Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-43359 State: PUBLISHED Published: 2022-11-07T00:00:00.000Z Last Updated: 2025-05-05T18:16:12.843Z Vendors: n/a Products: n/a Problem Types: n/a Description: Gifdec commit 1dcbae19363597314f6623010cc80abad4e47f7c was discovered to contain an out-of-bounds read in the function read_image_data. This vulnerability is triggered when parsing a crafted Gif file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/lecram/gifdec/pull/23
CVE ID: CVE-2022-43361 State: PUBLISHED Published: 2022-11-01T00:00:00.000Z Last Updated: 2025-05-05T14:26:22.348Z Vendors: n/a Products: n/a Problem Types: n/a Description: Senayan Library Management System v9.4.2 was discovered to contain a cross-site scripting (XSS) vulnerability via the component pop_chart.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/slims/slims9_bulian/issues/162
CVE ID: CVE-2022-43362 State: PUBLISHED Published: 2022-11-01T00:00:00.000Z Last Updated: 2025-05-05T14:25:03.498Z Vendors: n/a Products: n/a Problem Types: n/a Description: Senayan Library Management System v9.4.2 was discovered to contain a SQL injection vulnerability via the collType parameter at loan_by_class.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/slims/slims9_bulian/issues/163
CVE ID: CVE-2022-43363 State: PUBLISHED Published: 2022-12-06T00:00:00 Last Updated: 2024-08-03T13:26:02.861Z Vendors: n/a Products: n/a Problem Types: n/a Description: Telegram Web 15.3.1 allows XSS via a certain payload derived from a Target Corporation website. NOTE: some third parties have been unable to discern any relationship between the Pastebin information and a possible XSS finding. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.telegram.org/c/17831 - https://pastebin.com/72MRwNXW
CVE ID: CVE-2022-43364 State: PUBLISHED Published: 2022-10-27T00:00:00.000Z Last Updated: 2025-05-12T19:51:05.373Z Vendors: n/a Products: n/a Problem Types: n/a Description: An access control issue in the password reset page of IP-COM EW9 V15.11.0.14(9732) allows unauthenticated attackers to arbitrarily change the admin password. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/splashsc/IOT_Vulnerability_Discovery/blob/main/ip-com/5_reset_the_password.md
CVE ID: CVE-2022-43365 State: PUBLISHED Published: 2022-10-27T00:00:00.000Z Last Updated: 2025-05-12T19:49:54.325Z Vendors: n/a Products: n/a Problem Types: n/a Description: IP-COM EW9 V15.11.0.14(9732) was discovered to contain a buffer overflow in the formSetDebugCfg function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted string. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/splashsc/IOT_Vulnerability_Discovery/blob/main/ip-com/1_bof.md
CVE ID: CVE-2022-43366 State: PUBLISHED Published: 2022-10-27T00:00:00.000Z Last Updated: 2025-05-12T19:47:11.132Z Vendors: n/a Products: n/a Problem Types: n/a Description: IP-COM EW9 V15.11.0.14(9732) allows unauthenticated attackers to access sensitive information via the checkLoginUser, ate, telnet, version, setDebugCfg, and boot interfaces. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/splashsc/IOT_Vulnerability_Discovery/blob/main/ip-com/4_information_disclosure.md
CVE ID: CVE-2022-43367 State: PUBLISHED Published: 2022-10-27T00:00:00.000Z Last Updated: 2025-05-12T19:43:45.245Z Vendors: n/a Products: n/a Problem Types: n/a Description: IP-COM EW9 V15.11.0.14(9732) was discovered to contain a command injection vulnerability in the formSetDebugCfg function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/splashsc/IOT_Vulnerability_Discovery/blob/main/ip-com/2_cmdi.md
CVE ID: CVE-2022-43369 State: PUBLISHED Published: 2022-12-06T00:00:00.000Z Last Updated: 2025-04-23T16:16:49.665Z Vendors: n/a Products: n/a Problem Types: n/a Description: AutoTaxi Stand Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component search.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://phpgurukul.com/auto-taxi-stand-management-system-using-php-and-mysql/ - https://github.com/sudoninja-noob/CVE-2022-43369/blob/main/CVE-2022-43369
CVE ID: CVE-2022-43372 State: PUBLISHED Published: 2022-11-03T00:00:00.000Z Last Updated: 2025-05-05T12:45:50.673Z Vendors: n/a Products: n/a Problem Types: n/a Description: Emlog Pro v1.7.1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability at /admin/store.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/emlog/emlog/issues/195
CVE ID: CVE-2022-43375 State: REJECTED Published: N/A Last Updated: 2024-01-04T06:31:00.221Z Description: No description available.
CVE ID: CVE-2022-43376 State: PUBLISHED Published: 2023-04-18T19:55:07.347Z Last Updated: 2025-02-05T20:05:07.304Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L) Vendors: Schneider Electric Products: NetBotz 4 - 355/450/455/550/570 Problem Types: CWE-79 Description: A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause code and session manipulation when malicious code is inserted into the browser. Affected Products: NetBotz 4 - 355/450/455/550/570 (V4.7.0 and prior) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.
onal Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-312-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2022-312-01-NetBotz_4_Security_Notification.pdf
CVE ID: CVE-2022-43377 State: PUBLISHED Published: 2023-04-18T19:56:14.189Z Last Updated: 2025-02-05T20:24:49.039Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Schneider Electric Products: NetBotz 4 - 355/450/455/550/570 Problem Types: CWE-307 Description: A CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could cause account takeover when a brute force attack is performed on the account. Affected Products: NetBotz 4 - 355/450/455/550/570 (V4.7.0 and prior) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-312
Container: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-312-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2022-312-01-NetBotz_4_Security_Notification.pdf
CVE ID: CVE-2022-43378 State: PUBLISHED Published: 2023-04-18T20:06:36.818Z Last Updated: 2025-02-05T20:04:56.934Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) Vendors: Schneider Electric Products: NetBotz 4 - 355/450/455/550/570 Problem Types: CWE-1021 Description: A CWE-1021: Improper Restriction of Rendered UI Layers or Frames vulnerability exists that could cause the user to be tricked into performing unintended actions when external address frames are not properly restricted. Affected Products: NetBotz 4 - 355/450/455/550/570 (V4.7.0 and prior) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://download.schneider
or) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-312-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2022-312-01-NetBotz_4_Security_Notification.pdf
CVE ID: CVE-2022-43380 State: PUBLISHED Published: 2022-12-23T18:35:03.658Z Last Updated: 2025-04-15T13:49:12.281Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: IBM Products: AIX Problem Types: CWE-399 Description: IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the AIX NFS kernel extension to cause a denial of service. IBM X-Force ID: 238640. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6847947 - https://exchange.xforce.ibmcloud.com/vulnerabilities/238640
CVE ID: CVE-2022-43381 State: PUBLISHED Published: 2022-12-23T18:19:31.382Z Last Updated: 2025-04-15T03:58:31.717Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: IBM Products: AIX Problem Types: CWE-399 Description: IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1could allow a non-privileged local user to exploit a vulnerability in the AIX SMB client to cause a denial of service. IBM X-Force ID: 238639. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6851443 - https://exchange.xforce.ibmcloud.com/vulnerabilities/238639
CVE ID: CVE-2022-43382 State: PUBLISHED Published: 2022-12-20T20:11:47.065Z Last Updated: 2025-04-16T14:44:17.174Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: IBM Products: AIX Problem Types: CWE-399 Description: IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1could allow a local user with elevated privileges to exploit a vulnerability in the lpd daemon to cause a denial of service. IBM X-Force ID: 238641. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6848309 - https://exchange.xforce.ibmcloud.com/vulnerabilities/238641
CVE ID: CVE-2022-43384 State: PUBLISHED Published: 2024-05-30T11:36:25.042Z Last Updated: 2024-08-03T13:32:58.810Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: IBM Products: Aspera Console Problem Types: CWE-79 Description: IBM Aspera Console 3.4.0 through 3.4.2 PL5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 238645. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7155215 -
Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7155215 - https://exchange.xforce.ibmcloud.com/vulnerabilities/238645
CVE ID: CVE-2022-43389 State: PUBLISHED Published: 2023-01-11T00:00:00.000Z Last Updated: 2025-04-09T13:52:22.737Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H) Vendors: Zyxel Products: NR7101 firmware Problem Types: CWE-120 Description: A buffer overflow vulnerability in the library of the web server in Zyxel NR7101 firmware prior to V1.15(ACCC.3)C0, which could allow an unauthenticated attacker to execute some OS commands or to cause denial-of-service (DoS) conditions on a vulnerable device. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-fo
A ADP Vulnrichment: References: - https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-and-buffer-overflow-vulnerabilities-of-cpe-fiber-onts-and-wifi-extenders
CVE ID: CVE-2022-43390 State: PUBLISHED Published: 2023-01-11T00:00:00.000Z Last Updated: 2025-04-08T20:16:36.803Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: Zyxel Products: NR7101 firmware Problem Types: CWE-78 Description: A command injection vulnerability in the CGI program of Zyxel NR7101 firmware prior to V1.15(ACCC.3)C0, which could allow an authenticated attacker to execute some OS commands on a vulnerable device by sending a crafted HTTP request. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-and-bu
nces: - https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-and-buffer-overflow-vulnerabilities-of-cpe-fiber-onts-and-wifi-extenders
CVE ID: CVE-2022-43391 State: PUBLISHED Published: 2023-01-11T00:00:00 Last Updated: 2024-10-15T17:12:34.022Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Zyxel Products: NR7101 firmware Problem Types: CWE-120 Description: A buffer overflow vulnerability in the parameter of the CGI program in Zyxel NR7101 firmware prior to V1.15(ACCC.3)C0, which could allow an authenticated attacker to cause denial-of-service (DoS) conditions by sending a crafted HTTP request. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-an
ferences: - https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-and-buffer-overflow-vulnerabilities-of-cpe-fiber-onts-and-wifi-extenders
CVE ID: CVE-2022-43392 State: PUBLISHED Published: 2023-01-11T00:00:00 Last Updated: 2024-11-27T17:13:31.757Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Zyxel Products: NR7101 firmware Problem Types: CWE-120 Description: A buffer overflow vulnerability in the parameter of web server in Zyxel NR7101 firmware prior to V1.15(ACCC.3)C0, which could allow an authenticated attacker to cause denial-of-service (DoS) conditions by sending a crafted authorization request. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injectio
: References: - https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-and-buffer-overflow-vulnerabilities-of-cpe-fiber-onts-and-wifi-extenders
CVE ID: CVE-2022-43393 State: PUBLISHED Published: 2023-01-11T00:00:00.000Z Last Updated: 2025-04-08T14:29:52.874Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H) Vendors: Zyxel Products: GS1920-24v2 firmware Problem Types: CWE-754 Description: An improper check for unusual or exceptional conditions in the HTTP request processing function of Zyxel GS1920-24v2 firmware prior to V4.70(ABMH.8)C0, which could allow an unauthenticated attacker to corrupt the contents of the memory and result in a denial-of-service (DoS) condition on a vulnerable device. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.zyxel.com/global/en/
ditional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-dos-vulnerability-of-switches
CVE ID: CVE-2022-43396 State: PUBLISHED Published: 2022-12-30T10:30:45.627Z Last Updated: 2025-04-11T14:49:56.691Z Vendors: Apache Software Foundation Products: Apache Kylin Problem Types: Command injection Description: In the fix for CVE-2022-24697, a blacklist is used to filter user input commands. But there is a risk of being bypassed. The user can control the command by controlling the kylin.engine.spark-cmd parameter of conf. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/ob2ks04zl5ms0r44cd74y1xdl1rzfd1r
CVE ID: CVE-2022-43397 State: PUBLISHED Published: 2022-11-08T00:00:00.000Z Last Updated: 2025-04-21T13:46:27.727Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: Parasolid V34.0, Parasolid V34.1, Parasolid V35.0, Simcenter Femap Problem Types: CWE-787 Description: A vulnerability has been identified in Parasolid V34.0 (All versions < V34.0.252), Parasolid V34.1 (All versions < V34.1.242), Parasolid V35.0 (All versions < V35.0.170), Simcenter Femap (All versions < V2023.1). The affected application contains an out of bounds write past the end of an allocated buffer while parsing specially crafted X_T files. This could allow an a
out of bounds write past the end of an allocated buffer while parsing specially crafted X_T files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-17854) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-853037.pdf - https://cert-portal.siemens.com/productcert/pdf/ssa-565356.pdf
CVE ID: CVE-2022-43398 State: PUBLISHED Published: 2022-11-08T00:00:00 Last Updated: 2024-08-03T13:32:58.148Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: POWER METER SICAM Q100 Problem Types: CWE-384 Description: A vulnerability has been identified in POWER METER SICAM Q100 (All versions < V2.50), POWER METER SICAM Q100 (All versions < V2.50), POWER METER SICAM Q100 (All versions < V2.50), POWER METER SICAM Q100 (All versions < V2.50). Affected devices do not renew the session cookie after login/logout and also accept user defined session cookies. An attacker could overwrite the stored session cookie of a user. After the vic
also accept user defined session cookies. An attacker could overwrite the stored session cookie of a user. After the victim logged in, the attacker is given access to the user's account through the activated session. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-570294.pdf - https://cert-portal.siemens.com/productcert/pdf/ssa-887249.pdf
CVE ID: CVE-2022-43399 State: REJECTED Published: N/A Last Updated: 2023-03-10T00:00:00 Description: No description available.
CVE ID: CVE-2022-43400 State: PUBLISHED Published: 2022-10-21T00:00:00.000Z Last Updated: 2025-05-07T15:56:50.791Z Vendors: Siemens Products: Siveillance Video Mobile Server V2022 R2 Problem Types: CWE-1390 Description: A vulnerability has been identified in Siveillance Video Mobile Server V2022 R2 (All versions < V22.2a (80)). The mobile server component of affected applications improperly handles the log in for Active Directory accounts that are part of Administrators group. This could allow an unauthenticated remote attacker to access the application without a valid account. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.sieme
unt. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-640732.pdf
CVE ID: CVE-2022-43401 State: PUBLISHED Published: 2022-10-19T00:00:00 Last Updated: 2024-08-03T13:32:57.390Z Vendors: Jenkins project Products: Jenkins Script Security Plugin Description: A sandbox bypass vulnerability involving various casts performed implicitly by the Groovy language runtime in Jenkins Script Security Plugin 1183.v774b_0b_0a_a_451 and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2824%20%281
Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2824%20%281%29 - http://www.openwall.com/lists/oss-security/2022/10/19/3
CVE ID: CVE-2022-43402 State: PUBLISHED Published: 2022-10-19T00:00:00 Last Updated: 2024-08-03T13:32:58.640Z Vendors: Jenkins project Products: Jenkins Pipeline: Groovy Plugin Description: A sandbox bypass vulnerability involving various casts performed implicitly by the Groovy language runtime in Jenkins Pipeline: Groovy Plugin 2802.v5ea_628154b_c2 and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2824%20%281
CVE ID: CVE-2022-43403 State: PUBLISHED Published: 2022-10-19T00:00:00 Last Updated: 2024-08-03T13:32:57.319Z Vendors: Jenkins project Products: Jenkins Script Security Plugin Description: A sandbox bypass vulnerability involving casting an array-like value to an array type in Jenkins Script Security Plugin 1183.v774b_0b_0a_a_451 and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2824%20%281%29 - http://www.open
Container: References: - https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2824%20%281%29 - http://www.openwall.com/lists/oss-security/2022/10/19/3 - https://www.secpod.com/blog/oracle-releases-critical-security-updates-january-2023-patch-now/
CVE ID: CVE-2022-43404 State: PUBLISHED Published: 2022-10-19T00:00:00 Last Updated: 2024-08-03T13:32:57.353Z Vendors: Jenkins project Products: Jenkins Script Security Plugin Description: A sandbox bypass vulnerability involving crafted constructor bodies and calls to sandbox-generated synthetic constructors in Jenkins Script Security Plugin 1183.v774b_0b_0a_a_451 and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-10-19/#SECUR
itional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2824%20%281%29 - http://www.openwall.com/lists/oss-security/2022/10/19/3
CVE ID: CVE-2022-43405 State: PUBLISHED Published: 2022-10-19T00:00:00 Last Updated: 2024-08-03T13:32:58.478Z Vendors: Jenkins project Products: Jenkins Pipeline: Groovy Libraries Plugin Description: A sandbox bypass vulnerability in Jenkins Pipeline: Groovy Libraries Plugin 612.v84da_9c54906d and earlier allows attackers with permission to define untrusted Pipeline libraries and to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2824%20%282%29 - http://ww
rogram Container: References: - https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2824%20%282%29 - http://www.openwall.com/lists/oss-security/2022/10/19/3
CVE ID: CVE-2022-43406 State: PUBLISHED Published: 2022-10-19T00:00:00 Last Updated: 2024-08-03T13:32:57.407Z Vendors: Jenkins project Products: Jenkins Pipeline: Deprecated Groovy Libraries Plugin Description: A sandbox bypass vulnerability in Jenkins Pipeline: Deprecated Groovy Libraries Plugin 583.vf3b_454e43966 and earlier allows attackers with permission to define untrusted Pipeline libraries and to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2824
Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2824%20%282%29 - http://www.openwall.com/lists/oss-security/2022/10/19/3