rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-25165 
An issue was discovered in Amazon AWS VPN Client 2.0.0. A TOCTOU race condition exists during the validation of VPN configuration files. This allows parameters outside of the AWS VPN Client allow list to be injected into the configuration file prior to the AWS VPN Client service (running as SYSTEM) processing the file. Dangerous arguments can be injected by a low-level user such as log, which allows an arbitrary destination to be specified for writing log files. This leads to an arbitrary file write as SYSTEM with partial control over the files content. This can be abused to cause an elevation of privilege or denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-14T15:19:00.000Z
CVE-2022-25166 
An issue was discovered in Amazon AWS VPN Client 2.0.0. It is possible to include a UNC path in the OpenVPN configuration file when referencing file paths for parameters (such as auth-user-pass). When this file is imported and the client attempts to validate the file path, it performs an open operation on the path and leaks the user's Net-NTLMv2 hash to an external server. This could be exploited by having a user open a crafted malicious ovpn configuration file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-14T15:18:53.000Z
CVE-2022-25167 Apache Flume vulnerable to a JNDI RCE in JMSSource
Apache Flume versions 1.4.0 through 1.9.0 are vulnerable to a remote code execution (RCE) attack when a configuration uses a JMS Source with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI to allow only the use of the java protocol or no protocol.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
cwe_id: CWE-74
description: CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Affected products: vendor: Apache Software Foundation
product: Apache Flume
Published: 2022-06-14T07:55:10.000Z
CVE-2022-25168 Command injection in org.apache.hadoop.fs.FileUtil.unTarUsingTar
Apache Hadoop's FileUtil.unTar(File, File) API does not escape the input file name before being passed to the shell. An attacker can inject arbitrary commands. This is only used in Hadoop 3.3 InMemoryAliasMap.completeBootstrapTransfer, which is only ever run by a local user. It has been used in Hadoop 2.x for yarn localization, which does enable remote code execution. It is used in Apache Spark, from the SQL command ADD ARCHIVE. As the ADD ARCHIVE command adds new binaries to the classpath, being able to execute shell scripts does not confer new permissions to the caller. SPARK-38305. "Check existence of file before untarring/zipping", which is included in 3.3.0, 3.1.4, 3.2.2, prevents shell commands being executed, regardless of which version of the hadoop libraries are in use. Users should upgrade to Apache Hadoop 2.10.2, 3.2.4, 3.3.3 or upper (including HADOOP-18136).
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: Apache Software Foundation
product: Apache Hadoop
Credits: lang: en
value: Apache Hadoop would like to thank Kostya Kortchinsky for reporting this issue.
Published: 2022-08-04T14:30:17.000Z
CVE-2022-25169 Apache Tika BPGParser Memory Usage DoS
The BPG parser in versions of Apache Tika before 1.28.2 and 2.4.0 may allocate an unreasonable amount of memory on carefully crafted files.
Problem types: description: DoS caused by unreasonable memory allocation
Affected products: vendor: Apache Software Foundation
product: Apache Tika
Published: 2022-05-16T17:05:11.000Z
CVE-2022-25170 ICSA-22-055-01 FATEK Automation FvDesigner
The affected product is vulnerable to a stack-based buffer overflow while processing project files, which may allow an attacker to execute arbitrary code
Problem types: cwe_id: CWE-121
description: CWE-121 Stack-based Buffer Overflow
Affected products: vendor: FATEK Automation
product: FvDesigner
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Khangkito of VinCSS and xina1i, working with Trend Micro’s Zero Day initiative, reported these vulnerabilities to CISA.
Published: 2022-02-25T18:10:55.131Z
CVE-2022-25171 Command Injection
The package p4 before 0.0.7 are vulnerable to Command Injection via the run() function due to improper input sanitization
Problem types: description: Command Injection
Affected products: vendor: n/a
product: p4
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitCodeMaturity: PROOF_OF_CONCEPT
remediationLevel: NOT_DEFINED
reportConfidence: NOT_DEFINED
baseScore: 7.4
temporalScore: 7
baseSeverity: HIGH
temporalSeverity: HIGH
Credits: lang: en
value: JHU
Published: 2022-12-21T01:21:43.830Z
CVE-2022-25172 
An information disclosure vulnerability exists in the web interface session cookie functionality of InHand Networks InRouter302 V3.5.4. The session cookie misses the HttpOnly flag, making it accessible via JavaScript and thus allowing an attacker, able to perform an XSS attack, to steal the session cookie.
Problem types: cwe_id: CWE-1004
description: CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag
Affected products: vendor: InHand Networks
product: InRouter302
Published: 2022-05-12T17:01:34.630Z
CVE-2022-25173 
Jenkins Pipeline: Groovy Plugin 2648.va9433432b33c and earlier uses the same checkout directories for distinct SCMs when reading the script file (typically Jenkinsfile) for Pipelines, allowing attackers with Item/Configure permission to invoke arbitrary OS commands on the controller through crafted SCM contents.
Affected products: vendor: Jenkins project
product: Jenkins Pipeline: Groovy Plugin
Published: 2022-02-15T16:10:50.000Z
CVE-2022-25174 
Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier uses the same checkout directories for distinct SCMs for Pipeline libraries, allowing attackers with Item/Configure permission to invoke arbitrary OS commands on the controller through crafted SCM contents.
Affected products: vendor: Jenkins project
product: Jenkins Pipeline: Shared Groovy Libraries Plugin
Published: 2022-02-15T16:10:52.000Z
CVE-2022-25175 
Jenkins Pipeline: Multibranch Plugin 706.vd43c65dec013 and earlier uses the same checkout directories for distinct SCMs for the readTrusted step, allowing attackers with Item/Configure permission to invoke arbitrary OS commands on the controller through crafted SCM contents.
Affected products: vendor: Jenkins project
product: Jenkins Pipeline: Multibranch Plugin
Published: 2022-02-15T00:00:00.000Z
CVE-2022-25176 
Jenkins Pipeline: Groovy Plugin 2648.va9433432b33c and earlier follows symbolic links to locations outside of the checkout directory for the configured SCM when reading the script file (typically Jenkinsfile) for Pipelines, allowing attackers able to configure Pipelines to read arbitrary files on the Jenkins controller file system.
Affected products: vendor: Jenkins project
product: Jenkins Pipeline: Groovy Plugin
Published: 2022-02-15T16:10:55.000Z
CVE-2022-25177 
Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier follows symbolic links to locations outside of the expected Pipeline library when reading files using the libraryResource step, allowing attackers able to configure Pipelines to read arbitrary files on the Jenkins controller file system.
Affected products: vendor: Jenkins project
product: Jenkins Pipeline: Shared Groovy Libraries Plugin
Published: 2022-02-15T16:10:56.000Z
CVE-2022-25178 
Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier does not restrict the names of resources passed to the libraryResource step, allowing attackers able to configure Pipelines permission to read arbitrary files on the Jenkins controller file system.
Affected products: vendor: Jenkins project
product: Jenkins Pipeline: Shared Groovy Libraries Plugin
Published: 2022-02-15T16:10:58.000Z
CVE-2022-25179 
Jenkins Pipeline: Multibranch Plugin 706.vd43c65dec013 and earlier follows symbolic links to locations outside of the checkout directory for the configured SCM when reading files using the readTrusted step, allowing attackers able to configure Pipelines permission to read arbitrary files on the Jenkins controller file system.
Affected products: vendor: Jenkins project
product: Jenkins Pipeline: Multibranch Plugin
Published: 2022-02-15T00:00:00.000Z
CVE-2022-25180 
Jenkins Pipeline: Groovy Plugin 2648.va9433432b33c and earlier includes password parameters from the original build in replayed builds, allowing attackers with Run/Replay permission to obtain the values of password parameters passed to previous builds of a Pipeline.
Affected products: vendor: Jenkins project
product: Jenkins Pipeline: Groovy Plugin
Published: 2022-02-15T16:11:02.000Z
CVE-2022-25181 
A sandbox bypass vulnerability in Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier allows attackers with Item/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM through crafted SCM contents, if a global Pipeline library already exists.
Affected products: vendor: Jenkins project
product: Jenkins Pipeline: Shared Groovy Libraries Plugin
Published: 2022-02-15T16:11:03.000Z
CVE-2022-25182 
A sandbox bypass vulnerability in Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier allows attackers with Item/Configure permission to execute arbitrary code on the Jenkins controller JVM using specially crafted library names if a global Pipeline library is already configured.
Affected products: vendor: Jenkins project
product: Jenkins Pipeline: Shared Groovy Libraries Plugin
Published: 2022-02-15T16:11:05.000Z
CVE-2022-25183 
Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier uses the names of Pipeline libraries to create cache directories without any sanitization, allowing attackers with Item/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM using specially crafted library names if a global Pipeline library configured to use caching already exists.
Affected products: vendor: Jenkins project
product: Jenkins Pipeline: Shared Groovy Libraries Plugin
Published: 2022-02-15T16:11:07.000Z
CVE-2022-25184 
Jenkins Pipeline: Build Step Plugin 2.15 and earlier reveals password parameter default values when generating a pipeline script using the Pipeline Snippet Generator, allowing attackers with Item/Read permission to retrieve the default password parameter value from jobs.
Affected products: vendor: Jenkins project
product: Jenkins Pipeline: Build Step Plugin
Published: 2022-02-15T16:11:08.000Z
CVE-2022-25185 
Jenkins Generic Webhook Trigger Plugin 1.81 and earlier does not escape the build cause when using the webhook, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
Affected products: vendor: Jenkins project
product: Jenkins Generic Webhook Trigger Plugin
Published: 2022-02-15T16:11:10.000Z
CVE-2022-25186 
Jenkins HashiCorp Vault Plugin 3.8.0 and earlier implements functionality that allows agent processes to retrieve any Vault secrets for use on the agent, allowing attackers able to control agent processes to obtain Vault secrets for an attacker-specified path and key.
Affected products: vendor: Jenkins project
product: Jenkins HashiCorp Vault Plugin
Published: 2022-02-15T16:11:11.000Z
CVE-2022-25187 
Jenkins Support Core Plugin 2.79 and earlier does not redact some sensitive information in the support bundle.
Affected products: vendor: Jenkins project
product: Jenkins Support Core Plugin
Published: 2022-02-15T16:11:13.000Z
CVE-2022-25188 
Jenkins Fortify Plugin 20.2.34 and earlier does not sanitize the appName and appVersion parameters of its Pipeline steps, allowing attackers with Item/Configure permission to write or overwrite .xml files on the Jenkins controller file system with content not controllable by the attacker.
Affected products: vendor: Jenkins project
product: Jenkins Fortify Plugin
Published: 2022-02-15T16:11:14.000Z
CVE-2022-25189 
Jenkins Custom Checkbox Parameter Plugin 1.1 and earlier does not escape parameter names of custom checkbox parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
Affected products: vendor: Jenkins project
product: Jenkins Custom Checkbox Parameter Plugin
Published: 2022-02-15T16:11:15.000Z
CVE-2022-25190 
A missing permission check in Jenkins Conjur Secrets Plugin 1.0.11 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
Affected products: vendor: Jenkins project
product: Jenkins Conjur Secrets Plugin
Published: 2022-02-15T16:11:17.000Z
CVE-2022-25191 
Jenkins Agent Server Parameter Plugin 1.0 and earlier does not escape parameter names of agent server parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
Affected products: vendor: Jenkins project
product: Jenkins Agent Server Parameter Plugin
Published: 2022-02-15T16:11:18.000Z
CVE-2022-25192 
A cross-site request forgery (CSRF) vulnerability in Jenkins Snow Commander Plugin 1.10 and earlier allows attackers to connect to an attacker-specified webserver using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Affected products: vendor: Jenkins project
product: Jenkins Snow Commander Plugin
Published: 2022-02-15T16:11:20.000Z
CVE-2022-25193 
Missing permission checks in Jenkins Snow Commander Plugin 1.10 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified webserver using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Affected products: vendor: Jenkins project
product: Jenkins Snow Commander Plugin
Published: 2022-02-15T16:11:21.000Z
CVE-2022-25194 
A cross-site request forgery (CSRF) vulnerability in Jenkins autonomiq Plugin 1.15 and earlier allows attackers to connect to an attacker-specified URL server using attacker-specified credentials.
Affected products: vendor: Jenkins project
product: Jenkins autonomiq Plugin
Published: 2022-02-15T16:11:23.000Z
CVE-2022-25195 
A missing permission check in Jenkins autonomiq Plugin 1.15 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials.
Affected products: vendor: Jenkins project
product: Jenkins autonomiq Plugin
Published: 2022-02-15T16:11:25.000Z
CVE-2022-25196 
Jenkins GitLab Authentication Plugin 1.13 and earlier records the HTTP Referer header as part of the URL query parameters when the authentication process starts, allowing attackers with access to Jenkins to craft a URL that will redirect users to an attacker-specified URL after logging in.
Affected products: vendor: Jenkins project
product: Jenkins GitLab Authentication Plugin
Published: 2022-02-15T16:11:26.000Z
CVE-2022-25197 
Jenkins HashiCorp Vault Plugin 336.v182c0fbaaeb7 and earlier implements functionality that allows agent processes to read arbitrary files on the Jenkins controller file system.
Affected products: vendor: Jenkins project
product: Jenkins HashiCorp Vault Plugin
Published: 2022-02-15T16:11:28.000Z
CVE-2022-25198 
A cross-site request forgery (CSRF) vulnerability in Jenkins SCP publisher Plugin 1.8 and earlier allows attackers to connect to an attacker-specified SSH server using attacker-specified credentials.
Affected products: vendor: Jenkins project
product: Jenkins SCP publisher Plugin
Published: 2022-02-15T16:11:29.000Z
CVE-2022-25199 
A missing permission check in Jenkins SCP publisher Plugin 1.8 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified SSH server using attacker-specified credentials.
Affected products: vendor: Jenkins project
product: Jenkins SCP publisher Plugin
Published: 2022-02-15T16:11:30.000Z
CVE-2022-25200 
A cross-site request forgery (CSRF) vulnerability in Jenkins Checkmarx Plugin 2022.1.2 and earlier allows attackers to connect to an attacker-specified webserver using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Affected products: vendor: Jenkins project
product: Jenkins Checkmarx Plugin
Published: 2022-02-15T16:11:33.000Z
CVE-2022-25201 
Missing permission checks in Jenkins Checkmarx Plugin 2022.1.2 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified webserver using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Affected products: vendor: Jenkins project
product: Jenkins Checkmarx Plugin
Published: 2022-02-15T16:11:34.000Z
CVE-2022-25202 
Jenkins Promoted Builds (Simple) Plugin 1.9 and earlier does not escape the name of custom promotion levels, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Overall/Administer permission.
Affected products: vendor: Jenkins project
product: Jenkins Promoted Builds (Simple) Plugin
Published: 2022-02-15T16:11:36.000Z
CVE-2022-25203 
Jenkins Team Views Plugin 0.9.0 and earlier does not escape team names, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Overall/Read permission.
Affected products: vendor: Jenkins project
product: Jenkins Team Views Plugin
Published: 2022-02-15T16:11:37.000Z
CVE-2022-25204 
Jenkins Doktor Plugin 0.4.1 and earlier implements functionality that allows agent processes to render files on the controller as Markdown or Asciidoc, and error messages allow attackers able to control agent processes to determine whether a file with a given name exists.
Affected products: vendor: Jenkins project
product: Jenkins Doktor Plugin
Published: 2022-02-15T16:11:39.000Z
CVE-2022-25205 
A cross-site request forgery (CSRF) vulnerability in Jenkins dbCharts Plugin 0.5.2 and earlier allows attackers to connect to an attacker-specified database via JDBC using attacker-specified credentials and to determine if a class is available in the Jenkins instance.
Affected products: vendor: Jenkins project
product: Jenkins dbCharts Plugin
Published: 2022-02-15T16:11:41.000Z
CVE-2022-25206 
A missing check in Jenkins dbCharts Plugin 0.5.2 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified database via JDBC using attacker-specified credentials.
Affected products: vendor: Jenkins project
product: Jenkins dbCharts Plugin
Published: 2022-02-15T16:11:42.000Z
CVE-2022-25207 
A cross-site request forgery (CSRF) vulnerability in Jenkins Chef Sinatra Plugin 1.20 and earlier allows attackers to have Jenkins send an HTTP request to an attacker-controlled URL and have it parse an XML response.
Affected products: vendor: Jenkins project
product: Jenkins Chef Sinatra Plugin
Published: 2022-02-15T16:11:43.000Z
CVE-2022-25208 
A missing permission check in Jenkins Chef Sinatra Plugin 1.20 and earlier allows attackers with Overall/Read permission to have Jenkins send an HTTP request to an attacker-controlled URL and have it parse an XML response.
Affected products: vendor: Jenkins project
product: Jenkins Chef Sinatra Plugin
Published: 2022-02-15T16:11:45.000Z
CVE-2022-25209 
Jenkins Chef Sinatra Plugin 1.20 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
Affected products: vendor: Jenkins project
product: Jenkins Chef Sinatra Plugin
Published: 2022-02-15T16:11:46.000Z
CVE-2022-25210 
Jenkins Convertigo Mobile Platform Plugin 1.1 and earlier uses static fields to store job configuration information, allowing attackers with Item/Configure permission to capture passwords of the jobs that will be configured.
Affected products: vendor: Jenkins project
product: Jenkins Convertigo Mobile Platform Plugin
Published: 2022-02-15T16:11:48.000Z
CVE-2022-25211 
A missing permission check in Jenkins SWAMP Plugin 1.2.6 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified web server using attacker-specified credentials.
Affected products: vendor: Jenkins project
product: Jenkins SWAMP Plugin
Published: 2022-02-15T16:11:49.000Z
CVE-2022-25212 
A cross-site request forgery (CSRF) vulnerability in Jenkins SWAMP Plugin 1.2.6 and earlier allows attackers to connect to an attacker-specified web server using attacker-specified credentials.
Affected products: vendor: Jenkins project
product: Jenkins SWAMP Plugin
Published: 2022-02-15T16:11:51.000Z
CVE-2022-25213 
Improper physical access control and use of hard-coded credentials in /etc/passwd permits an attacker with physical access to obtain a root shell via an unprotected UART port on the device. The same port exposes an unauthenticated Das U-Boot BIOS shell.
Problem types: description: Improper physical access control
Affected products: vendor: n/a
product: Phicomm Routers
Published: 2022-03-07T21:55:25.000Z
CVE-2022-25214 
Improper access control on the LocalClientList.asp interface allows an unauthenticated remote attacker to obtain sensitive information concerning devices on the local area network, including IP and MAC addresses. Improper access control on the wirelesssetup.asp interface allows an unauthenticated remote attacker to obtain the WPA passphrases for the 2.4GHz and 5.0GHz wireless networks. This is particularly dangerous given that the K2G setup wizard presents the user with the option of using the same password for the 2.4Ghz network and the administrative interface, by clicking a checkbox. When Remote Managment is enabled, these endpoints are exposed to the WAN.
Problem types: description: Improper access control leading to information leaks
Affected products: vendor: n/a
product: Phicomm Routers
Published: 2022-03-07T21:47:00.000Z
CVE-2022-25215 
Improper access control on the LocalMACConfig.asp interface allows an unauthenticated remote attacker to add (or remove) client MAC addresses to (or from) a list of banned hosts. Clients with those MAC addresses are then prevented from accessing either the WAN or the router itself.
Problem types: description: Improper access control leading to denial of service
Affected products: vendor: n/a
product: Phicomm Routers
Published: 2022-03-07T21:53:11.000Z
CVE-2022-25216 
An absolute path traversal vulnerability allows a remote attacker to download any file on the Windows file system for which the user account running DVDFab 12 Player (recently renamed PlayerFab) has read-access, by means of an HTTP GET request to http://<IP_ADDRESS>:32080/download/<URL_ENCODED_PATH>.
Problem types: description: Path traversal
Affected products: vendor: n/a
product: DVDFab 12 Player / PlayerFab
Published: 2022-03-11T17:54:38.000Z