Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-23708 State: PUBLISHED Published: 2022-03-03T21:48:14 Last Updated: 2024-08-03T03:51:45.980Z Vendors: Elastic Products: elasticsearch Problem Types: CWE-264 Description: A flaw was discovered in Elasticsearch 7.17.0’s upgrade assistant, in which upgrading from version 6.x to 7.x would disable the in-built protections on the security index, allowing authenticated users with “*” index permissions access to this index. Additional Analyst Notes: - CVE Program Container: References: - https://discuss.elastic.co/t/elastic-stack-7-17-1-security-update/298447 - https://security.netapp.com/advisory/ntap-20220729-0003/
CVE ID: CVE-2022-23709 State: PUBLISHED Published: 2022-03-03T21:50:17 Last Updated: 2024-08-03T03:51:46.009Z Vendors: Elastic Products: kibana Problem Types: CWE-264 Description: A flaw was discovered in Kibana in which users with Read access to the Uptime feature could modify alerting rules. A user with this privilege would be able to create new alerting rules or overwrite existing ones. However, any new or modified rules would not be enabled, and a user with this privilege could not modify alerting connectors. This effectively means that Read users could disable existing alerting rules. Additional Analyst Notes: - CVE Program Container: References: - https://discuss.elastic.co/t/elastic-s
alerting rules. Additional Analyst Notes: - CVE Program Container: References: - https://discuss.elastic.co/t/elastic-stack-7-17-1-security-update/298447
CVE ID: CVE-2022-23710 State: PUBLISHED Published: 2022-03-03T21:51:43 Last Updated: 2024-08-03T03:51:45.928Z Vendors: Elastic Products: kibana Problem Types: CWE-79 Description: A cross-site-scripting (XSS) vulnerability was discovered in the Data Preview Pane (previously known as Index Pattern Preview Pane) which could allow arbitrary JavaScript to be executed in a victim’s browser. Additional Analyst Notes: - CVE Program Container: References: - https://discuss.elastic.co/t/elastic-stack-7-17-1-security-update/298447 - https://security.netapp.com/advisory/ntap-20220325-0009/
CVE ID: CVE-2022-23711 State: PUBLISHED Published: 2022-04-21T18:22:58 Last Updated: 2024-08-03T03:51:45.563Z Vendors: Elastic Products: kibana Problem Types: CWE-200 Description: A vulnerability in Kibana could expose sensitive information related to Elastic Stack monitoring in the Kibana page source. Elastic Stack monitoring features provide a way to keep a pulse on the health and performance of your Elasticsearch cluster. Authentication with a vulnerable Kibana instance is not required to view the exposed information. The Elastic Stack monitoring exposure only impacts users that have set any of the optional monitoring.ui.elasticsearch.* settings in order to configure Kibana as a remote UI
ers that have set any of the optional monitoring.ui.elasticsearch.* settings in order to configure Kibana as a remote UI for Elastic Stack Monitoring. The same vulnerability in Kibana could expose other non-sensitive application-internal information in the page source. Additional Analyst Notes: - CVE Program Container: References: - https://discuss.elastic.co/t/kibana-7-17-3-and-8-1-3-security-update/302826
CVE ID: CVE-2022-23712 State: PUBLISHED Published: 2022-06-06T17:07:29 Last Updated: 2024-08-03T03:51:45.879Z Vendors: Elastic Products: elasticsearch Problem Types: CWE-754 Description: A Denial of Service flaw was discovered in Elasticsearch. Using this vulnerability, an unauthenticated attacker could forcibly shut down an Elasticsearch node with a specifically formatted network request. Additional Analyst Notes: - CVE Program Container: References: - https://www.elastic.co/community/security/ - https://discuss.elastic.co/t/elastic-stack-7-17-4-and-8-2-1-security-update/305530 - https://security.netapp.com/advisory/ntap-20220707-0010/
CVE ID: CVE-2022-23713 State: PUBLISHED Published: 2022-07-06T13:56:13 Last Updated: 2024-08-03T03:51:46.084Z Vendors: Elastic Products: kibana Problem Types: CWE-79 Description: A cross-site-scripting (XSS) vulnerability was discovered in the Vega Charts Kibana integration which could allow arbitrary JavaScript to be executed in a victim’s browser. Additional Analyst Notes: - CVE Program Container: References: - https://discuss.elastic.co/t/elastic-8-3-1-8-3-0-and-7-17-5-security-update/308613 - https://www.elastic.co/community/security
CVE ID: CVE-2022-23714 State: PUBLISHED Published: 2022-07-06T13:57:27 Last Updated: 2024-08-03T03:51:45.981Z Vendors: Elastic Products: Endpoint Security Problem Types: CWE-264 Description: A local privilege escalation (LPE) issue was discovered in the ransomware canaries features of Elastic Endpoint Security for Windows, which could allow unprivileged users to elevate their privileges to those of the LocalSystem account. Additional Analyst Notes: - CVE Program Container: References: - https://discuss.elastic.co/t/elastic-8-3-1-8-3-0-and-7-17-5-security-update/308613 - https://www.elastic.co/community/security
CVE ID: CVE-2022-23715 State: PUBLISHED Published: 2022-08-25T17:25:42 Last Updated: 2024-08-03T03:51:45.962Z Vendors: Elastic Products: Elastic Cloud Enterprise Problem Types: CWE-532 Description: A flaw was discovered in ECE before 3.4.0 that might lead to the disclosure of sensitive information such as user passwords and Elasticsearch keystore settings values in logs such as the audit log or deployment logs in the Logging and Monitoring cluster. The affected APIs are PATCH /api/v1/user and PATCH /deployments/{deployment_id}/elasticsearch/{ref_id}/keystore Additional Analyst Notes: - CVE Program Container: References: - https://www.elastic.co/community/security - https://discuss.elastic.co
yst Notes: - CVE Program Container: References: - https://www.elastic.co/community/security - https://discuss.elastic.co/t/elastic-cloud-enterprise-3-4-0-security-update/312825
CVE ID: CVE-2022-23716 State: PUBLISHED Published: 2022-09-28T19:34:00.000Z Last Updated: 2025-05-21T14:23:08.842Z Vendors: Elastic Products: Elastic Cloud Enterprise Problem Types: CWE-532 Description: A flaw was discovered in ECE before 3.1.1 that could lead to the disclosure of the SAML signing private key used for the RBAC features, in deployment logs in the Logging and Monitoring cluster. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.elastic.co/community/security/ - https://discuss.elastic.co/t/elastic-cloud-enterprise-3-1-1-security-update/315317
CVE ID: CVE-2022-23717 State: PUBLISHED Published: 2022-06-30T19:25:27 Last Updated: 2024-08-03T03:51:45.972Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:N/I:N/A:H) Vendors: Ping Identity Products: PingID Windows Login Problem Types: CWE-404 Description: PingID Windows Login prior to 2.8 is vulnerable to a denial of service condition on local machines when combined with using offline security keys as part of authentication. Additional Analyst Notes: - CVE Program Container: References: - https://www.pingidentity.com/en/resources/downloads/pingid.html - https://docs.pingidentity.com/bundle/pingid/page/zhy1653552428545.html
CVE ID: CVE-2022-23718 State: PUBLISHED Published: 2022-06-30T19:25:30 Last Updated: 2024-08-03T03:51:46.036Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H) Vendors: Ping Identity Products: PingID Windows Login Problem Types: CWE-1352 Description: PingID Windows Login prior to 2.8 uses known vulnerable components that can lead to remote code execution. An attacker capable of achieving a sophisticated man-in-the-middle position, or to compromise Ping Identity web servers, could deliver malicious code that would be executed as SYSTEM by the PingID Windows Login application. Additional Analyst Notes: - CVE Program Container: References: - https://www.pingidentity.com/en/
ows Login application. Additional Analyst Notes: - CVE Program Container: References: - https://www.pingidentity.com/en/resources/downloads/pingid.html - https://docs.pingidentity.com/bundle/pingid/page/zhy1653552428545.html
CVE ID: CVE-2022-23719 State: PUBLISHED Published: 2022-06-30T19:25:35 Last Updated: 2024-08-03T03:51:46.025Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H) Vendors: Ping Identity Products: PingID Windows Login Problem Types: CWE-310, CWE-288 Description: PingID Windows Login prior to 2.8 does not authenticate communication with a local Java service used to capture security key requests. An attacker with the ability to execute code on the target machine maybe able to exploit and spoof the local Java service using multiple attack vectors. A successful attack can lead to code executed as SYSTEM by the PingID Windows Login application, or even a denial of service for off
attack can lead to code executed as SYSTEM by the PingID Windows Login application, or even a denial of service for offline security key authentication. Additional Analyst Notes: - CVE Program Container: References: - https://www.pingidentity.com/en/resources/downloads/pingid.html - https://docs.pingidentity.com/bundle/pingid/page/zhy1653552428545.html
CVE ID: CVE-2022-23720 State: PUBLISHED Published: 2022-06-30T19:25:41 Last Updated: 2024-08-03T03:51:45.962Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Ping Identity Products: PingID Windows Login Problem Types: CWE-648, CWE-288 Description: PingID Windows Login prior to 2.8 does not alert or halt operation if it has been provisioned with the full permissions PingID properties file. An IT administrator could mistakenly deploy administrator privileged PingID API credentials, such as those typically used by PingFederate, into PingID Windows Login user endpoints. Using sensitive full permissions properties file outside of a privileged trust boundary leads t
ws Login user endpoints. Using sensitive full permissions properties file outside of a privileged trust boundary leads to an increased risk of exposure or discovery, and an attacker could leverage these credentials to perform administrative actions against PingID APIs or endpoints. Additional Analyst Notes: - CVE Program Container: References: - https://www.pingidentity.com/en/resources/downloads/pingid.html - https://docs.pingidentity.com/bundle/pingid/page/zhy1653552428545.html
CVE ID: CVE-2022-23721 State: PUBLISHED Published: 2023-04-25T00:00:00.000Z Last Updated: 2025-02-04T14:49:49.619Z Severity: LOW (CVSS 3.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L) Vendors: Ping Identity Products: unspecified Problem Types: CWE-694 Description: PingID integration for Windows login prior to 2.9 does not handle duplicate usernames, which can lead to a username collision when two people with the same username are provisioned onto the same machine at different times. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://docs.pingidentity.com/r/en-us/pingid/davinci_pingid_windows_login_relnotes_2.9
CVE ID: CVE-2022-23722 State: PUBLISHED Published: 2022-05-02T22:05:13 Last Updated: 2024-08-03T03:51:46.174Z Vendors: Ping Identity Products: PingFederate Problem Types: CWE-288 Description: When a password reset mechanism is configured to use the Authentication API with an Authentication Policy, email One-Time Password, PingID or SMS authentication, an existing user can reset another existing user’s password. Additional Analyst Notes: - CVE Program Container: References: - https://www.pingidentity.com/en/resources/downloads/pingfederate.html - https://docs.pingidentity.com/bundle/pingfederate-110/page/spk1642790928508.html
CVE ID: CVE-2022-23723 State: PUBLISHED Published: 2022-05-02T22:05:15 Last Updated: 2024-08-03T03:51:45.964Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N) Vendors: Ping Identity Products: PingFederate PingOne MFA Integration Kit Problem Types: CWE-288 Description: An MFA bypass vulnerability exists in the PingFederate PingOne MFA Integration Kit when adapter HTML templates are used as part of an authentication flow. Additional Analyst Notes: - CVE Program Container: References: - https://www.pingidentity.com/en/resources/downloads/pingfederate.html - https://docs.pingidentity.com/bundle/pingfederate-pingone-mfa-ik/page/wpt1599064234202.html
CVE ID: CVE-2022-23724 State: PUBLISHED Published: 2022-05-04T16:30:11 Last Updated: 2024-08-03T03:51:46.013Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N) Vendors: Ping Identity Products: PingID Integration for Windows Login Problem Types: CWE-310, CWE-288 Description: Use of static encryption key material allows forging an authentication token to other users within a tenant organization. MFA may be bypassed by redirecting an authentication flow to a target user. To exploit the vulnerability, must have compromised user credentials. Additional Analyst Notes: - CVE Program Container: References: - https://www.pingidentity.com/en/resources/downloads/pingid.html - htt
lyst Notes: - CVE Program Container: References: - https://www.pingidentity.com/en/resources/downloads/pingid.html - https://docs.pingidentity.com/bundle/pingid/page/xqz1597139945488.html
CVE ID: CVE-2022-23725 State: PUBLISHED Published: 2022-06-30T19:25:46 Last Updated: 2024-08-03T03:51:46.172Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L) Vendors: Ping Identity Products: PingID Windows Login Problem Types: CWE-522, CWE-288 Description: PingID Windows Login prior to 2.8 does not properly set permissions on the Windows Registry entries used to store sensitive API keys under some circumstances. Additional Analyst Notes: - CVE Program Container: References: - https://www.pingidentity.com/en/resources/downloads/pingid.html - https://docs.pingidentity.com/bundle/pingid/page/zhy1653552428545.html
CVE ID: CVE-2022-23726 State: PUBLISHED Published: 2022-09-30T14:35:09.086Z Last Updated: 2025-05-20T16:02:08.159Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N) Vendors: Ping Identity Products: PingCentral Problem Types: CWE-200 Description: PingCentral versions prior to listed versions expose Spring Boot actuator endpoints that with administrative authentication return large amounts of sensitive environmental and application information. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.pingidentity.com/en/resources/downloads/pingcentral.html - https://docs.pingidentity.com/bundle/pingcentral-110/page/sdd16516961
tity.com/en/resources/downloads/pingcentral.html - https://docs.pingidentity.com/bundle/pingcentral-110/page/sdd1651696160285.html
CVE ID: CVE-2022-23727 State: PUBLISHED Published: 2022-01-28T19:09:30 Last Updated: 2024-08-03T03:51:45.960Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is a privilege escalation vulnerability in some webOS TVs. Due to wrong setting environments, local attacker is able to perform specific operation to exploit this vulnerability. Exploitation may cause the attacker to obtain a higher privilege Additional Analyst Notes: - CVE Program Container: References: - https://lgsecurity.lge.com/bulletins/tv
CVE ID: CVE-2022-23728 State: PUBLISHED Published: 2022-01-21T18:17:30 Last Updated: 2024-08-03T03:51:45.953Z Vendors: n/a Products: LG mobile devices Problem Types: CWE-684 Description: Attacker can reset the device with AT Command in the process of rebooting the device. The LG ID is LVE-SMP-210011. Additional Analyst Notes: - CVE Program Container: References: - https://lgsecurity.lge.com/bulletins/mobile
CVE ID: CVE-2022-23729 State: PUBLISHED Published: 2022-03-04T15:51:14 Last Updated: 2024-08-03T03:51:45.985Z Vendors: n/a Products: LG mobile devices Problem Types: CWE-305 Description: When the device is in factory state, it can be access the shell without adb authentication process. The LG ID is LVE-SMP-210010. Additional Analyst Notes: - CVE Program Container: References: - https://lgsecurity.lge.com/bulletins/mobile
CVE ID: CVE-2022-23730 State: PUBLISHED Published: 2022-03-11T17:54:10 Last Updated: 2024-08-03T03:51:46.129Z Vendors: n/a Products: LG webOS TV Problem Types: CWE-284 Description: The public API error causes for the attacker to be able to bypass API access control. Additional Analyst Notes: - CVE Program Container: References: - https://lgsecurity.lge.com/bulletins/tv
CVE ID: CVE-2022-23731 State: PUBLISHED Published: 2022-03-11T17:54:11 Last Updated: 2024-08-03T03:51:46.021Z Vendors: n/a Products: LG webOS TV Problem Types: CWE-264 Description: V8 javascript engine (heap vulnerability) can cause privilege escalation ,which can impact on some webOS TV models. Additional Analyst Notes: - CVE Program Container: References: - https://lgsecurity.lge.com/bulletins/tv
CVE ID: CVE-2022-23732 State: PUBLISHED Published: 2022-04-05T00:10:11 Last Updated: 2024-08-03T03:51:46.012Z Vendors: GitHub Products: GitHub Enterprise Server Problem Types: CWE-23 Description: A path traversal vulnerability was identified in GitHub Enterprise Server management console that allowed the bypass of CSRF protections. This could potentially lead to privilege escalation. To exploit this vulnerability, an attacker would need to target a user that was actively logged into the management console. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.5 and was fixed in versions 3.1.19, 3.2.11, 3.3.6, 3.4.1. This vulnerability was reported via the GitHub Bug
prior to 3.5 and was fixed in versions 3.1.19, 3.2.11, 3.3.6, 3.4.1. This vulnerability was reported via the GitHub Bug Bounty program. Additional Analyst Notes: - CVE Program Container: References: - https://docs.github.com/en/enterprise-server%403.1/admin/release-notes#3.1.19 - https://docs.github.com/en/enterprise-server%403.2/admin/release-notes#3.2.11 - https://docs.github.com/en/enterprise-server%403.3/admin/release-notes#3.3.6 - https://docs.github.com/en/enterprise-server%403.4/admin/release-notes#3.4.1
CVE ID: CVE-2022-23733 State: PUBLISHED Published: 2022-08-02T16:05:14 Last Updated: 2024-08-03T03:51:45.926Z Vendors: GitHub Products: GitHub Enterprise Server Problem Types: CWE-79 Description: A stored XSS vulnerability was identified in GitHub Enterprise Server that allowed the injection of arbitrary attributes. This injection was blocked by Github's Content Security Policy (CSP). This vulnerability affected all versions of GitHub Enterprise Server prior to 3.6 and was fixed in versions 3.3.11, 3.4.6 and 3.5.3. This vulnerability was reported via the GitHub Bug Bounty program. Additional Analyst Notes: - CVE Program Container: References: - https://docs.github.com/en/enterprise-server%40
rogram. Additional Analyst Notes: - CVE Program Container: References: - https://docs.github.com/en/enterprise-server%403.3/admin/release-notes#3.3.11 - https://docs.github.com/en/enterprise-server%403.4/admin/release-notes#3.4.6 - https://docs.github.com/en/enterprise-server%403.5/admin/release-notes#3.5.3
CVE ID: CVE-2022-23734 State: PUBLISHED Published: 2022-10-19T00:00:00.000Z Last Updated: 2025-05-09T14:50:32.354Z Vendors: GitHub Products: GitHub Enterprise Server Problem Types: CWE-502 Description: A deserialization of untrusted data vulnerability was identified in GitHub Enterprise Server that could potentially lead to remote code execution on the SVNBridge. To exploit this vulnerability, an attacker would need to gain access via a server-side request forgery (SSRF) that would let an attacker control the data being deserialized. This vulnerability affected all versions of GitHub Enterprise Server prior to v3.6 and was fixed in versions 3.5.3, 3.4.6, 3.3.11, and 3.2.16. This vulnerabilit
of GitHub Enterprise Server prior to v3.6 and was fixed in versions 3.5.3, 3.4.6, 3.3.11, and 3.2.16. This vulnerability was reported via the GitHub Bug Bounty program. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://docs.github.com/en/enterprise-server%403.3/admin/release-notes#3.3.11 - https://docs.github.com/en/enterprise-server%403.4/admin/release-notes#3.4.6 - https://docs.github.com/en/enterprise-server%403.5/admin/release-notes#3.5.3 - https://docs.github.com/en/enterprise-server%403.2/admin/release-notes#3.2.16
CVE ID: CVE-2022-23737 State: PUBLISHED Published: 2022-12-01T00:00:00.000Z Last Updated: 2025-04-24T14:32:04.210Z Vendors: GitHub Products: GitHub Enterprise Server Problem Types: CWE-269 Description: An improper privilege management vulnerability was identified in GitHub Enterprise Server that allowed users with improper privileges to create or delete pages via the API. To exploit this vulnerability, an attacker would need to be added to an organization's repo with write permissions. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.7 and was fixed in versions 3.2.20, 3.3.15, 3.4.10, 3.5.7, and 3.6.3. This vulnerability was reported via the GitHub Bug Bounty p
fixed in versions 3.2.20, 3.3.15, 3.4.10, 3.5.7, and 3.6.3. This vulnerability was reported via the GitHub Bug Bounty program. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://docs.github.com/en/enterprise-server%403.2/admin/release-notes#3.2.20 - https://docs.github.com/en/enterprise-server%403.3/admin/release-notes#3.3.15 - https://docs.github.com/en/enterprise-server%403.4/admin/release-notes#3.4.10 - https://docs.github.com/en/enterprise-server%403.5/admin/release-notes#3.5.7 - https://docs.github.com/en/enterprise-server%403.6/admin/release-notes#3.6.3
CVE ID: CVE-2022-23738 State: PUBLISHED Published: 2022-11-01T00:00:00.000Z Last Updated: 2025-05-06T14:35:41.946Z Vendors: GitHub Products: GitHub Enterprise Server Problem Types: CWE-200 Description: An improper cache key vulnerability was identified in GitHub Enterprise Server that allowed an unauthorized actor to access private repository files through a public repository. To exploit this, an actor would need to already be authorized on the GitHub Enterprise Server instance, be able to create a public repository, and have a site administrator visit a specially crafted URL. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.6 and was fixed in versions 3.2.20,
RL. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.6 and was fixed in versions 3.2.20, 3.3.15, 3.4.10, 3.5.7, 3.6.3. This vulnerability was reported via the GitHub Bug Bounty program. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://docs.github.com/en/enterprise-server%403.2/admin/release-notes#3.2.20 - https://docs.github.com/en/enterprise-server%403.3/admin/release-notes#3.3.15 - https://docs.github.com/en/enterprise-server%403.4/admin/release-notes#3.4.10 - https://docs.github.com/en/enterprise-server%403.5/admin/release-notes#3.5.7 - https://docs.github.com/en/enterprise-server%403.6/admin/release-notes#3.6
rise-server%403.5/admin/release-notes#3.5.7 - https://docs.github.com/en/enterprise-server%403.6/admin/release-notes#3.6.3
CVE ID: CVE-2022-23739 State: PUBLISHED Published: 2023-01-17T00:00:00.000Z Last Updated: 2025-04-08T20:17:33.773Z Vendors: GitHub Products: GitHub Enterprise Server Problem Types: CWE-863 Description: An incorrect authorization vulnerability was identified in GitHub Enterprise Server, allowing for escalation of privileges in GraphQL API requests from GitHub Apps. This vulnerability allowed an app installed on an organization to gain access to and modify most organization-level resources that are not tied to a repository regardless of granted permissions, such as users and organization-wide projects. Resources associated with repositories were not impacted, such as repository file content, r