rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-36928 Path Traversal in Zoom for Android Clients
Zoom for Android clients before version 5.13.0 contain a path traversal vulnerability. A third party app could exploit this vulnerability to read and write to the Zoom application data directory.
Problem types: cwe_id: CWE-35
description: CWE-35: Path Traversal
Affected products: vendor: Zoom Video Communications Inc
product: Zoom for Android
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
Published: 2023-01-09T00:00:00.000Z
CVE-2022-36929 Local Privilege Escalation in Zoom Rooms for Windows Clients
The Zoom Rooms Installer for Windows prior to 5.12.6 contains a local privilege escalation vulnerability. A local low-privileged user could exploit this vulnerability during the install process to escalate their privileges to the SYSTEM user.
Problem types: cwe_id: CWE-367
description: CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition
Affected products: vendor: Zoom Video Communications Inc
product: Zoom Rooms for Windows
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
Published: 2023-01-09T00:00:00.000Z
CVE-2022-36930 Local Privilege Escalation in Zoom Rooms for Windows Installers
Zoom Rooms for Windows installers before version 5.13.0 contain a local privilege escalation vulnerability. A local low-privileged user could exploit this vulnerability in an attack chain to escalate their privileges to the SYSTEM user.
Problem types: cwe_id: CWE-427
description: CWE-427: Uncontrolled Search Path Element
Affected products: vendor: Zoom Video Communications Inc
product: Zoom Rooms for Windows
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
Published: 2023-01-09T00:00:00.000Z
CVE-2022-36934 
An integer overflow in WhatsApp could result in remote code execution in an established video call.
Problem types: cwe_id: CWE-122
description: CWE-122
Affected products: vendor: Meta
product: WhatsApp for iOS
vendor: Meta
product: WhatsApp Business for iOS
vendor: Meta
product: WhatsApp for Android
vendor: Meta
product: WhatsApp Business for Android
Published: 2022-09-22T21:30:11.000Z
CVE-2022-36937 
HHVM 4.172.0 and all prior versions use TLS 1.0 for secure connections when handling tls:// URLs in the stream extension. TLS1.0 has numerous published vulnerabilities and is deprecated. HHVM 4.153.4, 4.168.2, 4.169.2, 4.170.2, 4.171.1, 4.172.1, 4.173.0 replaces TLS1.0 with TLS1.3.

Applications that call stream_socket_server or stream_socket_client functions with a URL starting with tls:// are affected.
Problem types: description: CWE-1104: Use of Unmaintained Third Party Components
Affected products: vendor: Facebook
product: HHVM
default_status: unaffected
Published: 2023-05-10T18:28:20.367Z
CVE-2022-36938 
DexLoader function get_stringidx_fromdex() in Redex prior to commit 3b44c64 can load an out of bound address when loading the string index table, potentially allowing remote code execution during processing of a 3rd party Android APK file.
Problem types: cwe_id: CWE-125
description: CWE-125: Out-of-bounds Read, CWE-822: Untrusted Pointer Dereference
Affected products: vendor: Facebook
product: Redex
Published: 2022-11-10T00:00:00.000Z
CVE-2022-36943 
SSZipArchive versions 2.5.3 and older contain an arbitrary file write vulnerability due to lack of sanitization on paths which are symlinks. SSZipArchive will overwrite files on the filesystem when opening a malicious ZIP containing a symlink as the first item.
Problem types: cwe_id: CWE-22
description: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), CWE-61: UNIX Symbolic Link (Symlink) Following
Affected products: vendor: ZipArchive
product: SSZipArchive
Published: 2023-01-03T00:00:00.000Z
CVE-2022-36944 
Scala 2.13.x before 2.13.9 has a Java deserialization chain in its JAR file. On its own, it cannot be exploited. There is only a risk in conjunction with Java object deserialization within an application. In such situations, it allows attackers to erase contents of arbitrary files, make network connections, or possibly run arbitrary code (specifically, Function0 functions) via a gadget chain.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-23T00:00:00.000Z
CVE-2022-36945 
The Remote Keyless Entry (RKE) receiving unit on certain Mazda vehicles through 2020 allows remote attackers to perform unlock operations and force a resynchronization after capturing three consecutive valid key-fob signals over the radio, aka a RollBack attack. The attacker retains the ability to unlock indefinitely.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-24T05:01:53.000Z
CVE-2022-36946 
nfqnl_mangle in net/netfilter/nfnetlink_queue.c in the Linux kernel through 5.18.14 allows remote attackers to cause a denial of service (panic) because, in the case of an nf_queue verdict with a one-byte nfta_payload attribute, an skb_pull can encounter a negative skb->len.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-27T00:00:00.000Z
CVE-2022-36947 
Unsafe Parsing of a PNG tRNS chunk in FastStone Image Viewer through 7.5 results in a stack buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-18T20:58:16.000Z
CVE-2022-36948 
In Veritas NetBackup OpsCenter, a DOM XSS attack can occur. This affects 8.x through 8.3.0.2, 9.x through 9.0.0.1, 9.1.x through 9.1.0.1, and 10.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AC:L/AV:N/A:N/C:L/I:L/PR:L/S:C/UI:R
version: 3.1
Published: 2022-07-27T21:01:05.000Z
CVE-2022-36949 
In Veritas NetBackup OpsCenter, an attacker with local access to a NetBackup OpsCenter server could potentially escalate their privileges. This affects 8.x through 8.3.0.2, 9.x through 9.0.0.1, 9.1.x through 9.1.0.1, and 10.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 9.3
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AC:L/AV:L/A:H/C:H/I:H/PR:N/S:C/UI:N
version: 3.1
Published: 2022-07-27T21:00:48.000Z
CVE-2022-36950 
In Veritas NetBackup OpsCenter, an unauthenticated remote attacker may be able to perform remote command execution through a Java classloader manipulation. This affects 8.x through 8.3.0.2, 9.x through 9.0.0.1, 9.1.x through 9.1.0.1, and 10.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:N
version: 3.1
Published: 2022-07-27T21:00:20.000Z
CVE-2022-36951 
In Veritas NetBackup OpsCenter, an unauthenticated remote attacker may compromise the host by exploiting an incorrectly patched vulnerability. This affects 8.x through 8.3.0.2, 9.x through 9.0.0.1, 9.1.x through 9.1.0.1, and 10.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:N
version: 3.1
Published: 2022-07-27T20:59:55.000Z
CVE-2022-36952 
In Veritas NetBackup OpsCenter, a hard-coded credential exists that could be used to exploit the underlying VxSS subsystem. This affects 8.x through 8.3.0.2, 9.x through 9.0.0.1, 9.1.x through 9.1.0.1, and 10.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 8.4
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AC:L/AV:L/A:H/C:H/I:H/PR:N/S:U/UI:N
version: 3.1
Published: 2022-07-27T20:59:34.000Z
CVE-2022-36953 
In Veritas NetBackup OpsCenter, certain endpoints could allow an unauthenticated remote attacker to gain sensitive information. This affects 8.x through 8.3.0.2, 9.x through 9.0.0.1, 9.1.x through 9.1.0.1, and 10.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AC:L/AV:N/A:N/C:L/I:N/PR:L/S:U/UI:N
version: 3.1
Published: 2022-07-27T20:59:09.000Z
CVE-2022-36954 
In Veritas NetBackup OpsCenter, under specific conditions, an authenticated remote attacker may be able to create or modify OpsCenter user accounts. This affects 8.x through 8.3.0.2, 9.x through 9.0.0.1, 9.1.x through 9.1.0.1, and 10.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.9
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:L/S:C/UI:N
version: 3.1
Published: 2022-07-27T20:58:39.000Z
CVE-2022-36955 
In Veritas NetBackup, an attacker with unprivileged local access to a NetBackup Client may send specific commands to escalate their privileges. This affects 8.0 through 8.1.2, 8.2, 8.3 through 8.3.0.2, 9.x through 9.0.0.1, and 9.1.x through 9.1.0.1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AC:L/AV:L/A:H/C:H/I:H/PR:N/S:U/UI:R
version: 3.1
Published: 2022-07-27T20:58:09.000Z
CVE-2022-36956 
In Veritas NetBackup, the NetBackup Client allows arbitrary command execution from any remote host that has access to a valid host-id NetBackup certificate/private key from the same domain. The affects 9.0.x through 9.0.0.1 and 9.1.x through 9.1.0.1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:L/S:C/UI:R
version: 3.1
Published: 2022-07-27T20:57:47.000Z
CVE-2022-36957 SolarWinds Platform Deserialization of Untrusted Data
SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Orion admin-level account access to SolarWinds Web Console to execute arbitrary commands.
Problem types: cwe_id: CWE-502
description: CWE-502: Deserialization of Untrusted Data
Affected products: vendor: SolarWinds
product: SolarWinds Platform
vendor: SolarWinds
product: Orion Platform
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 7.2
baseSeverity: HIGH
Credits: lang: en
value: SolarWinds would like to thank Piotr Bazydlo (@chudypb) of Trend Micro Zero Day Initiative for reporting on the issue in a responsible manner.
Published: 2022-10-20T20:08:04.993Z
CVE-2022-36958 SolarWinds Platform Deserialization of Untrusted Data
SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with valid access to SolarWinds Web Console to execute arbitrary commands.
Problem types: cwe_id: CWE-502
description: CWE-502 Deserialization of Untrusted Data
Affected products: vendor: SolarWinds
product: SolarWinds Platform
vendor: SolarWinds
product: Orion Platform
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
Credits: lang: en
value: SolarWinds would like to thank Piotr Bazydlo (@chudypb) of Trend Micro Zero Day Initiative for reporting on the issue in a responsible manner.
Published: 2022-10-20T20:10:01.367Z
CVE-2022-36960 SolarWinds Platform Improper Input Validation
SolarWinds Platform was susceptible to Improper Input Validation. This vulnerability allows a remote adversary with valid access to SolarWinds Web Console to escalate user privileges.
Problem types: cwe_id: CWE-287
description: CWE-287 Improper Authentication
cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: SolarWinds
product: SolarWinds Platform
default_status: unaffected
vendor: SolarWinds
product: Orion Platform
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: SolarWinds would like to thank Piotr Bazydlo (@chudypb) of Trend Micro Zero Day Initiative for reporting on the issue in a responsible manner.
Published: 2022-11-29T20:43:38.388Z
CVE-2022-36961 Orion Platform SQL Injection Privilege Escalation Vulnerability
A vulnerable component of Orion Platform was vulnerable to SQL Injection, an authenticated attacker could leverage this for privilege escalation or remote code execution.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: SolarWinds
product: Orion Platform
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2022-09-30T16:06:10.288Z
CVE-2022-36962 SolarWinds Platform Command Injection
SolarWinds Platform was susceptible to Command Injection. This vulnerability allows a remote adversary with complete control over the SolarWinds database to execute arbitrary commands.
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: SolarWinds
product: SolarWinds Platform
vendor: SolarWinds
product: Orion Platform
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 7.2
baseSeverity: HIGH
Credits: lang: en
value: SolarWinds would like to thank Piotr Bazydlo (@chudypb) of Trend Micro Zero Day Initiative for reporting on the issue in a responsible manner.
Published: 2022-11-29T20:46:18.482Z
CVE-2022-36963 SolarWinds Platform Deserialization of Untrusted Data Vulnerability
The SolarWinds Platform was susceptible to the Command Injection Vulnerability. This vulnerability allows a remote adversary with a valid SolarWinds Platform admin account to execute arbitrary commands.


Problem types: cwe_id: CWE-94
description: CWE-94 Improper Control of Generation of Code ('Code Injection')
Affected products: vendor: SolarWinds Platform Command Injection Vulnerability
product: SolarWinds Platform
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: SolarWinds would like to thank Piotr Bazydlo (@chudypb) of Trend Micro Zero Day Initiative for reporting on the issue in a responsible manner.
Published: 2023-04-21T00:00:00.000Z
CVE-2022-36964 SolarWinds Platform Deserialization of Untrusted Data
SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with valid access to SolarWinds Web Console to execute arbitrary commands.
Problem types: cwe_id: CWE-502
description: CWE-502 Deserialization of Untrusted Data
Affected products: vendor: SolarWinds
product: SolarWinds Platform
vendor: SolarWinds
product: Orion Platform
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
Credits: lang: en
value: SolarWinds would like to thank Piotr Bazydlo (@chudypb) of Trend Micro Zero Day Initiative for reporting on the issue in a responsible manner.
Published: 2022-11-29T20:47:49.978Z
CVE-2022-36965 Stored and DOM XSS in QoE Applications: Orion Platform
Insufficient sanitization of inputs in QoE application input field could lead to stored and Dom based XSS attack. This issue is fixed and released in SolarWinds Platform (2022.3.0).
Problem types: description: Stored and DOM XSS in QoE Applications: Orion Platform
Affected products: vendor: SolarWinds
product: Orion Platform
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: Shashank Chaurasia
Published: 2022-09-30T16:45:24.996Z
CVE-2022-36966 Insecure Direct Object Reference Vulnerability: Orion Platform 2020.2.6
Users with Node Management rights were able to view and edit all nodes due to Insufficient control on URL parameter causing insecure direct object reference (IDOR) vulnerability in SolarWinds Platform 2022.3 and previous.
Problem types: description: Insecure Direct Object Reference Vulnerability: Orion Platform 2020.2.6
Affected products: vendor: SolarWinds
product: SolarWinds Platform
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: Asim Liaquat
Published: 2022-10-20T20:05:35.645Z
CVE-2022-36967 
In Progress WS_FTP Server prior to version 8.7.3, multiple reflected cross-site scripting (XSS) vulnerabilities exist in the administrative web interface. It is possible for a remote attacker to inject arbitrary JavaScript into a WS_FTP administrator's web session. This would allow the attacker to execute code within the context of the victim's browser.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-02T21:58:48.000Z
CVE-2022-36968 
In Progress WS_FTP Server prior to version 8.7.3, forms within the administrative interface did not include a nonce to mitigate the risk of cross-site request forgery (CSRF) attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-02T21:58:52.000Z
CVE-2022-36969 
This vulnerability allows remote attackers to disclose sensitive information on affected installations of AVEVA Edge 2020 SP2 Patch 0(4201.2111.1802.0000). User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the LoadImportedLibraries method. Due to the improper restriction of XML External Entity (XXE) references, a crafted document specifying a URI causes the XML parser to access the URI and embed the contents back into the XML document for further processing. An attacker can leverage this vulnerability to disclose information in the context of the current process. Was ZDI-CAN-17394.
Problem types: cwe_id: CWE-611
description: CWE-611: Improper Restriction of XML External Entity Reference ('XXE')
Affected products: vendor: AVEVA
product: Edge
Credits: lang: en
value: Piotr Bazydlo (@chudypb) of Trend Micro Zero Day Initiative
Published: 2023-03-29T00:00:00.000Z
CVE-2022-36970 
This vulnerability allows remote attackers to execute arbitrary code on affected installations of AVEVA Edge 20.0 Build: 4201.2111.1802.0000 Service Pack 2. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of APP files. Crafted data in a APP file can cause the application to execute arbitrary Visual Basic scripts. The user interface fails to provide sufficient indication of the hazard. An attacker can leverage this vulnerability to execute code in the context of current process. Was ZDI-CAN-17370.
Problem types: cwe_id: CWE-356
description: CWE-356: Product UI does not Warn User of Unsafe Actions
Affected products: vendor: AVEVA
product: Edge
Credits: lang: en
value: Aaron Ferber
Published: 2023-03-29T00:00:00.000Z
CVE-2022-36971 
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Avalanche 6.3.2.3490. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the JwtTokenUtility class. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-15301.
Problem types: cwe_id: CWE-502
description: CWE-502: Deserialization of Untrusted Data
Affected products: vendor: Ivanti
product: Avalanche
Credits: lang: en
value: Piotr Bazydlo (@chudypb)
Published: 2023-03-29T00:00:00.000Z
CVE-2022-36972 
This vulnerability allows remote attackers to bypass authentication on affected installations of Ivanti Avalanche 6.3.2.3490. The specific flaw exists within the ProfileDaoImpl class. A crafted request can trigger execution of SQL queries composed from a user-supplied string. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-15328.
Problem types: cwe_id: CWE-89
description: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Ivanti
product: Avalanche
Credits: lang: en
value: Piotr Bazydlo (@chudypb)
Published: 2023-03-29T00:00:00.000Z