rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-38557 
D-Link DIR845L v1.00-v1.03 contains a Static Default Credential vulnerability in /etc/init0.d/S80telnetd.sh.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-28T15:49:36.000Z
CVE-2022-38562 
Tenda M3 V1.0.0.12(4856) was discovered to contain a heap buffer overflow vulnerability in the function formSetFixTools. This vulnerability allows attackers to cause a Denial of Service (DoS) via the lan parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-28T16:50:17.000Z
CVE-2022-38563 
Tenda M3 V1.0.0.12(4856) was discovered to contain a heap buffer overflow vulnerability in the function formSetFixTools. This vulnerability allows attackers to cause a Denial of Service (DoS) via the MACAddr parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-28T16:44:28.000Z
CVE-2022-38564 
Tenda M3 V1.0.0.12(4856) was discovered to contain a buffer overflow vulnerability in the function formSetPicListItem. This vulnerability allows attackers to cause a Denial of Service (DoS) via the adItemUID parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-28T16:49:16.000Z
CVE-2022-38565 
Tenda M3 V1.0.0.12(4856) was discovered to contain a heap buffer overflow vulnerability in the function formEmailTest. This vulnerability allows attackers to cause a Denial of Service (DoS) via the mailpwd parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-28T16:48:04.000Z
CVE-2022-38566 
Tenda M3 V1.0.0.12(4856) was discovered to contain a heap buffer overflow vulnerability in the function formEmailTest. This vulnerability allows attackers to cause a Denial of Service (DoS) via the mailname parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-28T16:47:13.000Z
CVE-2022-38567 
Tenda M3 V1.0.0.12(4856) was discovered to contain a stack overflow vulnerability in the function formSetAdConfigInfo. This vulnerability allows attackers to cause a Denial of Service (DoS) via the authIPs parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-28T16:46:04.000Z
CVE-2022-38568 
Tenda M3 V1.0.0.12(4856) was discovered to contain a heap buffer overflow vulnerability in the function formSetFixTools. This vulnerability allows attackers to cause a Denial of Service (DoS) via the hostname parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-28T16:43:16.000Z
CVE-2022-38569 
Tenda M3 V1.0.0.12(4856) was discovered to contain a stack overflow in the function formDelAd.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-28T16:41:09.000Z
CVE-2022-38570 
Tenda M3 V1.0.0.12(4856) was discovered to contain a stack overflow in the function formDelPushedAd. This vulnerability allows attackers to cause a Denial of Service (DoS) via the adPushUID parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-28T16:37:21.000Z
CVE-2022-38571 
Tenda M3 V1.0.0.12(4856) was discovered to contain a buffer overflow in the function formSetGuideListItem.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-28T16:39:52.000Z
CVE-2022-38573 
10-Strike Network Inventory Explorer v9.3 was discovered to contain a buffer overflow via the Add Computers function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-22T23:16:36.000Z
CVE-2022-38576 
Interview Management System v1.0 was discovered to contain a SQL injection vulnerability via the component /interview/delete.php?action=deletecand&id=.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-19T18:39:34.000Z
CVE-2022-38577 
ProcessMaker before v3.5.4 was discovered to contain insecure permissions in the user profile page. This vulnerability allows attackers to escalate normal users to Administrators.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-19T15:45:54.000Z
CVE-2022-38580 
Zalando Skipper v0.13.236 is vulnerable to Server-Side Request Forgery (SSRF).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-24T00:00:00.000Z
CVE-2022-38582 
Incorrect access control in the anti-virus driver wsdkd.sys of Watchdog Antivirus v1.4.158 allows attackers to write arbitrary files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-04T00:00:00.000Z
CVE-2022-38583 
On versions of Sage 300 2017 - 2022 (6.4.x - 6.9.x) which are setup in a "Windows Peer-to-Peer Network" or "Client Server Network" configuration, a low-privileged Sage 300 workstation user could abuse their access to the "SharedData" folder on the connected Sage 300 server to view and/or modify the credentials associated with Sage 300 users and SQL accounts to impersonate users and/or access the SQL database as a system administrator. With system administrator-level access to the Sage 300 MS SQL database it would be possible to create, update, and delete all records associated with the program and, depending on the configuration, execute code on the underlying database server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-28T00:00:00.000Z
CVE-2022-38594 
Church Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/edit_visitor.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-15T01:12:59.000Z
CVE-2022-38595 
Church Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/edit_user.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-15T01:13:00.000Z
CVE-2022-38599 
Teleport v3.2.2, Teleport v3.5.6-rc6, and Teleport v3.6.3-b2 was discovered to contain an information leak via the /user/get-role-list web interface.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-08T00:00:00.000Z
CVE-2022-38600 
Mplayer SVN-r38374-13.0.1 is vulnerable to Memory Leak via vf.c and vf_vo.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-15T15:07:09.000Z
CVE-2022-38604 
Wacom Driver 6.3.46-1 for Windows and lower was discovered to contain an arbitrary file deletion vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-11T00:00:00.000Z
CVE-2022-38605 
Church Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/edit_event.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-12T20:04:29.000Z
CVE-2022-38606 
Garage Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /garage/editcategory.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-12T20:04:31.000Z
CVE-2022-38610 
Garage Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /garage/editclient.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-12T20:04:31.000Z
CVE-2022-38611 
Incorrect access control in Watchdog Anti-Virus v1.4.158 allows attackers to perform a DLL hijacking attack and execute arbitrary code via a crafted binary.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-16T19:17:35.000Z
CVE-2022-38613 
A Path Traversal vulnerability in SmartVista Cardgen v3.28.0 allows authenticated attackers to read arbitrary files in the system.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-09T15:40:44.000Z
CVE-2022-38614 
An issue in the IGB Files and OutfileService features of SmartVista Cardgen v3.28.0 allows attackers to list and download arbitrary files via modifying the PATH parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-09T16:29:01.000Z
CVE-2022-38615 
SmartVista SVFE2 v2.2.22 was discovered to contain multiple SQL injection vulnerabilities via the UserForm:j_id88, UserForm:j_id90, and UserForm:j_id92 parameters at /SVFE2/pages/feegroups/service_group.jsf.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-09T16:22:17.000Z
CVE-2022-38616 
SmartVista SVFE2 v2.2.22 was discovered to contain a SQL injection vulnerability via the UserForm:j_id90 parameter at /feegroups/tgrt_group.jsf.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-13T11:12:40.000Z
CVE-2022-38617 
SmartVista SVFE2 v2.2.22 was discovered to contain a SQL injection vulnerability via the voiceAudit:j_id97 parameter at /SVFE2/pages/audit/voiceaudit.jsf.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-19T12:32:50.000Z
CVE-2022-38618 
SmartVista SVFE2 v2.2.22 was discovered to contain a SQL injection vulnerability via the UserForm:j_id88, UserForm:j_id90, and UserForm:j_id92 parameters at /SVFE2/pages/feegroups/country_group.jsf.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-19T15:22:10.000Z
CVE-2022-38619 
SmartVista SVFE2 v2.2.22 was discovered to contain a SQL injection vulnerability via the UserForm:j_id90 parameter at /SVFE2/pages/feegroups/mcc_group.jsf.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-20T23:59:47.000Z
CVE-2022-38621 
Doufox v0.0.4 was discovered to contain a remote code execution (RCE) vulnerability via the edit file page. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-16T18:36:25.000Z
CVE-2022-38625 
Patlite NH-FB v1.46 and below was discovered to contain insufficient firmware validation during the upgrade firmware file upload process. This vulnerability allows authenticated attackers to create and upload their own custom-built firmware and inject malicious code. NOTE: the vendor's position is that this is a design choice, not a vulnerability
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-29T22:46:15.000Z
CVE-2022-38627 
Nortek Linear eMerge E3-Series 0.32-08f, 0.32-07p, 0.32-07e, 0.32-09c, 0.32-09b, 0.32-09a, and 0.32-08e were discovered to contain a SQL injection vulnerability via the idt parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-01-03T00:00:00.000Z
CVE-2022-38628 
Nortek Linear eMerge E3-Series 0.32-08f, 0.32-07p, 0.32-07e, 0.32-09c, 0.32-09b, 0.32-09a, and 0.32-08e were discovered to contain a cross-site scripting (XSS) vulnerability which is chained with a local session fixation. This vulnerability allows attackers to escalate privileges via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-13T00:00:00.000Z
CVE-2022-38633 
Genymotion Desktop v3.2.1 was discovered to contain a DLL hijacking vulnerability which allows attackers to escalate privileges and execute arbitrary code via a crafted binary.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-13T21:30:23.000Z
CVE-2022-38637 
Hospital Management System v1.0 was discovered to contain multiple SQL injection vulnerabilities via the Username and Password parameters on the Login page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-13T20:36:28.000Z
CVE-2022-38638 
Casdoor v1.97.3 was discovered to contain an arbitrary file write vulnerability via the fullFilePath parameter at /api/upload-resource.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-09T19:40:29.000Z
CVE-2022-38639 
A cross-site scripting (XSS) vulnerability in Markdown-Nice v1.8.22 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Community Posting field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-09T18:49:10.000Z
CVE-2022-38648 PDFTranscoder does not block external resources
Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to fetch external resources. This issue affects Apache XML Graphics Batik 1.14.
Problem types: cwe_id: CWE-918
description: CWE-918 Server-Side Request Forgery (SSRF)
Affected products: vendor: Apache Software Foundation
product: Apache XML Graphics
Published: 2022-09-22T00:00:00.000Z
CVE-2022-38649 Apache Airflow Pinot provider allowed Command Injection
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airflow Pinot Provider, Apache Airflow allows an attacker to control commands executed in the task execution context, without write access to DAG files. This issue affects Apache Airflow Pinot Provider versions prior to 4.0.0. It also impacts any Apache Airflow versions prior to 2.3.0 in case Apache Airflow Pinot Provider is installed (Apache Airflow Pinot Provider 4.0.0 can only be installed for Airflow 2.3.0+). Note that you need to manually install the Pinot Provider version 4.0.0 in order to get rid of the vulnerability on top of Airflow 2.3.0+ version.
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: Apache Software Foundation
product: Apache Airflow Pinot Provider
vendor: Apache Software Foundation
product: Apache Airflow
Credits: lang: en
value: Apache Airflow PMC wants to thank id_No2015429 of 3H Security Team for reporting the issue.
Published: 2022-11-22T00:00:00.000Z
CVE-2022-38650 
A remote unauthenticated insecure deserialization vulnerability exists in VMware Hyperic Server 5.8.6. Exploitation of this vulnerability enables a malicious party to run arbitrary code or malware within Hyperic Server and the host operating system with the privileges of the Hyperic server process. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-12T00:00:00.000Z
CVE-2022-38651 
A security filter misconfiguration exists in VMware Hyperic Server 5.8.6. Exploitation of this vulnerability enables a malicious party to bypass some authentication requirements when issuing requests to Hyperic Server. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-12T00:00:00.000Z
CVE-2022-38652 
A remote insecure deserialization vulnerability exixsts in VMWare Hyperic Agent 5.8.6. Exploitation of this vulnerability enables a malicious authenticated user to run arbitrary code or malware within a Hyperic Agent instance and its host operating system with the privileges of the Hyperic Agent process (often SYSTEM on Windows platforms). NOTE: prior exploitation of CVE-2022-38650 results in the disclosure of the authentication material required to exploit this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-12T00:00:00.000Z
CVE-2022-38653 HCL Digital Experience is susceptible to cross-site scripting (XSS)
In HCL Digital Experience, customized XSS payload can be constructed such that it is served in the application unencoded.

Problem types: description: n/a
Affected products: vendor: HCL Software
product: HCL Digital Experience
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 2
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N
version: 3.1
Published: 2022-12-15T20:56:55.103Z
CVE-2022-38654 HCL Domino is susceptible to an information disclosure vulnerability
HCL Domino is susceptible to an information disclosure vulnerability.  In some scenarios, local calls made on the server to search the Domino directory will ignore xACL read restrictions.  An authenticated attacker could leverage this vulnerability to access attributes from a user's person record.

Problem types: cwe_id: CWE-200
description: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: HCL Software
product: HCL Domino
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2022-11-04T20:19:37.257Z
CVE-2022-38655 HCL BigFix WebUI is affected by a missing-permission-check vulnerability
BigFix WebUI non-master operators are missing controls that prevent them from being able to modify the relevance of fixlets or to deploy fixlets from the BES Support external site. 

Problem types: description: n/a
Affected products: vendor: HCL Software
product: BigFix WebUI
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.4
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L
version: 3.1
Published: 2022-12-20T04:51:01.413Z
CVE-2022-38656 HCL Commerce, when using Elasticsearch, could be affected by a denial of service vulnerability
HCL Commerce, when using Elasticsearch, can allow a remote attacker to cause a denial of service attack on the site and make administrative changes.

Problem types: description: n/a
Affected products: vendor: HCL Software
product: HCL Commerce
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.6
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
version: 3.1
Published: 2022-11-04T20:58:47.868Z
CVE-2022-38657 An open redirect to malicious sites affects HCL Leap
An open redirect to malicious sites can occur when accessing the "Feedback" action on the manager page.

Problem types: description: n/a
Affected products: vendor: HCL Software
product: Leap
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 8.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
version: 3.1
Published: 2023-02-02T21:17:29.565Z
CVE-2022-38658 HCL BigFix Server Automation (SA) is affected by a security vulnerability around Notification Service 
BigFix deployments that have installed the Notification Service on Windows are susceptible to disclosing SMTP BigFix operator's sensitive data in clear text. Operators who use Notification Service related content from BES Support are at risk of leaving their SMTP sensitive data exposed.

Problem types: description: n/a
Affected products: vendor: HCL Software
product: BigFix Server Automation
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.7
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:H
version: 3.1
Published: 2022-12-22T18:52:52.599Z
CVE-2022-38659 HCL BigFix Platform is affected by insecure credential storage
In specific scenarios, on Windows the operator credentials may be encrypted in a manner that is not completely machine-dependent.

Problem types: description: n/a
Affected products: vendor: HCL Software
product: BigFix Platform
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 6
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
version: 3.1
Published: 2022-12-17T18:44:57.327Z
CVE-2022-38660 HCL XPages applications are susceptible to Cross Site Request Forgery (CSRF) vulnerability
HCL XPages applications are susceptible to a Cross Site Request Forgery (CSRF) vulnerability.  An unauthenticated attacker could exploit this vulnerability to perform actions in the application on behalf of the logged in user.  

Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: HCL Software
product: HCL Domino
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 8.3
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L
version: 3.1
Published: 2022-11-04T19:57:02.979Z
CVE-2022-38661 HCL Workload Automation is affected by a vulnerability in Jlog component of the Master Domain Manager
HCL Workload Automation could allow a local user to overwrite key system files which would cause the system to crash.

Problem types: description: n/a
Affected products: vendor: HCL Software
product: HCL Workload Automation
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.2
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2022-11-04T20:47:16.299Z
CVE-2022-38662 HCL Digital Experience is susceptible to open redirects
 In HCL Digital Experience, URLs can be constructed to redirect users to untrusted sites.

Problem types: description: n/a
Affected products: vendor: HCL Software
product: HCL Digital Experience
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Published: 2022-12-15T20:36:54.482Z
CVE-2022-38663 
Jenkins Git Plugin 4.11.4 and earlier does not properly mask (i.e., replace with asterisks) credentials in the build log provided by the Git Username and Password (`gitUsernamePassword`) credentials binding.
Affected products: vendor: Jenkins project
product: Jenkins Git Plugin
Published: 2022-08-23T16:45:16.000Z
CVE-2022-38664 
Jenkins Job Configuration History Plugin 1165.v8cc9fd1f4597 and earlier does not escape the job name on the System Configuration History page, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to configure job names.
Affected products: vendor: Jenkins project
product: Jenkins Job Configuration History Plugin
Published: 2022-08-23T16:45:31.000Z
CVE-2022-38665 
Jenkins CollabNet Plugins Plugin 2.0.8 and earlier stores a RabbitMQ password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.
Affected products: vendor: Jenkins project
product: Jenkins CollabNet Plugins Plugin
Published: 2022-08-23T16:45:45.000Z