Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-36107 State: PUBLISHED Published: 2022-09-13T17:30:13.000Z Last Updated: 2025-04-23T17:11:32.639Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: TYPO3 Products: typo3 Problem Types: CWE-79 Description: TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that the `FileDumpController` (backend and frontend context) is vulnerable to cross-site scripting when malicious files are displayed using this component. A valid backend user account is needed to exploit this vulnerability. Update to TYPO3 version 7.6.58 ELTS, 8.7.48 ELTS, 9.5.37 ELTS, 10.4.32 or 11.5.16 that fix the problem. T
vulnerability. Update to TYPO3 version 7.6.58 ELTS, 8.7.48 ELTS, 9.5.37 ELTS, 10.4.32 or 11.5.16 that fix the problem. There are no known workarounds for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/TYPO3/typo3/security/advisories/GHSA-9c6w-55cp-5w25 - https://github.com/TYPO3/typo3/commit/bd58d2ff2eeef89e63ef754a2389597d22622a39 - https://typo3.org/security/advisory/typo3-core-sa-2022-009
CVE ID: CVE-2022-36108 State: PUBLISHED Published: 2022-09-13T17:20:13.000Z Last Updated: 2025-04-23T17:11:44.189Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: TYPO3 Products: typo3 Problem Types: CWE-79 Description: TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that the `f:asset.css` view helper is vulnerable to cross-site scripting when user input is passed as variables to the CSS. Update to TYPO3 version 10.4.32 or 11.5.16 that fix the problem. There are no known workarounds for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https
karounds for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/TYPO3/typo3/security/advisories/GHSA-fv2m-9249-qx85 - https://github.com/TYPO3/typo3/commit/6863f73818c36b0b88c677ba533765c8074907b4 - https://typo3.org/security/advisory/typo3-core-sa-2022-010
CVE ID: CVE-2022-36109 State: PUBLISHED Published: 2022-09-09T17:20:11.000Z Last Updated: 2025-04-23T17:12:31.122Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: moby Products: moby Problem Types: CWE-863 Description: Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker Engine) where supplementary groups are not set up properly. If an attacker has direct access to a container and manipulates their supplementary group access, they may be able to use supplementary group access to bypass primary group restrictions in some cases, potentially gaining access to sensitive information or gaining the a
to bypass primary group restrictions in some cases, potentially gaining access to sensitive information or gaining the ability to execute code in that container. This bug is fixed in Moby (Docker Engine) 20.10.18. Running containers should be stopped and restarted for the permissions to be fixed. For users unable to upgrade, this problem can be worked around by not using the `"USER $USERNAME"` Dockerfile instruction. Instead by calling `ENTRYPOINT ["su", "-", "user"]` the supplementary groups will be set up properly. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/moby/moby/security/advisories/GHSA-rc4r-wh2q-q6c4 - https://github.c
ADP Vulnrichment: References: - https://github.com/moby/moby/security/advisories/GHSA-rc4r-wh2q-q6c4 - https://github.com/moby/moby/commit/de7af816e76a7fd3fbf06bffa6832959289fba32 - https://github.com/moby/moby/releases/tag/v20.10.18 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O7JL2QA3RB732MLJ3RMUXB3IB7AA22YU - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RQQ4E3JBXVR3VK5FIZVJ3QS2TAOOXXTQ - https://www.benthamsgaze.org/2022/08/22/vulnerability-in-linux-containers-investigation-and-mitigation
CVE ID: CVE-2022-36110 State: PUBLISHED Published: 2022-09-09T19:15:12.000Z Last Updated: 2025-04-23T17:12:19.594Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: gravitl Products: netmaker Problem Types: CWE-1220, CWE-285 Description: Netmaker makes networks with WireGuard. Prior to version 0.15.1, Improper Authorization functions lead to non-privileged users running privileged API calls. If someone adds users to the Netmaker platform who do not have admin privileges, they can use their auth tokens to run admin-level functions via the API. This problem has been patched in v0.15.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Ref
his problem has been patched in v0.15.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/gravitl/netmaker/security/advisories/GHSA-ggf6-638m-vqmg - https://github.com/gravitl/netmaker/releases/tag/v0.15.1
CVE ID: CVE-2022-36111 State: PUBLISHED Published: 2022-11-23T00:00:00.000Z Last Updated: 2025-04-22T16:02:01.177Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:N/I:H/A:N) Vendors: codenotary Products: immudb Problem Types: CWE-345 Description: immudb is a database with built-in cryptographic proof and verification. In versions prior to 1.4.1, a malicious immudb server can provide a falsified proof that will be accepted by the client SDK signing a falsified transaction replacing the genuine one. This situation can not be triggered by a genuine immudb server and requires the client to perform a specific list of verified operations resulting in acceptance of an invalid state va
and requires the client to perform a specific list of verified operations resulting in acceptance of an invalid state value. This vulnerability only affects immudb client SDKs, the immudb server itself is not affected by this vulnerability. This issue has been patched in version 1.4.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/codenotary/immudb/releases/tag/v1.4.1 - https://github.com/codenotary/immudb/security/advisories/GHSA-672p-m5jq-mrh8 - https://github.com/codenotary/immudb/tree/master/docs/security/vulnerabilities/linear-fake - https://pkg.go.dev/github.com/codenotary/immudb/pkg/client
CVE ID: CVE-2022-36112 State: PUBLISHED Published: 2022-09-14T17:45:18.000Z Last Updated: 2025-04-23T17:10:34.106Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N) Vendors: glpi-project Products: glpi Problem Types: CWE-918 Description: GLPI stands for Gestionnaire Libre de Parc Informatique and is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. Usage of RSS feeds or extenal calendar in planning is subject to SSRF exploit. Server-side requests can be used to scan server port or services opened on GLPI server or its private network. Queries responses are not exposed to end-user (blind SSRF
port or services opened on GLPI server or its private network. Queries responses are not exposed to end-user (blind SSRF). Users are advised to upgrade to version 10.0.3 to resolve this issue. There are no known workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/glpi-project/glpi/security/advisories/GHSA-rqgx-gqhp-x8vv - https://github.com/glpi-project/glpi/commit/ad66d69049ae02bead8ed0f4ee654a458643244e
CVE ID: CVE-2022-36113 State: PUBLISHED Published: 2022-09-14T00:00:00.000Z Last Updated: 2025-04-23T17:10:57.339Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L) Vendors: rust-lang Products: cargo Problem Types: CWE-22 Description: Cargo is a package manager for the rust programming language. After a package is downloaded, Cargo extracts its source code in the ~/.cargo folder on disk, making it available to the Rust projects it builds. To record when an extraction is successful, Cargo writes "ok" to the .cargo-ok file at the root of the extracted source code once it extracted all the files. It was discovered that Cargo allowed packages to contain a .cargo-ok symboli
ource code once it extracted all the files. It was discovered that Cargo allowed packages to contain a .cargo-ok symbolic link, which Cargo would extract. Then, when Cargo attempted to write "ok" into .cargo-ok, it would actually replace the first two bytes of the file the symlink pointed to with ok. This would allow an attacker to corrupt one file on the machine using Cargo to extract the package. Note that by design Cargo allows code execution at build time, due to build scripts and procedural macros. The vulnerabilities in this advisory allow performing a subset of the possible damage in a harder to track down way. Your dependencies must still be trusted if you want to be protected from a
ossible damage in a harder to track down way. Your dependencies must still be trusted if you want to be protected from attacks, as it's possible to perform the same attacks with build scripts and procedural macros. The vulnerability is present in all versions of Cargo. Rust 1.64, to be released on September 22nd, will include a fix for it. Since the vulnerability is just a more limited way to accomplish what a malicious build scripts or procedural macros can do, we decided not to publish Rust point releases backporting the security fix. Patch files are available for Rust 1.63.0 are available in the wg-security-response repository for people building their own toolchain. Mitigations We recomm
63.0 are available in the wg-security-response repository for people building their own toolchain. Mitigations We recommend users of alternate registries to exercise care in which package they download, by only including trusted dependencies in their projects. Please note that even with these vulnerabilities fixed, by design Cargo allows arbitrary code execution at build time thanks to build scripts and procedural macros: a malicious dependency will be able to cause damage regardless of these vulnerabilities. crates.io implemented server-side checks to reject these kinds of packages years ago, and there are no packages on crates.io exploiting these vulnerabilities. crates.io users still need
packages years ago, and there are no packages on crates.io exploiting these vulnerabilities. crates.io users still need to exercise care in choosing their dependencies though, as remote code execution is allowed by design there as well. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/rust-lang/cargo/security/advisories/GHSA-rfj2-q3h3-hm5j - https://github.com/rust-lang/cargo/commit/97b80919e404b0768ea31ae329c3b4da54bed05a
CVE ID: CVE-2022-36114 State: PUBLISHED Published: 2022-09-14T00:00:00.000Z Last Updated: 2025-04-23T17:10:50.866Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H) Vendors: rust-lang Products: cargo Problem Types: CWE-400 Description: Cargo is a package manager for the rust programming language. It was discovered that Cargo did not limit the amount of data extracted from compressed archives. An attacker could upload to an alternate registry a specially crafted package that extracts way more data than its size (also known as a "zip bomb"), exhausting the disk space on the machine using Cargo to download the package. Note that by design Cargo allows code execution at bu
the disk space on the machine using Cargo to download the package. Note that by design Cargo allows code execution at build time, due to build scripts and procedural macros. The vulnerabilities in this advisory allow performing a subset of the possible damage in a harder to track down way. Your dependencies must still be trusted if you want to be protected from attacks, as it's possible to perform the same attacks with build scripts and procedural macros. The vulnerability is present in all versions of Cargo. Rust 1.64, to be released on September 22nd, will include a fix for it. Since the vulnerability is just a more limited way to accomplish what a malicious build scripts or procedural mac
or it. Since the vulnerability is just a more limited way to accomplish what a malicious build scripts or procedural macros can do, we decided not to publish Rust point releases backporting the security fix. Patch files are available for Rust 1.63.0 are available in the wg-security-response repository for people building their own toolchain. We recommend users of alternate registries to excercise care in which package they download, by only including trusted dependencies in their projects. Please note that even with these vulnerabilities fixed, by design Cargo allows arbitrary code execution at build time thanks to build scripts and procedural macros: a malicious dependency will be able to c
ary code execution at build time thanks to build scripts and procedural macros: a malicious dependency will be able to cause damage regardless of these vulnerabilities. crates.io implemented server-side checks to reject these kinds of packages years ago, and there are no packages on crates.io exploiting these vulnerabilities. crates.io users still need to excercise care in choosing their dependencies though, as the same concerns about build scripts and procedural macros apply here. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/rust-lang/cargo/security/advisories/GHSA-2hvr-h6gw-qrxp - https://github.com/rust-lang/cargo/commit/d1f9
ps://github.com/rust-lang/cargo/security/advisories/GHSA-2hvr-h6gw-qrxp - https://github.com/rust-lang/cargo/commit/d1f9553c825f6d7481453be8d58d0e7f117988a7
CVE ID: CVE-2022-36115 State: PUBLISHED Published: 2022-08-25T22:54:40 Last Updated: 2024-08-03T09:52:00.529Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Blue Prism Enterprise 6.0 through 7.01. In a misconfigured environment that exposes the Blue Prism Application server, it is possible for an authenticated user to reverse engineer the Blue Prism software and circumvent access controls for unintended functionality. An attacker can abuse the CreateProcessAutosave() method to inject their own functionality into a development process. If (upon a warning) a user decides to recover unsaved work by using the last saved version, the malicious code could ent
If (upon a warning) a user decides to recover unsaved work by using the last saved version, the malicious code could enter the workflow. Should the process action stages not be fully reviewed before publishing, this could result in the malicious code being run in a production environment. Additional Analyst Notes: - CVE Program Container: References: - https://blueprism.com - https://portal.blueprism.com/security-vulnerabilities-august-2022 - https://community.blueprism.com/discussion/security-vulnerability-notification-ssc-blue-prism-enterprise
CVE ID: CVE-2022-36116 State: PUBLISHED Published: 2022-08-25T22:56:14 Last Updated: 2024-08-03T09:52:00.512Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Blue Prism Enterprise 6.0 through 7.01. In a misconfigured environment that exposes the Blue Prism Application server, it is possible for an authenticated user to reverse engineer the Blue Prism software and circumvent access controls for the setValidationInfo administrative function. Removing the validation applied to newly designed processes increases the chance of successfully hiding malicious code that could be executed in a production environment. Additional Analyst Notes: - CVE Program Contain
iding malicious code that could be executed in a production environment. Additional Analyst Notes: - CVE Program Container: References: - https://blueprism.com - https://portal.blueprism.com/security-vulnerabilities-august-2022 - https://community.blueprism.com/discussion/security-vulnerability-notification-ssc-blue-prism-enterprise
CVE ID: CVE-2022-36117 State: PUBLISHED Published: 2022-08-25T22:57:41 Last Updated: 2024-08-03T09:52:00.541Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Blue Prism Enterprise 6.0 through 7.01. In a misconfigured environment that exposes the Blue Prism Application server, it is possible for an authenticated user to reverse engineer the Blue Prism software and circumvent access controls for an administrative function. If credential access is configured to be accessible by a machine or the runtime resource security group, using further reverse engineering, an attacker can spoof a known machine and request known encrypted credentials to decrypt later. A
r reverse engineering, an attacker can spoof a known machine and request known encrypted credentials to decrypt later. Additional Analyst Notes: - CVE Program Container: References: - https://blueprism.com - https://portal.blueprism.com/security-vulnerabilities-august-2022 - https://community.blueprism.com/discussion/security-vulnerability-notification-ssc-blue-prism-enterprise
CVE ID: CVE-2022-36118 State: PUBLISHED Published: 2022-08-25T22:58:58 Last Updated: 2024-08-03T09:52:00.525Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Blue Prism Enterprise 6.0 through 7.01. In a misconfigured environment that exposes the Blue Prism Application server, it is possible for an authenticated user to reverse engineer the Blue Prism software and circumvent access controls for the SetProcessAttributes administrative function. Abusing this function will allow any Blue Prism user to publish, unpublish, or retire processes. Using this function, any logged-in user can change the status of a process, an action allowed only intended for users
. Using this function, any logged-in user can change the status of a process, an action allowed only intended for users with the Edit Process permission. Additional Analyst Notes: - CVE Program Container: References: - https://blueprism.com - https://portal.blueprism.com/security-vulnerabilities-august-2022 - https://community.blueprism.com/discussion/security-vulnerability-notification-ssc-blue-prism-enterprise
CVE ID: CVE-2022-36119 State: PUBLISHED Published: 2022-08-25T23:00:13 Last Updated: 2024-08-03T09:52:00.576Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Blue Prism Enterprise 6.0 through 7.01. In a misconfigured environment that exposes the Blue Prism Application server, it is possible for a domain authenticated user to send a crafted message to the Blue Prism Server and accomplish a remote code execution attack that is possible because of insecure deserialization. Exploitation of this vulnerability allows for code to be executed in the context of the Blue Prism Server service. Additional Analyst Notes: - CVE Program Container: References: - https:/
n the context of the Blue Prism Server service. Additional Analyst Notes: - CVE Program Container: References: - https://blueprism.com - https://portal.blueprism.com/security-vulnerabilities-august-2022 - https://community.blueprism.com/discussion/security-vulnerability-notification-ssc-blue-prism-enterprise
CVE ID: CVE-2022-36120 State: PUBLISHED Published: 2022-08-25T23:01:22 Last Updated: 2024-08-03T10:00:01.367Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Blue Prism Enterprise 6.0 through 7.01. In a misconfigured environment that exposes the Blue Prism Application server, it is possible for an authenticated user to reverse engineer the Blue Prism software and circumvent access controls for the getChartData administrative function. Using a low/no privilege Blue Prism user account, the attacker can alter the server's settings by abusing the getChartData method, allowing the Blue Prism server to execute any MSSQL stored procedure by name. Additional Ana
ng the getChartData method, allowing the Blue Prism server to execute any MSSQL stored procedure by name. Additional Analyst Notes: - CVE Program Container: References: - https://blueprism.com - https://portal.blueprism.com/security-vulnerabilities-august-2022 - https://community.blueprism.com/discussion/security-vulnerability-notification-ssc-blue-prism-enterprise
CVE ID: CVE-2022-36121 State: PUBLISHED Published: 2022-08-25T23:02:37 Last Updated: 2024-08-03T10:00:01.351Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Blue Prism Enterprise 6.0 through 7.01. In a misconfigured environment that exposes the Blue Prism Application server, it is possible for an authenticated user to reverse engineer the Blue Prism software and circumvent access controls for the UpdateOfflineHelpData administrative function. Abusing this function will allow any Blue Prism user to change the offline help URL to one of their choice, opening the possibility of spoofing the help page or executing a local file. Additional Analyst Notes: - C
their choice, opening the possibility of spoofing the help page or executing a local file. Additional Analyst Notes: - CVE Program Container: References: - https://blueprism.com - https://portal.blueprism.com/security-vulnerabilities-august-2022 - https://community.blueprism.com/discussion/security-vulnerability-notification-ssc-blue-prism-enterprise
CVE ID: CVE-2022-36122 State: PUBLISHED Published: 2022-10-21T00:00:00.000Z Last Updated: 2025-05-08T15:12:15.092Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Automox Agent before 40 on Windows incorrectly sets permissions on key files. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://automox.com - https://www.automox.com/security/security-bulletin
CVE ID: CVE-2022-36123 State: PUBLISHED Published: 2022-07-29T13:43:38 Last Updated: 2024-08-03T10:00:04.244Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Linux kernel before 5.18.13 lacks a certain clear operation for the block starting symbol (.bss). This allows Xen PV guest OS users to cause a denial of service or gain privileges. Additional Analyst Notes: - CVE Program Container: References: - https://sick.codes/sick-2022-128 - https://github.com/sickcodes/security/blob/master/advisories/SICK-2022-128.md - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.18.13 - https://github.com/torvalds/linux/commit/96e8fc5818686d4a1591bb6907e7fdb64ef29884 - https://github.co
hangeLog-5.18.13 - https://github.com/torvalds/linux/commit/96e8fc5818686d4a1591bb6907e7fdb64ef29884 - https://github.com/torvalds/linux/commit/74a0032b8524ee2bd4443128c0bf9775928680b0 - https://security.netapp.com/advisory/ntap-20220901-0003/
CVE ID: CVE-2022-36124 State: PUBLISHED Published: 2022-08-09T06:50:32 Last Updated: 2024-08-03T10:00:01.548Z Vendors: Apache Software Foundation Products: Apache Avro Problem Types: CWE-770 Description: It is possible for a Reader to consume memory beyond the allowed constraints and thus lead to out of memory on the system. This issue affects Rust applications using Apache Avro Rust SDK prior to 0.14.0 (previously known as avro-rs). Users should update to apache-avro version 0.14.0 which addresses this issue. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread/kj429rzo1xxjgz058qqqg0y7c0p512zo
CVE ID: CVE-2022-36125 State: PUBLISHED Published: 2022-08-09T06:50:40 Last Updated: 2024-08-03T10:00:04.252Z Vendors: Apache Software Foundation Products: Apache Avro Problem Types: CWE-20 Description: It is possible to crash (panic) an application by providing a corrupted data to be read. This issue affects Rust applications using Apache Avro Rust SDK prior to 0.14.0 (previously known as avro-rs). Users should update to apache-avro version 0.14.0 which addresses this issue. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread/t1r5xz0pvhm4tosqopjpj6dz8zlsht07