Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-25192 State: PUBLISHED Published: 2022-02-15T16:11:20 Last Updated: 2024-08-03T04:36:06.188Z Vendors: Jenkins project Products: Jenkins Snow Commander Plugin Description: A cross-site request forgery (CSRF) vulnerability in Jenkins Snow Commander Plugin 1.10 and earlier allows attackers to connect to an attacker-specified webserver using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-02-15/#SECURITY-2536
CVE ID: CVE-2022-25193 State: PUBLISHED Published: 2022-02-15T16:11:21 Last Updated: 2024-08-03T04:36:06.519Z Vendors: Jenkins project Products: Jenkins Snow Commander Plugin Description: Missing permission checks in Jenkins Snow Commander Plugin 1.10 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified webserver using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-02-15/#SECURITY-2536
CVE ID: CVE-2022-25194 State: PUBLISHED Published: 2022-02-15T16:11:23 Last Updated: 2024-08-03T04:36:05.840Z Vendors: Jenkins project Products: Jenkins autonomiq Plugin Description: A cross-site request forgery (CSRF) vulnerability in Jenkins autonomiq Plugin 1.15 and earlier allows attackers to connect to an attacker-specified URL server using attacker-specified credentials. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-02-15/#SECURITY-2545
CVE ID: CVE-2022-25195 State: PUBLISHED Published: 2022-02-15T16:11:25 Last Updated: 2024-08-03T04:36:06.288Z Vendors: Jenkins project Products: Jenkins autonomiq Plugin Description: A missing permission check in Jenkins autonomiq Plugin 1.15 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-02-15/#SECURITY-2545
CVE ID: CVE-2022-25196 State: PUBLISHED Published: 2022-02-15T16:11:26 Last Updated: 2024-08-03T04:36:05.841Z Vendors: Jenkins project Products: Jenkins GitLab Authentication Plugin Description: Jenkins GitLab Authentication Plugin 1.13 and earlier records the HTTP Referer header as part of the URL query parameters when the authentication process starts, allowing attackers with access to Jenkins to craft a URL that will redirect users to an attacker-specified URL after logging in. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-02-15/#SECURITY-1833 - http://www.openwall.com/lists/oss-security/2022/02/15/2
CVE ID: CVE-2022-25197 State: PUBLISHED Published: 2022-02-15T16:11:28 Last Updated: 2024-08-03T04:36:06.402Z Vendors: Jenkins project Products: Jenkins HashiCorp Vault Plugin Description: Jenkins HashiCorp Vault Plugin 336.v182c0fbaaeb7 and earlier implements functionality that allows agent processes to read arbitrary files on the Jenkins controller file system. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-02-15/#SECURITY-2521
CVE ID: CVE-2022-25198 State: PUBLISHED Published: 2022-02-15T16:11:29 Last Updated: 2024-08-03T04:36:05.841Z Vendors: Jenkins project Products: Jenkins SCP publisher Plugin Description: A cross-site request forgery (CSRF) vulnerability in Jenkins SCP publisher Plugin 1.8 and earlier allows attackers to connect to an attacker-specified SSH server using attacker-specified credentials. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-02-15/#SECURITY-2323
CVE ID: CVE-2022-25199 State: PUBLISHED Published: 2022-02-15T16:11:30 Last Updated: 2024-08-03T04:36:06.621Z Vendors: Jenkins project Products: Jenkins SCP publisher Plugin Description: A missing permission check in Jenkins SCP publisher Plugin 1.8 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified SSH server using attacker-specified credentials. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-02-15/#SECURITY-2323
CVE ID: CVE-2022-25200 State: PUBLISHED Published: 2022-02-15T16:11:33 Last Updated: 2024-08-03T04:36:06.496Z Vendors: Jenkins project Products: Jenkins Checkmarx Plugin Description: A cross-site request forgery (CSRF) vulnerability in Jenkins Checkmarx Plugin 2022.1.2 and earlier allows attackers to connect to an attacker-specified webserver using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-02-15/#SECURITY-1017 - http://www.openwall.com/lists/oss-security/2022/02/15/2
CVE ID: CVE-2022-25201 State: PUBLISHED Published: 2022-02-15T16:11:34 Last Updated: 2024-08-03T04:36:06.623Z Vendors: Jenkins project Products: Jenkins Checkmarx Plugin Description: Missing permission checks in Jenkins Checkmarx Plugin 2022.1.2 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified webserver using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-02-15/#SECURITY-1017
CVE ID: CVE-2022-25202 State: PUBLISHED Published: 2022-02-15T16:11:36 Last Updated: 2024-08-03T04:36:06.532Z Vendors: Jenkins project Products: Jenkins Promoted Builds (Simple) Plugin Description: Jenkins Promoted Builds (Simple) Plugin 1.9 and earlier does not escape the name of custom promotion levels, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Overall/Administer permission. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-02-15/#SECURITY-2334
CVE ID: CVE-2022-25203 State: PUBLISHED Published: 2022-02-15T16:11:37 Last Updated: 2024-08-03T04:36:05.751Z Vendors: Jenkins project Products: Jenkins Team Views Plugin Description: Jenkins Team Views Plugin 0.9.0 and earlier does not escape team names, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Overall/Read permission. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-02-15/#SECURITY-2324
CVE ID: CVE-2022-25204 State: PUBLISHED Published: 2022-02-15T16:11:39 Last Updated: 2024-08-03T04:36:06.439Z Vendors: Jenkins project Products: Jenkins Doktor Plugin Description: Jenkins Doktor Plugin 0.4.1 and earlier implements functionality that allows agent processes to render files on the controller as Markdown or Asciidoc, and error messages allow attackers able to control agent processes to determine whether a file with a given name exists. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-02-15/#SECURITY-2548
CVE ID: CVE-2022-25205 State: PUBLISHED Published: 2022-02-15T16:11:41 Last Updated: 2024-08-03T04:36:06.646Z Vendors: Jenkins project Products: Jenkins dbCharts Plugin Description: A cross-site request forgery (CSRF) vulnerability in Jenkins dbCharts Plugin 0.5.2 and earlier allows attackers to connect to an attacker-specified database via JDBC using attacker-specified credentials and to determine if a class is available in the Jenkins instance. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-02-15/#SECURITY-2177
CVE ID: CVE-2022-25206 State: PUBLISHED Published: 2022-02-15T16:11:42 Last Updated: 2024-08-03T04:36:06.547Z Vendors: Jenkins project Products: Jenkins dbCharts Plugin Description: A missing check in Jenkins dbCharts Plugin 0.5.2 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified database via JDBC using attacker-specified credentials. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-02-15/#SECURITY-2177
CVE ID: CVE-2022-25207 State: PUBLISHED Published: 2022-02-15T16:11:43 Last Updated: 2024-08-03T04:36:06.608Z Vendors: Jenkins project Products: Jenkins Chef Sinatra Plugin Description: A cross-site request forgery (CSRF) vulnerability in Jenkins Chef Sinatra Plugin 1.20 and earlier allows attackers to have Jenkins send an HTTP request to an attacker-controlled URL and have it parse an XML response. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-02-15/#SECURITY-1377 - http://www.openwall.com/lists/oss-security/2022/02/15/2
CVE ID: CVE-2022-25208 State: PUBLISHED Published: 2022-02-15T16:11:45 Last Updated: 2024-08-03T04:36:06.563Z Vendors: Jenkins project Products: Jenkins Chef Sinatra Plugin Description: A missing permission check in Jenkins Chef Sinatra Plugin 1.20 and earlier allows attackers with Overall/Read permission to have Jenkins send an HTTP request to an attacker-controlled URL and have it parse an XML response. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-02-15/#SECURITY-1377 - http://www.openwall.com/lists/oss-security/2022/02/15/2
CVE ID: CVE-2022-25209 State: PUBLISHED Published: 2022-02-15T16:11:46 Last Updated: 2024-08-03T04:36:06.442Z Vendors: Jenkins project Products: Jenkins Chef Sinatra Plugin Description: Jenkins Chef Sinatra Plugin 1.20 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-02-15/#SECURITY-1377
CVE ID: CVE-2022-25210 State: PUBLISHED Published: 2022-02-15T16:11:48 Last Updated: 2024-08-03T04:36:06.458Z Vendors: Jenkins project Products: Jenkins Convertigo Mobile Platform Plugin Description: Jenkins Convertigo Mobile Platform Plugin 1.1 and earlier uses static fields to store job configuration information, allowing attackers with Item/Configure permission to capture passwords of the jobs that will be configured. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-02-15/#SECURITY-2280
CVE ID: CVE-2022-25211 State: PUBLISHED Published: 2022-02-15T16:11:49 Last Updated: 2024-08-03T04:36:05.791Z Vendors: Jenkins project Products: Jenkins SWAMP Plugin Description: A missing permission check in Jenkins SWAMP Plugin 1.2.6 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified web server using attacker-specified credentials. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-02-15/#SECURITY-1988
CVE ID: CVE-2022-25212 State: PUBLISHED Published: 2022-02-15T16:11:51 Last Updated: 2024-08-03T04:36:06.498Z Vendors: Jenkins project Products: Jenkins SWAMP Plugin Description: A cross-site request forgery (CSRF) vulnerability in Jenkins SWAMP Plugin 1.2.6 and earlier allows attackers to connect to an attacker-specified web server using attacker-specified credentials. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-02-15/#SECURITY-1988
CVE ID: CVE-2022-25213 State: PUBLISHED Published: 2022-03-07T21:55:25 Last Updated: 2024-08-03T04:36:06.435Z Vendors: n/a Products: Phicomm Routers Problem Types: Improper physical access control Description: Improper physical access control and use of hard-coded credentials in /etc/passwd permits an attacker with physical access to obtain a root shell via an unprotected UART port on the device. The same port exposes an unauthenticated Das U-Boot BIOS shell. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2022-01
CVE ID: CVE-2022-25214 State: PUBLISHED Published: 2022-03-07T21:47:00 Last Updated: 2024-08-03T04:36:05.813Z Vendors: n/a Products: Phicomm Routers Problem Types: Improper access control leading to information leaks Description: Improper access control on the LocalClientList.asp interface allows an unauthenticated remote attacker to obtain sensitive information concerning devices on the local area network, including IP and MAC addresses. Improper access control on the wirelesssetup.asp interface allows an unauthenticated remote attacker to obtain the WPA passphrases for the 2.4GHz and 5.0GHz wireless networks. This is particularly dangerous given that the K2G setup wizard presents the user
e 2.4GHz and 5.0GHz wireless networks. This is particularly dangerous given that the K2G setup wizard presents the user with the option of using the same password for the 2.4Ghz network and the administrative interface, by clicking a checkbox. When Remote Managment is enabled, these endpoints are exposed to the WAN. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2022-01
CVE ID: CVE-2022-25215 State: PUBLISHED Published: 2022-03-07T21:53:11 Last Updated: 2024-08-03T04:36:06.378Z Vendors: n/a Products: Phicomm Routers Problem Types: Improper access control leading to denial of service Description: Improper access control on the LocalMACConfig.asp interface allows an unauthenticated remote attacker to add (or remove) client MAC addresses to (or from) a list of banned hosts. Clients with those MAC addresses are then prevented from accessing either the WAN or the router itself. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2022-01
CVE ID: CVE-2022-25216 State: PUBLISHED Published: 2022-03-11T17:54:38 Last Updated: 2024-08-03T04:36:06.443Z Vendors: n/a Products: DVDFab 12 Player / PlayerFab Problem Types: Path traversal Description: An absolute path traversal vulnerability allows a remote attacker to download any file on the Windows file system for which the user account running DVDFab 12 Player (recently renamed PlayerFab) has read-access, by means of an HTTP GET request to http://<IP_ADDRESS>:32080/download/<URL_ENCODED_PATH>. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2022-07
CVE ID: CVE-2022-25217 State: PUBLISHED Published: 2022-03-07T21:49:05 Last Updated: 2024-08-03T04:36:06.305Z Vendors: n/a Products: Phicomm Routers Problem Types: Use of a hard-coded cryptographic key Description: Use of a hard-coded cryptographic key pair by the telnetd_startup service allows an attacker on the local area network to obtain a root shell on the device over telnet. The builds of telnetd_startup included in the version 22.5.9.163 of the K2 firmware, and version 32.1.15.93 of the K3C firmware (possibly amongst many other releases) included both the private and public RSA keys. The remaining versions cited here redacted the private key, but left the public key unchanged. An atta
public RSA keys. The remaining versions cited here redacted the private key, but left the public key unchanged. An attacker in possession of the leaked private key may, through a scripted exchange of UDP packets, instruct telnetd_startup to spawn an unauthenticated telnet shell as root, by means of which they can then obtain complete control of the device. A consequence of the limited availablility of firmware images for testing is that models and versions not listed here may share this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2022-01
CVE ID: CVE-2022-25218 State: PUBLISHED Published: 2022-03-07T21:50:25 Last Updated: 2024-08-03T04:36:06.287Z Vendors: n/a Products: Phicomm Routers Problem Types: Use of RSA Algorithm without OAEP Description: The use of the RSA algorithm without OAEP, or any other padding scheme, in telnetd_startup, allows an unauthenticated attacker on the local area network to achieve a significant degree of control over the "plaintext" to which an arbitrary blob of ciphertext will be decrypted by OpenSSL's RSA_public_decrypt() function. This weakness allows the attacker to manipulate the various iterations of the telnetd startup state machine and eventually obtain a root shell on the device, by means of
he various iterations of the telnetd startup state machine and eventually obtain a root shell on the device, by means of an exchange of crafted UDP packets. In all versions but K2 22.5.9.163 and K3C 32.1.15.93 a successful attack also requires the exploitation of a null-byte interaction error (CVE-2022-25219). Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2022-01
CVE ID: CVE-2022-25219 State: PUBLISHED Published: 2022-03-07T21:56:51 Last Updated: 2024-08-03T04:36:05.791Z Vendors: n/a Products: Phicomm Routers Problem Types: Null Byte Interaction Error Description: A null byte interaction error has been discovered in the code that the telnetd_startup daemon uses to construct a pair of ephemeral passwords that allow a user to spawn a telnet service on the router, and to ensure that the telnet service persists upon reboot. By means of a crafted exchange of UDP packets, an unauthenticated attacker on the local network can leverage this null byte interaction error in such a way as to make those ephemeral passwords predictable (with 1-in-94 odds). Since th
null byte interaction error in such a way as to make those ephemeral passwords predictable (with 1-in-94 odds). Since the attacker must manipulate data processed by the OpenSSL function RSA_public_decrypt(), successful exploitation of this vulnerability depends on the use of an unpadded RSA cipher (CVE-2022-25218). Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2022-01
CVE ID: CVE-2022-25220 State: PUBLISHED Published: 2022-03-03T21:57:46 Last Updated: 2024-08-03T04:36:06.450Z Vendors: n/a Products: PeTeReport Problem Types: Stored cross-site scripting (XSS) Description: PeteReport Version 0.5 allows an authenticated admin user to inject persistent JavaScript code inside the markdown descriptions while creating a product, report or finding. Additional Analyst Notes: - CVE Program Container: References: - https://fluidattacks.com/advisories/armstrong/ - https://github.com/1modm/petereport/issues/35
CVE ID: CVE-2022-25221 State: PUBLISHED Published: 2022-03-23T19:46:11 Last Updated: 2024-08-03T04:36:06.485Z Vendors: n/a Products: Money Transfer Management System Problem Types: DOM-Based Cross-Site Scripting (XSS) Description: Money Transfer Management System Version 1.0 allows an attacker to inject JavaScript code in the URL and then trick a user into visit the link in order to execute JavaScript code. Additional Analyst Notes: - CVE Program Container: References: - https://fluidattacks.com/advisories/charles/
CVE ID: CVE-2022-25222 State: PUBLISHED Published: 2022-03-23T19:46:12 Last Updated: 2024-08-03T04:36:06.454Z Vendors: n/a Products: Money Transfer Management System Problem Types: SQL injection Description: Money Transfer Management System Version 1.0 allows an unauthenticated user to inject SQL queries in 'admin/maintenance/manage_branch.php' and 'admin/maintenance/manage_fee.php' via the 'id' parameter. Additional Analyst Notes: - CVE Program Container: References: - https://fluidattacks.com/advisories/berry/
CVE ID: CVE-2022-25223 State: PUBLISHED Published: 2022-03-23T19:46:13 Last Updated: 2024-08-03T04:36:06.462Z Vendors: n/a Products: Money Transfer Management System Problem Types: SQL injection Description: Money Transfer Management System Version 1.0 allows an authenticated user to inject SQL queries in 'mtms/admin/?page=transaction/view_details' via the 'id' parameter. Additional Analyst Notes: - CVE Program Container: References: - https://fluidattacks.com/advisories/jagger/
CVE ID: CVE-2022-25224 State: PUBLISHED Published: 2022-05-20T11:04:12 Last Updated: 2024-08-03T04:36:06.522Z Vendors: n/a Products: Proton Problem Types: XSS to RCE Description: Proton v0.2.0 allows an attacker to create a malicious link inside a markdown file. When the victim clicks the link, the application opens the site in the current frame allowing an attacker to host JavaScript code in the malicious link in order to trigger an XSS attack. The 'nodeIntegration' configuration is set to on which allows the 'webpage' to use 'NodeJs' features, an attacker can leverage this to run OS commands. Additional Analyst Notes: - CVE Program Container: References: - https://fluidattacks.com/advisori
s to run OS commands. Additional Analyst Notes: - CVE Program Container: References: - https://fluidattacks.com/advisories/lennon/
CVE ID: CVE-2022-25225 State: PUBLISHED Published: 2022-03-08T14:19:27 Last Updated: 2024-08-03T04:36:06.442Z Vendors: n/a Products: Network Olympus Problem Types: Remote code execution (RCE) Description: Network Olympus version 1.8.0 allows an authenticated admin user to inject SQL queries in '/api/eventinstance' via the 'sqlparameter' JSON parameter. It is also possible to achieve remote code execution in the default installation (PostgreSQL) by exploiting this issue. Additional Analyst Notes: - CVE Program Container: References: - https://fluidattacks.com/advisories/spinetta/ - https://www.network-olympus.com/monitoring/
CVE ID: CVE-2022-25226 State: PUBLISHED Published: 2022-04-18T16:20:44 Last Updated: 2024-08-03T04:36:06.608Z Vendors: n/a Products: ThinVNC Problem Types: Authentication Bypass Description: ThinVNC version 1.0b1 allows an unauthenticated user to bypass the authentication process via 'http://thin-vnc:8080/cmd?cmd=connect' by obtaining a valid SID without any kind of authentication. It is possible to achieve code execution on the server by sending keyboard or mouse events to the server. Additional Analyst Notes: - CVE Program Container: References: - https://fluidattacks.com/advisories/sinatra/
CVE ID: CVE-2022-25227 State: PUBLISHED Published: 2022-05-20T11:02:49 Last Updated: 2024-08-03T04:36:06.591Z Vendors: n/a Products: Thinfinity VNC Problem Types: CORS Misconfiguration Description: Thinfinity VNC v4.0.0.1 contains a Cross-Origin Resource Sharing (CORS) vulnerability which can allow an unprivileged remote attacker, if they can trick a user into browse malicious site, to obtain an 'ID' that can be used to send websocket requests and achieve RCE. Additional Analyst Notes: - CVE Program Container: References: - https://fluidattacks.com/advisories/clapton/
CVE ID: CVE-2022-25228 State: PUBLISHED Published: 2022-08-18T19:29:36 Last Updated: 2024-08-03T04:36:06.648Z Vendors: n/a Products: CandidATS Problem Types: SQL injection Description: CandidATS Version 3.0.0 Beta allows an authenticated user to inject SQL queries in '/index.php?m=settings&a=show' via the 'userID' parameter, in '/index.php?m=candidates&a=show' via the 'candidateID', in '/index.php?m=joborders&a=show' via the 'jobOrderID' and '/index.php?m=companies&a=show' via the 'companyID' parameter Additional Analyst Notes: - CVE Program Container: References: - https://fluidattacks.com/advisories/jackson/ - https://candidats.net/forums/
CVE ID: CVE-2022-25229 State: PUBLISHED Published: 2022-05-20T11:01:18 Last Updated: 2024-08-03T04:36:06.674Z Vendors: n/a Products: Popcorn Time Problem Types: XSS to RCE Description: Popcorn Time 0.4.7 has a Stored XSS in the 'Movies API Server(s)' field via the 'settings' page. The 'nodeIntegration' configuration is set to on which allows the 'webpage' to use 'NodeJs' features, an attacker can leverage this to run OS commands. Additional Analyst Notes: - CVE Program Container: References: - https://fluidattacks.com/advisories/bowie/ - https://github.com/popcorn-official/popcorn-desktop/issues/2491