deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-46346
Published: 2022-12-13
Description: A vulnerability has been identified in Parasolid V33.1 (All versions < V33.1.264), Parasolid V34.0 (All versions < V34.0.252), Parasolid V34.1 (All versions < V34.1.242), Parasolid V35.0 (All versions < V35.0.170), Solid Edge SE2022 (All versions < V222.0MP12), Solid Edge SE2022 (All versions), Solid Edge SE2023 (All versions < V223.0Update2). The affected applications contain an out of bounds write past the end of an allocated structure while parsing specially crafted X_B files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-19071)
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://cert-portal.siemens.com/productcert/pdf/ssa-491245.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-588101.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-491245.pdf
CVE: CVE-2022-46347
Published: 2022-12-13
Description: A vulnerability has been identified in Parasolid V33.1 (All versions < V33.1.264), Parasolid V34.0 (All versions < V34.0.252), Parasolid V34.1 (All versions < V34.1.242), Parasolid V35.0 (All versions < V35.0.170), Solid Edge SE2022 (All versions < V222.0MP12), Solid Edge SE2022 (All versions), Solid Edge SE2023 (All versions < V223.0Update2). The affected applications contain an out of bounds write past the end of an allocated structure while parsing specially crafted X_B files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-19079)
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://cert-portal.siemens.com/productcert/pdf/ssa-491245.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-588101.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-491245.pdf
CVE: CVE-2022-46348
Published: 2022-12-13
Description: A vulnerability has been identified in Parasolid V33.1 (All versions < V33.1.264), Parasolid V34.0 (All versions < V34.0.252), Parasolid V34.1 (All versions < V34.1.242), Parasolid V35.0 (All versions < V35.0.170), Solid Edge SE2022 (All versions < V222.0MP12), Solid Edge SE2022 (All versions), Solid Edge SE2023 (All versions < V223.0Update2). The affected applications contain an out of bounds write past the end of an allocated structure while parsing specially crafted X_B files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-19383)
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://cert-portal.siemens.com/productcert/pdf/ssa-491245.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-588101.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-491245.pdf
CVE: CVE-2022-46349
Published: 2022-12-13
Description: A vulnerability has been identified in Parasolid V33.1 (All versions < V33.1.264), Parasolid V34.0 (All versions < V34.0.252), Parasolid V34.1 (All versions < V34.1.242), Parasolid V35.0 (All versions < V35.0.170), Solid Edge SE2022 (All versions < V222.0MP12), Solid Edge SE2022 (All versions), Solid Edge SE2023 (All versions < V223.0Update2). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted X_B files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-19384)
CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-125
References: https://cert-portal.siemens.com/productcert/pdf/ssa-491245.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-588101.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-491245.pdf
CVE: CVE-2022-46350
Published: 2022-12-13
Description: A vulnerability has been identified in SCALANCE X204RNA (HSR) (All versions < V3.2.7), SCALANCE X204RNA (PRP) (All versions < V3.2.7), SCALANCE X204RNA EEC (HSR) (All versions < V3.2.7), SCALANCE X204RNA EEC (PRP) (All versions < V3.2.7), SCALANCE X204RNA EEC (PRP/HSR) (All versions < V3.2.7). The integrated web server could allow Cross-Site Scripting (XSS) attacks if unsuspecting users are tricked into accessing a malicious link. This can be used by an attacker to trigger a malicious request on the affected device.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-80, CWE-79
References: https://cert-portal.siemens.com/productcert/pdf/ssa-363821.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-363821.pdf
CVE: CVE-2022-46351
Published: 2022-12-13
Description: A vulnerability has been identified in SCALANCE X204RNA (HSR) (All versions < V3.2.7), SCALANCE X204RNA (PRP) (All versions < V3.2.7), SCALANCE X204RNA EEC (HSR) (All versions < V3.2.7), SCALANCE X204RNA EEC (PRP) (All versions < V3.2.7), SCALANCE X204RNA EEC (PRP/HSR) (All versions < V3.2.7). Specially crafted PROFINET DCP packets could cause a denial of service condition of affected products on a local Ethernet segment (Layer 2).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-400, CWE-400
References: https://cert-portal.siemens.com/productcert/pdf/ssa-363821.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-363821.pdf
CVE: CVE-2022-46352
Published: 2022-12-13
Description: A vulnerability has been identified in SCALANCE X204RNA (HSR) (All versions < V3.2.7), SCALANCE X204RNA (PRP) (All versions < V3.2.7), SCALANCE X204RNA EEC (HSR) (All versions < V3.2.7), SCALANCE X204RNA EEC (PRP) (All versions < V3.2.7), SCALANCE X204RNA EEC (PRP/HSR) (All versions < V3.2.7). Specially crafted PROFINET DCP packets could cause a denial of service condition of affected products.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-400
References: https://cert-portal.siemens.com/productcert/pdf/ssa-363821.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-363821.pdf
CVE: CVE-2022-46353
Published: 2022-12-13
Description: A vulnerability has been identified in SCALANCE X204RNA (HSR) (All versions < V3.2.7), SCALANCE X204RNA (PRP) (All versions < V3.2.7), SCALANCE X204RNA EEC (HSR) (All versions < V3.2.7), SCALANCE X204RNA EEC (PRP) (All versions < V3.2.7), SCALANCE X204RNA EEC (PRP/HSR) (All versions < V3.2.7). The webserver of affected devices calculates session ids and nonces in an insecure manner. This could allow an unauthenticated remote attacker to brute-force session ids and hijack existing sessions.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-330, CWE-330
References: https://cert-portal.siemens.com/productcert/pdf/ssa-363821.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-363821.pdf
CVE: CVE-2022-46354
Published: 2022-12-13
Description: A vulnerability has been identified in SCALANCE X204RNA (HSR) (All versions < V3.2.7), SCALANCE X204RNA (PRP) (All versions < V3.2.7), SCALANCE X204RNA EEC (HSR) (All versions < V3.2.7), SCALANCE X204RNA EEC (PRP) (All versions < V3.2.7), SCALANCE X204RNA EEC (PRP/HSR) (All versions < V3.2.7). The webserver of an affected device is missing specific security headers. This could allow an remote attacker to extract confidential session information under certain circumstances.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-284
References: https://cert-portal.siemens.com/productcert/pdf/ssa-363821.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-363821.pdf
CVE: CVE-2022-46355
Published: 2022-12-13
Description: A vulnerability has been identified in SCALANCE X204RNA (HSR) (All versions < V3.2.7), SCALANCE X204RNA (PRP) (All versions < V3.2.7), SCALANCE X204RNA EEC (HSR) (All versions < V3.2.7), SCALANCE X204RNA EEC (PRP) (All versions < V3.2.7), SCALANCE X204RNA EEC (PRP/HSR) (All versions < V3.2.7). The affected products are vulnerable to an "Exposure of Sensitive Information to an Unauthorized Actor" vulnerability by leaking sensitive data in the HTTP Referer.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200, CWE-200
References: https://cert-portal.siemens.com/productcert/pdf/ssa-363821.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-363821.pdf
CVE: CVE-2022-46664
Published: 2022-12-13
Description: A vulnerability has been identified in Mendix Workflow Commons (All versions < V2.4.0), Mendix Workflow Commons V2.1 (All versions < V2.1.4), Mendix Workflow Commons V2.3 (All versions < V2.3.2). Affected versions of the module improperly handle access control for some module entities.

This could allow authenticated remote attackers to read or delete sensitive information.
CVSS Score: 8.1 (HIGH)
CWE: CWE-284
References: https://cert-portal.siemens.com/productcert/pdf/ssa-210822.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-210822.pdf
CVE: CVE-2022-46832
Published: 2022-12-13
Description: Use of a Broken or Risky Cryptographic Algorithm in SICK RFU62x firmware version < 2.21 allows a low-privileged remote attacker to decrypt the encrypted data if the user requested weak cipher suites to be used for encryption via the SSH interface. The patch and installation procedure for the firmware update is available from the responsible SICK customer contact person.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-327, CWE-327
References: https://sick.com/psirt; https://sick.com/psirt
CVE: CVE-2022-46833
Published: 2022-12-13
Description: Use of a Broken or Risky Cryptographic Algorithm in SICK RFU63x firmware version < v2.21 allows a low-privileged remote attacker to decrypt the encrypted data if the user requested weak cipher suites to be used for encryption via the SSH interface. The patch and installation procedure for the firmware update is available from the responsible SICK customer contact person.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-327, CWE-327
References: https://sick.com/psirt; https://sick.com/psirt
CVE: CVE-2022-46834
Published: 2022-12-13
Description: Use of a Broken or Risky Cryptographic Algorithm in SICK RFU65x firmware version < v2.21 allows a low-privileged remote attacker to decrypt the encrypted data if the user requested weak cipher suites to be used for encryption via the SSH interface. The patch and installation procedure for the firmware update is available from the responsible SICK customer contact person.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-327, CWE-327
References: https://sick.com/psirt; https://sick.com/psirt
CVE: CVE-2022-4223
Published: 2022-12-13
Description: The pgAdmin server includes an HTTP API that is intended to be used to validate the path a user selects to external PostgreSQL utilities such as pg_dump and pg_restore. The utility is executed by the server to determine what PostgreSQL version it is from. Versions of pgAdmin prior to 6.17 failed to properly secure this API, which could allow an unauthenticated user to call it with a path of their choosing, such as a UNC path to a server they control on a Windows machine. This would cause an appropriately named executable in the target path to be executed by the pgAdmin server.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94, CWE-862
References: https://github.com/pgadmin-org/pgadmin4/issues/5593; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R5EYTPKHVFSDCETBJI7LBZE4EYHBPN2Q/; https://github.com/pgadmin-org/pgadmin4/issues/5593
CVE: CVE-2022-27518
Published: 2022-12-13
Description: Unauthenticated remote arbitrary code execution
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-664
References: https://support.citrix.com/article/CTX474995; https://support.citrix.com/article/CTX474995; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-27518
CVE: CVE-2022-46062
Published: 2022-12-13
Description: Gym Management System v0.0.1 is vulnerable to Cross Site Request Forgery (CSRF).
CVSS Score: 4.5 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://github.com/rdyx0/CVE/blob/master/Gym%20Management%20System/CSRF/delete_user/delete_user.md; https://github.com/rdyx0/CVE/blob/master/Gym%20Management%20System/CSRF/delete_user/delete_user.md
CVE: CVE-2022-46364
Published: 2022-12-13
Description: A SSRF vulnerability in parsing the href attribute of XOP:Include in MTOM requests in versions of Apache CXF before 3.5.5 and 3.4.10 allows an attacker to perform SSRF style attacks on webservices that take at least one parameter of any type. 
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-918
References: https://cxf.apache.org/security-advisories.data/CVE-2022-46364.txt?version=1&modificationDate=[PII_REDACTED]39&api=v2; https://cxf.apache.org/security-advisories.data/CVE-2022-46364.txt?version=1&modificationDate=[PII_REDACTED]39&api=v2
CVE: CVE-2019-25078
Published: 2022-12-13
Description: A vulnerability classified as problematic was found in pacparser up to 1.3.x. Affected by this vulnerability is the function pacparser_find_proxy of the file src/pacparser.c. The manipulation of the argument url leads to buffer overflow. Attacking locally is a requirement. Upgrading to version 1.4.0 is able to address this issue. The name of the patch is 853e8f45607cb07b877ffd270c63dbcdd5201ad9. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-215443.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-119, CWE-120
References: https://github.com/manugarg/pacparser/commit/853e8f45607cb07b877ffd270c63dbcdd5201ad9; https://github.com/manugarg/pacparser/issues/99; https://github.com/manugarg/pacparser/releases/tag/v1.4.0
CVE: CVE-2022-45028
Published: 2022-12-13
Description: A cross-site scripting (XSS) vulnerability in Arris NVG443B 9.3.0h3d36 allows attackers to execute arbitrary web scripts or HTML via a crafted POST request sent to /cgi-bin/logs.ha.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://drive.google.com/file/d/1AHqvciVNMQpUoomFgtctnByewkkr24kB/view; https://seanpesce.blogspot.com/2022/11/unauthenticated-stored-xss-in-arris.html; https://drive.google.com/file/d/1AHqvciVNMQpUoomFgtctnByewkkr24kB/view
CVE: CVE-2022-4454
Published: 2022-12-13
Description: A vulnerability, which was classified as critical, has been found in m0ver bible-online. Affected by this issue is the function query of the file src/main/java/custom/application/search.java of the component Search Handler. The manipulation leads to sql injection. The name of the patch is 6ef0aabfb2d4ccd53fcaa[PII_REDACTED]af357410e. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-215444.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-707, CWE-89
References: https://github.com/m0ver/bible-online/commit/6ef0aabfb2d4ccd53fcaa[PII_REDACTED]af357410e; https://vuldb.com/?id.215444; https://github.com/m0ver/bible-online/commit/6ef0aabfb2d4ccd53fcaa[PII_REDACTED]af357410e
CVE: CVE-2022-4455
Published: 2022-12-13
Description: A vulnerability was identified in sproctor php-calendar up to 2.0.13. This impacts an unknown function of the file index.php. Such manipulation of the argument $_SERVER['PHP_SELF'] leads to cross site scripting. The attack may be launched remotely. The name of the patch is a2941109b42201c19733127ced763e270a357809. It is advisable to implement a patch to correct this issue.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/sproctor/php-calendar/commit/a2941109b42201c19733127ced763e270a357809; https://vuldb.com/?ctiid.215445; https://vuldb.com/?id.215445
CVE: CVE-2022-4456
Published: 2022-12-13
Description: A vulnerability has been found in falling-fruit and classified as problematic. This vulnerability affects unknown code. The manipulation leads to cross site scripting. The attack can be initiated remotely. The name of the patch is 15adb8e1ea1f1c3e3d152fc266071f621ef0c621. It is recommended to apply a patch to fix this issue. VDB-215446 is the identifier assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-707, CWE-79
References: https://github.com/falling-fruit/falling-fruit/commit/15adb8e1ea1f1c3e3d152fc266071f621ef0c621; https://vuldb.com/?id.215446; https://github.com/falling-fruit/falling-fruit/commit/15adb8e1ea1f1c3e3d152fc266071f621ef0c621
CVE: CVE-2022-24480
Published: 2022-12-13
Description: Outlook for Android Elevation of Privilege Vulnerability
CVSS Score: 6.3 (MEDIUM)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24480; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-24480
CVE: CVE-2022-26804
Published: 2022-12-13
Description: Microsoft Office Graphics Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26804; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26804
CVE: CVE-2022-26805
Published: 2022-12-13
Description: Microsoft Office Graphics Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26805; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26805
CVE: CVE-2022-26806
Published: 2022-12-13
Description: Microsoft Office Graphics Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26806; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26806
CVE: CVE-2022-41074
Published: 2022-12-13
Description: Windows Graphics Component Information Disclosure Vulnerability
CVSS Score: 5.5 (MEDIUM)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41074; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41074
CVE: CVE-2022-41076
Published: 2022-12-13
Description: PowerShell Remote Code Execution Vulnerability
CVSS Score: 8.5 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41076; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-41076
CVE: CVE-2022-41077
Published: 2022-12-13
Description: Windows Fax Compose Form Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41077; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41077
CVE: CVE-2022-41089
Published: 2022-12-13
Description: .NET Framework Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41089; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-41089
CVE: CVE-2022-41094
Published: 2022-12-13
Description: Windows Hyper-V Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41094; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41094
CVE: CVE-2022-41115
Published: 2022-12-13
Description: Microsoft Edge (Chromium-based) Update Elevation of Privilege Vulnerability
CVSS Score: 6.6 (MEDIUM)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41115; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-41115; https://security.gentoo.org/glsa/202305-10
CVE: CVE-2022-41121
Published: 2022-12-13
Description: Windows Graphics Component Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41121; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-41121
CVE: CVE-2022-41127
Published: 2022-12-13
Description: Microsoft Dynamics NAV and Microsoft Dynamics 365 Business Central (On Premises) Remote Code Execution Vulnerability
CVSS Score: 8.5 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41127; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41127
CVE: CVE-2022-41561
Published: 2022-12-13
Description: The JNDI Data Sources component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server - Community Edition, TIBCO JasperReports Server - Developer Edition, TIBCO JasperReports Server for AWS Marketplace, TIBCO JasperReports Server for AWS Marketplace, TIBCO JasperReports Server for Microsoft Azure, and TIBCO JasperReports Server for Microsoft Azure contains an easily exploitable vulnerability that allows a privileged/administrative attacker with network access to execute Remote Code Execution to obtain a reverse shell on the affected system. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Server: versions 8.0.2 and below, TIBCO JasperReports Server: version 8.1.0, TIBCO JasperReports Server - Community Edition: versions 8.1.0 and below, TIBCO JasperReports Server - Developer Edition: versions 8.1.0 and below, TIBCO JasperReports Server for AWS Marketplace: versions 8.0.2 and below, TIBCO JasperReports Server for AWS Marketplace: version 8.1.0, TIBCO JasperReports Server for Microsoft Azure: versions 8.0.2 and below, and TIBCO JasperReports Server for Microsoft Azure: version 8.1.0.
CVSS Score: 9.1 (CRITICAL)
References: https://www.tibco.com/services/support/advisories; https://www.tibco.com/support/advisories/2022/12/tibco-security-advisory-december-13-2022-tibco-jasperreports-server-cve-2022-41561; https://www.tibco.com/services/support/advisories
CVE: CVE-2022-41562
Published: 2022-12-13
Description: The HTML escaping component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server - Community Edition, TIBCO JasperReports Server - Developer Edition, TIBCO JasperReports Server for AWS Marketplace, TIBCO JasperReports Server for AWS Marketplace, TIBCO JasperReports Server for Microsoft Azure, and TIBCO JasperReports Server for Microsoft Azure contains an easily exploitable vulnerability that allows a privileged/administrative attacker with network access to execute an XSS attack on the affected system. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Server: versions 8.0.2 and below, TIBCO JasperReports Server: version 8.1.0, TIBCO JasperReports Server - Community Edition: versions 8.1.0 and below, TIBCO JasperReports Server - Developer Edition: versions 8.1.0 and below, TIBCO JasperReports Server for AWS Marketplace: versions 8.0.2 and below, TIBCO JasperReports Server for AWS Marketplace: version 8.1.0, TIBCO JasperReports Server for Microsoft Azure: versions 8.0.2 and below, and TIBCO JasperReports Server for Microsoft Azure: version 8.1.0.
CVSS Score: 8.4 (HIGH)
CWE: CWE-79
References: https://www.tibco.com/services/support/advisories; https://www.tibco.com/support/advisories/2022/12/tibco-security-advisory-december-13-2022-tibco-jasperreports-server-cve-2022-41562; https://www.tibco.com/services/support/advisories
CVE: CVE-2022-41563
Published: 2022-12-13
Description: The Dashboard component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server - Developer Edition, TIBCO JasperReports Server for AWS Marketplace, TIBCO JasperReports Server for AWS Marketplace, TIBCO JasperReports Server for Microsoft Azure, and TIBCO JasperReports Server for Microsoft Azure contains an easily exploitable vulnerability that allows a low privileged attacker with network access to execute Stored Cross Site Scripting (XSS) on the affected system. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Server: versions 8.0.2 and below, TIBCO JasperReports Server: version 8.1.0, TIBCO JasperReports Server - Developer Edition: versions 8.1.0 and below, TIBCO JasperReports Server for AWS Marketplace: versions 8.0.2 and below, TIBCO JasperReports Server for AWS Marketplace: version 8.1.0, TIBCO JasperReports Server for Microsoft Azure: versions 8.0.2 and below, and TIBCO JasperReports Server for Microsoft Azure: version 8.1.0.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-79
References: https://www.tibco.com/services/support/advisories; https://www.tibco.com/support/advisories/2022/12/tibco-security-advisory-december-13-2022-tibco-jasperreports-server-cve-2022-41563; https://www.tibco.com/services/support/advisories
CVE: CVE-2022-44666
Published: 2022-12-13
Description: Windows Contacts Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-44666; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-44666
CVE: CVE-2022-44667
Published: 2022-12-13
Description: Windows Media Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-44667; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-44667