Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-24049 State: PUBLISHED Published: 2022-02-18T19:51:43 Last Updated: 2024-08-03T03:59:23.606Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Sonos Products: One Speaker Problem Types: CWE-121 Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Sonos One Speaker prior to 3.4.1 (S2 systems) and 11.2.13 build 57923290 (S1 systems). Authentication is not required to exploit this vulnerability. The specific flaw exists within the ALAC audio codec. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An atta
m the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-15798. Additional Analyst Notes: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-22-261/
CVE ID: CVE-2022-24050 State: PUBLISHED Published: 2022-02-18T19:51:44 Last Updated: 2024-08-03T03:59:23.684Z Severity: HIGH (CVSS 7 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: MariaDB Products: MariaDB Problem Types: CWE-416 Description: MariaDB CONNECT Storage Engine Use-After-Free Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of MariaDB. Authentication is required to exploit this vulnerability. The specific flaw exists within the processing of SQL queries. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage
he lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the service account. Was ZDI-CAN-16207. Additional Analyst Notes: - CVE Program Container: References: - https://mariadb.com/kb/en/security/ - https://www.zerodayinitiative.com/advisories/ZDI-22-364/ - https://security.netapp.com/advisory/ntap-20220318-0004/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NJ4KDAGF3H4D4BDTHRAM6ZEAJJWWMRUO/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DK
THRAM6ZEAJJWWMRUO/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DKJRBYJAQCOPHSED43A3HUPNKQLDTFGD/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EZFZVMJL5UDTOZMARLXQIMG3BTG6UNYW/
CVE ID: CVE-2022-24051 State: PUBLISHED Published: 2022-02-18T19:51:46 Last Updated: 2024-08-03T03:59:23.659Z Severity: HIGH (CVSS 7 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: MariaDB Products: MariaDB Problem Types: CWE-134 Description: MariaDB CONNECT Storage Engine Format String Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of MariaDB. Authentication is required to exploit this vulnerability. The specific flaw exists within the processing of SQL queries. The issue results from the lack of proper validation of a user-supplied string before using it as a format specifier. An attacker can leverage th
e lack of proper validation of a user-supplied string before using it as a format specifier. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the service account. Was ZDI-CAN-16193. Additional Analyst Notes: - CVE Program Container: References: - https://mariadb.com/kb/en/security/ - https://www.zerodayinitiative.com/advisories/ZDI-22-318/ - https://security.netapp.com/advisory/ntap-20220318-0004/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NJ4KDAGF3H4D4BDTHRAM6ZEAJJWWMRUO/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DKJR
CVE ID: CVE-2022-24052 State: PUBLISHED Published: 2022-02-18T19:51:48 Last Updated: 2024-08-03T03:59:23.548Z Severity: HIGH (CVSS 7 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: MariaDB Products: MariaDB Problem Types: CWE-122 Description: MariaDB CONNECT Storage Engine Heap-based Buffer Overflow Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of MariaDB. Authentication is required to exploit this vulnerability. The specific flaw exists within the processing of SQL queries. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-
sults from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the service account. Was ZDI-CAN-16190. Additional Analyst Notes: - CVE Program Container: References: - https://mariadb.com/kb/en/security/ - https://www.zerodayinitiative.com/advisories/ZDI-22-367/ - https://security.netapp.com/advisory/ntap-20220318-0004/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NJ4KDAGF3H4D4BDTHRAM6ZEAJJWWMRUO/ - https://lists.fedoraproject.org/archives/list/package-announ
CVE ID: CVE-2022-24055 State: PUBLISHED Published: 2022-02-18T19:51:49 Last Updated: 2024-08-03T03:59:23.490Z Severity: LOW (CVSS 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: Sante Products: DICOM Viewer Pro Problem Types: CWE-125 Description: This vulnerability allows remote attackers to disclose sensitive information on affected installations of Sante DICOM Viewer Pro 11.8.7.0. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of GIF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the e
files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-14972. Additional Analyst Notes: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-22-247/
CVE ID: CVE-2022-24056 State: PUBLISHED Published: 2022-02-18T19:51:50 Last Updated: 2024-08-03T03:59:23.649Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Sante Products: DICOM Viewer Pro Problem Types: CWE-787 Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Sante DICOM Viewer Pro 11.8.7.0. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of J2K files. Crafted data in a J2K file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulner
Crafted data in a J2K file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15076. Additional Analyst Notes: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-22-248/
CVE ID: CVE-2022-24057 State: PUBLISHED Published: 2022-02-18T19:51:52 Last Updated: 2024-08-03T03:59:23.637Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Sante Products: DICOM Viewer Pro Problem Types: CWE-787 Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Sante DICOM Viewer Pro 11.8.7.0. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of J2K files. Crafted data in a J2K file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulner
Crafted data in a J2K file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15077. Additional Analyst Notes: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-22-249/
CVE ID: CVE-2022-24058 State: PUBLISHED Published: 2022-02-18T19:51:53 Last Updated: 2024-08-03T03:59:23.491Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Sante Products: DICOM Viewer Pro Problem Types: CWE-787 Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Sante DICOM Viewer Pro 11.8.7.0. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of J2K files. Crafted data in a J2K file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulner
Crafted data in a J2K file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15095. Additional Analyst Notes: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-22-250/
CVE ID: CVE-2022-24059 State: PUBLISHED Published: 2022-02-18T19:51:54 Last Updated: 2024-08-03T03:59:23.699Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Sante Products: DICOM Viewer Pro Problem Types: CWE-787 Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Sante DICOM Viewer Pro 11.8.7.0. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DCM files. Crafted data in a DCM file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulner
Crafted data in a DCM file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process Was ZDI-CAN-15098. Additional Analyst Notes: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-22-251/
CVE ID: CVE-2022-24060 State: PUBLISHED Published: 2022-02-18T19:51:56 Last Updated: 2024-08-03T03:59:23.571Z Severity: LOW (CVSS 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: Sante Products: DICOM Viewer Pro Problem Types: CWE-125 Description: This vulnerability allows remote attackers to disclose sensitive information on affected installations of Sante DICOM Viewer Pro 11.8.7.0. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DCM files. Crafted data in a DCM file can trigger a read past the end of an allocated buffer. An attacker can leverage this
files. Crafted data in a DCM file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-15099. Additional Analyst Notes: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-22-252/
CVE ID: CVE-2022-24061 State: PUBLISHED Published: 2022-02-18T19:51:57 Last Updated: 2024-08-03T03:59:23.579Z Severity: LOW (CVSS 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: Sante Products: DICOM Viewer Pro Problem Types: CWE-416 Description: This vulnerability allows remote attackers to disclose sensitive information on affected installations of Sante DICOM Viewer Pro 11.8.7.0. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DCM files. The issue results from the lack of validating the existence of an object prior to performing operations on the ob
files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-15100. Additional Analyst Notes: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-22-253/
CVE ID: CVE-2022-24062 State: PUBLISHED Published: 2022-02-18T19:51:59 Last Updated: 2024-08-03T03:59:23.459Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Sante Products: DICOM Viewer Pro Problem Types: CWE-416 Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Sante DICOM Viewer Pro 13.2.0.21165. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JP2 files. The issue results from the lack of validating the existence of an object prior to performing operations on the objec
es. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15104. Additional Analyst Notes: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-22-254/
CVE ID: CVE-2022-24063 State: PUBLISHED Published: 2022-02-18T19:52:00 Last Updated: 2024-08-03T03:59:23.650Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Sante Products: DICOM Viewer Pro Problem Types: CWE-119 Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Sante DICOM Viewer Pro 13.2.0.21165. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JP2 files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption
es. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15105. Additional Analyst Notes: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-22-255/
CVE ID: CVE-2022-24064 State: PUBLISHED Published: 2022-02-18T19:52:01 Last Updated: 2024-08-03T03:59:23.635Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Sante Products: DICOM Viewer Pro Problem Types: CWE-787 Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Sante DICOM Viewer Pro 11.8.8.0. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of J2K images. Crafted data in a J2K file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulne
Crafted data in a J2K file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15161. Additional Analyst Notes: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-22-256/
CVE ID: CVE-2022-24065 State: PUBLISHED Published: 2022-06-03T20:00:14.617802Z Last Updated: 2024-09-17T00:46:55.130Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P) Vendors: n/a Products: cookiecutter Problem Types: Command Injection Description: The package cookiecutter before 2.1.1 are vulnerable to Command Injection via hg argument injection. When calling the cookiecutter function from Python code with the checkout parameter, it is passed to the hg checkout command in a way that additional flags can be set. The additional flags can be used to perform a command injection. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-
perform a command injection. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-PYTHON-COOKIECUTTER-2414281 - https://github.com/cookiecutter/cookiecutter/releases/tag/2.1.1 - https://github.com/cookiecutter/cookiecutter/commit/fdffddb31fd2b46344dfa317531ff155e7999f77 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HQKWT7SGFDCUPPLDIELTN7FVTHWDL5YK/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G5TXC4JYTNGOUFMCXPZ6QKWEZN3URTAK/
CVE ID: CVE-2022-24066 State: PUBLISHED Published: 2022-04-01T20:00:16.930499Z Last Updated: 2024-09-16T21:08:34.077Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: n/a Products: simple-git Problem Types: Command Injection Description: The package simple-git before 3.5.0 are vulnerable to Command Injection due to an incomplete fix of [CVE-2022-24433](https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-2421199) which only patches against the git fetch attack vector. A similar use of the --upload-pack feature of git is also supported for git clone, which the prior fix didn't cover. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vul
, which the prior fix didn't cover. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-SIMPLEGIT-2434306 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2434820 - https://gist.github.com/lirantal/a930d902294b833514e821102316426b - https://github.com/steveukx/git-js/commit/2040de601c894363050fef9f28af367b169a56c5
CVE ID: CVE-2022-24067 State: REJECTED Published: N/A Last Updated: 2025-05-28T16:31:04.388Z Description: No description available.
CVE ID: CVE-2022-24069 State: PUBLISHED Published: 2022-02-02T23:46:35.000Z Last Updated: 2025-11-04T19:13:01.180Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in AhciBusDxe in Insyde InsydeH2O with kernel 5.0 before 05.08.41, 5.1 before 05.16.29, 5.2 before 05.26.29, 5.3 before 05.35.29, 5.4 before 05.43.29, and 5.5 before 05.51.29. An SMM callout vulnerability allows an attacker to hijack the execution flow of code running in System Management Mode. Exploiting this issue could lead to escalating privileges to SMM. Additional Analyst Notes: - CVE Program Container: References: - https://www.insyde.com/security-pledge - https://security.netapp.com/adviso
otes: - CVE Program Container: References: - https://www.insyde.com/security-pledge - https://security.netapp.com/advisory/ntap-20220216-0002/ - https://cert-portal.siemens.com/productcert/pdf/ssa-306654.pdf
CVE ID: CVE-2022-24070 State: PUBLISHED Published: 2022-04-12T17:50:14 Last Updated: 2024-08-03T03:59:23.785Z Vendors: Apache Software Foundation Products: Apache Subversion Problem Types: CWE-416 Description: Subversion's mod_dav_svn is vulnerable to memory corruption. While looking up path-based authorization rules, mod_dav_svn servers may attempt to use memory which has already been freed. Affected Subversion mod_dav_svn servers 1.10.0 through 1.14.1 (inclusive). Servers that do not use mod_dav_svn are not affected. Additional Analyst Notes: - CVE Program Container: References: - https://issues.apache.org/jira/browse/SVN-4880 - https://bz.apache.org/bugzilla/show_bug.cgi?id=65861 - https:
rences: - https://issues.apache.org/jira/browse/SVN-4880 - https://bz.apache.org/bugzilla/show_bug.cgi?id=65861 - https://cwiki.apache.org/confluence/display/HTTPD/ModuleLife - https://www.debian.org/security/2022/dsa-5119 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YJPMCWCGWBN3QWCDVILWQWPC75RR67LT/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PZ4ARNGLMGYBKYDX2B7DRBNMF6EH3A6R/ - https://support.apple.com/kb/HT213345 - http://seclists.org/fulldisclosure/2022/Jul/18
CVE ID: CVE-2022-24071 State: PUBLISHED Published: 2022-01-28T10:04:53 Last Updated: 2024-08-03T03:59:23.786Z Vendors: NAVER Products: NAVER Whale browser Problem Types: CWE-648 Description: A Built-in extension in Whale browser before 3.12.129.46 allows attackers to compromise the rendering process which could lead to controlling browser internal APIs. Additional Analyst Notes: - CVE Program Container: References: - https://cve.naver.com/detail/cve-2022-24071
CVE ID: CVE-2022-24072 State: PUBLISHED Published: 2022-03-17T05:20:13 Last Updated: 2024-08-03T03:59:23.580Z Vendors: NAVER Products: NAVER Whale browser Problem Types: CWE-269 Description: The devtools API in Whale browser before 3.12.129.18 allowed extension developers to inject arbitrary JavaScript into the extension store web page via devtools.inspectedWindow, leading to extensions downloading and uploading when users open the developer tool. Additional Analyst Notes: - CVE Program Container: References: - https://cve.naver.com/detail/cve-2022-24072
CVE ID: CVE-2022-24073 State: PUBLISHED Published: 2022-03-17T05:20:14 Last Updated: 2024-08-03T03:59:23.677Z Vendors: NAVER Products: NAVER Whale browser Problem Types: CWE-648 Description: The Web Request API in Whale browser before 3.12.129.18 allowed to deny access to the extension store or redirect to any URL when users access the store. Additional Analyst Notes: - CVE Program Container: References: - https://cve.naver.com/detail/cve-2022-24073
CVE ID: CVE-2022-24074 State: PUBLISHED Published: 2022-03-17T05:20:16 Last Updated: 2024-08-03T03:59:23.649Z Vendors: NAVER Products: NAVER Whale browser Problem Types: CWE-668 Description: Whale Bridge, a default extension in Whale browser before 3.12.129.18, allowed to receive any SendMessage request from the content script itself that could lead to controlling Whale Bridge if the rendering process compromises. Additional Analyst Notes: - CVE Program Container: References: - https://cve.naver.com/detail/cve-2022-24074
CVE ID: CVE-2022-24075 State: PUBLISHED Published: 2022-03-17T05:20:17 Last Updated: 2024-08-03T03:59:23.602Z Vendors: NAVER Products: NAVER Whale browser Problem Types: CWE-552 Description: Whale browser before 3.12.129.18 allowed extensions to replace JavaScript files of the HWP viewer website which could access to local HWP files. When the HWP files were opened, the replaced script could read the files. Additional Analyst Notes: - CVE Program Container: References: - https://cve.naver.com/detail/cve-2022-24075
CVE ID: CVE-2022-24077 State: PUBLISHED Published: 2022-06-13T13:40:17 Last Updated: 2024-08-03T03:59:23.920Z Vendors: NAVER Products: NAVER Cloud Explorer Beta Problem Types: CWE-269 Description: Naver Cloud Explorer Beta allows the attacker to execute arbitrary code as System privilege via malicious DLL injection. Additional Analyst Notes: - CVE Program Container: References: - https://cve.naver.com/detail/cve-2022-24077.html
CVE ID: CVE-2022-24082 State: PUBLISHED Published: 2022-07-19T00:00:00 Last Updated: 2024-08-03T03:59:23.700Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Pegasystems Products: Pega Infinity Problem Types: CWE-502 Description: If an on-premise installation of the Pega Platform is configured with the port for the JMX interface exposed to the Internet and port filtering is not properly configured, then it may be possible to upload serialized payloads to attack the underlying system. This does not affect systems running on PegaCloud due to its design and architecture. Additional Analyst Notes: - CVE Program Container: References: - https://support.pega.com