Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-40603 State: PUBLISHED Published: 2022-12-06T00:00:00.000Z Last Updated: 2025-04-23T20:00:23.891Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N) Vendors: Zyxel Products: ZyWALL/USG series firmware, VPN series firmware, USG FLEX series firmware, ATP series firmware Problem Types: CWE-79 Description: A cross-site scripting (XSS) vulnerability in the CGI program of Zyxel ZyWALL/USG series firmware versions 4.30 through 4.72, VPN series firmware versions 4.30 through 5.31, USG FLEX series firmware versions 4.50 through 5.31, and ATP series firmware versions 4.32 through 5.31, which could allow an attacker to trick a user into visiting a crafted URL with
ries firmware versions 4.32 through 5.31, which could allow an attacker to trick a user into visiting a crafted URL with the XSS payload. Then, the attacker could gain access to some browser-based information if the malicious script is executed on the victim’s browser. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-xss-vulnerability-in-firewalls
CVE ID: CVE-2022-40604 State: PUBLISHED Published: 2022-09-21T07:25:11.000Z Last Updated: 2025-05-27T18:20:24.284Z Vendors: Apache Software Foundation Products: Apache Airflow Problem Types: CWE-134 Description: In Apache Airflow 2.3.0 through 2.3.4, part of a url was unnecessarily formatted, allowing for possible information extraction. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/apache/airflow/pull/26337 - https://lists.apache.org/thread/z20x8m16fnhxdkoollv53w1ybsts687t
CVE ID: CVE-2022-40605 State: PUBLISHED Published: 2022-10-17T00:00:00.000Z Last Updated: 2025-05-14T20:25:34.233Z Vendors: n/a Products: n/a Problem Types: n/a Description: MITRE CALDERA before 4.1.0 allows XSS in the Operations tab and/or Debrief plugin via a crafted operation name, a different vulnerability than CVE-2022-40606. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/mitre/caldera/releases/tag/4.1.0
CVE ID: CVE-2022-40606 State: PUBLISHED Published: 2022-10-17T00:00:00.000Z Last Updated: 2025-05-14T20:26:59.469Z Vendors: n/a Products: n/a Problem Types: n/a Description: MITRE CALDERA before 4.1.0 allows XSS in the Operations tab and/or Debrief plugin via a crafted operation name, a different vulnerability than CVE-2022-40605. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/mitre/caldera/releases/tag/4.1.0
CVE ID: CVE-2022-40607 State: PUBLISHED Published: 2022-12-19T19:36:28.395Z Last Updated: 2025-04-17T13:40:06.251Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N) Vendors: IBM Products: Spectrum Scale Problem Types: CWE-22 Description: IBM Spectrum Scale 5.1 could allow users with permissions to create pod, persistent volume and persistent volume claim to access files and directories outside of the volume, including on the host filesystem. IBM X-Force ID: 235740. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6848231 - https://exchange.xforce.ibmcloud.com/vulnerabilities/235740
CVE ID: CVE-2022-40608 State: PUBLISHED Published: 2022-09-19T17:25:13.593524Z Last Updated: 2024-09-17T01:06:47.956Z Severity: MEDIUM (CVSS 5.9 CVSS:3.0/A:N/I:N/PR:N/AC:H/C:H/AV:N/UI:N/S:U/RC:C/E:U/RL:O) Vendors: IBM Products: Spectrum Protect Plus Problem Types: Obtain Information Description: IBM Spectrum Protect Plus 10.1.6 through 10.1.11 Microsoft File Systems restore operation can download any file on the target machine by manipulating the URL with a directory traversal attack. This results in the restore operation gaining access to files which the operator should not have access to. IBM X-Force ID: 235873. Additional Analyst Notes: - CVE Program Container: References: - https://www.i
t have access to. IBM X-Force ID: 235873. Additional Analyst Notes: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/6620209 - https://exchange.xforce.ibmcloud.com/vulnerabilities/235873
CVE ID: CVE-2022-40609 State: PUBLISHED Published: 2023-08-02T14:21:51.701Z Last Updated: 2024-10-17T18:51:39.988Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: IBM Products: SDK, Java Technology Edition Problem Types: CWE-502 Description: IBM SDK, Java Technology Edition 7.1.5.18 and 8.0.8.0 could allow a remote attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw. By sending specially-crafted data, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 236069. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/supp
6069. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7017032 - https://exchange.xforce.ibmcloud.com/vulnerabilities/236069
CVE ID: CVE-2022-40615 State: PUBLISHED Published: 2023-01-11T16:48:43.176Z Last Updated: 2025-04-08T13:49:04.178Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: IBM Products: Sterling Partner Engagement Manager Problem Types: CWE-89 Description: IBM Sterling Partner Engagement Manager 6.1, 6.2, and 6.2.1 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 236208. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6854333 -
Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6854333 - https://exchange.xforce.ibmcloud.com/vulnerabilities/236208
CVE ID: CVE-2022-40616 State: PUBLISHED Published: 2022-09-21T16:20:10.043Z Last Updated: 2025-05-28T14:05:05.418Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AC:L/AV:N/PR:N/UI:N/A:N/S:U/I:L/C:L/E:U/RC:C/RL:O) Vendors: IBM Products: Maximo Asset Management Problem Types: Bypass Security Description: IBM Maximo Asset Management 7.6.1.1, 7.6.1.2, and 7.6.1.3 could allow a user to bypass authentication and obtain sensitive information or perform tasks they should not have access to. IBM X-Force ID: 236311. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6621599 - https://exchange.xforce.ibmcloud.com/vulnerabilities/236311
CVE ID: CVE-2022-40617 State: PUBLISHED Published: 2022-10-31T00:00:00.000Z Last Updated: 2025-05-06T18:29:51.839Z Vendors: n/a Products: n/a Problem Types: n/a Description: strongSwan before 5.9.8 allows remote attackers to cause a denial of service in the revocation plugin by sending a crafted end-entity (and intermediate CA) certificate that contains a CRL/OCSP URL that points to a server (under the attacker's control) that doesn't properly respond but (for example) just does nothing after the initial TCP handshake, or sends an excessive amount of application data. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.strongswan.org/blog/202
ional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.strongswan.org/blog/2022/10/03/strongswan-vulnerability-%28cve-2022-40617%29.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J3GAYIOCSLU57C45CO4UE4IV4JZE4W3L/
CVE ID: CVE-2022-40621 State: PUBLISHED Published: 2022-09-13T20:35:12.006313Z Last Updated: 2024-09-17T02:01:24.046Z Vendors: WAVLINK Products: WN531G3 Problem Types: CWE-294 Description: Because the WAVLINK Quantum D4G (WN531G3) running firmware version M31G3.V5030.200325 and earlier communicates over HTTP and not HTTPS, and because the hashing mechanism does not rely on a server-supplied key, it is possible for an attacker with sufficient network access to capture the hashed password of a logged on user and use it in a classic Pass-the-Hash style attack. Additional Analyst Notes: - CVE Program Container: References: - https://www.malbytes.net/2022/07/wavlink-quantum-d4g-zero-day-part-01.h
st Notes: - CVE Program Container: References: - https://www.malbytes.net/2022/07/wavlink-quantum-d4g-zero-day-part-01.html
CVE ID: CVE-2022-40622 State: PUBLISHED Published: 2022-09-13T20:35:12.848865Z Last Updated: 2024-09-16T16:54:00.789Z Vendors: WAVLINK Products: WN531G3 Problem Types: CWE-304 Description: The WAVLINK Quantum D4G (WN531G3) running firmware version M31G3.V5030.200325 uses IP addresses to hold sessions and does not not use session tokens. Therefore, if an attacker changes their IP address to match the logged-in administrator's, or is behind the same NAT as the logged in administrator, session takeover is possible. Additional Analyst Notes: - CVE Program Container: References: - https://youtu.be/cSileV8YbsQ?t=655
CVE ID: CVE-2022-40623 State: PUBLISHED Published: 2022-09-13T20:35:13.734432Z Last Updated: 2024-09-17T04:25:38.938Z Vendors: WAVLINK Products: WN531G3 Problem Types: CWE-352 Description: The WAVLINK Quantum D4G (WN531G3) running firmware version M31G3.V5030.200325 does not utilize anti-CSRF tokens, which, when combined with other issues (such as CVE-2022-35518), can lead to remote, unauthenticated command execution. Additional Analyst Notes: - CVE Program Container: References: - https://youtu.be/cSileV8YbsQ?t=1028
CVE ID: CVE-2022-40624 State: PUBLISHED Published: 2022-12-20T00:00:00.000Z Last Updated: 2025-04-17T13:50:54.301Z Vendors: n/a Products: n/a Problem Types: n/a Description: pfSense pfBlockerNG through 2.1.4_27 allows remote attackers to execute arbitrary OS commands as root via the HTTP Host header, a different vulnerability than CVE-2022-31814. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://docs.netgate.com/pfsense/en/latest/packages/pfblocker.html - https://github.com/dhammon/pfBlockerNg-RCE - https://github.com/dhammon/pfBlockerNg-CVE-2022-40624
CVE ID: CVE-2022-40626 State: PUBLISHED Published: 2022-09-14T06:55:08.852950Z Last Updated: 2024-09-16T19:19:37.577Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:N) Vendors: Zabbix Products: Frontend Problem Types: CWE-79 Description: An unauthenticated user can create a link with reflected Javascript code inside the backurl parameter and send it to other authenticated users in order to create a fake account with predefined login, password and role in Zabbix Frontend. Additional Analyst Notes: - CVE Program Container: References: - https://support.zabbix.com/browse/ZBX-21350 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/m
zabbix.com/browse/ZBX-21350 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SPU4RCRYVNVM3SS523UQXE63ATCTEX5G/
CVE ID: CVE-2022-40628 State: PUBLISHED Published: 2022-09-23T15:37:32.259Z Last Updated: 2025-05-22T19:59:29.947Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Tacitine Products: Firewall Problem Types: CWE-94 Description: This vulnerability exists in Tacitine Firewall, all versions of EN6200-PRIME QUAD-35 and EN6200-PRIME QUAD-100 between 19.1.1 to 22.20.1 (inclusive), due to improper control of code generation in the Tacitine Firewall web-based management interface. An unauthenticated remote attacker could exploit this vulnerability by sending a specially crafted http request on the targeted device. Successful exploitation of this vulnerability could
by sending a specially crafted http request on the targeted device. Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to execute arbitrary commands on the targeted device. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2022-0363 - https://tacitine.com/newdownload/CVE-2022-40628.pdf
CVE ID: CVE-2022-40629 State: PUBLISHED Published: 2022-09-23T18:00:37.121Z Last Updated: 2025-05-22T18:16:53.836Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Tacitine Products: Firewall Problem Types: CWE-200 Description: This vulnerability exists in Tacitine Firewall, all versions of EN6200-PRIME QUAD-35 and EN6200-PRIME QUAD-100 between 19.1.1 to 22.20.1 (inclusive), due to insecure design in the Tacitine Firewall web-based management interface. An unauthenticated remote attacker could exploit this vulnerability by sending a specially crafted http request on the targeted device. Successful exploitation of this vulnerability could allow an unauthenticate
crafted http request on the targeted device. Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to view sensitive information on the targeted device. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2022-0363 - https://tacitine.com/newdownload/CVE-2022-40629.pdf
CVE ID: CVE-2022-40630 State: PUBLISHED Published: 2022-09-23T18:13:47.025Z Last Updated: 2025-05-22T18:16:08.278Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: Tacitine Products: Firewall Problem Types: CWE-384 Description: This vulnerability exists in Tacitine Firewall, all versions of EN6200-PRIME QUAD-35 and EN6200-PRIME QUAD-100 between 19.1.1 to 22.20.1 (inclusive), due to improper session management in the Tacitine Firewall web-based management interface. An unauthenticated remote attacker could exploit this vulnerability by sending a specially crafted http request on the targeted device. Successful exploitation of this vulnerability could allow an
g a specially crafted http request on the targeted device. Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to perform session fixation on the targeted device. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2022-0363 - https://tacitine.com/newdownload/CVE-2022-40630.pdf
CVE ID: CVE-2022-40631 State: PUBLISHED Published: 2022-10-11T00:00:00 Last Updated: 2024-08-03T12:21:46.592Z Vendors: Siemens Products: SCALANCE X200-4P IRT, SCALANCE X201-3P IRT, SCALANCE X201-3P IRT PRO, SCALANCE X202-2IRT, SCALANCE X202-2P IRT, SCALANCE X202-2P IRT PRO, SCALANCE X204-2, SCALANCE X204-2FM, SCALANCE X204-2LD, SCALANCE X204-2LD TS, SCALANCE X204-2TS, SCALANCE X204IRT, SCALANCE X204IRT PRO, SCALANCE X206-1, SCALANCE X206-1LD, SCALANCE X208, SCALANCE X208PRO, SCALANCE X212-2, SCALANCE X212-2LD, SCALANCE X216, SCALANCE X224, SCALANCE XF201-3P IRT, SCALANCE XF202-2P IRT, SCALANCE XF204, SCALANCE XF204-2, SCALANCE XF204-2BA IRT, SCALANCE XF204IRT, SCALANCE XF206-1, SCALANCE XF20
202-2P IRT, SCALANCE XF204, SCALANCE XF204-2, SCALANCE XF204-2BA IRT, SCALANCE XF204IRT, SCALANCE XF206-1, SCALANCE XF208, SIPLUS NET SCALANCE X202-2P IRT Problem Types: CWE-79 Description: A vulnerability has been identified in SCALANCE X200-4P IRT (All versions < V5.5.0), SCALANCE X201-3P IRT (All versions < V5.5.0), SCALANCE X201-3P IRT PRO (All versions < V5.5.0), SCALANCE X202-2IRT (All versions < V5.5.0), SCALANCE X202-2P IRT (All versions < V5.5.0), SCALANCE X202-2P IRT PRO (All versions < V5.5.0), SCALANCE X204-2 (All versions < V5.2.5), SCALANCE X204-2FM (All versions < V5.2.5), SCALANCE X204-2LD (All versions < V5.2.5), SCALANCE X204-2LD TS (All versions < V5.2.5), SCALANCE X204-2T
ons < V5.2.5), SCALANCE X204-2LD (All versions < V5.2.5), SCALANCE X204-2LD TS (All versions < V5.2.5), SCALANCE X204-2TS (All versions < V5.2.5), SCALANCE X204IRT (All versions < V5.5.0), SCALANCE X204IRT PRO (All versions < V5.5.0), SCALANCE X206-1 (All versions < V5.2.5), SCALANCE X206-1LD (All versions < V5.2.5), SCALANCE X208 (All versions < V5.2.5), SCALANCE X208PRO (All versions < V5.2.5), SCALANCE X212-2 (All versions < V5.2.5), SCALANCE X212-2LD (All versions < V5.2.5), SCALANCE X216 (All versions < V5.2.5), SCALANCE X224 (All versions < V5.2.5), SCALANCE XF201-3P IRT (All versions < V5.5.0), SCALANCE XF202-2P IRT (All versions < V5.5.0), SCALANCE XF204 (All versions < V5.2.5), SCAL
IRT (All versions < V5.5.0), SCALANCE XF202-2P IRT (All versions < V5.5.0), SCALANCE XF204 (All versions < V5.2.5), SCALANCE XF204-2 (All versions < V5.2.5), SCALANCE XF204-2BA IRT (All versions < V5.5.0), SCALANCE XF204IRT (All versions < V5.5.0), SCALANCE XF206-1 (All versions < V5.2.5), SCALANCE XF208 (All versions < V5.2.5), SIPLUS NET SCALANCE X202-2P IRT (All versions < V5.5.0). There is a cross-site scripting vulnerability on the affected devices, that if used by a threat actor, it could result in session hijacking. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-501891.pdf
CVE ID: CVE-2022-40632 State: PUBLISHED Published: 2022-11-08T18:23:18.560Z Last Updated: 2025-02-20T19:55:42.253Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: gVectors Team Products: wpForo Forum (WordPress plugin) Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in gVectors Team wpForo Forum plugin <= 2.0.5 on WordPress leading to topic deletion. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wpforo/wordpress-wpforo-forum-plugin-2-0-5-cross-site-request-forgery-csrf-vulnerability-2?_s_id=cve - https://wordpress.org/plugins/wpforo/
CVE ID: CVE-2022-40633 State: PUBLISHED Published: 2023-03-02T22:18:31.192Z Last Updated: 2025-01-17T22:11:59.387Z Vendors: Rittal Products: CMC III Problem Types: CWE-284 Description: A malicious actor can clone access cards used to open control cabinets secured with Rittal CMC III locks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-061-03
CVE ID: CVE-2022-40634 State: PUBLISHED Published: 2022-09-13T18:25:09.814692Z Last Updated: 2024-09-16T23:36:30.569Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H) Vendors: Crafter Software Products: Crafter CMS Problem Types: CWE-913 Description: Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via FreeMarker SSTI. Additional Analyst Notes: - CVE Program Container: References: - https://docs.craftercms.org/en/3.1/security/advisory.html#cv-2022051601
CVE ID: CVE-2022-40635 State: PUBLISHED Published: 2022-09-13T18:25:10.622257Z Last Updated: 2024-09-16T16:13:57.113Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H) Vendors: Crafter Software Products: Crafter CMS Problem Types: CWE-913 Description: Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via Groovy Sandbox Bypass. Additional Analyst Notes: - CVE Program Container: References: - https://docs.craftercms.org/en/3.1/security/advisory.html#cv-2022051602
CVE ID: CVE-2022-40636 State: PUBLISHED Published: 2022-09-15T15:26:14 Last Updated: 2024-08-03T12:21:46.439Z Severity: HIGH (CVSS 7 CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Ansys Products: SpaceClaim Problem Types: CWE-125 Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ansys SpaceClaim 2022 R1. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JT files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buff
s from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17044. Additional Analyst Notes: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-22-1192/
CVE ID: CVE-2022-40637 State: PUBLISHED Published: 2022-09-15T15:26:14 Last Updated: 2024-08-03T12:21:46.579Z Severity: HIGH (CVSS 7 CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Ansys Products: SpaceClaim Problem Types: CWE-416 Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ansys SpaceClaim 2022 R1. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JT files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can l
s from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17045. Additional Analyst Notes: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-22-1193/
CVE ID: CVE-2022-40638 State: PUBLISHED Published: 2022-09-15T15:26:15 Last Updated: 2024-08-03T12:21:46.551Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Ansys Products: SpaceClaim Problem Types: CWE-416 Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ansys SpaceClaim 2022 R1. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of X_B files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker ca
ults from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17102. Additional Analyst Notes: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-22-1194/
CVE ID: CVE-2022-40639 State: PUBLISHED Published: 2022-09-15T15:26:16 Last Updated: 2024-08-03T12:21:46.399Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Ansys Products: SpaceClaim Problem Types: CWE-416 Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ansys SpaceClaim 2022 R1. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of SKP files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker ca
ults from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17207. Additional Analyst Notes: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-22-1195/