Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-27656 State: PUBLISHED Published: 2022-05-11T14:53:55 Last Updated: 2024-08-03T05:32:59.822Z Vendors: SAP SE Products: SAP NetWeaver AS for ABAP and Java (ICM Administration UI), SAP Web Dispatcher (Web Administration UI) Problem Types: CWE-79 Description: The Web administration UI of SAP Web Dispatcher and the Internet Communication Manager (ICM) does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html - https://launchpad.support.sap.com/#/notes/3145046
CVE ID: CVE-2022-27657 State: PUBLISHED Published: 2022-04-12T16:11:29 Last Updated: 2024-08-03T05:32:59.992Z Vendors: SAP SE Products: SAP Focused Run (Simple Diagnostics Agent) Problem Types: CWE-22 Description: A highly privileged remote attacker, can gain unauthorized access to display contents of restricted directories by exploiting insufficient validation of path information in SAP Focused Run (Simple Diagnostics Agent 1.0) - version 1.0. Additional Analyst Notes: - CVE Program Container: References: - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html - https://launchpad.support.sap.com/#/notes/3159091 - http://seclists.org/fulldisclosure/2022/Jun/41 - htt
7e60039b.html - https://launchpad.support.sap.com/#/notes/3159091 - http://seclists.org/fulldisclosure/2022/Jun/41 - http://packetstormsecurity.com/files/167563/SAP-FRUN-Simple-Diagnostics-Agent-1.0-Directory-Traversal.html
CVE ID: CVE-2022-27658 State: PUBLISHED Published: 2022-03-28T18:52:57 Last Updated: 2024-08-03T05:32:59.993Z Vendors: SAP SE Products: SAP Innovation management Problem Types: CWE-862 Description: Under certain conditions, SAP Innovation management - version 2.0, allows an attacker to access information which could lead to information gathering for further exploits and attacks. Additional Analyst Notes: - CVE Program Container: References: - https://dam.sap.com/mac/embed/public/pdf/a/ucQrx6G.htm?rc=10 - https://launchpad.support.sap.com/#/notes/3165856
CVE ID: CVE-2022-27659 State: PUBLISHED Published: 2022-05-05T16:14:41.606388Z Last Updated: 2024-09-17T03:43:49.467Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: F5 Products: BIG-IP Problem Types: CWE-269 Description: On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, and 14.1.x versions prior to 14.1.4.6, an authenticated attacker can modify or delete Dashboards created by other BIG-IP users in the Traffic Management User Interface (TMUI). Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/
rt (EoTS) are not evaluated Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K41877405
CVE ID: CVE-2022-27660 State: PUBLISHED Published: 2022-08-05T21:19:58.091Z Last Updated: 2025-04-15T18:53:13.085Z Severity: CRITICAL (CVSS 9.3 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H) Vendors: TCL Products: LinkHub Mesh Wifi Problem Types: CWE-284 Description: A denial of service vulnerability exists in the confctl_set_guest_wlan functionality of TCL LinkHub Mesh Wi-Fi MS1G_00_01.00_14. A specially-crafted network packet can lead to denial of service. An attacker can send packets to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2022-1502
CVE ID: CVE-2022-27661 State: PUBLISHED Published: 2022-07-04T06:55:56 Last Updated: 2024-08-03T05:32:59.830Z Vendors: Cybozu, Inc. Products: Cybozu Garoon Problem Types: Improper Authorization Description: Operation restriction bypass vulnerability in Workflow of Cybozu Garoon 4.0.0 to 5.5.1 allows a remote authenticated attacker to alter the data of Workflow. Additional Analyst Notes: - CVE Program Container: References: - https://cs.cybozu.co.jp/2022/007429.html - https://jvn.jp/en/jp/JVN73897863/index.html
CVE ID: CVE-2022-27662 State: PUBLISHED Published: 2022-05-05T16:29:10.065731Z Last Updated: 2024-09-16T20:16:37.864Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: F5 Products: Traffix SDC Problem Types: CWE-1336 Description: On F5 Traffix SDC 5.2.x versions prior to 5.2.2 and 5.1.x versions prior to 5.1.35, a stored Cross-Site Template Injection vulnerability exists in an undisclosed page of the Traffix SDC Configuration utility that allows an attacker to execute template language-specific instructions in the context of the server. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated Additional Analyst Notes: - CVE
Software versions which have reached End of Technical Support (EoTS) are not evaluated Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K24248011
CVE ID: CVE-2022-27664 State: PUBLISHED Published: 2022-09-06T17:29:08 Last Updated: 2024-08-03T05:32:59.884Z Vendors: n/a Products: n/a Problem Types: n/a Description: In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error. Additional Analyst Notes: - CVE Program Container: References: - https://groups.google.com/g/golang-announce - https://groups.google.com/g/golang-announce/c/x49AQzIVX-s - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TXS2OQ57KZC5XZKK5UW4SYKPVQAHIOJX/ - https://lists.fedoraproject.org
t/package-announce%40lists.fedoraproject.org/message/TXS2OQ57KZC5XZKK5UW4SYKPVQAHIOJX/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JXKTHIGE5F576MAPFYCIJXNRGBSPISUF/ - https://security.netapp.com/advisory/ntap-20220923-0004/ - https://security.gentoo.org/glsa/202209-26
CVE ID: CVE-2022-27665 State: PUBLISHED Published: 2023-04-03T00:00:00 Last Updated: 2024-11-27T14:47:52.255Z Vendors: n/a Products: n/a Problem Types: n/a Description: Reflected XSS (via AngularJS sandbox escape expressions) exists in Progress Ipswitch WS_FTP Server 8.6.0. This can lead to execution of malicious code and commands on the client due to improper handling of user-provided input. By inputting malicious payloads in the subdirectory searchbar or Add folder filename boxes, it is possible to execute client-side commands. For example, there is Client-Side Template Injection via subFolderPath to the ThinClient/WtmApiService.asmx/GetFileSubTree URI. Additional Analyst Notes: - CVE Prog
njection via subFolderPath to the ThinClient/WtmApiService.asmx/GetFileSubTree URI. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://docs.ipswitch.com/WS_FTP_Server2020/ReleaseNotes/index.htm - https://github.com/dievus/CVE-2022-27665 - https://community.progress.com/s/article/WS-FTP-Server-Critical-Vulnerability-September-2023
CVE ID: CVE-2022-27666 State: PUBLISHED Published: 2022-03-23T05:07:01 Last Updated: 2024-08-03T05:32:59.797Z Vendors: n/a Products: n/a Problem Types: n/a Description: A heap buffer overflow flaw was found in IPsec ESP transformation code in net/ipv4/esp4.c and net/ipv6/esp6.c. This flaw allows a local attacker with a normal user privilege to overwrite kernel heap objects and may cause a local privilege escalation threat. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2061633 - https://github.com/torvalds/linux/commit/ebe48d368e97d007bfeb76fcb065d6cfc4c96645 - https://security.netapp.com/advisory/ntap-20220429-0001/ - https://www
commit/ebe48d368e97d007bfeb76fcb065d6cfc4c96645 - https://security.netapp.com/advisory/ntap-20220429-0001/ - https://www.debian.org/security/2022/dsa-5127 - https://www.debian.org/security/2022/dsa-5173
CVE ID: CVE-2022-27667 State: PUBLISHED Published: 2022-04-12T16:11:20 Last Updated: 2024-08-03T05:32:59.924Z Vendors: SAP SE Products: SAP BusinessObjects Business Intelligence Platform Problem Types: CWE-200 Description: Under certain conditions, SAP BusinessObjects Business Intelligence platform, Client Management Console (CMC) - version 430, allows an attacker to access information which would otherwise be restricted, leading to Information Disclosure. Additional Analyst Notes: - CVE Program Container: References: - https://launchpad.support.sap.com/#/notes/3145769 - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
CVE ID: CVE-2022-27668 State: PUBLISHED Published: 2022-06-14T16:57:29 Last Updated: 2024-08-03T05:33:00.474Z Vendors: SAP SE Products: SAP NetWeaver and ABAP Platform Problem Types: CWE-863 Description: Depending on the configuration of the route permission table in file 'saprouttab', it is possible for an unauthenticated attacker to execute SAProuter administration commands in SAP NetWeaver and ABAP Platform - versions KERNEL 7.49, 7.77, 7.81, 7.85, 7.86, 7.87, 7.88, KRNL64NUC 7.49, KRNL64UC 7.49, SAP_ROUTER 7.53, 7.22, from a remote client, for example stopping the SAProuter, that could highly impact systems availability. Additional Analyst Notes: - CVE Program Container: References: - ht
uter, that could highly impact systems availability. Additional Analyst Notes: - CVE Program Container: References: - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html - https://launchpad.support.sap.com/#/notes/3158375 - http://seclists.org/fulldisclosure/2022/Sep/17 - http://packetstormsecurity.com/files/168406/SAP-SAProuter-Improper-Access-Control.html
CVE ID: CVE-2022-27669 State: PUBLISHED Published: 2022-04-12T16:11:31 Last Updated: 2024-08-03T05:33:00.326Z Vendors: SAP SE Products: SAP NetWeaver Application Server for Java Problem Types: CWE-862 Description: An unauthenticated user can use functions of XML Data Archiving Service of SAP NetWeaver Application Server for Java - version 7.50, to which access should be restricted. This may result in an escalation of privileges. Additional Analyst Notes: - CVE Program Container: References: - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html - https://launchpad.support.sap.com/#/notes/3152442
CVE ID: CVE-2022-27670 State: PUBLISHED Published: 2022-04-12T16:11:25 Last Updated: 2024-08-03T05:32:59.825Z Vendors: SAP SE Products: SAP SQL Anywhere Server Problem Types: CWE-99 Description: SAP SQL Anywhere - version 17.0, allows an authenticated attacker to prevent legitimate users from accessing a SQL Anywhere database server by crashing the server with some queries that use indirect identifiers. Additional Analyst Notes: - CVE Program Container: References: - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html - https://launchpad.support.sap.com/#/notes/3148094
CVE ID: CVE-2022-27671 State: PUBLISHED Published: 2022-04-12T16:11:31 Last Updated: 2024-08-03T05:32:59.850Z Vendors: SAP SE Products: SAP BusinessObjects Business Intelligence Platform Problem Types: CWE-201 Description: A CSRF token visible in the URL may possibly lead to information disclosure vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html - https://launchpad.support.sap.com/#/notes/3130497
CVE ID: CVE-2022-27672 State: PUBLISHED Published: 2023-02-14T19:34:54.028Z Last Updated: 2024-08-03T05:32:59.968Z Vendors: AMD, AMD, AMD Products: 1st Gen AMD EPYC™ Processors, 2nd Gen AMD EPYC™ Processors, Athlon™ X4 Processor, Ryzen™ Threadripper™ PRO Processor, 2nd Gen AMD Ryzen™ Threadripper™ Processors, 3rd Gen AMD Ryzen™ Threadripper™ Processors, 7th Generation AMD A-Series APUs, Ryzen™ 2000 Series Processors, Ryzen™ 3000 Series Processors, Ryzen™ 4000 Series Processors, Ryzen™ 5000 Series Processors, Athlon™ Mobile Processors Problem Types: n/a Description: When SMT is enabled, certain AMD processors may speculatively execute instructions using a target from the sibling thread after
is enabled, certain AMD processors may speculatively execute instructions using a target from the sibling thread after an SMT mode switch potentially resulting in information disclosure. Additional Analyst Notes: - CVE Program Container: References: - https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1045 - https://security.gentoo.org/glsa/202402-07
CVE ID: CVE-2022-27673 State: PUBLISHED Published: 2022-11-09T20:46:51.519Z Last Updated: 2025-05-01T13:43:54.123Z Vendors: AMD Products: AMD Link Android Problem Types: NA Description: Insufficient access controls in the AMD Link Android app may potentially result in information disclosure. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1047
CVE ID: CVE-2022-27674 State: PUBLISHED Published: 2022-11-09T20:45:35.675Z Last Updated: 2025-05-01T14:11:02.633Z Vendors: AMD Products: AMD μProf Problem Types: NA Description: Insufficient validation in the IOCTL input/output buffer in AMD μProf may allow an attacker to bypass bounds checks potentially leading to a Windows kernel crash resulting in denial of service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1046
CVE ID: CVE-2022-27675 State: REJECTED Published: N/A Last Updated: 2023-01-17T00:00:00 Description: No description available.
CVE ID: CVE-2022-27676 State: REJECTED Published: N/A Last Updated: 2023-01-17T00:00:00 Description: No description available.
CVE ID: CVE-2022-27677 State: PUBLISHED Published: 2023-02-14T19:52:28.727Z Last Updated: 2025-03-19T18:52:04.925Z Vendors: AMD Products: Ryzen™ Master Problem Types: n/a Description: Failure to validate privileges during installation of AMD Ryzen™ Master may allow an attacker with low privileges to modify files potentially leading to privilege escalation and code execution by the lower privileged user. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1052
CVE ID: CVE-2022-27772 State: PUBLISHED Published: 2022-03-30T17:45:42 Last Updated: 2024-08-03T05:32:59.831Z Vendors: n/a Products: n/a Problem Types: n/a Description: spring-boot versions prior to version v2.2.11.RELEASE was vulnerable to temporary directory hijacking. This vulnerability impacted the org.springframework.boot.web.server.AbstractConfigurableWebServerFactory.createTempDir method. NOTE: This vulnerability only affects products and/or versions that are no longer supported by the maintainer Additional Analyst Notes: - CVE Program Container: References: - https://github.com/JLLeitschuh/security-research/security/advisories/GHSA-cm59-pr5q-cw85
CVE ID: CVE-2022-27773 State: PUBLISHED Published: 2022-12-05T00:00:00.000Z Last Updated: 2025-04-24T13:25:51.848Z Vendors: n/a Products: Ivanti Endpoint Manger Problem Types: Privilege Escalation (CAPEC-233) Description: A privilege escalation vulnerability is identified in Ivanti EPM (LANDesk Management Suite) that allows a user to execute commands with elevated privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-for-Ivanti-Endpoint-Manager-Client-CVE-2022-27773?language=en_US
CVE ID: CVE-2022-27774 State: PUBLISHED Published: 2022-06-01T00:00:00 Last Updated: 2024-08-03T05:32:59.946Z Vendors: n/a Products: https://github.com/curl/curl Problem Types: CWE-522 Description: An insufficiently protected credentials vulnerability exists in curl 4.9 to and include curl 7.82.0 are affected that could allow an attacker to extract credentials when follows HTTP(S) redirects is used with authentication could leak credentials to other services that exist on different protocols or port numbers. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/1543773 - https://security.netapp.com/advisory/ntap-20220609-0008/ - https://www.debian.org
ttps://hackerone.com/reports/1543773 - https://security.netapp.com/advisory/ntap-20220609-0008/ - https://www.debian.org/security/2022/dsa-5197 - https://security.gentoo.org/glsa/202212-01 - https://lists.debian.org/debian-lts-announce/2023/01/msg00028.html
CVE ID: CVE-2022-27775 State: PUBLISHED Published: 2022-06-01T00:00:00 Last Updated: 2024-08-03T05:32:59.833Z Vendors: n/a Products: https://github.com/curl/curl Problem Types: CWE-200 Description: An information disclosure vulnerability exists in curl 7.65.0 to 7.82.0 are vulnerable that by using an IPv6 address that was in the connection pool but with a different zone id it could reuse a connection instead. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/1546268 - https://security.netapp.com/advisory/ntap-20220609-0008/ - https://www.debian.org/security/2022/dsa-5197 - https://security.gentoo.org/glsa/202212-01
CVE ID: CVE-2022-27776 State: PUBLISHED Published: 2022-06-01T00:00:00 Last Updated: 2024-11-20T15:23:17.772Z Vendors: n/a Products: https://github.com/curl/curl Problem Types: CWE-522 Description: A insufficiently protected credentials vulnerability in fixed in curl 7.83.0 might leak authentication or cookie header data on HTTP redirects to the same host but another port number. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://hackerone.com/reports/1547048 - https://security.netapp.com/advisory/ntap-20220609-0008/ - https://www.debian.org/security/2022/dsa-5197 - https://lists.debian.org/debian-lts-announce/2022/08/msg00017.html - https://lis
www.debian.org/security/2022/dsa-5197 - https://lists.debian.org/debian-lts-announce/2022/08/msg00017.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7N5ZBWLNNPZKFK7Q4KEHGCJ2YELQEUJP/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DKKOQXPYLMBSEVDHFS32BPBR3ZQJKY5B/ - https://security.gentoo.org/glsa/202212-01
CVE ID: CVE-2022-27777 State: PUBLISHED Published: 2022-05-26T00:00:00 Last Updated: 2024-08-03T05:32:59.808Z Vendors: n/a Products: https://github.com/rails/rails Problem Types: CWE-79 Description: A XSS Vulnerability in Action View tag helpers >= 5.2.0 and < 5.2.0 which would allow an attacker to inject content if able to control input into specific attributes. Additional Analyst Notes: - CVE Program Container: References: - https://discuss.rubyonrails.org/t/cve-2022-27777-possible-xss-vulnerability-in-action-view-tag-helpers/80534 - https://lists.debian.org/debian-lts-announce/2022/09/msg00002.html - https://www.debian.org/security/2023/dsa-5372
CVE ID: CVE-2022-27778 State: PUBLISHED Published: 2022-06-01T19:03:32 Last Updated: 2024-08-03T05:32:59.845Z Vendors: n/a Products: https://github.com/curl/curl Problem Types: CWE-706 Description: A use of incorrectly resolved name vulnerability fixed in 7.83.1 might remove the wrong file when `--no-clobber` is used together with `--remove-on-error`. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/1553598 - https://www.oracle.com/security-alerts/cpujul2022.html - https://security.netapp.com/advisory/ntap-20220609-0009/ - https://security.netapp.com/advisory/ntap-20220729-0004/
CVE ID: CVE-2022-27779 State: PUBLISHED Published: 2022-06-01T00:00:00 Last Updated: 2024-08-03T05:33:00.476Z Vendors: n/a Products: https://github.com/curl/curl Problem Types: CWE-201 Description: libcurl wrongly allows cookies to be set for Top Level Domains (TLDs) if thehost name is provided with a trailing dot.curl can be told to receive and send cookies. curl's "cookie engine" can bebuilt with or without [Public Suffix List](https://publicsuffix.org/)awareness. If PSL support not provided, a more rudimentary check exists to atleast prevent cookies from being set on TLDs. This check was broken if thehost name in the URL uses a trailing dot.This can allow arbitrary sites to set cookies th
s. This check was broken if thehost name in the URL uses a trailing dot.This can allow arbitrary sites to set cookies that then would get sent to adifferent and unrelated site or domain. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/1553301 - https://security.netapp.com/advisory/ntap-20220609-0009/ - https://security.gentoo.org/glsa/202212-01
CVE ID: CVE-2022-27780 State: PUBLISHED Published: 2022-06-01T00:00:00 Last Updated: 2024-08-07T19:09:34.290Z Vendors: n/a Products: https://github.com/curl/curl Problem Types: CWE-177 Description: The curl URL parser wrongly accepts percent-encoded URL separators like '/'when decoding the host name part of a URL, making it a *different* URL usingthe wrong host name when it is later retrieved.For example, a URL like `http://example.com%2F127.0.0.1/`, would be allowed bythe parser and get transposed into `http://example.com/127.0.0.1/`. This flawcan be used to circumvent filters, checks and more. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https:/
ters, checks and more. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://hackerone.com/reports/1553841 - https://security.netapp.com/advisory/ntap-20220609-0009/ - https://security.gentoo.org/glsa/202212-01
CVE ID: CVE-2022-27781 State: PUBLISHED Published: 2022-06-01T00:00:00 Last Updated: 2024-08-03T05:33:00.192Z Vendors: n/a Products: https://github.com/curl/curl Problem Types: CWE-400 Description: libcurl provides the `CURLOPT_CERTINFO` option to allow applications torequest details to be returned about a server's certificate chain.Due to an erroneous function, a malicious server could make libcurl built withNSS get stuck in a never-ending busy-loop when trying to retrieve thatinformation. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/1555441 - https://security.netapp.com/advisory/ntap-20220609-0009/ - https://www.debian.org/security/2022/dsa
om/reports/1555441 - https://security.netapp.com/advisory/ntap-20220609-0009/ - https://www.debian.org/security/2022/dsa-5197 - https://lists.debian.org/debian-lts-announce/2022/08/msg00017.html - https://security.gentoo.org/glsa/202212-01
CVE ID: CVE-2022-27782 State: PUBLISHED Published: 2022-06-01T00:00:00 Last Updated: 2024-08-03T05:32:59.911Z Vendors: n/a Products: https://github.com/curl/curl Problem Types: CWE-840 Description: libcurl would reuse a previously created connection even when a TLS or SSHrelated option had been changed that should have prohibited reuse.libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse if one of them matches the setup. However, several TLS andSSH settings were left out from the configuration match checks, making themmatch too easily. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/1555796 - https://se
ily. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/1555796 - https://security.netapp.com/advisory/ntap-20220609-0009/ - https://www.debian.org/security/2022/dsa-5197 - https://lists.debian.org/debian-lts-announce/2022/08/msg00017.html - https://security.gentoo.org/glsa/202212-01 - http://www.openwall.com/lists/oss-security/2023/03/20/6