Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-35221 State: PUBLISHED Published: 2022-08-02T15:20:44.721953Z Last Updated: 2024-09-16T22:55:47.003Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: TEAMPLUS TECHNOLOGY INC. Products: Teamplus Pro Problem Types: CWE-770 Description: Teamplus Pro community discussion has an ‘allocation of resource without limits or throttling’ vulnerability on thread subject field. A remote attacker with general user privilege posting a thread subject with large content can cause the server to allocate too much memory, leading to missing partial post content and disrupt partial service. Additional Analyst Notes: - CVE Program Container: References: - https://
tial post content and disrupt partial service. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-6360-7bf50-1.html
CVE ID: CVE-2022-35222 State: PUBLISHED Published: 2022-08-02T15:21:00.177208Z Last Updated: 2024-09-16T20:37:53.650Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: HINET Products: HiCOS Citizen verification component - Stack Buffer Overflow Problem Types: CWE-787 Description: HiCOS Citizen verification component has a stack-based buffer overflow vulnerability due to insufficient parameter length validation. An unauthenticated physical attacker can exploit this vulnerability to execute arbitrary code, manipulate system command or disrupt service. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-6363-f5ec2-
ervice. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-6363-f5ec2-1.html
CVE ID: CVE-2022-35223 State: PUBLISHED Published: 2022-08-02T15:21:11.229464Z Last Updated: 2024-09-17T04:14:26.514Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: EasyUse Products: MailHunter Ultimate Problem Types: CWE-502 Description: EasyUse MailHunter Ultimate’s cookie deserialization function has an inadequate validation vulnerability. Deserializing a cookie containing malicious payload will trigger this insecure deserialization vulnerability, allowing an unauthenticated remote attacker to execute arbitrary code, manipulate system command or interrupt service. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.t
command or interrupt service. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-6365-b056c-1.html - https://www.chtsecurity.com/news/a381467e-74ff-4a8c-a4d3-fc86720f5400
CVE ID: CVE-2022-35224 State: PUBLISHED Published: 2022-07-12T20:30:20 Last Updated: 2024-08-03T09:29:17.428Z Vendors: SAP SE Products: SAP Enterprise Portal Problem Types: CWE-79 Description: SAP Enterprise Portal - versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. This attack can be used to non-permanently deface or modify portal content. The execution of script content by a victim registered on the portal could compromise the confidentiality and integrity of victim�s web browser session. Additional Analyst Notes: - CVE Program Container: References: - https://www.sap.com/documents/
m�s web browser session. Additional Analyst Notes: - CVE Program Container: References: - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html - https://launchpad.support.sap.com/#/notes/3210779
CVE ID: CVE-2022-35225 State: PUBLISHED Published: 2022-07-12T20:28:34 Last Updated: 2024-08-03T09:29:17.442Z Vendors: SAP SE Products: SAP NetWeaver Enterprise Portal Problem Types: CWE-79 Description: SAP NetWeaver Enterprise Portal - versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs over the network, resulting in reflected Cross-Site Scripting (XSS) vulnerability, therefore changing the scope of the attack. This leads to limited impact on confidentiality and integrity of data. Additional Analyst Notes: - CVE Program Container: References: - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html - https://launchp
ntainer: References: - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html - https://launchpad.support.sap.com/#/notes/3208880
CVE ID: CVE-2022-35226 State: PUBLISHED Published: 2022-10-11T00:00:00 Last Updated: 2024-08-03T09:29:17.458Z Vendors: SAP SE Products: SAP Data Services Management Console Problem Types: CWE-79 Description: SAP Data Services Management allows an attacker to copy the data from a request and echoed into the application's immediate response, it will lead to a Cross-Site Scripting vulnerability. The attacker would have to log in to the management console to perform such as an attack, only few of the pages are vulnerable in the DS management console. Additional Analyst Notes: - CVE Program Container: References: - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html -
CVE Program Container: References: - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html - https://launchpad.support.sap.com/#/notes/3167342
CVE ID: CVE-2022-35227 State: PUBLISHED Published: 2022-07-12T20:28:29 Last Updated: 2024-08-03T09:29:17.456Z Vendors: SAP SE Products: SAP NetWeaver Enterprise Portal (WPC) Problem Types: CWE-79 Description: A vulnerability in SAP NW EP (WPC) - versions 7.30, 7.31, 7.40, 7.50, which does not sufficiently validate user-controlled input, allows a remote attacker to conduct a Cross-Site (XSS) scripting attack. A successful exploit could allow the attacker to execute arbitrary script code which could lead to stealing or modifying of authentication information of the user, such as data relating to his or her current session. Additional Analyst Notes: - CVE Program Container: References: - https:
as data relating to his or her current session. Additional Analyst Notes: - CVE Program Container: References: - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html - https://launchpad.support.sap.com/#/notes/3211760
CVE ID: CVE-2022-35228 State: PUBLISHED Published: 2022-07-12T20:28:40 Last Updated: 2024-08-03T09:29:17.463Z Vendors: SAP SE Products: SAP BusinessObjects Business Intelligence Platform (Central management Console) Problem Types: CWE-352 Description: SAP BusinessObjects CMC allows an unauthenticated attacker to retrieve token information over the network which would otherwise be restricted. This can be achieved only when a legitimate user accesses the application and a local compromise occurs, like sniffing or social engineering. On successful exploitation, the attacker can completely compromise the application. Additional Analyst Notes: - CVE Program Container: References: - https://www.sa
n completely compromise the application. Additional Analyst Notes: - CVE Program Container: References: - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html - https://launchpad.support.sap.com/#/notes/3221288
CVE ID: CVE-2022-35229 State: PUBLISHED Published: 2022-07-06T11:05:12.493Z Last Updated: 2025-11-03T21:46:22.936Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: Zabbix Products: Frontend Problem Types: CWE-79 Description: An authenticated user can create a link with reflected Javascript code inside it for the discovery page and send it to other users. The payload can be executed only with a known CSRF token value of the victim, which is changed periodically and is difficult to predict. Additional Analyst Notes: - CVE Program Container: References: - https://support.zabbix.com/browse/ZBX-21306 - https://lists.debian.org/debian-lts-announce/2023/04/msg00013.htm
ences: - https://support.zabbix.com/browse/ZBX-21306 - https://lists.debian.org/debian-lts-announce/2023/04/msg00013.html - https://lists.debian.org/debian-lts-announce/2023/08/msg00027.html
CVE ID: CVE-2022-35230 State: PUBLISHED Published: 2022-07-06T11:05:14.025Z Last Updated: 2025-11-03T21:46:24.403Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: Zabbix Products: Frontend Problem Types: CWE-79 Description: An authenticated user can create a link with reflected Javascript code inside it for the graphs page and send it to other users. The payload can be executed only with a known CSRF token value of the victim, which is changed periodically and is difficult to predict. Additional Analyst Notes: - CVE Program Container: References: - https://support.zabbix.com/browse/ZBX-21305 - https://lists.debian.org/debian-lts-announce/2023/04/msg00013.html
CVE ID: CVE-2022-35234 State: PUBLISHED Published: 2022-07-29T23:15:27 Last Updated: 2024-08-03T09:29:17.571Z Vendors: Trend Micro Products: Trend Micro Security(Consumer) Problem Types: OOB Read Information Disclosure Description: Trend Micro Security 2021 and 2022 (Consumer) is vulnerable to an Out-Of-Bounds Read Information Disclosure Vulnerability that could allow an attacker to read sensitive information from other memory locations and cause a crash on an affected machine. Additional Analyst Notes: - CVE Program Container: References: - https://helpcenter.trendmicro.com/en-us/article/tmka-11058 - https://www.zerodayinitiative.com/advisories/ZDI-22-962/
CVE ID: CVE-2022-35235 State: PUBLISHED Published: 2022-08-23T15:46:59.073Z Last Updated: 2025-02-20T20:11:32.883Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: XplodedThemes Products: WPIDE – File Manager & Code Editor (WordPress plugin) Problem Types: Arbitrary File Read Description: Authenticated (admin+) Arbitrary File Read vulnerability in XplodedThemes WPide plugin <= 2.6 at WordPress. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wpide/wordpress-wpide-plugin-2-6-authenticated-arbitrary-file-read-vulnerability - https://wordpress.org/plugins/wpide/#developers
CVE ID: CVE-2022-35236 State: PUBLISHED Published: 2022-08-04T17:48:41.303318Z Last Updated: 2024-09-17T03:34:00.060Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: F5 Products: BIG-IP Problem Types: CWE-400 Description: In BIG-IP Versions 16.1.x before 16.1.2.2, 15.1.x before 15.1.6.1, and 14.1.x before 14.1.5, when an HTTP2 profile is configured on a virtual server, undisclosed traffic can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K79933541
CVE ID: CVE-2022-35237 State: REJECTED Published: N/A Last Updated: 2025-05-28T18:20:11.048Z Description: No description available.
CVE ID: CVE-2022-35238 State: PUBLISHED Published: 2022-09-23T14:28:43.132Z Last Updated: 2025-02-20T20:03:14.774Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: BriniA Products: Awesome Filterable Portfolio (WordPress plugin) Problem Types: CWE-264 Description: Unauthenticated Plugin Settings Change vulnerability in Awesome Filterable Portfolio plugin <= 1.9.7 at WordPress. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/awesome-filterable-portfolio/wordpress-awesome-filterable-portfolio-plugin-1-9-7-unauthenticated-plugin-settings-change-vulnerability/_s_id=cve - https
rdpress-awesome-filterable-portfolio-plugin-1-9-7-unauthenticated-plugin-settings-change-vulnerability/_s_id=cve - https://wordpress.org/plugins/awesome-filterable-portfolio/
CVE ID: CVE-2022-35239 State: PUBLISHED Published: 2022-08-16T07:01:46 Last Updated: 2024-08-03T09:29:17.446Z Vendors: CONTEC CO., LTD. Products: SolarView Compact Problem Types: Improper Input Validation Description: The image file management page of SolarView Compact SV-CPT-MC310 Ver.7.23 and earlier, and SV-CPT-MC310F Ver.7.23 and earlier contains an insufficient verification vulnerability when uploading files. If this vulnerability is exploited, arbitrary PHP code may be executed if a remote authenticated attacker uploads a specially crafted PHP file. Additional Analyst Notes: - CVE Program Container: References: - https://www.contec.com/jp/api/downloadlogger?download=/jp/-/media/Contec/
Notes: - CVE Program Container: References: - https://www.contec.com/jp/api/downloadlogger?download=/jp/-/media/Contec/jp/support/security-info/contec_security_solarview_220727.pdf - https://www.contec.com/jp/download/donwload-list/?itemid=b28c8b7c-9f40-40b2-843c-b5b04c035b0e#firmware - https://jvn.jp/en/vu/JVNVU93696585/
CVE ID: CVE-2022-35240 State: PUBLISHED Published: 2022-08-04T17:48:54.884516Z Last Updated: 2024-09-17T03:47:45.147Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: F5 Products: BIG-IP Problem Types: CWE-404 Description: In BIG-IP Versions 16.1.x before 16.1.2.2, 15.1.x before 15.1.6.1, and 14.1.x before 14.1.5, when the Message Routing (MR) Message Queuing Telemetry Transport (MQTT) profile is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Additional Analyst Notes: - CVE Program Container: References: - htt
End of Technical Support (EoTS) are not evaluated. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K28405643
CVE ID: CVE-2022-35241 State: PUBLISHED Published: 2022-08-04T17:49:06.414954Z Last Updated: 2024-09-16T16:24:08.770Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: F5 Products: NGINX Instance Manager Problem Types: CWE-400 Description: In versions 2.x before 2.3.1 and all versions of 1.x, when NGINX Instance Manager is in use, undisclosed requests can cause an increase in disk resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K37080719
CVE ID: CVE-2022-35242 State: PUBLISHED Published: 2022-08-23T15:45:54.736Z Last Updated: 2025-02-20T20:12:10.303Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: 59sec Products: THE Leads Management System: 59sec LITE (WordPress plugin) Problem Types: CWE-264 Description: Unauthenticated plugin settings change vulnerability in 59sec THE Leads Management System: 59sec LITE plugin <= 3.4.1 at WordPress. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/59sec-lite-contact-form-7-push-notifications-on-ios-and-android/wordpress-the-leads-management-system-59sec-lite-plugin-3-4-
c-lite-contact-form-7-push-notifications-on-ios-and-android/wordpress-the-leads-management-system-59sec-lite-plugin-3-4-1-unauthenticated-plugin-settings-change-vulnerability - https://wordpress.org/plugins/59sec-lite-contact-form-7-push-notifications-on-ios-and-android/
CVE ID: CVE-2022-35243 State: PUBLISHED Published: 2022-08-04T17:49:19.345871Z Last Updated: 2024-09-16T22:15:58.079Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N) Vendors: F5 Products: BIG-IP Problem Types: CWE-269 Description: In BIG-IP Versions 16.1.x before 16.1.3, 15.1.x before 15.1.5.1, 14.1.x before 14.1.5, and all versions of 13.1.x, when running in Appliance mode, an authenticated user assigned the Administrator role may be able to bypass Appliance mode restrictions, using an undisclosed iControl REST endpoint. A successful exploit can allow the attacker to cross a security boundary. Note: Software versions which have reached End of Technical Support (EoTS)
w the attacker to cross a security boundary. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K11010341
CVE ID: CVE-2022-35244 State: PUBLISHED Published: 2022-10-25T16:34:01.040Z Last Updated: 2025-04-15T18:45:04.949Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: abode systems, inc. Products: iota All-In-One Security Kit Problem Types: CWE-134 Description: A format string injection vulnerability exists in the XCMD getVarHA functionality of abode systems, inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-crafted XCMD can lead to memory corruption, information disclosure, and denial of service. An attacker can send a malicious XML payload to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Re
ML payload to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2022-1582
CVE ID: CVE-2022-35245 State: PUBLISHED Published: 2022-08-04T17:49:32.276539Z Last Updated: 2024-09-16T20:48:20.287Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: F5 Products: BIG-IP APM Problem Types: CWE-476 Description: In BIG-IP Versions 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, and 14.1.x before 14.1.5.1, when a BIG-IP APM access policy is configured on a virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K
are not evaluated. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K58235223
CVE ID: CVE-2022-35246 State: PUBLISHED Published: 2022-09-23T18:28:12.000Z Last Updated: 2025-05-22T19:35:24.804Z Vendors: n/a Products: Rocket.Chat Problem Types: CWE-200 Description: A NoSQL-Injection information disclosure vulnerability vulnerability exists in Rocket.Chat <v5, <v4.8.2 and <v4.7.5 in the getS3FileUrl Meteor server method that can disclose arbitrary file upload URLs to users that should not be able to access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://hackerone.com/reports/1458020
CVE ID: CVE-2022-35247 State: PUBLISHED Published: 2022-09-23T18:28:13.000Z Last Updated: 2025-05-22T17:52:00.214Z Vendors: n/a Products: Rocket.Chat Problem Types: CWE-200 Description: A information disclosure vulnerability exists in Rocket.chat <v5, <v4.8.2 and <v4.7.5 where the lack of ACL checks in the getRoomRoles Meteor method leak channel members with special roles to unauthorized clients. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://hackerone.com/reports/1447440
CVE ID: CVE-2022-35248 State: PUBLISHED Published: 2022-09-23T18:28:12 Last Updated: 2024-08-03T09:29:17.473Z Vendors: n/a Products: Rocket.Chat Problem Types: CWE-287 Description: A improper authentication vulnerability exists in Rocket.Chat <v5, <v4.8.2 and <v4.7.5 that allowed two factor authentication can be bypassed when telling the server to use CAS during login. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/1448268
CVE ID: CVE-2022-35249 State: PUBLISHED Published: 2022-09-23T18:28:12.000Z Last Updated: 2025-05-22T18:50:23.134Z Vendors: n/a Products: Rocket.Chat Problem Types: CWE-200 Description: A information disclosure vulnerability exists in Rocket.Chat <v5 where the getUserMentionsByChannel meteor server method discloses messages from private channels and direct messages regardless of the users access permission to the room. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://hackerone.com/reports/1410246
CVE ID: CVE-2022-35250 State: PUBLISHED Published: 2022-09-23T18:28:12.000Z Last Updated: 2025-05-22T18:51:50.487Z Vendors: n/a Products: Rocket.chat Problem Types: Privilege Escalation (CAPEC-233) Description: A privilege escalation vulnerability exists in Rocket.chat <v5 which made it possible to elevate privileges for any authenticated user to view Direct messages without appropriate permissions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://hackerone.com/reports/917946
CVE ID: CVE-2022-35251 State: PUBLISHED Published: 2022-09-23T18:28:12.000Z Last Updated: 2025-05-22T18:52:28.502Z Vendors: n/a Products: Rocket.chat Problem Types: CWE-79 Description: A cross-site scripting vulnerability exists in Rocket.chat <v5 due to style injection in the complete chat window, an adversary is able to manipulate not only the style of it, but will also be able to block functionality as well as hijacking the content of targeted users. Hence the payloads are stored in messages, it is a persistent attack vector, which will trigger as soon as the message gets viewed. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://hackerone.co
s viewed. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://hackerone.com/reports/1401268
CVE ID: CVE-2022-35252 State: PUBLISHED Published: 2022-09-23T00:00:00.000Z Last Updated: 2025-05-05T16:14:44.468Z Vendors: n/a Products: https://github.com/curl/curl Problem Types: CWE-20 Description: When curl is used to retrieve and parse cookies from a HTTP(S) server, itaccepts cookies using control codes that when later are sent back to a HTTPserver might make the server return 400 responses. Effectively allowing a"sister site" to deny service to all siblings. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://hackerone.com/reports/1613943 - https://security.netapp.com/advisory/ntap-20220930-0005/ - https://security.gentoo.org/glsa/202212-0
m/reports/1613943 - https://security.netapp.com/advisory/ntap-20220930-0005/ - https://security.gentoo.org/glsa/202212-01 - https://support.apple.com/kb/HT213603 - https://support.apple.com/kb/HT213604 - http://seclists.org/fulldisclosure/2023/Jan/20 - http://seclists.org/fulldisclosure/2023/Jan/21 - https://lists.debian.org/debian-lts-announce/2023/01/msg00028.html
CVE ID: CVE-2022-35253 State: REJECTED Published: 2022-09-23T13:37:48.175Z Last Updated: 2025-02-13T15:46:29.146Z Description: No description available.
CVE ID: CVE-2022-35254 State: PUBLISHED Published: 2022-12-05T00:00:00.000Z Last Updated: 2025-04-24T14:43:33.701Z Vendors: n/a Products: Ivanti Connect Secure (ICS), Ivanti Policy Secure (IPS), and Ivanti Neurons for Zero Trust Access Gateway Problem Types: CWE-416 Description: An unauthenticated attacker can cause a denial-of-service to the following products: Ivanti Connect Secure (ICS) in versions prior to 9.1R14.3, 9.1R15.2, 9.1R16.2, and 22.2R4, Ivanti Policy Secure (IPS) in versions prior to 9.1R17 and 22.3R1, and Ivanti Neurons for Zero-Trust Access in versions prior to 22.3R1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://kb.pulses
r to 22.3R1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA45520/?kA23Z000000GH5OSAW
CVE ID: CVE-2022-35255 State: PUBLISHED Published: 2022-12-05T00:00:00.000Z Last Updated: 2025-04-30T05:48:45.486Z Vendors: NodeJS Products: Node Problem Types: CWE-338 Description: A weak randomness in WebCrypto keygen vulnerability exists in Node.js 18 due to a change with EntropySource() in SecretKeyGenTraits::DoKeyGen() in src/crypto/crypto_keygen.cc. There are two problems with this: 1) It does not check the return value, it assumes EntropySource() always succeeds, but it can (and sometimes will) fail. 2) The random data returned byEntropySource() may not be cryptographically strong and therefore not suitable as keying material. Additional Analyst Notes: - CVE Program Container: - CISA