deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-30954
Published: 2022-05-17
Description: Jenkins Blue Ocean Plugin 1.25.3 and earlier does not perform a permission check in several HTTP endpoints, allowing attackers with Overall/Read permission to connect to an attacker-specified HTTP server.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: http://www.openwall.com/lists/oss-security/2022/05/17/8; https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2502; http://www.openwall.com/lists/oss-security/2022/05/17/8
CVE: CVE-2022-30955
Published: 2022-05-17
Description: Jenkins GitLab Plugin 1.5.31 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2753; https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2753
CVE: CVE-2022-30956
Published: 2022-05-17
Description: Jenkins Rundeck Plugin 3.6.10 and earlier does not restrict URL schemes in Rundeck webhook submissions, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to submit crafted Rundeck webhook payloads.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2600; https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2600
CVE: CVE-2022-30957
Published: 2022-05-17
Description: A missing permission check in Jenkins SSH Plugin 2.6.1 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: http://www.openwall.com/lists/oss-security/2022/05/17/8; https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2315; http://www.openwall.com/lists/oss-security/2022/05/17/8
CVE: CVE-2022-30958
Published: 2022-05-17
Description: A cross-site request forgery (CSRF) vulnerability in Jenkins SSH Plugin 2.6.1 and earlier allows attackers to connect to an attacker-specified SSH server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2093; https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2093
CVE: CVE-2022-30959
Published: 2022-05-17
Description: A missing permission check in Jenkins SSH Plugin 2.6.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified SSH server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2093; https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2093
CVE: CVE-2022-30960
Published: 2022-05-17
Description: Jenkins Application Detector Plugin 1.0.8 and earlier does not escape the name of Chois Application Version parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2717; https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2717
CVE: CVE-2022-30961
Published: 2022-05-17
Description: Jenkins Autocomplete Parameter Plugin 1.1 and earlier does not escape the name of Dropdown Autocomplete and Auto Complete String parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2717; https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2717
CVE: CVE-2022-30962
Published: 2022-05-17
Description: Jenkins Global Variable String Parameter Plugin 1.2 and earlier does not escape the name and description of Global Variable String parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2717; https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2717
CVE: CVE-2022-30963
Published: 2022-05-17
Description: Jenkins JDK Parameter Plugin 1.0 and earlier does not escape the name and description of JDK parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2717; https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2717
CVE: CVE-2022-30964
Published: 2022-05-17
Description: Jenkins Multiselect parameter Plugin 1.3 and earlier does not escape the name and description of Multiselect parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2717; https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2717
CVE: CVE-2022-30965
Published: 2022-05-17
Description: Jenkins Promoted Builds (Simple) Plugin 1.9 and earlier does not escape the name and description of Promotion Level parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2717; https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2717
CVE: CVE-2022-30966
Published: 2022-05-17
Description: Jenkins Random String Parameter Plugin 1.0 and earlier does not escape the name and description of Random String parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-116
References: https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2717; https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2717
CVE: CVE-2022-30967
Published: 2022-05-17
Description: Jenkins Selection tasks Plugin 1.0 and earlier does not escape the name and description of Script Selection task variable parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2717; https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2717
CVE: CVE-2022-30968
Published: 2022-05-17
Description: Jenkins vboxwrapper Plugin 1.3 and earlier does not escape the name and description of VBox node parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2717; https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2717
CVE: CVE-2022-30969
Published: 2022-05-17
Description: A cross-site request forgery (CSRF) vulnerability in Jenkins Autocomplete Parameter Plugin 1.1 and earlier allows attackers to execute arbitrary code without sandbox protection if the victim is an administrator.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2322; https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2322
CVE: CVE-2022-30970
Published: 2022-05-17
Description: Jenkins Autocomplete Parameter Plugin 1.1 and earlier references Dropdown Autocomplete parameter and Auto Complete String parameter names in an unsafe manner from Javascript embedded in view definitions, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2267; https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2267
CVE: CVE-2022-30971
Published: 2022-05-17
Description: Jenkins Storable Configs Plugin 1.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVSS Score: 8.8 (HIGH)
CWE: CWE-611
References: https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-1969; https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-1969
CVE: CVE-2022-30972
Published: 2022-05-17
Description: A cross-site request forgery (CSRF) vulnerability in Jenkins Storable Configs Plugin 1.0 and earlier allows attackers to have Jenkins parse a local XML file (e.g., archived artifacts) that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-1969; https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-1969
CVE: CVE-2020-4957
Published: 2022-05-17
Description: IBM Security Identity Governance and Intelligence 5.2.6 could disclose sensitive information in URL parameters that could aid in future attacks against the system. IBM X-Force ID: 192208.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/192208; https://www.ibm.com/support/pages/node/6586142; https://exchange.xforce.ibmcloud.com/vulnerabilities/192208
CVE: CVE-2022-22484
Published: 2022-05-17
Description: IBM Spectrum Protect Operations Center 8.1.12 and 8.1.13 could allow a local attacker to obtain sensitive information, caused by plain text user account passwords potentially being stored in the browser's application command history. By accessing browser history, an attacker could exploit this vulnerability to obtain other user accounts' passwords. IBM X-Force ID: 226322.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-312
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/226322; https://www.ibm.com/support/pages/node/6586314; https://exchange.xforce.ibmcloud.com/vulnerabilities/226322
CVE: CVE-2022-24108
Published: 2022-05-17
Description: The Skyoftech So Listing Tabs module 2.2.0 for OpenCart allows a remote attacker to inject a serialized PHP object via the setting parameter, potentially resulting in the ability to write to files on the server, cause DoS, and achieve remote code execution because of deserialization of untrusted data.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: http://packetstormsecurity.com/files/167197/OpenCart-So-Listing-Tabs-2.2.0-Unsafe-Deserialization.html; https://codecanyon.net/item/so-listing-tabs-responsive-opencart-module/12388133; https://seclists.org/fulldisclosure/2022/May/30
CVE: CVE-2022-24856
Published: 2022-05-17
Description: FlyteConsole is the web user interface for the Flyte platform. FlyteConsole prior to version 0.52.0 is vulnerable to server-side request forgery (SSRF) when FlyteConsole is open to the general internet. An attacker can exploit any user of a vulnerable instance to access the internal metadata server or other unauthenticated URLs. Passing of headers to an unauthorized actor may occur. The patch for this issue deletes the entire `cors_proxy`, as this is not required for console anymore. A patch is available in FlyteConsole version 0.52.0. Disable FlyteConsole availability on the internet as a workaround.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-918
References: https://github.com/flyteorg/flyteconsole/commit/05b88ed2d2ecdb5d8a8404efea25414e57189709; https://github.com/flyteorg/flyteconsole/pull/389; https://github.com/flyteorg/flyteconsole/releases/tag/v0.52.0
CVE: CVE-2022-30007
Published: 2022-05-17
Description: GXCMS V1.5 has a file upload vulnerability in the background. The vulnerability is the template management page. You can edit any template content and then rename to PHP suffix file, after calling PHP file can control the server.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: https://github.com/ZackSecurity/VulnerReport/blob/cve/gxcms/1.md; https://github.com/breezety/gxcms15/issues/1; https://github.com/ZackSecurity/VulnerReport/blob/cve/gxcms/1.md
CVE: CVE-2022-30073
Published: 2022-05-17
Description: WBCE CMS 1.5.2 is vulnerable to Cross Site Scripting (XSS) via /admin/users/save.php.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/APTX-4879/CVE; https://github.com/APTX-4879/CVE/blob/main/CVE-2022-30073.pdf; https://github.com/APTX-4879/CVE
CVE: CVE-2020-4994
Published: 2022-05-17
Description: IBM DataPower Gateway 10.0.1.0 through 10.0.1.4 and 2018.4.1.0 through 2018.4.1.17 could allow a remote user to cause a temporary denial of service by sending invalid HTTP requests. IBM X-Force ID: 192906.
CVSS Score: 7.5 (HIGH)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/192906; https://www.ibm.com/support/pages/node/6586526; https://exchange.xforce.ibmcloud.com/vulnerabilities/192906
CVE: CVE-2021-29726
Published: 2022-05-17
Description: IBM Sterling Secure Proxy 6.0.3 and IBM Secure External Authentication Server 6.0.3 does not properly ensure that a certificate is actually associated with the host due to improper validation of certificates. IBM X-Force ID: 201104.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-295
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/201104; https://www.ibm.com/support/pages/node/6586754; https://www.ibm.com/support/pages/node/6586756
CVE: CVE-2021-38872
Published: 2022-05-17
Description: IBM DataPower Gateway 10.0.2.0, 10.0.3.0, 10.0.1.0 through 10.0.1.4, and 2018.4.1.0 through 2018.4.1.17 could allow a remote user to cause a denial of service by consuming resources with multiple requests. IBM X-Force ID: 208348.
CVSS Score: 7.5 (HIGH)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/208348; https://www.ibm.com/support/pages/node/6586704; https://exchange.xforce.ibmcloud.com/vulnerabilities/208348
CVE: CVE-2022-1116
Published: 2022-05-17
Description: Integer Overflow or Wraparound vulnerability in io_uring of Linux Kernel allows local attacker to cause memory corruption and escalate privileges to root. This issue affects: Linux Kernel versions prior to 5.4.189; version 5.4.24 and later versions.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190, CWE-190
References: http://packetstormsecurity.com/files/167386/Kernel-Live-Patch-Security-Notice-LSN-0086-1.html; https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/fs/io_uring.c?h=v5.4.189&id=1a623d361ffe5cecd4244a02f[PII_REDACTED]60038; https://kernel.dance/#1a623d361ffe5cecd4244a02f[PII_REDACTED]60038
CVE: CVE-2022-1733
Published: 2022-05-17
Description: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.4968.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: http://seclists.org/fulldisclosure/2022/Oct/28; http://seclists.org/fulldisclosure/2022/Oct/41; https://github.com/vim/vim/commit/60ae0e71490c97f2871a6344aca61cacf220f813
CVE: CVE-2022-1769
Published: 2022-05-17
Description: Buffer Over-read in GitHub repository vim/vim prior to 8.2.4974.
CVSS Score: 7.8 (HIGH)
CWE: CWE-126, CWE-125
References: http://seclists.org/fulldisclosure/2022/Oct/28; http://seclists.org/fulldisclosure/2022/Oct/41; https://github.com/vim/vim/commit/4748c4bd64610cf943a431d215bb1aad51f8d0b4
CVE: CVE-2022-22475
Published: 2022-05-17
Description: IBM WebSphere Application Server Liberty and Open Liberty 17.0.0.3 through 22.0.0.5 are vulnerable to identity spoofing by an authenticated user. IBM X-Force ID: 225603.
CVSS Score: 6.5 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/225603; https://www.ibm.com/support/pages/node/6586734; https://exchange.xforce.ibmcloud.com/vulnerabilities/225603
CVE: CVE-2022-22482
Published: 2022-05-17
Description: IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.5 and 6.1.0.0 through 6.1.1.0 could allow an authenticated user to upload files that could fill up the filesystem and cause a denial of service. IBM X-Force ID: 225977.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-434
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/225977; https://www.ibm.com/support/pages/node/6586576; https://exchange.xforce.ibmcloud.com/vulnerabilities/225977
CVE: CVE-2022-29581
Published: 2022-05-17
Description: Improper Update of Reference Count vulnerability in net/sched of Linux Kernel allows local attacker to cause privilege escalation to root. This issue affects: Linux Kernel versions prior to 5.18; version 4.14 and later versions.
CVSS Score: 7.8 (HIGH)
CWE: CWE-911
References: http://packetstormsecurity.com/files/167386/Kernel-Live-Patch-Security-Notice-LSN-0086-1.html; http://packetstormsecurity.com/files/168191/Kernel-Live-Patch-Security-Notice-LSN-0089-1.html; http://www.openwall.com/lists/oss-security/2022/05/18/2
CVE: CVE-2022-30067
Published: 2022-05-17
Description: GIMP 2.10.30 and 2.99.10 are vulnerable to Buffer Overflow. Through a crafted XCF file, the program will allocate for a huge amount of memory, resulting in insufficient memory or program crash.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-120
References: https://gitlab.gnome.org/GNOME/gimp/-/issues/8120; https://lists.debian.org/debian-lts-announce/2023/11/msg00015.html; https://gitlab.gnome.org/GNOME/gimp/-/issues/8120
CVE: CVE-2022-30072
Published: 2022-05-17
Description: WBCE CMS 1.5.2 is vulnerable to Cross Site Scripting (XSS) via \admin\pages\sections_save.php namesection2 parameters.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/APTX-4879/CVE; https://github.com/APTX-4879/CVE/blob/main/CVE-2022-30072.pdf; https://github.com/WBCE/WBCE_CMS
CVE: CVE-2022-1706
Published: 2022-05-17
Description: A vulnerability was found in Ignition where ignition configs are accessible from unprivileged containers in VMs running on VMware products. This issue is only relevant in user environments where the Ignition config contains secrets. The highest threat from this vulnerability is to data confidentiality. Possible workaround is to not put secrets in the Ignition config.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-863, CWE-863
References: https://bugzilla.redhat.com/show_bug.cgi?id=2082274; https://github.com/coreos/ignition/commit/4b70b44b430ecf8377a276e89b5acd3a6957d4ea; https://github.com/coreos/ignition/issues/1300
CVE: CVE-2022-22773
Published: 2022-05-17
Description: The REST API component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server - Community Edition, TIBCO JasperReports Server - Developer Edition, TIBCO JasperReports Server for AWS Marketplace, TIBCO JasperReports Server for ActiveMatrix BPM, and TIBCO JasperReports Server for Microsoft Azure contains difficult to exploit Reflected Cross Site Scripting (XSS) vulnerabilities that allow a low privileged attacker with network access to execute scripts targeting the affected system or the victim's local system. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Server: versions 8.0.1 and below, TIBCO JasperReports Server - Community Edition: versions 8.0.1 and below, TIBCO JasperReports Server - Developer Edition: versions 8.0.0 and below, TIBCO JasperReports Server for AWS Marketplace: versions 8.0.1 and below, TIBCO JasperReports Server for ActiveMatrix BPM: versions 7.9.2 and below, and TIBCO JasperReports Server for Microsoft Azure: versions 8.0.1 and below.
CVSS Score: 7.7 (HIGH)
CWE: CWE-79
References: https://www.tibco.com/services/support/advisories; https://www.tibco.com/support/advisories/2022/05/tibco-security-advisory-may-17-2022-tibco-jasperreports-server-cve-2022-22773; https://www.tibco.com/services/support/advisories
CVE: CVE-2022-22775
Published: 2022-05-17
Description: The Workspace client component of TIBCO Software Inc.'s TIBCO BPM Enterprise and TIBCO BPM Enterprise Distribution for TIBCO Silver Fabric contains difficult to exploit Reflected Cross Site Scripting (XSS) vulnerabilities that allow low privileged attackers with network access to execute scripts targeting the affected system or the victim's local system. Affected releases are TIBCO Software Inc.'s TIBCO BPM Enterprise: versions 4.3.1 and below and TIBCO BPM Enterprise Distribution for TIBCO Silver Fabric: versions 4.3.1 and below.
CVSS Score: 8.1 (HIGH)
CWE: CWE-79
References: https://www.tibco.com/services/support/advisories; https://www.tibco.com/support/advisories/2022/05/tibco-security-advisory-may-17-2022-tibco-activematrix-bpm-cve-2022-22775; https://www.tibco.com/services/support/advisories
CVE: CVE-2022-23669
Published: 2022-05-17
Description: A remote authorization bypass vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8.9-HF2 and below, 6.7.x and below. Aruba has released updates to ClearPass Policy Manager that address this security vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-613
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-007.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-007.txt
CVE: CVE-2022-23671
Published: 2022-05-17
Description: A remote authenticated information disclosure vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8.9-HF2 and below, 6.7.x and below. Aruba has released updates to ClearPass Policy Manager that address this security vulnerability.
CVSS Score: 7.5 (HIGH)
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-007.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-007.txt
CVE: CVE-2022-23672
Published: 2022-05-17
Description: A authenticated remote command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8.9-HF2 and below, 6.7.x and below. Aruba has released updates to ClearPass Policy Manager that address this security vulnerability.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-007.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-007.txt
CVE: CVE-2022-23673
Published: 2022-05-17
Description: A authenticated remote command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8.9-HF2 and below, 6.7.x and below. Aruba has released updates to ClearPass Policy Manager that address this security vulnerability.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-007.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-007.txt
CVE: CVE-2022-23675
Published: 2022-05-17
Description: A remote authenticated stored cross-site scripting (xss) vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8.9-HF2 and below, 6.7.x and below. Aruba has released updates to ClearPass Policy Manager that address this security vulnerability.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-007.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-007.txt
CVE: CVE-2022-24611
Published: 2022-05-17
Description: Denial of Service (DoS) in the Z-Wave S0 NonceGet protocol specification in Silicon Labs Z-Wave 500 series allows local attackers to block S0/S2 protected Z-Wave network via crafted S0 NonceGet Z-Wave packages, utilizing included but absent NodeIDs.
CVSS Score: 6.5 (MEDIUM)
References: http://z-wave.com; https://github.com/ITSecLab-HSEL/CVE-2022-24611; http://z-wave.com