Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-27855 State: PUBLISHED Published: 2022-11-08T18:30:19.855Z Last Updated: 2025-02-20T19:55:21.833Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: Fatcat Apps Products: Analytics Cat (WordPress plugin) Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Fatcat Apps Analytics Cat plugin <= 1.0.9 on WordPress allows Plugin Settings Change. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/analytics-cat/#developers - https://patchstack.com/database/vulnerability/analytics-cat/wordpress-analytics-cat-plugin-1-0-9-plugin-settings-change-via-cro
/patchstack.com/database/vulnerability/analytics-cat/wordpress-analytics-cat-plugin-1-0-9-plugin-settings-change-via-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2022-27856 State: PUBLISHED Published: 2023-05-10T10:28:07.703Z Last Updated: 2025-01-09T15:18:21.711Z Severity: LOW (CVSS 3.4 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:L/A:N) Vendors: Atlas Gondal Products: Export All URLs Problem Types: CWE-79 Description: Auth. (editor+) Stored Cross-Site Scripting (XSS) vulnerability in Atlas Gondal Export All URLs plugin <= 4.1 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/export-all-urls/wordpress-export-all-urls-plugin-4-1-authenticated-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2022-27858 State: PUBLISHED Published: 2022-11-08T18:29:27.320Z Last Updated: 2025-02-20T19:55:29.141Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N) Vendors: Activity Log Team Products: Activity Log (WordPress plugin) Problem Types: CWE-1236 Description: CSV Injection vulnerability in Activity Log Team Activity Log <= 2.8.3 on WordPress. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/aryo-activity-log/wordpress-activity-log-plugin-2-8-3-csv-injection-vulnerability?_s_id=cve
CVE ID: CVE-2022-27859 State: PUBLISHED Published: 2022-06-15T13:12:01.926Z Last Updated: 2025-02-20T20:19:50.998Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N) Vendors: Nicdark d.o.o. Products: Travel Management (WordPress plugin) Problem Types: CWE-79 Description: Multiple Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerabilities in Nicdark d.o.o. Travel Management plugin <= 2.0 at WordPress. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/nd-travel/ - https://patchstack.com/database/vulnerability/nd-travel/wordpress-travel-management-plugin-2-0-multipl
gins/nd-travel/ - https://patchstack.com/database/vulnerability/nd-travel/wordpress-travel-management-plugin-2-0-multiple-authenticated-stored-cross-site-scripting-xss-vulnerabilities
CVE ID: CVE-2022-27860 State: PUBLISHED Published: 2022-04-28T15:32:13.984Z Last Updated: 2025-02-20T20:24:53.620Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Shea Bunge Products: Footer Text (WordPress plugin) Problem Types: CWE-352, CWE-79 Description: Cross-Site Request Forgery (CSRF) leading to Cross-Site Scripting (XSS) in Shea Bunge's Footer Text plugin <= 2.0.3 on WordPress. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/footer-text/ - https://patchstack.com/database/vulnerability/footer-text/wordpress-footer-text-plugin-2-0-3-cross-site-request-forgery-csrf-leading-to-cross-
/database/vulnerability/footer-text/wordpress-footer-text-plugin-2-0-3-cross-site-request-forgery-csrf-leading-to-cross-site-scripting-xss-vulnerability
CVE ID: CVE-2022-27861 State: PUBLISHED Published: 2023-08-10T09:19:45.367Z Last Updated: 2024-09-25T16:45:13.141Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N) Vendors: Arscode Products: Ninja Popups Problem Types: CWE-601 Description: Unauth. Open Redirect vulnerability in Arscode Ninja Popups plugin <= 4.7.5 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/arscode-ninja-popups/wordpress-ninja-popups-plugin-4-7-5-unauth-open-redirect-vulnerability?_s_id=cve
CVE ID: CVE-2022-27862 State: PUBLISHED Published: 2022-04-19T20:26:26.021Z Last Updated: 2025-02-20T20:26:06.326Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: E4J s.r.l. Products: VikBooking Hotel Booking Engine & PMS (WordPress plugin) Problem Types: CWE-434 Description: Arbitrary File Upload leading to RCE in E4J s.r.l. VikBooking Hotel Booking Engine & PMS plugin <= 1.5.3 on WordPress allows attackers to upload and execute dangerous file types (e.g. PHP shell) via the signature upload on the booking form. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/vikbooking/#developers - h
- CVE Program Container: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/vikbooking/#developers - https://patchstack.com/database/vulnerability/vikbooking/wordpress-vikbooking-hotel-booking-engine-pms-plugin-1-5-3-arbitrary-file-upload-leading-to-rce
CVE ID: CVE-2022-27863 State: PUBLISHED Published: 2022-04-19T20:26:26.940Z Last Updated: 2025-02-20T20:25:56.872Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: E4J s.r.l. Products: VikBooking Hotel Booking Engine & PMS (WordPress plugin) Problem Types: CWE-200 Description: Sensitive Information Exposure in E4J s.r.l. VikBooking Hotel Booking Engine & PMS plugin <= 1.5.3 on WordPress allows attackers to get the booking data by guessing / brute-forcing easy predictable booking IDs via search POST requests. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/vikbooking/#developers - https://
rogram Container: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/vikbooking/#developers - https://patchstack.com/database/vulnerability/vikbooking/wordpress-vikbooking-hotel-booking-engine-pms-plugin-1-5-3-sensitive-data-exposure-vulnerability
CVE ID: CVE-2022-27864 State: PUBLISHED Published: 2022-07-29T19:05:31 Last Updated: 2024-08-03T05:41:10.210Z Vendors: n/a Products: Autodesk Design Review Problem Types: Double Free vulnerability Description: A Double Free vulnerability allows remote attackers to execute arbitrary code through DesignReview.exe application on PDF files within affected installations. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. Additional Analyst Notes: - CVE Program Container: References: - https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0009
CVE ID: CVE-2022-27865 State: PUBLISHED Published: 2022-07-29T19:01:34 Last Updated: 2024-08-03T05:41:10.400Z Vendors: n/a Products: Autodesk Design Review Problem Types: Out-of-bound read vulnerability Description: A maliciously crafted TGA or PCX file may be used to write beyond the allocated buffer through DesignReview.exe application while parsing TGA and PCX files. This vulnerability may be exploited to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0009
CVE ID: CVE-2022-27866 State: PUBLISHED Published: 2022-07-29T19:01:44 Last Updated: 2024-08-03T05:41:10.188Z Vendors: n/a Products: Autodesk Design Review Problem Types: Out-of-bound write vulnerability Description: A maliciously crafted TIFF file when consumed through DesignReview.exe application can be forced to read beyond allocated boundaries when parsing the TIFF file. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process. Additional Analyst Notes: - CVE Program Container: References: - https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0009
CVE ID: CVE-2022-27867 State: PUBLISHED Published: 2022-06-21T14:23:34 Last Updated: 2024-08-03T05:41:10.191Z Vendors: n/a Products: Autodesk Inventor, Advanced Steel, Civil 3D, AutoCAD, AutoCAD LT, AutoCAD Architecture, AutoCAD Electrical, AutoCAD Map 3D, AutoCAD Mechanical, AutoCAD MEP, AutoCAD Plant 3D Problem Types: Use-after-free vulnerability Description: A maliciously crafted JT file in Autodesk AutoCAD 2022, 2021, 2020, 2019 can be used to trigger use-after-free vulnerability. Exploitation of this vulnerability may lead to code execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0002
CVE ID: CVE-2022-27868 State: PUBLISHED Published: 2022-06-21T14:23:35 Last Updated: 2024-08-03T05:41:10.982Z Vendors: n/a Products: Autodesk Advanced Steel, Civil 3D, AutoCAD, AutoCAD LT, AutoCAD Architecture, AutoCAD Electrical, AutoCAD Map 3D, AutoCAD Mechanical, AutoCAD MEP, AutoCAD Plant 3D Problem Types: Use-after-free vulnerability Description: A maliciously crafted CAT file in Autodesk AutoCAD 2023 can be used to trigger use-after-free vulnerability. Exploitation of this vulnerability may lead to code execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0005
CVE ID: CVE-2022-27869 State: PUBLISHED Published: 2022-06-21T14:23:32 Last Updated: 2024-08-03T05:41:10.319Z Vendors: n/a Products: Autodesk Advanced Steel, Civil 3D, AutoCAD, AutoCAD LT, AutoCAD Architecture, AutoCAD Electrical, AutoCAD Map 3D, AutoCAD Mechanical, AutoCAD MEP, AutoCAD Plant 3D Problem Types: Out-of-bound Read Vulnerability Description: A maliciously crafted TIFF file in Autodesk AutoCAD 2023 can be forced to read and write beyond allocated boundaries when parsing the TIFF file. This vulnerability can be exploited to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0004
CVE ID: CVE-2022-27870 State: PUBLISHED Published: 2022-06-21T14:23:36 Last Updated: 2024-08-03T05:41:10.383Z Vendors: n/a Products: Autodesk Advanced Steel, Civil 3D, AutoCAD, AutoCAD LT, AutoCAD Architecture, AutoCAD Electrical, AutoCAD Map 3D, AutoCAD Mechanical, AutoCAD MEP, AutoCAD Plant 3D Problem Types: Out-of-bound Write Vulnerability Description: A maliciously crafted TGA file in Autodesk AutoCAD 2023 may be used to write beyond the allocated buffer while parsing TGA file. This vulnerability may be exploited to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0004
CVE ID: CVE-2022-27871 State: PUBLISHED Published: 2022-06-21T14:23:33 Last Updated: 2024-08-03T05:41:10.620Z Vendors: n/a Products: Autodesk AutoCAD product suite, Revit, Design Review and Navisworks Problem Types: Heap-based Buffer Overflow vul Description: Autodesk AutoCAD product suite, Revit, Design Review and Navisworks releases using PDFTron prior to 9.1.17 version may be used to write beyond the allocated buffer while parsing PDF files. This vulnerability may be exploited to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0011
CVE ID: CVE-2022-27872 State: PUBLISHED Published: 2022-06-21T14:23:37 Last Updated: 2024-08-03T05:41:10.449Z Vendors: n/a Products: Navisworks Problem Types: Untrusted Pointer Dereference vuln Description: A maliciously crafted PDF file may be used to dereference a pointer for read or write operation while parsing PDF files in Autodesk Navisworks 2022. The vulnerability exists because the application fails to handle a crafted PDF file, which causes an unhandled exception. An attacker can leverage this vulnerability to cause a crash or read sensitive data or execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://www.autodesk.com/trust/security-adviso
ry code. Additional Analyst Notes: - CVE Program Container: References: - https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0011
CVE ID: CVE-2022-27873 State: PUBLISHED Published: 2022-07-29T15:17:03 Last Updated: 2024-08-03T05:41:10.218Z Vendors: n/a Products: Fusion360 Problem Types: XML External Entities (XXE) Description: An attacker can force the victim’s device to perform arbitrary HTTP requests in WAN through a malicious SVG file being parsed by Autodesk Fusion 360’s document parser. The vulnerability exists in the application’s ‘Insert SVG’ procedure. An attacker can also leverage this vulnerability to obtain victim’s public IP and possibly other sensitive information. Additional Analyst Notes: - CVE Program Container: References: - https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0013
CVE ID: CVE-2022-27874 State: PUBLISHED Published: 2022-11-11T15:48:45.296Z Last Updated: 2025-02-05T20:47:44.677Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:P/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) XMM(TM) 7560 Modem software Problem Types: escalation of privilege Description: Improper authentication in some Intel(R) XMM(TM) 7560 Modem software before version M2_7560_R_01.2146.00 may allow a privileged user to potentially enable escalation of privilege via physical access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00683.html
CVE ID: CVE-2022-27875 State: PUBLISHED Published: 2022-05-05T16:30:55.127803Z Last Updated: 2024-09-17T00:36:24.314Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: F5 Products: F5 Access for Android Problem Types: CWE-200 Description: On F5 Access for Android 3.x versions prior to 3.0.8, a Task Hijacking vulnerability exists in the F5 Access for Android application, which may allow an attacker to steal sensitive user information. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K40019131
CVE ID: CVE-2022-27876 State: REJECTED Published: N/A Last Updated: 2025-05-28T17:22:06.334Z Description: No description available.
CVE ID: CVE-2022-27877 State: REJECTED Published: N/A Last Updated: 2025-05-28T17:22:08.641Z Description: No description available.
CVE ID: CVE-2022-27878 State: PUBLISHED Published: 2022-05-05T16:31:45.750Z Last Updated: 2025-04-23T18:31:15.632Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H) Vendors: F5 Products: BIG-IP, BIG-IP Guided Configuration (GC) Problem Types: CWE-79 Description: On all versions of 16.1.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x of F5 BIG-IP, and F5 BIG-IP Guided Configuration (GC) all versions prior to 9.0, a stored cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to execute JavaScript in the context of the currently logged-in user. Note: Software versions which have reached End of Tec
execute JavaScript in the context of the currently logged-in user. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.f5.com/csp/article/K92807525
CVE ID: CVE-2022-27879 State: PUBLISHED Published: 2023-08-11T02:37:02.000Z Last Updated: 2025-02-13T16:32:33.039Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N) Vendors: n/a Products: Intel(R) Processors Problem Types: information disclosure, CWE-92 Description: Improper buffer restrictions in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable information disclosure via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00813.html - https://security.netapp.com/advisory/ntap-20230824-0001/
CVE ID: CVE-2022-27880 State: PUBLISHED Published: 2022-05-05T16:32:33.813504Z Last Updated: 2024-09-17T04:00:20.047Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: F5 Products: Traffix SDC Problem Types: CWE-79 Description: On F5 Traffix SDC 5.2.x versions prior to 5.2.2 and 5.1.x versions prior to 5.1.35, a stored Cross-Site Scripting (XSS) vulnerability exists in an undisclosed page of the Traffix SDC Configuration utility that allows an attacker to execute JavaScript in the context of the currently logged-in user. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated Additional Analyst Notes: - CVE Program Containe
ns which have reached End of Technical Support (EoTS) are not evaluated Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K17341495
CVE ID: CVE-2022-27881 State: PUBLISHED Published: 2022-03-25T17:13:08 Last Updated: 2024-08-03T05:41:10.307Z Vendors: n/a Products: n/a Problem Types: n/a Description: engine.c in slaacd in OpenBSD 6.9 and 7.0 before 2022-02-21 has a buffer overflow triggerable by an IPv6 router advertisement with more than seven nameservers. NOTE: privilege separation and pledge can prevent exploitation. Additional Analyst Notes: - CVE Program Container: References: - https://ftp.openbsd.org/pub/OpenBSD/patches/7.0/common/014_slaacd.patch.sig - https://blog.quarkslab.com/heap-overflow-in-openbsds-slaacd-via-router-advertisement.html - https://ftp.openbsd.org/pub/OpenBSD/patches/6.9/common/030_slaacd.patch.
openbsds-slaacd-via-router-advertisement.html - https://ftp.openbsd.org/pub/OpenBSD/patches/6.9/common/030_slaacd.patch.sig - https://security.netapp.com/advisory/ntap-20220506-0005/
CVE ID: CVE-2022-27882 State: PUBLISHED Published: 2022-03-25T17:13:23 Last Updated: 2024-08-03T05:41:10.754Z Vendors: n/a Products: n/a Problem Types: n/a Description: slaacd in OpenBSD 6.9 and 7.0 before 2022-03-22 has an integer signedness error and resultant heap-based buffer overflow triggerable by a crafted IPv6 router advertisement. NOTE: privilege separation and pledge can prevent exploitation. Additional Analyst Notes: - CVE Program Container: References: - https://blog.quarkslab.com/heap-overflow-in-openbsds-slaacd-via-router-advertisement.html - https://ftp.openbsd.org/pub/OpenBSD/patches/7.0/common/017_slaacd.patch.sig - https://ftp.openbsd.org/pub/OpenBSD/patches/6.9/common/033_
sd.org/pub/OpenBSD/patches/7.0/common/017_slaacd.patch.sig - https://ftp.openbsd.org/pub/OpenBSD/patches/6.9/common/033_slaacd.patch.sig - https://security.netapp.com/advisory/ntap-20220506-0005/
CVE ID: CVE-2022-27883 State: PUBLISHED Published: 2022-04-09T00:05:11 Last Updated: 2024-08-03T05:41:10.659Z Vendors: Trend Micro Products: Trend Micro Antivirus for Mac Problem Types: Link Following Privilege Escalation Description: A link following vulnerability in Trend Micro Antivirus for Mac 11.5 could allow an attacker to create a specially-crafted file as a symlink that can lead to privilege escalation. Please note that an attacker must at least have low-level privileges on the system to attempt to exploit this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://helpcenter.trendmicro.com/en-us/article/tmka-10978 - https://www.zerodayinitiative.com/
Container: References: - https://helpcenter.trendmicro.com/en-us/article/tmka-10978 - https://www.zerodayinitiative.com/advisories/ZDI-22-546/
CVE ID: CVE-2022-27884 State: PUBLISHED Published: 2022-03-25T18:50:13 Last Updated: 2024-08-03T05:41:11.006Z Vendors: n/a Products: n/a Problem Types: n/a Description: Maccms v10 was discovered to contain a reflected cross-site scripting (XSS) vulnerability in /admin.php/admin/plog/index.html via the wd parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/magicblack/maccms10/issues/840
CVE ID: CVE-2022-27885 State: PUBLISHED Published: 2022-03-25T18:50:13 Last Updated: 2024-08-03T05:41:11.044Z Vendors: n/a Products: n/a Problem Types: n/a Description: Maccms v10 was discovered to contain multiple reflected cross-site scripting (XSS) vulnerabilities in /admin.php/admin/website/data.html via the select and input parameters. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/magicblack/maccms10/issues/840
CVE ID: CVE-2022-27886 State: PUBLISHED Published: 2022-03-25T18:50:14 Last Updated: 2024-08-03T05:41:11.007Z Vendors: n/a Products: n/a Problem Types: n/a Description: Maccms v10 was discovered to contain a reflected cross-site scripting (XSS) vulnerability in /admin.php/admin/ulog/index.html via the wd parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/magicblack/maccms10/issues/840
CVE ID: CVE-2022-27887 State: PUBLISHED Published: 2022-03-25T18:50:14 Last Updated: 2024-08-03T05:41:10.840Z Vendors: n/a Products: n/a Problem Types: n/a Description: Maccms v10 was discovered to contain a reflected cross-site scripting (XSS) vulnerability in /admin.php/admin/vod/data.html via the repeat parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/magicblack/maccms10/issues/840
CVE ID: CVE-2022-27888 State: PUBLISHED Published: 2022-04-26T22:35:08.294239Z Last Updated: 2024-09-17T02:27:08.492Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Palantir Products: Foundry Issues Problem Types: CWE-532 Description: Foundry Issues service versions 2.244.0 to 2.249.0 was found to be logging in a manner that captured sensitive information (session tokens). This issue was fixed in 2.249.1. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/palantir/security-bulletins/blob/main/PLTRSEC-2022-01.md
CVE ID: CVE-2022-27889 State: PUBLISHED Published: 2022-06-14T13:45:14.836459Z Last Updated: 2024-09-16T20:12:11.222Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Palantir Products: Foundry Multipass Problem Types: CWE-400 Description: The Multipass service was found to have code paths that could be abused to cause a denial of service for authentication or authorization operations. A malicious attacker could perform an application-level denial of service attack, potentially causing authentication and/or authorization operations to fail for the duration of the attack. This could lead to performance degradation or login failures for customer Palantir Foundr
or the duration of the attack. This could lead to performance degradation or login failures for customer Palantir Foundry environments. This vulnerability is resolved in Multipass 3.647.0. This issue affects: Palantir Foundry Multipass versions prior to 3.647.0. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/palantir/security-bulletins/blob/main/PLTRSEC-2022-02.md
CVE ID: CVE-2022-27890 State: PUBLISHED Published: 2023-02-16T00:00:00.000Z Last Updated: 2025-03-18T15:09:08.136Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N) Vendors: Palantir Products: AtlasDB Problem Types: CWE-297 Description: It was discovered that the sls-logging was not verifying hostnames in TLS certificates due to a misuse of the javax.net.ssl.SSLSocketFactory API. A malicious attacker in a privileged network position could abuse this to perform a man-in-the-middle attack. A successful man-in-the-middle attack would allow them to intercept, read, or modify network communications to and from the affected service. In the case of AtlasDB, the vulnerability