Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-31766 State: PUBLISHED Published: 2022-10-11T00:00:00.000Z Last Updated: 2025-04-21T13:48:28.967Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: RUGGEDCOM RM1224 LTE(4G) EU, RUGGEDCOM RM1224 LTE(4G) NAM, SCALANCE M804PB, SCALANCE M812-1 ADSL-Router, SCALANCE M816-1 ADSL-Router, SCALANCE M826-2 SHDSL-Router, SCALANCE M874-2, SCALANCE M874-3, SCALANCE M876-3, SCALANCE M876-3 (ROK), SCALANCE M876-4, SCALANCE M876-4 (EU), SCALANCE M876-4 (NAM), SCALANCE MUM853-1 (EU), SCALANCE MUM856-1 (EU), SCALANCE MUM856-1 (RoW), SCALANCE S615 EEC LAN-Router, SCALANCE S615 LAN-Router, SCALANCE WAM763-1, SCALANCE WAM766-1, SCALAN
NCE MUM856-1 (RoW), SCALANCE S615 EEC LAN-Router, SCALANCE S615 LAN-Router, SCALANCE WAM763-1, SCALANCE WAM766-1, SCALANCE WAM766-1 (US), SCALANCE WAM766-1 EEC, SCALANCE WAM766-1 EEC (US), SCALANCE WUM763-1, SCALANCE WUM766-1, SCALANCE WUM766-1 (USA) Problem Types: CWE-20 Description: A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V7.1.2), RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2) (All versions < V7.1.2), SCALANCE M804PB (6GK5804-0AP00-2AA2) (All versions < V7.1.2), SCALANCE M812-1 ADSL-Router (6GK5812-1AA00-2AA2) (All versions < V7.1.2), SCALANCE M812-1 ADSL-Router (6GK5812-1BA00-2AA2) (All versions < V7.1.2), SCALANCE M816-1
AA2) (All versions < V7.1.2), SCALANCE M812-1 ADSL-Router (6GK5812-1BA00-2AA2) (All versions < V7.1.2), SCALANCE M816-1 ADSL-Router (6GK5816-1AA00-2AA2) (All versions < V7.1.2), SCALANCE M816-1 ADSL-Router (6GK5816-1BA00-2AA2) (All versions < V7.1.2), SCALANCE M826-2 SHDSL-Router (6GK5826-2AB00-2AB2) (All versions < V7.1.2), SCALANCE M874-2 (6GK5874-2AA00-2AA2) (All versions < V7.1.2), SCALANCE M874-3 (6GK5874-3AA00-2AA2) (All versions < V7.1.2), SCALANCE M876-3 (6GK5876-3AA02-2BA2) (All versions < V7.1.2), SCALANCE M876-3 (ROK) (6GK5876-3AA02-2EA2) (All versions < V7.1.2), SCALANCE M876-4 (6GK5876-4AA10-2BA2) (All versions < V7.1.2), SCALANCE M876-4 (EU) (6GK5876-4AA00-2BA2) (All versions <
SCALANCE M876-4 (6GK5876-4AA10-2BA2) (All versions < V7.1.2), SCALANCE M876-4 (EU) (6GK5876-4AA00-2BA2) (All versions < V7.1.2), SCALANCE M876-4 (NAM) (6GK5876-4AA00-2DA2) (All versions < V7.1.2), SCALANCE MUM853-1 (EU) (6GK5853-2EA00-2DA1) (All versions < V7.1.2), SCALANCE MUM856-1 (EU) (6GK5856-2EA00-3DA1) (All versions < V7.1.2), SCALANCE MUM856-1 (RoW) (6GK5856-2EA00-3AA1) (All versions < V7.1.2), SCALANCE S615 EEC LAN-Router (6GK5615-0AA01-2AA2) (All versions < V7.1.2), SCALANCE S615 LAN-Router (6GK5615-0AA00-2AA2) (All versions < V7.1.2), SCALANCE WAM763-1 (6GK5763-1AL00-7DA0) (All versions >= V1.1.0 < V3.0.0), SCALANCE WAM766-1 (6GK5766-1GE00-7DA0) (All versions >= V1.1.0 < V3.0.0),
AL00-7DA0) (All versions >= V1.1.0 < V3.0.0), SCALANCE WAM766-1 (6GK5766-1GE00-7DA0) (All versions >= V1.1.0 < V3.0.0), SCALANCE WAM766-1 (US) (6GK5766-1GE00-7DB0) (All versions >= V1.1.0 < V3.0.0), SCALANCE WAM766-1 EEC (6GK5766-1GE00-7TA0) (All versions >= V1.1.0 < V3.0.0), SCALANCE WAM766-1 EEC (US) (6GK5766-1GE00-7TB0) (All versions >= V1.1.0 < V3.0.0), SCALANCE WUM763-1 (6GK5763-1AL00-3AA0) (All versions >= V1.1.0 < V3.0.0), SCALANCE WUM763-1 (6GK5763-1AL00-3DA0) (All versions >= V1.1.0 < V3.0.0), SCALANCE WUM766-1 (6GK5766-1GE00-3DA0) (All versions >= V1.1.0 < V3.0.0), SCALANCE WUM766-1 (USA) (6GK5766-1GE00-3DB0) (All versions >= V1.1.0 < V3.0.0). Affected devices with TCP Event servic
, SCALANCE WUM766-1 (USA) (6GK5766-1GE00-3DB0) (All versions >= V1.1.0 < V3.0.0). Affected devices with TCP Event service enabled do not properly handle malformed packets. This could allow an unauthenticated remote attacker to cause a denial of service condition and reboot the device thus possibly affecting other network resources. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-697140.pdf - https://cert-portal.siemens.com/productcert/html/ssa-697140.html
CVE ID: CVE-2022-31767 State: PUBLISHED Published: 2022-06-24T15:35:29.233443Z Last Updated: 2024-09-16T23:41:56.102Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/C:H/S:U/A:H/AC:L/PR:N/I:H/UI:N/RL:O/E:U/RC:C) Vendors: IBM Products: CICS TX Advanced, CICS TX Standard Problem Types: Gain Access Description: IBM CICS TX Standard and Advanced 11.1 could allow a remote attacker to execute arbitrary commands on the system by sending a specially crafted request. IBM X-Force ID: 227980. Additional Analyst Notes: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/6597533 - https://www.ibm.com/support/pages/node/6597531 - https://exchange.xforce.ibmcloud.com/vulnerabilities/22
/node/6597533 - https://www.ibm.com/support/pages/node/6597531 - https://exchange.xforce.ibmcloud.com/vulnerabilities/227980
CVE ID: CVE-2022-31768 State: PUBLISHED Published: 2022-06-06T16:20:11.652107Z Last Updated: 2024-09-16T23:06:06.226Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/UI:N/AV:N/I:N/S:U/A:N/PR:L/AC:H/C:H/E:U/RC:C/RL:O) Vendors: IBM Products: InfoSphere Information Server Problem Types: Data Manipulation Description: IBM InfoSphere Information Server 11.7 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. Additional Analyst Notes: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/6592573 - https://exchange.xforce.ibmcloud.com/vulnerabili
ntainer: References: - https://www.ibm.com/support/pages/node/6592573 - https://exchange.xforce.ibmcloud.com/vulnerabilities/227986
CVE ID: CVE-2022-31769 State: PUBLISHED Published: 2022-06-10T16:00:27.395135Z Last Updated: 2024-09-16T23:40:48.096Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/PR:N/I:N/AC:L/S:U/C:L/AV:N/UI:N/A:N/RC:C/E:U/RL:O) Vendors: IBM Products: Spectrum Copy Data Management Problem Types: Obtain Information Description: IBM Spectrum Copy Data Management 2.2.0.0 through 2.2.15.0 could allow a remote attacker to view product configuration information stored in PostgreSQL, which could be used in further attacks against the system. IBM X-Force ID: 228219. Additional Analyst Notes: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/6593721 - https://exchange.xforce.ibmcloud.com/vulnerab
Container: References: - https://www.ibm.com/support/pages/node/6593721 - https://exchange.xforce.ibmcloud.com/vulnerabilities/228219
CVE ID: CVE-2022-31770 State: PUBLISHED Published: 2022-07-05T16:10:10.491879Z Last Updated: 2024-09-17T04:19:19.029Z Severity: MEDIUM (CVSS 4.9 CVSS:3.0/S:U/A:H/AV:N/UI:N/C:N/PR:H/AC:L/I:N/RL:O/RC:C/E:U) Vendors: IBM Products: App Connect Enterprise Certified Container Problem Types: Denial of Service Description: IBM App Connect Enterprise Certified Container 4.2 could allow a user from the administration console to cause a denial of service by creating a specially crafted request. IBM X-Force ID: 228221. Additional Analyst Notes: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/6601125 - https://exchange.xforce.ibmcloud.com/vulnerabilities/228221
CVE ID: CVE-2022-31772 State: PUBLISHED Published: 2022-11-11T18:56:12.717Z Last Updated: 2025-05-01T13:35:04.809Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: IBM Products: MQ Problem Types: CWE-20 Description: IBM MQ 8.0, 9.0 LTS, 9.1 CD, 9.1 LTS, 9.2 CD, and 9.2 LTS could allow an authenticated and authorized user to cause a denial of service to the MQTT channels. IBM X-Force ID: 228335. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6833806 - https://exchange.xforce.ibmcloud.com/vulnerabilities/228335
CVE ID: CVE-2022-31773 State: PUBLISHED Published: 2022-08-26T17:25:12.579354Z Last Updated: 2024-09-16T18:50:13.645Z Severity: HIGH (CVSS 8.8 CVSS:3.0/C:H/A:H/S:U/UI:R/I:H/AC:L/PR:N/AV:N/RC:C/E:U/RL:O) Vendors: IBM Products: DataPower Gateway Problem Types: Gain Access Description: IBM DataPower Gateway V10CD, 10.0.1, and 2018.4.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 228357. Additional Analyst Notes: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/6615307 - https://exchange.xforce.ibmcloud.com/vulnerabilities/228357
CVE ID: CVE-2022-31774 State: PUBLISHED Published: 2022-07-31T16:05:55.923164Z Last Updated: 2024-09-16T20:16:42.239Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/A:N/AC:L/S:C/UI:R/C:L/AV:N/I:L/PR:L/RC:C/RL:O/E:H) Vendors: IBM Products: DataPower Gateway Problem Types: Cross-Site Scripting Description: IBM DataPower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.8, 10.5.0.0, and 2018.4.1.0 through 2018.4.1.21 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 228358. Additional Analyst Notes: -
entially leading to credentials disclosure within a trusted session. IBM X-Force ID: 228358. Additional Analyst Notes: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/6608600 - https://exchange.xforce.ibmcloud.com/vulnerabilities/228358
CVE ID: CVE-2022-31775 State: PUBLISHED Published: 2022-07-31T16:06:37.375554Z Last Updated: 2024-09-16T19:46:54.483Z Severity: MEDIUM (CVSS 5.5 CVSS:3.0/AC:L/S:U/A:H/PR:H/UI:N/I:N/AV:N/C:L/E:U/RL:O/RC:C) Vendors: IBM Products: DataPower Gateway Problem Types: Denial of Service Description: IBM DataPower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.8, 10.5.0.0, and 2018.4.1.0 through 2018.4.1.21 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 228359. Additional Analyst Notes: - CVE Program Container: References:
tion or consume memory resources. IBM X-Force ID: 228359. Additional Analyst Notes: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/6608608 - https://exchange.xforce.ibmcloud.com/vulnerabilities/228359
CVE ID: CVE-2022-31776 State: PUBLISHED Published: 2022-07-31T16:07:13.000062Z Last Updated: 2024-09-17T04:20:23.455Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/UI:N/I:L/C:L/AV:N/PR:N/A:N/AC:L/S:U/RC:C/E:U/RL:O) Vendors: IBM Products: DataPower Gateway Problem Types: Gain Access Description: IBM DataPower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.8, 10.5.0.0, and 2018.4.1.0 through 2018.4.1.21 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 228433. Additional Analyst Notes: - CVE Program Container: Ref
numeration or facilitating other attacks. IBM X-Force ID: 228433. Additional Analyst Notes: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/6608604 - https://exchange.xforce.ibmcloud.com/vulnerabilities/228433
CVE ID: CVE-2022-31777 State: PUBLISHED Published: 2022-11-01T00:00:00.000Z Last Updated: 2025-05-06T03:36:31.908Z Vendors: Apache Software Foundation Products: Apache Spark Problem Types: CWE-74 Description: A stored cross-site scripting (XSS) vulnerability in Apache Spark 3.2.1 and earlier, and 3.3.0, allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into the logs which would be returned in logs rendered in the UI. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/60mgbswq2lsmrxykfxpqq13ztkm2ht6q - http://www.openwall.com/lists/oss-security/2022/11/01
https://lists.apache.org/thread/60mgbswq2lsmrxykfxpqq13ztkm2ht6q - http://www.openwall.com/lists/oss-security/2022/11/01/14
CVE ID: CVE-2022-31778 State: PUBLISHED Published: 2022-08-10T00:00:00 Last Updated: 2024-08-03T07:26:01.210Z Vendors: Apache Software Foundation Products: Apache Traffic Server Problem Types: CWE-20 Description: Improper Input Validation vulnerability in handling the Transfer-Encoding header of Apache Traffic Server allows an attacker to poison the cache. This issue affects Apache Traffic Server 8.0.0 to 9.0.2. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread/rc64lwbdgrkv674koc3zl1sljr9vwg21 - https://www.debian.org/security/2022/dsa-5206 - https://lists.debian.org/debian-lts-announce/2023/04/msg00007.html
CVE ID: CVE-2022-31779 State: PUBLISHED Published: 2022-08-10T05:50:40 Last Updated: 2024-08-03T07:26:01.104Z Vendors: Apache Software Foundation Products: Apache Traffic Server Problem Types: CWE-20 Description: Improper Input Validation vulnerability in HTTP/2 header parsing of Apache Traffic Server allows an attacker to smuggle requests. This issue affects Apache Traffic Server 8.0.0 to 9.1.2. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread/rc64lwbdgrkv674koc3zl1sljr9vwg21 - https://www.debian.org/security/2022/dsa-5206 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CJ67IWD5PRJUOIYIDJRUG3U
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CJ67IWD5PRJUOIYIDJRUG3UMS2UF4X4J/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZCSBQBYPOZSWS5LCOAQ6LJLRLXFIAW5A/
CVE ID: CVE-2022-31780 State: PUBLISHED Published: 2022-08-10T00:00:00 Last Updated: 2024-08-03T07:26:01.168Z Vendors: Apache Software Foundation Products: Apache Traffic Server Problem Types: CWE-20 Description: Improper Input Validation vulnerability in HTTP/2 frame handling of Apache Traffic Server allows an attacker to smuggle requests. This issue affects Apache Traffic Server 8.0.0 to 9.1.2. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread/rc64lwbdgrkv674koc3zl1sljr9vwg21 - https://www.debian.org/security/2022/dsa-5206 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CJ67IWD5PRJUOIYIDJRUG3U
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CJ67IWD5PRJUOIYIDJRUG3UMS2UF4X4J/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZCSBQBYPOZSWS5LCOAQ6LJLRLXFIAW5A/ - https://lists.debian.org/debian-lts-announce/2023/01/msg00019.html
CVE ID: CVE-2022-31781 State: PUBLISHED Published: 2022-07-13T07:25:10 Last Updated: 2024-08-03T07:26:01.066Z Vendors: Apache Software Foundation Products: Apache Tapestry Problem Types: CWE-1333 Description: Apache Tapestry up to version 5.8.1 is vulnerable to Regular Expression Denial of Service (ReDoS) in the way it handles Content Types. Specially crafted Content Types may cause catastrophic backtracking, taking exponential time to complete. Specifically, this is about the regular expression used on the parameter of the org.apache.tapestry5.http.ContentType class. Apache Tapestry 5.8.2 has a fix for this vulnerability. Notice the vulnerability cannot be triggered by web requests in Tapes
e Tapestry 5.8.2 has a fix for this vulnerability. Notice the vulnerability cannot be triggered by web requests in Tapestry code alone. It would only happen if there's some non-Tapestry codepath passing some outside input to the ContentType class constructor. Additional Analyst Notes: - CVE Program Container: References: - https://www.openwall.com/lists/oss-security/2022/07/12/3
CVE ID: CVE-2022-31782 State: PUBLISHED Published: 2022-05-27T21:10:35 Last Updated: 2024-08-03T07:26:01.196Z Vendors: n/a Products: n/a Problem Types: n/a Description: ftbench.c in FreeType Demo Programs through 2.12.1 has a heap-based buffer overflow. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.freedesktop.org/freetype/freetype-demos/-/issues/8
CVE ID: CVE-2022-31783 State: PUBLISHED Published: 2022-05-27T00:00:00 Last Updated: 2024-08-03T07:26:01.098Z Vendors: n/a Products: n/a Problem Types: n/a Description: Liblouis 3.21.0 has an out-of-bounds write in compileRule in compileTranslationTable.c, as demonstrated by lou_trace. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/liblouis/liblouis/issues/1214 - https://github.com/liblouis/liblouis/commit/ff747ec5e1ac54d54194846f6fe5bfc689192a85 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CFD2KIHESDUCNWTEW3USFB5GKTWT624L/ - https://security.gentoo.org/glsa/202301-06
CVE ID: CVE-2022-31784 State: PUBLISHED Published: 2022-06-17T11:43:09 Last Updated: 2024-08-03T07:26:01.127Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability in the management interface of MiVoice Business through 9.3 PR1 and MiVoice Business Express through 8.0 SP3 PR3 could allow an unauthenticated attacker (that has network access to the management interface) to conduct a buffer overflow attack due to insufficient validation of URL parameters. A successful exploit could allow arbitrary code execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.mitel.com/support/security-advisories - https://www.mitel.com/support/security-advisor
tainer: References: - https://www.mitel.com/support/security-advisories - https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-22-0005
CVE ID: CVE-2022-31786 State: PUBLISHED Published: 2022-06-21T14:06:19 Last Updated: 2024-08-03T07:26:01.208Z Vendors: n/a Products: n/a Problem Types: n/a Description: IdeaLMS 2022 allows reflected Cross Site Scripting (XSS) via the IdeaLMS/Class/Assessment/ PATH_INFO. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/RNPG/e10524f1781a9981b50fb27bb473b0fe
CVE ID: CVE-2022-31787 State: PUBLISHED Published: 2022-06-22T14:38:41 Last Updated: 2024-08-03T07:26:01.201Z Vendors: n/a Products: n/a Problem Types: n/a Description: IdeaTMS 2022 is vulnerable to SQL Injection via the PATH_INFO Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/This-is-Neo/c91e1a0ed5d40fbcf0dada43ea1d7479 - https://gist.github.com/RNPG/ef10c0acceb650d43625a77d3472dd84
CVE ID: CVE-2022-31788 State: PUBLISHED Published: 2022-06-10T12:08:06 Last Updated: 2024-08-03T07:26:01.074Z Vendors: n/a Products: n/a Problem Types: n/a Description: IdeaLMS 2022 allows SQL injection via the IdeaLMS/ChatRoom/ClassAccessControl/6?isBigBlueButton=0&ClassID= pathname. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/This-is-Neo/cc5b08ad8a3a60cd81fd1b9c1cb573b4 - https://gist.github.com/RNPG/b154f4b2e90340d2f39605989af06bee
CVE ID: CVE-2022-31789 State: PUBLISHED Published: 2022-09-06T18:16:40 Last Updated: 2024-08-03T07:26:01.237Z Vendors: n/a Products: n/a Problem Types: n/a Description: An integer overflow in WatchGuard Firebox and XTM appliances allows an unauthenticated remote attacker to trigger a buffer overflow and potentially execute arbitrary code by sending a malicious request to exposed management ports. This is fixed in Fireware OS 12.8.1, 12.5.10, and 12.1.4. Additional Analyst Notes: - CVE Program Container: References: - https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2022-00015
CVE ID: CVE-2022-31790 State: PUBLISHED Published: 2022-09-06T17:54:41 Last Updated: 2024-08-03T07:26:01.128Z Vendors: n/a Products: n/a Problem Types: n/a Description: WatchGuard Firebox and XTM appliances allow an unauthenticated remote attacker to retrieve sensitive authentication server settings by sending a malicious request to exposed authentication endpoints. This is fixed in Fireware OS 12.8.1, 12.5.10, and 12.1.4. Additional Analyst Notes: - CVE Program Container: References: - https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2022-00017 - https://www.openwall.com/lists/oss-security/2022/08/30/2 - https://www.ambionics.io/blog/hacking-watchguard-firewalls
CVE ID: CVE-2022-31791 State: PUBLISHED Published: 2022-09-06T18:26:38 Last Updated: 2024-08-03T07:26:01.197Z Vendors: n/a Products: n/a Problem Types: n/a Description: WatchGuard Firebox and XTM appliances allow a local attacker (that has already obtained shell access) to elevate their privileges and execute code with root permissions. This is fixed in Fireware OS 12.8.1, 12.5.10, and 12.1.4. Additional Analyst Notes: - CVE Program Container: References: - https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2022-00018
CVE ID: CVE-2022-31792 State: PUBLISHED Published: 2022-09-06T18:24:45 Last Updated: 2024-08-03T07:26:01.229Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability exists in the management web interface of WatchGuard Firebox and XTM appliances. A remote attacker can potentially execute arbitrary JavaScript code in the management web interface by sending crafted requests to exposed management ports. This is fixed in Fireware OS 12.8.1, 12.5.10, and 12.1.4. Additional Analyst Notes: - CVE Program Container: References: - https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2022-00014
CVE ID: CVE-2022-31793 State: PUBLISHED Published: 2022-08-04T21:55:05 Last Updated: 2024-08-03T07:26:01.085Z Vendors: n/a Products: n/a Problem Types: n/a Description: do_request in request.c in muhttpd before 1.1.7 allows remote attackers to read arbitrary files by constructing a URL with a single character before a desired path on the filesystem. This occurs because the code skips over the first character when serving files. Arris NVG443, NVG599, NVG589, and NVG510 devices and Arris-derived BGW210 and BGW320 devices are affected. Additional Analyst Notes: - CVE Program Container: References: - http://inglorion.net/software/muhttpd/ - https://kb.cert.org/vuls/id/495801 - https://derekabdin
ontainer: References: - http://inglorion.net/software/muhttpd/ - https://kb.cert.org/vuls/id/495801 - https://derekabdine.com/blog/2022-arris-advisory - https://blog.malwarebytes.com/exploits-and-vulnerabilities/2022/08/millions-of-arris-routers-are-vulnerable-to-path-traversal-attacks/
CVE ID: CVE-2022-31794 State: PUBLISHED Published: 2022-06-20T14:38:29 Last Updated: 2024-08-03T07:26:01.296Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Fujitsu ETERNUS CentricStor CS8000 (Control Center) devices before 8.1A SP02 P04. The vulnerability resides in the requestTempFile function in hw_view.php. An attacker is able to influence the unitName POST parameter and inject special characters such as semicolons, backticks, or command-substitution sequences in order to force the application to execute arbitrary commands. Additional Analyst Notes: - CVE Program Container: References: - https://cwe.mitre.org/data/definitions/78.html - https://suppo
nal Analyst Notes: - CVE Program Container: References: - https://cwe.mitre.org/data/definitions/78.html - https://support.ts.fujitsu.com/ProductSecurity/content/Fujitsu-PSIRT-PSS-IS-2022-050316-Security-Notice-SF.pdf - https://research.nccgroup.com/2022/05/27/technical-advisory-fujitsu-centricstor-control-center-v8-1-unauthenticated-command-injection/
CVE ID: CVE-2022-31795 State: PUBLISHED Published: 2022-06-20T14:41:14 Last Updated: 2024-08-03T07:26:01.281Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Fujitsu ETERNUS CentricStor CS8000 (Control Center) devices before 8.1A SP02 P04. The vulnerability resides in the grel_finfo function in grel.php. An attacker is able to influence the username (user), password (pw), and file-name (file) parameters and inject special characters such as semicolons, backticks, or command-substitution sequences in order to force the application to execute arbitrary commands. Additional Analyst Notes: - CVE Program Container: References: - https://cwe.mitre.org/data/def