Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-1228 State: PUBLISHED Published: 2022-04-25T15:51:23 Last Updated: 2024-08-02T23:55:24.424Z Vendors: Unknown Products: Opensea Problem Types: CWE-79 Description: The Opensea WordPress plugin before 1.0.3 does not sanitize and escape some of its settings, like its "Referer address" field, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/ef6830c0-e933-4e62-8321-011d91f9cfea
CVE ID: CVE-2022-1229 State: PUBLISHED Published: 2023-03-28T00:00:00.000Z Last Updated: 2025-02-19T15:42:40.654Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Bentley Products: MicroStation CONNECT Problem Types: CWE-787 Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.2.034. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of IFC files. Crafted data in an IFC file can trigger a write past the end of an allocated buffer. An attacker can
sing of IFC files. Crafted data in an IFC file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-16581. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-22-615/ - https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0006
CVE ID: CVE-2022-1230 State: PUBLISHED Published: 2023-03-28T00:00:00.000Z Last Updated: 2025-02-19T17:03:06.798Z Severity: LOW (CVSS 3.9 CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: Samsung Products: Galaxy S21 Problem Types: CWE-601 Description: This vulnerability allows local attackers to execute arbitrary code on affected installations of Samsung Galaxy S21 prior to 4.5.40.5 phones. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of redirections. An attacker can force a redirection to a site that serves malicious content. An attacker can leverage th
f redirections. An attacker can force a redirection to a site that serves malicious content. An attacker can leverage this in conjunction with other vulnerabilities to escalate privileges and execute arbitrary code in the context of the current user. Was ZDI-CAN-15918. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.samsungmobile.com/serviceWeb.smsb - https://www.zerodayinitiative.com/advisories/ZDI-22-621/
CVE ID: CVE-2022-1231 State: PUBLISHED Published: 2022-04-15T15:05:10 Last Updated: 2024-08-02T23:55:24.417Z Severity: CRITICAL (CVSS 9.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N) Vendors: plantuml Products: plantuml/plantuml Problem Types: CWE-79 Description: XSS via Embedded SVG in SVG Diagram Format in GitHub repository plantuml/plantuml prior to 1.2022.4. Stored XSS in the context of the diagram embedder. Depending on the actual context, this ranges from stealing secrets to account hijacking or even to code execution for example in desktop applications. Web based applications are the ones most affected. Since the SVG format allows clickable links in diagrams, it is commonly used in p
plications are the ones most affected. Since the SVG format allows clickable links in diagrams, it is commonly used in plugins for web based projects (like the Confluence plugin, etc. see https://plantuml.com/de/running). Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/27db9509-6cd3-4148-8d70-5942f3837604 - https://github.com/plantuml/plantuml/commit/c9137be051ce98b3e3e27f65f54ec7d9f8886903 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FQMHXN5BVBK433C5SVSSBXWB5JLJ7NID/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EO26WBHQRMWTS44M5VLZJIJZOIGJYL
/lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EO26WBHQRMWTS44M5VLZJIJZOIGJYL3A/
CVE ID: CVE-2022-1232 State: PUBLISHED Published: 2022-07-25T13:39:16 Last Updated: 2024-08-02T23:55:24.528Z Vendors: Google Products: Chrome Problem Types: Type Confusion Description: Type confusion in V8 in Google Chrome prior to 100.0.4896.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - https://crbug.com/1311641 - https://chromereleases.googleblog.com/2022/04/stable-channel-update-for-desktop.html - https://security.gentoo.org/glsa/202208-25
CVE ID: CVE-2022-1233 State: PUBLISHED Published: 2022-04-04T19:30:15 Last Updated: 2024-08-02T23:55:24.574Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: medialize Products: medialize/uri.js Problem Types: CWE-115 Description: URL Confusion When Scheme Not Supplied in GitHub repository medialize/uri.js prior to 1.19.11. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/228d5548-1109-49f8-8aee-91038e88371c - https://github.com/medialize/uri.js/commit/88805fd3da03bd7a5e60947adb49d182011f1277
CVE ID: CVE-2022-1234 State: PUBLISHED Published: 2022-04-06T03:10:15 Last Updated: 2024-08-02T23:55:24.544Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: livehelperchat Products: livehelperchat/livehelperchat Problem Types: CWE-79 Description: XSS in livehelperchat in GitHub repository livehelperchat/livehelperchat prior to 3.97. This vulnerability has the potential to deface websites, result in compromised user accounts, and can run malicious code on web pages, which can lead to a compromise of the user’s device. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/0d235252-0882-4053-85c1-b41b94c814d4 - https://github
- CVE Program Container: References: - https://huntr.dev/bounties/0d235252-0882-4053-85c1-b41b94c814d4 - https://github.com/livehelperchat/livehelperchat/commit/a09aa0d793818dc4cae78ac4bcfb557d4fd2a30d
CVE ID: CVE-2022-1235 State: PUBLISHED Published: 2022-04-05T06:30:15 Last Updated: 2024-08-02T23:55:24.549Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: livehelperchat Products: livehelperchat/livehelperchat Problem Types: CWE-916 Description: Weak secrethash can be brute-forced in GitHub repository livehelperchat/livehelperchat prior to 3.96. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/92f7b2d4-fa88-4c62-a2ee-721eebe01705 - https://github.com/livehelperchat/livehelperchat/commit/6538d6df3d8a60fee254170b08dd76a161f7bfdc
CVE ID: CVE-2022-1236 State: PUBLISHED Published: 2022-04-05T08:25:10 Last Updated: 2024-08-02T23:55:24.606Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: weseek Products: weseek/growi Problem Types: CWE-521 Description: Weak Password Requirements in GitHub repository weseek/growi prior to v5.0.0. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/c7df088f-e355-45e6-9267-e41030dc6a32 - https://github.com/weseek/growi/commit/b584e2a47ee3c8ce1d8ef38238302825c015327e
CVE ID: CVE-2022-1237 State: PUBLISHED Published: 2022-04-06T09:35:11 Last Updated: 2024-08-02T23:55:24.559Z Severity: HIGH (CVSS 7.6 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H) Vendors: radareorg Products: radareorg/radare2 Problem Types: CWE-129 Description: Improper Validation of Array Index in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability is heap overflow and may be exploitable. For more general description of heap buffer overflow, see [CWE](https://cwe.mitre.org/data/definitions/122.html). Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/ad3c9c4c-76e7-40c8-bd4a-c095acd8bb40 - https://github.com/radareorg/radare2/commi
ferences: - https://huntr.dev/bounties/ad3c9c4c-76e7-40c8-bd4a-c095acd8bb40 - https://github.com/radareorg/radare2/commit/2d782cdaa2112c10b8dd5e7a93c134b2ada9c1a6
CVE ID: CVE-2022-1238 State: PUBLISHED Published: 2022-04-06T00:00:00 Last Updated: 2024-08-02T23:55:24.538Z Severity: HIGH (CVSS 7.6 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H) Vendors: radareorg Products: radareorg/radare2 Problem Types: CWE-787 Description: Out-of-bounds Write in libr/bin/format/ne/ne.c in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability is heap overflow and may be exploitable. For more general description of heap buffer overflow, see [CWE](https://cwe.mitre.org/data/definitions/122.html). Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/47422cdf-aad2-4405-a6a1-6f63a3a93200 - https://github.com/radareorg/r
ontainer: References: - https://huntr.dev/bounties/47422cdf-aad2-4405-a6a1-6f63a3a93200 - https://github.com/radareorg/radare2/commit/c40a4f9862104ede15d0ba05ccbf805923070778
CVE ID: CVE-2022-1239 State: PUBLISHED Published: 2022-05-02T16:05:49 Last Updated: 2024-08-02T23:55:24.529Z Vendors: Unknown Products: HubSpot – CRM, Email Marketing, Live Chat, Forms & Analytics Problem Types: CWE-918 Description: The HubSpot WordPress plugin before 8.8.15 does not validate the proxy URL given to the proxy REST endpoint, which could allow users with the edit_posts capability (by default contributor and above) to perform SSRF attacks Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/4ad2bb96-87a4-4590-a058-b03b33d2fcee
CVE ID: CVE-2022-1240 State: PUBLISHED Published: 2022-04-06T10:15:15 Last Updated: 2024-08-02T23:55:24.530Z Severity: HIGH (CVSS 7.6 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H) Vendors: radareorg Products: radareorg/radare2 Problem Types: CWE-122 Description: Heap buffer overflow in libr/bin/format/mach0/mach0.c in GitHub repository radareorg/radare2 prior to 5.8.6. If address sanitizer is disabled during the compiling, the program should executes into the `r_str_ncpy` function. Therefore I think it is very likely to be exploitable. For more general description of heap buffer overflow, see [CWE](https://cwe.mitre.org/data/definitions/122.html). Additional Analyst Notes: - CVE Program Cont
uffer overflow, see [CWE](https://cwe.mitre.org/data/definitions/122.html). Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/e589bd97-4c74-4e79-93b5-0951a281facc - https://github.com/radareorg/radare2/commit/ca8d8b39f3e34a4fd943270330b80f1148129de4
CVE ID: CVE-2022-1241 State: PUBLISHED Published: 2022-06-06T08:50:54 Last Updated: 2024-08-02T23:55:24.534Z Vendors: Unknown Products: Ask me Problem Types: CWE-79 Description: The Ask me WordPress theme before 6.8.2 does not properly sanitise and escape several of the fields in the Edit Profile page, leading to Reflected Cross-Site Scripting issues Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/3258393a-eafb-4356-994e-2ff8ce223c9b
CVE ID: CVE-2022-1242 State: PUBLISHED Published: 2024-06-03T18:48:02.281Z Last Updated: 2025-03-27T19:31:12.082Z Vendors: Canonical Ltd. Products: Apport Description: Apport can be tricked into connecting to arbitrary sockets as the root user Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://ubuntu.com/security/notices/USN-5427-1 - https://www.cve.org/CVERecord?id=CVE-2022-1242
CVE ID: CVE-2022-1243 State: PUBLISHED Published: 2022-04-05T15:05:18 Last Updated: 2024-08-02T23:55:24.671Z Severity: HIGH (CVSS 7.2 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: medialize Products: medialize/uri.js Problem Types: CWE-20 Description: CRHTLF can lead to invalid protocol extraction potentially leading to XSS in GitHub repository medialize/uri.js prior to 1.19.11. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/8c5afc47-1553-4eba-a98e-024e4cc3dfb7 - https://github.com/medialize/uri.js/commit/b0c9796aa1a95a85f40924fb18b1e5da3dc8ffae
CVE ID: CVE-2022-1244 State: PUBLISHED Published: 2022-04-05T17:55:09 Last Updated: 2024-08-02T23:55:24.320Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: radareorg Products: radareorg/radare2 Problem Types: CWE-122 Description: heap-buffer-overflow in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability is capable of inducing denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/8ae2c61a-2220-47a5-bfe8-fe6d41ab1f82 - https://github.com/radareorg/radare2/commit/2b77b277d67ce061ee6ef839e7139ebc2103c1e3
CVE ID: CVE-2022-1245 State: PUBLISHED Published: 2022-07-07T23:39:22 Last Updated: 2024-08-02T23:55:24.704Z Vendors: n/a Products: keycloak Problem Types: CWE-862 Description: A privilege escalation flaw was found in the token exchange feature of keycloak. Missing authorization allows a client application holding a valid access token to exchange tokens for any target client by passing the client_id of the target. This could allow a client to gain unauthorized access to additional services. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/keycloak/keycloak/security/advisories/GHSA-75p6-52g3-rqc8
CVE ID: CVE-2022-1246 State: REJECTED Published: 2022-04-13T17:07:25 Last Updated: 2022-04-13T17:07:25 Description: No description available.
CVE ID: CVE-2022-1247 State: PUBLISHED Published: 2022-08-31T15:32:59 Last Updated: 2024-08-02T23:55:24.491Z Vendors: n/a Products: Kernel Problem Types: CWE-362 Description: An issue found in linux-kernel that leads to a race condition in rose_connect(). The rose driver uses rose_neigh->use to represent how many objects are using the rose_neigh. When a user wants to delete a rose_route via rose_ioctl(), the rose driver calls rose_del_node() and removes neighbours only if their “count” and “use” are zero. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2066799 - https://access.redhat.com/security/cve/CVE-2022-1247
CVE ID: CVE-2022-1248 State: PUBLISHED Published: 2022-04-06T03:10:10.000Z Last Updated: 2025-04-15T14:42:10.761Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: unspecified Products: SAP Information System Problem Types: CWE-287 Description: A vulnerability was found in SAP Information System 1.0 which has been rated as critical. Affected by this issue is the file /SAP_Information_System/controllers/add_admin.php. An unauthenticated attacker is able to create a new admin account for the web application with a simple POST request. Exploit details were disclosed. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://v
ails were disclosed. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.196550 - http://packetstormsecurity.com/files/166609/SAP-Information-System-1.0.0-Missing-Authorization.html
CVE ID: CVE-2022-1249 State: PUBLISHED Published: 2022-04-29T15:43:10 Last Updated: 2024-08-02T23:55:24.575Z Vendors: n/a Products: pesign Problem Types: CWE-476 Description: A NULL pointer dereference flaw was found in pesign's cms_set_pw_data() function of the cms_common.c file. The function fails to handle the NULL pwdata invocation from daemon.c, which leads to an explicit NULL dereference and crash on all attempts to daemonize pesign. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2065771
CVE ID: CVE-2022-1250 State: PUBLISHED Published: 2022-05-02T16:05:50 Last Updated: 2024-08-02T23:55:24.439Z Vendors: Unknown Products: LifterLMS Paypal Problem Types: CWE-79 Description: The LifterLMS PayPal WordPress plugin before 1.4.0 does not sanitise and escape some parameters from the payment confirmation page before outputting them back in the page, leading to a Reflected Cross-Site Scripting issue Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/1f8cb0b9-7447-44db-8d13-292db5b17718 - https://make.lifterlms.com/2022/04/04/lifterlms-paypal-version-1-4-0/
CVE ID: CVE-2022-1251 State: PUBLISHED Published: 2022-08-22T14:57:20 Last Updated: 2024-08-02T23:55:24.600Z Vendors: Unknown Products: Ask me Problem Types: CWE-352 Description: The Ask me WordPress theme before 6.8.4 does not perform nonce checks when processing POST requests to the Edit Profile page, allowing an attacker to trick a user to change their profile information by sending a crafted request. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/34b3fc35-381a-4bd7-87e3-f1ef0a15a349
CVE ID: CVE-2022-1252 State: PUBLISHED Published: 2022-04-11T10:15:14 Last Updated: 2024-08-02T23:55:24.553Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N) Vendors: gnuboard Products: gnuboard/gnuboard5 Problem Types: CWE-327 Description: Use of a Broken or Risky Cryptographic Algorithm in GitHub repository gnuboard/gnuboard5 prior to and including 5.5.5. A vulnerability in gnuboard v5.5.5 and below uses weak encryption algorithms leading to sensitive information exposure. This allows an attacker to derive the email address of any user, including when the 'Let others see my information.' box is ticked off. Or to send emails to any email address, with full control of i
n the 'Let others see my information.' box is ticked off. Or to send emails to any email address, with full control of its contents Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/c8c2c3e1-67d0-4a11-a4d4-11af567a9ebb - https://0g.vc/posts/insecure-cipher-gnuboard5/
CVE ID: CVE-2022-1253 State: PUBLISHED Published: 2022-04-06T00:00:00 Last Updated: 2024-08-02T23:55:24.444Z Severity: HIGH (CVSS 7.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L) Vendors: strukturag Products: strukturag/libde265 Problem Types: CWE-122 Description: Heap-based Buffer Overflow in GitHub repository strukturag/libde265 prior to and including 1.0.8. The fix is established in commit 8e89fe0e175d2870c39486fdd09250b230ec10b8 but does not yet belong to an official release. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/1-other-strukturag/libde265 - https://github.com/strukturag/libde265/commit/8e89fe0e175d2870c39486fdd09250b230ec10b8 - htt
other-strukturag/libde265 - https://github.com/strukturag/libde265/commit/8e89fe0e175d2870c39486fdd09250b230ec10b8 - https://www.debian.org/security/2023/dsa-5346
CVE ID: CVE-2022-1254 State: PUBLISHED Published: 2022-04-20T13:00:17 Last Updated: 2024-08-02T23:55:24.561Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: McAfee,LLC Products: Secure Web Gateway Problem Types: CWE-601 Description: A URL redirection vulnerability in Skyhigh SWG in main releases 10.x prior to 10.2.9, 9.x prior to 9.2.20, 8.x prior to 8.2.27, and 7.x prior to 7.8.2.31, and controlled release 11.x prior to 11.1.3 allows a remote attacker to redirect a user to a malicious website controlled by the attacker. This is possible because SWG incorrectly creates a HTTP redirect response when a user clicks a carefully constructed URL. Following the red
cause SWG incorrectly creates a HTTP redirect response when a user clicks a carefully constructed URL. Following the redirect response, the new request is still filtered by the SWG policy. Additional Analyst Notes: - CVE Program Container: References: - https://kc.mcafee.com/corporate/index?page=content&id=SB10381
CVE ID: CVE-2022-1255 State: PUBLISHED Published: 2022-05-02T16:05:52 Last Updated: 2024-08-02T23:55:24.548Z Vendors: Unknown Products: Import and export users and customers Problem Types: CWE-79 Description: The Import and export users and customers WordPress plugin before 1.19.2.1 does not sanitise and escaped imported CSV data, which could allow high privilege users to import malicious javascript code and lead to Stored Cross-Site Scripting issues Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/22fe68c4-8f47-491e-be87-5e8e40535a82
CVE ID: CVE-2022-1256 State: PUBLISHED Published: 2022-04-14T13:45:17 Last Updated: 2024-08-02T23:55:24.540Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: McAfee,LLC Products: McAfee Agent for Windows Problem Types: CWE-269 Description: A local privilege escalation vulnerability in MA for Windows prior to 5.7.6 allows a local low privileged user to gain system privileges through running the repair functionality. Temporary file actions were performed on the local user's %TEMP% directory with System privileges through manipulation of symbolic links. Additional Analyst Notes: - CVE Program Container: References: - https://kc.mcafee.com/corporate/index?page=cont
links. Additional Analyst Notes: - CVE Program Container: References: - https://kc.mcafee.com/corporate/index?page=content&id=SB10382
CVE ID: CVE-2022-1257 State: PUBLISHED Published: 2022-04-14T13:50:18 Last Updated: 2024-08-02T23:55:24.338Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) Vendors: McAfee,LLC Products: McAfee Agent Problem Types: CWE-922 Description: Insecure storage of sensitive information vulnerability in MA for Linux, macOS, and Windows prior to 5.7.6 allows a local user to gain access to sensitive information through storage in ma.db. The sensitive information has been moved to encrypted database files. Additional Analyst Notes: - CVE Program Container: References: - https://kc.mcafee.com/corporate/index?page=content&id=SB10382
CVE ID: CVE-2022-1258 State: PUBLISHED Published: 2022-04-14T13:50:12 Last Updated: 2024-08-02T23:55:24.563Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H) Vendors: McAfee,LLC Products: McAfee Agent ePO extension Problem Types: CWE-89 Description: A blind SQL injection vulnerability in the ePolicy Orchestrator (ePO) extension of MA prior to 5.7.6 can be exploited by an authenticated administrator on ePO to perform arbitrary SQL queries in the back-end database, potentially leading to command execution on the server. Additional Analyst Notes: - CVE Program Container: References: - https://kc.mcafee.com/corporate/index?page=content&id=SB10382
CVE ID: CVE-2022-1259 State: PUBLISHED Published: 2022-08-31T00:00:00 Last Updated: 2024-08-02T23:55:24.711Z Vendors: n/a Products: undertow Problem Types: CWE-400 Description: A flaw was found in Undertow. A potential security issue in flow control handling by the browser over HTTP/2 may cause overhead or a denial of service in the server. This flaw exists because of an incomplete fix for CVE-2021-3629. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2072339 - https://access.redhat.com/security/cve/CVE-2022-1259 - https://security.netapp.com/advisory/ntap-20221014-0006/
CVE ID: CVE-2022-1260 State: REJECTED Published: 2022-09-06T17:19:08 Last Updated: 2022-09-06T17:19:08 Description: No description available.
CVE ID: CVE-2022-1261 State: PUBLISHED Published: 2022-05-26T16:35:55.833Z Last Updated: 2025-04-16T16:17:57.516Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:N) Vendors: Matrikon, a subsidiary of Honeywell Products: Matrikon OPC Server Problem Types: CWE-284 Description: Matrikon, a subsidary of Honeywell Matrikon OPC Server (all versions) is vulnerable to a condition where a low privileged user allowed to connect to the OPC server to use the functions of the IPersisFile to execute operating system processes with system-level privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisori
Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-144-02