rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-22812 
A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause a web session compromise when an attacker injects and then executes arbitrary malicious JavaScript code inside the target browser. Affected Product: spaceLYnk (V2.6.2 and prior), Wiser for KNX (formerly homeLYnk) (V2.6.2 and prior), fellerLYnk (V2.6.2 and prior)
Problem types: cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: n/a
product: spaceLYnk (V2.6.2 and prior), Wiser for KNX (formerly homeLYnk) (V2.6.2 and prior), fellerLYnk (V2.6.2 and prior)
Published: 2022-02-09T22:05:09.000Z
CVE-2022-22813 
A CWE-798: Use of Hard-coded Credentials vulnerability exists. If an attacker were to obtain the TLS cryptographic key and take active control of the Courier tunneling communication network, they could potentially observe and manipulate traffic associated with product configuration.
Problem types: cwe_id: CWE-798
description: CWE-798: Use of Hard-coded Credentials
Affected products: vendor: n/a
product: Easergy P40 Series model numbers with Ethernet option bit as Q, R, S (All PX4X firmware Versions)
Published: 2022-02-09T22:05:06.000Z
CVE-2022-22814 
The System Diagnosis service of MyASUS before 3.1.2.0 allows privilege escalation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-10T15:17:13.000Z
CVE-2022-22815 
path_getbbox in path.c in Pillow before 9.0.0 improperly initializes ImagePath.Path.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-07T00:00:00.000Z
CVE-2022-22816 
path_getbbox in path.c in Pillow before 9.0.0 has a buffer over-read during initialization of ImagePath.Path.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-07T00:00:00.000Z
CVE-2022-22817 
PIL.ImageMath.eval in Pillow before 9.0.0 allows evaluation of arbitrary expressions, such as ones that use the Python exec method. A lambda expression could also be used.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-07T00:00:00.000Z
CVE-2022-22818 
The {% debug %} template tag in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2 does not properly encode the current context. This may lead to XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-03T00:00:00.000Z
CVE-2022-22819 
NXP LPC55S66JBD64, LPC55S66JBD100, LPC55S66JEV98, LPC55S69JBD64, LPC55S69JBD100, and LPC55S69JEV98 microcontrollers (ROM version 1B) have a buffer overflow in parsing SB2 updates before the signature is verified. This can allow an attacker to achieve non-persistent code execution via a crafted unsigned update.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-23T21:13:46.000Z
CVE-2022-22820 
Due to the lack of media file checks before rendering, it was possible for an attacker to cause abnormal CPU consumption for message recipient by sending specially crafted gif image in LINE for Windows before 7.4.
Problem types: description: n/a
Affected products: vendor: LINE Corporation
product: LINE for Windows
Published: 2022-01-20T11:47:43.000Z
CVE-2022-22821 
NVIDIA NeMo before 1.6.0 contains a vulnerability in ASR WebApp, in which ../ Path Traversal may lead to deletion of any directory when admin privileges are available.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 2
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AC:L/AV:L/A:N/C:N/I:L/PR:H/S:U/UI:R
version: 3.1
Published: 2022-01-08T02:35:18.000Z
CVE-2022-22822 
addBinding in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-08T02:57:15.000Z
CVE-2022-22823 
build_model in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-08T02:57:07.000Z
CVE-2022-22824 
defineAttribute in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-08T02:56:58.000Z
CVE-2022-22825 
lookup in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-08T02:56:48.000Z
CVE-2022-22826 
nextScaffoldPart in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-08T02:56:39.000Z
CVE-2022-22827 
storeAtts in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-08T02:56:30.000Z
CVE-2022-22828 
An insecure direct object reference for the file-download URL in Synametrics SynaMan before 5.0 allows a remote attacker to access unshared files via a modified base64-encoded filename string.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-27T05:41:02.000Z
CVE-2022-22831 
An issue was discovered in Servisnet Tessa 0.0.2. An attacker can add a new sysadmin user via a manipulation of the Authorization HTTP header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-06T20:53:50.000Z
CVE-2022-22832 
An issue was discovered in Servisnet Tessa 0.0.2. Authorization data is available via an unauthenticated /data-service/users/ request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-06T20:54:53.000Z
CVE-2022-22833 
An issue was discovered in Servisnet Tessa 0.0.2. An attacker can obtain sensitive information via a /js/app.js request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-06T21:11:02.000Z
CVE-2022-22834 
An issue was discovered in OverIT Geocall before 8.0. An authenticated user who has the Test Trasformazione XSL functionality enabled can exploit a XSLT Injection vulnerability. Attackers could exploit this issue to achieve remote code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-07T20:52:17.000Z
CVE-2022-22835 
An issue was discovered in OverIT Geocall before version 8.0. An authenticated user who has the Test Trasformazione XSL functionality enabled can exploit a XXE vulnerability to read arbitrary files from the filesystem.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-07T20:48:20.000Z
CVE-2022-22836 
CoreFTP Server before 727 allows directory traversal (for file creation) by an authenticated attacker via ../ in an HTTP PUT request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-08T22:30:11.000Z
CVE-2022-22844 
LibTIFF 4.3.0 has an out-of-bounds read in _TIFFmemcpy in tif_unix.c in certain situations involving a custom tag and 0x0200 as the second word of the DE field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-08T00:00:00.000Z
CVE-2022-22845 
QXIP SIPCAPTURE homer-app before 1.4.28 for HOMER 7.x has the same 167f0db2-f83e-4baa-9736-d56064a5b415 JWT secret key across different customers' installations.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-09T15:03:39.000Z
CVE-2022-22846 
The dnslib package through 0.9.16 for Python does not verify that the ID value in a DNS reply matches an ID value in a query.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AC:L/AV:N/A:N/C:N/I:H/PR:N/S:U/UI:N
version: 3.1
Published: 2022-01-09T00:49:30.000Z
CVE-2022-22847 
Formpipe Lasernet before 9.13.3 allows file inclusion in Client Web Services (either by an authenticated attacker, or in a configuration that does not require authentication).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-10T06:02:23.000Z
CVE-2022-22850 
A Stored Cross Site Scripting (XSS) vulnerability exists in Sourcecodtester Hospital's Patient Records Management System 1.0 via the description parameter in room_types.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-26T18:31:00.000Z
CVE-2022-22851 
A Stored Cross Site Scripting (XSS) vulnerability exists in Sourcecodtester Hospital's Patient Records Management System 1.0 via the specialization parameter in doctors.php
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-26T15:58:58.000Z
CVE-2022-22852 
A Stored Cross Site Scripting (XSS) vulnerability exists in Sourcecodtester Hospital's Patient Records Management System 1.0 via the description parameter in room_list.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-26T19:07:18.000Z
CVE-2022-22853 
A stored cross-site scripting (XSS) vulnerability in Hospital Patient Record Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload inserted into the Name field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-16T17:12:41.000Z
CVE-2022-22854 
An access control issue in hprms/admin/?page=user/list of Hospital Patient Record Management System v1.0 allows attackers to escalate privileges via accessing and editing the user list.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-14T17:11:14.000Z
CVE-2022-22868 
Gibbon CMS v22.0.01 was discovered to contain a cross-site scripting (XSS) vulnerability, that allows attackers to inject arbitrary script via name parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-28T18:10:42.000Z
CVE-2022-22880 
Jeecg-boot v3.0 was discovered to contain a SQL injection vulnerability via the code parameter in /jeecg-boot/sys/user/queryUserByDepId.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-16T21:42:08.000Z
CVE-2022-22881 
Jeecg-boot v3.0 was discovered to contain a SQL injection vulnerability via the code parameter in /sys/user/queryUserComponentData.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-16T21:42:08.000Z
CVE-2022-22885 
Hutool v5.7.18's HttpRequest was discovered to ignore all TLS/SSL certificate validation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-16T21:56:16.000Z
CVE-2022-22888 
Jerryscript 3.0.0 was discovered to contain a stack overflow via ecma_op_object_find_own in /ecma/operations/ecma-objects.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-20T22:16:43.000Z
CVE-2022-22890 
There is an Assertion 'arguments_type != SCANNER_ARGUMENTS_PRESENT && arguments_type != SCANNER_ARGUMENTS_PRESENT_NO_REG' failed at /jerry-core/parser/js/js-scanner-util.c in Jerryscript 3.0.0.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-20T22:16:46.000Z
CVE-2022-22891 
Jerryscript 3.0.0 was discovered to contain a SEGV vulnerability via ecma_ref_object_inline in /jerry-core/ecma/base/ecma-gc.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-20T23:04:22.000Z
CVE-2022-22892 
There is an Assertion 'ecma_is_value_undefined (value) || ecma_is_value_null (value) || ecma_is_value_boolean (value) || ecma_is_value_number (value) || ecma_is_value_string (value) || ecma_is_value_bigint (value) || ecma_is_value_symbol (value) || ecma_is_value_object (value)' failed at jerry-core/ecma/base/ecma-helpers-value.c in Jerryscripts 3.0.0.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-20T23:04:22.000Z
CVE-2022-22893 
Jerryscript 3.0.0 was discovered to contain a stack overflow via vm_loop.lto_priv.304 in /jerry-core/vm/vm.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-20T23:04:23.000Z
CVE-2022-22894 
Jerryscript 3.0.0 was discovered to contain a stack overflow via ecma_lcache_lookup in /jerry-core/ecma/base/ecma-lcache.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-20T23:04:24.000Z
CVE-2022-22895 
Jerryscript 3.0.0 was discovered to contain a heap-buffer-overflow via ecma_utf8_string_to_number_by_radix in /jerry-core/ecma/base/ecma-helpers-conversion.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-20T23:04:25.000Z
CVE-2022-22897 
A SQL injection vulnerability in the product_all_one_img and image_product parameters of the ApolloTheme AP PageBuilder component through 2.4.4 for PrestaShop allows unauthenticated attackers to exfiltrate database data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-29T00:00:00.000Z
CVE-2022-22899 
Core FTP / SFTP Server v2 Build 725 was discovered to allow unauthenticated attackers to cause a Denial of Service (DoS) via a crafted packet through the SSH service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-17T12:51:23.000Z
CVE-2022-22901 
There is an Assertion in 'context_p->next_scanner_info_p->type == SCANNER_TYPE_FUNCTION' failed at parser_parse_function_arguments in /js/js-parser.c of JerryScript commit a6ab5e9.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-17T02:40:13.000Z
CVE-2022-22908 
SangforCSClient.exe in Sangfor VDI Client 5.4.2.1006 allows attackers, when they are able to read process memory, to discover the contents of the Username and Password fields.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-26T21:24:43.000Z
CVE-2022-22909 
HotelDruid v3.0.3 was discovered to contain a remote code execution (RCE) vulnerability which is exploited via an attacker inserting a crafted payload into the name field under the Create New Room module.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-02T23:49:47.000Z
CVE-2022-22912 
Prototype pollution vulnerability via .parse() in Plist before v3.0.4 allows attackers to cause a Denial of Service (DoS) and may lead to remote code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-17T18:50:43.000Z
CVE-2022-22914 
An incorrect access control issue in the component FileManager of Ovidentia CMS 6.0 allows authenticated attackers to to view and download content in the upload directory via path traversal.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-17T20:50:36.000Z
CVE-2022-22916 
O2OA v6.4.7 was discovered to contain a remote code execution (RCE) vulnerability via /x_program_center/jaxrs/invoke.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-17T21:08:22.000Z
CVE-2022-22919 
Adenza AxiomSL ControllerView through 10.8.1 allows redirection for SSO login URLs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-30T01:13:30.000Z
CVE-2022-22922 
TP-Link TL-WA850RE Wi-Fi Range Extender before v6_200923 was discovered to use highly predictable and easily detectable session keys, allowing attackers to gain administrative privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-18T00:55:17.000Z
CVE-2022-22928 
MCMS v5.2.4 was discovered to have a hardcoded shiro-key, allowing attackers to exploit the key and execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-20T23:40:34.000Z
CVE-2022-22929 
MCMS v5.2.4 was discovered to have an arbitrary file upload vulnerability in the New Template module, which allows attackers to execute arbitrary code via a crafted ZIP file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-20T23:40:35.000Z
CVE-2022-22930 
A remote code execution (RCE) vulnerability in the Template Management function of MCMS v5.2.4 allows attackers to execute arbitrary code via a crafted payload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-20T23:40:47.000Z
CVE-2022-22931 Path traversal in Apache James 3.6.1
Fix of CVE-2021-40525 do not prepend delimiters upon valid directory validations. Affected implementations include: - maildir mailbox store - Sieve file repository This enables a user to access other users data stores (limited to user names being prefixed by the value of the username being used).
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Apache Software Foundation
product: Apache James
Credits: lang: en
value: These issues were discovered and reported by GHSL team member Jaroslav Lobačevski
Published: 2022-02-07T18:50:10.000Z
CVE-2022-22932 Path traversal flaws
Apache Karaf obr:* commands and run goal on the karaf-maven-plugin have partial path traversal which allows to break out of expected folder. The risk is low as obr:* commands are not very used and the entry is set by user. This has been fixed in revision: https://gitbox.apache.org/repos/asf?p=karaf.git;h=36a2bc4 https://gitbox.apache.org/repos/asf?p=karaf.git;h=52b70cf Mitigation: Apache Karaf users should upgrade to 4.2.15 or 4.3.6 or later as soon as possible, or use correct path. JIRA Tickets: https://issues.apache.org/jira/browse/KARAF-7326
Problem types: description: Path traversal flaws
Affected products: vendor: Apache Software Foundation
product: Apache Karaf
Credits: lang: en
value: This issue was discovered and reported by GHSL team member Jaroslav Lobacevski
Published: 2022-01-26T11:10:12.000Z
CVE-2022-22934 
An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. Salt Masters do not sign pillar data with the minion’s public key, which can result in attackers substituting arbitrary pillar data.
Problem types: description: Salt Masters do not sign pillar data with the minion’s public key.
Affected products: vendor: n/a
product: SaltStack Salt
Published: 2022-03-29T00:00:00.000Z
CVE-2022-22935 
An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. A minion authentication denial of service can cause a MiTM attacker to force a minion process to stop by impersonating a master.
Problem types: description: Minion authentication denial of service
Affected products: vendor: n/a
product: SaltStack Salt
Published: 2022-03-29T00:00:00.000Z
CVE-2022-22936 
An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. Job publishes and file server replies are susceptible to replay attacks, which can result in an attacker replaying job publishes causing minions to run old jobs. File server replies can also be re-played. A sufficient craft attacker could gain root access on minion under certain scenarios.
Problem types: description: Job publishes and file server replies are susceptible to replay attacks.
Affected products: vendor: n/a
product: SaltStack Salt
Published: 2022-03-29T00:00:00.000Z
CVE-2022-22938 
VMware Workstation (16.x prior to 16.2.2) and Horizon Client for Windows (5.x prior to 5.5.3) contains a denial-of-service vulnerability in the Cortado ThinPrint component. The issue exists in TrueType font parser. A malicious actor with access to a virtual machine or remote desktop may exploit this issue to trigger a denial-of-service condition in the Thinprint service running on the host machine where VMware Workstation or Horizon Client for Windows is installed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-28T19:09:25.000Z
CVE-2022-22939 
VMware Cloud Foundation contains an information disclosure vulnerability due to logging of credentials in plain-text within multiple log files on the SDDC Manager. A malicious actor with root access on VMware Cloud Foundation SDDC Manager may be able to view credentials in plaintext within one or more log files.
Problem types: description: VMware Cloud Foundation updates address an information disclosure vulnerability.
Affected products: vendor: n/a
product: VMware Cloud Foundation
Published: 2022-02-04T22:29:14.000Z
CVE-2022-22941 
An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. When configured as a Master-of-Masters, with a publisher_acl, if a user configured in the publisher_acl targets any minion connected to the Syndic, the Salt Master incorrectly interpreted no valid targets as valid, allowing configured users to target any of the minions connected to the syndic with their configured commands. This requires a syndic master combined with publisher_acl configured on the Master-of-Masters, allowing users specified in the publisher_acl to bypass permissions, publishing authorized commands to any configured minion.
Problem types: description: Salt Master allows configured users to target any of the minions connected to the syndic with their configured commands
Affected products: vendor: n/a
product: SaltStack Salt
Published: 2022-03-29T00:00:00.000Z
CVE-2022-22942 
The vmwgfx driver contains a local privilege escalation vulnerability that allows unprivileged users to gain access to files opened by other processes on the system through a dangling 'file' pointer.
Problem types: description: Privilege escalation
Affected products: vendor: n/a
product: Photon OS
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2023-12-13T08:16:34.363Z
CVE-2022-22943 
VMware Tools for Windows (11.x.y and 10.x.y prior to 12.0.0) contains an uncontrolled search path vulnerability. A malicious actor with local administrative privileges in the Windows guest OS, where VMware Tools is installed, may be able to execute code with system privileges in the Windows guest OS due to an uncontrolled search path element.
Problem types: description: Uncontrolled search path vulnerability
Affected products: vendor: n/a
product: VMware Tools for Windows
Published: 2022-03-03T21:59:08.000Z
CVE-2022-22944 
VMware Workspace ONE Boxer contains a stored cross-site scripting (XSS) vulnerability. Due to insufficient sanitization and validation, in VMware Workspace ONE Boxer calendar event descriptions, a malicious actor can inject script tags to execute arbitrary script within a user's window.
Problem types: description: Stored cross-site scripting (XSS) vulnerability
Affected products: vendor: n/a
product: VMware Workspace ONE Boxer
Published: 2022-03-02T20:50:17.000Z
CVE-2022-22945 
VMware NSX Edge contains a CLI shell injection vulnerability. A malicious actor with SSH access to an NSX-Edge appliance can execute arbitrary commands on the operating system as root.
Problem types: description: A CLI shell injection vulnerability affecting VMware NSX Edge
Affected products: vendor: n/a
product: VMware NSX Edge
Published: 2022-02-16T16:38:35.000Z