rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-31644 
Potential vulnerabilities have been identified in the system BIOS of certain HP PC products, which might allow arbitrary code execution, escalation of privilege, denial of service, and information disclosure.
Affected products: vendor: HP Inc.
product: HP PC BIOS
Published: 2023-06-14T17:06:30.332Z
CVE-2022-31645 
Potential vulnerabilities have been identified in the system BIOS of certain HP PC products, which might allow arbitrary code execution, escalation of privilege, denial of service, and information disclosure. 
Affected products: vendor: HP Inc.
product: HP PC BIOS
Published: 2023-06-14T17:07:00.373Z
CVE-2022-31646 
Potential vulnerabilities have been identified in the system BIOS of certain HP PC products, which might allow arbitrary code execution, escalation of privilege, denial of service, and information disclosure.
Affected products: vendor: HP Inc.
product: HP PC BIOS
Published: 2023-06-14T17:07:52.139Z
CVE-2022-31647 
Docker Desktop before 4.6.0 on Windows allows attackers to delete any file through the hyperv/destroy dockerBackendV2 API via a symlink in the DataFolder parameter, a different vulnerability than CVE-2022-26659.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-27T00:00:00.000Z
CVE-2022-31648 
Talend Administration Center is vulnerable to a reflected Cross-Site Scripting (XSS) issue in the SSO login endpoint. The issue is fixed for versions 8.0.x in TPS-5233, for versions 7.3.x in TPS-5324, and for versions 7.2.x in TPS-5235. Earlier versions of Talend Administration Center may also be impacted; users are encouraged to update to a supported version.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-26T19:07:39.000Z
CVE-2022-31649 
ownCloud owncloud/core before 10.10.0 Improperly Removes Sensitive Information Before Storage or Transfer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-09T00:51:14.000Z
CVE-2022-31650 
In SoX 14.4.2, there is a floating-point exception in lsx_aiffstartwrite in aiff.c in libsox.a.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-25T00:00:00.000Z
CVE-2022-31651 
In SoX 14.4.2, there is an assertion failure in rate_init in rate.c in libsox.a.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-25T00:00:00.000Z
CVE-2022-31654 
VMware vRealize Log Insight in versions prior to 8.8.2 contain a stored cross-site scripting vulnerability due to improper input sanitization in configurations.
Problem types: description: Stored cross-site scripting
Affected products: vendor: n/a
product: VMware vRealize Log Insight
Published: 2022-07-12T20:43:09.000Z
CVE-2022-31655 
VMware vRealize Log Insight in versions prior to 8.8.2 contain a stored cross-site scripting vulnerability due to improper input sanitization in alerts.
Problem types: description: Stored cross-site scripting
Affected products: vendor: n/a
product: VMware vRealize Log Insight
Published: 2022-07-12T20:44:46.000Z
CVE-2022-31656 
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an authentication bypass vulnerability affecting local domain users. A malicious actor with network access to the UI may be able to obtain administrative access without the need to authenticate.
Problem types: description: Authentication Bypass Vulnerability
Affected products: vendor: n/a
product: VMware Workspace ONE Access, Identity Manager and vRealize Automation
Published: 2022-08-05T15:07:24.000Z
CVE-2022-31657 
VMware Workspace ONE Access and Identity Manager contain a URL injection vulnerability. A malicious actor with network access may be able to redirect an authenticated user to an arbitrary domain.
Problem types: description: VMware Workspace ONE Access and Identity Manager contain a URL injection vulnerability
Affected products: vendor: n/a
product: VMware Workspace ONE Access, Identity Manager and vRealize Automation
Published: 2022-08-05T15:07:39.000Z
CVE-2022-31658 
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a remote code execution vulnerability. A malicious actor with administrator and network access can trigger a remote code execution.
Problem types: description: VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a remote code execution vulnerability.
Affected products: vendor: n/a
product: VMware Workspace ONE Access, Identity Manager and vRealize Automation
Published: 2022-08-05T15:07:10.000Z
CVE-2022-31659 
VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability. A malicious actor with administrator and network access can trigger a remote code execution.
Problem types: description: VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability.
Affected products: vendor: n/a
product: VMware Workspace ONE Access, Identity Manager and vRealize Automation
Published: 2022-08-05T15:06:41.000Z
CVE-2022-31660 
VMware Workspace ONE Access, Identity Manager and vRealize Automation contains a privilege escalation vulnerability. A malicious actor with local access can escalate privileges to 'root'.
Problem types: description: VMware Workspace ONE Access, Identity Manager and vRealize Automation contains a privilege escalation vulnerability.
Affected products: vendor: n/a
product: VMware Workspace ONE Access, Identity Manager and vRealize Automation
Published: 2022-08-05T15:05:45.000Z
CVE-2022-31661 
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain two privilege escalation vulnerabilities. A malicious actor with local access can escalate privileges to 'root'.
Problem types: description: VMware Workspace ONE Access, Identity Manager and vRealize Automation contains a privilege escalation vulnerability.
Affected products: vendor: n/a
product: VMware Workspace ONE Access, Identity Manager and vRealize Automation
Published: 2022-08-05T15:06:55.000Z
CVE-2022-31662 
VMware Workspace ONE Access, Identity Manager, Connectors and vRealize Automation contain a path traversal vulnerability. A malicious actor with network access may be able to access arbitrary files.
Problem types: description: VMware Workspace ONE Access, Identity Manager, Connectors and vRealize Automation contain a path traversal vulnerability.
Affected products: vendor: n/a
product: VMware Workspace ONE Access, Access Connector, Identity Manager, vIDM Connector and vRealize Automation
Published: 2022-08-05T15:05:34.000Z
CVE-2022-31663 
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a reflected cross-site scripting (XSS) vulnerability. Due to improper user input sanitization, a malicious actor with some user interaction may be able to inject javascript code in the target user's window.
Problem types: description: VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a reflected cross-site scripting (XSS) vulnerability.
Affected products: vendor: n/a
product: VMware Workspace ONE Access, Identity Manager and vRealize Automation
Published: 2022-08-05T15:06:30.000Z
CVE-2022-31664 
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a privilege escalation vulnerability. A malicious actor with local access can escalate privileges to 'root'.
Problem types: description: VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a privilege escalation vulnerability.
Affected products: vendor: n/a
product: VMware Workspace ONE Access, Identity Manager and vRealize Automation
Published: 2022-08-05T15:06:15.000Z
CVE-2022-31665 
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a remote code execution vulnerability. A malicious actor with administrator and network access can trigger a remote code execution.
Problem types: description: VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a remote code execution vulnerability.
Affected products: vendor: n/a
product: VMware Workspace ONE Access, Identity Manager and vRealize Automation
Published: 2022-08-05T15:06:00.000Z
CVE-2022-31666 Harbor fails to validate user permissions while Viewing, updating and deleting Webhook policies
Harbor fails to validate user permissions while deleting Webhook policies, allowing malicious users to view, update and delete Webhook policies of other users.  The attacker could modify Webhook policies configured in other projects.
Problem types: cwe_id: CWE-285
description: CWE-285
Affected products: vendor: n/a
product: Harbor
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.7
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
version: 3.1
Published: 2024-11-14T11:32:32.600Z
CVE-2022-31667 Harbor fails to validate the user permissions when updating a robot account
Harbor fails to validate the user permissions when updating a robot account that belongs to a project that the authenticated user doesn’t have access to. 

By sending a request that attempts to update a robot account, and specifying a robot account id and robot account name that belongs to a different project that the user doesn’t have access to, it was possible to revoke the robot account permissions.
Problem types: cwe_id: CWE-285
description: CWE-285
Affected products: vendor: n/a
product: Harbor
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.4
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L
version: 3.1
Published: 2024-11-14T11:50:48.289Z
CVE-2022-31668 User permission validation failure and disclosure of P2P preheat execution logs
Harbor fails to validate the user permissions when updating p2p preheat policies. By sending a request to update a p2p preheat policy with an id that belongs to a project that the currently authenticated user doesn't have access to, the attacker could modify p2p preheat policies configured in other projects.
Problem types: cwe_id: CWE-285
description: CWE-285
Affected products: vendor: n/a
product: Harbor
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.4
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
version: 3.1
Published: 2024-11-14T11:56:31.043Z
CVE-2022-31669 Harbor fails to validate the user permissions when updating tag immutability policies
Harbor fails to validate the user permissions when updating tag immutability policies. 

By sending a request to update a tag immutability policy with an id that belongs to a
project that the currently authenticated user doesn’t have access to, the attacker could
modify tag immutability policies configured in other projects.
Problem types: cwe_id: CWE-285
description: CWE-285
Affected products: vendor: n/a
product: Harbor
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.4
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L
version: 3.1
Published: 2024-11-14T11:48:03.444Z
CVE-2022-31670 Harbor fails to validate the user permissions when updating tag retention policies
Harbor fails to validate the user permissions when updating tag retention policies. 

By sending a request to update a tag retention policy with an id that belongs to a project that the currently authenticated user doesn’t have access to, the attacker could modify
tag retention policies configured in other projects.
Problem types: cwe_id: CWE-285
description: CWE-285
Affected products: vendor: n/a
product: Harbor
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.7
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
version: 3.1
Published: 2024-11-14T11:45:22.257Z
CVE-2022-31671 Harbor fails to validate the user permissions when reading and updating job execution logs through the P2P preheat execution logs
Harbor fails to validate user permissions when reading and updating job execution logs through the P2P preheat execution logs. By sending a request that attempts to read/update P2P preheat execution logs and specifying different job IDs, malicious authenticated users could read all the job logs stored in the Harbor database.
Problem types: cwe_id: CWE-285
description: CWE-285
Affected products: vendor: n/a
product: Harbor
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.4
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
version: 3.1
Published: 2024-11-14T11:42:22.373Z
CVE-2022-31672 
VMware vRealize Operations contains a privilege escalation vulnerability. A malicious actor with administrative network access can escalate privileges to root.
Problem types: description: Privilege Escalation Vulnerability
Affected products: vendor: n/a
product: VMware vRealize Operations
Published: 2022-08-09T20:18:53.000Z
CVE-2022-31673 
VMware vRealize Operations contains an information disclosure vulnerability. A low-privileged malicious actor with network access can create and leak hex dumps, leading to information disclosure. Successful exploitation can lead to a remote code execution.
Problem types: description: Information Disclosure Vulnerability
Affected products: vendor: n/a
product: VMware vRealize Operations
Published: 2022-08-09T20:19:45.000Z
CVE-2022-31674 
VMware vRealize Operations contains an information disclosure vulnerability. A low-privileged malicious actor with network access can access log files that lead to information disclosure.
Problem types: description: Information Disclosure Vulnerability
Affected products: vendor: n/a
product: VMware vRealize Operations
Published: 2022-08-09T20:19:31.000Z
CVE-2022-31675 
VMware vRealize Operations contains an authentication bypass vulnerability. An unauthenticated malicious actor with network access may be able to create a user with administrative privileges.
Problem types: description: Authentication Bypass Vulnerability
Affected products: vendor: n/a
product: VMware vRealize Operations
Published: 2022-08-09T20:19:18.000Z
CVE-2022-31676 
VMware Tools (12.0.0, 11.x.y and 10.x.y) contains a local privilege escalation vulnerability. A malicious actor with local non-administrative access to the Guest OS can escalate privileges as a root user in the virtual machine.
Problem types: description: Local privilege escalation vulnerability
Affected products: vendor: n/a
product: VMware Tools
Published: 2022-08-23T00:00:00.000Z
CVE-2022-31677 
An Insufficient Session Expiration issue was discovered in the Pinniped Supervisor (before v0.19.0). A user authenticating to Kubernetes clusters via the Pinniped Supervisor could potentially use their access token to continue their session beyond what proper use of their refresh token might allow.
Problem types: description: Insufficient Session Expiration issue
Affected products: vendor: n/a
product: Pinniped Supervisor
Published: 2022-08-29T14:03:02.000Z
CVE-2022-31678 
VMware Cloud Foundation (NSX-V) contains an XML External Entity (XXE) vulnerability. On VCF 3.x instances with NSX-V deployed, this may allow a user to exploit this issue leading to a denial-of-service condition or unintended information disclosure.
Problem types: description: VMware Cloud Foundation contains an XML External Entity (XXE)
Affected products: vendor: n/a
product: VMware Cloud Foundation (NSX-V)
Published: 2022-10-28T00:00:00.000Z
CVE-2022-31679 
Applications that allow HTTP PATCH access to resources exposed by Spring Data REST in versions 3.6.0 - 3.5.5, 3.7.0 - 3.7.2, and older unsupported versions, if an attacker knows about the structure of the underlying domain model, they can craft HTTP requests that expose hidden entity attributes.
Problem types: description: Potential Unintended Data Exposure for Resource Exposed
Affected products: vendor: n/a
product: Spring Data REST
Published: 2022-09-21T17:42:42.000Z
CVE-2022-31680 
The vCenter Server contains an unsafe deserialisation vulnerability in the PSC (Platform services controller). A malicious actor with admin access on vCenter server may exploit this issue to execute arbitrary code on the underlying operating system that hosts the vCenter Server.
Problem types: description: Unsafe deserialization vulnerability
Affected products: vendor: n/a
product: VMware vCenter Server
Published: 2022-10-07T00:00:00.000Z
CVE-2022-31681 
VMware ESXi contains a null-pointer deference vulnerability. A malicious actor with privileges within the VMX process only, may create a denial of service condition on the host.
Problem types: description: Null-pointer dereference vulnerability
Affected products: vendor: n/a
product: VMware ESXi
Published: 2022-10-07T00:00:00.000Z
CVE-2022-31682 
VMware Aria Operations contains an arbitrary file read vulnerability. A malicious actor with administrative privileges may be able to read arbitrary files containing sensitive data.
Problem types: description: VMware Aria Operations patches address an arbitrary file read vulnerability.
Affected products: vendor: n/a
product: VMware Aria Operations
Published: 2022-10-11T00:00:00.000Z
CVE-2022-31683 
Concourse (7.x.y prior to 7.8.3 and 6.x.y prior to 6.7.9) contains an authorization bypass issue. A Concourse user can send a request with body including :team_name=team2 to bypass team scope check to gain access to certain resources belong to any other team.
Problem types: description: Authorization Bypass vulnerability
Affected products: vendor: n/a
product: Concourse
Published: 2022-12-19T00:00:00.000Z
CVE-2022-31684 
Reactor Netty HTTP Server, in versions 1.0.11 - 1.0.23, may log request headers in some cases of invalid HTTP requests. The logged headers may reveal valid access tokens to those with access to server logs. This may affect only invalid HTTP requests where logging at WARN level is enabled.
Problem types: description: HTTP Server may log request headers
Affected products: vendor: n/a
product: Reactor Netty
Published: 2022-10-19T00:00:00.000Z
CVE-2022-31685 
VMware Workspace ONE Assist prior to 22.10 contains an Authentication Bypass vulnerability. A malicious actor with network access to Workspace ONE Assist may be able to obtain administrative access without the need to authenticate to the application.
Problem types: description: Authentication Bypass vulnerability
Affected products: vendor: n/a
product: VMware Workspace ONE Assist
Published: 2022-11-09T00:00:00.000Z
CVE-2022-31686 
VMware Workspace ONE Assist prior to 22.10 contains a Broken Authentication Method vulnerability. A malicious actor with network access to Workspace ONE Assist may be able to obtain administrative access without the need to authenticate to the application.
Problem types: description: Broken Authentication Method
Affected products: vendor: n/a
product: VMware Workspace ONE Assist
Published: 2022-11-09T00:00:00.000Z
CVE-2022-31687 
VMware Workspace ONE Assist prior to 22.10 contains a Broken Access Control vulnerability. A malicious actor with network access to Workspace ONE Assist may be able to obtain administrative access without the need to authenticate to the application.
Problem types: description: Broken Access Control
Affected products: vendor: n/a
product: VMware Workspace ONE Assist
Published: 2022-11-09T00:00:00.000Z
CVE-2022-31688 
VMware Workspace ONE Assist prior to 22.10 contains a Reflected cross-site scripting (XSS) vulnerability. Due to improper user input sanitization, a malicious actor with some user interaction may be able to inject javascript code in the target user's window.
Problem types: description: Reflected cross-site scripting (XSS)
Affected products: vendor: n/a
product: VMware Workspace ONE Assist
Published: 2022-11-09T00:00:00.000Z
CVE-2022-31689 
VMware Workspace ONE Assist prior to 22.10 contains a Session fixation vulnerability. A malicious actor who obtains a valid session token may be able to authenticate to the application using that token.
Problem types: description: Session fixation
Affected products: vendor: n/a
product: VMware Workspace ONE Assist
Published: 2022-11-09T00:00:00.000Z
CVE-2022-31690 
Spring Security, versions 5.7 prior to 5.7.5, and 5.6 prior to 5.6.9, and older unsupported versions could be susceptible to a privilege escalation under certain conditions. A malicious user or attacker can modify a request initiated by the Client (via the browser) to the Authorization Server which can lead to a privilege escalation on the subsequent approval. This scenario can happen if the Authorization Server responds with an OAuth2 Access Token Response containing an empty scope list (per RFC 6749, Section 5.1) on the subsequent request to the token endpoint to obtain the access token.
Problem types: description: Privilege Escalation in spring-security-oauth2-client
Affected products: vendor: n/a
product: Spring Security
Published: 2022-10-31T00:00:00.000Z
CVE-2022-31691 
Spring Tools 4 for Eclipse version 4.16.0 and below as well as VSCode extensions such as Spring Boot Tools, Concourse CI Pipeline Editor, Bosh Editor and Cloudfoundry Manifest YML Support version 1.39.0 and below all use Snakeyaml library for YAML editing support. This library allows for some special syntax in the YAML that under certain circumstances allows for potentially harmful remote code execution by the attacker.
Problem types: description: Potential Remote Code Execution
Affected products: vendor: n/a
product: Spring by VMware
Published: 2022-11-04T00:00:00.000Z
CVE-2022-31692 
Spring Security, versions 5.7 prior to 5.7.5 and 5.6 prior to 5.6.9 could be susceptible to authorization rules bypass via forward or include dispatcher types. Specifically, an application is vulnerable when all of the following are true: The application expects that Spring Security applies security to forward and include dispatcher types. The application uses the AuthorizationFilter either manually or via the authorizeHttpRequests() method. The application configures the FilterChainProxy to apply to forward and/or include requests (e.g. spring.security.filter.dispatcher-types = request, error, async, forward, include). The application may forward or include the request to a higher privilege-secured endpoint.The application configures Spring Security to apply to every dispatcher type via authorizeHttpRequests().shouldFilterAllDispatcherTypes(true)
Problem types: description: Spring is susceptible to authorization rules bypass via forward or include dispatcher types.
Affected products: vendor: n/a
product: Spring by VMware
Published: 2022-10-31T00:00:00.000Z
CVE-2022-31693 
VMware Tools for Windows (12.x.y prior to 12.1.5, 11.x.y and 10.x.y) contains a denial-of-service vulnerability in the VM3DMP driver. A malicious actor with local user privileges in the Windows guest OS, where VMware Tools is installed, can trigger a PANIC in the VM3DMP driver leading to a denial-of-service condition in the Windows guest OS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-06-07T00:00:00.000Z