rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-28920 
Tieba-Cloud-Sign v4.9 was discovered to contain a cross-site scripting (XSS) vulnerability via the function strip_tags.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-12T15:43:21.000Z
CVE-2022-28921 
A Cross-Site Request Forgery (CSRF) vulnerability discovered in BlogEngine.Net v3.3.8.0 allows unauthenticated attackers to read arbitrary files on the hosting web server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-18T17:11:02.000Z
CVE-2022-28923 
Caddy v2.4.6 was discovered to contain an open redirection vulnerability which allows attackers to redirect users to phishing websites via crafted URLs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-06T00:00:00.000Z
CVE-2022-28924 
An information disclosure vulnerability in UniverSIS-Students before v1.5.0 allows attackers to obtain sensitive information via a crafted GET request to the endpoint /api/students/me/courses/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-18T16:33:42.000Z
CVE-2022-28927 
A remote code execution (RCE) vulnerability in Subconverter v0.7.2 allows attackers to execute arbitrary code via crafted config and url parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-19T15:31:27.000Z
CVE-2022-28929 
Hospital Management System v1.0 was discovered to contain a SQL injection vulnerability via the delid parameter at viewtreatmentrecord.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-15T15:35:19.000Z
CVE-2022-28930 
ERP-Pro v3.7.5 was discovered to contain a SQL injection vulnerability via the component /base/SysEveMenuAuthPointMapper.xml..
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-15T16:17:03.000Z
CVE-2022-28932 
D-Link DSL-G2452DG HW:T1\\tFW:ME_2.00 was discovered to contain insecure permissions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-23T16:01:16.000Z
CVE-2022-28935 
Totolink A830R V5.9c.4729_B20191112, Totolink A3100R V4.1.2cu.5050_B20200504, Totolink A950RG V4.1.2cu.5161_B20200903, Totolink A800R V4.1.2cu.5137_B20200730, Totolink A3000RU V5.9c.5185_B20201128, Totolink A810R V4.1.2cu.5182_B20201026 were discovered to contain a command injection vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-06T12:24:38.000Z
CVE-2022-28936 
FISCO-BCOS release-3.0.0-rc2 was discovered to contain an issue where a malicious node can trigger an integer overflow and cause a Denial of Service (DoS) via an unusually large viewchange message packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-15T15:39:47.000Z
CVE-2022-28937 
FISCO-BCOS release-3.0.0-rc2 was discovered to contain an issue where a malicious node, via an invalid proposal with an invalid header, will cause normal nodes to stop producing new blocks and processing new clients' requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-15T15:39:48.000Z
CVE-2022-28940 
In H3C MagicR100 <=V100R005, the / Ajax / ajaxget interface can be accessed without authorization. It sends a large amount of data through ajaxmsg to carry out DOS attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-04T15:40:06.000Z
CVE-2022-28944 
Certain EMCO Software products are affected by: CWE-494: Download of Code Without Integrity Check. This affects MSI Package Builder for Windows 9.1.4 and Remote Installer for Windows 6.0.13 and Ping Monitor for Windows 8.0.18 and Remote Shutdown for Windows 7.2.2 and WakeOnLan 2.0.8 and Network Inventory for Windows 5.8.22 and Network Software Scanner for Windows 2.0.8 and UnLock IT for Windows 6.1.1. The impact is: execute arbitrary code (remote). The component is: Updater. The attack vector is: To exploit this vulnerability, a user must trigger an update of an affected installation of EMCO Software. ¶¶ Multiple products from EMCO Software are affected by a remote code execution vulnerability during the update process.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-23T17:05:09.000Z
CVE-2022-28945 
An issue in Webbank WeCube v3.2.2 allows attackers to execute a directory traversal via a crafted ZIP file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-31T23:22:54.000Z
CVE-2022-28946 
An issue in the component ast/parser.go of Open Policy Agent v0.39.0 causes the application to incorrectly interpret every expression, causing a Denial of Service (DoS) via triggering out-of-range memory access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-19T18:03:47.000Z
CVE-2022-28948 
An issue in the Unmarshal function in Go-Yaml v3 causes the program to crash when attempting to deserialize invalid input.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-19T19:59:30.000Z
CVE-2022-28955 
An access control issue in D-Link DIR816L_FW206b01 allows unauthenticated attackers to access folders folder_view.php and category_view.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-18T11:50:41.000Z
CVE-2022-28956 
An issue in the getcfg.php component of D-Link DIR816L_FW206b01 allows attackers to access the device via a crafted payload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-18T11:50:42.000Z
CVE-2022-28959 
Multiple cross-site scripting (XSS) vulnerabilities in the component /spip.php of Spip Web Framework v3.1.13 and below allows attackers to execute arbitrary web scripts or HTML.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-19T20:26:11.000Z
CVE-2022-28960 
A PHP injection vulnerability in Spip before v3.2.8 allows attackers to execute arbitrary PHP code via the _oups parameter at /ecrire.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-19T20:26:14.000Z
CVE-2022-28961 
Spip Web Framework v3.1.13 and below was discovered to contain multiple SQL injection vulnerabilities at /ecrire via the lier_trad and where parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-19T20:26:16.000Z
CVE-2022-28962 
Online Sports Complex Booking System 1.0 is vulnerable to SQL Injection via /scbs/classes/Users.php?f=delete_client.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-19T20:40:19.000Z
CVE-2022-28964 
An arbitrary file write vulnerability in Avast Premium Security before v21.11.2500 (build 21.11.6809.528) allows attackers to cause a Denial of Service (DoS) via a crafted DLL file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-20T01:13:35.000Z
CVE-2022-28965 
Multiple DLL hijacking vulnerabilities via the components instup.exe and wsc_proxy.exe in Avast Premium Security before v21.11.2500 allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via a crafted DLL file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-20T01:13:39.000Z
CVE-2022-28966 
Wasm3 0.5.0 has a heap-based buffer overflow in NewCodePage in m3_code.c (called indirectly from Compile_BranchTable in m3_compile.c).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-16T15:52:37.000Z
CVE-2022-28969 
Tenda AX1806 v1.0.0.1 was discovered to contain a stack overflow via the shareSpeed parameter in the function fromSetWifiGusetBasic. This vulnerability allows attackers to cause a Denial of Service (DoS).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-06T13:08:38.000Z
CVE-2022-28970 
Tenda AX1806 v1.0.0.1 was discovered to contain a heap overflow via the mac parameter in the function GetParentControlInfo. This vulnerability allows attackers to cause a Denial of Service (DoS).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-06T13:08:39.000Z
CVE-2022-28971 
Tenda AX1806 v1.0.0.1 was discovered to contain a stack overflow via the list parameter in the function fromSetIpMacBind. This vulnerability allows attackers to cause a Denial of Service (DoS).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-06T13:08:40.000Z
CVE-2022-28972 
Tenda AX1806 v1.0.0.1 was discovered to contain a stack overflow via the timeZone parameter in the function form_fast_setting_wifi_set. This vulnerability allows attackers to cause a Denial of Service (DoS).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-06T13:08:41.000Z
CVE-2022-28973 
Tenda AX1806 v1.0.0.1 was discovered to contain a stack overflow via the wanMTU parameter in the function fromAdvSetMacMtuWan. This vulnerability allows attackers to cause a Denial of Service (DoS).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-06T13:08:42.000Z
CVE-2022-28975 
A stored cross-site scripting (XSS) vulnerability in Infoblox NIOS v8.5.2-409296 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the VLAN View Name field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-01-09T00:00:00.000Z
CVE-2022-28977 
HtmlUtil.escapeRedirect in Liferay Portal 7.3.1 through 7.4.2, and Liferay DXP 7.0 fix pack 91 through 101, 7.1 fix pack 17 through 25, 7.2 fix pack 5 through 14, and 7.3 before service pack 3 can be circumvented by using multiple forward slashes, which allows remote attackers to redirect users to arbitrary external URLs via the (1) 'redirect` parameter (2) `FORWARD_URL` parameter, and (3) others parameters that rely on HtmlUtil.escapeRedirect.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-22T00:02:08.000Z
CVE-2022-28978 
Stored cross-site scripting (XSS) vulnerability in the Site module's user membership administration page in Liferay Portal 7.0.1 through 7.4.1, and Liferay DXP 7.0 before fix pack 102, 7.1 before fix pack 26, 7.2 before fix pack 15, and 7.3 before service pack 3 allows remote attackers to inject arbitrary web script or HTML via the a user's name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-21T23:38:59.000Z
CVE-2022-28979 
Liferay Portal v7.1.0 through v7.4.2 and Liferay DXP 7.1 before fix pack 26, 7.2 before fix pack 15, and 7.3 before service pack 3 was discovered to contain a cross-site scripting (XSS) vulnerability in the Portal Search module's Custom Facet widget. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Custom Parameter Name text field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-21T23:22:44.000Z
CVE-2022-28980 
Multiple cross-site scripting (XSS) vulnerabilities in Liferay Portal v7.4.3.4 and Liferay DXP v7.4 GA allows attackers to execute arbitrary web scripts or HTML via parameters with the filter_ prefix.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-22T00:13:41.000Z
CVE-2022-28981 
Path traversal vulnerability in the Hypermedia REST APIs module in Liferay Portal 7.4.0 through 7.4.2 allows remote attackers to access files outside of com.liferay.headless.discovery.web/META-INF/resources via the `parameter` parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-22T00:06:35.000Z
CVE-2022-28982 
A cross-site scripting (XSS) vulnerability in Liferay Portal v7.3.3 through v7.4.2 and Liferay DXP v7.3 before service pack 3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the name of a tag.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-21T23:57:41.000Z
CVE-2022-28985 
A stored cross-site scripting (XSS) vulnerability in the addNewPost component of OrangeHRM v4.10.1 allows attackers to execute arbitrary web scripts or HTML via a crafted POST request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AC:L/AV:N/A:N/C:L/I:H/PR:L/S:U/UI:R
version: 3.1
Published: 2022-05-20T01:43:10.000Z
CVE-2022-28986 
LMS Doctor Simple 2 Factor Authentication Plugin For Moodle Affected: 2021072900 has an Insecure direct object references (IDOR) vulnerability, which allows remote attackers to update sensitive records such as email, password and phone number of other user accounts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-10T18:51:15.000Z
CVE-2022-28987 
Zoho ManageEngine ADSelfService Plus before 6202 allows attackers to perform username enumeration via a crafted POST request to /ServletAPI/accounts/login.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-20T02:10:39.000Z
CVE-2022-28990 
WASM3 v0.5.0 was discovered to contain a heap overflow via the component /wabt/bin/poc.wasm.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-20T18:06:27.000Z
CVE-2022-28991 
Multi Store Inventory Management System v1.0 was discovered to contain an information disclosure vulnerability which allows attackers to access sensitive files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-20T12:53:14.000Z
CVE-2022-28992 
A Cross-Site Request Forgery (CSRF) in Online Banquet Booking System v1.0 allows attackers to change admin credentials via a crafted POST request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-20T12:53:16.000Z
CVE-2022-28993 
Multi Store Inventory Management System v1.0 allows attackers to perform an account takeover via a crafted POST request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-20T12:53:17.000Z
CVE-2022-28994 
Small HTTP Server version 3.06 suffers from a remote buffer overflow vulnerability via long GET request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-29T16:17:27.000Z
CVE-2022-28995 
Rengine v1.0.2 was discovered to contain a remote code execution (RCE) vulnerability via the yaml configuration function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-20T18:31:32.000Z
CVE-2022-28997 
CSZCMS v1.3.0 allows attackers to execute a Server-Side Request Forgery (SSRF) which can be leveraged to leak sensitive data via a local file inclusion at /admin/filemanager/connector/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-23T13:35:17.000Z
CVE-2022-28998 
Xlight FTP v3.9.3.2 was discovered to contain a stack-based buffer overflow which allows attackers to leak sensitive information via crafted code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-23T13:35:18.000Z
CVE-2022-28999 
Insecure permissions in the install directories and binaries of Dev-CPP v4.9.9.2 allows attackers to execute arbitrary code via overwriting the binary devcpp.exe.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-23T20:16:03.000Z
CVE-2022-29001 
In SpringBootMovie <=1.2, the uploaded file suffix parameter is not filtered, resulting in arbitrary file upload vulnerability
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-03T17:43:36.000Z
CVE-2022-29002 
A Cross-Site Request Forgery (CSRF) in XXL-Job v2.3.0 allows attackers to arbitrarily create administrator accounts via the component /gaia-job-admin/user/add.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-23T20:50:39.000Z
CVE-2022-29004 
Diary Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Name parameter in search-result.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-23T15:38:12.000Z
CVE-2022-29005 
Multiple cross-site scripting (XSS) vulnerabilities in the component /obcs/user/profile.php of Online Birth Certificate System v1.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the fname or lname parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-23T15:31:49.000Z
CVE-2022-29006 
Multiple SQL injection vulnerabilities via the username and password parameters in the Admin panel of Directory Management System v1.0 allows attackers to bypass authentication.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-11T13:08:00.000Z
CVE-2022-29007 
Multiple SQL injection vulnerabilities via the username and password parameters in the Admin panel of Dairy Farm Shop Management System v1.0 allows attackers to bypass authentication.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-11T13:08:01.000Z
CVE-2022-29008 
An insecure direct object reference (IDOR) vulnerability in the viewid parameter of Bus Pass Management System v1.0 allows attackers to access sensitive information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-11T13:08:03.000Z
CVE-2022-29009 
Multiple SQL injection vulnerabilities via the username and password parameters in the Admin panel of Cyber Cafe Management System Project v1.0 allows attackers to bypass authentication.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-11T13:08:04.000Z
CVE-2022-29013 
A command injection in the command parameter of Razer Sila Gaming Router v2.0.441_api-2.0.418 allows attackers to execute arbitrary commands via a crafted POST request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-08T23:28:57.000Z
CVE-2022-29014 
A local file inclusion vulnerability in Razer Sila Gaming Router v2.0.441_api-2.0.418 allows attackers to read arbitrary files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-08T23:43:15.000Z
CVE-2022-29017 
Bento4 v1.6.0.0 was discovered to contain a segmentation fault via the component /x86_64/multiarch/strlen-avx2.S.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-16T13:26:09.000Z
CVE-2022-29020 
ForestBlog through 2022-02-16 allows admin/profile/save userAvatar XSS during addition of a user avatar.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-15T23:25:00.000Z
CVE-2022-29021 
A buffer overflow vulnerability exists in the razerkbd driver of OpenRazer up to version v3.3.0 allows attackers to cause a Denial of Service (DoS) and possibly escalate their privileges via a crafted buffer sent to the matrix_custom_frame device.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-20T12:43:44.000Z
CVE-2022-29022 
A buffer overflow vulnerability exists in the razeraccessory driver of OpenRazer up to version v3.3.0 allows attackers to cause a Denial of Service (DoS) and possibly escalate their privileges via a crafted buffer sent to the matrix_custom_frame device.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-20T12:43:50.000Z
CVE-2022-29023 
A buffer overflow vulnerability exists in the razermouse driver of OpenRazer up to version v3.3.0 allows attackers to cause a Denial of Service (DoS) and possibly escalate their privileges via a crafted buffer sent to the matrix_custom_frame device.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-20T12:43:46.000Z
CVE-2022-29028 
A vulnerability has been identified in JT2Go (All versions < V13.3.0.3), Teamcenter Visualization V13.3 (All versions < V13.3.0.3), Teamcenter Visualization V14.0 (All versions < V14.0.0.1). The Tiff_Loader.dll is vulnerable to infinite loop condition while parsing specially crafted TIFF files. An attacker could leverage this vulnerability to crash the application causing denial of service condition.
Problem types: cwe_id: CWE-835
description: CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')
Affected products: vendor: Siemens
product: JT2Go
vendor: Siemens
product: Teamcenter Visualization V13.3
vendor: Siemens
product: Teamcenter Visualization V14.0
Published: 2022-05-10T09:47:05.000Z
CVE-2022-29029 
A vulnerability has been identified in JT2Go (All versions < V13.3.0.3), Teamcenter Visualization V13.3 (All versions < V13.3.0.3), Teamcenter Visualization V14.0 (All versions < V14.0.0.1). The CGM_NIST_Loader.dll contains a null pointer dereference vulnerability while parsing specially crafted CGM files. An attacker could leverage this vulnerability to crash the application causing denial of service condition.
Problem types: cwe_id: CWE-476
description: CWE-476: NULL Pointer Dereference
Affected products: vendor: Siemens
product: JT2Go
vendor: Siemens
product: Teamcenter Visualization V13.3
vendor: Siemens
product: Teamcenter Visualization V14.0
Published: 2022-05-10T09:47:06.000Z
CVE-2022-29030 
A vulnerability has been identified in JT2Go (All versions < V13.3.0.3), Teamcenter Visualization V13.3 (All versions < V13.3.0.3), Teamcenter Visualization V14.0 (All versions < V14.0.0.1). The Mono_Loader.dll library is vulnerable to integer overflow condition while parsing specially crafted TG4 files. An attacker could leverage this vulnerability to crash the application causing denial of service condition.
Problem types: cwe_id: CWE-680
description: CWE-680: Integer Overflow to Buffer Overflow
Affected products: vendor: Siemens
product: JT2Go
vendor: Siemens
product: Teamcenter Visualization V13.3
vendor: Siemens
product: Teamcenter Visualization V14.0
Published: 2022-05-10T09:47:08.000Z
CVE-2022-29031 
A vulnerability has been identified in JT2Go (All versions < V13.3.0.3), Teamcenter Visualization V13.3 (All versions < V13.3.0.3), Teamcenter Visualization V14.0 (All versions < V14.0.0.1). The CGM_NIST_Loader.dll contains a null pointer dereference vulnerability while parsing specially crafted CGM files. An attacker could leverage this vulnerability to crash the application causing denial of service condition.
Problem types: cwe_id: CWE-476
description: CWE-476: NULL Pointer Dereference
Affected products: vendor: Siemens
product: JT2Go
vendor: Siemens
product: Teamcenter Visualization V13.3
vendor: Siemens
product: Teamcenter Visualization V14.0
Published: 2022-05-10T09:47:09.000Z
CVE-2022-29032 
A vulnerability has been identified in JT2Go (All versions < V13.3.0.3), Teamcenter Visualization V13.3 (All versions < V13.3.0.3), Teamcenter Visualization V14.0 (All versions < V14.0.0.1). The CGM_NIST_Loader.dll library contains a double free vulnerability while parsing specially crafted CGM files. An attacker could leverage this vulnerability to execute code in the context of the current process.
Problem types: cwe_id: CWE-415
description: CWE-415: Double Free
Affected products: vendor: Siemens
product: JT2Go
vendor: Siemens
product: Teamcenter Visualization V13.3
vendor: Siemens
product: Teamcenter Visualization V14.0
Published: 2022-05-10T09:47:11.000Z