deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-20820
Published: 2022-08-10
Description: Multiple vulnerabilities in the web interface of Cisco Webex Meetings could allow a remote attacker to conduct a cross-site scripting (XSS) attack or a frame hijacking attack against a user of the web interface. For more information about these vulnerabilities, see the Details section of this advisory.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-1021, CWE-79
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-xss-frmhijck-kO3wmkuS; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-xss-frmhijck-kO3wmkuS
CVE: CVE-2022-20827
Published: 2022-08-10
Description: Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an unauthenticated, remote attacker to execute arbitrary code or cause a denial of service (DoS) condition on an affected device. For more information about these vulnerabilities, see the Details section of this advisory.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-120, CWE-78
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sb-mult-vuln-CbVp4SUR; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sb-mult-vuln-CbVp4SUR
CVE: CVE-2022-20842
Published: 2022-08-10
Description: Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an unauthenticated, remote attacker to execute arbitrary code or cause a denial of service (DoS) condition on an affected device. For more information about these vulnerabilities, see the Details section of this advisory.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-120, CWE-20
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sb-mult-vuln-CbVp4SUR; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sb-mult-vuln-CbVp4SUR
CVE: CVE-2022-20852
Published: 2022-08-10
Description: Multiple vulnerabilities in the web interface of Cisco Webex Meetings could allow a remote attacker to conduct a cross-site scripting (XSS) attack or a frame hijacking attack against a user of the web interface. For more information about these vulnerabilities, see the Details section of this advisory.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-1021, CWE-1021
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-xss-frmhijck-kO3wmkuS; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-xss-frmhijck-kO3wmkuS
CVE: CVE-2022-20869
Published: 2022-08-10
Description: A vulnerability in the web-based management interface of Cisco BroadWorks Application Delivery Platform Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting attack against a user of the interface. This vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive browser-based information.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-broadworks-xss-xbhfr4cD; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-broadworks-xss-xbhfr4cD
CVE: CVE-2022-20914
Published: 2022-08-10
Description: A vulnerability in the External RESTful Services (ERS) API of Cisco Identity Services Engine (ISE) Software could allow an authenticated, remote attacker to obtain sensitive information. This vulnerability is due to excessive verbosity in a specific REST API output. An attacker could exploit this vulnerability by sending a crafted HTTP request to the affected device. A successful exploit could allow the attacker to obtain sensitive information, including administrative credentials for an external authentication server. Note: To successfully exploit this vulnerability, the attacker must have valid ERS administrative credentials.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-549, CWE-522
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-pwd-WH64AhQF; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-pwd-WH64AhQF
CVE: CVE-2022-2242
Published: 2022-08-10
Description: The KUKA SystemSoftware V/KSS in versions prior to 8.6.5 is prone to improper access control as an unauthorized attacker can directly read and write robot configurations when access control is not available or not enabled (default).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://www.kuka.com/advisories-CVE-2022-2242; https://www.kuka.com/advisories-CVE-2022-2242
CVE: CVE-2021-46304
Published: 2022-08-10
Description: A vulnerability has been identified in CP-8000 MASTER MODULE WITH I/O -25/+70°C (All versions), CP-8000 MASTER MODULE WITH I/O -40/+70°C (All versions), CP-8021 MASTER MODULE (All versions), CP-8022 MASTER MODULE WITH GPRS (All versions). The component allows to activate a web server module which provides unauthenticated access to its web pages. This could allow an attacker to retrieve debug-level information from the component such as internal network topology or connected systems.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://cert-portal.siemens.com/productcert/pdf/ssa-185638.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-185638.pdf
CVE: CVE-2022-34659
Published: 2022-08-10
Description: A vulnerability has been identified in Simcenter STAR-CCM+ (All versions only if the Power-on-Demand public license server is used). Affected applications expose user, host and display name of users, when the public license server is used. This could allow an attacker to retrieve this information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://cert-portal.siemens.com/productcert/pdf/ssa-555707.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-555707.pdf
CVE: CVE-2022-34660
Published: 2022-08-10
Description: A vulnerability has been identified in Teamcenter V12.4 (All versions < V12.4.0.15), Teamcenter V13.0 (All versions < V13.0.0.10), Teamcenter V13.1 (All versions < V13.1.0.10), Teamcenter V13.2 (All versions < V13.2.0.9), Teamcenter V13.3 (All versions < V13.3.0.5), Teamcenter V14.0 (All versions < V14.0.0.2). File Server Cache service in Teamcenter consist of a functionality that is vulnerable to command injection. This could potentially allow an attacker to perform remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://cert-portal.siemens.com/productcert/pdf/ssa-759952.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-759952.pdf
CVE: CVE-2022-34661
Published: 2022-08-10
Description: A vulnerability has been identified in Teamcenter V12.4 (All versions < V12.4.0.15), Teamcenter V13.0 (All versions < V13.0.0.10), Teamcenter V13.1 (All versions < V13.1.0.10), Teamcenter V13.2 (All versions < V13.2.0.9), Teamcenter V13.3 (All versions < V13.3.0.5), Teamcenter V14.0 (All versions < V14.0.0.2). File Server Cache service in Teamcenter is vulnerable to denial of service by entering infinite loops and using up CPU cycles. This could allow an attacker to cause denial of service condition.
CVSS Score: 7.5 (HIGH)
CWE: CWE-835
References: https://cert-portal.siemens.com/productcert/pdf/ssa-759952.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-759952.pdf
CVE: CVE-2022-36323
Published: 2022-08-10
Description: Affected devices do not properly sanitize an input field.  This could allow an authenticated remote attacker with administrative privileges to inject code or spawn a system root shell.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-74
References: https://cert-portal.siemens.com/productcert/html/ssa-019200.html; https://cert-portal.siemens.com/productcert/html/ssa-710008.html; https://cert-portal.siemens.com/productcert/pdf/ssa-710008.pdf
CVE: CVE-2022-36324
Published: 2022-08-10
Description: Affected devices do not properly handle the renegotiation of SSL/TLS parameters. This could allow an unauthenticated remote attacker to bypass the TCP brute force prevention and lead to a denial of service condition for the duration of the attack.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770, CWE-770
References: https://cert-portal.siemens.com/productcert/html/ssa-019200.html; https://cert-portal.siemens.com/productcert/html/ssa-710008.html; https://cert-portal.siemens.com/productcert/pdf/ssa-710008.pdf
CVE: CVE-2022-36325
Published: 2022-08-10
Description: Affected devices do not properly sanitize data introduced by an user when rendering the web interface. This could allow an authenticated remote attacker with administrative privileges to inject code and lead to a DOM-based XSS.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-80
References: https://cert-portal.siemens.com/productcert/html/ssa-019200.html; https://cert-portal.siemens.com/productcert/html/ssa-710008.html; https://cert-portal.siemens.com/productcert/pdf/ssa-710008.pdf
CVE: CVE-2022-0028
Published: 2022-08-10
Description: A PAN-OS URL filtering policy misconfiguration could allow a network-based attacker to conduct reflected and amplified TCP denial-of-service (RDoS) attacks. The DoS attack would appear to originate from a Palo Alto Networks PA-Series (hardware), VM-Series (virtual) and CN-Series (container) firewall against an attacker-specified target. To be misused by an external attacker, the firewall configuration must have a URL filtering profile with one or more blocked categories assigned to a source zone that has an external facing interface. This configuration is not typical for URL filtering and, if set, is likely unintended by the administrator. If exploited, this issue would not impact the confidentiality, integrity, or availability of our products. However, the resulting denial-of-service (DoS) attack may help obfuscate the identity of the attacker and implicate the firewall as the source of the attack. We have taken prompt action to address this issue in our PAN-OS software. All software updates for this issue are expected to be released no later than the week of August 15, 2022. This issue does not impact Panorama M-Series or Panorama virtual appliances. This issue has been resolved for all Cloud NGFW and Prisma Access customers and no additional action is required from them.
CVSS Score: 8.6 (HIGH)
CWE: CWE-406
References: https://security.paloaltonetworks.com/CVE-2022-0028; https://security.paloaltonetworks.com/CVE-2022-0028; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-0028
CVE: CVE-2022-2756
Published: 2022-08-10
Description: Server-Side Request Forgery (SSRF) in GitHub repository kareadita/kavita prior to 0.5.4.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-918
References: https://github.com/kareadita/kavita/commit/9c31f7e7c81b919923cb2e3857439ec0d16243e4; https://huntr.dev/bounties/95e7c181-9d80-4428-aebf-687ac55a9216; https://github.com/kareadita/kavita/commit/9c31f7e7c81b919923cb2e3857439ec0d16243e4
CVE: CVE-2022-38133
Published: 2022-08-10
Description: In JetBrains TeamCity before 2022.04.3 the private SSH key could be written to the server log in some cases
CVSS Score: 3.2 (LOW)
CWE: CWE-532, CWE-532
References: https://www.jetbrains.com/privacy-security/issues-fixed/; https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2022-20713
Published: 2022-08-10
Description: A vulnerability in the VPN web client services component of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct browser-based attacks against users of an affected device. This vulnerability is due to improper validation of input that is passed to the VPN web client services component before being returned to the browser that is in use. An attacker could exploit this vulnerability by persuading a user to visit a website that is designed to pass malicious requests to a device that is running Cisco ASA Software or Cisco FTD Software and has web services endpoints supporting VPN features enabled. A successful exploit could allow the attacker to reflect malicious input from the affected device to the browser that is in use and conduct browser-based attacks, including cross-site scripting attacks. The attacker could not directly impact the affected device.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-444, CWE-79
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asa-webvpn-LOeKsNmO; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asa-webvpn-LOeKsNmO
CVE: CVE-2022-20866
Published: 2022-08-10
Description: A vulnerability in the handling of RSA keys on devices running Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to retrieve an RSA private key. This vulnerability is due to a logic error when the RSA key is stored in memory on a hardware platform that performs hardware-based cryptography. An attacker could exploit this vulnerability by using a Lenstra side-channel attack against the targeted device. A successful exploit could allow the attacker to retrieve the RSA private key. The following conditions may be observed on an affected device: This vulnerability will apply to approximately 5 percent of the RSA keys on a device that is running a vulnerable release of Cisco ASA Software or Cisco FTD Software; not all RSA keys are expected to be affected due to mathematical calculations applied to the RSA key. The RSA key could be valid but have specific characteristics that make it vulnerable to the potential leak of the RSA private key. If an attacker obtains the RSA private key, they could use the key to impersonate a device that is running Cisco ASA Software or Cisco FTD Software or to decrypt the device traffic. See the Indicators of Compromise section for more information on the detection of this type of RSA key. The RSA key could be malformed and invalid. A malformed RSA key is not functional, and a TLS client connection to a device that is running Cisco ASA Software or Cisco FTD Software that uses the malformed RSA key will result in a TLS signature failure, which means a vulnerable software release created an invalid RSA signature that failed verification. If an attacker obtains the RSA private key, they could use the key to impersonate a device that is running Cisco ASA Software or Cisco FTD Software or to decrypt the device traffic.
CVSS Score: 7.4 (HIGH)
CWE: CWE-203, CWE-203
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-rsa-key-leak-Ms7UEfZz; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-rsa-key-leak-Ms7UEfZz
CVE: CVE-2022-22369
Published: 2022-08-10
Description: IBM Workload Scheduler 9.4 and 9.5 could allow a local user to overwrite key system files which would cause the system to crash. IBM X-Force ID: 221187.
CVSS Score: 7.1 (HIGH)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/221187; https://www.ibm.com/support/pages/node/6610903; https://exchange.xforce.ibmcloud.com/vulnerabilities/221187
CVE: CVE-2022-22411
Published: 2022-08-10
Description: IBM Spectrum Scale Data Access Services (DAS) 5.1.3.1 could allow an authenticated user to insert code which could allow the attacker to manipulate cluster resources due to excessive permissions. IBM X-Force ID: 223016.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-732
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/223016; https://www.ibm.com/support/pages/node/6610277; https://exchange.xforce.ibmcloud.com/vulnerabilities/223016
CVE: CVE-2022-22490
Published: 2022-08-10
Description: IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 could allow a privileged user to obtain sensitive Azure bot credential information. IBM X-Force ID: 226342.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-552
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/226342; https://www.ibm.com/support/pages/node/6610397; https://exchange.xforce.ibmcloud.com/vulnerabilities/226342
CVE: CVE-2022-29090
Published: 2022-08-10
Description: Dell Wyse Management Suite 3.6.1 and below contains a Sensitive Data Exposure vulnerability. A low privileged malicious user could potentially exploit this vulnerability in order to obtain credentials. The attacker may be able to use the exposed credentials to access the target device and perform unauthorized actions.
CVSS Score: 8.5 (HIGH)
CWE: CWE-317, CWE-312
References: https://www.dell.com/support/kbdoc/en-us/000201383/dsa-2022-134-dell-wyse-management-suite-security-update-for-multiple-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000201383/dsa-2022-134-dell-wyse-management-suite-security-update-for-multiple-vulnerabilities
CVE: CVE-2022-33924
Published: 2022-08-10
Description: Dell Wyse Management Suite 3.6.1 and below contains an Improper Access control vulnerability with which an attacker with no access to create rules could potentially exploit this vulnerability and create rules.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284
References: https://www.dell.com/support/kbdoc/en-us/000201383/dsa-2022-134-dell-wyse-management-suite-security-update-for-multiple-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000201383/dsa-2022-134-dell-wyse-management-suite-security-update-for-multiple-vulnerabilities
CVE: CVE-2022-33925
Published: 2022-08-10
Description: Dell Wyse Management Suite 3.6.1 and below contains an Improper Access control vulnerability in UI. An remote authenticated attacker could potentially exploit this vulnerability by bypassing access controls in order to download reports containing sensitive information.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: https://www.dell.com/support/kbdoc/en-us/000201383/dsa-2022-134-dell-wyse-management-suite-security-update-for-multiple-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000201383/dsa-2022-134-dell-wyse-management-suite-security-update-for-multiple-vulnerabilities
CVE: CVE-2022-33926
Published: 2022-08-10
Description: Dell Wyse Management Suite 3.6.1 and below contains an improper access control vulnerability. A remote malicious user could exploit this vulnerability in order to retain access to a file repository after it has been revoked.
CVSS Score: 7.1 (HIGH)
CWE: CWE-284
References: https://www.dell.com/support/kbdoc/en-us/000201383/dsa-2022-134-dell-wyse-management-suite-security-update-for-multiple-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000201383/dsa-2022-134-dell-wyse-management-suite-security-update-for-multiple-vulnerabilities
CVE: CVE-2022-33927
Published: 2022-08-10
Description: Dell Wyse Management Suite 3.6.1 and below contains a Session Fixation vulnerability. A unauthenticated attacker could exploit this by taking advantage of a user with multiple active sessions in order to hijack a user's session.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-384, CWE-384
References: https://www.dell.com/support/kbdoc/en-us/000201383/dsa-2022-134-dell-wyse-management-suite-security-update-for-multiple-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000201383/dsa-2022-134-dell-wyse-management-suite-security-update-for-multiple-vulnerabilities
CVE: CVE-2022-33928
Published: 2022-08-10
Description: Dell Wyse Management Suite 3.6.1 and below contains an Plain-text Password Storage Vulnerability in UI. An attacker with low privileges could potentially exploit this vulnerability, leading to the disclosure of certain user credentials. The attacker may be able to use the exposed credentials to access the vulnerable application with privileges of the compromised account.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-256, CWE-312
References: https://www.dell.com/support/kbdoc/en-us/000201383/dsa-2022-134-dell-wyse-management-suite-security-update-for-multiple-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000201383/dsa-2022-134-dell-wyse-management-suite-security-update-for-multiple-vulnerabilities
CVE: CVE-2022-33929
Published: 2022-08-10
Description: Dell Wyse Management Suite 3.6.1 and below contains a Reflected Cross-Site Scripting Vulnerability in EndUserSummary page. An authenticated attacker could potentially exploit this vulnerability, leading to the execution of malicious HTML or JavaScript code in a victim user's web browser in the context of the vulnerable web application. Exploitation may lead to information disclosure, session theft, or client-side request forgery.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.dell.com/support/kbdoc/en-us/000201383/dsa-2022-134-dell-wyse-management-suite-security-update-for-multiple-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000201383/dsa-2022-134-dell-wyse-management-suite-security-update-for-multiple-vulnerabilities
CVE: CVE-2022-33930
Published: 2022-08-10
Description: Dell Wyse Management Suite 3.6.1 and below contains Information Disclosure in Devices error pages. An attacker could potentially exploit this vulnerability, leading to the disclosure of certain sensitive information. The attacker may be able to use the exposed information to access and further vulnerability research.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-209, CWE-209
References: https://www.dell.com/support/kbdoc/en-us/000201383/dsa-2022-134-dell-wyse-management-suite-security-update-for-multiple-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000201383/dsa-2022-134-dell-wyse-management-suite-security-update-for-multiple-vulnerabilities
CVE: CVE-2022-33931
Published: 2022-08-10
Description: Dell Wyse Management Suite 3.6.1 and below contains an Improper Access control vulnerability in UI. An attacker with no access to Alert Classification page could potentially exploit this vulnerability, leading to the change the alert categories.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-284
References: https://www.dell.com/support/kbdoc/en-us/000201383/dsa-2022-134-dell-wyse-management-suite-security-update-for-multiple-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000201383/dsa-2022-134-dell-wyse-management-suite-security-update-for-multiple-vulnerabilities
CVE: CVE-2022-34365
Published: 2022-08-10
Description: WMS 3.7 contains a Path Traversal Vulnerability in Device API. An attacker could potentially exploit this vulnerability, to gain unauthorized read access to the files stored on the server filesystem, with the privileges of the running web application.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://www.dell.com/support/kbdoc/en-us/000201383/dsa-2022-134-dell-wyse-management-suite-security-update-for-multiple-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000201383/dsa-2022-134-dell-wyse-management-suite-security-update-for-multiple-vulnerabilities
CVE: CVE-2022-35280
Published: 2022-08-10
Description: IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 230634.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-521
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/230634; https://www.ibm.com/support/pages/node/6610393; https://exchange.xforce.ibmcloud.com/vulnerabilities/230634
CVE: CVE-2022-35715
Published: 2022-08-10
Description: IBM InfoSphere Information Server 11.7 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in a stack trace. This information could be used in further attacks against the system. IBM X-Force ID: 231202.
CVSS Score: 7.5 (HIGH)
CWE: CWE-209, CWE-200
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/231202; https://www.ibm.com/support/pages/node/6610883; https://exchange.xforce.ibmcloud.com/vulnerabilities/231202