Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-38155 State: PUBLISHED Published: 2022-08-11T00:52:12 Last Updated: 2024-08-03T10:45:52.690Z Vendors: n/a Products: n/a Problem Types: n/a Description: TEE_Malloc in Samsung mTower through 0.3.0 allows a trusted application to achieve Excessive Memory Allocation via a large len value, as demonstrated by a Numaker-PFM-M2351 TEE kernel crash. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Samsung/mTower/blob/18f4b592a8a973ce5972f4e2658ea0f6e3686284/tee/lib/libutee/tee_api.c#L314 - https://github.com/Samsung/mTower/issues/74
CVE ID: CVE-2022-38156 State: PUBLISHED Published: 2023-06-12T00:00:00 Last Updated: 2025-01-03T23:48:51.671Z Vendors: n/a Products: n/a Problem Types: n/a Description: A remote command injection issues exists in the web server of the Kratos SpectralNet device with SpectralNet Narrowband (NB) before 1.7.5. As an admin user, an attacker can send a crafted password in order to execute Linux commands as the root user. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.kratosdefense.com/-/media/k/pdf/s/sy/os-011-spectralnet-narrowband.pdf
CVE ID: CVE-2022-38161 State: PUBLISHED Published: 2022-08-11T01:36:57 Last Updated: 2024-08-03T10:45:52.807Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Gumstix Overo SBC on the VSKS board through 2022-08-09, as used on the Orlan-10 and other platforms, allows unrestricted remapping of the NOR flash memory containing the bitstream for the FPGA. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/subreption/birdwatch-report-1-repo - https://subreption.com/downloads/reports/demystifying-the-orlan-10_opt.pdf - https://subreption.com/press-releases/2022-birdwatch-first-report/
CVE ID: CVE-2022-38162 State: PUBLISHED Published: 2022-10-25T00:00:00.000Z Last Updated: 2025-05-07T20:15:47.590Z Vendors: n/a Products: n/a Problem Types: n/a Description: Reflected cross-site scripting (XSS) vulnerabilities in WithSecure through 2022-08-10) exists within the F-Secure Policy Manager due to an unvalidated parameter in the endpoint, which allows remote attackers to provide a malicious input. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://withsecure.com - https://www.withsecure.com/en/support/security-advisories/cve-2022-38162?_gl=1%2Adtq2t3%2A_up%2AMQ..%2A_ga%2AMTMxOTM1OTA2MC4xNjY2NzIxMjQ0%2A_ga_B5SG5Y2DHS%2AMTY2NjcyMTI0MS4x
ries/cve-2022-38162?_gl=1%2Adtq2t3%2A_up%2AMQ..%2A_ga%2AMTMxOTM1OTA2MC4xNjY2NzIxMjQ0%2A_ga_B5SG5Y2DHS%2AMTY2NjcyMTI0MS4xLjAuMTY2NjcyMTI0MS4wLjAuMA.. - https://www.withsecure.com/en/support/security-advisories
CVE ID: CVE-2022-38163 State: PUBLISHED Published: 2022-11-07T00:00:00.000Z Last Updated: 2025-05-02T18:33:10.326Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Drag and Drop spoof vulnerability was discovered in F-Secure SAFE Browser for Android and iOS version 19.0 and below. Drag and drop operation by user on address bar could lead to a spoofing of the address bar. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://withsecure.com - https://www.f-secure.com/en/home/support/security-advisories - https://www.f-secure.com/en/home/support/security-advisories/cve-2022-38163
CVE ID: CVE-2022-38164 State: PUBLISHED Published: 2022-11-07T00:00:00 Last Updated: 2024-10-27T17:46:20.580Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability affecting F-Secure SAFE browser for Android and iOS was discovered. A maliciously crafted website could make a phishing attack with URL spoofing as the browser only display certain part of the entire URL. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://withsecure.com - https://www.f-secure.com/en/home/support/security-advisories
CVE ID: CVE-2022-38165 State: PUBLISHED Published: 2022-11-17T00:00:00.000Z Last Updated: 2025-04-30T14:42:49.179Z Vendors: n/a Products: n/a Problem Types: n/a Description: Arbitrary file write in F-Secure Policy Manager through 2022-08-10 allows unauthenticated users to write the file with the contents in arbitrary locations on the F-Secure Policy Manager Server. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.withsecure.com/en/support/security-advisories/cve-2022-38165
CVE ID: CVE-2022-38166 State: PUBLISHED Published: 2022-11-25T00:00:00.000Z Last Updated: 2025-04-29T14:55:54.830Z Vendors: n/a Products: n/a Problem Types: n/a Description: In F-Secure Endpoint Protection for Windows and macOS before channel with Capricorn database 2022-11-22_07, the aerdl.dll unpacker handler crashes. This can lead to a scanning engine crash, triggerable remotely by an attacker for denial of service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.f-secure.com/en/home/support/security-advisories/cve-2022-38166
CVE ID: CVE-2022-38167 State: PUBLISHED Published: 2022-11-14T00:00:00.000Z Last Updated: 2025-05-01T13:33:36.429Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Nintex Workflow plugin 5.2.2.30 for SharePoint allows XSS. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.nintex.com/ - https://help.nintex.com/en-US/platform/ReleaseNotes/NintexSharePoint2019.htm
CVE ID: CVE-2022-38168 State: PUBLISHED Published: 2022-11-03T00:00:00.000Z Last Updated: 2025-05-02T20:17:37.880Z Vendors: n/a Products: n/a Problem Types: n/a Description: Broken Access Control in User Authentication in Avaya Scopia Pathfinder 10 and 20 PTS version 8.3.7.0.4 allows remote unauthenticated attackers to bypass the login page, access sensitive information, and reset user passwords via URL modification. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://medium.com/%40rob_nes/avaya-scopia-pathfinder-broken-access-control-ac792e995bae
CVE ID: CVE-2022-38170 State: PUBLISHED Published: 2022-09-02T07:10:21 Last Updated: 2024-08-03T10:45:52.810Z Vendors: Apache Software Foundation Products: Apache Airflow Problem Types: Overly permissive umask for deamons Description: In Apache Airflow prior to 2.3.4, an insecure umask was configured for numerous Airflow components when running with the `--daemon` flag which could result in a race condition giving world-writable files in the Airflow home directory and allowing local users to expose arbitrary file contents via the webserver. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread/zn8mbbb1j2od5nc9zhrvb7rpsrg1vvzv - http://www.openwall.c
rogram Container: References: - https://lists.apache.org/thread/zn8mbbb1j2od5nc9zhrvb7rpsrg1vvzv - http://www.openwall.com/lists/oss-security/2022/09/02/3 - http://www.openwall.com/lists/oss-security/2022/09/02/12 - http://www.openwall.com/lists/oss-security/2022/09/21/2
CVE ID: CVE-2022-38171 State: PUBLISHED Published: 2022-08-22T18:33:47.097485Z Last Updated: 2024-09-16T18:34:06.293Z Vendors: n/a Products: n/a Problem Types: n/a Description: Xpdf prior to version 4.04 contains an integer overflow in the JBIG2 decoder (JBIG2Stream::readTextRegionSeg() in JBIG2Stream.cc). Processing a specially crafted PDF file or JBIG2 image could lead to a crash or the execution of arbitrary code. This is similar to the vulnerability described by CVE-2021-30860 (Apple CoreGraphics). Additional Analyst Notes: - CVE Program Container: References: - http://www.xpdfreader.com/security-fixes.html - https://dl.xpdfreader.com/xpdf-4.04.tar.gz - https://www.cve.org/CVERecord?id=C
www.xpdfreader.com/security-fixes.html - https://dl.xpdfreader.com/xpdf-4.04.tar.gz - https://www.cve.org/CVERecord?id=CVE-2021-30860 - https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-into-nso-zero-click.html - https://github.com/jeffssh/CVE-2021-30860 - http://www.openwall.com/lists/oss-security/2022/09/02/11 - https://github.com/zmanion/Vulnerabilities/blob/main/CVE-2022-38171.md
CVE ID: CVE-2022-38172 State: PUBLISHED Published: 2022-08-23T18:02:07 Last Updated: 2024-08-03T10:45:52.998Z Vendors: n/a Products: n/a Problem Types: n/a Description: ServiceNow through San Diego Patch 3 allows XSS via the name field during creation of a new dashboard for the Performance Analytics dashboard. Additional Analyst Notes: - CVE Program Container: References: - https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1122640
CVE ID: CVE-2022-38176 State: PUBLISHED Published: 2022-09-06T20:32:12 Last Updated: 2024-08-03T10:45:52.959Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in YSoft SAFEQ 6 before 6.0.72. Incorrect privileges were configured as part of the installer package for the Client V3 services, allowing for local user privilege escalation by overwriting the executable file via an alternative data stream. NOTE: this is not the same as CVE-2021-31859. Additional Analyst Notes: - CVE Program Container: References: - https://ysoft.com - https://www.ysoft.com/en/legal/ysoft-safeq-client-v3-local-privilege-escalation
CVE ID: CVE-2022-38177 State: PUBLISHED Published: 2022-09-21T10:15:28.292Z Last Updated: 2025-05-28T15:23:30.627Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: ISC Products: BIND9 Problem Types: In BIND 9.8.4 -> 9.16.32 and versions 9.9.4-S1 -> 9.11.37-S1, 9.16.8-S1 -> 9.16.32-S1 of the BIND Supported Preview Edition, the DNSSEC verification code for the ECDSA algorithm leaks memory when there is a signature length mismatch. Description: By spoofing the target resolver with responses that have a malformed ECDSA signature, an attacker can trigger a small memory leak. It is possible to gradually erode available memory to the point where named crashes for lack
rigger a small memory leak. It is possible to gradually erode available memory to the point where named crashes for lack of resources. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://kb.isc.org/docs/cve-2022-38177 - http://www.openwall.com/lists/oss-security/2022/09/21/3 - https://www.debian.org/security/2022/dsa-5235 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CV4GQWBPF7Y52J2FA24U6UMHQAOXZEF7/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MRHB6J4Z7BKH4HPEKG5D35QGRD6ANNMT/ - https://lists.fedoraproject.org/archives/list/package-announce
raproject.org/message/MRHB6J4Z7BKH4HPEKG5D35QGRD6ANNMT/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YZJQNUASODNVAWZV6STKG5SD6XIJ446S/ - https://lists.debian.org/debian-lts-announce/2022/10/msg00007.html - https://security.gentoo.org/glsa/202210-25 - https://security.netapp.com/advisory/ntap-20221228-0010/
CVE ID: CVE-2022-38178 State: PUBLISHED Published: 2022-09-21T10:15:29.078Z Last Updated: 2025-05-28T15:23:06.572Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: ISC Products: BIND9 Problem Types: In BIND 9.9.12 -> 9.9.13, 9.10.7 -> 9.10.8, 9.11.3 -> 9.16.32, 9.18.0 -> 9.18.6, versions 9.11.4-S1 -> 9.11.37-S1, 9.16.8-S1 -> 9.16.32-S1 of the BIND Supported Preview Edition, and versions 9.19.0 -> 9.19.4 of the BIND 9.19 development branch, the DNSSEC verification code for the EdDSA algorithm leaks memory when there is a signature length mismatch. Description: By spoofing the target resolver with responses that have a malformed EdDSA signature, an attacker can t
ch. Description: By spoofing the target resolver with responses that have a malformed EdDSA signature, an attacker can trigger a small memory leak. It is possible to gradually erode available memory to the point where named crashes for lack of resources. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://kb.isc.org/docs/cve-2022-38178 - http://www.openwall.com/lists/oss-security/2022/09/21/3 - https://www.debian.org/security/2022/dsa-5235 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CV4GQWBPF7Y52J2FA24U6UMHQAOXZEF7/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedo
/message/CV4GQWBPF7Y52J2FA24U6UMHQAOXZEF7/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MRHB6J4Z7BKH4HPEKG5D35QGRD6ANNMT/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YZJQNUASODNVAWZV6STKG5SD6XIJ446S/ - https://lists.debian.org/debian-lts-announce/2022/10/msg00007.html - https://security.gentoo.org/glsa/202210-25 - https://security.netapp.com/advisory/ntap-20221228-0009/
CVE ID: CVE-2022-38179 State: PUBLISHED Published: 2022-08-12T09:55:10 Last Updated: 2024-08-03T10:45:52.874Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: JetBrains Products: Ktor Problem Types: CWE-184 Description: JetBrains Ktor before 2.1.0 was vulnerable to the Reflect File Download attack Additional Analyst Notes: - CVE Program Container: References: - https://www.jetbrains.com/privacy-security/issues-fixed/ - https://github.com/ktorio/ktor/pull/3110
CVE ID: CVE-2022-38180 State: PUBLISHED Published: 2022-08-12T09:55:15 Last Updated: 2024-08-03T10:45:52.879Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: JetBrains Products: Ktor Problem Types: CWE-287 Description: In JetBrains Ktor before 2.1.0 the wrong authentication provider could be selected in some cases Additional Analyst Notes: - CVE Program Container: References: - https://www.jetbrains.com/privacy-security/issues-fixed/ - https://github.com/ktorio/ktor/pull/3092
CVE ID: CVE-2022-38181 State: PUBLISHED Published: 2022-10-25T00:00:00.000Z Last Updated: 2025-10-21T23:15:32.846Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Arm Mali GPU kernel driver allows unprivileged users to access freed memory because GPU memory operations are mishandled. This affects Bifrost r0p0 through r38p1, and r39p0; Valhall r19p0 through r38p1, and r39p0; and Midgard r4p0 through r32p0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://developer.arm.com/support/arm-security-updates - https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities - https://github.blog/2023-01-23-pwning-t
eveloper.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities - https://github.blog/2023-01-23-pwning-the-all-google-phone-with-a-non-google-bug/ - https://securitylab.github.com/advisories/GHSL-2022-054_Arm_Mali/ - http://packetstormsecurity.com/files/172854/Android-Arm-Mali-GPU-Arbitrary-Code-Execution.html
CVE ID: CVE-2022-38183 State: PUBLISHED Published: 2022-08-12T00:00:00 Last Updated: 2024-08-03T10:45:52.995Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Gitea before 1.16.9, it was possible for users to add existing issues to projects. Due to improper access controls, an attacker could assign any issue to any project in Gitea (there was no permission check for fetching the issue). As a result, the attacker would get access to private issue titles. Additional Analyst Notes: - CVE Program Container: References: - https://blog.gitea.io/2022/07/gitea-1.16.9-is-released/ - https://herolab.usd.de/security-advisories/usd-2022-0015/ - https://security.gentoo.org/glsa/202210-14
CVE ID: CVE-2022-38184 State: PUBLISHED Published: 2022-08-16T17:20:14.725Z Last Updated: 2025-04-10T14:56:50.818Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Esri Products: Portal for ArcGIS Problem Types: CWE-284 Description: There is an improper access control vulnerability in Portal for ArcGIS versions 10.8.1 and below which could allow a remote, unauthenticated attacker to access an API that may induce Esri Portal for ArcGIS to read arbitrary URLs. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/portal-for-arcgis-security-2022-update-1-
: - https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/portal-for-arcgis-security-2022-update-1-patch/
CVE ID: CVE-2022-38186 State: PUBLISHED Published: 2022-08-15T20:45:12.551Z Last Updated: 2025-04-10T14:58:11.627Z Severity: HIGH (CVSS 7.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Esri Products: Portal for ArcGIS Problem Types: CWE-79 Description: There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.8.1 and below which may allow a remote attacker able to convince a user to click on a crafted link which could potentially execute arbitrary JavaScript code in the victim’s browser. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/portal-for-ar
ADP Vulnrichment: References: - https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/portal-for-arcgis-security-2022-update-1-patch/
CVE ID: CVE-2022-38187 State: PUBLISHED Published: 2022-08-15T21:00:16.117Z Last Updated: 2025-04-10T14:57:44.604Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Esri Products: Portal for ArcGIS Problem Types: CWE-918 Description: Prior to version 10.9.0, the sharing/rest/content/features/analyze endpoint is always accessible to anonymous users, which could allow an unauthenticated attacker to induce Esri Portal for ArcGIS to read arbitrary URLs. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/portal-for-arcgis-security-2022-update-1-patch/
CVE ID: CVE-2022-38188 State: PUBLISHED Published: 2022-08-15T20:46:03.455Z Last Updated: 2025-04-10T14:57:52.654Z Severity: HIGH (CVSS 7.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Esri Products: Portal for ArcGIS Problem Types: CWE-79 Description: There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.9.1 which may allow a remote attacker able to convince a user to click on a crafted link which could potentially execute arbitrary JavaScript code in the victim’s browser. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/portal-for-arcgis-secur
chment: References: - https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/portal-for-arcgis-security-2022-update-1-patch/
CVE ID: CVE-2022-38189 State: PUBLISHED Published: 2022-08-16T17:25:13.227Z Last Updated: 2025-04-10T14:56:40.120Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Esri Products: Portal for ArcGIS Problem Types: CWE-79 Description: A stored Cross Site Scripting (XSS) vulnerability in Esri Portal for ArcGIS may allow a remote, authenticated attacker to pass and store malicious strings via crafted queries which when accessed could potentially execute arbitrary JavaScript code in the user’s browser. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/
iner: - CISA ADP Vulnrichment: References: - https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/portal-for-arcgis-security-2022-update-1-patch/
CVE ID: CVE-2022-38190 State: PUBLISHED Published: 2022-08-15T20:45:35.306Z Last Updated: 2025-04-10T14:58:02.441Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Esri Products: Portal for ArcGIS Problem Types: CWE-79 Description: A stored Cross Site Scripting (XSS) vulnerability in Esri Portal for ArcGIS configurable apps may allow a remote, unauthenticated attacker to pass and store malicious strings via crafted queries which when accessed could potentially execute arbitrary JavaScript code in the user’s browser Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.esri.com/arcgis-blog/products/arcgis-enterpr
- CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/portal-for-arcgis-security-2022-update-1-patch/
CVE ID: CVE-2022-38191 State: PUBLISHED Published: 2022-08-15T21:05:11.382Z Last Updated: 2025-04-10T14:57:34.645Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Esri Products: Portal for ArcGIS Problem Types: CWE-74 Description: There is an HTML injection issue in Esri Portal for ArcGIS versions 10.9.0 and below which may allow a remote, authenticated attacker to inject HTML into some locations in the home application. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/portal-for-arcgis-security-2022-update-1-patch/
CVE ID: CVE-2022-38192 State: PUBLISHED Published: 2022-08-16T17:10:09.266Z Last Updated: 2025-04-10T14:57:02.875Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Esri Products: Portal for ArcGIS Problem Types: CWE-79 Description: A stored Cross Site Scripting (XSS) vulnerability in Esri Portal for ArcGIS may allow a remote, authenticated attacker to pass and store malicious strings via crafted queries which when accessed could potentially execute arbitrary JavaScript code in the user’s browser. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/
CVE ID: CVE-2022-38193 State: PUBLISHED Published: 2022-08-16T17:05:10.705Z Last Updated: 2025-04-10T14:57:14.254Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Esri Products: Portal for ArcGIS Problem Types: CWE-95 Description: There is a code injection vulnerability in Esri Portal for ArcGIS versions 10.8.1 and below that may allow a remote, unauthenticated attacker to pass strings which could potentially cause arbitrary code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/portal-for-arcgis-security-2022-update-1-patch/
CVE ID: CVE-2022-38194 State: PUBLISHED Published: 2022-08-16T17:00:17.513Z Last Updated: 2025-04-10T14:57:25.465Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N) Vendors: Esri Products: Portal for ArcGIS Problem Types: CWE-311 Description: In Esri Portal for ArcGIS versions 10.8.1, a system property is not properly encrypted. This may lead to a local user reading sensitive information from a properties file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/portal-for-arcgis-security-2022-update-1-patch/
CVE ID: CVE-2022-38195 State: PUBLISHED Published: 2022-10-25T16:32:09.865Z Last Updated: 2025-04-10T14:55:37.078Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Esri Products: ArcGIS Server Problem Types: CWE-79 Description: There is as reflected cross site scripting issue in Esri ArcGIS Server versions 10.9.1 and below which may allow a remote unauthorized attacker able to convince a user to click on a crafted link which could potentially execute arbitrary JavaScript code in the victim’s browser. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.esri.com/arcgis-blog/products/administration/administration
ontainer: - CISA ADP Vulnrichment: References: - https://www.esri.com/arcgis-blog/products/administration/administration/arcgis-server-security-2022-update-1-patch