rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-38666 
Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.146 and earlier unconditionally disables SSL/TLS certificate and hostname validation for several features.
Affected products: vendor: Jenkins project
product: Jenkins NS-ND Integration Performance Publisher Plugin
Published: 2022-11-15T00:00:00.000Z
CVE-2022-38667 
HTTP applications (servers) based on Crow through 1.0+4 may allow a Use-After-Free and code execution when HTTP pipelining is used. The HTTP parser supports HTTP pipelining, but the asynchronous Connection layer is unaware of HTTP pipelining. Specifically, the Connection layer is unaware that it has begun processing a later request before it has finished processing an earlier request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-22T19:07:43.000Z
CVE-2022-38668 
HTTP applications (servers) based on Crow through 1.0+4 may reveal potentially sensitive uninitialized data from stack memory when fulfilling a request for a static file smaller than 16 KB.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-22T19:06:02.000Z
CVE-2022-38669 
In soundrecorder service, there is a missing permission check. This could lead to elevation of privilege in contacts service with no additional execution privileges needed.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: Unisoc (Shanghai) Technologies Co., Ltd.
product: SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000
Published: 2022-10-14T00:00:00.000Z
CVE-2022-38670 
In soundrecorder service, there is a missing permission check. This could lead to elevation of privilege in contacts service with no additional execution privileges needed.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: Unisoc (Shanghai) Technologies Co., Ltd.
product: SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000
Published: 2022-10-14T00:00:00.000Z
CVE-2022-38671 
In camera driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service in kernel.
Problem types: cwe_id: CWE-126
description: CWE-126 Buffer Over-read
Affected products: vendor: Unisoc (Shanghai) Technologies Co., Ltd.
product: SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000
Published: 2022-10-14T00:00:00.000Z
CVE-2022-38672 
In face detect driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service in kernel.
Problem types: cwe_id: CWE-121
description: CWE-121 Stack-based Buffer Overflow
Affected products: vendor: Unisoc (Shanghai) Technologies Co., Ltd.
product: SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000
Published: 2022-10-14T00:00:00.000Z
CVE-2022-38673 
In face detect driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service in kernel.
Problem types: cwe_id: CWE-126
description: CWE-126 Buffer Over-read
Affected products: vendor: Unisoc (Shanghai) Technologies Co., Ltd.
product: SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000
Published: 2022-10-14T00:00:00.000Z
CVE-2022-38674 
In wlan driver, there is a possible missing params check. This could lead to local denial of service in wlan services.
Problem types: description: n/a
Affected products: vendor: Unisoc (Shanghai) Technologies Co., Ltd.
product: SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000
default_status: unaffected
Published: 2023-02-06T05:27:30.212Z
CVE-2022-38675 
In  gpu driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service in kernel.
Problem types: description: n/a
Affected products: vendor: Unisoc (Shanghai) Technologies Co., Ltd.
product: SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000
default_status: unaffected
Published: 2023-02-06T05:27:29.217Z
CVE-2022-38676 
In gpu driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service in kernel.
Problem types: cwe_id: CWE-787
description: CWE-787 Out-of-bounds Write
Affected products: vendor: Unisoc (Shanghai) Technologies Co., Ltd.
product: SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000
Published: 2022-10-14T00:00:00.000Z
CVE-2022-38677 
In cell service, there is a missing permission check. This could lead to local denial of service in cell service with no additional execution privileges needed.
Problem types: cwe_id: CWE-400
description: CWE-400 Uncontrolled Resource Consumption
Affected products: vendor: Unisoc (Shanghai) Technologies Co., Ltd.
product: SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000
Published: 2022-10-14T00:00:00.000Z
CVE-2022-38678 
In contacts service, there is a missing permission check. This could lead to local denial of service in contacts service with no additional execution privileges needed.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: Unisoc (Shanghai) Technologies Co., Ltd.
product: SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000
Published: 2023-01-04T00:00:00.000Z
CVE-2022-38679 
In music service, there is a missing permission check. This could lead to local denial of service in music service with no additional execution privileges needed.
Problem types: cwe_id: CWE-400
description: CWE-400 Uncontrolled Resource Consumption
Affected products: vendor: Unisoc (Shanghai) Technologies Co., Ltd.
product: SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000
Published: 2022-10-14T00:00:00.000Z
CVE-2022-38680 
In wlan driver, there is a possible missing params check. This could lead to local denial of service in wlan services.
Problem types: description: n/a
Affected products: vendor: Unisoc (Shanghai) Technologies Co., Ltd.
product: SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000
default_status: unaffected
Published: 2023-02-06T05:27:31.771Z
CVE-2022-38681 
In wlan driver, there is a possible missing params check. This could lead to local denial of service in wlan services.
Problem types: description: n/a
Affected products: vendor: Unisoc (Shanghai) Technologies Co., Ltd.
product: SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000
default_status: unaffected
Published: 2023-02-06T05:27:33.757Z
CVE-2022-38682 
In contacts service, there is a missing permission check. This could lead to local denial of service in contacts service with no additional execution privileges needed.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: Unisoc (Shanghai) Technologies Co., Ltd.
product: SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000
Published: 2023-01-04T00:00:00.000Z
CVE-2022-38683 
In contacts service, there is a missing permission check. This could lead to local denial of service in contacts service with no additional execution privileges needed.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: Unisoc (Shanghai) Technologies Co., Ltd.
product: SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000
Published: 2023-01-04T00:00:00.000Z
CVE-2022-38684 
In contacts service, there is a missing permission check. This could lead to local denial of service in contacts service with no additional execution privileges needed.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: Unisoc (Shanghai) Technologies Co., Ltd.
product: SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000
Published: 2023-01-04T00:00:00.000Z
CVE-2022-38685 
In bluetooth service, there is a possible missing permission check. This could lead to local denial of service in bluetooth service with no additional execution privileges needed.
Affected products: vendor: Unisoc (Shanghai) Technologies Co., Ltd.
product: SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000
default_status: unaffected
Published: 2023-05-09T01:21:32.813Z
CVE-2022-38686 
In wlan driver, there is a possible missing params check. This could lead to local denial of service in wlan services.
Problem types: description: n/a
Affected products: vendor: Unisoc (Shanghai) Technologies Co., Ltd.
product: SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000
default_status: unaffected
Published: 2023-02-06T05:27:35.576Z
CVE-2022-38687 
In messaging service, there is a missing permission check. This could lead to local denial of service in messaging service with no additional execution privileges needed.
Problem types: cwe_id: CWE-400
description: CWE-400 Uncontrolled Resource Consumption
Affected products: vendor: Unisoc (Shanghai) Technologies Co., Ltd.
product: SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000
Published: 2022-10-14T00:00:00.000Z
CVE-2022-38688 
In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.
Problem types: cwe_id: CWE-200
description: CWE-200 Information Exposure
Affected products: vendor: Unisoc (Shanghai) Technologies Co., Ltd.
product: SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000
Published: 2022-10-14T00:00:00.000Z
CVE-2022-38689 
In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.
Problem types: cwe_id: CWE-200
description: CWE-200 Information Exposure
Affected products: vendor: Unisoc (Shanghai) Technologies Co., Ltd.
product: SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000
Published: 2022-10-14T00:00:00.000Z
CVE-2022-38690 
In camera driver, there is a possible memory corruption due to improper locking. This could lead to local denial of service in kernel.
Problem types: cwe_id: CWE-119
description: CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
Affected products: vendor: Unisoc (Shanghai) Technologies Co., Ltd.
product: SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000
Published: 2022-10-14T00:00:00.000Z
CVE-2022-38691 
In BootROM, there is a possible missing validation for Certificate Type 0. This could lead to local escalation of privilege with no additional execution privileges needed.
Affected products: vendor: Unisoc (Shanghai) Technologies Co., Ltd.
product: SC9863A//T310/T610/T618/
default_status: unaffected
Published: 2025-09-01T07:28:10.876Z
CVE-2022-38692 
In BootROM, there is a missing size check for RSA keys in Certificate Type 0 validation. This could lead to memory buffer overflow without requiring additional execution privileges.
Affected products: vendor: Unisoc (Shanghai) Technologies Co., Ltd.
product: SC9863A/T310/T610/T618/T606/T612/T616/T760/T770/T820/S8000/
default_status: unaffected
Published: 2025-09-01T07:28:11.880Z
CVE-2022-38693 
In FDL1, there is a possible missing payload size check. This could lead to memory buffer overflow without requiring additional execution privileges.
Affected products: vendor: Unisoc (Shanghai) Technologies Co., Ltd.
product: SC9863A//T310/T610/T618/T606/T612/T616/T760/T770/T820/S8000/T750/T765
default_status: unaffected
Published: 2025-09-01T07:28:12.889Z
CVE-2022-38694 
In BootRom, there is a possible unchecked write address. This could lead to local escalation of privilege with no additional execution privileges needed.
Affected products: vendor: Unisoc (Shanghai) Technologies Co., Ltd.
product: SC9863A//T310/T610/T618/
default_status: unaffected
Published: 2025-09-01T07:28:13.890Z
CVE-2022-38695 
In BootRom, there's a possible unchecked command index. This could lead to local escalation of privilege with no additional execution privileges needed.
Affected products: vendor: Unisoc (Shanghai) Technologies Co., Ltd.
product: SC9863A/T310/T610/T618/T606/T612/T616/T760/T770/T820/S8000/
default_status: unaffected
Published: 2025-09-01T07:28:14.841Z
CVE-2022-38696 
In BootRom, there's a possible missing payload size check. This could lead to memory buffer overflow without requiring additional execution privileges.
Affected products: vendor: Unisoc (Shanghai) Technologies Co., Ltd.
product: SC9863A/T310/T610/T618/T606/T612/T616/T760/T770/T820/S8000/T750/T765
default_status: unaffected
Published: 2025-09-01T07:28:15.805Z
CVE-2022-38697 
In messaging service, there is a missing permission check. This could lead to access unexpected provider in contacts service with no additional execution privileges needed.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: Unisoc (Shanghai) Technologies Co., Ltd.
product: SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000
Published: 2022-10-14T00:00:00.000Z
CVE-2022-38698 
In messaging service, there is a missing permission check. This could lead to elevation of privilege in contacts service with no additional execution privileges needed.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: Unisoc (Shanghai) Technologies Co., Ltd.
product: SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000
Published: 2022-10-14T00:00:00.000Z
CVE-2022-38699 ASUS Armoury Crate Service - Arbitrary File Creation via Elevation of Privilege Flaw
Armoury Crate Service’s logging function has insufficient validation to check if the log file is a symbolic link. A physical attacker with general user privilege can modify the log file property to a symbolic link that points to arbitrary system file, causing the logging function to overwrite the system file and disrupt the system.
Problem types: cwe_id: CWE-59
description: CWE-59 Improper Link Resolution Before File Access ('Link Following')
Affected products: vendor: ASUS
product: Armoury Crate Service
CVSS v3.1: attackComplexity: LOW
attackVector: PHYSICAL
availabilityImpact: HIGH
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
version: 3.1
Published: 2022-09-28T03:25:34.591Z
CVE-2022-38700 multimedia subsystem has a permission bypass vulnerability. LAN attackers can bypass permission control and get control of camera service.
OpenHarmony-v3.1.1 and prior versions have a permission bypass vulnerability. LAN attackers can bypass permission control and get control of camera service.
Problem types: cwe_id: CWE-305
description: CWE-305 Authentication Bypass by Primary Weakness
Affected products: vendor: OpenHarmony
product: OpenHarmony
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2022-09-09T14:39:56.696Z
CVE-2022-38701 IPC in communication subsystem has a heap overflow vulnerability. Local attackers can trigger a heap overflow and get network sensitive information.
OpenHarmony-v3.1.2 and prior versions have a heap overflow vulnerability. Local attackers can trigger a heap overflow and get network sensitive information.
Problem types: cwe_id: CWE-122
description: CWE-122 Heap-based Buffer Overflow
Affected products: vendor: OpenHarmony
product: OpenHarmony
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 6.2
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
version: 3.1
Published: 2022-09-09T14:39:57.040Z
CVE-2022-38702 WordPress WP CSV Exporter Plugin <= 2.0 is vulnerable to CSV Injection
Improper Neutralization of Formula Elements in a CSV File vulnerability in Nakashima Masahiro WP CSV Exporter.This issue affects WP CSV Exporter: from n/a through 2.0.
Problem types: cwe_id: CWE-1236
description: CWE-1236 Improper Neutralization of Formula Elements in a CSV File
Affected products: vendor: Nakashima Masahiro
product: WP CSV Exporter
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.8
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:N
version: 3.1
Credits: lang: en
value: Mika (Patchstack Alliance)
Published: 2023-11-07T17:14:12.146Z
CVE-2022-38703 WordPress Button Plugin MaxButtons plugin <= 9.2 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability
Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Max Foundry Button Plugin MaxButtons plugin <= 9.2 at WordPress
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Max Foundry
product: WordPress Button Plugin MaxButtons (WordPress plugin)
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 3.4
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: HIGH
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: Vulnerability discovered by Muhammad Daffa (Patchstack Alliance)
Published: 2022-09-23T13:52:19.181Z
CVE-2022-38704 WordPress SEO Redirection plugin <= 8.9 - Cross-Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in SEO Redirection plugin <= 8.9 at WordPress, leading to deletion of 404 errors and redirection history.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: WP-buy
product: SEO Redirection Plugin – 301 Redirect Manager (WordPress plugin)
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
version: 3.1
Credits: lang: en
value: Vulnerability discovered by Muhammad Daffa (Patchstack Alliance)
Published: 2022-09-23T18:32:54.735Z
CVE-2022-38705 IBM CICS TX phishing

IBM CICS TX 11.1 Standard and Advanced could allow a remote attacker to bypass security restrictions, caused by a reverse tabnabbing flaw. An attacker could exploit this vulnerability and redirect a victim to a phishing site. IBM X-Force ID: 234172.


Problem types: description: 1022
Affected products: vendor: IBM
product: CICS TX
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N
version: 3.1
Published: 2022-11-14T17:56:59.006Z
CVE-2022-38707 IBM Cognos Command Center information disclosure
IBM Cognos Command Center 10.2.4.1 could allow a local attacker to obtain sensitive information due to insufficient session expiration.  IBM X-Force ID:  234179.
Problem types: cwe_id: CWE-613
description: CWE-613 Insufficient Session Expiration
Affected products: vendor: IBM
product: Cognos Command Center
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Published: 2023-05-05T13:54:45.562Z
CVE-2022-38708 IBM Cognos Analytics server-side request forgery

IBM Cognos Analytics 11.1.7 11.2.0, and 11.2.1 could be vulnerable to a Server-Side Request Forgery Attack (SSRF) attack by constructing URLs from user-controlled data. This could enable attackers to make arbitrary requests to the internal network or to the local file system. IBM X-Force ID: 234180.


Problem types: cwe_id: CWE-918
description: CWE-918 Server-Side Request Forgery (SSRF)
Affected products: vendor: IBM
product: Cognos Analytics
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
version: 3.1
Published: 2022-12-19T20:12:17.865Z
CVE-2022-38709 
IBM Robotic Process Automation 21.0.1, 21.0.2, and 21.0.3 for Cloud Pak is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 234291.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Robotic Process Automation
Published: 2022-10-06T17:15:27.395Z
CVE-2022-38710 IBM Robotic Process Automation information disclosure
IBM Robotic Process Automation 21.0.1 and 21.0.2 could disclose sensitive version to an unauthorized control sphere information that could aid in further attacks against the system.  IBM X-Force ID:  234292.
Problem types: cwe_id: CWE-497
description: CWE-497 Exposure of System Data to an Unauthorized Control Sphere
Affected products: vendor: IBM
product: Robotic Process Automation
cpes: cpe:2.3:a:ibm:robotic_process_automation:21.0.1:*:*:*:*:*:*:*
cpe:2.3:a:ibm:robotic_process_automation:21.0.2:*:*:*:*:*:*:*
default_status: unaffected
Published: 2022-11-03T00:00:00.000Z
CVE-2022-38712 
"IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Web services could allow a man-in-the-middle attacker to conduct SOAPAction spoofing to execute unwanted or unauthorized operations. IBM X-Force ID: 234762."
Problem types: description: Command Execution
Affected products: vendor: n/a
product: IBM WebSphere Application Server
Published: 2022-11-03T00:00:00.000Z
CVE-2022-38714 IBM DataStage on Cloud Pak for Data information disclosure
IBM DataStage on Cloud Pak for Data 4.0.6 to 4.5.2 stores sensitive credential information that can be read by a privileged user.  IBM X-Force ID:  235060.
Problem types: description: 256 Plaintext Storage of a Password
Affected products: vendor: IBM
product: DataStage on Cloud Pak for Data
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.9
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2024-02-12T17:41:24.984Z
CVE-2022-38715 
A leftover debug code vulnerability exists in the httpd shell.cgi functionality of Siretta QUARTZ-GOLD G5.0.1.5-210720-141020. A specially-crafted HTTP request can lead to remote code execution. An attacker can send an HTTP request to trigger this vulnerability.
Problem types: cwe_id: CWE-489
description: CWE-489: Leftover Debug Code
Affected products: vendor: Siretta
product: QUARTZ-GOLD
Published: 2023-01-26T21:24:48.787Z