Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-45127 State: PUBLISHED Published: 2023-01-18T00:39:40.324Z Last Updated: 2025-01-16T22:00:10.759Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H) Vendors: Sewio Products: RTLS Studio Problem Types: CWE-352 Description: Sewio’s Real-Time Location System (RTLS) Studio version 2.0.0 up to and including version 2.6.2 is vulnerable to cross-site request forgery in its backup services. An attacker could take advantage of this vulnerability to execute arbitrary backup operations and cause a denial-of-service condition. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-23-0
es: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-23-012-01
CVE ID: CVE-2022-45128 State: PUBLISHED Published: 2023-05-10T13:17:21.859Z Last Updated: 2025-01-27T17:59:07.380Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H) Vendors: n/a Products: Intel(R) EMA software Problem Types: denial of service, CWE-285 Description: Improper authorization in the Intel(R) EMA software before version 1.9.0.0 may allow an authenticated user to potentially enable denial of service via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00797.html
CVE ID: CVE-2022-45129 State: PUBLISHED Published: 2022-11-10T00:00:00.000Z Last Updated: 2025-05-01T13:42:02.196Z Vendors: n/a Products: n/a Problem Types: n/a Description: Payara before 2022-11-04, when deployed to the root context, allows attackers to visit META-INF and WEB-INF, a different vulnerability than CVE-2022-37422. This affects Payara Platform Community before 4.1.2.191.38, 5.x before 5.2022.4, and 6.x before 6.2022.1, and Payara Platform Enterprise before 5.45.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://blog.payara.fish/whats-new-in-the-november-2022-payara-platform-release - https://docs.payara.fish/enterprise/docs/Relea
blog.payara.fish/whats-new-in-the-november-2022-payara-platform-release - https://docs.payara.fish/enterprise/docs/Release%20Notes/Release%20Notes%205.45.0.html - https://docs.payara.fish/community/docs/Release%20Notes/Release%20Notes%205.2022.4.html - https://docs.payara.fish/community/docs/6.2022.1/Release%20Notes/Release%20Notes%206.2022.1.html - https://github.com/payara/Payara/commit/cccdfddeda71c78ae7b3179db5429e1bb8a56b2e - http://seclists.org/fulldisclosure/2022/Nov/11 - http://packetstormsecurity.com/files/169864/Payara-Platform-Path-Traversal.html
CVE ID: CVE-2022-45130 State: PUBLISHED Published: 2022-11-10T00:00:00.000Z Last Updated: 2025-05-01T13:39:58.856Z Vendors: n/a Products: n/a Problem Types: n/a Description: Plesk Obsidian allows a CSRF attack, e.g., via the /api/v2/cli/commands REST API to change an Admin password. NOTE: Obsidian is a specific version of the Plesk product: version numbers were used through version 12, and then the convention was changed so that versions are identified by names ("Obsidian"), not numbers. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortbridge.co.uk/research/compromising-plesk-via-its-rest-api/
CVE ID: CVE-2022-45132 State: PUBLISHED Published: 2022-11-18T00:00:00.000Z Last Updated: 2025-04-30T14:36:37.228Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Linaro Automated Validation Architecture (LAVA) before 2022.11.1, remote code execution can be achieved through user-submitted Jinja2 template. The REST API endpoint for validating device configuration files in lava-server loads input as a Jinja2 template in a way that can be used to trigger remote code execution in the LAVA server. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://podalirius.net/en/articles/python-vulnerabilities-code-execution-in-jinja-templates/ - htt
chment: References: - https://podalirius.net/en/articles/python-vulnerabilities-code-execution-in-jinja-templates/ - https://lists.lavasoftware.org/archives/list/lava-announce%40lists.lavasoftware.org/thread/WHXGQMIZAPW3GCQEXYHC32N2ZAAAIYCY/
CVE ID: CVE-2022-45133 State: PUBLISHED Published: 2025-08-22T00:00:00.000Z Last Updated: 2025-08-25T15:53:30.339Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mahara 21.10 before 21.10.6, 22.04 before 22.04.4, and 22.10 before 22.10.1 allows unsafe font upload for skins. A particularly structured XML file could allow one to traverse the server to obtain access to secure files or cause code execution based on the payload. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugs.launchpad.net/mahara/+bug/1995819 - https://mahara.org/interaction/forum/topic.php?id=9353
CVE ID: CVE-2022-45134 State: PUBLISHED Published: 2025-08-22T00:00:00.000Z Last Updated: 2025-08-26T14:07:13.114Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mahara 21.10 before 21.10.6, 22.04 before 22.04.4, and 22.10 before 22.10.1 deserializes user input unsafely during skin import. A particularly structured XML file could cause code execution when being processed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugs.launchpad.net/mahara/+bug/1993082 - https://mahara.org/interaction/forum/topic.php?id=9353
CVE ID: CVE-2022-45135 State: PUBLISHED Published: 2023-11-30T08:05:45.604Z Last Updated: 2025-02-13T16:33:44.260Z Vendors: Apache Software Foundation Products: Apache Cocoon Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Cocoon.This issue affects Apache Cocoon: from 2.2.0 before 2.3.0. Users are recommended to upgrade to version 2.3.0, which fixes the issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/lsvd1hmr2t2q823x21d5ygzgbj9jpvjp - http://www.openwall.com/lists/oss-security/2023/11/30/3
CVE ID: CVE-2022-45136 State: PUBLISHED Published: 2022-11-14T00:00:00 Last Updated: 2024-08-03T14:09:56.492Z Vendors: Apache Software Foundation Products: Apache Jena SDB Problem Types: CWE-502 Description: Apache Jena SDB 3.17.0 and earlier is vulnerable to a JDBC Deserialisation attack if the attacker is able to control the JDBC URL used or cause the underlying database server to return malicious data. The mySQL JDBC driver in particular is known to be vulnerable to this class of attack. As a result an application using Apache Jena SDB can be subject to RCE when connected to a malicious database server. Apache Jena SDB has been EOL since December 2020 and users should migrate to alternati
d to a malicious database server. Apache Jena SDB has been EOL since December 2020 and users should migrate to alternative options e.g. Apache Jena TDB 2. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://lists.apache.org/thread/mc77cdl5stgjtjoldk467gdf756qjt31 - http://www.openwall.com/lists/oss-security/2022/11/14/5
CVE ID: CVE-2022-45137 State: PUBLISHED Published: 2023-02-27T14:36:03.411Z Last Updated: 2024-08-03T14:09:56.545Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: WAGO Products: Compact Controller CC100 (751-9301), Edge Controller (752-8303/8000-002), PFC100 (750-81xx/xxx-xxx), PFC200 (750-82xx/xxx-xxx), Touch Panel 600 Advanced Line (762-5xxx), Touch Panel 600 Marine Line (762-6xxx), Touch Panel 600 Standard Line (762-4xxx) Problem Types: CWE-79 Description: The configuration backend of the web-based management is vulnerable to reflected XSS (Cross-Site Scripting) attacks that targets the users browser. This leads to a limited impact of confidentiality and
SS (Cross-Site Scripting) attacks that targets the users browser. This leads to a limited impact of confidentiality and integrity but no impact of availability. Additional Analyst Notes: - CVE Program Container: References: - https://cert.vde.com/en/advisories/VDE-2022-060/
CVE ID: CVE-2022-45138 State: PUBLISHED Published: 2023-02-27T14:36:20.474Z Last Updated: 2025-03-10T17:20:50.798Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: WAGO Products: Compact Controller CC100 (751-9301), Edge Controller (752-8303/8000-002), PFC100 (750-81xx/xxx-xxx), PFC200 (750-82xx/xxx-xxx), Touch Panel 600 Advanced Line (762-5xxx), Touch Panel 600 Marine Line (762-6xxx), Touch Panel 600 Standard Line (762-4xxx) Problem Types: CWE-306 Description: The configuration backend of the web-based management can be used by unauthenticated users, although only authenticated users should be able to use the API. The vulnerability allows an unauthenticate
cated users, although only authenticated users should be able to use the API. The vulnerability allows an unauthenticated attacker to read and set several device parameters that can lead to full compromise of the device. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert.vde.com/en/advisories/VDE-2022-060/
CVE ID: CVE-2022-45139 State: PUBLISHED Published: 2023-02-27T14:36:32.016Z Last Updated: 2025-03-10T17:46:16.888Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: WAGO Products: Compact Controller CC100 (751-9301), Edge Controller (752-8303/8000-002), PFC100 (750-81xx/xxx-xxx), PFC200 (750-82xx/xxx-xxx), Touch Panel 600 Advanced Line (762-5xxx), Touch Panel 600 Marine Line (762-6xxx), Touch Panel 600 Standard Line (762-4xxx) Problem Types: CWE-346 Description: A CORS Misconfiguration in the web-based management allows a malicious third party webserver to misuse all basic information pages on the webserver. In combination with CVE-2022-45138 this could lead t
y webserver to misuse all basic information pages on the webserver. In combination with CVE-2022-45138 this could lead to disclosure of device information like CPU diagnostics. As there is just a limited amount of information readable the impact only affects a small subset of confidentiality. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert.vde.com/en/advisories/VDE-2022-060/
CVE ID: CVE-2022-45140 State: PUBLISHED Published: 2023-02-27T14:36:39.448Z Last Updated: 2025-03-10T17:46:52.078Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: WAGO Products: Compact Controller CC100 (751-9301), Edge Controller (752-8303/8000-002), PFC100 (750-81xx/xxx-xxx), PFC200 (750-82xx/xxx-xxx), Touch Panel 600 Advanced Line (762-5xxx), Touch Panel 600 Marine Line (762-6xxx), Touch Panel 600 Standard Line (762-4xxx) Problem Types: CWE-306 Description: The configuration backend allows an unauthenticated user to write arbitrary data with root privileges to the storage, which could lead to unauthenticated remote code execution and full system comprom
a with root privileges to the storage, which could lead to unauthenticated remote code execution and full system compromise. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert.vde.com/en/advisories/VDE-2022-060/
CVE ID: CVE-2022-45141 State: PUBLISHED Published: 2023-03-06T00:00:00.000Z Last Updated: 2025-03-06T20:38:07.059Z Vendors: n/a Products: Samba Problem Types: CWE-328 Description: Since the Windows Kerberos RC4-HMAC Elevation of Privilege Vulnerability was disclosed by Microsoft on Nov 8 2022 and per RFC8429 it is assumed that rc4-hmac is weak, Vulnerable Samba Active Directory DCs will issue rc4-hmac encrypted tickets despite the target server supporting better encryption (eg aes256-cts-hmac-sha1-96). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.samba.org/samba/security/CVE-2022-45141.html - https://security.gentoo.org/glsa/202309-06
CVE ID: CVE-2022-45142 State: PUBLISHED Published: 2023-03-06T00:00:00.000Z Last Updated: 2025-03-06T20:20:48.532Z Vendors: n/a Products: Samba Problem Types: CWE-354 Description: The fix for CVE-2022-3437 included changing memcmp to be constant time and a workaround for a compiler bug by adding "!= 0" comparisons to the result of memcmp. When these patches were backported to the heimdal-7.7.1 and heimdal-7.8.0 branches (and possibly other branches) a logic inversion sneaked in causing the validation of message integrity codes in gssapi/arcfour to be inverted. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.openwall.com/lists/oss-security
alyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.openwall.com/lists/oss-security/2023/02/08/1 - https://security.gentoo.org/glsa/202310-06
CVE ID: CVE-2022-45143 State: PUBLISHED Published: 2023-01-03T18:12:28.351Z Last Updated: 2024-08-03T14:09:56.475Z Vendors: Apache Software Foundation Products: Apache Tomcat Problem Types: CWE-116 Description: The JsonErrorReportValve in Apache Tomcat 8.5.83, 9.0.40 to 9.0.68 and 10.1.0-M1 to 10.1.1 did not escape the type, message or description values. In some circumstances these are constructed from user provided data and it was therefore possible for users to supply values that invalidated or manipulated the JSON output. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/yqkd183xrw3wqvnpcg3osbcryq85fkzj - https://sec
r: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/yqkd183xrw3wqvnpcg3osbcryq85fkzj - https://security.gentoo.org/glsa/202305-37
CVE ID: CVE-2022-45144 State: PUBLISHED Published: 2023-05-17T00:00:00.000Z Last Updated: 2025-01-22T20:07:21.219Z Vendors: n/a Products: n/a Problem Types: n/a Description: Algoo Tracim before 4.4.2 allows XSS via HTML file upload. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://hub.docker.com/r/algoo/tracim - https://github.com/tracim/tracim/compare/release_04.04.01...release_04.04.02 - https://herolab.usd.de/security-advisories/usd-2022-0048/
CVE ID: CVE-2022-45145 State: PUBLISHED Published: 2022-12-10T00:00:00.000Z Last Updated: 2025-04-23T13:54:51.643Z Vendors: n/a Products: n/a Problem Types: n/a Description: egg-compile.scm in CHICKEN 5.x before 5.3.1 allows arbitrary OS command execution during package installation via escape characters in a .egg file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.gnu.org/archive/html/chicken-announce/2022-11/msg00000.html - https://code.call-cc.org/cgi-bin/gitweb.cgi?p=chicken-core.git%3Ba=blobdiff%3Bf=egg-compile.scm%3Bh=9ba4568113350ec75204cba55e43e27925e2d6fe%3Bhp=c1f2ceb0fb470f63c2ba2a1cf9d8d40083c2359f%3Bhb=a08f8f548d772ef410c6
scm%3Bh=9ba4568113350ec75204cba55e43e27925e2d6fe%3Bhp=c1f2ceb0fb470f63c2ba2a1cf9d8d40083c2359f%3Bhb=a08f8f548d772ef410c672ba33a27108d8d434f3%3Bhpb=9c6fb001c25de4390f46ffd7c3c94237f4df92a9 - https://code.call-cc.org/cgi-bin/gitweb.cgi?p=chicken-core.git%3Ba=blobdiff%3Bf=NEWS%3Bh=54888afff09353093453673c407cabfe76a5ce77%3Bhp=a3fd88a892f82c8353267f50509d018bbb1934b9%3Bhb=670478435a982fc4d1f001ea08669f53d35a51cd%3Bhpb=a08f8f548d772ef410c672ba33a27108d8d434f3
CVE ID: CVE-2022-45146 State: PUBLISHED Published: 2022-11-21T00:00:00 Last Updated: 2024-08-03T14:09:56.019Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the FIPS Java API of Bouncy Castle BC-FJA before 1.0.2.4. Changes to the JVM garbage collector in Java 13 and later trigger an issue in the BC-FJA FIPS modules where it is possible for temporary keys used by the module to be zeroed out while still in use by the module, resulting in errors or potential information loss. NOTE: FIPS compliant users are unaffected because the FIPS certification is only for Java 7, 8, and 11. Additional Analyst Notes: - CVE Program Container: References: - https://www.bo
ification is only for Java 7, 8, and 11. Additional Analyst Notes: - CVE Program Container: References: - https://www.bouncycastle.org/latest_releases.html - https://github.com/bcgit/bc-java/wiki/CVE-2022-45146 - https://mvnrepository.com/artifact/org.bouncycastle/bc-fips
CVE ID: CVE-2022-45147 State: PUBLISHED Published: 2024-07-09T12:04:22.545Z Last Updated: 2025-08-27T20:32:52.249Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: SIMATIC PCS neo V4.0, SIMATIC STEP 7 V16, SIMATIC STEP 7 V17, SIMATIC STEP 7 V18 Problem Types: CWE-502 Description: A vulnerability has been identified in SIMATIC PCS neo V4.0 (All versions), SIMATIC STEP 7 V16 (All versions), SIMATIC STEP 7 V17 (All versions), SIMATIC STEP 7 V18 (All versions < V18 Update 2). Affected applications do not properly restrict the .NET BinaryFormatter when deserializing user-controllable input. This could allow an attacker to cause a type
strict the .NET BinaryFormatter when deserializing user-controllable input. This could allow an attacker to cause a type confusion and execute arbitrary code within the affected application. This is the same issue that exists for .NET BinaryFormatter https://docs.microsoft.com/en-us/visualstudio/code-quality/ca2300. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/html/ssa-825651.html
CVE ID: CVE-2022-45148 State: REJECTED Published: N/A Last Updated: 2023-01-12T00:00:00 Description: No description available.
CVE ID: CVE-2022-45149 State: PUBLISHED Published: 2022-11-23T00:00:00.000Z Last Updated: 2025-04-25T19:40:45.380Z Vendors: n/a Products: Moodle Problem Types: CWE-352 Description: A vulnerability was found in Moodle which exists due to insufficient validation of the HTTP request origin in course redirect URL. A user's CSRF token was unnecessarily included in the URL when being redirected to a course they have just restored. A remote attacker can trick the victim to visit a specially crafted web page and perform arbitrary actions on behalf of the victim on the vulnerable website. This flaw allows an attacker to perform cross-site request forgery attacks. Additional Analyst Notes: - CVE Progr
bsite. This flaw allows an attacker to perform cross-site request forgery attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2142772 - https://moodle.org/mod/forum/discuss.php?d=440769 - http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-75862 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/74SXNGA5RIWM7QNX7H3G7SYIQLP4UUGV/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NLRJB5JNKK3VVBLV3NH3RI7COEDAXSAB/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedora
essage/NLRJB5JNKK3VVBLV3NH3RI7COEDAXSAB/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2DHYIIAUXUBHMBEDYU7TYNZXEN2W2SA2/
CVE ID: CVE-2022-45150 State: PUBLISHED Published: 2022-11-23T00:00:00.000Z Last Updated: 2025-04-25T19:29:24.937Z Vendors: n/a Products: Moodle Problem Types: CWE-79 Description: A reflected cross-site scripting vulnerability was discovered in Moodle. This flaw exists due to insufficient sanitization of user-supplied data in policy tool. An attacker can trick the victim to open a specially crafted link that executes an arbitrary HTML and script code in user's browser in context of vulnerable website. This vulnerability may allow an attacker to perform cross-site scripting (XSS) attacks to gain access potentially sensitive information and modification of web pages. Additional Analyst Notes:
(XSS) attacks to gain access potentially sensitive information and modification of web pages. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2142773 - https://moodle.org/mod/forum/discuss.php?d=440770 - http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-76091 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/74SXNGA5RIWM7QNX7H3G7SYIQLP4UUGV/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NLRJB5JNKK3VVBLV3NH3RI7COEDAXSAB/ - https://lists.fedoraproject.org/archives/list/package-announce%40l
oject.org/message/NLRJB5JNKK3VVBLV3NH3RI7COEDAXSAB/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2DHYIIAUXUBHMBEDYU7TYNZXEN2W2SA2/
CVE ID: CVE-2022-45151 State: PUBLISHED Published: 2022-11-23T00:00:00.000Z Last Updated: 2025-04-25T19:28:48.118Z Vendors: n/a Products: Moodle Problem Types: CWE-79 Description: The stored-XSS vulnerability was discovered in Moodle which exists due to insufficient sanitization of user-supplied data in several "social" user profile fields. An attacker could inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2142774 - https://moodle.org/mod/forum/discuss.php?d=440771 - http://git.moodle.org/gw?p=moodle.git&a=s
/show_bug.cgi?id=2142774 - https://moodle.org/mod/forum/discuss.php?d=440771 - http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-76131 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/74SXNGA5RIWM7QNX7H3G7SYIQLP4UUGV/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NLRJB5JNKK3VVBLV3NH3RI7COEDAXSAB/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2DHYIIAUXUBHMBEDYU7TYNZXEN2W2SA2/
CVE ID: CVE-2022-45152 State: PUBLISHED Published: 2022-11-25T00:00:00.000Z Last Updated: 2025-04-29T14:22:36.364Z Vendors: n/a Products: Moodle Problem Types: CWE-918 Description: A blind Server-Side Request Forgery (SSRF) vulnerability was found in Moodle. This flaw exists due to insufficient validation of user-supplied input in LTI provider library. The library does not utilise Moodle's inbuilt cURL helper, which resulted in a blind SSRF risk. An attacker can send a specially crafted HTTP request and trick the application to initiate requests to arbitrary systems. This vulnerability allows a remote attacker to perform SSRF attacks. Additional Analyst Notes: - CVE Program Container: - CISA
ulnerability allows a remote attacker to perform SSRF attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2142775 - https://moodle.org/mod/forum/discuss.php?d=440772 - http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-71920 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/74SXNGA5RIWM7QNX7H3G7SYIQLP4UUGV/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NLRJB5JNKK3VVBLV3NH3RI7COEDAXSAB/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/
BLV3NH3RI7COEDAXSAB/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2DHYIIAUXUBHMBEDYU7TYNZXEN2W2SA2/
CVE ID: CVE-2022-45153 State: PUBLISHED Published: 2023-02-15T00:00:00.000Z Last Updated: 2025-03-18T19:25:05.374Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: SUSE, openSUSE Products: SUSE Linux Enterprise Module for SAP Applications 15-SP1, SUSE Linux Enterprise Server for SAP 12-SP5, openSUSE Leap 15.4 Problem Types: CWE-276 Description: An Incorrect Default Permissions vulnerability in saphanabootstrap-formula of SUSE Linux Enterprise Module for SAP Applications 15-SP1, SUSE Linux Enterprise Server for SAP 12-SP5; openSUSE Leap 15.4 allows local attackers to escalate to root by manipulating the sudo configuration that is created. This issue affects: SUSE