Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-24300 State: PUBLISHED Published: 2022-02-02T06:01:04 Last Updated: 2024-08-03T04:07:02.410Z Vendors: n/a Products: n/a Problem Types: n/a Description: Minetest before 5.4.0 allows attackers to add or modify arbitrary meta fields of the same item stack as saved user input, aka ItemStack meta injection. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.debian.org/1004223 - https://github.com/minetest/minetest/commit/b5956bde259faa240a81060ff4e598e25ad52dae - https://github.com/minetest/minetest/security/advisories/GHSA-hwj2-xf72-r4cf - https://www.debian.org/security/2022/dsa-5075
CVE ID: CVE-2022-24301 State: PUBLISHED Published: 2022-02-02T06:00:50 Last Updated: 2024-08-03T04:07:02.389Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Minetest before 5.4.0, players can add or subtract items from a different player's inventory. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/minetest/minetest/security/advisories/GHSA-fvwv-qcq6-wmp5 - https://github.com/minetest/minetest/commit/3693b6871eba268ecc79b3f52d00d3cefe761131 - https://www.debian.org/security/2022/dsa-5075
CVE ID: CVE-2022-24302 State: PUBLISHED Published: 2022-03-17T21:02:10 Last Updated: 2024-08-03T04:07:02.466Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Paramiko before 2.10.1, a race condition (between creation and chmod) in the write_private_key_file function could allow unauthorized information disclosure. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/paramiko/paramiko/blob/363a28d94cada17f012c1604a3c99c71a2bda003/paramiko/pkey.py#L546 - https://www.paramiko.org/changelog.html - https://lists.debian.org/debian-lts-announce/2022/03/msg00032.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.or
announce/2022/03/msg00032.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U63MJ2VOLLQ35R7CYNREUHSXYLWNPVSB/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LUEUEGILZ7MQXRSUF5VMMO4SWJQVPTQL/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TPMKRUS4HO3P7NR7P4Y6CLHB4MBEE3AI/ - https://lists.debian.org/debian-lts-announce/2022/09/msg00013.html
CVE ID: CVE-2022-24303 State: PUBLISHED Published: 2022-03-28T00:00:00 Last Updated: 2024-08-03T04:07:02.356Z Vendors: n/a Products: n/a Problem Types: n/a Description: Pillow before 9.0.1 allows attackers to delete files because spaces in temporary pathnames are mishandled. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/python-pillow/Pillow/pull/3450 - https://pillow.readthedocs.io/en/stable/releasenotes/9.0.1.html#security - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W4ZUXPKEX72O3E5IHBPVY5ZCPMJ4GHHV/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XR
IHBPVY5ZCPMJ4GHHV/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XR6UP2XONXOVXI4446VY72R63YRO2YTP/ - https://security.gentoo.org/glsa/202211-10
CVE ID: CVE-2022-24304 State: REJECTED Published: 2022-08-26T04:44:09 Last Updated: 2022-09-14T17:55:25 Description: No description available.
CVE ID: CVE-2022-24305 State: PUBLISHED Published: 2022-03-02T14:36:51 Last Updated: 2024-08-03T04:07:02.347Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine SharePoint Manager Plus before 4329 is vulnerable to a sensitive data leak that leads to privilege escalation. Additional Analyst Notes: - CVE Program Container: References: - https://www.manageengine.com/sharepoint-management-reporting/release-notes.html#4329
CVE ID: CVE-2022-24306 State: PUBLISHED Published: 2022-03-02T14:34:49 Last Updated: 2024-08-03T04:07:02.342Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine SharePoint Manager Plus before 4329 allows account takeover because authorization is mishandled. Additional Analyst Notes: - CVE Program Container: References: - https://www.manageengine.com/sharepoint-management-reporting/release-notes.html#4329
CVE ID: CVE-2022-24307 State: PUBLISHED Published: 2022-02-03T19:06:54 Last Updated: 2024-08-03T04:07:02.339Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mastodon before 3.3.2 and 3.4.x before 3.4.6 has incorrect access control because it does not compact incoming signed JSON-LD activities. (JSON-LD signing has been supported since version 1.6.0.) Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mastodon/mastodon/releases/tag/v3.4.6 - https://github.com/mastodon/mastodon/releases/tag/v3.3.2
CVE ID: CVE-2022-24308 State: PUBLISHED Published: 2022-04-13T12:14:37 Last Updated: 2024-08-03T04:07:02.344Z Vendors: n/a Products: n/a Problem Types: n/a Description: Automox Agent prior to version 37 on Windows and Linux and Version 36 on OSX could allow for a non privileged user to obtain sensitive information during the install process. Additional Analyst Notes: - CVE Program Container: References: - https://automox.com - https://www.automox.com/security/security-bulletin
CVE ID: CVE-2022-24309 State: PUBLISHED Published: 2022-03-08T11:31:29 Last Updated: 2024-10-08T08:39:51.939Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N/E:P/RL:O/RC:C) Vendors: Siemens Products: Mendix Runtime V7, Mendix Runtime V8, Mendix Runtime V9 Problem Types: CWE-284 Description: A vulnerability has been identified in Mendix Runtime V7 (All versions < V7.23.29), Mendix Runtime V8 (All versions < V8.18.16), Mendix Runtime V9 (All versions < V9.13 only with Runtime Custom Setting *DataStorage.UseNewQueryHandler* set to False). If an entity has an association readable by the user, then in some cases, Mendix Runtime may not apply checks for XPath constraints th
as an association readable by the user, then in some cases, Mendix Runtime may not apply checks for XPath constraints that parse said associations, within apps running on affected versions. A malicious user could use this to dump and manipulate sensitive data. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-148641.pdf - https://cert-portal.siemens.com/productcert/html/ssa-148641.html
CVE ID: CVE-2022-24310 State: PUBLISHED Published: 2022-02-09T22:04:57 Last Updated: 2024-08-03T04:07:02.515Z Vendors: n/a Products: Interactive Graphical SCADA System Data Server (V15.0.0.22020 and prior) Problem Types: CWE-190 Description: A CWE-190: Integer Overflow or Wraparound vulnerability exists that could cause heap-based buffer overflow, leading to denial of service and potentially remote code execution when an attacker sends multiple specially crafted messages. Affected Product: Interactive Graphical SCADA System Data Server (V15.0.0.22020 and prior) Additional Analyst Notes: - CVE Program Container: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-0
nalyst Notes: - CVE Program Container: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-039-01
CVE ID: CVE-2022-24311 State: PUBLISHED Published: 2022-02-09T22:04:58 Last Updated: 2024-08-03T04:07:02.449Z Vendors: n/a Products: Interactive Graphical SCADA System Data Server (V15.0.0.22020 and prior) Problem Types: CWE-22 Description: A CWE-22: Improper Limitation of a Pathname to a Restricted Directory vulnerability exists that could cause modification of an existing file by inserting at beginning of file or create a new file in the context of the Data Server potentially leading to remote code execution when an attacker sends a specially crafted message. Affected Product: Interactive Graphical SCADA System Data Server (V15.0.0.22020 and prior) Additional Analyst Notes: - CVE Program C
duct: Interactive Graphical SCADA System Data Server (V15.0.0.22020 and prior) Additional Analyst Notes: - CVE Program Container: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-039-01 - https://www.zerodayinitiative.com/advisories/ZDI-22-320/
CVE ID: CVE-2022-24312 State: PUBLISHED Published: 2022-02-09T22:04:58 Last Updated: 2024-08-03T04:07:02.317Z Vendors: n/a Products: Interactive Graphical SCADA System Data Server (V15.0.0.22020 and prior) Problem Types: CWE-22 Description: A CWE-22: Improper Limitation of a Pathname to a Restricted Directory vulnerability exists that could cause modification of an existing file by adding at end of file or create a new file in the context of the Data Server potentially leading to remote code execution when an attacker sends a specially crafted message. Affected Product: Interactive Graphical SCADA System Data Server (V15.0.0.22020 and prior) Additional Analyst Notes: - CVE Program Container:
eractive Graphical SCADA System Data Server (V15.0.0.22020 and prior) Additional Analyst Notes: - CVE Program Container: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-039-01 - https://www.zerodayinitiative.com/advisories/ZDI-22-321/
CVE ID: CVE-2022-24313 State: PUBLISHED Published: 2022-02-09T22:04:59 Last Updated: 2024-08-03T04:07:02.386Z Vendors: n/a Products: Interactive Graphical SCADA System Data Server (V15.0.0.22020 and prior) Problem Types: CWE-120 Description: A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could cause a stack-based buffer overflow potentially leading to remote code execution when an attacker sends a specially crafted message. Affected Product: Interactive Graphical SCADA System Data Server (V15.0.0.22020 and prior) Additional Analyst Notes: - CVE Program Container: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-039-01 - https://
CVE Program Container: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-039-01 - https://www.zerodayinitiative.com/advisories/ZDI-22-325/
CVE ID: CVE-2022-24314 State: PUBLISHED Published: 2022-02-09T22:05:00 Last Updated: 2024-08-03T04:07:02.443Z Vendors: n/a Products: Interactive Graphical SCADA System Data Server (V15.0.0.22020 and prior) Problem Types: CWE-125 Description: A CWE-125: Out-of-bounds Read vulnerability exists that could cause memory leaks potentially resulting in denial of service when an attacker repeatedly sends a specially crafted message. Affected Product: Interactive Graphical SCADA System Data Server (V15.0.0.22020 and prior) Additional Analyst Notes: - CVE Program Container: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-039-01
CVE ID: CVE-2022-24315 State: PUBLISHED Published: 2022-02-09T22:05:01 Last Updated: 2024-08-03T04:07:02.404Z Vendors: n/a Products: Interactive Graphical SCADA System Data Server (V15.0.0.22020 and prior) Problem Types: CWE-125 Description: A CWE-125: Out-of-bounds Read vulnerability exists that could cause denial of service when an attacker repeatedly sends a specially crafted message. Affected Product: Interactive Graphical SCADA System Data Server (V15.0.0.22020 and prior) Additional Analyst Notes: - CVE Program Container: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-039-01 - https://www.zerodayinitiative.com/advisories/ZDI-22-322/
CVE ID: CVE-2022-24316 State: PUBLISHED Published: 2022-02-09T22:05:02 Last Updated: 2024-08-03T04:07:02.318Z Vendors: n/a Products: Interactive Graphical SCADA System Data Server (V15.0.0.22020 and prior) Problem Types: CWE-665 Description: A CWE-665: Improper Initialization vulnerability exists that could cause information exposure when an attacker sends a specially crafted message. Affected Product: Interactive Graphical SCADA System Data Server (V15.0.0.22020 and prior) Additional Analyst Notes: - CVE Program Container: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-039-01 - https://www.zerodayinitiative.com/advisories/ZDI-22-323/
CVE ID: CVE-2022-24317 State: PUBLISHED Published: 2022-02-09T22:05:03 Last Updated: 2024-08-03T04:07:02.387Z Vendors: n/a Products: Interactive Graphical SCADA System Data Server (V15.0.0.22020 and prior) Problem Types: CWE-862 Description: A CWE-862: Missing Authorization vulnerability exists that could cause information exposure when an attacker sends a specific message. Affected Product: Interactive Graphical SCADA System Data Server (V15.0.0.22020 and prior) Additional Analyst Notes: - CVE Program Container: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-039-01 - https://www.zerodayinitiative.com/advisories/ZDI-22-324/
CVE ID: CVE-2022-24318 State: PUBLISHED Published: 2022-02-09T22:05:09 Last Updated: 2024-08-03T04:07:02.559Z Vendors: n/a Products: ClearSCADA (All Versions), EcoStruxure Geo SCADA Expert 2019 (All Versions), EcoStruxure Geo SCADA Expert 2020 (All Versions) Problem Types: CWE-326 Description: A CWE-326: Inadequate Encryption Strength vulnerability exists that could cause non-encrypted communication with the server when outdated versions of the ViewX client are used. Affected Product: ClearSCADA (All Versions), EcoStruxure Geo SCADA Expert 2019 (All Versions), EcoStruxure Geo SCADA Expert 2020 (All Versions) Additional Analyst Notes: - CVE Program Container: References: - https://download.sc
eo SCADA Expert 2020 (All Versions) Additional Analyst Notes: - CVE Program Container: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-039-05
CVE ID: CVE-2022-24319 State: PUBLISHED Published: 2022-02-09T22:05:10 Last Updated: 2024-08-03T04:07:02.536Z Vendors: n/a Products: ClearSCADA (All Versions), EcoStruxure Geo SCADA Expert 2019 (All Versions), EcoStruxure Geo SCADA Expert 2020 (All Versions) Problem Types: CWE-295 Description: A CWE-295: Improper Certificate Validation vulnerability exists that could allow a Man-in-theMiddle attack when communications between the client and Geo SCADA web server are intercepted. Affected Product: ClearSCADA (All Versions), EcoStruxure Geo SCADA Expert 2019 (All Versions), EcoStruxure Geo SCADA Expert 2020 (All Versions) Additional Analyst Notes: - CVE Program Container: References: - https://
oStruxure Geo SCADA Expert 2020 (All Versions) Additional Analyst Notes: - CVE Program Container: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-039-05 - https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2022/MNDT-2022-0018/MNDT-2022-0018.md
CVE ID: CVE-2022-24320 State: PUBLISHED Published: 2022-02-09T22:05:11 Last Updated: 2024-08-03T04:07:02.327Z Vendors: n/a Products: ClearSCADA (All Versions), EcoStruxure Geo SCADA Expert 2019 (All Versions), EcoStruxure Geo SCADA Expert 2020 (All Versions) Problem Types: CWE-295 Description: A CWE-295: Improper Certificate Validation vulnerability exists that could allow a Man-in-theMiddle attack when communications between the client and Geo SCADA database server are intercepted. Affected Product: ClearSCADA (All Versions), EcoStruxure Geo SCADA Expert 2019 (All Versions), EcoStruxure Geo SCADA Expert 2020 (All Versions) Additional Analyst Notes: - CVE Program Container: References: - htt
), EcoStruxure Geo SCADA Expert 2020 (All Versions) Additional Analyst Notes: - CVE Program Container: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-039-05 - https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2022/MNDT-2022-0019/MNDT-2022-0019.md
CVE ID: CVE-2022-24321 State: PUBLISHED Published: 2022-02-09T22:05:12 Last Updated: 2024-08-03T04:07:02.454Z Vendors: n/a Products: ClearSCADA (All Versions), EcoStruxure Geo SCADA Expert 2019 (All Versions), EcoStruxure Geo SCADA Expert 2020 (All Versions) Problem Types: CWE-754 Description: A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists that could cause Denial of Service against the Geo SCADA server when receiving a malformed HTTP request. Affected Product: ClearSCADA (All Versions), EcoStruxure Geo SCADA Expert 2019 (All Versions), EcoStruxure Geo SCADA Expert 2020 (All Versions) Additional Analyst Notes: - CVE Program Container: References: - https:
EcoStruxure Geo SCADA Expert 2020 (All Versions) Additional Analyst Notes: - CVE Program Container: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-039-05
CVE ID: CVE-2022-24322 State: PUBLISHED Published: 2022-03-09T23:05:13 Last Updated: 2024-08-03T04:07:02.429Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H) Vendors: Schneider Electric Products: EcoStruxure Control Expert Problem Types: CWE-119 Description: A CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could cause a disruption of communication between the Modicon controller and the engineering software when an attacker is able to intercept and manipulate specific Modbus response data. Affected Product: EcoStruxure Control Expert (V15.0 SP1 and prior) Additional Analyst Notes: - CVE Program Container: Ref
ffected Product: EcoStruxure Control Expert (V15.0 SP1 and prior) Additional Analyst Notes: - CVE Program Container: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-067-01
CVE ID: CVE-2022-24323 State: PUBLISHED Published: 2022-03-09T23:05:14 Last Updated: 2024-08-03T04:07:02.566Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H) Vendors: Schneider Electric Products: EcoStruxure Process Expert, EcoStruxure Control Expert Problem Types: CWE-754 Description: A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists that could cause a disruption of communication between the Modicon controller and the engineering software, when an attacker is able to intercept and manipulate specific Modbus response data. Affected Product: EcoStruxure Process Expert (V2021 and prior), EcoStruxure Control Expert (V15.0 SP1 and prior
se data. Affected Product: EcoStruxure Process Expert (V2021 and prior), EcoStruxure Control Expert (V15.0 SP1 and prior) Additional Analyst Notes: - CVE Program Container: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-067-01
CVE ID: CVE-2022-24324 State: PUBLISHED Published: 2023-02-01T00:00:00.000Z Last Updated: 2025-02-05T20:17:25.000Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Schneider Electric Products: IGSS Data Server (IGSSdataServer.exe) Problem Types: CWE-120 Description: A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could cause a stack-based buffer overflow potentially leading to remote code execution when an attacker sends a specially crafted message. Affected Products: IGSS Data Server - IGSSdataServer.exe (Versions prior to V15.0.0.22073) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References:
ersions prior to V15.0.0.22073) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2022-102-01_IGSS_Security_Notification_V2.0.pdf
CVE ID: CVE-2022-24327 State: PUBLISHED Published: 2022-02-25T14:34:56 Last Updated: 2024-08-03T04:07:02.392Z Vendors: n/a Products: n/a Problem Types: n/a Description: In JetBrains Hub before 2021.1.13890, integration with JetBrains Account exposed an API key with excessive permissions. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jetbrains.com - https://blog.jetbrains.com/blog/2022/02/08/jetbrains-security-bulletin-q4-2021/
CVE ID: CVE-2022-24328 State: PUBLISHED Published: 2022-02-25T14:35:00 Last Updated: 2024-08-03T04:07:02.459Z Vendors: n/a Products: n/a Problem Types: n/a Description: In JetBrains Hub before 2021.1.13956, an unprivileged user could perform DoS. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jetbrains.com - https://blog.jetbrains.com/blog/2022/02/08/jetbrains-security-bulletin-q4-2021/
CVE ID: CVE-2022-24329 State: PUBLISHED Published: 2022-02-25T14:35:03 Last Updated: 2024-08-03T04:07:02.514Z Vendors: n/a Products: n/a Problem Types: n/a Description: In JetBrains Kotlin before 1.6.0, it was not possible to lock dependencies for Multiplatform Gradle Projects. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jetbrains.com - https://www.oracle.com/security-alerts/cpuapr2022.html - https://blog.jetbrains.com/blog/2022/02/08/jetbrains-security-bulletin-q4-2021/ - https://www.oracle.com/security-alerts/cpujul2022.html
CVE ID: CVE-2022-24330 State: PUBLISHED Published: 2022-02-25T14:35:06 Last Updated: 2024-08-03T04:07:02.533Z Vendors: n/a Products: n/a Problem Types: n/a Description: In JetBrains TeamCity before 2021.2.1, a redirection to an external site was possible. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jetbrains.com - https://blog.jetbrains.com/blog/2022/02/08/jetbrains-security-bulletin-q4-2021/
CVE ID: CVE-2022-24331 State: PUBLISHED Published: 2022-02-25T14:35:09 Last Updated: 2024-08-03T04:07:02.425Z Vendors: n/a Products: n/a Problem Types: n/a Description: In JetBrains TeamCity before 2021.1.4, GitLab authentication impersonation was possible. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jetbrains.com - https://blog.jetbrains.com/blog/2022/02/08/jetbrains-security-bulletin-q4-2021/
CVE ID: CVE-2022-24332 State: PUBLISHED Published: 2022-02-25T14:35:12 Last Updated: 2024-08-03T04:07:02.639Z Vendors: n/a Products: n/a Problem Types: n/a Description: In JetBrains TeamCity before 2021.2, a logout action didn't remove a Remember Me cookie. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jetbrains.com - https://blog.jetbrains.com/blog/2022/02/08/jetbrains-security-bulletin-q4-2021/
CVE ID: CVE-2022-24333 State: PUBLISHED Published: 2022-02-25T14:35:15 Last Updated: 2024-08-03T04:07:02.343Z Vendors: n/a Products: n/a Problem Types: n/a Description: In JetBrains TeamCity before 2021.2, blind SSRF via an XML-RPC call was possible. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jetbrains.com - https://blog.jetbrains.com/blog/2022/02/08/jetbrains-security-bulletin-q4-2021/
CVE ID: CVE-2022-24334 State: PUBLISHED Published: 2022-02-25T14:35:18 Last Updated: 2024-08-03T04:07:02.517Z Vendors: n/a Products: n/a Problem Types: n/a Description: In JetBrains TeamCity before 2021.2.1, the Agent Push feature allowed selection of any private key on the server. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jetbrains.com - https://blog.jetbrains.com/blog/2022/02/08/jetbrains-security-bulletin-q4-2021/
CVE ID: CVE-2022-24335 State: PUBLISHED Published: 2022-02-25T14:35:21 Last Updated: 2024-08-03T04:07:02.476Z Vendors: n/a Products: n/a Problem Types: n/a Description: JetBrains TeamCity before 2021.2 was vulnerable to a Time-of-check/Time-of-use (TOCTOU) race-condition attack in agent registration via XML-RPC. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jetbrains.com - https://blog.jetbrains.com/blog/2022/02/08/jetbrains-security-bulletin-q4-2021/
CVE ID: CVE-2022-24336 State: PUBLISHED Published: 2022-02-25T14:35:27 Last Updated: 2024-08-03T04:07:02.515Z Vendors: n/a Products: n/a Problem Types: n/a Description: In JetBrains TeamCity before 2021.2.1, an unauthenticated attacker can cancel running builds via an XML-RPC request to the TeamCity server. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jetbrains.com - https://blog.jetbrains.com/blog/2022/02/08/jetbrains-security-bulletin-q4-2021/
CVE ID: CVE-2022-24337 State: PUBLISHED Published: 2022-02-25T14:35:31 Last Updated: 2024-08-03T04:07:02.495Z Vendors: n/a Products: n/a Problem Types: n/a Description: In JetBrains TeamCity before 2021.2, health items of pull requests were shown to users who lacked appropriate permissions. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jetbrains.com - https://blog.jetbrains.com/blog/2022/02/08/jetbrains-security-bulletin-q4-2021/