Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-36920 State: PUBLISHED Published: 2022-07-27T14:29:01 Last Updated: 2024-08-03T10:14:29.469Z Vendors: Jenkins project Products: Jenkins Coverity Plugin Description: A cross-site request forgery (CSRF) vulnerability in Jenkins Coverity Plugin 1.11.4 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-2790%20%282%29 - http://www.openwall.com/lists/oss-security/2022/07/27/1
CVE ID: CVE-2022-36921 State: PUBLISHED Published: 2022-07-27T14:29:16 Last Updated: 2024-08-03T10:14:29.543Z Vendors: Jenkins project Products: Jenkins Coverity Plugin Description: A missing permission check in Jenkins Coverity Plugin 1.11.4 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-2790%20%282%29 - http://www.openwall.com/lists/oss-security/2022/07/27/1
CVE ID: CVE-2022-36922 State: PUBLISHED Published: 2022-07-27T14:29:29 Last Updated: 2024-08-03T10:14:29.456Z Vendors: Jenkins project Products: Jenkins Lucene-Search Plugin Description: Jenkins Lucene-Search Plugin 370.v62a5f618cd3a and earlier does not escape the search query parameter displayed on the 'search' result page, resulting in a reflected cross-site scripting (XSS) vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-2812 - http://www.openwall.com/lists/oss-security/2022/07/27/1
CVE ID: CVE-2022-36923 State: PUBLISHED Published: 2022-08-10T14:17:09.000Z Last Updated: 2025-08-27T18:47:32.363Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, Firewall Analyzer, and OpUtils before 2022-07-27 through 2022-07-28 (125657, 126002, 126104, and 126118) allow unauthenticated attackers to obtain a user's API key, and then access external APIs. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.manageengine.com/itom/advisory/cve-2022-36923.html
CVE ID: CVE-2022-36924 State: PUBLISHED Published: 2022-11-17T22:37:00.188Z Last Updated: 2025-04-28T15:39:04.232Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Zoom Video Communications Inc Products: Zoom Rooms Installer for Windows Problem Types: CWE-427 Description: The Zoom Rooms Installer for Windows prior to 5.12.6 contains a local privilege escalation vulnerability. A local low-privileged user could exploit this vulnerability during the install process to escalate their privileges to the SYSTEM user. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://explore.zoom.us/en/trust/security/security-bulletin/
CVE ID: CVE-2022-36925 State: PUBLISHED Published: 2023-01-09T00:00:00.000Z Last Updated: 2025-04-09T14:33:28.921Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: Zoom Video Communications Inc Products: Zoom Rooms for macOS Problem Types: CWE-321 Description: Zoom Rooms for macOS clients before version 5.11.4 contain an insecure key generation mechanism. The encryption key used for IPC between the Zoom Rooms daemon service and the Zoom Rooms client was generated using parameters that could be obtained by a local low-privileged application. That key can then be used to interact with the daemon service to execute privileged functions and cause a local denial o
That key can then be used to interact with the daemon service to execute privileged functions and cause a local denial of service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://explore.zoom.us/en/trust/security/security-bulletin/
CVE ID: CVE-2022-36926 State: PUBLISHED Published: 2023-01-09T00:00:00.000Z Last Updated: 2025-04-09T14:31:27.018Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Zoom Video Communications Inc Products: Zoom Rooms for macOS Problem Types: CWE-78 Description: Zoom Rooms for macOS clients before version 5.11.3 contain a local privilege escalation vulnerability. A local low-privileged user could exploit this vulnerability to escalate their privileges to root. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://explore.zoom.us/en/trust/security/security-bulletin/
CVE ID: CVE-2022-36927 State: PUBLISHED Published: 2023-01-09T00:00:00.000Z Last Updated: 2025-04-09T14:31:47.826Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Zoom Video Communications Inc Products: Zoom Rooms for macOS Problem Types: CWE-367 Description: Zoom Rooms for macOS clients before version 5.11.3 contain a local privilege escalation vulnerability. A local low-privileged user could exploit this vulnerability to escalate their privileges to root. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://explore.zoom.us/en/trust/security/security-bulletin/
CVE ID: CVE-2022-36928 State: PUBLISHED Published: 2023-01-09T00:00:00.000Z Last Updated: 2025-04-09T14:29:28.671Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N) Vendors: Zoom Video Communications Inc Products: Zoom for Android Problem Types: CWE-35 Description: Zoom for Android clients before version 5.13.0 contain a path traversal vulnerability. A third party app could exploit this vulnerability to read and write to the Zoom application data directory. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://explore.zoom.us/en/trust/security/security-bulletin/
CVE ID: CVE-2022-36929 State: PUBLISHED Published: 2023-01-09T00:00:00.000Z Last Updated: 2025-04-09T14:27:39.256Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Zoom Video Communications Inc Products: Zoom Rooms for Windows Problem Types: CWE-367 Description: The Zoom Rooms Installer for Windows prior to 5.12.6 contains a local privilege escalation vulnerability. A local low-privileged user could exploit this vulnerability during the install process to escalate their privileges to the SYSTEM user. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://explore.zoom.us/en/trust/security/security-bulletin/
CVE ID: CVE-2022-36930 State: PUBLISHED Published: 2023-01-09T00:00:00.000Z Last Updated: 2025-04-08T15:25:59.000Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Zoom Video Communications Inc Products: Zoom Rooms for Windows Problem Types: CWE-427 Description: Zoom Rooms for Windows installers before version 5.13.0 contain a local privilege escalation vulnerability. A local low-privileged user could exploit this vulnerability in an attack chain to escalate their privileges to the SYSTEM user. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://explore.zoom.us/en/trust/security/security-bulletin/
CVE ID: CVE-2022-36934 State: PUBLISHED Published: 2022-09-22T21:30:11.000Z Last Updated: 2025-05-27T16:05:50.201Z Vendors: Meta Products: WhatsApp for iOS, WhatsApp Business for iOS, WhatsApp for Android, WhatsApp Business for Android Problem Types: CWE-122 Description: An integer overflow in WhatsApp could result in remote code execution in an established video call. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.whatsapp.com/security/advisories/2022/
CVE ID: CVE-2022-36937 State: PUBLISHED Published: 2023-05-10T18:28:20.367Z Last Updated: 2025-01-27T18:25:06.548Z Vendors: Facebook Products: HHVM Problem Types: CWE-1104: Use of Unmaintained Third Party Components Description: HHVM 4.172.0 and all prior versions use TLS 1.0 for secure connections when handling tls:// URLs in the stream extension. TLS1.0 has numerous published vulnerabilities and is deprecated. HHVM 4.153.4, 4.168.2, 4.169.2, 4.170.2, 4.171.1, 4.172.1, 4.173.0 replaces TLS1.0 with TLS1.3. Applications that call stream_socket_server or stream_socket_client functions with a URL starting with tls:// are affected. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vu
functions with a URL starting with tls:// are affected. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://hhvm.com/blog/2023/01/20/security-update.html - https://github.com/facebook/hhvm/commit/083f5ffdee661f61512909d16f9a5b98cff3cf0b
CVE ID: CVE-2022-36938 State: PUBLISHED Published: 2022-11-10T00:00:00.000Z Last Updated: 2025-05-01T13:48:31.983Z Vendors: Facebook Products: Redex Problem Types: CWE-125 Description: DexLoader function get_stringidx_fromdex() in Redex prior to commit 3b44c64 can load an out of bound address when loading the string index table, potentially allowing remote code execution during processing of a 3rd party Android APK file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/facebook/redex/commit/3b44c640346b77bfb7ef36e2413688dd460288d2
CVE ID: CVE-2022-36943 State: PUBLISHED Published: 2023-01-03T00:00:00.000Z Last Updated: 2025-04-10T15:56:21.976Z Vendors: ZipArchive Products: SSZipArchive Problem Types: CWE-22 Description: SSZipArchive versions 2.5.3 and older contain an arbitrary file write vulnerability due to lack of sanitization on paths which are symlinks. SSZipArchive will overwrite files on the filesystem when opening a malicious ZIP containing a symlink as the first item. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/metaredteam/external-disclosures/security/advisories/GHSA-vgvw-6xcf-qqfc
CVE ID: CVE-2022-36944 State: PUBLISHED Published: 2022-09-23T00:00:00.000Z Last Updated: 2025-05-27T14:56:43.802Z Vendors: n/a Products: n/a Problem Types: n/a Description: Scala 2.13.x before 2.13.9 has a Java deserialization chain in its JAR file. On its own, it cannot be exploited. There is only a risk in conjunction with Java object deserialization within an application. In such situations, it allows attackers to erase contents of arbitrary files, make network connections, or possibly run arbitrary code (specifically, Function0 functions) via a gadget chain. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.scala-lang.org/download/ - h
Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.scala-lang.org/download/ - https://github.com/scala/scala/pull/10118 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L3WMKPFAMFQE3HJVRQ5KOJUTWG264SXI/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6ZOZVWY3X72FZZCCRAKRJYTQOJ6LUD6Z/ - https://discuss.lightbend.com/t/impact-of-cve-2022-36944-on-akka-cluster-akka-actor-akka-remote/10007/2 - https://github.com/scala/scala-collection-compat/releases/tag/v2.9.0
CVE ID: CVE-2022-36945 State: PUBLISHED Published: 2022-08-24T05:01:53 Last Updated: 2024-08-03T10:21:31.962Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Remote Keyless Entry (RKE) receiving unit on certain Mazda vehicles through 2020 allows remote attackers to perform unlock operations and force a resynchronization after capturing three consecutive valid key-fob signals over the radio, aka a RollBack attack. The attacker retains the ability to unlock indefinitely. Additional Analyst Notes: - CVE Program Container: References: - https://www.blackhat.com/us-22/briefings/schedule/#rollback---a-new-time-agnostic-replay-attack-against-the-automotive-remote-keyless-entry-system
s-22/briefings/schedule/#rollback---a-new-time-agnostic-replay-attack-against-the-automotive-remote-keyless-entry-systems-27185 - https://medium.com/codex/rollback-a-new-time-agnostic-replay-attack-against-the-automotive-remote-keyless-entry-systems-df5f99ba9490 - https://www.youtube.com/playlist?list=PLYodcy84oQL1gxwiuRm13xRXxTQL9cO5t - https://www.pcmag.com/news/is-your-car-key-fob-vulnerable-to-this-simple-replay-attack - https://hackaday.com/2022/08/17/rollback-breaks-into-your-car/
CVE ID: CVE-2022-36946 State: PUBLISHED Published: 2022-07-27T00:00:00.000Z Last Updated: 2025-05-05T16:13:27.647Z Vendors: n/a Products: n/a Problem Types: n/a Description: nfqnl_mangle in net/netfilter/nfnetlink_queue.c in the Linux kernel through 5.18.14 allows remote attackers to cause a denial of service (panic) because, in the case of an nf_queue verdict with a one-byte nfta_payload attribute, an skb_pull can encounter a negative skb->len. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://marc.info/?l=netfilter-devel&m=165883202007292&w=2 - https://www.debian.org/security/2022/dsa-5207 - https://security.netapp.com/advisory/ntap-20220901-
65883202007292&w=2 - https://www.debian.org/security/2022/dsa-5207 - https://security.netapp.com/advisory/ntap-20220901-0007/ - https://lists.debian.org/debian-lts-announce/2022/09/msg00011.html - https://lists.debian.org/debian-lts-announce/2022/10/msg00000.html - https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=99a63d36cb3ed5ca3aa6fcb64cffbeaf3b0fb164
CVE ID: CVE-2022-36947 State: PUBLISHED Published: 2022-08-18T20:58:16 Last Updated: 2024-08-03T10:21:31.919Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unsafe Parsing of a PNG tRNS chunk in FastStone Image Viewer through 7.5 results in a stack buffer overflow. Additional Analyst Notes: - CVE Program Container: References: - https://www.faststone.org/FSViewerDetail.htm - https://wid.cert-bund.de/portal/wid/kurzinformationen - https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-0883
CVE ID: CVE-2022-36948 State: PUBLISHED Published: 2022-07-27T21:01:05 Last Updated: 2024-08-03T10:21:32.254Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AC:L/AV:N/A:N/C:L/I:L/PR:L/S:C/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: In Veritas NetBackup OpsCenter, a DOM XSS attack can occur. This affects 8.x through 8.3.0.2, 9.x through 9.0.0.1, 9.1.x through 9.1.0.1, and 10. Additional Analyst Notes: - CVE Program Container: References: - https://www.veritas.com/content/support/en_US/security/VTS22-009#Issue7
CVE ID: CVE-2022-36949 State: PUBLISHED Published: 2022-07-27T21:00:48 Last Updated: 2024-08-03T10:21:32.351Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AC:L/AV:L/A:H/C:H/I:H/PR:N/S:C/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: In Veritas NetBackup OpsCenter, an attacker with local access to a NetBackup OpsCenter server could potentially escalate their privileges. This affects 8.x through 8.3.0.2, 9.x through 9.0.0.1, 9.1.x through 9.1.0.1, and 10. Additional Analyst Notes: - CVE Program Container: References: - https://www.veritas.com/content/support/en_US/security/VTS22-009#Issue5
CVE ID: CVE-2022-36950 State: PUBLISHED Published: 2022-07-27T21:00:20 Last Updated: 2024-08-03T10:21:31.968Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: In Veritas NetBackup OpsCenter, an unauthenticated remote attacker may be able to perform remote command execution through a Java classloader manipulation. This affects 8.x through 8.3.0.2, 9.x through 9.0.0.1, 9.1.x through 9.1.0.1, and 10. Additional Analyst Notes: - CVE Program Container: References: - https://www.veritas.com/content/support/en_US/security/VTS22-009#Issue3
CVE ID: CVE-2022-36951 State: PUBLISHED Published: 2022-07-27T20:59:55 Last Updated: 2024-08-03T10:21:32.173Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: In Veritas NetBackup OpsCenter, an unauthenticated remote attacker may compromise the host by exploiting an incorrectly patched vulnerability. This affects 8.x through 8.3.0.2, 9.x through 9.0.0.1, 9.1.x through 9.1.0.1, and 10. Additional Analyst Notes: - CVE Program Container: References: - https://www.veritas.com/content/support/en_US/security/VTS22-009#Issue2
CVE ID: CVE-2022-36952 State: PUBLISHED Published: 2022-07-27T20:59:34 Last Updated: 2024-08-03T10:21:32.239Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AC:L/AV:L/A:H/C:H/I:H/PR:N/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: In Veritas NetBackup OpsCenter, a hard-coded credential exists that could be used to exploit the underlying VxSS subsystem. This affects 8.x through 8.3.0.2, 9.x through 9.0.0.1, 9.1.x through 9.1.0.1, and 10. Additional Analyst Notes: - CVE Program Container: References: - https://www.veritas.com/content/support/en_US/security/VTS22-009#Issue6
CVE ID: CVE-2022-36953 State: PUBLISHED Published: 2022-07-27T20:59:09 Last Updated: 2024-08-03T10:21:32.459Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AC:L/AV:N/A:N/C:L/I:N/PR:L/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: In Veritas NetBackup OpsCenter, certain endpoints could allow an unauthenticated remote attacker to gain sensitive information. This affects 8.x through 8.3.0.2, 9.x through 9.0.0.1, 9.1.x through 9.1.0.1, and 10. Additional Analyst Notes: - CVE Program Container: References: - https://www.veritas.com/content/support/en_US/security/VTS22-009#Issue8
CVE ID: CVE-2022-36954 State: PUBLISHED Published: 2022-07-27T20:58:39 Last Updated: 2024-08-03T10:21:32.231Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:L/S:C/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: In Veritas NetBackup OpsCenter, under specific conditions, an authenticated remote attacker may be able to create or modify OpsCenter user accounts. This affects 8.x through 8.3.0.2, 9.x through 9.0.0.1, 9.1.x through 9.1.0.1, and 10. Additional Analyst Notes: - CVE Program Container: References: - https://www.veritas.com/content/support/en_US/security/VTS22-009#Issue1
CVE ID: CVE-2022-36955 State: PUBLISHED Published: 2022-07-27T20:58:09 Last Updated: 2024-08-03T10:21:32.411Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AC:L/AV:L/A:H/C:H/I:H/PR:N/S:U/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: In Veritas NetBackup, an attacker with unprivileged local access to a NetBackup Client may send specific commands to escalate their privileges. This affects 8.0 through 8.1.2, 8.2, 8.3 through 8.3.0.2, 9.x through 9.0.0.1, and 9.1.x through 9.1.0.1. Additional Analyst Notes: - CVE Program Container: References: - https://www.veritas.com/content/support/en_US/security/VTS22-008#Issue2
CVE ID: CVE-2022-36956 State: PUBLISHED Published: 2022-07-27T20:57:47 Last Updated: 2024-08-03T10:21:32.180Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:L/S:C/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: In Veritas NetBackup, the NetBackup Client allows arbitrary command execution from any remote host that has access to a valid host-id NetBackup certificate/private key from the same domain. The affects 9.0.x through 9.0.0.1 and 9.1.x through 9.1.0.1. Additional Analyst Notes: - CVE Program Container: References: - https://www.veritas.com/content/support/en_US/security/VTS22-008#Issue1
CVE ID: CVE-2022-36957 State: PUBLISHED Published: 2022-10-20T20:08:04.993Z Last Updated: 2025-05-05T20:01:34.955Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: SolarWinds Products: SolarWinds Platform, Orion Platform Problem Types: CWE-502 Description: SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Orion admin-level account access to SolarWinds Web Console to execute arbitrary commands. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.solarwinds.com/trust-center/security-advisories/CVE-2022-36957 - https://www.zerodayinitiati
: References: - https://www.solarwinds.com/trust-center/security-advisories/CVE-2022-36957 - https://www.zerodayinitiative.com/advisories/ZDI-CAN-17530
CVE ID: CVE-2022-36958 State: PUBLISHED Published: 2022-10-20T20:10:01.367Z Last Updated: 2025-05-08T13:25:48.824Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: SolarWinds Products: SolarWinds Platform, Orion Platform Problem Types: CWE-502 Description: SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with valid access to SolarWinds Web Console to execute arbitrary commands. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.solarwinds.com/trust-center/security-advisories/CVE-2022-36958 - https://www.zerodayinitiative.com/advisories/ZD
s://www.solarwinds.com/trust-center/security-advisories/CVE-2022-36958 - https://www.zerodayinitiative.com/advisories/ZDI-CAN-17567
CVE ID: CVE-2022-36960 State: PUBLISHED Published: 2022-11-29T20:43:38.388Z Last Updated: 2025-04-24T17:46:45.937Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: SolarWinds Products: SolarWinds Platform, Orion Platform Problem Types: CWE-287, CWE-20 Description: SolarWinds Platform was susceptible to Improper Input Validation. This vulnerability allows a remote adversary with valid access to SolarWinds Web Console to escalate user privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.solarwinds.com/trust-center/security-advisories/CVE-2022-36960 - https://documentation.solarwinds.com/en/success_cente
w.solarwinds.com/trust-center/security-advisories/CVE-2022-36960 - https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2022-4_release_notes.htm
CVE ID: CVE-2022-36961 State: PUBLISHED Published: 2022-09-30T16:06:10.288Z Last Updated: 2025-05-20T16:01:34.479Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: SolarWinds Products: Orion Platform Problem Types: CWE-89 Description: A vulnerable component of Orion Platform was vulnerable to SQL Injection, an authenticated attacker could leverage this for privilege escalation or remote code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.solarwinds.com/trust-center/security-advisories/cve-2022-36961 - https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solar
sories/cve-2022-36961 - https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2022-3_release_notes.htm
CVE ID: CVE-2022-36962 State: PUBLISHED Published: 2022-11-29T20:46:18.482Z Last Updated: 2025-04-25T14:42:00.235Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: SolarWinds Products: SolarWinds Platform, Orion Platform Problem Types: CWE-78 Description: SolarWinds Platform was susceptible to Command Injection. This vulnerability allows a remote adversary with complete control over the SolarWinds database to execute arbitrary commands. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2022-4_release_notes.htm -
ion.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2022-4_release_notes.htm - https://www.solarwinds.com/trust-center/security-advisories/CVE-2022-36962