Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
778-1 M12 EEC, SCALANCE W778-1 M12 EEC (USA), SCALANCE W786-1 RJ45, SCALANCE W786-2 RJ45, SCALANCE W786-2 SFP, SCALANCE W786-2IA RJ45, SCALANCE W788-1 M12, SCALANCE W788-1 RJ45, SCALANCE W788-2 M12, SCALANCE W788-2 M12 EEC, SCALANCE W788-2 RJ45, SCALANCE WAM763-1, SCALANCE WAM766-1, SCALANCE WAM766-1 (US), SCALANCE WAM766-1 EEC, SCALANCE WAM766-1 EEC (US), SCALANCE WUM763-1, SCALANCE WUM766-1, SCALANCE WUM766-1 (USA), SCALANCE XB205-3 (SC, PN), SCALANCE XB205-3 (ST, E/IP), SCALANCE XB205-3 (ST, PN), SCALANCE XB205-3LD (SC, E/IP), SCALANCE XB205-3LD (SC, PN), SCALANCE XB208 (E/IP), SCALANCE XB208 (PN), SCALANCE XB213-3 (SC, E/IP), SCALANCE XB213-3 (SC, PN), SCALANCE XB213-3 (ST, E/IP), SCALAN
(E/IP), SCALANCE XB208 (PN), SCALANCE XB213-3 (SC, E/IP), SCALANCE XB213-3 (SC, PN), SCALANCE XB213-3 (ST, E/IP), SCALANCE XB213-3 (ST, PN), SCALANCE XB213-3LD (SC, E/IP), SCALANCE XB213-3LD (SC, PN), SCALANCE XB216 (E/IP), SCALANCE XB216 (PN), SCALANCE XC206-2 (SC), SCALANCE XC206-2 (ST/BFOC), SCALANCE XC206-2G PoE, SCALANCE XC206-2G PoE (54 V DC), SCALANCE XC206-2G PoE EEC (54 V DC), SCALANCE XC206-2SFP, SCALANCE XC206-2SFP EEC, SCALANCE XC206-2SFP G, SCALANCE XC206-2SFP G (EIP DEF.), SCALANCE XC206-2SFP G EEC, SCALANCE XC208, SCALANCE XC208EEC, SCALANCE XC208G, SCALANCE XC208G (EIP def.), SCALANCE XC208G EEC, SCALANCE XC208G PoE, SCALANCE XC208G PoE (54 V DC), SCALANCE XC216, SCALANCE XC2
XC208G (EIP def.), SCALANCE XC208G EEC, SCALANCE XC208G PoE, SCALANCE XC208G PoE (54 V DC), SCALANCE XC216, SCALANCE XC216-3G PoE, SCALANCE XC216-3G PoE (54 V DC), SCALANCE XC216-4C, SCALANCE XC216-4C G, SCALANCE XC216-4C G (EIP Def.), SCALANCE XC216-4C G EEC, SCALANCE XC216EEC, SCALANCE XC224, SCALANCE XC224-4C G, SCALANCE XC224-4C G (EIP Def.), SCALANCE XC224-4C G EEC, SCALANCE XF204, SCALANCE XF204 DNA, SCALANCE XF204-2BA, SCALANCE XF204-2BA DNA, SCALANCE XM408-4C, SCALANCE XM408-4C (L3 int.), SCALANCE XM408-8C, SCALANCE XM408-8C (L3 int.), SCALANCE XM416-4C, SCALANCE XM416-4C (L3 int.), SCALANCE XP208, SCALANCE XP208 (Ethernet/IP), SCALANCE XP208EEC, SCALANCE XP208PoE EEC, SCALANCE XP216
416-4C (L3 int.), SCALANCE XP208, SCALANCE XP208 (Ethernet/IP), SCALANCE XP208EEC, SCALANCE XP208PoE EEC, SCALANCE XP216, SCALANCE XP216 (Ethernet/IP), SCALANCE XP216EEC, SCALANCE XP216POE EEC, SCALANCE XR324WG (24 x FE, AC 230V), SCALANCE XR324WG (24 X FE, DC 24V), SCALANCE XR326-2C PoE WG, SCALANCE XR326-2C PoE WG (without UL), SCALANCE XR328-4C WG (24XFE, 4XGE, 24V), SCALANCE XR328-4C WG (24xFE, 4xGE,DC24V), SCALANCE XR328-4C WG (24xFE,4xGE,AC230V), SCALANCE XR328-4C WG (28xGE, AC 230V), SCALANCE XR328-4C WG (28xGE, DC 24V), SCALANCE XR524-8C, 1x230V, SCALANCE XR524-8C, 1x230V (L3 int.), SCALANCE XR524-8C, 24V, SCALANCE XR524-8C, 24V (L3 int.), SCALANCE XR524-8C, 2x230V, SCALANCE XR524-8C
1x230V (L3 int.), SCALANCE XR524-8C, 24V, SCALANCE XR524-8C, 24V (L3 int.), SCALANCE XR524-8C, 2x230V, SCALANCE XR524-8C, 2x230V (L3 int.), SCALANCE XR526-8C, 1x230V, SCALANCE XR526-8C, 1x230V (L3 int.), SCALANCE XR526-8C, 24V, SCALANCE XR526-8C, 24V (L3 int.), SCALANCE XR526-8C, 2x230V, SCALANCE XR526-8C, 2x230V (L3 int.), SCALANCE XR528-6M, SCALANCE XR528-6M (2HR2, L3 int.), SCALANCE XR528-6M (2HR2), SCALANCE XR528-6M (L3 int.), SCALANCE XR552-12M, SCALANCE XR552-12M (2HR2, L3 int.), SCALANCE XR552-12M (2HR2), SIPLUS NET SCALANCE XC206-2, SIPLUS NET SCALANCE XC206-2SFP, SIPLUS NET SCALANCE XC208, SIPLUS NET SCALANCE XC216-4C Problem Types: CWE-327 Description: Affected devices use a weak e
IPLUS NET SCALANCE XC208, SIPLUS NET SCALANCE XC216-4C Problem Types: CWE-327 Description: Affected devices use a weak encryption scheme to encrypt the debug zip file. This could allow an authenticated attacker to decrypt the contents of the file and retrieve debug information about the system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-413565.pdf - https://cert-portal.siemens.com/productcert/html/ssa-413565.html
CVE ID: CVE-2022-46141 State: PUBLISHED Published: 2023-12-12T11:25:26.583Z Last Updated: 2024-11-25T21:17:26.263Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C) Vendors: Siemens Products: SIMATIC STEP 7 (TIA Portal) Problem Types: CWE-316 Description: A vulnerability has been identified in SIMATIC STEP 7 (TIA Portal) (All versions < V19). An information disclosure vulnerability could allow a local attacker to gain access to the access level password of the SIMATIC S7-1200 and S7-1500 CPUs, when entered by a legitimate user in the hardware configuration of the affected application. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichm
dware configuration of the affected application. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-887801.pdf
CVE ID: CVE-2022-46142 State: PUBLISHED Published: 2022-12-13T00:00:00.000Z Last Updated: 2025-04-21T13:43:06.184Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L) Vendors: Siemens Products: RUGGEDCOM RM1224 LTE(4G) EU, RUGGEDCOM RM1224 LTE(4G) NAM, SCALANCE M804PB, SCALANCE M812-1 ADSL-Router, SCALANCE M816-1 ADSL-Router, SCALANCE M826-2 SHDSL-Router, SCALANCE M874-2, SCALANCE M874-3, SCALANCE M876-3, SCALANCE M876-3 (ROK), SCALANCE M876-4, SCALANCE M876-4 (EU), SCALANCE M876-4 (NAM), SCALANCE MUM853-1 (EU), SCALANCE MUM856-1 (EU), SCALANCE MUM856-1 (RoW), SCALANCE S615 EEC LAN-Router, SCALANCE S615 LAN-Router, SCALANCE SC622-2C, SCALANCE SC626-2C, SCALANCE SC632-2C,
1x230V (L3 int.), SCALANCE XR524-8C, 24V, SCALANCE XR524-8C, 24V (L3 int.), SCALANCE XR524-8C, 2x230V, SCALANCE XR524-8C, 2x230V (L3 int.), SCALANCE XR526-8C, 1x230V, SCALANCE XR526-8C, 1x230V (L3 int.), SCALANCE XR526-8C, 24V, SCALANCE XR526-8C, 24V (L3 int.), SCALANCE XR526-8C, 2x230V, SCALANCE XR526-8C, 2x230V (L3 int.), SCALANCE XR528-6M, SCALANCE XR528-6M (2HR2, L3 int.), SCALANCE XR528-6M (2HR2), SCALANCE XR528-6M (L3 int.), SCALANCE XR552-12M, SCALANCE XR552-12M (2HR2, L3 int.), SCALANCE XR552-12M (2HR2), SIPLUS NET SCALANCE XC206-2, SIPLUS NET SCALANCE XC206-2SFP, SIPLUS NET SCALANCE XC208, SIPLUS NET SCALANCE XC216-4C Problem Types: CWE-257 Description: Affected devices store the CL
IPLUS NET SCALANCE XC208, SIPLUS NET SCALANCE XC216-4C Problem Types: CWE-257 Description: Affected devices store the CLI user passwords encrypted in flash memory. Attackers with physical access to the device could retrieve the file and decrypt the CLI user passwords. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-413565.pdf - https://cert-portal.siemens.com/productcert/html/ssa-413565.html
CVE ID: CVE-2022-46143 State: PUBLISHED Published: 2022-12-13T00:00:00 Last Updated: 2025-01-14T10:27:11.064Z Severity: LOW (CVSS 2.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N) Vendors: Siemens Products: RUGGEDCOM RM1224 LTE(4G) EU, RUGGEDCOM RM1224 LTE(4G) NAM, SCALANCE M804PB, SCALANCE M812-1 ADSL-Router, SCALANCE M816-1 ADSL-Router, SCALANCE M826-2 SHDSL-Router, SCALANCE M874-2, SCALANCE M874-3, SCALANCE M876-3, SCALANCE M876-3 (ROK), SCALANCE M876-4, SCALANCE M876-4 (EU), SCALANCE M876-4 (NAM), SCALANCE MUM853-1 (EU), SCALANCE MUM856-1 (EU), SCALANCE MUM856-1 (RoW), SCALANCE S615 EEC LAN-Router, SCALANCE S615 LAN-Router, SCALANCE SC622-2C, SCALANCE SC626-2C, SCALANCE SC632-2C, SCALANC
SCALANCE S615 EEC LAN-Router, SCALANCE S615 LAN-Router, SCALANCE SC622-2C, SCALANCE SC626-2C, SCALANCE SC632-2C, SCALANCE SC636-2C, SCALANCE SC642-2C, SCALANCE SC646-2C, SCALANCE W1748-1 M12, SCALANCE W1788-1 M12, SCALANCE W1788-2 EEC M12, SCALANCE W1788-2 M12, SCALANCE W1788-2IA M12, SCALANCE W721-1 RJ45, SCALANCE W722-1 RJ45, SCALANCE W734-1 RJ45, SCALANCE W734-1 RJ45 (USA), SCALANCE W738-1 M12, SCALANCE W748-1 M12, SCALANCE W748-1 RJ45, SCALANCE W761-1 RJ45, SCALANCE W774-1 M12 EEC, SCALANCE W774-1 RJ45, SCALANCE W774-1 RJ45 (USA), SCALANCE W778-1 M12, SCALANCE W778-1 M12 EEC, SCALANCE W778-1 M12 EEC (USA), SCALANCE W786-1 RJ45, SCALANCE W786-2 RJ45, SCALANCE W786-2 SFP, SCALANCE W786-2IA
2 EEC, SCALANCE W778-1 M12 EEC (USA), SCALANCE W786-1 RJ45, SCALANCE W786-2 RJ45, SCALANCE W786-2 SFP, SCALANCE W786-2IA RJ45, SCALANCE W788-1 M12, SCALANCE W788-1 RJ45, SCALANCE W788-2 M12, SCALANCE W788-2 M12 EEC, SCALANCE W788-2 RJ45, SCALANCE WAB762-1, SCALANCE WAM763-1, SCALANCE WAM763-1 (ME), SCALANCE WAM763-1 (US), SCALANCE WAM766-1, SCALANCE WAM766-1 (ME), SCALANCE WAM766-1 (US), SCALANCE WAM766-1 EEC, SCALANCE WAM766-1 EEC (ME), SCALANCE WAM766-1 EEC (US), SCALANCE WUB762-1, SCALANCE WUB762-1 iFeatures, SCALANCE WUM763-1, SCALANCE WUM763-1 (US), SCALANCE WUM766-1, SCALANCE WUM766-1 (ME), SCALANCE WUM766-1 (USA), SCALANCE XB205-3 (SC, PN), SCALANCE XB205-3 (ST, E/IP), SCALANCE XB205-
SCALANCE WUM766-1 (ME), SCALANCE WUM766-1 (USA), SCALANCE XB205-3 (SC, PN), SCALANCE XB205-3 (ST, E/IP), SCALANCE XB205-3 (ST, PN), SCALANCE XB205-3LD (SC, E/IP), SCALANCE XB205-3LD (SC, PN), SCALANCE XB208 (E/IP), SCALANCE XB208 (PN), SCALANCE XB213-3 (SC, E/IP), SCALANCE XB213-3 (SC, PN), SCALANCE XB213-3 (ST, E/IP), SCALANCE XB213-3 (ST, PN), SCALANCE XB213-3LD (SC, E/IP), SCALANCE XB213-3LD (SC, PN), SCALANCE XB216 (E/IP), SCALANCE XB216 (PN), SCALANCE XC206-2 (SC), SCALANCE XC206-2 (ST/BFOC), SCALANCE XC206-2G PoE, SCALANCE XC206-2G PoE (54 V DC), SCALANCE XC206-2G PoE EEC (54 V DC), SCALANCE XC206-2SFP, SCALANCE XC206-2SFP EEC, SCALANCE XC206-2SFP G, SCALANCE XC206-2SFP G (EIP DEF.), S
EEC (54 V DC), SCALANCE XC206-2SFP, SCALANCE XC206-2SFP EEC, SCALANCE XC206-2SFP G, SCALANCE XC206-2SFP G (EIP DEF.), SCALANCE XC206-2SFP G EEC, SCALANCE XC208, SCALANCE XC208EEC, SCALANCE XC208G, SCALANCE XC208G (EIP def.), SCALANCE XC208G EEC, SCALANCE XC208G PoE, SCALANCE XC208G PoE (54 V DC), SCALANCE XC216, SCALANCE XC216-3G PoE, SCALANCE XC216-3G PoE (54 V DC), SCALANCE XC216-4C, SCALANCE XC216-4C G, SCALANCE XC216-4C G (EIP Def.), SCALANCE XC216-4C G EEC, SCALANCE XC216EEC, SCALANCE XC224, SCALANCE XC224-4C G, SCALANCE XC224-4C G (EIP Def.), SCALANCE XC224-4C G EEC, SCALANCE XF204, SCALANCE XF204 DNA, SCALANCE XF204-2BA, SCALANCE XF204-2BA DNA, SCALANCE XM408-4C, SCALANCE XM408-4C (L
SCALANCE XF204, SCALANCE XF204 DNA, SCALANCE XF204-2BA, SCALANCE XF204-2BA DNA, SCALANCE XM408-4C, SCALANCE XM408-4C (L3 int.), SCALANCE XM408-8C, SCALANCE XM408-8C (L3 int.), SCALANCE XM416-4C, SCALANCE XM416-4C (L3 int.), SCALANCE XP208, SCALANCE XP208 (Ethernet/IP), SCALANCE XP208EEC, SCALANCE XP208PoE EEC, SCALANCE XP216, SCALANCE XP216 (Ethernet/IP), SCALANCE XP216EEC, SCALANCE XP216POE EEC, SCALANCE XR324WG (24 x FE, AC 230V), SCALANCE XR324WG (24 X FE, DC 24V), SCALANCE XR326-2C PoE WG, SCALANCE XR326-2C PoE WG (without UL), SCALANCE XR328-4C WG (24XFE, 4XGE, 24V), SCALANCE XR328-4C WG (24xFE, 4xGE,DC24V), SCALANCE XR328-4C WG (24xFE,4xGE,AC230V), SCALANCE XR328-4C WG (28xGE, AC 230V
SCALANCE XR328-4C WG (24xFE, 4xGE,DC24V), SCALANCE XR328-4C WG (24xFE,4xGE,AC230V), SCALANCE XR328-4C WG (28xGE, AC 230V), SCALANCE XR328-4C WG (28xGE, DC 24V), SCALANCE XR524-8C, 1x230V, SCALANCE XR524-8C, 1x230V (L3 int.), SCALANCE XR524-8C, 24V, SCALANCE XR524-8C, 24V (L3 int.), SCALANCE XR524-8C, 2x230V, SCALANCE XR524-8C, 2x230V (L3 int.), SCALANCE XR526-8C, 1x230V, SCALANCE XR526-8C, 1x230V (L3 int.), SCALANCE XR526-8C, 24V, SCALANCE XR526-8C, 24V (L3 int.), SCALANCE XR526-8C, 2x230V, SCALANCE XR526-8C, 2x230V (L3 int.), SCALANCE XR528-6M, SCALANCE XR528-6M (2HR2, L3 int.), SCALANCE XR528-6M (2HR2), SCALANCE XR528-6M (L3 int.), SCALANCE XR552-12M, SCALANCE XR552-12M (2HR2, L3 int.), SC
int.), SCALANCE XR528-6M (2HR2), SCALANCE XR528-6M (L3 int.), SCALANCE XR552-12M, SCALANCE XR552-12M (2HR2, L3 int.), SCALANCE XR552-12M (2HR2), SIPLUS NET SCALANCE XC206-2, SIPLUS NET SCALANCE XC206-2SFP, SIPLUS NET SCALANCE XC208, SIPLUS NET SCALANCE XC216-4C Problem Types: CWE-1284 Description: Affected devices do not check the TFTP blocksize correctly. This could allow an authenticated attacker to read from an uninitialized buffer that potentially contains previously allocated data. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-413565.pdf - https://cert-portal.siemens.com/productcert/pdf/ssa-180704.pdf - https://cert-
mens.com/productcert/pdf/ssa-413565.pdf - https://cert-portal.siemens.com/productcert/pdf/ssa-180704.pdf - https://cert-portal.siemens.com/productcert/html/ssa-413565.html - https://cert-portal.siemens.com/productcert/html/ssa-180704.html
CVE ID: CVE-2022-46144 State: PUBLISHED Published: 2022-12-13T00:00:00.000Z Last Updated: 2025-04-21T13:42:58.124Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Siemens Products: SCALANCE SC622-2C, SCALANCE SC626-2C, SCALANCE SC632-2C, SCALANCE SC636-2C, SCALANCE SC642-2C, SCALANCE SC646-2C, SCALANCE WAM763-1, SCALANCE WAM766-1, SCALANCE WAM766-1 (US), SCALANCE WAM766-1 EEC, SCALANCE WAM766-1 EEC (US), SCALANCE WUM763-1, SCALANCE WUM766-1, SCALANCE WUM766-1 (USA) Problem Types: CWE-664 Description: A vulnerability has been identified in SCALANCE SC622-2C (6GK5622-2GS00-2AC2) (All versions < V2.3), SCALANCE SC622-2C (6GK5622-2GS00-2AC2) (All versions >= V2.
CALANCE SC622-2C (6GK5622-2GS00-2AC2) (All versions < V2.3), SCALANCE SC622-2C (6GK5622-2GS00-2AC2) (All versions >= V2.3 < V3.0), SCALANCE SC626-2C (6GK5626-2GS00-2AC2) (All versions < V2.3), SCALANCE SC626-2C (6GK5626-2GS00-2AC2) (All versions >= V2.3 < V3.0), SCALANCE SC632-2C (6GK5632-2GS00-2AC2) (All versions < V2.3), SCALANCE SC632-2C (6GK5632-2GS00-2AC2) (All versions >= V2.3 < V3.0), SCALANCE SC636-2C (6GK5636-2GS00-2AC2) (All versions < V2.3), SCALANCE SC636-2C (6GK5636-2GS00-2AC2) (All versions >= V2.3 < V3.0), SCALANCE SC642-2C (6GK5642-2GS00-2AC2) (All versions < V2.3), SCALANCE SC642-2C (6GK5642-2GS00-2AC2) (All versions >= V2.3 < V3.0), SCALANCE SC646-2C (6GK5646-2GS00-2AC2) (A
< V2.3), SCALANCE SC642-2C (6GK5642-2GS00-2AC2) (All versions >= V2.3 < V3.0), SCALANCE SC646-2C (6GK5646-2GS00-2AC2) (All versions < V2.3), SCALANCE SC646-2C (6GK5646-2GS00-2AC2) (All versions >= V2.3 < V3.0), SCALANCE WAM763-1 (6GK5763-1AL00-7DA0) (All versions < V2.0.0), SCALANCE WAM766-1 (6GK5766-1GE00-7DA0) (All versions < V2.0.0), SCALANCE WAM766-1 (US) (6GK5766-1GE00-7DB0) (All versions < V2.0.0), SCALANCE WAM766-1 EEC (6GK5766-1GE00-7TA0) (All versions < V2.0.0), SCALANCE WAM766-1 EEC (US) (6GK5766-1GE00-7TB0) (All versions < V2.0.0), SCALANCE WUM763-1 (6GK5763-1AL00-3AA0) (All versions < V2.0.0), SCALANCE WUM763-1 (6GK5763-1AL00-3DA0) (All versions < V2.0.0), SCALANCE WUM766-1 (6GK5
0-3AA0) (All versions < V2.0.0), SCALANCE WUM763-1 (6GK5763-1AL00-3DA0) (All versions < V2.0.0), SCALANCE WUM766-1 (6GK5766-1GE00-3DA0) (All versions < V2.0.0), SCALANCE WUM766-1 (USA) (6GK5766-1GE00-3DB0) (All versions < V2.0.0). Affected devices do not properly process CLI commands after a user forcefully quitted the SSH connection. This could allow an authenticated attacker to make the CLI via SSH or serial interface irresponsive. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-413565.pdf - https://cert-portal.siemens.com/productcert/html/ssa-413565.html - https://cert-portal.siemens.com/productc
413565.pdf - https://cert-portal.siemens.com/productcert/html/ssa-413565.html - https://cert-portal.siemens.com/productcert/html/ssa-690517.html
CVE ID: CVE-2022-46145 State: PUBLISHED Published: 2022-12-02T17:12:42.046Z Last Updated: 2025-04-23T16:33:01.881Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: goauthentik Products: authentik Problem Types: CWE-287 Description: authentik is an open-source identity provider. Versions prior to 2022.11.2 and 2022.10.2 are vulnerable to unauthorized user creation and potential account takeover. With the default flows, unauthenticated users can create new accounts in authentik. If a flow exists that allows for email-verified password recovery, this can be used to overwrite the email address of admin accounts and take over their accounts. authentik 2022.11.2 and
this can be used to overwrite the email address of admin accounts and take over their accounts. authentik 2022.11.2 and 2022.10.2 fix this issue. As a workaround, a policy can be created and bound to the `default-user-settings-flow flow` with the contents `return request.user.is_authenticated`. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/goauthentik/authentik/security/advisories/GHSA-mjfw-54m5-fvjf - https://goauthentik.io/docs/releases/2022.10#fixed-in-2022102 - https://goauthentik.io/docs/releases/2022.11#fixed-in-2022112
CVE ID: CVE-2022-46146 State: PUBLISHED Published: 2022-11-29T00:00:00 Last Updated: 2024-08-03T14:24:03.295Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: prometheus Products: exporter-toolkit Problem Types: CWE-303, CWE-287 Description: Prometheus Exporter Toolkit is a utility package to build exporters. Prior to versions 0.7.2 and 0.8.2, if someone has access to a Prometheus web.yml file and users' bcrypted passwords, they can bypass security by poisoning the built-in authentication cache. Versions 0.7.2 and 0.8.2 contain a fix for the issue. There is no workaround, but attacker must have access to the hashed password to use this functionality. Addition
issue. There is no workaround, but attacker must have access to the hashed password to use this functionality. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/prometheus/exporter-toolkit/security/advisories/GHSA-7rg2-cxvp-9p7p - https://github.com/prometheus/exporter-toolkit/commit/5b1eab34484ddd353986bce736cd119d863e4ff5 - http://www.openwall.com/lists/oss-security/2022/11/29/1 - http://www.openwall.com/lists/oss-security/2022/11/29/2 - http://www.openwall.com/lists/oss-security/2022/11/29/4 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ULVDTAI76VATRAHTKCE2SUJ4NC3PQZ6Y/ - https://lists.fedoraproject.or
st/package-announce%40lists.fedoraproject.org/message/ULVDTAI76VATRAHTKCE2SUJ4NC3PQZ6Y/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JRSHISR64L6QGSMDFZDNPHHIXSCAKK26/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UH24VXIB25OGHF4VGY4PLZMTGTI3BHCA/ - https://security.gentoo.org/glsa/202401-15
CVE ID: CVE-2022-46147 State: PUBLISHED Published: 2022-11-28T00:00:00.000Z Last Updated: 2025-04-22T15:59:21.749Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H) Vendors: openedx Products: xblock-drag-and-drop-v2 Problem Types: CWE-79 Description: Drag and Drop XBlock v2 implements a drag-and-drop style problem, where a learner has to drag items to zones on a target image. Versions prior to 3.0.0 are vulnerable to cross-site scripting in multiple XBlock Fields. Any platform that has deployed the XBlock may be impacted. Version 3.0.0 contains a patch for this issue. There are no known workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichme
for this issue. There are no known workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/openedx/xblock-drag-and-drop-v2/security/advisories/GHSA-qv6c-367r-3w6q - https://github.com/openedx/xblock-drag-and-drop-v2/pull/295#issuecomment-1277693864 - https://github.com/openedx/xblock-drag-and-drop-v2/commit/68887d1b4a44325d2de7573d450e41129ba98b1a - https://github.com/openedx/xblock-drag-and-drop-v2/releases/tag/v3.0.0
CVE ID: CVE-2022-46148 State: PUBLISHED Published: 2022-11-29T00:00:00.000Z Last Updated: 2025-04-23T16:34:02.080Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: discourse Products: discourse Problem Types: CWE-79 Description: Discourse is an open-source messaging platform. In versions 2.8.10 and prior on the `stable` branch and versions 2.9.0.beta11 and prior on the `beta` and `tests-passed` branches, users composing malicious messages and navigating to drafts page could self-XSS. This vulnerability can lead to a full XSS on sites which have modified or disabled Discourse’s default Content Security Policy. This issue is patched in the latest stable, beta and
e modified or disabled Discourse’s default Content Security Policy. This issue is patched in the latest stable, beta and tests-passed versions of Discourse. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/discourse/discourse/security/advisories/GHSA-c5h6-6gg5-84fh
CVE ID: CVE-2022-46149 State: PUBLISHED Published: 2022-11-30T00:00:00.000Z Last Updated: 2025-04-23T16:33:43.499Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:L) Vendors: capnproto Products: capnproto Problem Types: CWE-125 Description: Cap'n Proto is a data interchange format and remote procedure call (RPC) system. Cap'n Proro prior to versions 0.7.1, 0.8.1, 0.9.2, and 0.10.3, as well as versions of Cap'n Proto's Rust implementation prior to 0.13.7, 0.14.11, and 0.15.2 are vulnerable to out-of-bounds read due to logic error handling list-of-list. This issue may lead someone to remotely segfault a peer by sending it a malicious message, if the victim performs certai
This issue may lead someone to remotely segfault a peer by sending it a malicious message, if the victim performs certain actions on a list-of-pointer type. Exfiltration of memory is possible if the victim performs additional certain actions on a list-of-pointer type. To be vulnerable, an application must perform a specific sequence of actions, described in the GitHub Security Advisory. The bug is present in inlined code, therefore the fix will require rebuilding dependent applications. Cap'n Proto has C++ fixes available in versions 0.7.1, 0.8.1, 0.9.2, and 0.10.3. The `capnp` Rust crate has fixes available in versions 0.13.7, 0.14.11, and 0.15.2. Additional Analyst Notes: - CVE Program Con
pnp` Rust crate has fixes available in versions 0.13.7, 0.14.11, and 0.15.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/capnproto/capnproto/security/advisories/GHSA-qqff-4vw4-f6hx - https://github.com/capnproto/capnproto/commit/25d34c67863fd960af34fc4f82a7ca3362ee74b9 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WKXM4JAFXLTXU5IQB3OUBQVCIICZWGYX/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZOCQQOPMVQOFUWBWAGVGN76OYAV3WXY4/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/
WBWAGVGN76OYAV3WXY4/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PTS6TWD6K2NKXLEEFBPROQXMOFUTEYWY/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EAHKLUMJAXJEV5BPBS5XXWBQ3ZTHGOLY/
CVE ID: CVE-2022-46150 State: PUBLISHED Published: 2022-11-29T00:00:00.000Z Last Updated: 2025-04-23T16:33:56.607Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: discourse Products: discourse Problem Types: CWE-200 Description: Discourse is an open-source discussion platform. Prior to version 2.8.13 of the `stable` branch and version 2.9.0.beta14 of the `beta` and `tests-passed` branches, unauthorized users may learn of the existence of hidden tags and that they have been applied to topics that they have access to. This issue is patched in version 2.8.13 of the `stable` branch and version 2.9.0.beta14 of the `beta` and `tests-passed` branches. As a workarou