Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-3132 State: PUBLISHED Published: 2022-10-03T13:45:28 Last Updated: 2024-08-03T01:00:10.506Z Vendors: Unknown Products: Goolytics – Simple Google Analytics Problem Types: CWE-79 Description: The Goolytics WordPress plugin before 1.1.2 does not sanitise and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/ed2dc1b9-f9f9-4e99-87b3-a614c223dd64
CVE ID: CVE-2022-3133 State: PUBLISHED Published: 2022-09-09T17:55:09 Last Updated: 2024-08-03T01:00:10.491Z Severity: HIGH (CVSS 7 CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: jgraph Products: jgraph/drawio Problem Types: CWE-78 Description: OS Command Injection in GitHub repository jgraph/drawio prior to 20.3.0. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/2d93052f-efc6-4647-9a6d-8b08dc251223 - https://github.com/jgraph/drawio/commit/8f3f95a05b701175b639ba9572dc4e0fb7c46b02
CVE ID: CVE-2022-3134 State: PUBLISHED Published: 2022-09-06T00:00:00.000Z Last Updated: 2025-11-03T20:34:53.048Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: vim Products: vim/vim Problem Types: CWE-416 Description: Use After Free in GitHub repository vim/vim prior to 9.0.0389. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/6ec79e49-c7ab-4cd6-a517-e7934c2eb9dc - https://github.com/vim/vim/commit/ccfde4d028e891a41e3548323c3d47b06fb0b83e - https://lists.debian.org/debian-lts-announce/2022/11/msg00009.html - https://security.gentoo.org/glsa/202305-16
CVE ID: CVE-2022-3135 State: PUBLISHED Published: 2022-09-26T12:35:45.000Z Last Updated: 2025-05-21T19:14:41.697Z Vendors: Unknown Products: SEO Smart Links Problem Types: CWE-79 Description: The SEO Smart Links WordPress plugin through 3.0.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/3505481d-141a-4516-bdbb-d4dad4e1eb01
CVE ID: CVE-2022-3136 State: PUBLISHED Published: 2022-10-10T00:00:00 Last Updated: 2024-08-03T01:00:10.318Z Vendors: Unknown Products: Social Rocket – Social Sharing Plugin Problem Types: CWE-79 Description: The Social Rocket WordPress plugin before 1.3.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/913d7e78-23f6-4b0d-aca3-17051a2dc649
CVE ID: CVE-2022-3137 State: PUBLISHED Published: 2022-10-10T00:00:00 Last Updated: 2024-08-03T01:00:10.436Z Vendors: Unknown Products: Taskbuilder – WordPress Project & Task Management plugin Problem Types: CWE-79 Description: The Taskbuilder WordPress plugin before 1.0.8 does not validate and sanitise task's attachments, which could allow any authenticated user (such as subscriber) creating a task to perform Stored Cross-Site Scripting by attaching a malicious SVG file Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/524928d6-d4e9-4a2f-b410-46958da549d8
CVE ID: CVE-2022-3138 State: PUBLISHED Published: 2022-09-08T09:30:14 Last Updated: 2024-08-03T01:00:10.521Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: jgraph Products: jgraph/drawio Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Generic in GitHub repository jgraph/drawio prior to 20.3.0. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jgraph/drawio/commit/b5dfeb238369d664fb06a95e2179236b0e75f366 - https://huntr.dev/bounties/1816a207-6abf-408c-b19a-e497e24172b3
CVE ID: CVE-2022-3139 State: PUBLISHED Published: 2022-10-17T00:00:00.000Z Last Updated: 2025-05-14T16:01:25.089Z Vendors: Unknown Products: We’re Open! Problem Types: CWE-79 Description: The We’re Open! WordPress plugin before 1.42 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/11c89925-4fe9-45f7-9020-55fe7bbae3db
CVE ID: CVE-2022-3140 State: PUBLISHED Published: 2022-10-11T00:00:00 Last Updated: 2024-08-03T01:00:10.521Z Vendors: The Document Foundation Products: LibreOffice Problem Types: CWE-20 Description: LibreOffice supports Office URI Schemes to enable browser integration of LibreOffice with MS SharePoint server. An additional scheme 'vnd.libreoffice.command' specific to LibreOffice was added. In the affected versions of LibreOffice links using that scheme could be constructed to call internal macros with arbitrary arguments. Which when clicked on, or activated by document events, could result in arbitrary script execution without warning. This issue affects: The Document Foundation LibreOffice
ts, could result in arbitrary script execution without warning. This issue affects: The Document Foundation LibreOffice 7.4 versions prior to 7.4.1; 7.3 versions prior to 7.3.6. Additional Analyst Notes: - CVE Program Container: References: - https://www.libreoffice.org/about-us/security/advisories/CVE-2022-3140 - https://www.debian.org/security/2022/dsa-5252 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TORANVTIWWBH3DNJR4UZATAG67KZOH32/ - https://security.gentoo.org/glsa/202212-04 - https://lists.debian.org/debian-lts-announce/2023/03/msg00022.html
CVE ID: CVE-2022-3141 State: PUBLISHED Published: 2022-09-19T00:00:00 Last Updated: 2024-08-03T01:00:10.566Z Vendors: Unknown Products: Translate Multilingual sites – TranslatePress Problem Types: CWE-89 Description: The Translate Multilingual sites WordPress plugin before 2.3.3 is vulnerable to an authenticated SQL injection. By adding a new language (via the settings page) containing specific special characters, the backticks in the SQL query can be surpassed and a time-based blind payload can be injected. Additional Analyst Notes: - CVE Program Container: References: - https://medium.com/%40elias.hohl/authenticated-sql-injection-vulnerability-in-translatepress-multilingual-wordpress-plugi
ttps://medium.com/%40elias.hohl/authenticated-sql-injection-vulnerability-in-translatepress-multilingual-wordpress-plugin-effc08eda514 - https://wpscan.com/vulnerability/1fa355d1-cca8-4b27-9d21-0b420a2e1bf3 - http://packetstormsecurity.com/files/171479/WordPress-Translatepress-Multilingual-SQL-Injection.html
CVE ID: CVE-2022-3142 State: PUBLISHED Published: 2022-09-19T00:00:00 Last Updated: 2024-08-03T01:00:10.258Z Vendors: Unknown Products: NEX-Forms – Ultimate Form Builder – Contact forms and much more Problem Types: CWE-89 Description: The NEX-Forms WordPress plugin before 7.9.7 does not properly sanitise and escape user input before using it in SQL statements, leading to SQL injections. The attack can be executed by anyone who is permitted to view the forms statistics chart, by default administrators, however can be configured otherwise via the plugin settings. Additional Analyst Notes: - CVE Program Container: References: - https://medium.com/%40elias.hohl/authenticated-sql-injection-vulner
nalyst Notes: - CVE Program Container: References: - https://medium.com/%40elias.hohl/authenticated-sql-injection-vulnerability-in-nex-forms-wordpress-plugin-35b8558dd0f5 - https://wpscan.com/vulnerability/8acc0fc6-efe6-4662-b9ac-6342a7823328 - http://packetstormsecurity.com/files/171477/WordPress-NEX-Forms-SQL-Injection.html
CVE ID: CVE-2022-3143 State: PUBLISHED Published: 2023-01-11T20:57:29.342Z Last Updated: 2025-04-09T13:46:25.564Z Vendors: redhat.com Products: Wildfly-elytron Problem Types: n/a Description: wildfly-elytron: possible timing attacks via use of unsafe comparator. A flaw was found in Wildfly-elytron. Wildfly-elytron uses java.util.Arrays.equals in several places, which is unsafe and vulnerable to timing attacks. To compare values securely, use java.security.MessageDigest.isEqual instead. This flaw allows an attacker to access secure information or impersonate an authed user. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/secu
Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2022-3143
CVE ID: CVE-2022-3144 State: PUBLISHED Published: 2022-09-23T13:54:18 Last Updated: 2024-08-03T01:00:10.058Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: mmaunder Products: Wordfence Security – Firewall, Malware Scan, and Login Security Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Wordfence Security – Firewall & Malware Scan plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 7.6.0 via a setting on the options page due to insufficient escaping on the stored value. This makes it possible for authenticated users, with administrative p
due to insufficient escaping on the stored value. This makes it possible for authenticated users, with administrative privileges, to inject malicious web scripts into the setting that executes whenever a user accesses a page displaying the affected setting on sites running a vulnerable version. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/833eb481-4fb4-432e-8e93-3f497ccbf1eb?source=cve - https://wordpress.org/plugins/wordfence/#developers - https://www.wordfence.com/vulnerability-advisories/#CVE-2022-3144 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2780937%40wordfence&new=278
2022-3144 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2780937%40wordfence&new=2780937%40wordfence&sfp_email=&sfph_mail=
CVE ID: CVE-2022-3145 State: PUBLISHED Published: 2023-01-12T00:00:00.000Z Last Updated: 2025-04-08T13:37:49.124Z Vendors: Okta Products: Okta OIDC Middleware Problem Types: Open Redirect Description: An open redirect vulnerability exists in Okta OIDC Middleware prior to version 5.0.0 allowing an attacker to redirect a user to an arbitrary URL. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/okta/okta-oidc-middleware/security/advisories/GHSA-58h4-9m7m-j9m4
CVE ID: CVE-2022-3146 State: PUBLISHED Published: 2023-03-23T00:00:00.000Z Last Updated: 2025-02-25T15:41:22.806Z Vendors: n/a Products: tripleo-ansible Problem Types: CWE-22 Description: A flaw was found in tripleo-ansible. Due to an insecure default configuration, the permissions of a sensitive file are not sufficiently restricted. This flaw allows a local attacker to use brute force to explore the relevant directory and discover the file. This issue leads to information disclosure of important configuration details from the OpenStack deployment. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2022-3146
CVE ID: CVE-2022-3147 State: PUBLISHED Published: 2022-09-09T14:39:51 Last Updated: 2024-12-06T23:08:00.683Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: Mattermost Products: Mattermost Problem Types: CWE-400 Description: Mattermost version 7.0.x and earlier fails to sufficiently limit the in-memory sizes of concurrently uploaded JPEG images, which allows authenticated users to cause resource exhaustion on specific system configurations, resulting in server-side Denial of Service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates/ - https://hackerone.com/reports/1549513
CVE ID: CVE-2022-3148 State: PUBLISHED Published: 2022-09-08T09:25:09 Last Updated: 2024-08-03T01:00:10.577Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: jgraph Products: jgraph/drawio Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Generic in GitHub repository jgraph/drawio prior to 20.3.0. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/1f730015-b4d0-4f84-8cac-9cf1e57a091a - https://github.com/jgraph/drawio/commit/b5dfeb238369d664fb06a95e2179236b0e75f366
CVE ID: CVE-2022-3149 State: PUBLISHED Published: 2022-10-17T00:00:00.000Z Last Updated: 2025-05-14T16:02:18.679Z Vendors: Unknown Products: WP Custom Cursors Problem Types: CWE-352, CWE-79 Description: The WP Custom Cursors WordPress plugin before 3.0.1 does not have CSRF check in place when creating and editing cursors, which could allow attackers to made a logged in admin perform such actions via CSRF attacks. Furthermore, due to the lack of sanitisation and escaping in some of the cursor options, it could also lead to Stored Cross-Site Scripting Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/4c13a93d-2100-4721-89
: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/4c13a93d-2100-4721-8937-a1205378655f
CVE ID: CVE-2022-3150 State: PUBLISHED Published: 2022-10-17T00:00:00.000Z Last Updated: 2025-05-14T16:16:21.491Z Vendors: Unknown Products: WP Custom Cursors | WordPress Cursor Plugin Problem Types: CWE-89 SQL Injection Description: The WP Custom Cursors WordPress plugin before 3.2 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privileged users such as admin Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/bb0806d7-21e3-4a65-910c-bf0625c338ec
CVE ID: CVE-2022-3151 State: PUBLISHED Published: 2022-10-17T00:00:00.000Z Last Updated: 2025-05-14T16:18:24.730Z Vendors: Unknown Products: WP Custom Cursors Problem Types: CWE-352 Description: The WP Custom Cursors WordPress plugin before 3.0.1 does not have CSRF check in place when deleting cursors, which could allow attackers to made a logged in admin delete arbitrary cursors via a CSRF attack. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/27816c70-58ad-4ffb-adcc-69eb1b210744
CVE ID: CVE-2022-3152 State: PUBLISHED Published: 2022-09-07T14:25:10 Last Updated: 2024-08-03T01:00:10.823Z Severity: CRITICAL (CVSS 9.6 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) Vendors: phpfusion Products: phpfusion/phpfusion Problem Types: CWE-620 Description: Unverified Password Change in GitHub repository phpfusion/phpfusion prior to 9.10.20. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/b3f888d2-5c71-4682-8287-42613401fd5a - https://github.com/phpfusion/phpfusion/commit/57c96d4a0c00e8e1e25100087654688123c6e991
CVE ID: CVE-2022-3153 State: PUBLISHED Published: 2022-09-08T00:00:00 Last Updated: 2024-08-03T01:00:10.455Z Severity: MEDIUM (CVSS 6.1 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H) Vendors: vim Products: vim/vim Problem Types: CWE-476 Description: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0404. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/68331124-620d-48bc-a8fa-cd947b26270a - https://github.com/vim/vim/commit/1540d334a04d874c2aa9d26b82dbbcd4bc5a78de - https://security.gentoo.org/glsa/202305-16
CVE ID: CVE-2022-3154 State: PUBLISHED Published: 2022-10-10T00:00:00 Last Updated: 2024-08-03T01:00:10.538Z Vendors: TODO Products: Woo Billingo Plus, Integration for Billingo & Gravity Forms, Integration for Szamlazz.hu & Gravity Forms Problem Types: CWE-352 Description: The Woo Billingo Plus WordPress plugin before 4.4.5.4, Integration for Billingo & Gravity Forms WordPress plugin before 1.0.4, Integration for Szamlazz.hu & Gravity Forms WordPress plugin before 1.2.7 are lacking CSRF checks in various AJAX actions, which could allow attackers to make logged in Shop Managers and above perform unwanted actions, such as deactivate the plugin's license Additional Analyst Notes: - CVE Program
ers and above perform unwanted actions, such as deactivate the plugin's license Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/cda978b2-b31f-495d-8601-0aaa3e4b45cd
CVE ID: CVE-2022-3155 State: PUBLISHED Published: 2022-12-22T00:00:00.000Z Last Updated: 2025-04-15T15:58:52.277Z Vendors: Mozilla Products: Thunderbird Problem Types: Attachment files saved to disk on macOS could be executed without warning Description: When saving or opening an email attachment on macOS, Thunderbird did not set attribute com.apple.quarantine on the received file. If the received file was an application and the user attempted to open it, then the application was started immediately without asking the user to confirm. This vulnerability affects Thunderbird < 102.3. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mozilla.o
< 102.3. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2022-42/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1789061
CVE ID: CVE-2022-3156 State: PUBLISHED Published: 2022-12-27T18:17:50.219Z Last Updated: 2025-04-10T20:06:21.915Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Rockwell Automation Products: Studio 5000 Logix Emulate Problem Types: CWE-287 Description: A remote code execution vulnerability exists in Rockwell Automation Studio 5000 Logix Emulate software. Users are granted elevated permissions on certain product services when the software is installed. Due to this misconfiguration, a malicious user could potentially achieve remote code execution on the targeted software. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: -
ion on the targeted software. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1137846
CVE ID: CVE-2022-3157 State: PUBLISHED Published: 2022-12-16T20:35:55.689Z Last Updated: 2025-04-16T14:32:17.798Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) Vendors: Rockwell Automation Products: CompactLogix 5370, Compact GuardLogix, ControlLogix 5570, ControlLogix 5570 Redundancy, GuardLogix 5570 Problem Types: CWE-20 Description: A vulnerability exists in the Rockwell Automation controllers that allows a malformed CIP request to cause a major non-recoverable fault (MNRF) and a denial-of-service condition (DOS). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://rockwellautomation.custhelp.com/app/answers/answer_vie
Program Container: - CISA ADP Vulnrichment: References: - https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1137757
CVE ID: CVE-2022-3158 State: PUBLISHED Published: 2022-10-17T00:00:00.000Z Last Updated: 2025-05-14T18:11:50.528Z Vendors: n/a Products: FactoryTalk VantagePoint Problem Types: CWE-89 Description: Rockwell Automation FactoryTalk VantagePoint versions 8.0, 8.10, 8.20, 8.30, 8.31 are vulnerable to an input validation vulnerability. The FactoryTalk VantagePoint SQL Server lacks input validation when users enter SQL statements to retrieve information from the back-end database. If successfully exploited, this could allow a user with basic user privileges to perform remote code execution on the server. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https
execution on the server. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1137043
CVE ID: CVE-2022-3159 State: PUBLISHED Published: 2023-01-13T00:15:15.775Z Last Updated: 2025-01-16T22:01:53.147Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Siemens Products: JT2Go, Teamcenter Visualization V13.3, Teamcenter Visualization V14.0, Teamcenter Visualization V14.1 Problem Types: CWE-121 Description: The APDFL.dll contains a stack-based buffer overflow vulnerability that could be triggered while parsing specially crafted PDF files. This could allow an attacker to execute code in the context of the current process. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories
nalyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-349-15 - https://cert-portal.siemens.com/productcert/html/ssa-360681.html - https://cert-portal.siemens.com/productcert/csaf/ssa-360681.json
CVE ID: CVE-2022-3160 State: PUBLISHED Published: 2023-01-13T00:16:30.069Z Last Updated: 2025-01-16T22:01:46.182Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Siemens Products: JT2Go, Teamcenter Visualization V13.3, Teamcenter Visualization V14.0, Teamcenter Visualization V14.1 Problem Types: CWE-122 Description: The APDFL.dll contains an out-of-bounds write past the fixed-length heap-based buffer while parsing specially crafted PDF files. This could allow an attacker to execute code in the context of the current process. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa
t Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-349-15 - https://cert-portal.siemens.com/productcert/html/ssa-360681.html - https://cert-portal.siemens.com/productcert/csaf/ssa-360681.json
CVE ID: CVE-2022-3161 State: PUBLISHED Published: 2023-01-13T00:17:06.310Z Last Updated: 2025-01-16T22:01:39.070Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Siemens Products: JT2Go, Teamcenter Visualization V13.3, Teamcenter Visualization V14.0, Teamcenter Visualization V14.1 Problem Types: CWE-119 Description: The APDFL.dll contains a memory corruption vulnerability while parsing specially crafted PDF files. This could allow an attacker to execute code in the context of the current process. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-349-15 - https://cert-por
ner: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-349-15 - https://cert-portal.siemens.com/productcert/html/ssa-360681.html - https://cert-portal.siemens.com/productcert/csaf/ssa-360681.json
CVE ID: CVE-2022-3162 State: PUBLISHED Published: 2023-03-01T00:00:00.000Z Last Updated: 2025-03-07T18:35:03.127Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Kubernetes Products: Kubernetes Problem Types: CWE-23 Description: Users authorized to list or watch one type of namespaced custom resource cluster-wide can read custom resources of a different type in the same API group without authorization. Clusters are impacted by this vulnerability if all of the following are true: 1. There are 2+ CustomResourceDefinitions sharing the same API group 2. Users have cluster-wide list or watch authorization on one of those custom resources. 3. The same users are no