Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ed when a legitimate user attempts to upload, copy, download, or delete an existing configuration (Administrative Services). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-062-01
CVE ID: CVE-2022-24916 State: PUBLISHED Published: 2022-02-10T19:07:31 Last Updated: 2024-08-03T04:29:01.657Z Vendors: n/a Products: n/a Problem Types: n/a Description: Optimism before @eth-optimism/l2geth@0.5.11 allows economic griefing because a balance is duplicated upon contract self-destruction. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ethereum-optimism/optimism/compare/%40eth-optimism%2Fl2geth%400.5.10...%40eth-optimism%2Fl2geth%400.5.11 - https://www.saurik.com/optimism.html - https://github.com/ethereum-optimism/optimism/pull/2146 - https://optimismpbc.medium.com/disclosure-fixing-a-critical-bug-in-optimisms-geth-fork-a836ebdf7c94 - https://
ll/2146 - https://optimismpbc.medium.com/disclosure-fixing-a-critical-bug-in-optimisms-geth-fork-a836ebdf7c94 - https://news.ycombinator.com/item?id=30289240
CVE ID: CVE-2022-24917 State: PUBLISHED Published: 2022-03-09T19:30:28.388Z Last Updated: 2025-11-03T21:46:08.154Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: Zabbix Products: Frontend Problem Types: CWE-79 Description: An authenticated user can create a link with reflected Javascript code inside it for services’ page and send it to other users. The payload can be executed only with a known CSRF token value of the victim, which is changed periodically and is difficult to predict. Malicious code has access to all the same objects as the rest of the web page and can make arbitrary modifications to the contents of the page being displayed to a victim during so
t of the web page and can make arbitrary modifications to the contents of the page being displayed to a victim during social engineering attacks. Additional Analyst Notes: - CVE Program Container: References: - https://support.zabbix.com/browse/ZBX-20680 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2V4N22R3QVTYAJMWFK2U2O6QXAZYM35Z/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SWDZONUHDYKBXTAIAGHSYQDEGORD2QT7/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QWP6UBFA5T6MOQPY2VDUG5YAJBFPYRFF/ - https://lists.debian.org/debian-lts-announce
ounce%40lists.fedoraproject.org/message/QWP6UBFA5T6MOQPY2VDUG5YAJBFPYRFF/ - https://lists.debian.org/debian-lts-announce/2022/04/msg00011.html - https://lists.debian.org/debian-lts-announce/2023/04/msg00013.html
CVE ID: CVE-2022-24918 State: PUBLISHED Published: 2022-03-09T19:30:29.711Z Last Updated: 2025-11-03T21:46:09.598Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: Zabbix Products: Frontend Problem Types: CWE-79 Description: An authenticated user can create a link with reflected Javascript code inside it for items’ page and send it to other users. The payload can be executed only with a known CSRF token value of the victim, which is changed periodically and is difficult to predict. Malicious code has access to all the same objects as the rest of the web page and can make arbitrary modifications to the contents of the page being displayed to a victim during socia
f the web page and can make arbitrary modifications to the contents of the page being displayed to a victim during social engineering attacks. Additional Analyst Notes: - CVE Program Container: References: - https://support.zabbix.com/browse/ZBX-20680 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2V4N22R3QVTYAJMWFK2U2O6QXAZYM35Z/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SWDZONUHDYKBXTAIAGHSYQDEGORD2QT7/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QWP6UBFA5T6MOQPY2VDUG5YAJBFPYRFF/
CVE ID: CVE-2022-24919 State: PUBLISHED Published: 2022-03-09T19:30:31.234Z Last Updated: 2025-11-03T21:46:11.096Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: Zabbix Products: Frontend Problem Types: CWE-79 Description: An authenticated user can create a link with reflected Javascript code inside it for graphs’ page and send it to other users. The payload can be executed only with a known CSRF token value of the victim, which is changed periodically and is difficult to predict. Malicious code has access to all the same objects as the rest of the web page and can make arbitrary modifications to the contents of the page being displayed to a victim during soci
of the web page and can make arbitrary modifications to the contents of the page being displayed to a victim during social engineering attacks. Additional Analyst Notes: - CVE Program Container: References: - https://support.zabbix.com/browse/ZBX-20680 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2V4N22R3QVTYAJMWFK2U2O6QXAZYM35Z/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SWDZONUHDYKBXTAIAGHSYQDEGORD2QT7/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QWP6UBFA5T6MOQPY2VDUG5YAJBFPYRFF/ - https://lists.debian.org/debian-lts-announce/2
nce%40lists.fedoraproject.org/message/QWP6UBFA5T6MOQPY2VDUG5YAJBFPYRFF/ - https://lists.debian.org/debian-lts-announce/2022/04/msg00011.html - https://lists.debian.org/debian-lts-announce/2023/04/msg00013.html
CVE ID: CVE-2022-24921 State: PUBLISHED Published: 2022-03-05T00:00:00 Last Updated: 2024-08-03T04:29:01.519Z Vendors: n/a Products: n/a Problem Types: n/a Description: regexp.Compile in Go before 1.16.15 and 1.17.x before 1.17.8 allows stack exhaustion via a deeply nested expression. Additional Analyst Notes: - CVE Program Container: References: - https://groups.google.com/g/golang-announce/c/RP1hfrBYVuk - https://security.netapp.com/advisory/ntap-20220325-0010/ - https://lists.debian.org/debian-lts-announce/2022/04/msg00017.html - https://lists.debian.org/debian-lts-announce/2022/04/msg00018.html - https://security.gentoo.org/glsa/202208-02 - https://cert-portal.siemens.com/productcert/pdf
nce/2022/04/msg00018.html - https://security.gentoo.org/glsa/202208-02 - https://cert-portal.siemens.com/productcert/pdf/ssa-744259.pdf - https://lists.debian.org/debian-lts-announce/2023/04/msg00021.html
CVE ID: CVE-2022-24923 State: PUBLISHED Published: 2022-02-11T17:40:23 Last Updated: 2024-08-03T04:29:00.709Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Samsung Mobile Products: SearchWidget Problem Types: CWE-284 Description: Improper access control vulnerability in Samsung SearchWidget prior to versions 2.3.00.6 in China models allows untrusted applications to load arbitrary URL and local files in webview. Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=2
CVE ID: CVE-2022-24924 State: PUBLISHED Published: 2022-02-11T17:40:24 Last Updated: 2024-08-03T04:29:00.730Z Severity: LOW (CVSS 2.2 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: Samsung Mobile Products: LiveWallpaper Problem Types: CWE-284 Description: An improper access control in LiveWallpaperService prior to versions 3.0.9.0 allows to create a specific named system directory without a proper permission. Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=2
CVE ID: CVE-2022-24925 State: PUBLISHED Published: 2022-02-11T17:40:25 Last Updated: 2024-08-03T04:29:01.540Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: Samsung Mobile Products: Samsung Mobile Devices Problem Types: CWE-20 Description: Improper input validation vulnerability in SettingsProvider prior to Android S(12) allows privileged attackers to trigger a permanent denial of service attack on a victim's devices. Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=2
CVE ID: CVE-2022-24926 State: PUBLISHED Published: 2022-02-11T17:40:26 Last Updated: 2024-08-03T04:29:01.659Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Samsung Mobile Products: SmartTagPlugin Problem Types: CWE-20 Description: Improper input validation vulnerability in SmartTagPlugin prior to version 1.2.15-6 allows privileged attackers to trigger a XSS on a victim's devices. Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=2
CVE ID: CVE-2022-24927 State: PUBLISHED Published: 2022-02-11T17:40:26 Last Updated: 2024-08-03T04:29:00.685Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L) Vendors: Samsung Mobile Products: Samsung Video Player Problem Types: CWE-269 Description: Improper privilege management vulnerability in Samsung Video Player prior to version 7.3.15.30 allows attackers to execute video files without permission. Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=2
CVE ID: CVE-2022-24928 State: PUBLISHED Published: 2022-03-08T13:46:13 Last Updated: 2024-08-03T04:29:01.666Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: Samsung Mobile Products: Samsung Mobile Devices Problem Types: CWE-815 Description: Security misconfiguration of RKP in kernel prior to SMR Mar-2022 Release 1 allows a system not to be protected by RKP. Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=3
CVE ID: CVE-2022-24929 State: PUBLISHED Published: 2022-03-08T13:46:21 Last Updated: 2024-08-03T04:29:00.656Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: Samsung Mobile Products: Samsung Mobile Devices Problem Types: CWE-926 Description: Unprotected Activity in AppLock prior to SMR Mar-2022 Release 1 allows attacker to change the list of locked app without authentication. Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=3
CVE ID: CVE-2022-24930 State: PUBLISHED Published: 2022-03-08T13:46:25 Last Updated: 2024-08-03T04:29:01.547Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: Samsung Mobile Products: Samsung Wearable Devices Problem Types: CWE-284 Description: An Improper access control vulnerability in StRetailModeReceiver in Wear OS 3.0 prior to Firmware update MAR-2022 Release allows untrusted applications to reset default app settings without a proper permission Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=3
CVE ID: CVE-2022-24931 State: PUBLISHED Published: 2022-03-08T13:46:31 Last Updated: 2024-08-03T04:29:01.470Z Severity: HIGH (CVSS 7.9 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L) Vendors: Samsung Mobile Products: Samsung Mobile Devices Problem Types: CWE-269 Description: Improper access control vulnerability in dynamic receiver in ApkInstaller prior to SMR MAR-2022 Release allows unauthorized attackers to execute arbitrary activity without a proper permission Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=3
CVE ID: CVE-2022-24932 State: PUBLISHED Published: 2022-03-08T13:46:36 Last Updated: 2024-08-03T04:29:01.593Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: Samsung Mobile Products: Samsung Mobile Devices, Samsung Clould Problem Types: CWE-424 Description: Improper Protection of Alternate Path vulnerability in Setup wizard process prior to SMR Mar-2022 Release 1 allows physical attacker package installation before finishing Setup wizard. Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=3
CVE ID: CVE-2022-24934 State: PUBLISHED Published: 2022-03-23T21:19:54 Last Updated: 2024-08-03T04:29:01.541Z Vendors: n/a Products: n/a Problem Types: n/a Description: wpsupdater.exe in Kingsoft WPS Office through 11.2.0.10382 allows remote code execution by modifying HKEY_CURRENT_USER in the registry. Additional Analyst Notes: - CVE Program Container: References: - https://www.wps.com - https://decoded.avast.io/luigicamastra/operation-dragon-castling-apt-group-targeting-betting-companies/
CVE ID: CVE-2022-24935 State: PUBLISHED Published: 2022-04-28T12:42:11 Last Updated: 2024-08-03T04:29:01.644Z Vendors: n/a Products: n/a Problem Types: n/a Description: Lexmark products through 2022-02-10 have Incorrect Access Control. Additional Analyst Notes: - CVE Program Container: References: - https://lexmark.com - https://publications.lexmark.com/publications/security-alerts/CVE-2022-24935.pdf
CVE ID: CVE-2022-24936 State: PUBLISHED Published: 2022-11-02T17:25:38.758Z Last Updated: 2025-05-02T16:14:05.273Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H) Vendors: silabs.com Products: Gecko Bootloader Problem Types: CWE-119 Description: Out-of-Bounds error in GBL parser in Silicon Labs Gecko Bootloader version 4.0.1 and earlier allows attacker to overwrite flash Sign key and OTA decryption key via malicious bootloader upgrade. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://community.silabs.com/sfc/servlet.shepherd/document/download/0698Y00000Gdop4QAB?operationContext=S1 - https://github.com/SiliconLabs/gecko_s
m/sfc/servlet.shepherd/document/download/0698Y00000Gdop4QAB?operationContext=S1 - https://github.com/SiliconLabs/gecko_sdk/blame/2e82050dc8823c9fe0e8908c1b2666fb83056230/platform/bootloader/core/btl_bootload.c
CVE ID: CVE-2022-24937 State: PUBLISHED Published: 2022-11-14T17:22:55.243Z Last Updated: 2025-04-30T18:20:47.128Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Silicon Labs Products: Ember ZNet Problem Types: CWE-119 Description: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Silicon Labs Ember ZNet allows Overflow Buffers. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://siliconlabs.lightning.force.com/sfc/servlet.shepherd/document/download/0698Y00000HbLj2QAF?operationContext=S1 - https://github.com/SiliconLabs/gecko_sdk
CVE ID: CVE-2022-24938 State: PUBLISHED Published: 2022-11-14T17:37:05.048Z Last Updated: 2025-04-30T18:21:11.903Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: silabs.com Products: Ember ZNet Problem Types: CWE-119 Description: A malformed packet causes a stack overflow in the Ember ZNet stack. This causes an assert which leads to a reset, immediately clearing the error. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://siliconlabs.lightning.force.com/sfc/servlet.shepherd/document/download/0698Y00000HbLj2QAF?operationContext=S1 - https://github.com/SiliconLabs/gecko_sdk
CVE ID: CVE-2022-24939 State: PUBLISHED Published: 2022-11-17T23:35:55.522Z Last Updated: 2025-04-29T15:42:22.788Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: silabs.com Products: Ember ZNet Problem Types: CWE-119 Description: A malformed packet containing an invalid destination address, causes a stack overflow in the Ember ZNet stack. This causes an assert which leads to a reset, immediately clearing the error. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/SiliconLabs/gecko_sdk - https://siliconlabs.lightning.force.com/sfc/servlet.shepherd/document/download/0698Y00000IWDCwQAP?operationContex
_sdk - https://siliconlabs.lightning.force.com/sfc/servlet.shepherd/document/download/0698Y00000IWDCwQAP?operationContext=S1
CVE ID: CVE-2022-24940 State: REJECTED Published: N/A Last Updated: 2023-05-12T00:00:00 Description: No description available.
CVE ID: CVE-2022-24941 State: REJECTED Published: N/A Last Updated: 2023-05-12T00:00:00 Description: No description available.
CVE ID: CVE-2022-24942 State: PUBLISHED Published: 2022-11-02T21:04:45.822Z Last Updated: 2025-05-05T13:43:26.671Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) Vendors: silabs.com Products: Gecko Platform Problem Types: CWE-122 Description: Heap based buffer overflow in HTTP Server functionality in Micrium uC-HTTP 3.01.01 allows remote code execution via HTTP request. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/SiliconLabs/gecko_sdk/blame/v4.1.1/platform/micrium_os/net/source/http/server/http_server_req.c - https://community.silabs.com/sfc/servlet.shepherd/document/download/0698Y00000KlMPOQA3?opera
/server/http_server_req.c - https://community.silabs.com/sfc/servlet.shepherd/document/download/0698Y00000KlMPOQA3?operationContext=S1
CVE ID: CVE-2022-24943 State: REJECTED Published: N/A Last Updated: 2023-05-12T00:00:00 Description: No description available.
CVE ID: CVE-2022-24944 State: REJECTED Published: N/A Last Updated: 2023-05-12T00:00:00 Description: No description available.
CVE ID: CVE-2022-24945 State: REJECTED Published: N/A Last Updated: 2022-11-10T00:00:00 Description: No description available.
CVE ID: CVE-2022-24946 State: PUBLISHED Published: 2022-06-15T20:18:35 Last Updated: 2024-08-03T04:29:01.628Z Vendors: n/a Products: Mitsubishi Electric MELSEC iQ-R Series R12CCPU-V; Mitsubishi Electric MELSEC-Q Series Q03UDECPU; Mitsubishi Electric MELSEC-Q Series Q04/06/10/13/20/26/50/100UDEHCPU; Mitsubishi Electric MELSEC-Q Series Q03/04/06/13/26UDVCPU; Mitsubishi Electric MELSEC-Q Series Q04/06/13/26UDPVCPU; Mitsubishi Electric MELSEC-Q Series Q12DCCPU-V; Mitsubishi Electric MELSEC-Q Series Q24DHCCPU-V(G); Mitsubishi Electric MELSEC-Q Series Q24/26DHCCPU-LS; Mitsubishi Electric MELSEC-L series L02/06/26CPU(-P); Mitsubishi Electric MELSEC-L series L26CPU-(P)BT; Mitsubishi Electric MELIPC
Electric MELSEC-L series L02/06/26CPU(-P); Mitsubishi Electric MELSEC-L series L26CPU-(P)BT; Mitsubishi Electric MELIPC Series MI5122-VW Problem Types: Improper Resource Locking Description: Improper Resource Locking vulnerability in Mitsubishi Electric MELSEC iQ-R Series R12CCPU-V firmware versions "16" and prior, Mitsubishi Electric MELSEC-Q Series Q03UDECPU the first 5 digits of serial No. "24061" and prior, Mitsubishi Electric MELSEC-Q Series Q04/06/10/13/20/26/50/100UDEHCPU the first 5 digits of serial No. "24061" and prior, Mitsubishi Electric MELSEC-Q Series Q03/04/06/13/26UDVCPU the first 5 digits of serial number "24051" and prior, Mitsubishi Electric MELSEC-Q Series Q04/06/13/26UDP
6/13/26UDVCPU the first 5 digits of serial number "24051" and prior, Mitsubishi Electric MELSEC-Q Series Q04/06/13/26UDPVCPU the first 5 digits of serial number "24051" and prior, Mitsubishi Electric MELSEC-Q Series Q12DCCPU-V all versions, Mitsubishi Electric MELSEC-Q Series Q24DHCCPU-V(G) all versions, Mitsubishi Electric MELSEC-Q Series Q24/26DHCCPU-LS all versions, Mitsubishi Electric MELSEC-L series L02/06/26CPU(-P) the first 5 digits of serial number "24051" and prior, Mitsubishi Electric MELSEC-L series L26CPU-(P)BT the first 5 digits of serial number "24051" and prior and Mitsubishi Electric MELIPC Series MI5122-VW firmware versions "05" and prior allows a remote unauthenticated atta
or and Mitsubishi Electric MELIPC Series MI5122-VW firmware versions "05" and prior allows a remote unauthenticated attacker to cause a denial of service (DoS) condition in Ethernet communications by sending specially crafted packets. A system reset of the products is required for recovery. Additional Analyst Notes: - CVE Program Container: References: - https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-007_en.pdf - https://jvn.jp/vu/JVNVU90895626/index.html - https://www.cisa.gov/uscert/ics/advisories/icsa-22-172-01
CVE ID: CVE-2022-24947 State: PUBLISHED Published: 2022-02-25T08:30:18 Last Updated: 2024-08-03T04:29:01.578Z Vendors: Apache Software Foundation Products: Apache JSPWiki Problem Types: CSRF Account Takeover Description: Apache JSPWiki user preferences form is vulnerable to CSRF attacks, which can lead to account takeover. Apache JSPWiki users should upgrade to 2.11.2 or later. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread/txrgykjkpt80t57kzpbjo8kfrv8ss02c - http://www.openwall.com/lists/oss-security/2022/02/25/1
CVE ID: CVE-2022-24948 State: PUBLISHED Published: 2022-02-25T08:30:19 Last Updated: 2024-08-03T04:29:01.128Z Vendors: Apache Software Foundation Products: Apache JSPWiki Problem Types: Cross-site scripting vulnerability on User Preferences screen Description: A carefully crafted user preferences for submission could trigger an XSS vulnerability on Apache JSPWiki, related to the user preferences screen, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. Apache JSPWiki users should upgrade to 2.11.2 or later. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread/86p0yzopc4
.2 or later. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread/86p0yzopc4mw2h5bkwpt927b2c8tfq3b - http://www.openwall.com/lists/oss-security/2022/02/25/2
CVE ID: CVE-2022-24949 State: PUBLISHED Published: 2022-08-16T00:30:36 Last Updated: 2024-08-03T04:29:01.780Z Vendors: Jason Gauci Products: Eternal Terminal Problem Types: CWE-362 Description: A privilege escalation to root exists in Eternal Terminal prior to version 6.2.0. This is due to the combination of a race condition, buffer overflow, and logic bug all in PipeSocketHandler::listen(). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/MisterTea/EternalTerminal/commit/900348bb8bc96e1c7ba4888ac8480f643c43d3c3 - https://github.com/metaredteam/external-disclosures/security/advisories/GHSA-hxg8-4r3q-p9rv
CVE ID: CVE-2022-24950 State: PUBLISHED Published: 2022-08-16T00:00:00 Last Updated: 2024-08-03T04:29:01.530Z Vendors: Jason Gauci Products: Eternal Terminal Problem Types: CWE-362 Description: A race condition exists in Eternal Terminal prior to version 6.2.0 that allows an authenticated attacker to hijack other users' SSH authorization socket, enabling the attacker to login to other systems as the targeted users. The bug is in UserTerminalRouter::getInfoForId(). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/MisterTea/EternalTerminal/commit/900348bb8bc96e1c7ba4888ac8480f643c43d3c3 - https://github.com/metaredteam/external-disclosures/security/advisories
ommit/900348bb8bc96e1c7ba4888ac8480f643c43d3c3 - https://github.com/metaredteam/external-disclosures/security/advisories/GHSA-85gw-pchc-4rf3 - http://www.openwall.com/lists/oss-security/2023/02/16/1
CVE ID: CVE-2022-24951 State: PUBLISHED Published: 2022-08-16T00:00:00 Last Updated: 2024-08-03T04:29:01.505Z Vendors: Jason Gauci Products: Eternal Terminal Problem Types: CWE-362 Description: A race condition exists in Eternal Terminal prior to version 6.2.0 which allows a local attacker to hijack Eternal Terminal's IPC socket, enabling access to Eternal Terminal clients which attempt to connect in the future. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/metaredteam/external-disclosures/security/advisories/GHSA-546v-59j5-g95q - https://github.com/MisterTea/EternalTerminal/releases/tag/et-v6.2.0 - http://www.openwall.com/lists/oss-security/2023/02/16/1