserialization can occur. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/MISP/MISP/compare/v2.4.157...v2.4.158 - https://github.com/MISP/MISP/commit/0108f1bde2117ac5c1e28d124128f60c8bb09a8e - https://github.com/MISP/MISP/commit/93821c0de6a7dd32262ce62212773f43136ca66e - https://zigrin.com/cakephp-application-cybersecurity-research-exploring-the-phar-deserialization-php-vulnerability-a-white-box-testing-example/ - https://zigrin.com/advi
ity-research-exploring-the-phar-deserialization-php-vulnerability-a-white-box-testing-example/ - https://zigrin.com/advisories/misp-phar-deserialization/