Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-43711 State: PUBLISHED Published: 2023-07-26T00:00:00 Last Updated: 2024-10-23T19:19:08.772Z Vendors: n/a Products: n/a Problem Types: n/a Description: Interactive Forms (IAF) in GX Software XperienCentral versions 10.29.1 until 10.33.0 was vulnerable to cross site scripting attacks (XSS) because the CSP header uses eval() in the script-src. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://service.gxsoftware.com - https://service.gxsoftware.com/hc/nl/articles/12208173122461
CVE ID: CVE-2022-43712 State: PUBLISHED Published: 2023-07-26T00:00:00 Last Updated: 2024-10-23T15:07:18.937Z Vendors: n/a Products: n/a Problem Types: n/a Description: POST requests to /web/mvc in GX Software XperienCentral version 10.36.0 and earlier were not blocked for uses that are not logged in. If an unauthorized user is able to bypass other security filters they are able to post unauthorized data to the server because of CVE-2022-22965. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://service.gxsoftware.com/hc/en-us/articles/4717373636381-Vulnerability-in-Spring-core-Spring4Shell- - https://service.gxsoftware.com/hc/nl/articles/1220817
rticles/4717373636381-Vulnerability-in-Spring-core-Spring4Shell- - https://service.gxsoftware.com/hc/nl/articles/12208173122461
CVE ID: CVE-2022-43713 State: PUBLISHED Published: 2023-07-26T00:00:00 Last Updated: 2024-10-23T15:05:37.520Z Vendors: n/a Products: n/a Problem Types: n/a Description: Interactive Forms (IAF) in GX Software XperienCentral versions 10.33.1 until 10.35.0 was vulnerable to invalid data input because form validation could be bypassed. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://service.gxsoftware.com - https://service.gxsoftware.com/hc/nl/articles/12208173122461
CVE ID: CVE-2022-43716 State: PUBLISHED Published: 2023-04-11T09:02:49.383Z Last Updated: 2024-09-10T09:33:31.854Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: SIMATIC CP 1242-7 V2, SIMATIC CP 1243-1, SIMATIC CP 1243-1 DNP3 (incl. SIPLUS variants), SIMATIC CP 1243-1 IEC (incl. SIPLUS variants), SIMATIC CP 1243-7 LTE EU, SIMATIC CP 1243-7 LTE US, SIMATIC CP 1243-8 IRC, SIMATIC CP 1542SP-1, SIMATIC CP 1542SP-1 IRC, SIMATIC CP 1543SP-1, SIMATIC CP 443-1, SIMATIC CP 443-1 Advanced, SIPLUS ET 200SP CP 1542SP-1 IRC TX RAIL, SIPLUS ET 200SP CP 1543SP-1 ISEC, SIPLUS ET 200SP CP 1543SP-1 ISEC TX RAIL, SIPLUS NET CP 1242-7 V2, SIPLUS N
C TX RAIL, SIPLUS ET 200SP CP 1543SP-1 ISEC, SIPLUS ET 200SP CP 1543SP-1 ISEC TX RAIL, SIPLUS NET CP 1242-7 V2, SIPLUS NET CP 443-1, SIPLUS NET CP 443-1 Advanced, SIPLUS S7-1200 CP 1243-1, SIPLUS S7-1200 CP 1243-1 RAIL, SIPLUS TIM 1531 IRC, TIM 1531 IRC Problem Types: CWE-416 Description: A vulnerability has been identified in SIMATIC CP 1242-7 V2 (6GK7242-7KX31-0XE0) (All versions < V3.4.29), SIMATIC CP 1243-1 (6GK7243-1BX30-0XE0) (All versions < V3.4.29), SIMATIC CP 1243-1 DNP3 (incl. SIPLUS variants) (All versions < V3.4.29), SIMATIC CP 1243-1 IEC (incl. SIPLUS variants) (All versions < V3.4.29), SIMATIC CP 1243-7 LTE EU (6GK7243-7KX30-0XE0) (All versions < V3.4.29), SIMATIC CP 1243-7 LTE
(All versions < V3.4.29), SIMATIC CP 1243-7 LTE EU (6GK7243-7KX30-0XE0) (All versions < V3.4.29), SIMATIC CP 1243-7 LTE US (6GK7243-7SX30-0XE0) (All versions < V3.4.29), SIMATIC CP 1243-8 IRC (6GK7243-8RX30-0XE0) (All versions < V3.4.29), SIMATIC CP 1542SP-1 (6GK7542-6UX00-0XE0) (All versions < V2.3), SIMATIC CP 1542SP-1 IRC (6GK7542-6VX00-0XE0) (All versions < V2.3), SIMATIC CP 1543SP-1 (6GK7543-6WX00-0XE0) (All versions < V2.3), SIMATIC CP 443-1 (6GK7443-1EX30-0XE0) (All versions < V3.3), SIMATIC CP 443-1 (6GK7443-1EX30-0XE1) (All versions < V3.3), SIMATIC CP 443-1 Advanced (6GK7443-1GX30-0XE0) (All versions < V3.3), SIPLUS ET 200SP CP 1542SP-1 IRC TX RAIL (6AG2542-6VX00-4XE0) (All versio
ced (6GK7443-1GX30-0XE0) (All versions < V3.3), SIPLUS ET 200SP CP 1542SP-1 IRC TX RAIL (6AG2542-6VX00-4XE0) (All versions < V2.3), SIPLUS ET 200SP CP 1543SP-1 ISEC (6AG1543-6WX00-7XE0) (All versions < V2.3), SIPLUS ET 200SP CP 1543SP-1 ISEC TX RAIL (6AG2543-6WX00-4XE0) (All versions < V2.3), SIPLUS NET CP 1242-7 V2 (6AG1242-7KX31-7XE0) (All versions < V3.4.29), SIPLUS NET CP 443-1 (6AG1443-1EX30-4XE0) (All versions < V3.3), SIPLUS NET CP 443-1 Advanced (6AG1443-1GX30-4XE0) (All versions < V3.3), SIPLUS S7-1200 CP 1243-1 (6AG1243-1BX30-2AX0) (All versions < V3.4.29), SIPLUS S7-1200 CP 1243-1 RAIL (6AG2243-1BX30-1XE0) (All versions < V3.4.29), SIPLUS TIM 1531 IRC (6AG1543-1MX00-7XE0) (All ver
S7-1200 CP 1243-1 RAIL (6AG2243-1BX30-1XE0) (All versions < V3.4.29), SIPLUS TIM 1531 IRC (6AG1543-1MX00-7XE0) (All versions < V2.3.6), TIM 1531 IRC (6GK7543-1MX00-0XE0) (All versions < V2.3.6). The webserver of the affected products contains a vulnerability that may lead to a denial of service condition. An attacker may cause a denial of service situation which leads to a restart of the webserver of the affected product. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-566905.pdf - https://cert-portal.siemens.com/productcert/html/ssa-139628.html - https://cert-portal.siemens.com/productcert/html/ss
- https://cert-portal.siemens.com/productcert/html/ssa-139628.html - https://cert-portal.siemens.com/productcert/html/ssa-566905.html
CVE ID: CVE-2022-43717 State: PUBLISHED Published: 2023-01-16T10:08:04.670Z Last Updated: 2025-04-04T13:54:56.210Z Vendors: Apache Software Foundation Products: Apache Superset Problem Types: CWE-79 Description: Dashboard rendering does not sufficiently sanitize the content of markdown components leading to possible XSS attack vectors that can be performed by authenticated users with create dashboard permissions. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/g6zy6vkpvkbj5mj32vmyzwol5ldtg9pl
CVE ID: CVE-2022-43718 State: PUBLISHED Published: 2023-01-16T10:10:04.630Z Last Updated: 2025-04-07T15:06:28.119Z Vendors: Apache Software Foundation Products: Apache Superset Problem Types: CWE-79 Description: Upload data forms do not correctly render user input leading to possible XSS attack vectors that can be performed by authenticated users with database connection update permissions. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/8615608jt2x7b3rmqrtngldy8pn3nz2r
CVE ID: CVE-2022-43719 State: PUBLISHED Published: 2023-01-16T10:10:27.487Z Last Updated: 2025-04-07T15:04:38.899Z Vendors: Apache Software Foundation Products: Apache Superset Problem Types: CWE-352 Description: Two legacy REST API endpoints for approval and request access are vulnerable to cross site request forgery. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/xc309h2dphrkg33154djf3nqlh2xc1c0
CVE ID: CVE-2022-43720 State: PUBLISHED Published: 2023-01-16T10:10:41.565Z Last Updated: 2025-04-07T15:03:05.455Z Vendors: Apache Software Foundation Products: Apache Superset Problem Types: CWE-74 Description: An authenticated attacker with write CSS template permissions can create a record with specific HTML tags that will not get properly escaped by the toast message displayed when a user deletes that specific CSS template record. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/jts6x56kghr9mbowb653bk70pl81jp8l
CVE ID: CVE-2022-43721 State: PUBLISHED Published: 2023-01-16T10:10:52.583Z Last Updated: 2025-04-07T15:01:48.626Z Vendors: Apache Software Foundation Products: Apache Superset Problem Types: CWE-601 Description: An authenticated attacker with update datasets permission could change a dataset link to an untrusted site, users could be redirected to this site when clicking on that specific dataset. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/s6sqt5jmcv6qxtvdot1t5tpt57v439kg
CVE ID: CVE-2022-43722 State: PUBLISHED Published: 2022-12-13T00:00:00.000Z Last Updated: 2025-04-22T15:26:30.567Z Vendors: Siemens Products: SICAM PAS/PQS Problem Types: CWE-427 Description: A vulnerability has been identified in SICAM PAS/PQS (All versions < V7.0). Affected software does not properly secure a folder containing library files. This could allow an attacker to place a custom malicious DLL in this folder which is then run with SYSTEM rights when a service is started that requires this DLL. At the time of assigning the CVE, the affected firmware version of the component has already been superseded by succeeding mainline versions. Additional Analyst Notes: - CVE Program Container
component has already been superseded by succeeding mainline versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-849072.pdf
CVE ID: CVE-2022-43723 State: PUBLISHED Published: 2022-12-13T00:00:00.000Z Last Updated: 2025-04-22T15:22:17.726Z Vendors: Siemens Products: SICAM PAS/PQS Problem Types: CWE-1287 Description: A vulnerability has been identified in SICAM PAS/PQS (All versions < V7.0), SICAM PAS/PQS (All versions >= 7.0 < V8.06). Affected software does not properly validate the input for a certain parameter in the s7ontcp.dll. This could allow an unauthenticated remote attacker to send messages and create a denial of service condition as the application crashes. At the time of assigning the CVE, the affected firmware version of the component has already been superseded by succeeding mainline versions. Additio
CVE, the affected firmware version of the component has already been superseded by succeeding mainline versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-849072.pdf
CVE ID: CVE-2022-43724 State: PUBLISHED Published: 2022-12-13T00:00:00.000Z Last Updated: 2025-04-22T15:15:56.110Z Vendors: Siemens Products: SICAM PAS/PQS Problem Types: CWE-319 Description: A vulnerability has been identified in SICAM PAS/PQS (All versions < V7.0). Affected software transmits the database credentials for the inbuilt SQL server in cleartext. In combination with the by default enabled xp_cmdshell feature unauthenticated remote attackers could execute custom OS commands. At the time of assigning the CVE, the affected firmware version of the component has already been superseded by succeeding mainline versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vuln
eady been superseded by succeeding mainline versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-849072.pdf
CVE ID: CVE-2022-43740 State: PUBLISHED Published: 2023-10-14T15:13:27.562Z Last Updated: 2024-09-16T20:04:37.403Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: IBM Products: Security Verify Access Problem Types: CWE-400 Description: IBM Security Verify Access OIDC Provider could allow a remote user to cause a denial of service due to uncontrolled resource consumption. IBM X-Force ID: 238921. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7028513 - https://exchange.xforce.ibmcloud.com/vulnerabilities/238921
CVE ID: CVE-2022-43747 State: PUBLISHED Published: 2022-10-26T00:00:00 Last Updated: 2024-08-22T14:47:38.553Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AC:H/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: baramundi Management Agent (bMA) in baramundi Management Suite (bMS) 2021 R1 and R2 and 2022 R1 allows remote code execution. This is fixed in security update S-2022-01, which contains fixed bMA setup files for these versions. This also is fixed in baramundi Management Suite 2022 R2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.baramundi.com/de-de/security-info/s-2022-01/ - https://www.baramundi.com/
SA ADP Vulnrichment: References: - https://www.baramundi.com/de-de/security-info/s-2022-01/ - https://www.baramundi.com/en-us/security-info/s-2022-01/
CVE ID: CVE-2022-43748 State: PUBLISHED Published: 2022-10-26T10:05:13.540Z Last Updated: 2025-04-25T19:05:40.528Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N) Vendors: Synology Products: Presto File Server Problem Types: CWE-22 Description: Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in file operation management in Synology Presto File Server before 2.1.2-1601 allows remote attackers to write arbitrary files via unspecified vectors. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.synology.com/security/advisory/Synology_SA_22_19
CVE ID: CVE-2022-43749 State: PUBLISHED Published: 2022-10-26T10:05:08.833Z Last Updated: 2025-05-09T19:13:07.492Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Synology Products: Presto File Server Problem Types: CWE-269 Description: Improper privilege management vulnerability in summary report management in Synology Presto File Server before 2.1.2-1601 allows remote authenticated users to bypass security constraint via unspecified vectors. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.synology.com/security/advisory/Synology_SA_22_19
CVE ID: CVE-2022-43750 State: PUBLISHED Published: 2022-10-26T00:00:00.000Z Last Updated: 2025-05-07T13:40:53.245Z Vendors: n/a Products: n/a Problem Types: n/a Description: drivers/usb/mon/mon_bin.c in usbmon in the Linux kernel before 5.19.15 and 6.x before 6.0.1 allows a user-space client to corrupt the monitor's internal memory. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/torvalds/linux/commit/a659daf63d16aa883be42f3f34ff84235c302198 - https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=a659daf63d16aa883be42f3f34ff84235c302198 - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.19.15 - https://
?id=a659daf63d16aa883be42f3f34ff84235c302198 - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.19.15 - https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.0.1 - https://lists.debian.org/debian-lts-announce/2022/11/msg00001.html - https://lists.debian.org/debian-lts-announce/2022/12/msg00034.html
CVE ID: CVE-2022-43751 State: PUBLISHED Published: 2022-11-22T00:00:00.000Z Last Updated: 2025-04-29T04:12:13.188Z Vendors: n/a Products: n/a Problem Types: n/a Description: McAfee Total Protection prior to version 16.0.49 contains an uncontrolled search path element vulnerability due to the use of a variable pointing to a subdirectory that may be controllable by an unprivileged user. This may have allowed the unprivileged user to execute arbitrary code with system privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://mcafee.com - https://www.mcafee.com/support/?articleId=TS103348&page=shell&shell=article-view
CVE ID: CVE-2022-43752 State: PUBLISHED Published: 2022-10-31T00:00:00.000Z Last Updated: 2025-05-06T18:43:30.848Z Vendors: n/a Products: n/a Problem Types: n/a Description: Oracle Solaris version 10 1/13, when using the Common Desktop Environment (CDE), is vulnerable to a privilege escalation vulnerability. A low privileged user can escalate to root by crafting a malicious printer and double clicking on the the crafted printer's icon. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://phrack.org/issues/70/13.html#article - https://github.com/0xdea/exploits/blob/master/solaris/raptor_dtprintcheckdir_intel.c
CVE ID: CVE-2022-43753 State: PUBLISHED Published: 2022-11-10T07:30:17.870Z Last Updated: 2025-04-30T19:55:05.952Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: SUSE Products: SUSE Linux Enterprise Module for SUSE Manager Server 4.2, SUSE Linux Enterprise Module for SUSE Manager Server 4.3, SUSE Manager Server 4.2 Problem Types: CWE-22 Description: A Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in spacewalk/Uyuni of SUSE Linux Enterprise Module for SUSE Manager Server 4.2, SUSE Linux Enterprise Module for SUSE Manager Server 4.3, SUSE Manager Server 4.2 allows remote attackers to read files available to the u
ise Module for SUSE Manager Server 4.3, SUSE Manager Server 4.2 allows remote attackers to read files available to the user running the process, typically tomcat. This issue affects: SUSE Linux Enterprise Module for SUSE Manager Server 4.2 hub-xmlrpc-api-0.7-150300.3.9.2, inter-server-sync-0.2.4-150300.8.25.2, locale-formula-0.3-150300.3.3.2, py27-compat-salt-3000.3-150300.7.7.26.2, python-urlgrabber-3.10.2.1py2_3-150300.3.3.2, spacecmd-4.2.20-150300.4.30.2, spacewalk-backend-4.2.25-150300.4.32.4, spacewalk-client-tools-4.2.21-150300.4.27.3, spacewalk-java-4.2.43-150300.3.48.2, spacewalk-utils-4.2.18-150300.3.21.2, spacewalk-web-4.2.30-150300.3.30.3, susemanager-4.2.38-150300.3.44.3, suseman
8.2, spacewalk-utils-4.2.18-150300.3.21.2, spacewalk-web-4.2.30-150300.3.30.3, susemanager-4.2.38-150300.3.44.3, susemanager-doc-indexes-4.2-150300.12.36.3, susemanager-docs_en-4.2-150300.12.36.2, susemanager-schema-4.2.25-150300.3.30.3, susemanager-sls versions prior to 4.2.28. SUSE Linux Enterprise Module for SUSE Manager Server 4.3 spacewalk-java versions prior to 4.3.39. SUSE Manager Server 4.2 release-notes-susemanager versions prior to 4.2.10. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.suse.com/show_bug.cgi?id=1204716
CVE ID: CVE-2022-43754 State: PUBLISHED Published: 2022-11-10T07:30:18.906Z Last Updated: 2025-04-30T19:54:37.083Z Severity: LOW (CVSS 2.6 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N) Vendors: SUSE Products: SUSE Linux Enterprise Module for SUSE Manager Server 4.2, SUSE Linux Enterprise Module for SUSE Manager Server 4.3, SUSE Manager Server 4.2 Problem Types: CWE-79 Description: An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in spacewalk/Uyuni of SUSE Linux Enterprise Module for SUSE Manager Server 4.2, SUSE Linux Enterprise Module for SUSE Manager Server 4.3, SUSE Manager Server 4.2 allows remote attackers to embed Javascript code via
erprise Module for SUSE Manager Server 4.3, SUSE Manager Server 4.2 allows remote attackers to embed Javascript code via /rhn/audit/scap/Search.do This issue affects: SUSE Linux Enterprise Module for SUSE Manager Server 4.2 hub-xmlrpc-api-0.7-150300.3.9.2, inter-server-sync-0.2.4-150300.8.25.2, locale-formula-0.3-150300.3.3.2, py27-compat-salt-3000.3-150300.7.7.26.2, python-urlgrabber-3.10.2.1py2_3-150300.3.3.2, spacecmd-4.2.20-150300.4.30.2, spacewalk-backend-4.2.25-150300.4.32.4, spacewalk-client-tools-4.2.21-150300.4.27.3, spacewalk-java-4.2.43-150300.3.48.2, spacewalk-utils-4.2.18-150300.3.21.2, spacewalk-web-4.2.30-150300.3.30.3, susemanager-4.2.38-150300.3.44.3, susemanager-doc-indexes
tils-4.2.18-150300.3.21.2, spacewalk-web-4.2.30-150300.3.30.3, susemanager-4.2.38-150300.3.44.3, susemanager-doc-indexes-4.2-150300.12.36.3, susemanager-docs_en-4.2-150300.12.36.2, susemanager-schema-4.2.25-150300.3.30.3, susemanager-sls versions prior to 4.2.28. SUSE Linux Enterprise Module for SUSE Manager Server 4.3 spacewalk-java versions prior to 4.3.39. SUSE Manager Server 4.2 release-notes-susemanager versions prior to 4.2.10. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.suse.com/show_bug.cgi?id=1204741
CVE ID: CVE-2022-43755 State: PUBLISHED Published: 2023-02-07T00:00:00.000Z Last Updated: 2025-03-25T15:37:45.361Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H) Vendors: SUSE Products: Rancher Problem Types: CWE-331 Description: A Insufficient Entropy vulnerability in SUSE Rancher allows attackers that gained knowledge of the cattle-token to continue abusing this even after the token was renewed. This issue affects: SUSE Rancher Rancher versions prior to 2.6.10; Rancher versions prior to 2.7.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.suse.com/show_bug.cgi?id=1205297
CVE ID: CVE-2022-43756 State: PUBLISHED Published: 2023-02-07T00:00:00.000Z Last Updated: 2025-03-25T15:37:21.661Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H) Vendors: SUSE Products: Rancher Problem Types: CWE-74 Description: A Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in SUSE Rancher allows remote attackers to cause denial of service by supplying specially crafted git credentials. This issue affects: SUSE Rancher wrangler version 0.7.3 and prior versions; wrangler version 0.8.4 and prior versions; wrangler version 1.0.0 and prior versions. Additional Analyst Notes: - CVE Program Container: -
8.4 and prior versions; wrangler version 1.0.0 and prior versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.suse.com/show_bug.cgi?id=1205296
CVE ID: CVE-2022-43757 State: PUBLISHED Published: 2023-02-07T00:00:00.000Z Last Updated: 2025-03-25T15:33:37.242Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: SUSE Products: Rancher Problem Types: CWE-312 Description: A Cleartext Storage of Sensitive Information vulnerability in SUSE Rancher allows users on managed clusters to gain access to credentials. The impact depends on the credentials exposed This issue affects: SUSE Rancher Rancher versions prior to 2.5.17; Rancher versions prior to 2.6.10; Rancher versions prior to 2.7.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.suse.com/show_bu
itional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.suse.com/show_bug.cgi?id=1205295
CVE ID: CVE-2022-43758 State: PUBLISHED Published: 2023-02-07T00:00:00.000Z Last Updated: 2025-03-25T15:27:31.285Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H) Vendors: SUSE Products: Rancher Problem Types: CWE-78 Description: A Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in SUSE Rancher allows code execution for user with the ability to add an untrusted Helm catalog or modifying the URL configuration used to download KDM (only admin users by default) This issue affects: SUSE Rancher Rancher versions prior to 2.5.17; Rancher versions prior to 2.6.10; Rancher versions prior to 2.7.1. Additional Analyst Note
her versions prior to 2.5.17; Rancher versions prior to 2.6.10; Rancher versions prior to 2.7.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.suse.com/show_bug.cgi?id=1205294