Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-35554 State: PUBLISHED Published: 2022-08-19T22:33:13 Last Updated: 2024-08-03T09:36:44.409Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple reflected XSS vulnerabilities occur when handling error message of BPC SmartVista version 3.28.0 allowing an attacker to execute javascript code at client side. Additional Analyst Notes: - CVE Program Container: References: - http://bpcbt.com - http://smartvista.com - https://tf1t.gitbook.io/mycve/smartvista/smartvista-cardgen/reflected-xss-in-smartvista-cardgen-version-3.28.0-cve-2022-35554
CVE ID: CVE-2022-35555 State: PUBLISHED Published: 2022-08-11T16:35:18 Last Updated: 2024-08-03T09:36:44.410Z Vendors: n/a Products: n/a Problem Types: n/a Description: A command injection vulnerability exists in /goform/exeCommand in Tenda W6 V1.0.0.9(4122), which allows attackers to construct cmdinput parameters for arbitrary command execution. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ilovekeer/IOT/blob/main/Tenda/W6/Injection/exeCommand/README.md
CVE ID: CVE-2022-35557 State: PUBLISHED Published: 2022-08-11T16:37:46 Last Updated: 2024-08-03T09:36:44.413Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stack overflow vulnerability exists in /goform/wifiSSIDget in Tenda W6 V1.0.0.9(4122) version, which can be exploited by attackers to cause a denial of service (DoS) via the index parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ilovekeer/IOT/tree/main/Tenda/W6/stackoverflow/wifiSSIDget
CVE ID: CVE-2022-35558 State: PUBLISHED Published: 2022-08-11T16:38:49 Last Updated: 2024-08-03T09:36:44.396Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stack overflow vulnerability exists in /goform/WifiMacFilterGet in Tenda W6 V1.0.0.9(4122) version, which can be exploited by attackers to cause a denial of service (DoS) via the index parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ilovekeer/IOT/tree/main/Tenda/W6/stackoverflow/WifiMacFilterGet
CVE ID: CVE-2022-35559 State: PUBLISHED Published: 2022-08-11T16:39:56 Last Updated: 2024-08-03T09:36:44.406Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stack overflow vulnerability exists in /goform/setAutoPing in Tenda W6 V1.0.0.9(4122), which allows an attacker to construct ping1 parameters and ping2 parameters for a stack overflow attack. An attacker can use this vulnerability to execute arbitrary code execution. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ilovekeer/IOT/tree/main/Tenda/W6/stackoverflow/formSetAutoPing
CVE ID: CVE-2022-35560 State: PUBLISHED Published: 2022-08-11T16:43:45 Last Updated: 2024-08-03T09:36:44.397Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stack overflow vulnerability exists in /goform/wifiSSIDset in Tenda W6 V1.0.0.9(4122) version, which can be exploited by attackers to cause a denial of service (DoS) via the index parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ilovekeer/IOT/tree/main/Tenda/W6/stackoverflow/wifiSSIDset
CVE ID: CVE-2022-35561 State: PUBLISHED Published: 2022-08-11T16:48:51 Last Updated: 2024-08-03T09:36:44.347Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stack overflow vulnerability exists in /goform/WifiMacFilterSet in Tenda W6 V1.0.0.9(4122) version, which can be exploited by attackers to cause a denial of service (DoS) via the index parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ilovekeer/IOT/tree/main/Tenda/W6/stackoverflow/WifiMacFilterSet
CVE ID: CVE-2022-35569 State: PUBLISHED Published: 2022-07-20T17:45:59 Last Updated: 2024-08-03T09:36:44.399Z Vendors: n/a Products: n/a Problem Types: n/a Description: Blogifier v3.0 was discovered to contain an arbitrary file upload vulnerability at /api/storage/upload/PostImage. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/blogifierdotnet/Blogifier/issues/316
CVE ID: CVE-2022-35572 State: PUBLISHED Published: 2022-09-12T21:17:06 Last Updated: 2024-08-03T09:36:44.355Z Vendors: n/a Products: n/a Problem Types: n/a Description: On Linksys E5350 WiFi Router with firmware version 1.0.00.037 and lower, (and potentially other vendors/devices due to code reuse), the /SysInfo.htm URI does not require a session ID. This web page calls a show_sysinfo function which retrieves WPA passwords, SSIDs, MAC Addresses, serial numbers, WPS Pins, and hardware/firmware versions, and prints this information into the web page. This web page is visible when remote management is enabled. A user who has access to the web interface of the device can extract these secrets. I
when remote management is enabled. A user who has access to the web interface of the device can extract these secrets. If the device has remote management enabled and is connected directly to the internet, this vulnerability is exploitable over the internet without interaction. Additional Analyst Notes: - CVE Program Container: References: - https://willgu.es/?p=76
CVE ID: CVE-2022-35582 State: PUBLISHED Published: 2022-09-13T22:00:19 Last Updated: 2024-08-03T09:36:44.413Z Vendors: n/a Products: n/a Problem Types: n/a Description: Penta Security Systems Inc WAPPLES 4.0.*, 5.0.0.*, 5.0.12.* are vulnerable to Incorrect Access Control. The operating system that WAPPLES runs on has a built-in non-privileged user penta with a predefined password. The password for this user, as well as its existence, is not disclosed in the documentation. Knowing the credentials, attackers can use this feature to gain uncontrolled access to the device and therefore are considered an undocumented possibility for remote control. Additional Analyst Notes: - CVE Program Containe
herefore are considered an undocumented possibility for remote control. Additional Analyst Notes: - CVE Program Container: References: - https://www.pentasecurity.com/product/wapples/ - https://medium.com/%40_sadshade/wapples-web-application-firewall-multiple-vulnerabilities-35bdee52c8fb
CVE ID: CVE-2022-35583 State: PUBLISHED Published: 2022-08-22T00:00:00 Last Updated: 2024-08-03T09:36:44.415Z Vendors: n/a Products: n/a Problem Types: n/a Description: wkhtmlTOpdf 0.12.6 is vulnerable to SSRF which allows an attacker to get initial access into the target's system by injecting iframe tag with initial asset IP address on it's source. This allows the attacker to takeover the whole infrastructure by accessing their internal assets. Additional Analyst Notes: - CVE Program Container: References: - https://wkhtmltopdf.org/ - https://drive.google.com/file/d/1LAmf_6CJLk5qDp0an2s_gVQ0TN2wmht5/view?usp=sharing - https://cyber-guy.gitbook.io/cyber-guys-blog/blogs/initial-access-via-pdf
6CJLk5qDp0an2s_gVQ0TN2wmht5/view?usp=sharing - https://cyber-guy.gitbook.io/cyber-guys-blog/blogs/initial-access-via-pdf-file-silently - http://packetstormsecurity.com/files/171446/wkhtmltopdf-0.12.6-Server-Side-Request-Forgery.html
CVE ID: CVE-2022-35585 State: PUBLISHED Published: 2022-08-12T15:55:56 Last Updated: 2024-08-03T09:36:44.455Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) issue in the ForkCMS version 5.9.3 allows remote attackers to inject JavaScript via the "start_date" Parameter Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/5-other-forkcms/
CVE ID: CVE-2022-35587 State: PUBLISHED Published: 2022-08-12T15:54:50 Last Updated: 2024-08-03T09:36:44.370Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) issue in the Fork version 5.9.3 allows remote attackers to inject JavaScript via the "publish_on_date" Parameter Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/6-other-forkcms/
CVE ID: CVE-2022-35589 State: PUBLISHED Published: 2022-08-12T15:51:00 Last Updated: 2024-08-03T09:36:44.416Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) issue in the Fork version 5.9.3 allows remote attackers to inject JavaScript via the "publish_on_time" Parameter. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/7-other-forkcms/
CVE ID: CVE-2022-35590 State: PUBLISHED Published: 2022-08-12T15:49:23 Last Updated: 2024-08-03T09:36:44.418Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) issue in the ForkCMS version 5.9.3 allows remote attackers to inject JavaScript via the "end_date" Parameter Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/4-other-forkcms/
CVE ID: CVE-2022-35598 State: PUBLISHED Published: 2022-08-18T01:17:34 Last Updated: 2024-08-03T09:36:44.412Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection vulnerability in ConnectionFactoryDAO.java in sazanrjb InventoryManagementSystem 1.0 allows attackers to execute arbitrary SQL commands via parameter username. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sazanrjb/InventoryManagementSystem/issues/14 - https://github.com/sazanrjb/InventoryManagementSystem
CVE ID: CVE-2022-35599 State: PUBLISHED Published: 2022-08-18T01:18:41 Last Updated: 2024-08-03T09:36:44.388Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection vulnerability in Stocks.java in sazanrjb InventoryManagementSystem 1.0 allows attackers to execute arbitrary SQL commands via parameter productcode. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sazanrjb/InventoryManagementSystem/issues/14 - https://github.com/sazanrjb/InventoryManagementSystem
CVE ID: CVE-2022-35601 State: PUBLISHED Published: 2022-08-18T01:21:48 Last Updated: 2024-08-03T09:36:44.402Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection vulnerability in SupplierDAO.java in sazanrjb InventoryManagementSystem 1.0 allows attackers to execute arbitrary SQL commands via parameter searchTxt. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sazanrjb/InventoryManagementSystem/issues/14 - https://github.com/sazanrjb/InventoryManagementSystem
CVE ID: CVE-2022-35602 State: PUBLISHED Published: 2022-08-18T01:23:28 Last Updated: 2024-08-03T09:36:44.450Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection vulnerability in UserDAO.java in sazanrjb InventoryManagementSystem 1.0 allows attackers to execute arbitrary SQL commands via parameter user. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sazanrjb/InventoryManagementSystem/issues/14 - https://github.com/sazanrjb/InventoryManagementSystem
CVE ID: CVE-2022-35603 State: PUBLISHED Published: 2022-08-18T01:24:18 Last Updated: 2024-08-03T09:36:44.409Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection vulnerability in CustomerDAO.java in sazanrjb InventoryManagementSystem 1.0 allows attackers to execute arbitrary SQL commands via parameter searchTxt. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sazanrjb/InventoryManagementSystem/issues/14 - https://github.com/sazanrjb/InventoryManagementSystem
CVE ID: CVE-2022-35604 State: REJECTED Published: N/A Last Updated: 2024-05-06T21:46:12.156514 Description: No description available.
CVE ID: CVE-2022-35605 State: PUBLISHED Published: 2022-08-18T01:26:27 Last Updated: 2024-08-03T09:36:44.399Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection vulnerability in UserDAO.java in sazanrjb InventoryManagementSystem 1.0 allows attackers to execute arbitrary SQL commands via the parameters such as 'users', 'pass', etc. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sazanrjb/InventoryManagementSystem/issues/14 - https://github.com/sazanrjb/InventoryManagementSystem
CVE ID: CVE-2022-35606 State: PUBLISHED Published: 2022-08-18T01:29:16 Last Updated: 2024-08-03T09:36:44.421Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection vulnerability in CustomerDAO.java in sazanrjb InventoryManagementSystem 1.0 allows attackers to execute arbitrary SQL commands via the parameter 'customerCode.' Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sazanrjb/InventoryManagementSystem/issues/14 - https://github.com/sazanrjb/InventoryManagementSystem
CVE ID: CVE-2022-35611 State: PUBLISHED Published: 2022-10-13T00:00:00.000Z Last Updated: 2025-05-15T15:26:38.571Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross-Site Request Forgery (CSRF) in MQTTRoute v3.3 and below allows attackers to create and remove dashboards. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://securityblog101.blogspot.com/2022/10/cve-id-cve-2022-35611.html
CVE ID: CVE-2022-35612 State: PUBLISHED Published: 2022-10-13T00:00:00.000Z Last Updated: 2025-05-15T15:17:59.438Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in MQTTRoute v3.3 and below allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the dashboard name text field. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://securityblog101.blogspot.com/2022/10/cve-id-cve-2022-35612.html
CVE ID: CVE-2022-35613 State: PUBLISHED Published: 2022-11-14T00:00:00.000Z Last Updated: 2025-04-30T19:42:53.294Z Vendors: n/a Products: n/a Problem Types: n/a Description: Konker v2.3.9 was to discovered to contain a Cross-Site Request Forgery (CSRF). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://securityblog101.blogspot.com/2022/10/cve-id-cve-2022-35613.html
CVE ID: CVE-2022-35619 State: PUBLISHED Published: 2022-08-03T14:06:32 Last Updated: 2024-08-03T09:36:44.409Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-LINK DIR-818LW A1:DIR818L_FW105b01 was discovered to contain a remote code execution (RCE) vulnerability via the function ssdpcgi_main. Additional Analyst Notes: - CVE Program Container: References: - https://www.dlink.com/en/security-bulletin/ - https://github.com/1759134370/iot/blob/main/DIR-818L.md
CVE ID: CVE-2022-35620 State: PUBLISHED Published: 2022-08-03T14:06:43 Last Updated: 2024-08-03T09:36:44.392Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-LINK DIR-818LW A1:DIR818L_FW105b01 was discovered to contain a remote code execution (RCE) vulnerability via the function binary.soapcgi_main. Additional Analyst Notes: - CVE Program Container: References: - https://www.dlink.com/en/security-bulletin/ - https://github.com/1759134370/iot/blob/main/DIR-818L.md
CVE ID: CVE-2022-35621 State: PUBLISHED Published: 2022-09-21T18:14:11.000Z Last Updated: 2025-05-28T13:56:30.422Z Vendors: n/a Products: n/a Problem Types: n/a Description: Access control vulnerability in Evoh NFT EvohClaimable contract with sha256 hash code fa2084d5abca91a62ed1d2f1cad3ec318e6a9a2d7f1510a00d898737b05f48ae allows remote attackers to execute fraudulent NFT transfers. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/MacherCS/CVE_Evoh_Contract
CVE ID: CVE-2022-35623 State: PUBLISHED Published: 2022-08-15T16:09:15 Last Updated: 2024-08-03T09:36:44.404Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AC:L/AV:A/A:L/C:H/I:L/PR:L/S:C/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: In Nordic nRF5 SDK for Mesh 5.0, a heap overflow vulnerability can be triggered by sending a series of segmented control packets and access packets with the same SeqAuth Additional Analyst Notes: - CVE Program Container: References: - https://docs.google.com/document/d/1Y3sB5JbyrTIOgvA1h9X6o8pJQBG4PjWF/edit?usp=sharing&ouid=112184420235437308950&rtpof=true&sd=true
CVE ID: CVE-2022-35624 State: PUBLISHED Published: 2022-08-15T16:10:32 Last Updated: 2024-08-03T09:36:44.407Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AC:L/AV:A/A:L/C:H/I:L/PR:L/S:C/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: In Nordic nRF5 SDK for Mesh 5.0, a heap overflow vulnerability can be triggered by sending a series of segmented packets with SegO > SegN Additional Analyst Notes: - CVE Program Container: References: - https://docs.google.com/document/d/1BrgB1bQiL-cMXQGaXJWSSyaZY51Zxomp/edit?usp=sharing&ouid=112184420235437308950&rtpof=true&sd=true
CVE ID: CVE-2022-35628 State: PUBLISHED Published: 2022-07-12T22:01:37 Last Updated: 2024-08-03T09:36:44.409Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection issue was discovered in the lux extension before 17.6.1, and 18.x through 24.x before 24.0.2, for TYPO3. Additional Analyst Notes: - CVE Program Container: References: - https://typo3.org/security/advisory/typo3-ext-sa-2022-014
CVE ID: CVE-2022-35629 State: PUBLISHED Published: 2022-07-29T17:00:21.251524Z Last Updated: 2024-09-16T20:26:44.573Z Vendors: Rapid7 Products: Velociraptor Problem Types: CWE-287 Description: Due to a bug in the handling of the communication between the client and server, it was possible for one client, already registered with their own client ID, to send messages to the server claiming to come from another client ID. This issue was resolved in Velociraptor 0.6.5-2. Additional Analyst Notes: - CVE Program Container: References: - https://www.rapid7.com/blog/post/2022/07/26/cve-2022-35629-35632-velociraptor-multiple-vulnerabilities-fixed/
CVE ID: CVE-2022-35630 State: PUBLISHED Published: 2022-07-29T17:00:33.544112Z Last Updated: 2024-09-17T02:20:37.847Z Vendors: Rapid7 Products: Velociraptor Problem Types: CWE-79 Description: A cross-site scripting (XSS) issue in generating a collection report made it possible for malicious clients to inject JavaScript code into the static HTML file. This issue was resolved in Velociraptor 0.6.5-2. Additional Analyst Notes: - CVE Program Container: References: - https://www.rapid7.com/blog/post/2022/07/26/cve-2022-35629-35632-velociraptor-multiple-vulnerabilities-fixed/
CVE ID: CVE-2022-35631 State: PUBLISHED Published: 2022-07-29T17:00:46.360561Z Last Updated: 2024-09-16T22:20:46.285Z Vendors: Rapid7 Products: Velociraptor Problem Types: CWE-377 Description: On MacOS and Linux, it may be possible to perform a symlink attack by replacing this predictable file name with a symlink to another file and have the Velociraptor client overwrite the other file. This issue was resolved in Velociraptor 0.6.5-2. Additional Analyst Notes: - CVE Program Container: References: - https://www.rapid7.com/blog/post/2022/07/26/cve-2022-35629-35632-velociraptor-multiple-vulnerabilities-fixed/
CVE ID: CVE-2022-35632 State: PUBLISHED Published: 2022-07-29T17:01:01.834546Z Last Updated: 2024-09-16T23:26:36.693Z Vendors: Rapid7 Products: Velociraptor Problem Types: CWE-79 Description: The Velociraptor GUI contains an editor suggestion feature that can display the description field of a VQL function, plugin or artifact. This field was not properly sanitized and can lead to cross-site scripting (XSS). This issue was resolved in Velociraptor 0.6.5-2. Additional Analyst Notes: - CVE Program Container: References: - https://www.rapid7.com/blog/post/2022/07/26/cve-2022-35629-35632-velociraptor-multiple-vulnerabilities-fixed/
CVE ID: CVE-2022-35637 State: PUBLISHED Published: 2022-09-13T20:45:27.233996Z Last Updated: 2024-09-16T19:40:50.184Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/C:N/A:H/I:N/AV:N/UI:N/S:U/PR:L/AC:L/RL:O/RC:C/E:U) Vendors: IBM Products: DB2 for Linux, UNIX and Windows Problem Types: Denial of Service Description: IBM Db2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, 11.1, and 11.5 is vulnerable to a denial of service after entering a malformed SQL statement into the Db2expln tool. IBM X-Force ID: 230823. Additional Analyst Notes: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/6618775 - https://exchange.xforce.ibmcloud.com/vulnerabilities/230823 - https://security.netapp.
.com/support/pages/node/6618775 - https://exchange.xforce.ibmcloud.com/vulnerabilities/230823 - https://security.netapp.com/advisory/ntap-20230921-0003/
CVE ID: CVE-2022-35638 State: PUBLISHED Published: 2023-11-22T04:00:15.625Z Last Updated: 2024-11-21T18:56:11.554Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: IBM Products: Sterling B2B Integrator Problem Types: CWE-352 Description: IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.8 and 6.1.0.0 through 6.1.2.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 230824. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7080104 -
Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7080104 - https://exchange.xforce.ibmcloud.com/vulnerabilities/230824
CVE ID: CVE-2022-35639 State: PUBLISHED Published: 2022-07-26T14:25:39.449708Z Last Updated: 2024-09-16T22:09:50.790Z Severity: HIGH (CVSS 7.5 CVSS:3.0/PR:N/UI:N/A:H/AV:N/S:U/I:N/AC:L/C:N/E:U/RL:O/RC:C) Vendors: IBM Products: Sterling Partner Engagement Manager, Sterling Partner Engagement Manager on Cloud Problem Types: Denial of Service Description: IBM Sterling Partner Engagement Manager 6.1, 6.2, and Cloud 22.2 do not limit the length of a connection which could cause the server to become unresponsive. IBM X-Force ID: 230932. Additional Analyst Notes: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/6606969 - https://exchange.xforce.ibmcloud.com/vulnerabiliti
ainer: References: - https://www.ibm.com/support/pages/node/6606969 - https://exchange.xforce.ibmcloud.com/vulnerabilities/230932
CVE ID: CVE-2022-35640 State: PUBLISHED Published: 2024-07-16T23:05:39.388Z Last Updated: 2024-08-03T09:36:44.407Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: IBM Products: Sterling Partner Engagement Manager Problem Types: CWE-209 Description: IBM Sterling Partner Engagement Manager 6.2.2 could allow a local attacker to obtain sensitive information when a detailed technical error message is returned. IBM X-Force ID: 230933. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7160300 - https://exchange.xforce.ibmcloud.com/vulnerabilities/230933
CVE ID: CVE-2022-35642 State: PUBLISHED Published: 2022-11-03T00:00:00.000Z Last Updated: 2025-05-02T20:20:39.842Z Vendors: n/a Products: IBM InfoSphere Information Server Problem Types: Cross-Site Scripting Description: "IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 227592." Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6829311
CVE ID: CVE-2022-35643 State: PUBLISHED Published: 2022-07-29T14:05:11.503142Z Last Updated: 2024-09-17T00:46:04.288Z Severity: CRITICAL (CVSS 9.1 CVSS:3.0/A:H/UI:N/PR:N/AC:L/C:H/S:U/AV:N/I:N/RL:O/E:U/RC:C) Vendors: IBM Products: PowerVM VIOS Problem Types: Obtain Information Description: IBM PowerVM VIOS 3.1 could allow a remote attacker to tamper with system configuration or cause a denial of service. IBM X-Force ID: 230956. Additional Analyst Notes: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/6607886 - https://exchange.xforce.ibmcloud.com/vulnerabilities/230956