Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-24671 State: PUBLISHED Published: 2022-02-24T02:45:48 Last Updated: 2024-08-03T04:20:49.102Z Vendors: Trend Micro Products: Trend Micro Antivirus for Mac Problem Types: Link Following Privilege Escalation Description: A link following privilege escalation vulnerability in Trend Micro Antivirus for Max 11.0.2150 and below could allow a local attacker to modify a file during the update process and escalate their privileges. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://helpcenter.trendmicro.com/en-us/artic
rability. Additional Analyst Notes: - CVE Program Container: References: - https://helpcenter.trendmicro.com/en-us/article/TMKA-10937 - https://www.zerodayinitiative.com/advisories/ZDI-22-371/
CVE ID: CVE-2022-24672 State: PUBLISHED Published: 2023-03-28T00:00:00.000Z Last Updated: 2025-02-19T15:41:43.674Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Canon Products: imageCLASS MF644Cdw Problem Types: CWE-122 Description: This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Canon imageCLASS MF644Cdw 10.02 printers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the CADM service. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage
n of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-15802. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-22-514/ - https://www.usa.canon.com/support/canon-product-advisories/canon-laser-printer-inkjet-printer-and-small-office-multifunctio
CVE ID: CVE-2022-24673 State: PUBLISHED Published: 2023-03-28T00:00:00.000Z Last Updated: 2025-02-19T15:39:58.261Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Canon Products: imageCLASS MF644Cdw Problem Types: CWE-121 Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Canon imageCLASS MF644Cdw 10.02 printers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the SLP protocol. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker
er validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-15845. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-22-515/ - https://www.usa.canon.com/support/canon-product-advisories/canon-laser-printer-inkjet-printer-and-small-office-multifunctional-printer-measure-against-buffer-overflow
CVE ID: CVE-2022-24674 State: PUBLISHED Published: 2023-03-28T00:00:00.000Z Last Updated: 2025-02-19T15:37:21.554Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Canon Products: imageCLASS MF644Cdw Problem Types: CWE-121 Description: This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Canon imageCLASS MF644Cdw 10.02 printers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the privet API. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage t
of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-15834. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-22-516/ - https://www.usa.canon.com/internet/portal/us/home/support/product-advisories/detail/canon-laser-printer-and-small-office-multifunctional-printer-measure-against-buffer-overflow/
CVE ID: CVE-2022-24675 State: PUBLISHED Published: 2022-04-20T00:00:00 Last Updated: 2024-08-03T04:20:49.135Z Vendors: n/a Products: n/a Problem Types: n/a Description: encoding/pem in Go before 1.17.9 and 1.18.x before 1.18.1 has a Decode stack overflow via a large amount of PEM data. Additional Analyst Notes: - CVE Program Container: References: - https://groups.google.com/g/golang-announce - https://groups.google.com/g/golang-announce/c/oecdBNLOml8 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/42TYZC4OAY54TO75FBEFAPV5G7O4D5TM/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F3BMW5QGX53C
7O4D5TM/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F3BMW5QGX53CMIJIZWKXFKBJX2C5GWTY/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RCRSABD6CUDIZULZPZL5BJ3ET3A2NEJP/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZY2SLWOQR4ZURQ7UBRZ7JIX6H6F5JHJR/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z55VUVGO7E5PJFXIOVAY373NZRHBNCI5/ - https://security.gentoo.org/glsa/202208-02 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RQXU752ALW53OJA
08-02 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RQXU752ALW53OJAF5MG3WMR5CCZVLWW6/ - https://security.netapp.com/advisory/ntap-20220915-0010/ - https://cert-portal.siemens.com/productcert/pdf/ssa-744259.pdf
CVE ID: CVE-2022-24676 State: PUBLISHED Published: 2022-02-08T23:48:56 Last Updated: 2024-08-03T04:20:49.162Z Vendors: n/a Products: n/a Problem Types: n/a Description: update_code in Admin.php in HYBBS2 through 2.3.2 allows arbitrary file upload via a crafted ZIP archive. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/hyyyp/HYBBS2/issues/33
CVE ID: CVE-2022-24677 State: PUBLISHED Published: 2022-02-08T23:48:40 Last Updated: 2024-08-03T04:20:49.868Z Vendors: n/a Products: n/a Problem Types: n/a Description: Admin.php in HYBBS2 through 2.3.2 allows remote code execution because it writes plugin-related configuration information to conf.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/hyyyp/HYBBS2/issues/34
CVE ID: CVE-2022-24678 State: PUBLISHED Published: 2022-02-24T02:45:49 Last Updated: 2024-08-03T04:20:49.099Z Vendors: Trend Micro Products: Trend Micro Apex One, Trend Micro Worry-Free Business Security Problem Types: Resource Exhaustion Denial-of-Service Description: An security agent resource exhaustion denial-of-service vulnerability in Trend Micro Apex One, Trend Micro Apex One as a Service, Trend Micro Worry-Free Business Security 10.0 SP1 and Trend Micro Worry-Free Business Security Services agents could allow an attacker to flood a temporary log location and consume all disk space on affected installations. Additional Analyst Notes: - CVE Program Container: References: - https://succ
all disk space on affected installations. Additional Analyst Notes: - CVE Program Container: References: - https://success.trendmicro.com/solution/000290464 - https://success.trendmicro.com/solution/000290486 - https://www.zerodayinitiative.com/advisories/ZDI-22-372/
CVE ID: CVE-2022-24679 State: PUBLISHED Published: 2022-02-24T02:45:51 Last Updated: 2024-08-03T04:20:50.339Z Vendors: Trend Micro Products: Trend Micro Apex One, Trend Micro Worry-Free Business Security Problem Types: Link Following Local Privilege Escalation Description: A security link following local privilege escalation vulnerability in Trend Micro Apex One, Trend Micro Apex One as a Service, Trend Micro Worry-Free Business Security 10.0 SP1 and Trend Micro Worry-Free Business Security Services agents could allow a local attacker to create an writable folder in an arbitrary location and escalate privileges affected installations. Please note: an attacker must first obtain the ability to
trary location and escalate privileges affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://success.trendmicro.com/solution/000290464 - https://success.trendmicro.com/solution/000290486 - https://www.zerodayinitiative.com/advisories/ZDI-22-370/
CVE ID: CVE-2022-24680 State: PUBLISHED Published: 2022-02-24T02:45:52 Last Updated: 2024-08-03T04:20:49.145Z Vendors: Trend Micro Products: Trend Micro Apex One, Trend Micro Worry-Free Business Security Problem Types: Link Following Local Privilege Escalation Description: A security link following local privilege escalation vulnerability in Trend Micro Apex One, Trend Micro Apex One as a Service, Trend Micro Worry-Free Business Security 10.0 SP1 and Trend Micro Worry-Free Business Security Services agents could allow a local attacker to create a mount point and leverage this for arbitrary folder deletion, leading to escalated privileges on affected installations. Please note: an attacker mu
is for arbitrary folder deletion, leading to escalated privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://success.trendmicro.com/solution/000290464 - https://success.trendmicro.com/solution/000290486 - https://www.zerodayinitiative.com/advisories/ZDI-22-369/
CVE ID: CVE-2022-24681 State: PUBLISHED Published: 2022-04-07T21:49:29 Last Updated: 2024-08-03T04:20:49.188Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine ADSelfService Plus before 6121 allows XSS via the welcome name attribute to the Reset Password, Unlock Account, or User Must Change Password screen. Additional Analyst Notes: - CVE Program Container: References: - https://manageengine.com - https://www.manageengine.com/products/self-service-password/kb/CVE-2022-24681.html - https://raxis.com/blog/cve-2022-24681
CVE ID: CVE-2022-24682 State: PUBLISHED Published: 2022-02-09T03:19:04.000Z Last Updated: 2025-10-21T23:15:48.240Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Calendar feature in Zimbra Collaboration Suite 8.8.x before 8.8.15 patch 30 (update 1), as exploited in the wild starting in December 2021. An attacker could place HTML containing executable JavaScript inside element attributes. This markup becomes unescaped, causing arbitrary markup to be injected into the document. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories - https://wiki.zimbra.com/wiki
A ADP Vulnrichment: References: - https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories - https://wiki.zimbra.com/wiki/Security_Center - https://www.volexity.com/blog/2022/02/03/operation-emailthief-active-exploitation-of-zero-day-xss-vulnerability-in-zimbra/ - https://blog.zimbra.com/2022/02/hotfix-available-5-feb-for-zero-day-exploit-vulnerability-in-zimbra-8-8-15/ - https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P30
CVE ID: CVE-2022-24683 State: PUBLISHED Published: 2022-02-17T16:36:37 Last Updated: 2024-08-03T04:20:50.373Z Vendors: n/a Products: n/a Problem Types: n/a Description: HashiCorp Nomad and Nomad Enterprise 0.9.2 through 1.0.17, 1.1.11, and 1.2.5 allow operators with read-fs and alloc-exec (or job-submit) capabilities to read arbitrary files on the host filesystem as root. Additional Analyst Notes: - CVE Program Container: References: - https://discuss.hashicorp.com - https://discuss.hashicorp.com/t/hcsec-2022-02-nomad-alloc-filesystem-and-container-escape/35560 - https://security.netapp.com/advisory/ntap-20220318-0008/
CVE ID: CVE-2022-24684 State: PUBLISHED Published: 2022-02-15T14:04:46 Last Updated: 2024-08-03T04:20:49.161Z Vendors: n/a Products: n/a Problem Types: n/a Description: HashiCorp Nomad and Nomad Enterprise 0.9.0 through 1.0.16, 1.1.11, and 1.2.5 allow operators with job-submit capabilities to use the spread stanza to panic server agents. Fixed in 1.0.18, 1.1.12, and 1.2.6. Additional Analyst Notes: - CVE Program Container: References: - https://discuss.hashicorp.com - https://discuss.hashicorp.com/t/hcsec-2022-04-nomad-spread-job-stanza-may-trigger-panic-in-servers/35562 - https://security.netapp.com/advisory/ntap-20220318-0008/ - https://discuss.hashicorp.com/t/hcsec-2022-04-nomad-spread-jo
https://security.netapp.com/advisory/ntap-20220318-0008/ - https://discuss.hashicorp.com/t/hcsec-2022-04-nomad-spread-job-stanza-may-trigger-panic-in-servers/
CVE ID: CVE-2022-24685 State: PUBLISHED Published: 2022-02-28T13:26:51 Last Updated: 2024-08-03T04:20:50.157Z Vendors: n/a Products: n/a Problem Types: n/a Description: HashiCorp Nomad and Nomad Enterprise 1.0.17, 1.1.11, and 1.2.5 allow invalid HCL for the jobs parse endpoint, which may cause excessive CPU usage. Fixed in 1.0.18, 1.1.12, and 1.2.6. Additional Analyst Notes: - CVE Program Container: References: - https://discuss.hashicorp.com - https://discuss.hashicorp.com/t/hcsec-2022-03-nomad-malformed-job-parsing-results-in-excessive-cpu-usage/35561 - https://security.netapp.com/advisory/ntap-20220331-0007/ - https://discuss.hashicorp.com/t/hcsec-2022-03-nomad-malformed-job-parsing-resul
etapp.com/advisory/ntap-20220331-0007/ - https://discuss.hashicorp.com/t/hcsec-2022-03-nomad-malformed-job-parsing-results-in-excessive-cpu-usage/
CVE ID: CVE-2022-24686 State: PUBLISHED Published: 2022-02-14T13:54:07 Last Updated: 2024-08-03T04:20:49.714Z Vendors: n/a Products: n/a Problem Types: n/a Description: HashiCorp Nomad and Nomad Enterprise 0.3.0 through 1.0.17, 1.1.11, and 1.2.5 artifact download functionality has a race condition such that the Nomad client agent could download the wrong artifact into the wrong destination. Fixed in 1.0.18, 1.1.12, and 1.2.6 Additional Analyst Notes: - CVE Program Container: References: - https://discuss.hashicorp.com - https://discuss.hashicorp.com/t/hcsec-2022-01-nomad-artifact-download-race-condition/35559 - https://security.netapp.com/advisory/ntap-20220318-0008/
CVE ID: CVE-2022-24687 State: PUBLISHED Published: 2022-02-24T15:37:51 Last Updated: 2024-08-03T04:20:49.839Z Vendors: n/a Products: n/a Problem Types: n/a Description: HashiCorp Consul and Consul Enterprise 1.9.0 through 1.9.14, 1.10.7, and 1.11.2 clusters with at least one Ingress Gateway allow a user with service:write to register a specifically-defined service that can cause Consul servers to panic. Fixed in 1.9.15, 1.10.8, and 1.11.3. Additional Analyst Notes: - CVE Program Container: References: - https://discuss.hashicorp.com - https://discuss.hashicorp.com/t/hcsec-2022-05-consul-ingress-gateway-panic-can-shutdown-servers/ - https://security.netapp.com/advisory/ntap-20220331-0006/ - h
022-05-consul-ingress-gateway-panic-can-shutdown-servers/ - https://security.netapp.com/advisory/ntap-20220331-0006/ - https://security.gentoo.org/glsa/202208-09
CVE ID: CVE-2022-24688 State: PUBLISHED Published: 2022-07-18T12:34:18 Last Updated: 2024-08-03T04:20:49.788Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in DSK DSKNet 2.16.136.0 and 2.17.136.5. The Touch settings allow unrestricted file upload (and consequently Remote Code Execution) via PDF upload with PHP content and a .php extension. The attacker must hijack or obtain privileged user access to the Parameters page in order to exploit this issue. (That can be easily achieved by exploiting the Broken Access Control with further Brute-force attack or SQL Injection.) The uploaded file is stored within the database and copied to the sync web folder if the
force attack or SQL Injection.) The uploaded file is stored within the database and copied to the sync web folder if the attacker visits a certain .php?action= page. Additional Analyst Notes: - CVE Program Container: References: - https://dsk.lu/fr/produits/temps-de-presence - https://github.com/post-cyberlabs/CVE-Advisory/blob/main/CVE-2022-24688-92.pdf
CVE ID: CVE-2022-24689 State: PUBLISHED Published: 2022-07-18T12:34:24 Last Updated: 2024-08-03T04:20:50.187Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in DSK DSKNet 2.16.136.0 and 2.17.136.5. It mishandles access control. This allows a remote attacker to access account information pages (including personal data) without being authenticated. The collected information includes the badge numbers that operate as user login names. They have a PIN code. The PIN code is 4 digits and thus can be guessed in 10000 brute force attempts. Additional Analyst Notes: - CVE Program Container: References: - https://dsk.lu/fr/produits/temps-de-presence - https://github
onal Analyst Notes: - CVE Program Container: References: - https://dsk.lu/fr/produits/temps-de-presence - https://github.com/post-cyberlabs/CVE-Advisory/blob/main/CVE-2022-24688-92.pdf
CVE ID: CVE-2022-24690 State: PUBLISHED Published: 2022-07-18T12:34:29 Last Updated: 2024-08-03T04:20:50.088Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in DSK DSKNet 2.16.136.0 and 2.17.136.5. A PresAbs.php SQL Injection vulnerability allows unauthenticated users to taint database data and extract sensitive information via crafted HTTP requests. The type of SQL Injection is blind boolean based. (An unauthenticated attacker can discover the endpoint by abusing a Broken Access Control issue with further SQL injection attacks to gather all user's badge numbers and PIN codes.) Additional Analyst Notes: - CVE Program Container: References: - https://dsk.lu
all user's badge numbers and PIN codes.) Additional Analyst Notes: - CVE Program Container: References: - https://dsk.lu/fr/produits/temps-de-presence - https://github.com/post-cyberlabs/CVE-Advisory/blob/main/CVE-2022-24688-92.pdf
CVE ID: CVE-2022-24691 State: PUBLISHED Published: 2022-07-18T12:34:34 Last Updated: 2024-08-03T04:20:49.796Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in DSK DSKNet 2.16.136.0 and 2.17.136.5. A SQL Injection vulnerability allows authenticated users to taint database data and extract sensitive information via crafted HTTP requests. The type of SQL Injection is blind boolean based. Additional Analyst Notes: - CVE Program Container: References: - https://dsk.lu/fr/produits/temps-de-presence - https://github.com/post-cyberlabs/CVE-Advisory/blob/main/CVE-2022-24688-92.pdf
CVE ID: CVE-2022-24692 State: PUBLISHED Published: 2022-07-18T12:34:40 Last Updated: 2024-08-03T04:20:49.925Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in DSK DSKNet 2.16.136.0 and 2.17.136.5. The new menu option within the general Parameters page is vulnerable to stored XSS. The attacker can create a menu option, make it visible to every application user, and conduct session hijacking, account takeover, or malicious code delivery, with the final goal of achieving client-side code execution. Additional Analyst Notes: - CVE Program Container: References: - https://dsk.lu/fr/produits/temps-de-presence - https://github.com/post-cyberlabs/CVE-Advisory/blo
ntainer: References: - https://dsk.lu/fr/produits/temps-de-presence - https://github.com/post-cyberlabs/CVE-Advisory/blob/main/CVE-2022-24688-92.pdf
CVE ID: CVE-2022-24693 State: PUBLISHED Published: 2022-03-30T01:43:18 Last Updated: 2024-08-03T04:20:50.191Z Vendors: n/a Products: n/a Problem Types: n/a Description: Baicells Nova436Q and Neutrino 430 devices with firmware through QRTB 2.7.8 have hardcoded credentials that are easily discovered, and can be used by remote attackers to authenticate via ssh. (The credentials are stored in the firmware, encrypted by the crypt function.) Additional Analyst Notes: - CVE Program Container: References: - https://na.baicells.com/Service/Firmware - https://img.baicells.com/Upload/20210909/FILE/98d2752f-6e83-49b1-9dab-d291e9023db6.pdf - https://github.com/lukejenkins/CVE-2022-24693
CVE ID: CVE-2022-24694 State: PUBLISHED Published: 2022-02-09T04:31:50 Last Updated: 2024-08-03T04:20:50.285Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Mahara 20.10 before 20.10.4, 21.04 before 21.04.3, and 21.10 before 21.10.1, the names of folders in the Files area can be seen by a person not owning the folders. (Only folder names are affected. Neither file names nor file contents are affected.) Additional Analyst Notes: - CVE Program Container: References: - https://bugs.launchpad.net/mahara/+bug/1952808 - https://mahara.org/interaction/forum/topic.php?id=8994
CVE ID: CVE-2022-24695 State: PUBLISHED Published: 2023-06-02T00:00:00 Last Updated: 2025-01-10T18:29:57.338Z Vendors: n/a Products: n/a Problem Types: n/a Description: Bluetooth Classic in Bluetooth Core Specification through 5.3 does not properly conceal device information for Bluetooth transceivers in Non-Discoverable mode. By conducting an efficient over-the-air attack, an attacker can fully extract the permanent, unique Bluetooth MAC identifier, along with device capabilities and identifiers, some of which may contain identifying information about the device owner. This additionally allows the attacker to establish a connection to the target device. Additional Analyst Notes: - CVE Progr
s additionally allows the attacker to establish a connection to the target device. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.bluetooth.com/specifications/specs/core-specification/ - https://www.computer.org/csdl/proceedings-article/sp/2023/933600a521/1He7Yja1AYM - https://sp2023.ieee-security.org/program-papers.html
CVE ID: CVE-2022-24696 State: PUBLISHED Published: 2022-03-13T17:50:21 Last Updated: 2024-08-03T04:20:50.438Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mirametrix Glance before 5.1.1.42207 (released on 2018-08-30) allows a local attacker to elevate privileges. NOTE: this is unrelated to products from the glance.com and glance.net websites. Additional Analyst Notes: - CVE Program Container: References: - https://help.mirametrix.com/hc/en-us/articles/4424676598157
CVE ID: CVE-2022-24697 State: PUBLISHED Published: 2022-10-13T00:00:00.000Z Last Updated: 2025-05-16T13:42:57.582Z Vendors: Apache Software Foundation Products: Apache Kylin Problem Types: Command injection Description: Kylin's cube designer function has a command injection vulnerability when overwriting system parameters in the configuration overwrites menu. RCE can be implemented by closing the single quotation marks around the parameter value of “-- conf=” to inject any operating system command into the command line parameters. This vulnerability affects Kylin 2 version 2.6.5 and earlier, Kylin 3 version 3.1.2 and earlier, and Kylin 4 version 4.0.1 and earlier. Additional Analyst Notes: -
2.6.5 and earlier, Kylin 3 version 3.1.2 and earlier, and Kylin 4 version 4.0.1 and earlier. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/07mnn9c7o314wrhrwjr10w9j5s82voj4 - http://www.openwall.com/lists/oss-security/2022/12/30/1