Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-3260 State: PUBLISHED Published: 2022-12-08T00:00:00.000Z Last Updated: 2025-04-23T15:29:37.556Z Vendors: n/a Products: Openshift Problem Types: CWE-1021 Description: The response header has not enabled X-FRAME-OPTIONS, Which helps prevents against Clickjacking attack.. Some browsers would interpret these results incorrectly, allowing clickjacking attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2106780
CVE ID: CVE-2022-3261 State: PUBLISHED Published: 2023-09-15T20:20:18.481Z Last Updated: 2024-09-25T13:40:38.245Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: n/a, Red Hat Products: openstack, Red Hat OpenStack Platform 16.2 Problem Types: CWE-256 Description: A flaw was found in OpenStack. Multiple components show plain-text passwords in /var/log/messages during the OpenStack overcloud update run, leading to a disclosure of sensitive information problem. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2022-3261 - https://bugzilla.redhat.com/show_bug.cgi?id=2128834
CVE ID: CVE-2022-3262 State: PUBLISHED Published: 2022-12-08T00:00:00.000Z Last Updated: 2025-04-23T15:19:14.027Z Vendors: n/a Products: openshift Problem Types: CWE-453 Description: A flaw was found in Openshift. A pod with a DNSPolicy of "ClusterFirst" may incorrectly resolve the hostname based on a service provided. This flaw allows an attacker to supply an incorrect name with the DNS search policy, affecting confidentiality and availability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2128858
CVE ID: CVE-2022-3263 State: PUBLISHED Published: 2022-09-23T18:30:36.700Z Last Updated: 2025-04-16T17:47:16.118Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Measuresoft Products: ScadaPro Server Problem Types: CWE-284 Description: The security descriptor of Measuresoft ScadaPro Server version 6.7 has inconsistent permissions, which could allow a local user with limited privileges to modify the service binary path and start malicious commands with SYSTEM privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-265-01
CVE ID: CVE-2022-3265 State: PUBLISHED Published: 2022-11-09T00:00:00.000Z Last Updated: 2025-05-01T19:26:11.438Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:N) Vendors: GitLab Products: GitLab Problem Types: Improper neutralization of input during web page generation ('cross-site scripting') in GitLab Description: A cross-site scripting issue has been discovered in GitLab CE/EE affecting all versions prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2. It was possible to exploit a vulnerability in setting the labels colour feature which could lead to a stored XSS that allowed attackers to perform arbitrary actions on behalf of victims at client side. Addi
could lead to a stored XSS that allowed attackers to perform arbitrary actions on behalf of victims at client side. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/374976 - https://hackerone.com/reports/1693150 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3265.json
CVE ID: CVE-2022-3266 State: PUBLISHED Published: 2022-12-22T00:00:00.000Z Last Updated: 2025-04-15T15:57:17.191Z Vendors: Mozilla Products: Firefox ESR, Thunderbird, Firefox Problem Types: Out of bounds read when decoding H264 Description: An out-of-bounds read can occur when decoding H264 video. This results in a potentially exploitable crash. This vulnerability affects Firefox ESR < 102.3, Thunderbird < 102.3, and Firefox < 105. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2022-40/ - https://www.mozilla.org/security/advisories/mfsa2022-41/ - https://www.mozilla.org/security/advisories/mfsa2022-42/
0/ - https://www.mozilla.org/security/advisories/mfsa2022-41/ - https://www.mozilla.org/security/advisories/mfsa2022-42/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1767360
CVE ID: CVE-2022-3267 State: PUBLISHED Published: 2022-09-22T09:20:14.000Z Last Updated: 2025-05-23T20:21:52.624Z Severity: MEDIUM (CVSS 6.8 CVSS:3.0/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L) Vendors: ikus060 Products: ikus060/rdiffweb Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) in GitHub repository ikus060/rdiffweb prior to 2.4.6. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/7b6ec9f4-4fe9-4716-8dba-3491ffa3f6f2 - https://github.com/ikus060/rdiffweb/commit/20fc0d304412cc569b21f31e52cb8b94094d6314
CVE ID: CVE-2022-3268 State: PUBLISHED Published: 2022-09-22T09:20:09.000Z Last Updated: 2025-05-23T20:30:45.079Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: ikus060 Products: ikus060/minarca Problem Types: CWE-521 Description: Weak Password Requirements in GitHub repository ikus060/minarca prior to 4.2.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ikus060/minarca/commit/7b5c7e6cbd59268d5cd4f1b5f42e721db116f71a - https://huntr.dev/bounties/00e464ce-53b9-485d-ac62-6467881654c2
CVE ID: CVE-2022-3269 State: PUBLISHED Published: 2022-09-23T09:20:09.000Z Last Updated: 2025-05-22T18:28:01.655Z Severity: MEDIUM (CVSS 6.4 CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L) Vendors: ikus060 Products: ikus060/rdiffweb Problem Types: CWE-384 Description: Session Fixation in GitHub repository ikus060/rdiffweb prior to 2.4.7. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/67c25969-5e7a-4424-817e-e1a918f63cc6 - https://github.com/ikus060/rdiffweb/commit/39e7dcd4a1f44d2a7bd92b79d78a800910b1b22b
CVE ID: CVE-2022-3270 State: PUBLISHED Published: 2022-12-01T10:27:52.434Z Last Updated: 2025-04-24T20:05:32.864Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Festo SE Products: Bus module CPX-E-EP, Bus node CPX-FB32, Bus node CPX-FB33, Bus node CPX-FB36, Bus node CPX-FB37, Bus node CPX-FB39, Bus node CPX-FB40, Bus node CPX-FB43, Bus node CPX-M-FB34, Bus node CPX-M-FB35, Bus node CPX-M-FB44, Bus node CPX-M-FB45, Bus node CTEU-EP, Bus node CTEU-PN, Bus node CTEU-PN-EX1C, Camera system CHB-C-N, Compact Vision System SBO*-C-*, Compact Vision System SBO*-M-*, Compact Vision System SBO*-Q-*, Control block CPX-CEC, Control block CPX-CEC-C1, Control block CPX-
ion System SBO*-M-*, Compact Vision System SBO*-Q-*, Control block CPX-CEC, Control block CPX-CEC-C1, Control block CPX-CEC-C1-V3, Control block CPX-CEC-M1, Control block CPX-CEC-M1-V3, Control block CPX-CEC-S1-V3, Control block CPX-CMXX, Control block CPX-FEC-1-IE, Controller CECC-D, Controller CECC-D-BA, Controller CECC-LK, Controller CECC-S, Controller CECC-X-*, Controller CECX-X-C1, Controller CECX-X-M1, Controller CMXH-ST2-C5-7-DIOP, Controller CPX-E-CEC-*, Controller SBRD-Q, EtherNet/IP interface CPX-AP-I-EP-M12, EtherNet/IP interface CPX-AP-I-PN-M12, Gateway CPX-IOT, Integrated drive EMCA-EC-67-*, Motor controller CMMO-ST-C5-1-DION, Motor controller CMMO-ST-C5-1-DIOP, Motor controller
Integrated drive EMCA-EC-67-*, Motor controller CMMO-ST-C5-1-DION, Motor controller CMMO-ST-C5-1-DIOP, Motor controller CMMO-ST-C5-1-LKP, Motor controller CMMP-AS-*, Motor controller CMMT-AS-*, Operator unit CDPX-X-A-S-10, Operator unit CDPX-X-A-W-13, Operator unit CDPX-X-A-W-4, Operator unit CDPX-X-A-W-7, Planar surface gantry EXCM-*, Servo drive CMMT-ST-C8-1C-EP-S0, Servo drive CMMT-ST-C8-1C-PN-S0, VTEM-S1-*, Bus module CPX-E-PN Problem Types: CWE-1059 Description: In multiple products by Festo a remote unauthenticated attacker could use functions of an undocumented protocol which could lead to a complete loss of confidentiality, integrity and availability. Additional Analyst Notes: - CVE
ocol which could lead to a complete loss of confidentiality, integrity and availability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert.vde.com/en/advisories/VDE-2022-041/
CVE ID: CVE-2022-3272 State: PUBLISHED Published: 2022-09-26T16:50:10.000Z Last Updated: 2025-05-21T15:13:20.154Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: ikus060 Products: ikus060/rdiffweb Problem Types: CWE-130 Description: Improper Handling of Length Parameter Inconsistency in GitHub repository ikus060/rdiffweb prior to 2.4.8. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ikus060/rdiffweb/commit/667657c6fe2b336c90be37f37fb92f65df4feee3 - https://huntr.dev/bounties/733678b9-daa1-4d6a-875a-382fa09a6e38
CVE ID: CVE-2022-3273 State: PUBLISHED Published: 2022-10-06T00:00:00 Last Updated: 2024-08-03T01:07:06.202Z Severity: LOW (CVSS 3.6 CVSS:3.0/AV:P/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L) Vendors: ikus060 Products: ikus060/rdiffweb Problem Types: CWE-770 Description: Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.0a4. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/a6df4bad-3382-4add-8918-760d885690f6 - https://github.com/ikus060/rdiffweb/commit/b5e3bb0a98268d18ceead36ab9b2b7eaacd659a8
CVE ID: CVE-2022-3274 State: PUBLISHED Published: 2022-09-22T18:15:11.000Z Last Updated: 2025-05-22T18:29:16.071Z Severity: HIGH (CVSS 7 CVSS:3.0/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:H) Vendors: ikus060 Products: ikus060/rdiffweb Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) in GitHub repository ikus060/rdiffweb prior to 2.4.7. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/8834c356-4ddb-4be7-898b-d76f480e9c3f - https://github.com/ikus060/rdiffweb/commit/e974df75bdbcff3996ad70bd1b4424ec1485ea3f
CVE ID: CVE-2022-3275 State: PUBLISHED Published: 2022-10-07T00:00:00 Last Updated: 2024-08-03T01:07:06.418Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Puppet Products: puppetlabs-apt Problem Types: CWE-78 Description: Command injection is possible in the puppetlabs-apt module prior to version 9.0.0. A malicious actor is able to exploit this vulnerability only if they are able to provide unsanitized input to the module. This condition is rare in most deployments of Puppet and Puppet Enterprise. Additional Analyst Notes: - CVE Program Container: References: - https://puppet.com/security/cve/CVE-2022-3275 - https://lists.fedoraproject.org/archives/list/pack
tainer: References: - https://puppet.com/security/cve/CVE-2022-3275 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YR5LIOF5VKS4DC2NQWXTMPPXOYJC46XC/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CH4NUKZKPY4MFQHFBTONJK2AWES4DFDA/
CVE ID: CVE-2022-3276 State: PUBLISHED Published: 2022-10-07T00:00:00 Last Updated: 2024-08-03T01:07:05.971Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Puppet Products: puppetlabs-mysql Problem Types: CWE-78 Description: Command injection is possible in the puppetlabs-mysql module prior to version 13.0.0. A malicious actor is able to exploit this vulnerability only if they are able to provide unsanitized input to the module. This condition is rare in most deployments of Puppet and Puppet Enterprise. Additional Analyst Notes: - CVE Program Container: References: - https://puppet.com/security/cve/CVE-2022-3276
CVE ID: CVE-2022-3277 State: PUBLISHED Published: 2023-03-06T00:00:00.000Z Last Updated: 2025-03-07T15:54:48.807Z Vendors: n/a Products: openstack-neutron Problem Types: CWE-400 Description: An uncontrolled resource consumption flaw was found in openstack-neutron. This flaw allows a remote authenticated user to query a list of security groups for an invalid project. This issue creates resources that are unconstrained by the user's quota. If a malicious user were to submit a significant number of requests, this could lead to a denial of service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2129193 - https
VE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2129193 - https://bugs.launchpad.net/neutron/+bug/1988026
CVE ID: CVE-2022-3278 State: PUBLISHED Published: 2022-09-23T00:00:00.000Z Last Updated: 2025-05-22T18:28:37.480Z Severity: MEDIUM (CVSS 6.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L) Vendors: vim Products: vim/vim Problem Types: CWE-476 Description: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0552. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/a9fad77e-f245-4ce9-ba15-c7d4c86c4612 - https://github.com/vim/vim/commit/69082916c8b5d321545d60b9f5facad0a2dd5a4e - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LSSEWQLK55MCNT4Z2IIJEJYEI5HLCODI/ - https:/
project.org/archives/list/package-announce%40lists.fedoraproject.org/message/LSSEWQLK55MCNT4Z2IIJEJYEI5HLCODI/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4QI7AETXBHPC7SGA77Q7O5IEGULWYET7/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GTBVD4J2SKVSWK4VBN5JP5OEVK6GDS3N/ - https://security.gentoo.org/glsa/202305-16
CVE ID: CVE-2022-3279 State: PUBLISHED Published: 2022-10-17T00:00:00.000Z Last Updated: 2025-05-13T15:50:02.812Z Severity: LOW (CVSS 2.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L) Vendors: GitLab Products: GitLab Problem Types: Uncaught exception in GitLab Description: An unhandled exception in job log parsing in GitLab CE/EE affecting all versions prior to 15.2.5, 15.3 prior to 15.3.4, and 15.4 prior to 15.4.1 allows an attacker to prevent access to job logs Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/364249 - https://hackerone.com/reports/1587261 - https://gitlab.com/gitlab-org/cves/-/blob/maste
lab-org/gitlab/-/issues/364249 - https://hackerone.com/reports/1587261 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3279.json
CVE ID: CVE-2022-3280 State: PUBLISHED Published: 2022-11-09T00:00:00.000Z Last Updated: 2025-05-01T19:25:23.142Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: GitLab Products: GitLab Problem Types: Url redirection to untrusted site ('open redirect') in GitLab Description: An open redirect in GitLab CE/EE affecting all versions from 10.1 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allows an attacker to trick users into visiting a trustworthy URL and being redirected to arbitrary content. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/352611 - https://h
ogram Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/352611 - https://hackerone.com/reports/1475686 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3280.json
CVE ID: CVE-2022-3281 State: PUBLISHED Published: 2022-10-17T08:20:12.389Z Last Updated: 2025-05-10T02:56:32.932Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: WAGO Products: 750-81xx/xxx-xxx Series PFC100/PFC200, 750-8217/xxx-xxx Series PFC100/PFC200, 750-82xx/xxx-xxx Series PFC100/PFC200, Compact Controller CC100, 762-4xxx Series Touch Panel 600, 762-5xxx Series Touch Panel 600, 762-6xxx Series Touch Panel 600, 752-8303/8000-002 Edge Controller Problem Types: CWE-440 Description: WAGO Series PFC100/PFC200, Series Touch Panel 600, Compact Controller CC100 and Edge Controller in multiple versions are prone to a loss of MAC-Address-Filtering after reboot. Thi
Controller CC100 and Edge Controller in multiple versions are prone to a loss of MAC-Address-Filtering after reboot. This may allow an remote attacker to circumvent the reach the network that should be protected by the MAC address filter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert.vde.com/en/advisories/VDE-2022-042/
CVE ID: CVE-2022-3282 State: PUBLISHED Published: 2022-10-17T00:00:00.000Z Last Updated: 2025-05-13T15:47:23.226Z Vendors: Unknown Products: Drag and Drop Multiple File Upload – Contact Form 7 Problem Types: CWE-639 Description: The Drag and Drop Multiple File Upload WordPress plugin before 1.3.6.5 does not properly check for the upload size limit set in forms, taking the value from user input sent when submitting the form. As a result, attackers could control the file length limit and bypass the limit set by admins in the contact form. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/035dffef-4b4b-4afb-9776-7f6c5e5645
am Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/035dffef-4b4b-4afb-9776-7f6c5e56452c
CVE ID: CVE-2022-3283 State: PUBLISHED Published: 2022-10-17T00:00:00.000Z Last Updated: 2025-05-13T15:46:08.723Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: GitLab Products: GitLab Problem Types: Uncontrolled resource consumption in GitLab Description: A potential DOS vulnerability was discovered in GitLab CE/EE affecting all versions before before 15.2.5, all versions starting from 15.3 before 15.3.4, all versions starting from 15.4 before 15.4.1 While cloning an issue with special crafted content added to the description could have been used to trigger high CPU usage. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References
n used to trigger high CPU usage. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://hackerone.com/reports/1543718 - https://gitlab.com/gitlab-org/gitlab/-/issues/361982 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3283.json
CVE ID: CVE-2022-3284 State: PUBLISHED Published: 2023-03-06T10:39:43.877Z Last Updated: 2024-08-28T20:00:07.310Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: M-Files Products: M-Files New Web Problem Types: CWE-200 Description: Download key for a file in a vault was passed in an insecure way that could easily be logged in M-Files New Web in M-Files before 22.11.12011.0. This issue affects M-Files New Web: before 22.11.12011.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.m-files.com/about/trust-center/security-advisories/cve-2022-3284/ - https://product.m-files.com/security-advisories/cve-2022-3284
om/about/trust-center/security-advisories/cve-2022-3284/ - https://product.m-files.com/security-advisories/cve-2022-3284/
CVE ID: CVE-2022-3285 State: PUBLISHED Published: 2022-11-09T00:00:00.000Z Last Updated: 2025-05-01T19:24:39.816Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: GitLab Products: GitLab Problem Types: Improper access control in GitLab Description: Bypass of healthcheck endpoint allow list affecting all versions from 12.0 prior to 15.2.5, 15.3 prior to 15.3.4, and 15.4 prior to 15.4.1 allows an unauthorized attacker to prevent access to GitLab Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/security/omnibus-gitlab/-/issues/64 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-202
itlab.com/gitlab-org/security/omnibus-gitlab/-/issues/64 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3285.json
CVE ID: CVE-2022-3286 State: PUBLISHED Published: 2022-10-17T00:00:00.000Z Last Updated: 2025-05-13T15:45:08.979Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: Improper access control in GitLab Description: Lack of IP address checking in GitLab EE affecting all versions from 14.2 prior to 15.2.5, 15.3 prior to 15.3.4, and 15.4 prior to 15.4.1 allows a group member to bypass IP restrictions when using a deploy token Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/363827 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-202
: - https://gitlab.com/gitlab-org/gitlab/-/issues/363827 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3286.json
CVE ID: CVE-2022-3287 State: PUBLISHED Published: 2022-09-28T19:07:38.000Z Last Updated: 2025-05-20T20:12:47.373Z Vendors: n/a Products: fwupd Problem Types: CWE-256 Description: When creating an OPERATOR user account on the BMC, the redfish plugin saved the auto-generated password to /etc/fwupd/redfish.conf without proper restriction, allowing any user on the system to read the same configuration file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/fwupd/fwupd/commit/ea676855f2119e36d433fbd2ed604039f53b2091
CVE ID: CVE-2022-3288 State: PUBLISHED Published: 2022-10-17T00:00:00.000Z Last Updated: 2025-05-13T15:43:38.380Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: GitLab Products: GitLab Problem Types: Use of incorrectly-resolved name or reference in GitLab Description: A branch/tag name confusion in GitLab CE/EE affecting all versions prior to 15.2.5, 15.3 prior to 15.3.4, and 15.4 prior to 15.4.1 allows an attacker to manipulate pages where the content of the default branch would be expected. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/354948 - https://hackerone.com/rep
- CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/354948 - https://hackerone.com/reports/1498354 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3288.json
CVE ID: CVE-2022-3290 State: PUBLISHED Published: 2022-09-26T19:00:14.000Z Last Updated: 2025-05-21T20:07:31.267Z Severity: MEDIUM (CVSS 5.7 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H) Vendors: ikus060 Products: ikus060/rdiffweb Problem Types: CWE-130 Description: Improper Handling of Length Parameter Inconsistency in GitHub repository ikus060/rdiffweb prior to 2.4.8. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ikus060/rdiffweb/commit/667657c6fe2b336c90be37f37fb92f65df4feee3 - https://huntr.dev/bounties/d8b8519d-96a5-484c-8141-624c54290bf5
CVE ID: CVE-2022-3291 State: PUBLISHED Published: 2022-10-17T00:00:00.000Z Last Updated: 2025-05-13T15:42:30.176Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: Information exposure in GitLab Description: Serialization of sensitive data in GitLab EE affecting all versions from 14.9 prior to 15.2.5, 15.3 prior to 15.3.4, and 15.4 prior to 15.4.1 can leak sensitive information via cache Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/354299 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3291.json