Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-32136 State: PUBLISHED Published: 2022-06-24T07:46:18.799994Z Last Updated: 2024-09-16T17:58:43.646Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: CODESYS Products: Runtime Toolkit, PLCWinNT Problem Types: CWE-824 Description: In multiple CODESYS products, a low privileged remote attacker may craft a request that cause a read access to an uninitialized pointer, resulting in a denial-of-service. User interaction is not required. Additional Analyst Notes: - CVE Program Container: References: - https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=17139&token=ec67d15a433b61c77154166c20c78036540cacb0&download=
CVE ID: CVE-2022-32137 State: PUBLISHED Published: 2022-06-24T07:46:20.466345Z Last Updated: 2024-09-16T21:04:08.115Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: CODESYS Products: Runtime Toolkit, PLCWinNT Problem Types: CWE-122 Description: In multiple CODESYS products, a low privileged remote attacker may craft a request, which may cause a heap-based buffer overflow, resulting in a denial-of-service condition or memory overwrite. User interaction is not required. Additional Analyst Notes: - CVE Program Container: References: - https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=17139&token=ec67d15a433b61c77154166c20c78036540cacb0&download=
CVE ID: CVE-2022-32138 State: PUBLISHED Published: 2022-06-24T07:46:21.898779Z Last Updated: 2024-09-17T01:47:02.194Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: CODESYS Products: Runtime Toolkit, PLCWinNT Problem Types: CWE-194 Description: In multiple CODESYS products, a remote attacker may craft a request which may cause an unexpected sign extension, resulting in a denial-of-service condition or memory overwrite. Additional Analyst Notes: - CVE Program Container: References: - https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=17139&token=ec67d15a433b61c77154166c20c78036540cacb0&download=
CVE ID: CVE-2022-32139 State: PUBLISHED Published: 2022-06-24T07:46:23.482737Z Last Updated: 2024-09-16T16:13:22.976Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: CODESYS Products: Runtime Toolkit, PLCWinNT Problem Types: CWE-125 Description: In multiple CODESYS products, a low privileged remote attacker may craft a request, which cause an out-of-bounds read, resulting in a denial-of-service condition. User Interaction is not required. Additional Analyst Notes: - CVE Program Container: References: - https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=17139&token=ec67d15a433b61c77154166c20c78036540cacb0&download=
CVE ID: CVE-2022-32140 State: PUBLISHED Published: 2022-06-24T07:46:25.218250Z Last Updated: 2024-09-16T19:35:27.161Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: CODESYS Products: Runtime Toolkit, PLCWinNT Problem Types: CWE-120 Description: Multiple CODESYS products are affected to a buffer overflow.A low privileged remote attacker may craft a request, which can cause a buffer copy without checking the size of the service, resulting in a denial-of-service condition. User Interaction is not required. Additional Analyst Notes: - CVE Program Container: References: - https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=17139&token=ec67d15a433b61c77154
ram Container: References: - https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=17139&token=ec67d15a433b61c77154166c20c78036540cacb0&download=
CVE ID: CVE-2022-32141 State: PUBLISHED Published: 2022-06-24T07:46:26.865644Z Last Updated: 2024-09-16T17:27:44.290Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: CODESYS Products: Runtime Toolkit, PLCWinNT Problem Types: CWE-126 Description: Multiple CODESYS Products are prone to a buffer over read. A low privileged remote attacker may craft a request with an invalid offset, which can cause an internal buffer over-read, resulting in a denial-of-service condition. User interaction is not required. Additional Analyst Notes: - CVE Program Container: References: - https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=17139&token=ec67d15a433b61c77154166c
Container: References: - https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=17139&token=ec67d15a433b61c77154166c20c78036540cacb0&download=
CVE ID: CVE-2022-32142 State: PUBLISHED Published: 2022-06-24T07:46:28.408653Z Last Updated: 2024-09-17T01:00:49.177Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) Vendors: CODESYS Products: Runtime Toolkit, PLCWinNT Problem Types: CWE-823 Description: Multiple CODESYS Products are prone to a out-of bounds read or write access. A low privileged remote attacker may craft a request with invalid offset, which can cause an out-of-bounds read or write access, resulting in denial-of-service condition or local memory overwrite, which can lead to a change of local files. User interaction is not required. Additional Analyst Notes: - CVE Program Container: References: - https:
f local files. User interaction is not required. Additional Analyst Notes: - CVE Program Container: References: - https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=17139&token=ec67d15a433b61c77154166c20c78036540cacb0&download=
CVE ID: CVE-2022-32143 State: PUBLISHED Published: 2022-06-24T07:46:30.133019Z Last Updated: 2024-09-16T17:28:17.867Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: CODESYS Products: Runtime Toolkit, PLCWinNT Problem Types: CWE-552 Description: In multiple CODESYS products, file download and upload function allows access to internal files in the working directory e.g. firmware files of the PLC. All requests are processed on the controller only if no level 1 password is configured on the controller or if remote attacker has previously successfully authenticated himself to the controller. A successful Attack may lead to a denial of service, change of local file
fully authenticated himself to the controller. A successful Attack may lead to a denial of service, change of local files, or drain of confidential Information. User interaction is not required Additional Analyst Notes: - CVE Program Container: References: - https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=17139&token=ec67d15a433b61c77154166c20c78036540cacb0&download=
CVE ID: CVE-2022-32144 State: PUBLISHED Published: 2024-12-20T01:52:28.878Z Last Updated: 2024-12-20T17:11:36.175Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H) Vendors: Huawei Products: CV81-WDM FW Problem Types: CWE-20 Description: There is an insufficient input verification vulnerability in Huawei product. Successful exploitation of this vulnerability may lead to service abnormal. (Vulnerability ID: HWPSIRT-2022-76192) This vulnerability has been assigned a Common Vulnerabilities and Exposures (CVE) ID: CVE-2022-32144. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20220601-01-66843eb3
CISA ADP Vulnrichment: References: - https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20220601-01-66843eb3-en
CVE ID: CVE-2022-32145 State: PUBLISHED Published: 2022-06-14T09:21:59 Last Updated: 2024-08-03T07:32:55.971Z Vendors: Siemens Products: Teamcenter Active Workspace V5.2, Teamcenter Active Workspace V6.0 Problem Types: CWE-79 Description: A vulnerability has been identified in Teamcenter Active Workspace V5.2 (All versions < V5.2.9), Teamcenter Active Workspace V6.0 (All versions < V6.0.3). A reflected cross-site scripting (XSS) vulnerability exists in the web interface of the affected application that could allow an attacker to execute malicious code by tricking users into accessing a malicious link. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemen
accessing a malicious link. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-401167.pdf
CVE ID: CVE-2022-32147 State: REJECTED Published: N/A Last Updated: 2024-07-02T16:15:15.828Z Description: No description available.
CVE ID: CVE-2022-32148 State: PUBLISHED Published: 2022-08-09T20:18:21 Last Updated: 2024-08-03T07:32:55.971Z Vendors: Go standard library Products: net/http Problem Types: CWE-200: Information Exposure Description: Improper exposure of client IP addresses in net/http before Go 1.17.12 and Go 1.18.4 can be triggered by calling httputil.ReverseProxy.ServeHTTP with a Request.Header map containing a nil value for the X-Forwarded-For header, which causes ReverseProxy to set the client IP as the value of the X-Forwarded-For header. Additional Analyst Notes: - CVE Program Container: References: - https://go.dev/cl/412857 - https://go.googlesource.com/go/+/b2cc0fecc2ccd80e6d5d16542cc684f97b3a9c8a -
er: References: - https://go.dev/cl/412857 - https://go.googlesource.com/go/+/b2cc0fecc2ccd80e6d5d16542cc684f97b3a9c8a - https://go.dev/issue/53423 - https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE - https://pkg.go.dev/vuln/GO-2022-0520
CVE ID: CVE-2022-32149 State: PUBLISHED Published: 2022-10-14T00:00:00.000Z Last Updated: 2025-05-15T20:35:11.868Z Vendors: golang.org/x/text Products: golang.org/x/text/language Problem Types: CWE 400: Uncontrolled Resource Consumption Description: An attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to parse. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://go.dev/issue/56152 - https://go.dev/cl/442235 - https://groups.google.com/g/golang-announce/c/-hjNw559_tE/m/KlGTfid5CAAJ - https://pkg.go.dev/vuln/GO-2022-1059
CVE ID: CVE-2022-32151 State: PUBLISHED Published: 2022-06-15T16:46:07.016591Z Last Updated: 2024-09-16T17:59:24.447Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: Splunk, Inc Products: Splunk Enterprise, Splunk Cloud Platform Problem Types: CWE-295 Description: The httplib and urllib Python libraries that Splunk shipped with Splunk Enterprise did not validate certificates using the certificate authority (CA) certificate stores by default in Splunk Enterprise versions before 9.0 and Splunk Cloud Platform versions before 8.2.2203. Python 3 client libraries now verify server certificates by default and use the appropriate CA certificate stores for each library
lient libraries now verify server certificates by default and use the appropriate CA certificate stores for each library. Apps and add-ons that include their own HTTP libraries are not affected. For Splunk Enterprise, update to Splunk Enterprise version 9.0 and Configure TLS host name validation for Splunk-to-Splunk communications (https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation) to enable the remediation. Additional Analyst Notes: - CVE Program Container: References: - https://www.splunk.com/en_us/product-security/announcements/svd-2022-0601.html - https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation - https:
vd-2022-0601.html - https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation - https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/Updates - https://research.splunk.com/application/splunk_protocol_impersonation_weak_encryption_simplerequest/
CVE ID: CVE-2022-32152 State: PUBLISHED Published: 2022-06-15T16:46:29.133423Z Last Updated: 2024-09-17T02:02:11.058Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Splunk Products: Splunk Enterprise, Splunk Cloud Platform Problem Types: CWE-295 Description: Splunk Enterprise peers in Splunk Enterprise versions before 9.0 and Splunk Cloud Platform versions before 8.2.2203 did not validate the TLS certificates during Splunk-to-Splunk communications by default. Splunk peer communications configured properly with valid certificates were not vulnerable. However, an attacker with administrator credentials could add a peer without a valid certificate and connection
nerable. However, an attacker with administrator credentials could add a peer without a valid certificate and connections from misconfigured nodes without valid certificates did not fail by default. For Splunk Enterprise, update to Splunk Enterprise version 9.0 and Configure TLS host name validation for Splunk-to-Splunk communications (https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation) to enable the remediation. Additional Analyst Notes: - CVE Program Container: References: - https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation - https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/Updates - https://www.s
ty/EnableTLSCertHostnameValidation - https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/Updates - https://www.splunk.com/en_us/product-security/announcements/svd-2022-0602.html - https://research.splunk.com/application/splunk_digital_certificates_infrastructure_version/ - https://research.splunk.com/application/splunk_digital_certificates_lack_of_encryption/ - https://research.splunk.com/application/splunk_protocol_impersonation_weak_encryption_selfsigned/ - https://research.splunk.com/network/splunk_identified_ssl_tls_certificates/
CVE ID: CVE-2022-32153 State: PUBLISHED Published: 2022-06-15T16:48:21.566031Z Last Updated: 2024-09-16T16:43:11.526Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Splunk, Inc Products: Splunk Enterprise, Splunk Cloud Platform Problem Types: CWE-297 Description: Splunk Enterprise peers in Splunk Enterprise versions before 9.0 and Splunk Cloud Platform versions before 8.2.2203 did not validate the TLS certificates during Splunk-to-Splunk communications by default. Splunk peer communications configured properly with valid certificates were not vulnerable. However, an attacker with administrator credentials could add a peer without a valid certificate and conne
t vulnerable. However, an attacker with administrator credentials could add a peer without a valid certificate and connections from misconfigured nodes without valid certificates did not fail by default. For Splunk Enterprise, update to Splunk Enterprise version 9.0 and Configure TLS host name validation for Splunk-to-Splunk communications (https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation) to enable the remediation. Additional Analyst Notes: - CVE Program Container: References: - https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation - https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/Updates - https://
ecurity/EnableTLSCertHostnameValidation - https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/Updates - https://research.splunk.com/application/splunk_digital_certificates_infrastructure_version/ - https://research.splunk.com/application/splunk_digital_certificates_lack_of_encryption/ - https://research.splunk.com/application/splunk_protocol_impersonation_weak_encryption_selfsigned/ - https://research.splunk.com/network/splunk_identified_ssl_tls_certificates/ - https://www.splunk.com/en_us/product-security/announcements/svd-2022-0603.html
CVE ID: CVE-2022-32154 State: PUBLISHED Published: 2022-06-15T16:48:46.918488Z Last Updated: 2024-09-16T20:11:36.885Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N) Vendors: Splunk, Inc Products: Splunk Enterprise, Splunk Cloud Platform Problem Types: CWE-20 Description: Dashboards in Splunk Enterprise versions before 9.0 might let an attacker inject risky search commands into a form token when the token is used in a query in a cross-origin request. The result bypasses SPL safeguards for risky commands. See New capabilities can limit access to some custom and potentially risky commands (https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/SPLsafeguards#New_ca
custom and potentially risky commands (https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/SPLsafeguards#New_capabilities_can_limit_access_to_some_custom_and_potentially_risky_commands) for more information. Note that the attack is browser-based and an attacker cannot exploit it at will. Additional Analyst Notes: - CVE Program Container: References: - https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/Updates - https://www.splunk.com/en_us/product-security/announcements/svd-2022-0604.html - https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/SPLsafeguards#New_capabilities_can_limit_access_to_some_custom_and_potentially_risky_commands - https://research.splunk.com/ap
eguards#New_capabilities_can_limit_access_to_some_custom_and_potentially_risky_commands - https://research.splunk.com/application/splunk_command_and_scripting_interpreter_risky_commands/ - https://research.splunk.com/application/splunk_command_and_scripting_interpreter_risky_spl_mltk/ - https://research.splunk.com/application/splunk_command_and_scripting_interpreter_delete_usage/
CVE ID: CVE-2022-32155 State: PUBLISHED Published: 2022-06-15T16:49:26.618027Z Last Updated: 2024-09-16T20:12:22.106Z Vendors: Splunk, Inc Products: Universal Forwarder Description: In universal forwarder versions before 9.0, management services are available remotely by default. When not required, it introduces a potential exposure, but it is not a vulnerability. If exposed, we recommend each customer assess the potential severity specific to your environment. In 9.0, the universal forwarder now binds the management port to localhost preventing remote logins by default. If management services are not required in versions before 9.0, set disableDefaultPort = true in server.conf OR allowRemot
management services are not required in versions before 9.0, set disableDefaultPort = true in server.conf OR allowRemoteLogin = never in server.conf OR mgmtHostPort = localhost in web.conf. See Configure universal forwarder management security (https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation#Configure_universal_forwarder_management_security) for more information on disabling the remote management services. Additional Analyst Notes: - CVE Program Container: References: - https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/Updates - https://www.splunk.com/en_us/product-security/announcements/svd-2022-0605.html - https://docs.splunk.com/Docum
Updates - https://www.splunk.com/en_us/product-security/announcements/svd-2022-0605.html - https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation#Configure_universal_forwarder_management_security
CVE ID: CVE-2022-32156 State: PUBLISHED Published: 2022-06-14T00:00:00 Last Updated: 2024-08-03T07:32:55.975Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Splunk Products: Splunk Enterprise, Universal Forwarder Problem Types: CWE-295 Description: In Splunk Enterprise and Universal Forwarder versions before 9.0, the Splunk command-line interface (CLI) did not validate TLS certificates while connecting to a remote Splunk platform instance by default. After updating to version 9.0, see Configure TLS host name validation for the Splunk CLI https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation#Configure_TLS_host_name_validat
ps://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation#Configure_TLS_host_name_validation_for_the_Splunk_CLI to enable the remediation. The vulnerability does not affect the Splunk Cloud Platform. At the time of publishing, we have no evidence of exploitation of this vulnerability by external parties. The issue requires conditions beyond the control of a potential bad actor such as a machine-in-the-middle attack. Hence, Splunk rates the complexity of the attack as High. Additional Analyst Notes: - CVE Program Container: References: - https://www.splunk.com/en_us/product-security/announcements/svd-2022-0606.html - https://docs.splunk.com/Documentation/Splunk/
//www.splunk.com/en_us/product-security/announcements/svd-2022-0606.html - https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/Updates - https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation#Configure_TLS_host_name_validation_for_the_Splunk_CLI
CVE ID: CVE-2022-32157 State: PUBLISHED Published: 2022-06-15T16:50:14.702126Z Last Updated: 2024-09-17T02:57:39.248Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Splunk, Inc Products: Splunk Enterprise Problem Types: CWE-306 Description: Splunk Enterprise deployment servers in versions before 9.0 allow unauthenticated downloading of forwarder bundles. Remediation requires you to update the deployment server to version 9.0 and Configure authentication for deployment servers and clients (https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/ConfigDSDCAuthEnhancements#Configure_authentication_for_deployment_servers_and_clients). Once enabled, deployment
curity/ConfigDSDCAuthEnhancements#Configure_authentication_for_deployment_servers_and_clients). Once enabled, deployment servers can manage only Universal Forwarder versions 9.0 and higher. Though the vulnerability does not directly affect Universal Forwarders, remediation requires updating all Universal Forwarders that the deployment server manages to version 9.0 or higher prior to enabling the remediation. Additional Analyst Notes: - CVE Program Container: References: - https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/Updates - https://www.splunk.com/en_us/product-security/announcements/svd-2022-0607.html - https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/ConfigDSDCAu
uct-security/announcements/svd-2022-0607.html - https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/ConfigDSDCAuthEnhancements#Configure_authentication_for_deployment_servers_and_clients - https://research.splunk.com/application/splunk_process_injection_forwarder_bundle_downloads/
CVE ID: CVE-2022-32158 State: PUBLISHED Published: 2022-06-15T16:50:43.633116Z Last Updated: 2024-09-17T02:20:54.385Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Splunk, Inc Products: Splunk Enterprise Problem Types: CWE-284 Description: Splunk Enterprise deployment servers in versions before 8.1.10.1, 8.2.6.1, and 9.0 let clients deploy forwarder bundles to other deployment clients through the deployment server. An attacker that compromised a Universal Forwarder endpoint could use the vulnerability to execute arbitrary code on all other Universal Forwarder endpoints subscribed to the deployment server. Additional Analyst Notes: - CVE Program Container:
r Universal Forwarder endpoints subscribed to the deployment server. Additional Analyst Notes: - CVE Program Container: References: - https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/Updates - https://www.splunk.com/en_us/product-security/announcements/svd-2022-0608.html
CVE ID: CVE-2022-32159 State: PUBLISHED Published: 2022-06-22T17:55:10.378456Z Last Updated: 2024-09-17T03:48:29.941Z Vendors: infogami Products: infogami Problem Types: CWE-79 Description: In openlibrary versions deploy-2016-07-0 through deploy-2021-12-22 are vulnerable to Stored XSS. Additional Analyst Notes: - CVE Program Container: References: - https://www.mend.io/vulnerability-database/CVE-2022-32159 - https://github.com/internetarchive/infogami/pull/195/commits/ccc2141c5fb093870c9e2742c01336ecca8cd12e
CVE ID: CVE-2022-32166 State: PUBLISHED Published: 2022-09-28T09:30:12.924Z Last Updated: 2025-05-21T14:13:43.702Z Vendors: ovs Products: ovs Problem Types: CWE-125 Description: In ovs versions v0.90.0 through v2.5.0 are vulnerable to heap buffer over-read in flow.c. An unsafe comparison of “minimasks” function could lead access to an unmapped region of memory. This vulnerability is capable of crashing the software, memory modification, and possible remote execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mend.io/vulnerability-database/CVE-2022-32166 - https://github.com/cloudbase/ovs/commit/2ed6505555cdcb46f9b1f0329d1491b75290fc