Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-36963 State: PUBLISHED Published: 2023-04-21T00:00:00.000Z Last Updated: 2025-02-05T16:04:58.805Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: SolarWinds Platform Command Injection Vulnerability Products: SolarWinds Platform Problem Types: CWE-94 Description: The SolarWinds Platform was susceptible to the Command Injection Vulnerability. This vulnerability allows a remote adversary with a valid SolarWinds Platform admin account to execute arbitrary commands. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.solarwinds.com/trust-center/security-advisories/cve-2022-36963 - https://documentat
nrichment: References: - https://www.solarwinds.com/trust-center/security-advisories/cve-2022-36963 - https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2023-2_release_notes.htm
CVE ID: CVE-2022-36964 State: PUBLISHED Published: 2022-11-29T20:47:49.978Z Last Updated: 2025-04-25T14:41:14.527Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: SolarWinds Products: SolarWinds Platform, Orion Platform Problem Types: CWE-502 Description: SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with valid access to SolarWinds Web Console to execute arbitrary commands. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2022-4_releas
s://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2022-4_release_notes.htm - https://www.solarwinds.com/trust-center/security-advisories/CVE-2022-36964
CVE ID: CVE-2022-36965 State: PUBLISHED Published: 2022-09-30T16:45:24.996Z Last Updated: 2025-05-20T16:14:58.743Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: SolarWinds Products: Orion Platform Problem Types: Stored and DOM XSS in QoE Applications: Orion Platform Description: Insufficient sanitization of inputs in QoE application input field could lead to stored and Dom based XSS attack. This issue is fixed and released in SolarWinds Platform (2022.3.0). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.solarwinds.com/trust-center/security-advisories/CVE-2022-36965 - https://documentation.solarwinds.co
nces: - https://www.solarwinds.com/trust-center/security-advisories/CVE-2022-36965 - https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2022-3_release_notes.htm#:~:text=Release%20date%3A%20May%2024%2C%202022%20These%20release%20notes%2Cissues.%20New%20features%20and%20improvements%20in%20SolarWinds%20Platform
CVE ID: CVE-2022-36966 State: PUBLISHED Published: 2022-10-20T20:05:35.645Z Last Updated: 2025-05-07T20:49:50.846Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: SolarWinds Products: SolarWinds Platform Problem Types: Insecure Direct Object Reference Vulnerability: Orion Platform 2020.2.6 Description: Users with Node Management rights were able to view and edit all nodes due to Insufficient control on URL parameter causing insecure direct object reference (IDOR) vulnerability in SolarWinds Platform 2022.3 and previous. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://documentation.solarwinds.com/en/success_ce
otes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2022-4_release_notes.htm - https://www.solarwinds.com/trust-center/security-advisories/CVE-2022-36966
CVE ID: CVE-2022-36967 State: PUBLISHED Published: 2022-08-02T21:58:48 Last Updated: 2024-08-03T10:21:32.503Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Progress WS_FTP Server prior to version 8.7.3, multiple reflected cross-site scripting (XSS) vulnerabilities exist in the administrative web interface. It is possible for a remote attacker to inject arbitrary JavaScript into a WS_FTP administrator's web session. This would allow the attacker to execute code within the context of the victim's browser. Additional Analyst Notes: - CVE Program Container: References: - https://www.progress.com/ws_ftp - https://community.progress.com/s/article/WS-FTP-Server-Critical-Security-Pro
rences: - https://www.progress.com/ws_ftp - https://community.progress.com/s/article/WS-FTP-Server-Critical-Security-Product-Alert-Bulletin-June-2022
CVE ID: CVE-2022-36968 State: PUBLISHED Published: 2022-08-02T21:58:52 Last Updated: 2024-08-03T10:21:32.341Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Progress WS_FTP Server prior to version 8.7.3, forms within the administrative interface did not include a nonce to mitigate the risk of cross-site request forgery (CSRF) attacks. Additional Analyst Notes: - CVE Program Container: References: - https://www.progress.com/ws_ftp - https://community.progress.com/s/article/WS-FTP-Server-Critical-Security-Product-Alert-Bulletin-June-2022
CVE ID: CVE-2022-36969 State: PUBLISHED Published: 2023-03-29T00:00:00.000Z Last Updated: 2025-02-18T16:43:19.184Z Severity: MEDIUM (CVSS 5.5 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: AVEVA Products: Edge Problem Types: CWE-611 Description: This vulnerability allows remote attackers to disclose sensitive information on affected installations of AVEVA Edge 2020 SP2 Patch 0(4201.2111.1802.0000). User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the LoadImportedLibraries method. Due to the improper restriction of XML External Entity (XXE) references, a crafted document
adImportedLibraries method. Due to the improper restriction of XML External Entity (XXE) references, a crafted document specifying a URI causes the XML parser to access the URI and embed the contents back into the XML document for further processing. An attacker can leverage this vulnerability to disclose information in the context of the current process. Was ZDI-CAN-17394. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.aveva.com/content/dam/aveva/documents/support/cyber-security-updates/SecurityBulletin_AVEVA-2022-005.pdf - https://www.zerodayinitiative.com/advisories/ZDI-22-1128/
CVE ID: CVE-2022-36970 State: PUBLISHED Published: 2023-03-29T00:00:00.000Z Last Updated: 2025-02-18T20:01:03.094Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: AVEVA Products: Edge Problem Types: CWE-356 Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of AVEVA Edge 20.0 Build: 4201.2111.1802.0000 Service Pack 2. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of APP files. Crafted data in a APP file can cause the application to execute arbitrary Visual Basic scripts. Th
cessing of APP files. Crafted data in a APP file can cause the application to execute arbitrary Visual Basic scripts. The user interface fails to provide sufficient indication of the hazard. An attacker can leverage this vulnerability to execute code in the context of current process. Was ZDI-CAN-17370. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.aveva.com/content/dam/aveva/documents/support/cyber-security-updates/SecurityBulletin_AVEVA-2022-005.pdf - https://www.zerodayinitiative.com/advisories/ZDI-22-1129/
CVE ID: CVE-2022-36971 State: PUBLISHED Published: 2023-03-29T00:00:00.000Z Last Updated: 2025-02-18T19:41:04.286Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Ivanti Products: Avalanche Problem Types: CWE-502 Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Avalanche 6.3.2.3490. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the JwtTokenUtility class. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data.
results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-15301. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-22-776/ - https://download.wavelink.com/Files/avalanche_v6.3.4_release_notes.txt
CVE ID: CVE-2022-36972 State: PUBLISHED Published: 2023-03-29T00:00:00.000Z Last Updated: 2025-02-18T19:45:41.570Z Severity: CRITICAL (CVSS 9.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: Ivanti Products: Avalanche Problem Types: CWE-89 Description: This vulnerability allows remote attackers to bypass authentication on affected installations of Ivanti Avalanche 6.3.2.3490. The specific flaw exists within the ProfileDaoImpl class. A crafted request can trigger execution of SQL queries composed from a user-supplied string. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-15328. Additional Analyst Notes: - CVE Program Container: - CISA A
y to bypass authentication on the system. Was ZDI-CAN-15328. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://download.wavelink.com/Files/avalanche_v6.3.4_release_notes.txt - https://www.zerodayinitiative.com/advisories/ZDI-22-777/
CVE ID: CVE-2022-36973 State: PUBLISHED Published: 2023-03-29T00:00:00.000Z Last Updated: 2025-02-18T19:46:16.070Z Severity: CRITICAL (CVSS 9.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: Ivanti Products: Avalanche Problem Types: CWE-89 Description: This vulnerability allows remote attackers to bypass authentication on affected installations of Ivanti Avalanche 6.3.2.3490. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the ProfileDaoImpl class. A crafted request can trigger execution of SQL queries composed from a user-supplied string. An attacker can leverage this vulnerabil
uest can trigger execution of SQL queries composed from a user-supplied string. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-15329. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://download.wavelink.com/Files/avalanche_v6.3.4_release_notes.txt - https://www.zerodayinitiative.com/advisories/ZDI-22-778/
CVE ID: CVE-2022-36974 State: PUBLISHED Published: 2023-03-29T00:00:00.000Z Last Updated: 2025-02-18T19:46:49.297Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Ivanti Products: Avalanche Problem Types: CWE-502 Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Avalanche 6.3.2.3490. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the Web File Server service. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted dat
e results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-15330. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://download.wavelink.com/Files/avalanche_v6.3.4_release_notes.txt - https://www.zerodayinitiative.com/advisories/ZDI-22-779/
CVE ID: CVE-2022-36975 State: PUBLISHED Published: 2023-03-29T00:00:00.000Z Last Updated: 2025-02-18T19:47:21.078Z Severity: CRITICAL (CVSS 9.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: Ivanti Products: Avalanche Problem Types: CWE-89 Description: This vulnerability allows remote attackers to bypass authentication on affected installations of Ivanti Avalanche 6.3.2.3490. The specific flaw exists within the ProfileDaoImpl class. A crafted request can trigger execution of SQL queries composed from a user-supplied string. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-15332. Additional Analyst Notes: - CVE Program Container: - CISA A
y to bypass authentication on the system. Was ZDI-CAN-15332. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://download.wavelink.com/Files/avalanche_v6.3.4_release_notes.txt - https://www.zerodayinitiative.com/advisories/ZDI-22-780/
CVE ID: CVE-2022-36976 State: PUBLISHED Published: 2023-03-29T00:00:00.000Z Last Updated: 2025-02-18T19:48:16.675Z Severity: CRITICAL (CVSS 9.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: Ivanti Products: Avalanche Problem Types: CWE-89 Description: This vulnerability allows remote attackers to bypass authentication on affected installations of Ivanti Avalanche 6.3.2.3490. The specific flaw exists within the GroupDaoImpl class. A crafted request can trigger execution of SQL queries composed from a user-supplied string. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-15333. Additional Analyst Notes: - CVE Program Container: - CISA ADP
to bypass authentication on the system. Was ZDI-CAN-15333. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://download.wavelink.com/Files/avalanche_v6.3.4_release_notes.txt - https://www.zerodayinitiative.com/advisories/ZDI-22-781/
CVE ID: CVE-2022-36977 State: PUBLISHED Published: 2023-03-29T00:00:00.000Z Last Updated: 2025-02-18T19:49:09.270Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Ivanti Products: Avalanche Problem Types: CWE-502 Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Avalanche 6.3.2.3490. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the Certificate Management Server service. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of
vice. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-15449. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://download.wavelink.com/Files/avalanche_v6.3.4_release_notes.txt - https://www.zerodayinitiative.com/advisories/ZDI-22-782/
CVE ID: CVE-2022-36978 State: PUBLISHED Published: 2023-03-29T00:00:00.000Z Last Updated: 2025-02-18T19:49:38.376Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Ivanti Products: Avalanche Problem Types: CWE-502 Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Avalanche 6.3.2.3490. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the Notification Server service. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted
issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-15448. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://download.wavelink.com/Files/avalanche_v6.3.4_release_notes.txt - https://www.zerodayinitiative.com/advisories/ZDI-22-783/
CVE ID: CVE-2022-36979 State: PUBLISHED Published: 2023-03-29T00:00:00.000Z Last Updated: 2025-02-18T19:50:07.700Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Ivanti Products: Avalanche Problem Types: CWE-89 Description: This vulnerability allows remote attackers to bypass authentication on affected installations of Ivanti Avalanche 6.3.2.3490. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the AvalancheDaoSupport class. A crafted request can trigger execution of SQL queries composed from a user-supplied string. An attacker can leverage this vulnerabi
quest can trigger execution of SQL queries composed from a user-supplied string. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-15493. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://download.wavelink.com/Files/avalanche_v6.3.4_release_notes.txt - https://www.zerodayinitiative.com/advisories/ZDI-22-784/
CVE ID: CVE-2022-36980 State: PUBLISHED Published: 2023-03-29T00:00:00.000Z Last Updated: 2025-02-18T19:50:52.328Z Severity: CRITICAL (CVSS 9.4 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H) Vendors: Ivanti Products: Avalanche Problem Types: CWE-367 Description: This vulnerability allows remote attackers to bypass authentication on affected installations of Ivanti Avalanche 6.3.2.3490. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the EnterpriseServer service. The issue results from the lack of proper locking when performing operations during authentication. An attacker can leverage thi
e results from the lack of proper locking when performing operations during authentication. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-15528. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://download.wavelink.com/Files/avalanche_v6.3.4_release_notes.txt - https://www.zerodayinitiative.com/advisories/ZDI-22-785/
CVE ID: CVE-2022-36981 State: PUBLISHED Published: 2023-03-29T00:00:00.000Z Last Updated: 2025-02-18T19:51:38.772Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Ivanti Products: Avalanche Problem Types: CWE-22 Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Avalanche 6.3.3.101. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the DeviceLogResource class. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can lev
lts from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-15966. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://download.wavelink.com/Files/avalanche_v6.3.4_release_notes.txt - https://www.zerodayinitiative.com/advisories/ZDI-22-786/
CVE ID: CVE-2022-36982 State: PUBLISHED Published: 2023-03-29T00:00:00.000Z Last Updated: 2025-02-18T19:52:06.136Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Ivanti Products: Avalanche Problem Types: CWE-22 Description: This vulnerability allows remote attackers to read arbitrary files on affected installations of Ivanti Avalanche 6.3.3.101. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the AgentTaskHandler class. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leve
ts from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose stored session cookies, leading to further compromise. Was ZDI-CAN-15967. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://download.wavelink.com/Files/avalanche_v6.3.4_release_notes.txt - https://www.zerodayinitiative.com/advisories/ZDI-22-787/
CVE ID: CVE-2022-36983 State: PUBLISHED Published: 2023-03-29T00:00:00.000Z Last Updated: 2025-02-18T19:52:33.811Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: Ivanti Products: Avalanche Problem Types: CWE-306 Description: This vulnerability allows remote attackers to bypass authentication on affected installations of Ivanti Avalanche. Authentication is not required to exploit this vulnerability. The specific flaw exists within the SetSettings class. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-15919. Additional Ana
y. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-15919. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://download.wavelink.com/Files/avalanche_v6.3.4_release_notes.txt - https://www.zerodayinitiative.com/advisories/ZDI-22-788/
CVE ID: CVE-2022-36984 State: PUBLISHED Published: 2022-07-28T00:57:02 Last Updated: 2024-08-03T10:21:32.609Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AC:L/AV:N/A:H/C:N/I:N/PR:L/S:C/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Veritas NetBackup 8.1.x through 8.1.2, 8.2, 8.3.x through 8.3.0.2, 9.x through 9.0.0.1, and 9.1.x through 9.1.0.1 (and related NetBackup products). An attacker with authenticated access to a NetBackup Client could remotely trigger a denial of service attack against a NetBackup Primary server. Additional Analyst Notes: - CVE Program Container: References: - https://www.veritas.com/content/support/en_US/security/VTS22-004#h8
CVE ID: CVE-2022-36985 State: PUBLISHED Published: 2022-07-28T00:56:33 Last Updated: 2024-08-03T10:21:32.311Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AC:L/AV:L/A:H/C:H/I:H/PR:L/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Veritas NetBackup 8.1.x through 8.1.2, 8.2, 8.3.x through 8.3.0.2, 9.x through 9.0.0.1, and 9.1.x through 9.1.0.1 (and related NetBackup products). An attacker with unprivileged local access to a Windows NetBackup Primary server could potentially escalate their privileges. Additional Analyst Notes: - CVE Program Container: References: - https://www.veritas.com/content/support/en_US/security/VTS22-004#h7
CVE ID: CVE-2022-36986 State: PUBLISHED Published: 2022-07-28T00:56:03 Last Updated: 2024-08-03T10:21:32.400Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AC:L/AV:N/A:H/C:N/I:N/PR:N/S:C/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Veritas NetBackup 8.1.x through 8.1.2, 8.2, 8.3.x through 8.3.0.2, 9.x through 9.0.0.1, and 9.1.x through 9.1.0.1 (and related NetBackup products). An attacker with unauthenticated access could remotely execute arbitrary commands on a NetBackup Primary server. Additional Analyst Notes: - CVE Program Container: References: - https://www.veritas.com/content/support/en_US/security/VTS22-004#h3