Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-29529 State: PUBLISHED Published: 2022-04-20T00:00:00 Last Updated: 2024-08-03T06:26:06.190Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in MISP before 2.4.158. There is stored XSS via the LinOTP login field. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/MISP/MISP/compare/v2.4.157...v2.4.158 - https://github.com/MISP/MISP/commit/9623de2f5cca011afc581d55cfa5ce87682894fd - https://zigrin.com/cakephp-application-cybersecurity-research-protect-your-website-from-stored-xss-attacks-understanding-and-preventing-vulnerabilities-in-open-source-applications/ - https://zigrin.com/advisories/misp-stored-xss-via
standing-and-preventing-vulnerabilities-in-open-source-applications/ - https://zigrin.com/advisories/misp-stored-xss-via-the-linotp-login-field/
CVE ID: CVE-2022-29530 State: PUBLISHED Published: 2022-04-20T00:00:00 Last Updated: 2024-08-03T06:26:06.013Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in MISP before 2.4.158. There is stored XSS in the galaxy clusters. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/MISP/MISP/compare/v2.4.157...v2.4.158 - https://github.com/MISP/MISP/commit/107e271d78c255d658ce998285fe6f6c4f291b41 - https://zigrin.com/cakephp-application-cybersecurity-research-protect-your-website-from-stored-xss-attacks-understanding-and-preventing-vulnerabilities-in-open-source-applications/ - https://zigrin.com/advisories/misp-stored-xss-in-the-
ding-and-preventing-vulnerabilities-in-open-source-applications/ - https://zigrin.com/advisories/misp-stored-xss-in-the-galaxy-clusters/
CVE ID: CVE-2022-29531 State: PUBLISHED Published: 2022-04-20T00:00:00 Last Updated: 2024-08-03T06:26:06.270Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in MISP before 2.4.158. There is stored XSS in the event graph via a tag name. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/MISP/MISP/compare/v2.4.157...v2.4.158 - https://github.com/MISP/MISP/commit/bb3b7a7e91862742cae228c43b3091bad476dcc0 - https://zigrin.com/cakephp-application-cybersecurity-research-protect-your-website-from-stored-xss-attacks-understanding-and-preventing-vulnerabilities-in-open-source-applications/ - https://zigrin.com/advisories/misp-stored-
s-understanding-and-preventing-vulnerabilities-in-open-source-applications/ - https://zigrin.com/advisories/misp-stored-xss-in-the-event-graph/
CVE ID: CVE-2022-29532 State: PUBLISHED Published: 2022-04-20T00:00:00 Last Updated: 2024-08-03T06:26:06.260Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in MISP before 2.4.158. There is XSS in the cerebrate view if one administrator puts a javascript: URL in the URL field, and another administrator clicks on it. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/MISP/MISP/compare/v2.4.157...v2.4.158 - https://github.com/MISP/MISP/commit/60c85b80e3ab05c3ef015bca5630e95eddbb1436 - https://zigrin.com/cakephp-application-cybersecurity-research-protect-your-website-from-stored-xss-attacks-understanding-and-preventing-vulnera
php-application-cybersecurity-research-protect-your-website-from-stored-xss-attacks-understanding-and-preventing-vulnerabilities-in-open-source-applications/ - https://zigrin.com/advisories/misp-xss-in-the-cerebrate-view/
CVE ID: CVE-2022-29533 State: PUBLISHED Published: 2022-04-20T00:00:00 Last Updated: 2024-08-03T06:26:06.355Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in MISP before 2.4.158. There is XSS in app/Controller/OrganisationsController.php in a situation with a "weird single checkbox page." Additional Analyst Notes: - CVE Program Container: References: - https://github.com/MISP/MISP/compare/v2.4.157...v2.4.158 - https://github.com/MISP/MISP/commit/ce6bc88e330f5ef50666b149d86c0d94f545f24e - https://zigrin.com/advisories/misp-xss-in-app-controller-organisationscontroller-php/
CVE ID: CVE-2022-29534 State: PUBLISHED Published: 2022-04-20T00:00:00 Last Updated: 2024-08-03T06:26:05.971Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in MISP before 2.4.158. In UsersController.php, password confirmation can be bypassed via vectors involving an "Accept: application/json" header. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/MISP/MISP/compare/v2.4.157...v2.4.158 - https://github.com/MISP/MISP/commit/01120163a6b4d905029d416e7305575df31df8af - https://zigrin.com/cakephp-application-cybersecurity-research-the-impact-of-a-php-vulnerability-exploring-the-password-confirmation-bypass-in-misp/ - https://
-cybersecurity-research-the-impact-of-a-php-vulnerability-exploring-the-password-confirmation-bypass-in-misp/ - https://zigrin.com/advisories/misp-password-confirmation-can-be-bypassed/
CVE ID: CVE-2022-29535 State: PUBLISHED Published: 2022-05-05T22:17:40 Last Updated: 2024-08-03T06:26:06.231Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine OPManager through 125588 allows SQL Injection via a few default reports. Additional Analyst Notes: - CVE Program Container: References: - https://manageengine.com - https://www.manageengine.com/network-monitoring/security-updates/cve-2022-29535.html
CVE ID: CVE-2022-29536 State: PUBLISHED Published: 2022-04-20T22:37:09 Last Updated: 2024-08-03T06:26:06.251Z Vendors: n/a Products: n/a Problem Types: n/a Description: In GNOME Epiphany before 41.4 and 42.x before 42.2, an HTML document can trigger a client buffer overflow (in ephy_string_shorten in the UI process) via a long page title. The issue occurs because the number of bytes for a UTF-8 ellipsis character is not properly considered. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/1106 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U5K5UPNHVWXDPSMBNSB2645MD2N5C
//lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U5K5UPNHVWXDPSMBNSB2645MD2N5CXQS/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GLLDMY4JYDZTMZSCPSY23K5YW3SQYUR6/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N7YWVIUGFRA6GOE3QAPSJJ6EL3DJG5NX/ - https://www.debian.org/security/2022/dsa-5208 - https://lists.debian.org/debian-lts-announce/2022/08/msg00006.html
CVE ID: CVE-2022-29537 State: PUBLISHED Published: 2022-04-20T00:00:00 Last Updated: 2024-08-03T06:26:06.357Z Vendors: n/a Products: n/a Problem Types: n/a Description: gp_rtp_builder_do_hevc in ietf/rtp_pck_mpeg4.c in GPAC 2.0.0 has a heap-based buffer over-read, as demonstrated by MP4Box. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gpac/gpac/issues/2173 - https://www.debian.org/security/2023/dsa-5411
CVE ID: CVE-2022-29538 State: PUBLISHED Published: 2022-05-12T14:15:45 Last Updated: 2024-08-03T06:26:05.986Z Vendors: n/a Products: n/a Problem Types: n/a Description: RESI Gemini-Net Web 4.2 is affected by Improper Access Control in authorization logic. An unauthenticated user is able to access some critical resources. Additional Analyst Notes: - CVE Program Container: References: - https://www.gruppotim.it/it/footer/red-team.html - https://www.resi.it/prodotti-soluzioni-commerciali/gemini-network-service-monitoring
CVE ID: CVE-2022-29539 State: PUBLISHED Published: 2022-05-12T14:15:42 Last Updated: 2024-08-03T06:26:06.514Z Vendors: n/a Products: n/a Problem Types: n/a Description: resi-calltrace in RESI Gemini-Net 4.2 is affected by OS Command Injection. It does not properly check the parameters sent as input before they are processed on the server. Due to the lack of validation of user input, an unauthenticated attacker can bypass the syntax intended by the software (e.g., concatenate `&|;\r\ commands) and inject arbitrary system commands with the privileges of the application user. Additional Analyst Notes: - CVE Program Container: References: - https://www.gruppotim.it/it/footer/red-team.html - http
Additional Analyst Notes: - CVE Program Container: References: - https://www.gruppotim.it/it/footer/red-team.html - https://www.resi.it/prodotti-soluzioni-commerciali/gemini-network-service-monitoring
CVE ID: CVE-2022-29540 State: PUBLISHED Published: 2022-05-31T20:34:17 Last Updated: 2024-08-03T06:26:06.205Z Vendors: n/a Products: n/a Problem Types: n/a Description: resi-calltrace in RESI Gemini-Net 4.2 is affected by Multiple XSS issues. Unauthenticated remote attackers can inject arbitrary web script or HTML into an HTTP GET parameter that reflects user input without sanitization. This exists on numerous application endpoints, Additional Analyst Notes: - CVE Program Container: References: - https://www.gruppotim.it/it/footer/red-team.html - https://www.resi.it/prodotti-soluzioni-commerciali/gemini-network-service-monitoring
CVE ID: CVE-2022-29546 State: PUBLISHED Published: 2022-04-25T02:54:59 Last Updated: 2024-08-03T06:26:06.394Z Vendors: n/a Products: n/a Problem Types: n/a Description: HtmlUnit NekoHtml Parser before 2.61.0 suffers from a denial of service vulnerability. Crafted input associated with the parsing of Processing Instruction (PI) data leads to heap memory consumption. This is similar to CVE-2022-28366 but affects a much later version of the product. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/HtmlUnit/htmlunit-neko/security/advisories/GHSA-6jmm-mp6w-4rrg
CVE ID: CVE-2022-29547 State: PUBLISHED Published: 2022-04-21T00:57:44 Last Updated: 2024-08-03T06:26:06.260Z Vendors: n/a Products: n/a Problem Types: n/a Description: The CreateRedirect extension before 2022-04-14 for MediaWiki does not properly check whether the user has permissions to edit the target page. This could lead to an unauthorised (or blocked) user being able to edit a page. Additional Analyst Notes: - CVE Program Container: References: - https://phabricator.wikimedia.org/T306174 - https://phabricator.miraheze.org/T9061 - https://gerrit.wikimedia.org/r/c/mediawiki/extensions/CreateRedirect/+/780567
CVE ID: CVE-2022-29548 State: PUBLISHED Published: 2022-04-21T00:00:00 Last Updated: 2024-08-03T06:26:06.033Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AC:L/AV:A/A:N/C:L/I:L/PR:N/S:U/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: A reflected XSS issue exists in the Management Console of several WSO2 products. This affects API Manager 2.2.0, 2.5.0, 2.6.0, 3.0.0, 3.1.0, 3.2.0, and 4.0.0; API Manager Analytics 2.2.0, 2.5.0, and 2.6.0; API Microgateway 2.2.0; Data Analytics Server 3.2.0; Enterprise Integrator 6.2.0, 6.3.0, 6.4.0, 6.5.0, and 6.6.0; IS as Key Manager 5.5.0, 5.6.0, 5.7.0, 5.9.0, and 5.10.0; Identity Server 5.5.0, 5.6.0, 5.7.0, 5.9.0, 5.10.0, and 5.11.0; Identity Server
5.5.0, 5.6.0, 5.7.0, 5.9.0, and 5.10.0; Identity Server 5.5.0, 5.6.0, 5.7.0, 5.9.0, 5.10.0, and 5.11.0; Identity Server Analytics 5.5.0 and 5.6.0; and WSO2 Micro Integrator 1.0.0. Additional Analyst Notes: - CVE Program Container: References: - https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2021-1603 - http://packetstormsecurity.com/files/167587/WSO2-Management-Console-Cross-Site-Scripting.html - https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2022/WSO2-2021-1603/
CVE ID: CVE-2022-29549 State: PUBLISHED Published: 2022-08-18T12:16:30 Last Updated: 2024-08-03T06:26:06.239Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Qualys Cloud Agent 4.8.0-49. It executes programs at various full pathnames without first making ownership and permission checks (e.g., to help ensure that a program was installed by root) and without integrity checks (e.g., a checksum comparison against known legitimate programs). Also, the vendor recommendation is to install this agent software with root privileges. Thus, privilege escalation is possible on systems where any of these pathnames is controlled by a non-root user. An example is /opt/f
ge escalation is possible on systems where any of these pathnames is controlled by a non-root user. An example is /opt/firebird/bin/isql, where the /opt/firebird directory is often owned by the firebird user. Additional Analyst Notes: - CVE Program Container: References: - https://blog.qualys.com/vulnerabilities-threat-research - http://software.firstworks.com/p/getting-started-with-firebird.html - https://blog.qualys.com/product-tech/2022/08/15/qualys-security-updates-cloud-agent-for-linux - http://seclists.org/fulldisclosure/2022/Sep/10 - http://packetstormsecurity.com/files/168367/Qualys-Cloud-Agent-Arbitrary-Code-Execution.html
CVE ID: CVE-2022-29550 State: PUBLISHED Published: 2022-08-18T12:16:18 Last Updated: 2024-08-03T06:26:06.296Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Qualys Cloud Agent 4.8.0-49. It writes "ps auxwwe" output to the /var/log/qualys/qualys-cloud-agent-scan.log file. This may, for example, unexpectedly write credentials (from environment variables) to disk in cleartext. NOTE: there are no common circumstances in which qualys-cloud-agent-scan.log can be read by a user other than root; however, the file contents could be exposed through site-specific operational practices. The vendor does NOT characterize this as a vulnerability because the ps data co
ugh site-specific operational practices. The vendor does NOT characterize this as a vulnerability because the ps data collection is intentional, and would only capture credentials on a machine that was already affected by the CWE-214 weakness Additional Analyst Notes: - CVE Program Container: References: - https://blog.qualys.com/vulnerabilities-threat-research - https://blog.qualys.com/product-tech/2022/08/15/qualys-security-updates-cloud-agent-for-linux - http://seclists.org/fulldisclosure/2022/Sep/10 - http://packetstormsecurity.com/files/168367/Qualys-Cloud-Agent-Arbitrary-Code-Execution.html
CVE ID: CVE-2022-29555 State: PUBLISHED Published: 2022-04-28T19:44:49 Last Updated: 2024-08-03T06:26:06.100Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Deviceconnect microservice through 1.3.0 in Northern.tech Mender Enterprise before 3.2.2. allows Cross-Origin Websocket Hijacking. Additional Analyst Notes: - CVE Program Container: References: - https://northern.tech - https://mender.io/blog/cve-2022-29555-and-cve-2022-29556-vulnerabilities-in-iot-manager-and-deviceconnect
CVE ID: CVE-2022-29556 State: PUBLISHED Published: 2022-04-28T19:48:39 Last Updated: 2024-08-03T06:26:06.303Z Vendors: n/a Products: n/a Problem Types: n/a Description: The iot-manager microservice 1.0.0 in Northern.tech Mender Enterprise before 3.2.2 allows SSRF because the Azure IoT Hub integration provides several SSRF primitives that can execute cross-tenant actions via internal API endpoints. Additional Analyst Notes: - CVE Program Container: References: - https://northern.tech - https://mender.io/blog/cve-2022-29555-and-cve-2022-29556-vulnerabilities-in-iot-manager-and-deviceconnect
CVE ID: CVE-2022-29557 State: PUBLISHED Published: 2023-02-14T00:00:00.000Z Last Updated: 2025-03-20T20:42:38.107Z Vendors: n/a Products: n/a Problem Types: n/a Description: LexisNexis Firco Compliance Link 3.7 allows CSRF. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Q2Flc2FySec/CVE-List/blob/main/CVE-2022-29557.txt
CVE ID: CVE-2022-29558 State: PUBLISHED Published: 2022-07-28T21:20:49 Last Updated: 2024-08-03T06:26:06.331Z Vendors: n/a Products: n/a Problem Types: n/a Description: Realtek rtl819x-SDK before v3.6.1 allows command injection over the web interface. Additional Analyst Notes: - CVE Program Container: References: - https://www.realtek.com - https://www.realtek.com/images/safe-report/Realtek_APRouter_SDK_Advisory-CVE-2022-29558.pdf
CVE ID: CVE-2022-29560 State: PUBLISHED Published: 2022-07-12T10:06:38 Last Updated: 2024-08-03T06:26:06.278Z Vendors: Siemens Products: RUGGEDCOM ROX MX5000, RUGGEDCOM ROX MX5000RE, RUGGEDCOM ROX RX1400, RUGGEDCOM ROX RX1500, RUGGEDCOM ROX RX1501, RUGGEDCOM ROX RX1510, RUGGEDCOM ROX RX1511, RUGGEDCOM ROX RX1512, RUGGEDCOM ROX RX1524, RUGGEDCOM ROX RX1536, RUGGEDCOM ROX RX5000 Problem Types: CWE-77 Description: A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < 2.15.1), RUGGEDCOM ROX MX5000RE (All versions < 2.15.1), RUGGEDCOM ROX RX1400 (All versions < 2.15.1), RUGGEDCOM ROX RX1500 (All versions < 2.15.1), RUGGEDCOM ROX RX1501 (All versions < 2.15.1), RUGGEDCOM ROX
ns < 2.15.1), RUGGEDCOM ROX RX1500 (All versions < 2.15.1), RUGGEDCOM ROX RX1501 (All versions < 2.15.1), RUGGEDCOM ROX RX1510 (All versions < 2.15.1), RUGGEDCOM ROX RX1511 (All versions < 2.15.1), RUGGEDCOM ROX RX1512 (All versions < 2.15.1), RUGGEDCOM ROX RX1524 (All versions < 2.15.1), RUGGEDCOM ROX RX1536 (All versions < 2.15.1), RUGGEDCOM ROX RX5000 (All versions < 2.15.1). Affected devices do not properly validate user input, making them susceptible to command injection. An attacker with access to either the shell or the web CLI with administrator privileges could access the underlying operating system as the root user. Additional Analyst Notes: - CVE Program Container: References: - h
ess the underlying operating system as the root user. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-599506.pdf
CVE ID: CVE-2022-29561 State: PUBLISHED Published: 2023-07-11T09:06:58.988Z Last Updated: 2024-11-12T19:11:46.270Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: RUGGEDCOM ROX MX5000, RUGGEDCOM ROX MX5000RE, RUGGEDCOM ROX RX1400, RUGGEDCOM ROX RX1500, RUGGEDCOM ROX RX1501, RUGGEDCOM ROX RX1510, RUGGEDCOM ROX RX1511, RUGGEDCOM ROX RX1512, RUGGEDCOM ROX RX1524, RUGGEDCOM ROX RX1536, RUGGEDCOM ROX RX5000 Problem Types: CWE-352 Description: A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.0), RUGGEDCOM ROX MX5000RE (All versions < V2.16.0), RUGGEDCOM ROX RX1400 (All versions < V2.16.0), RUGGEDCOM RO
< V2.16.0), RUGGEDCOM ROX MX5000RE (All versions < V2.16.0), RUGGEDCOM ROX RX1400 (All versions < V2.16.0), RUGGEDCOM ROX RX1500 (All versions < V2.16.0), RUGGEDCOM ROX RX1501 (All versions < V2.16.0), RUGGEDCOM ROX RX1510 (All versions < V2.16.0), RUGGEDCOM ROX RX1511 (All versions < V2.16.0), RUGGEDCOM ROX RX1512 (All versions < V2.16.0), RUGGEDCOM ROX RX1524 (All versions < V2.16.0), RUGGEDCOM ROX RX1536 (All versions < V2.16.0), RUGGEDCOM ROX RX5000 (All versions < V2.16.0). The web interface of the affected devices are vulnerable to Cross-Site Request Forgery attacks. By tricking an authenticated victim user to click a malicious link, an attacker could perform arbitrary actions on the d
By tricking an authenticated victim user to click a malicious link, an attacker could perform arbitrary actions on the device on behalf of the victim user. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-146325.pdf
CVE ID: CVE-2022-29562 State: PUBLISHED Published: 2023-07-11T09:07:00.397Z Last Updated: 2024-11-12T16:17:46.868Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C) Vendors: Siemens Products: RUGGEDCOM ROX MX5000, RUGGEDCOM ROX MX5000RE, RUGGEDCOM ROX RX1400, RUGGEDCOM ROX RX1500, RUGGEDCOM ROX RX1501, RUGGEDCOM ROX RX1510, RUGGEDCOM ROX RX1511, RUGGEDCOM ROX RX1512, RUGGEDCOM ROX RX1524, RUGGEDCOM ROX RX1536, RUGGEDCOM ROX RX5000 Problem Types: CWE-20 Description: A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.0), RUGGEDCOM ROX MX5000RE (All versions < V2.16.0), RUGGEDCOM ROX RX1400 (All versions < V2.16.0), RUGGEDCOM ROX
V2.16.0), RUGGEDCOM ROX MX5000RE (All versions < V2.16.0), RUGGEDCOM ROX RX1400 (All versions < V2.16.0), RUGGEDCOM ROX RX1500 (All versions < V2.16.0), RUGGEDCOM ROX RX1501 (All versions < V2.16.0), RUGGEDCOM ROX RX1510 (All versions < V2.16.0), RUGGEDCOM ROX RX1511 (All versions < V2.16.0), RUGGEDCOM ROX RX1512 (All versions < V2.16.0), RUGGEDCOM ROX RX1524 (All versions < V2.16.0), RUGGEDCOM ROX RX1536 (All versions < V2.16.0), RUGGEDCOM ROX RX5000 (All versions < V2.16.0). Affected devices do not properly handle malformed HTTP packets. This could allow an unauthenticated remote attacker to send a malformed HTTP packet causing certain functions to fail in a controlled manner. Additional A
d remote attacker to send a malformed HTTP packet causing certain functions to fail in a controlled manner. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-146325.pdf
CVE ID: CVE-2022-29564 State: PUBLISHED Published: 2022-06-07T13:23:11 Last Updated: 2024-08-03T06:26:06.161Z Vendors: n/a Products: n/a Problem Types: n/a Description: Jamf Private Access before 2022-05-16 has Incorrect Access Control, in which an unauthorized user can reach a system in the internal infrastructure, aka WND-44801. Additional Analyst Notes: - CVE Program Container: References: - https://jamf.com - https://github.com/wandera/public-disclosures/blob/master/CVE-2022-29564.md
CVE ID: CVE-2022-29566 State: PUBLISHED Published: 2022-04-21T18:47:20 Last Updated: 2024-08-03T06:26:06.294Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Bulletproofs 2017/1066 paper mishandles Fiat-Shamir generation because the hash computation fails to include all of the public values from the Zero Knowledge proof statement as well as all of the public values computed in the proof, aka the Frozen Heart issue. Additional Analyst Notes: - CVE Program Container: References: - https://blog.trailofbits.com/2022/04/13/part-1-coordinated-disclosure-of-vulnerabilities-affecting-girault-bulletproofs-and-plonk/ - https://eprint.iacr.org/2017/1066
CVE ID: CVE-2022-29567 State: PUBLISHED Published: 2022-05-24T14:20:19.452600Z Last Updated: 2024-09-16T18:09:13.978Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N) Vendors: Vaadin Products: vaadin, vaadin-grid-flow Problem Types: CWE-200 Description: The default configuration of a TreeGrid component uses Object::toString as a key on the client-side and server communication in Vaadin 14.8.5 through 14.8.9, 22.0.6 through 22.0.14, 23.0.0.beta2 through 23.0.8 and 23.1.0.alpha1 through 23.1.0.alpha4, resulting in potential information disclosure of values that should not be available on the client-side. Additional Analyst Notes: - CVE Program Container: References: - h
lues that should not be available on the client-side. Additional Analyst Notes: - CVE Program Container: References: - https://vaadin.com/security/cve-2022-29567 - https://github.com/vaadin/flow-components/pull/3046
CVE ID: CVE-2022-29577 State: PUBLISHED Published: 2022-04-21T22:42:51 Last Updated: 2024-08-03T06:26:06.625Z Vendors: n/a Products: n/a Problem Types: n/a Description: OWASP AntiSamy before 1.6.7 allows XSS via HTML tag smuggling on STYLE content with crafted input. The output serializer does not properly encode the supposed Cascading Style Sheets (CSS) content. NOTE: this issue exists because of an incomplete fix for CVE-2022-28367. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nahsra/antisamy/releases/tag/v1.6.7 - https://github.com/nahsra/antisamy/commit/32e273507da0e964b58c50fd8a4c94c9d9363af0 - https://www.oracle.com/security-alerts/cpujul2022.html
CVE ID: CVE-2022-29578 State: PUBLISHED Published: 2022-06-24T16:36:22 Last Updated: 2024-08-03T06:26:06.302Z Vendors: n/a Products: n/a Problem Types: n/a Description: Meridian Cooperative Utility Software versions 22.02 and 22.03 allows remote attackers to obtain sensitive information such as name, address, and daily energy usage. Additional Analyst Notes: - CVE Program Container: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-165-02