Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-37422 State: PUBLISHED Published: 2022-08-18T18:02:01 Last Updated: 2024-08-03T10:29:20.971Z Vendors: n/a Products: n/a Problem Types: n/a Description: Payara through 5.2022.2 allows directory traversal without authentication. This affects Payara Server, Payara Micro, and Payara Server Embedded. Additional Analyst Notes: - CVE Program Container: References: - https://www.payara.fish/downloads/ - https://blog.payara.fish/august-community-5-release
CVE ID: CVE-2022-37423 State: PUBLISHED Published: 2022-08-12T12:16:36 Last Updated: 2024-08-03T10:29:21.036Z Vendors: n/a Products: n/a Problem Types: n/a Description: Neo4j APOC (Awesome Procedures on Cypher) before 4.3.0.7 and 4.x before 4.4.0.8 allows Directory Traversal to sibling directories via apoc.log.stream. Additional Analyst Notes: - CVE Program Container: References: - https://neo4j.com/docs/aura/platform/apoc/ - https://github.com/neo4j-contrib/neo4j-apoc-procedures/security/advisories/GHSA-78f9-745f-278p
CVE ID: CVE-2022-37424 State: PUBLISHED Published: 2022-10-28T15:09:20.963674Z Last Updated: 2024-08-03T10:29:21.020Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: n/a Products: n/a Problem Types: n/a Description: Files or Directories Accessible to External Parties vulnerability in OpenNebula on Linux allows File Discovery. Additional Analyst Notes: - CVE Program Container: References: - https://opennebula.io/opennebula-6-4-2-ee-lts-maintenance-release-is-available/
CVE ID: CVE-2022-37425 State: PUBLISHED Published: 2022-10-28T15:09:21.268822Z Last Updated: 2024-08-03T10:29:21.021Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: n/a Products: n/a Problem Types: n/a Description: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in OpenNebula OpenNebula core on Linux allows Remote Code Inclusion. Additional Analyst Notes: - CVE Program Container: References: - https://opennebula.io/opennebula-6-4-2-ee-lts-maintenance-release-is-available/
CVE ID: CVE-2022-37426 State: PUBLISHED Published: 2022-10-28T15:09:21.611406Z Last Updated: 2024-08-03T10:29:21.036Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: n/a Products: n/a Problem Types: n/a Description: Unrestricted Upload of File with Dangerous Type vulnerability in OpenNebula OpenNebula core on Linux allows File Content Injection. Additional Analyst Notes: - CVE Program Container: References: - https://opennebula.io/opennebula-6-4-2-ee-lts-maintenance-release-is-available/
CVE ID: CVE-2022-37428 State: PUBLISHED Published: 2022-08-23T16:33:04 Last Updated: 2024-08-03T10:29:21.028Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AC:L/AV:N/A:H/C:N/I:N/PR:L/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: PowerDNS Recursor up to and including 4.5.9, 4.6.2 and 4.7.1, when protobuf logging is enabled, has Improper Cleanup upon a Thrown Exception, leading to a denial of service (daemon crash) via a DNS query that leads to an answer with specific properties. Additional Analyst Notes: - CVE Program Container: References: - https://docs.powerdns.com/recursor/lua-config/protobuf.html - https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2022
ns.com/recursor/lua-config/protobuf.html - https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2022-02.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FXSREJKTT6RNE3GXQENQ4R4HS37UNSPX/
CVE ID: CVE-2022-37429 State: PUBLISHED Published: 2022-11-23T00:00:00.000Z Last Updated: 2025-04-25T20:33:41.264Z Vendors: n/a Products: n/a Problem Types: n/a Description: Silverstripe silverstripe/framework through 4.11 allows XSS (issue 1 of 2) via JavaScript payload to the href attribute of a link by splitting a javascript URL with white space characters. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.silverstripe.org/download/security-releases/ - https://www.silverstripe.org/blog/tag/release - https://forum.silverstripe.org/c/releases - https://www.silverstripe.org/download/security-releases/CVE-2022-37429
CVE ID: CVE-2022-37430 State: PUBLISHED Published: 2022-11-23T00:00:00.000Z Last Updated: 2025-04-25T20:32:29.574Z Vendors: n/a Products: n/a Problem Types: n/a Description: Silverstripe silverstripe/framework through 4.11 allows XSS vulnerability via href attribute of a link (issue 2 of 2). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.silverstripe.org/download/security-releases/ - https://www.silverstripe.org/blog/tag/release - https://forum.silverstripe.org/c/releases - https://www.silverstripe.org/download/security-releases/CVE-2022-37430
CVE ID: CVE-2022-37431 State: PUBLISHED Published: 2022-08-05T05:31:15 Last Updated: 2024-08-03T10:29:21.033Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Reflected Cross-site scripting (XSS) issue was discovered in dotCMS Core through 22.06. This occurs in the admin portal when the configuration has XSS_PROTECTION_ENABLED=false. NOTE: the vendor disputes this because the current product behavior, in effect, has XSS_PROTECTION_ENABLED=true in all configurations Additional Analyst Notes: - CVE Program Container: References: - https://fortiguard.fortinet.com/zeroday/FG-VD-22-062
CVE ID: CVE-2022-37434 State: PUBLISHED Published: 2022-08-05T00:00:00.000Z Last Updated: 2025-05-30T19:47:26.322Z Vendors: n/a Products: n/a Problem Types: n/a Description: zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code but may be unable to call inflateGetHeader (e.g., see the nodejs/node reference). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ivd38/zlib_overflow - https://github.com/madler/zlib/commit/eff308af425b67
ulnrichment: References: - https://github.com/ivd38/zlib_overflow - https://github.com/madler/zlib/commit/eff308af425b67093bab25f80f1ae950166bece1 - https://github.com/madler/zlib/blob/21767c654d31d2dccdde4330529775c6c5fd5389/zlib.h#L1062-L1063 - https://github.com/nodejs/node/blob/75b68c6e4db515f76df73af476eccf382bbcb00a/deps/zlib/inflate.c#L762-L764 - http://www.openwall.com/lists/oss-security/2022/08/05/2 - https://github.com/curl/curl/issues/9271 - http://www.openwall.com/lists/oss-security/2022/08/09/1 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YRQAI7H4M4RQZ2IWZUEEXECBE5D56BH2/ - https://www.debian.org/security/2022/dsa-5218 - http
lists.fedoraproject.org/message/YRQAI7H4M4RQZ2IWZUEEXECBE5D56BH2/ - https://www.debian.org/security/2022/dsa-5218 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NMBOJ77A7T7PQCARMDUK75TE6LLESZ3O/ - https://security.netapp.com/advisory/ntap-20220901-0005/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JWN4VE3JQR4O2SOUS5TXNLANRPMHWV4I/ - https://lists.debian.org/debian-lts-announce/2022/09/msg00012.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X5U7OTKZSHY2I3ZFJSR2SHFHW72RKGDK/ - https://lists.fedoraproject.org/archives/list/package-ann
.fedoraproject.org/message/X5U7OTKZSHY2I3ZFJSR2SHFHW72RKGDK/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PAVPQNCG3XRLCLNSQRM3KAN5ZFMVXVTY/ - https://support.apple.com/kb/HT213489 - https://support.apple.com/kb/HT213488 - https://support.apple.com/kb/HT213494 - https://support.apple.com/kb/HT213493 - https://support.apple.com/kb/HT213491 - https://support.apple.com/kb/HT213490 - http://seclists.org/fulldisclosure/2022/Oct/41 - http://seclists.org/fulldisclosure/2022/Oct/38 - http://seclists.org/fulldisclosure/2022/Oct/37 - http://seclists.org/fulldisclosure/2022/Oct/42 - https://security.netapp.com/advisory/ntap-20230427-0007/ - https://g
- http://seclists.org/fulldisclosure/2022/Oct/42 - https://security.netapp.com/advisory/ntap-20230427-0007/ - https://github.com/madler/zlib/commit/1eb7682f845ac9e9bf9ae35bbfb3bad5dacbd91d
CVE ID: CVE-2022-37435 State: PUBLISHED Published: 2022-09-01T14:00:14 Last Updated: 2024-08-03T10:29:20.982Z Vendors: Apache Software Foundation Products: Apache ShenYu Problem Types: CWE-732 Description: Apache ShenYu Admin has insecure permissions, which may allow low-privilege administrators to modify high-privilege administrator's passwords. This issue affects Apache ShenYu 2.4.2 and 2.4.3. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread/ndblyxr2fdrvjtgbs1bogxgv2cgk7t28
CVE ID: CVE-2022-37436 State: PUBLISHED Published: 2023-01-17T19:12:59.968Z Last Updated: 2025-04-04T18:06:37.763Z Vendors: Apache Software Foundation Products: Apache HTTP Server Problem Types: CWE-113 Description: Prior to Apache HTTP Server 2.4.55, a malicious backend can cause the response headers to be truncated early, resulting in some headers being incorporated into the response body. If the later headers have any security purpose, they will not be interpreted by the client. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://httpd.apache.org/security/vulnerabilities_24.html - https://security.gentoo.org/glsa/202309-01
CVE ID: CVE-2022-37437 State: PUBLISHED Published: 2022-08-16T19:50:29.832023Z Last Updated: 2024-09-16T20:03:48.193Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: Splunk Products: Splunk Enterprise Problem Types: CWE-295 Description: When using Ingest Actions to configure a destination that resides on Amazon Simple Storage Service (S3) in Splunk Web, TLS certificate validation is not correctly performed and tested for the destination. The vulnerability only affects connections between Splunk Enterprise and an Ingest Actions Destination through Splunk Web and only applies to environments that have configured TLS certificate validation. It does not apply to D
ough Splunk Web and only applies to environments that have configured TLS certificate validation. It does not apply to Destinations configured directly in the outputs.conf configuration file. The vulnerability affects Splunk Enterprise version 9.0.0 and does not affect versions below 9.0.0, including the 8.1.x and 8.2.x versions. Additional Analyst Notes: - CVE Program Container: References: - https://www.splunk.com/en_us/product-security/announcements/svd-2022-0801.html
CVE ID: CVE-2022-37438 State: PUBLISHED Published: 2022-08-16T19:49:23.763068Z Last Updated: 2024-09-17T01:46:12.412Z Severity: LOW (CVSS 2.6 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N) Vendors: Splunk Products: Splunk Enterprise, Splunk Cloud Platform Problem Types: CWE-200 Description: In Splunk Enterprise versions in the following table, an authenticated user can craft a dashboard that could potentially leak information (for example, username, email, and real name) about Splunk users, when visited by another user through the drilldown component. The vulnerability requires user access to create and share dashboards using Splunk Web. Additional Analyst Notes: - CVE Program Container: Refe
res user access to create and share dashboards using Splunk Web. Additional Analyst Notes: - CVE Program Container: References: - https://www.splunk.com/en_us/product-security/announcements/svd-2022-0802.html - https://research.splunk.com/application/f844c3f6-fd99-43a2-ba24-93e35fe84be6
CVE ID: CVE-2022-37439 State: PUBLISHED Published: 2022-08-16T19:49:49.787022Z Last Updated: 2024-09-16T22:56:21.322Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Splunk Products: Splunk Enterprise, Universal Forwarders Problem Types: CWE-409 Description: In Splunk Enterprise and Universal Forwarder versions in the following table, indexing a specially crafted ZIP file using the file monitoring input can result in a crash of the application. Attempts to restart the application would result in a crash and would require manually removing the malformed file. Additional Analyst Notes: - CVE Program Container: References: - https://www.splunk.com/en_us/product
he malformed file. Additional Analyst Notes: - CVE Program Container: References: - https://www.splunk.com/en_us/product-security/announcements/svd-2022-0803.html - https://research.splunk.com/application/b237d393-2f57-4531-aad7-ad3c17c8b041
CVE ID: CVE-2022-37440 State: REJECTED Published: 2022-08-15T19:50:31 Last Updated: 2022-08-15T19:50:31 Description: No description available.
CVE ID: CVE-2022-37441 State: REJECTED Published: 2022-08-15T19:50:43 Last Updated: 2022-08-15T19:50:43 Description: No description available.
CVE ID: CVE-2022-37442 State: REJECTED Published: 2022-08-15T19:50:52 Last Updated: 2022-08-15T19:50:52 Description: No description available.
CVE ID: CVE-2022-37443 State: REJECTED Published: 2022-08-15T19:50:58 Last Updated: 2022-08-15T19:50:58 Description: No description available.
CVE ID: CVE-2022-37444 State: REJECTED Published: 2022-08-15T19:51:09 Last Updated: 2022-08-15T19:51:09 Description: No description available.
CVE ID: CVE-2022-37445 State: REJECTED Published: 2022-08-15T19:51:29 Last Updated: 2022-08-15T19:51:29 Description: No description available.
CVE ID: CVE-2022-37446 State: REJECTED Published: 2022-08-15T19:51:46 Last Updated: 2022-08-15T19:51:46 Description: No description available.
CVE ID: CVE-2022-37447 State: REJECTED Published: 2022-08-15T19:52:10 Last Updated: 2022-08-15T19:52:10 Description: No description available.
CVE ID: CVE-2022-37448 State: REJECTED Published: 2022-08-15T19:52:27 Last Updated: 2022-08-15T19:52:27 Description: No description available.
CVE ID: CVE-2022-37449 State: REJECTED Published: 2022-08-15T19:52:46 Last Updated: 2022-08-15T19:52:46 Description: No description available.
CVE ID: CVE-2022-37450 State: PUBLISHED Published: 2022-08-05T20:30:46 Last Updated: 2024-08-03T10:29:20.985Z Vendors: n/a Products: n/a Problem Types: n/a Description: Go Ethereum (aka geth) through 1.10.21 allows attackers to increase rewards by mining blocks in certain situations, and using a manipulation of time-difference values to achieve replacement of main-chain blocks, aka Riskless Uncle Making (RUM), as exploited in the wild in 2020 through 2022. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ethereum/go-ethereum/blob/671094279e8d27f4b4c3c94bf8b636c26b473976/core/forkchoice.go#L91-L94 - https://medium.com/%40aviv.yaish/uncle-maker-time-stamping-
e8d27f4b4c3c94bf8b636c26b473976/core/forkchoice.go#L91-L94 - https://medium.com/%40aviv.yaish/uncle-maker-time-stamping-out-the-competition-in-ethereum-d27c1cb62fef - http://dx.doi.org/10.13140/RG.2.2.27813.99043 - https://news.ycombinator.com/item?id=32354896
CVE ID: CVE-2022-37451 State: PUBLISHED Published: 2022-08-06T17:02:11 Last Updated: 2024-08-03T10:29:21.028Z Vendors: n/a Products: n/a Problem Types: n/a Description: Exim before 4.96 has an invalid free in pam_converse in auths/call_pam.c because store_free is not used after store_malloc. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Exim/exim/wiki/EximSecurity - https://www.exim.org/static/doc/security/ - https://github.com/ivd38/exim_invalid_free - https://www.openwall.com/lists/oss-security/2022/08/06/1 - https://lists.exim.org/lurker/message/20220625.141825.d6de6074.en.html - https://cwe.mitre.org/data/definitions/762.html - https://github.com/Exi
rker/message/20220625.141825.d6de6074.en.html - https://cwe.mitre.org/data/definitions/762.html - https://github.com/Exim/exim/compare/exim-4.95...exim-4.96 - https://github.com/Exim/exim/commit/51be321b27825c01829dffd90f11bfff256f7e42 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LETR5CVDPFOFQHXCJP6NFLG52JZHQYDY/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XSWDF4QEXD4TDWQLYQOWCHBJKTDQR4Z7/
CVE ID: CVE-2022-37452 State: PUBLISHED Published: 2022-08-07T17:06:55 Last Updated: 2024-08-03T10:29:21.079Z Vendors: n/a Products: n/a Problem Types: n/a Description: Exim before 4.95 has a heap-based buffer overflow for the alias list in host_name_lookup in host.c when sender_host_name is set. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Exim/exim/wiki/EximSecurity - https://www.exim.org/static/doc/security/ - https://github.com/ivd38/exim_overflow - https://www.openwall.com/lists/oss-security/2022/08/06/8 - https://github.com/Exim/exim/compare/exim-4.94...exim-4.95 - https://github.com/Exim/exim/commit/d4bc023436e4cce7c23c5f8bb5199e178b4cc743 - http
exim/compare/exim-4.94...exim-4.95 - https://github.com/Exim/exim/commit/d4bc023436e4cce7c23c5f8bb5199e178b4cc743 - https://lists.debian.org/debian-lts-announce/2022/08/msg00014.html
CVE ID: CVE-2022-37453 State: PUBLISHED Published: 2022-10-20T00:00:00.000Z Last Updated: 2025-05-08T18:57:46.842Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Softing OPC UA C++ SDK before 6.10. A buffer overflow or an excess allocation happens due to unchecked array and matrix bounds in structure data types. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://softing.com - https://industrial.softing.com/fileadmin/psirt/downloads/syt-2022-9.html
CVE ID: CVE-2022-37454 State: PUBLISHED Published: 2022-10-21T00:00:00.000Z Last Updated: 2025-05-08T15:03:28.946Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic properties. This occurs in the sponge function interface. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://csrc.nist.gov/projects/hash-functions/sha-3-project - https://mouha.be/sha-3-buffer-overflow/ - https://news.ycombinator.com/item?id=33281106 - https://github.com/XKCP/XK
t - https://mouha.be/sha-3-buffer-overflow/ - https://news.ycombinator.com/item?id=33281106 - https://github.com/XKCP/XKCP/security/advisories/GHSA-6w4m-2xhg-2658 - https://lists.debian.org/debian-lts-announce/2022/10/msg00041.html - https://lists.debian.org/debian-lts-announce/2022/11/msg00000.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CMIEXLMTW5GO36HTFFWIPB3OHZXCT3G4/ - https://www.debian.org/security/2022/dsa-5267 - https://www.debian.org/security/2022/dsa-5269 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3ALQ6BDDPX5HU5YBQOBMDVAA2TSGDKIJ/ - https://eprint.iacr.org/2023/331 -
ckage-announce%40lists.fedoraproject.org/message/3ALQ6BDDPX5HU5YBQOBMDVAA2TSGDKIJ/ - https://eprint.iacr.org/2023/331 - https://news.ycombinator.com/item?id=35050307 - https://security.gentoo.org/glsa/202305-02
CVE ID: CVE-2022-37458 State: PUBLISHED Published: 2022-09-02T11:28:29 Last Updated: 2024-08-03T10:29:21.031Z Vendors: n/a Products: n/a Problem Types: n/a Description: Discourse through 2.8.7 allows admins to send invitations to arbitrary email addresses at an unlimited rate. Additional Analyst Notes: - CVE Program Container: References: - https://www.enisa.europa.eu/topics/threat-risk-management/vulnerability-disclosure - https://github.com/discourse/discourse/tags - https://github.com/discourse/discourse/security/advisories/GHSA-q2rg-m477-8wg7
CVE ID: CVE-2022-37459 State: PUBLISHED Published: 2022-08-17T12:49:21 Last Updated: 2024-08-03T10:29:21.026Z Vendors: n/a Products: n/a Problem Types: n/a Description: Ampere Altra devices before 1.08g and Ampere Altra Max devices before 2.05a allow attackers to control the predictions for return addresses and potentially hijack code flow to execute arbitrary code via a side-channel attack, aka a "Retbleed" issue. Additional Analyst Notes: - CVE Program Container: References: - https://amperecomputing.com/products/security-bulletins/retbleed.html - https://developer.arm.com/documentation/ka005138/1-0/
CVE ID: CVE-2022-37460 State: REJECTED Published: N/A Last Updated: 2024-05-06T20:43:18.714220 Description: No description available.
CVE ID: CVE-2022-37461 State: PUBLISHED Published: 2022-09-30T13:26:37.000Z Last Updated: 2025-05-20T19:21:22.569Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in Canon Medical Vitrea View 7.x before 7.7.6 allow remote attackers to inject arbitrary web script or HTML via (1) the input after the error subdirectory to the /vitrea-view/error/ subdirectory, or the (2) groupID, (3) offset, or (4) limit parameter to an Administrative Panel (Group and Users) page. There is a risk of an attacker retrieving patient information. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.vitalim
formation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.vitalimages.com/vitrea-vision/vitrea-view/ - https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=30693 - https://www.vitalimages.com/customer-success-support-program/vital-images-software-security-updates/
CVE ID: CVE-2022-37462 State: PUBLISHED Published: 2023-04-10T00:00:00.000Z Last Updated: 2025-02-12T17:22:15.441Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored Cross-Site Scripting (XSS) vulnerability in the Chat gadget in Upstream Works Agent Desktop for Cisco Finesse through 4.2.12 and 5.0 allows remote attackers to inject arbitrary web script or HTML via AttachmentId in the file-upload details. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.upstreamworks.com/support/notifications/ - https://www.campusguard.com/post/going-beyond-pen-testing-to-identify-zero-day-exploits
CVE ID: CVE-2022-37598 State: PUBLISHED Published: 2022-10-20T00:00:00 Last Updated: 2024-08-03T10:29:21.029Z Vendors: n/a Products: n/a Problem Types: n/a Description: Prototype pollution vulnerability in function DEFNODE in ast.js in mishoo UglifyJS 3.13.2 via the name variable in ast.js. NOTE: the vendor considers this an invalid report. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/mishoo/UglifyJS/blob/352a944868b09c9ce3121a49d4a0bf0afe370a35/lib/ast.js#L46 - https://github.com/mishoo/UglifyJS/blob/352a944868b09c9ce3121a49d4a0bf0afe370a35/lib/ast.js#L79 - https://github.com/mishoo/UglifyJS/issues/5699 - https://github.com/mis
8b09c9ce3121a49d4a0bf0afe370a35/lib/ast.js#L79 - https://github.com/mishoo/UglifyJS/issues/5699 - https://github.com/mishoo/UglifyJS/issues/5721#issuecomment-1292849604
CVE ID: CVE-2022-37599 State: PUBLISHED Published: 2022-10-11T00:00:00.000Z Last Updated: 2025-11-04T18:14:20.740Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.0 via the resourcePath variable in interpolateName.js. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/webpack/loader-utils/blob/d9f4e23cf411d8556f8bac2d3bf05a6e0103b568/lib/interpolateName.js#L38 - https://github.com/webpack/loader-utils/blob/d9f4e23cf411d8556f8bac2d3bf05a6e0103b568/lib/interpolateName.js#L83 - https://github.com/webpack/loader-ut
er-utils/blob/d9f4e23cf411d8556f8bac2d3bf05a6e0103b568/lib/interpolateName.js#L83 - https://github.com/webpack/loader-utils/issues/211 - https://github.com/webpack/loader-utils/issues/216 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6PVVPNSAGSDS63HQ74PJ7MZ3MU5IYNVZ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3HUE6ZR5SL73KHL7XUPAOEL6SB7HUDT2/