rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-46694 
An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in iOS 16.2 and iPadOS 16.2, iOS 15.7.2 and iPadOS 15.7.2, tvOS 16.2, watchOS 9.2. Parsing a maliciously crafted video file may lead to kernel code execution.
Problem types: description: Parsing a maliciously crafted video file may lead to kernel code execution
Affected products: vendor: Apple
product: tvOS
vendor: Apple
product: tvOS
vendor: Apple
product: tvOS
vendor: Apple
product: watchOS
Published: 2022-12-15T00:00:00.000Z
CVE-2022-46695 
A spoofing issue existed in the handling of URLs. This issue was addressed with improved input validation. This issue is fixed in tvOS 16.2, macOS Ventura 13.1, iOS 15.7.2 and iPadOS 15.7.2, iOS 16.2 and iPadOS 16.2, watchOS 9.2. Visiting a website that frames malicious content may lead to UI spoofing.
Problem types: description: Visiting a website that frames malicious content may lead to UI spoofing
Affected products: vendor: Apple
product: tvOS
vendor: Apple
product: tvOS
vendor: Apple
product: tvOS
vendor: Apple
product: tvOS
vendor: Apple
product: watchOS
Published: 2022-12-15T00:00:00.000Z
CVE-2022-46696 
A memory corruption issue was addressed with improved input validation. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 16.2 and iPadOS 16.2, watchOS 9.2. Processing maliciously crafted web content may lead to arbitrary code execution.
Problem types: description: Processing maliciously crafted web content may lead to arbitrary code execution
Affected products: vendor: Apple
product: tvOS
vendor: Apple
product: tvOS
vendor: Apple
product: tvOS
vendor: Apple
product: watchOS
vendor: Apple
product: watchOS
Published: 2022-12-15T00:00:00.000Z
CVE-2022-46697 
An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in macOS Ventura 13.1. An app may be able to execute arbitrary code with kernel privileges.
Problem types: description: An app may be able to execute arbitrary code with kernel privileges
Affected products: vendor: Apple
product: macOS
Published: 2022-12-15T00:00:00.000Z
CVE-2022-46698 
A logic issue was addressed with improved checks. This issue is fixed in Safari 16.2, tvOS 16.2, iCloud for Windows 14.1, macOS Ventura 13.1, iOS 16.2 and iPadOS 16.2, watchOS 9.2. Processing maliciously crafted web content may disclose sensitive user information.
Problem types: description: Processing maliciously crafted web content may disclose sensitive user information
Affected products: vendor: Apple
product: iCloud for Windows
vendor: Apple
product: tvOS
vendor: Apple
product: tvOS
vendor: Apple
product: tvOS
vendor: Apple
product: watchOS
vendor: Apple
product: watchOS
Published: 2022-12-15T00:00:00.000Z
CVE-2022-46699 
A memory corruption issue was addressed with improved state management. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 16.2 and iPadOS 16.2, watchOS 9.2. Processing maliciously crafted web content may lead to arbitrary code execution.
Problem types: description: Processing maliciously crafted web content may lead to arbitrary code execution
Affected products: vendor: Apple
product: tvOS
vendor: Apple
product: tvOS
vendor: Apple
product: tvOS
vendor: Apple
product: watchOS
vendor: Apple
product: watchOS
Published: 2022-12-15T00:00:00.000Z
CVE-2022-46700 
A memory corruption issue was addressed with improved input validation. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 15.7.2 and iPadOS 15.7.2, iOS 16.2 and iPadOS 16.2, watchOS 9.2. Processing maliciously crafted web content may lead to arbitrary code execution.
Problem types: description: Processing maliciously crafted web content may lead to arbitrary code execution
Affected products: vendor: Apple
product: tvOS
vendor: Apple
product: tvOS
vendor: Apple
product: tvOS
vendor: Apple
product: tvOS
vendor: Apple
product: watchOS
vendor: Apple
product: watchOS
Published: 2022-12-15T00:00:00.000Z
CVE-2022-46701 
The issue was addressed with improved bounds checks. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Ventura 13.1, tvOS 16.2. Connecting to a malicious NFS server may lead to arbitrary code execution with kernel privileges.
Problem types: description: Connecting to a malicious NFS server may lead to arbitrary code execution with kernel privileges
Affected products: vendor: Apple
product: tvOS
vendor: Apple
product: tvOS
vendor: Apple
product: tvOS
Published: 2022-12-15T00:00:00.000Z
CVE-2022-46702 
The issue was addressed with improved memory handling. This issue is fixed in iOS 16.2 and iPadOS 16.2. An app may be able to disclose kernel memory.
Problem types: description: An app may be able to disclose kernel memory
Affected products: vendor: Apple
product: iOS and iPadOS
Published: 2022-12-15T00:00:00.000Z
CVE-2022-46703 
A logic issue was addressed with improved restrictions. This issue is fixed in iOS 15.7.2 and iPadOS 15.7.2, macOS Ventura 13.1, iOS 16.2 and iPadOS 16.2. An app may be able to read sensitive location information
Problem types: description: An app may be able to read sensitive location information
Affected products: vendor: Apple
product: macOS
vendor: Apple
product: macOS
vendor: Apple
product: macOS
Published: 2023-04-10T00:00:00.000Z
CVE-2022-46704 
A logic issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.1, macOS Big Sur 11.7.2, macOS Monterey 12.6.2. An app may be able to modify protected parts of the file system.
Problem types: description: An app may be able to modify protected parts of the file system
Affected products: vendor: Apple
product: macOS
vendor: Apple
product: macOS
vendor: Apple
product: macOS
Published: 2023-02-27T00:00:00.000Z
CVE-2022-46705 
A spoofing issue existed in the handling of URLs. This issue was addressed with improved input validation. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Ventura 13.1, Safari 16.2. Visiting a malicious website may lead to address bar spoofing.
Problem types: description: Visiting a malicious website may lead to address bar spoofing
Affected products: vendor: Apple
product: macOS
vendor: Apple
product: macOS
vendor: Apple
product: macOS
Published: 2023-02-27T00:00:00.000Z
CVE-2022-46706 
A type confusion issue was addressed with improved state handling. This issue is fixed in Security Update 2022-003 Catalina, macOS Monterey 12.3, macOS Big Sur 11.6.5. An application may be able to execute arbitrary code with kernel privileges.
Problem types: description: An application may be able to execute arbitrary code with kernel privileges
Affected products: vendor: Apple
product: macOS
vendor: Apple
product: Security Update - Catalina
vendor: Apple
product: macOS
Published: 2023-08-14T22:40:43.228Z
CVE-2022-46709 
A memory corruption issue was addressed with improved state management. This issue is fixed in macOS Ventura 13, iOS 16. An app may be able to execute arbitrary code with kernel privileges
Problem types: description: An app may be able to execute arbitrary code with kernel privileges
Affected products: vendor: Apple
product: macOS
vendor: Apple
product: macOS
Published: 2023-04-10T00:00:00.000Z
CVE-2022-46710 
A logic issue was addressed with improved checks. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Ventura 13.1. Location data may be shared via iCloud links even if Location metadata is disabled via the Share Sheet.
Problem types: description: Location data may be shared via iCloud links even if Location metadata is disabled via the Share Sheet
Affected products: vendor: Apple
product: macOS
vendor: Apple
product: iOS and iPadOS
Published: 2024-01-10T22:03:37.235Z
CVE-2022-46712 
A use after free issue was addressed with improved memory management. This issue is fixed in macOS Ventura 13. An app may be able to cause unexpected system termination or potentially execute code with kernel privileges.
Problem types: description: An app may be able to cause unexpected system termination or potentially execute code with kernel privileges
Affected products: vendor: Apple
product: macOS
Published: 2023-02-27T00:00:00.000Z
CVE-2022-46713 
A race condition was addressed with additional validation. This issue is fixed in macOS Ventura 13, macOS Monterey 12.6.1, macOS Big Sur 11.7.1. An app may be able to modify protected parts of the file system.
Problem types: description: An app may be able to modify protected parts of the file system
Affected products: vendor: Apple
product: macOS
vendor: Apple
product: macOS
vendor: Apple
product: macOS
Published: 2023-02-27T00:00:00.000Z
CVE-2022-46715 
A logic issue was addressed with improved checks. This issue is fixed in iOS 16.1 and iPadOS 16. An app may be able to bypass certain Privacy preferences
Problem types: description: An app may be able to bypass certain Privacy preferences
Affected products: vendor: Apple
product: iOS and iPadOS
Published: 2023-06-23T00:00:00.000Z
CVE-2022-46716 
A logic issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.1, iOS 16.2 and iPadOS 16.2. Private Relay functionality did not match system settings
Problem types: description: Private Relay functionality did not match system settings
Affected products: vendor: Apple
product: macOS
vendor: Apple
product: macOS
Published: 2023-04-10T00:00:00.000Z
CVE-2022-46717 
A logic issue was addressed with improved restrictions. This issue is fixed in iOS 16.2 and iPadOS 16.2. A user with physical access to a locked Apple Watch may be able to view user photos via accessibility features
Problem types: description: A user with physical access to a locked Apple Watch may be able to view user photos via accessibility features
Affected products: vendor: Apple
product: iOS and iPadOS
Published: 2023-04-10T00:00:00.000Z
CVE-2022-46718 
A logic issue was addressed with improved restrictions. This issue is fixed in iOS 15.7.2 and iPadOS 15.7.2, macOS Ventura 13.1, macOS Big Sur 11.7.2, macOS Monterey 12.6.2. An app may be able to read sensitive location information
Problem types: description: An app may be able to read sensitive location information
Affected products: vendor: Apple
product: macOS
vendor: Apple
product: macOS
vendor: Apple
product: macOS
vendor: Apple
product: macOS
Published: 2023-06-23T00:00:00.000Z
CVE-2022-46720 
An integer overflow was addressed with improved input validation. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Ventura 13.1. An app may be able to break out of its sandbox
Problem types: description: An app may be able to break out of its sandbox
Affected products: vendor: Apple
product: macOS
vendor: Apple
product: macOS
Published: 2023-05-08T00:00:00.000Z
CVE-2022-46721 
The issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13. An app may be able to execute arbitrary code with kernel privileges.
Problem types: description: An app may be able to execute arbitrary code with kernel privileges
Affected products: vendor: Apple
product: macOS
Published: 2024-01-10T22:03:33.924Z
CVE-2022-46722 
A logic issue was addressed with improved checks. This issue is fixed in macOS Ventura 13. An app may be able to modify protected parts of the file system.
Problem types: description: An app may be able to modify protected parts of the file system
Affected products: vendor: Apple
product: macOS
Published: 2023-08-14T22:40:33.623Z
CVE-2022-46723 
This issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.6.1, macOS Big Sur 11.7.1. A remote user may be able to write arbitrary files.
Problem types: description: A remote user may be able to write arbitrary files
Affected products: vendor: Apple
product: macOS
vendor: Apple
product: macOS
Published: 2023-02-27T00:00:00.000Z
CVE-2022-46724 
This issue was addressed by restricting options offered on a locked device. This issue is fixed in iOS 16.4 and iPadOS 16.4. A person with physical access to an iOS device may be able to view the last image used in Magnifier from the lock screen.
Problem types: description: A person with physical access to an iOS device may be able to view the last image used in Magnifier from the lock screen
Affected products: vendor: Apple
product: iOS and iPadOS
Published: 2023-08-14T22:40:29.303Z
CVE-2022-46725 
A spoofing issue existed in the handling of URLs. This issue was addressed with improved input validation. This issue is fixed in iOS 16.4 and iPadOS 16.4. Visiting a malicious website may lead to address bar spoofing.
Problem types: description: Visiting a malicious website may lead to address bar spoofing
Affected products: vendor: Apple
product: iOS and iPadOS
Published: 2023-08-14T22:40:31.532Z
CVE-2022-46732 CVE-2022-46732
Even if the authentication fails for local service authentication, the requested command could still execute regardless of authentication status.
Problem types: description: CWE-288
Affected products: vendor: GE Digital
product: Proficy Historian
Published: 2023-01-17T23:31:14.972Z
CVE-2022-46733 CVE-2022-46733
Sewio’s Real-Time Location System (RTLS) Studio version 2.0.0 up to and including version 2.6.2 is vulnerable to cross-site scripting in its backup services. An attacker could take advantage of this vulnerability to execute arbitrary commands.


Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Sewio
product: RTLS Studio
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Andrea Palanca of Nozomi Networks
Published: 2023-01-18T00:43:45.382Z
CVE-2022-46738 CVE-2022-46738
The affected product exposes multiple sensitive data fields of the affected product. An attacker can use the SNMP command to get device mac address and login as admin.
Problem types: description: CWE-1391 Use of Weak Credentials
Affected products: vendor: Dataprobe, Inc.
product: Dataprobe iBoot-PDU FW
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: LOW
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L
baseScore: 7.2
baseSeverity: HIGH
Published: 2023-05-22T22:36:40.682Z
CVE-2022-46740 
There is a denial of service vulnerability in the Wi-Fi module of the HUAWEI WS7100-20 Smart WiFi Router.Successful exploit could cause a denial of service (DoS) condition.
Problem types: description: Denial of Service
Affected products: vendor: Huawei
product: WS7100-20
Published: 2022-12-28T00:00:00.000Z
CVE-2022-46741 
Out-of-bounds read in gather_tree in PaddlePaddle before 2.4. 
Problem types: cwe_id: CWE-125
description: CWE-125 Out-of-bounds Read
Affected products: vendor: PaddlePaddle
product: PaddlePaddle
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
version: 3.1
Published: 2022-12-07T07:41:04.470Z
CVE-2022-46742 
Code injection in paddle.audio.functional.get_window in PaddlePaddle 2.4.0-rc0 allows arbitrary code execution.

Problem types: cwe_id: CWE-94
description: CWE-94 Improper Control of Generation of Code ('Code Injection')
Affected products: vendor: PaddlePaddle
product: PaddlePaddle
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 10
baseSeverity: CRITICAL
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H
version: 3.1
Published: 2022-12-07T08:16:09.365Z
CVE-2022-46751 Apache Ivy: XML External Entity vulnerability in Apache Ivy
Improper Restriction of XML External Entity Reference, XML Injection (aka Blind XPath Injection) vulnerability in Apache Software Foundation Apache Ivy.This issue affects any version of Apache Ivy prior to 2.5.2.

When Apache Ivy prior to 2.5.2 parses XML files - either its own configuration, Ivy files or Apache Maven POMs - it will allow downloading external document type definitions and expand any entity references contained therein when used.

This can be used to exfiltrate data, access resources only the machine running Ivy has access to or disturb the execution of Ivy in different ways.

Starting with Ivy 2.5.2 DTD processing is disabled by default except when parsing Maven POMs where the default is to allow DTD processing but only to include a DTD snippet shipping with Ivy that is needed to deal with existing Maven POMs that are not valid XML files but are nevertheless accepted by Maven. Access can be be made more lenient via newly introduced system properties where needed.

Users of Ivy prior to version 2.5.2 can use Java system properties to restrict processing of external DTDs, see the section about "JAXP Properties for External Access restrictions" inside Oracle's "Java API for XML Processing (JAXP) Security Guide".
Problem types: cwe_id: CWE-611
description: CWE-611 Improper Restriction of XML External Entity Reference
cwe_id: CWE-91
description: CWE-91 XML Injection (aka Blind XPath Injection)
Affected products: vendor: Apache Software Foundation
product: Apache Ivy
default_status: unaffected
Credits: lang: en
value: CC Bomber, Kitri BoB
lang: en
value: Jenkins Security Team
Published: 2023-08-21T06:55:00.181Z
CVE-2022-46752 

Dell BIOS contains an Improper Authorization vulnerability. An unauthenticated physical attacker may potentially exploit this vulnerability, leading to denial of service.


Problem types: cwe_id: CWE-285
description: CWE-285: Improper Authorization
Affected products: vendor: Dell
product: CPG BIOS
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: PHYSICAL
availabilityImpact: HIGH
baseScore: 4.6
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2023-03-08T16:51:55.033Z
CVE-2022-46754 

Wyse Management Suite 3.8 and below contain an improper access control vulnerability. A authenticated malicious admin user might access certain pro license features for which this admin is not authorized in order to configure user controlled external entities.






Problem types: cwe_id: CWE-284
description: CWE-284: Improper Access Control
Affected products: vendor: Dell
product: Wyse Management Suite
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 8.7
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
version: 3.1
Published: 2023-02-10T21:25:19.476Z
CVE-2022-46755 

Wyse Management Suite 3.8 and below contain an improper access control vulnerability. A authenticated malicious admin user can edit general client policy for which the user is not authorized.






Problem types: cwe_id: CWE-284
description: CWE-284: Improper Access Control
Affected products: vendor: Dell
product: Wyse Management Suite
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 4.9
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2023-02-10T21:22:15.642Z
CVE-2022-46756 

Dell VxRail, versions prior to 7.0.410, contain a Container Escape Vulnerability. A local high-privileged attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the container's underlying OS. Exploitation may lead to a system take over by an attacker.






Problem types: cwe_id: CWE-668
description: CWE-668: Exposure of Resource to Wrong Sphere
Affected products: vendor: Dell
product: VxRail HCI
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 8.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Published: 2023-02-01T05:37:17.789Z
CVE-2022-46761 
The system has a vulnerability that may cause dynamic hiding and restoring of app icons.Successful exploitation of this vulnerability may cause malicious hiding of app icons.
Problem types: description: Configuration Defects
Affected products: vendor: Huawei
product: HarmonyOS
vendor: Huawei
product: EMUI
Published: 2023-01-06T00:00:00.000Z
CVE-2022-46762 
The memory management module has a logic bypass vulnerability.Successful exploitation of this vulnerability may affect data confidentiality.
Problem types: description: Logic bypass vulnerability
Affected products: vendor: Huawei
product: HarmonyOS
vendor: Huawei
product: EMUI
Published: 2023-01-06T00:00:00.000Z
CVE-2022-46763 
A SQL injection issue in a database stored function in TrueConf Server 5.2.0.10225 (fixed in 5.2.6.10025) allows a low-privileged database user to execute arbitrary SQL commands as the database administrator, resulting in execution of arbitrary code.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: TrueConf
product: TrueConf Server
default_status: unknown
CVSS v3.1: version: 3.1
baseScore: 8.8
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Published: 2022-12-27T00:00:00.000Z
CVE-2022-46764 
A SQL injection issue in the web API in TrueConf Server 5.2.0.10225 (fixed in 5.2.6.10025) allows remote unauthenticated attackers to execute arbitrary SQL commands, ultimately leading to remote code execution.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: TrueConf
product: TrueConf Server
default_status: unknown
CVSS v3.1: version: 3.1
baseScore: 9.8
baseSeverity: CRITICAL
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published: 2022-12-27T00:00:00.000Z
CVE-2022-46768 File name information disclosure vulnerability in Zabbix Web Service Report Generation
Arbitrary file read vulnerability exists in Zabbix Web Service Report Generation, which listens on the port 10053. The service does not have proper validation for URL parameters before reading the files.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Zabbix
product: Web Service Report Generation
vendor: Zabbix
product: Zabbix agent 2 (MSI packages)
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
baseScore: 5.9
baseSeverity: MEDIUM
Credits: lang: en
value: Trend Micro ZDI
Published: 2022-12-19T10:00:14.221Z
CVE-2022-46769 Apache Sling App CMS: XSS in CMS Site Group Detail
An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability in Sling App CMS version 1.1.2 and prior may allow an authenticated remote attacker to perform a reflected cross-site scripting (XSS) attack in the site group feature.

Upgrade to Apache Sling App CMS >= 1.1.4 

Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Apache Software Foundation
product: Apache Sling App CMS
default_status: unaffected
Credits: lang: en
value: Apache Sling would like to thank Sam Bagheri for reporting this issue
Published: 2023-01-09T10:14:56.823Z