rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-22726 
A CWE-20: Improper Input Validation vulnerability exists that could allow arbitrary files on the server to be read by authenticated users through a limited operating system service account. Affected Product: EcoStruxure Power Monitoring Expert (Versions 2020 and prior)
Problem types: cwe_id: CWE-20
description: CWE-20: Improper Input Validation
Affected products: vendor: n/a
product: EcoStruxure Power Monitoring Expert (Versions 2020 and prior)
Published: 2022-02-04T22:29:38.000Z
CVE-2022-22727 
A CWE-20: Improper Input Validation vulnerability exists that could allow an unauthenticated attacker to view data, change settings, impact availability of the software, or potentially impact a user�s local machine when the user clicks a specially crafted link. Affected Product: EcoStruxure Power Monitoring Expert (Versions 2020 and prior)
Problem types: cwe_id: CWE-20
description: CWE-20: Improper Input Validation
Affected products: vendor: n/a
product: EcoStruxure Power Monitoring Expert (Versions 2020 and prior)
Published: 2022-02-04T22:29:38.000Z
CVE-2022-22728 libapreq2 multipart form parse memory corruption
A flaw in Apache libapreq2 versions 2.16 and earlier could cause a buffer overflow while processing multipart form uploads. A remote attacker could send a request causing a process crash which could lead to a denial of service attack.
Problem types: cwe_id: CWE-120
description: CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Affected products: vendor: Apache Software Foundation
product: libapreq2
Published: 2022-08-25T00:00:00.000Z
CVE-2022-22729 
CAMS for HIS Server contained in the following Yokogawa Electric products improperly authenticate the receiving packets. The authentication may be bypassed via some crafted packets: CENTUM CS 3000 versions from R3.08.10 to R3.09.00, CENTUM VP versions from R4.01.00 to R4.03.00, from R5.01.00 to R5.04.20, and from R6.01.00 to R6.08.00, and Exaopc versions from R3.72.00 to R3.79.00.
Problem types: cwe_id: CWE-302
description: CWE-302: Authentication Bypass by Assumed-Immutable Data
Affected products: vendor: Yokogawa Electric Corporation
product: CENTUM CS 3000
vendor: Yokogawa Electric Corporation
product: CENTUM VP
vendor: Yokogawa Electric Corporation
product: Exaopc
Published: 2022-03-11T09:10:50.000Z
CVE-2022-22730 
Improper authentication in the Intel(R) Edge Insights for Industrial software before version 2.6.1 may allow an unauthenticated user to potentially enable escalation of privilege via network access.
Problem types: description: escalation of privilege
Affected products: vendor: n/a
product: Intel(R) Edge Insights for Industrial software
Published: 2022-08-18T19:44:53.000Z
CVE-2022-22731 
A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in a function that could allow an attacker to create or overwrite critical files that are used to execute code, such as programs or libraries and cause path traversal attacks. Affected Products: EcoStruxure Power Commission (Versions prior to V2.22)
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Schneider Electric
product: EcoStruxure Power Commission
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
Published: 2023-01-30T00:00:00.000Z
CVE-2022-22732 
A CWE-668: Exposure of Resource to Wrong Sphere vulnerability exists that could cause all remote domains to access the resources (data) supplied by the server when an attacker sends a fetch request from third-party site or malicious site. Affected Products: EcoStruxure Power Commission (Versions prior to V2.22)
Problem types: cwe_id: CWE-668
description: CWE-668 Exposure of Resource to Wrong Sphere
Affected products: vendor: Schneider Electric
product: EcoStruxure Power Commission
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 3.9
baseSeverity: LOW
Published: 2023-01-30T00:00:00.000Z
CVE-2022-22733 Access-Token in ElasticJob UI causes password disclosure
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache ShardingSphere ElasticJob-UI allows an attacker who has guest account to do privilege escalation. This issue affects Apache ShardingSphere ElasticJob-UI Apache ShardingSphere ElasticJob-UI 3.x version 3.0.0 and prior versions.
Problem types: cwe_id: CWE-200
description: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: Apache Software Foundation
product: Apache ShardingSphere ElasticJob-UI
Published: 2022-01-20T10:25:12.000Z
CVE-2022-22734 Simple Quotation <= 1.3.2 - Quote Creation/Edition via CSRF to Stored Cross-Site Scripting
The Simple Quotation WordPress plugin through 1.3.2 does not have CSRF check when creating or editing a quote and does not sanitise and escape Quotes. As a result, attacker could make a logged in admin create or edit arbitrary quote, and put Cross-Site Scripting payloads in them
Problem types: description: CWE-116 Improper Encoding or Escaping of Output
Affected products: vendor: Unknown
product: Simple Quotation
default_status: affected
Credits: lang: en
value: Abhishek Bhoir
lang: en
value: WPScan
Published: 2022-03-14T14:41:53.000Z
CVE-2022-22735 Simple Quotation <= 1.3.2 - Subscriber+ SQL injection
The Simple Quotation WordPress plugin through 1.3.2 does not have authorisation (and CSRF) checks in various of its AJAX actions and is lacking escaping of user data when using it in SQL statements, allowing any authenticated users, such as subscriber to perform SQL injection attacks
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Simple Quotation
Credits: lang: en
value: abhishek bhoir
Published: 2022-03-14T14:41:54.000Z
CVE-2022-22736 
If Firefox was installed to a world-writable directory, a local privilege escalation could occur when Firefox searched the current directory for system libraries. However the install directory is not world-writable by default.<br>*This bug only affects Firefox for Windows in a non-default installation. Other operating systems are unaffected.*. This vulnerability affects Firefox < 96.
Problem types: description: Potential local privilege escalation when loading modules from the install directory.
Affected products: vendor: Mozilla
product: Firefox
Published: 2022-12-22T00:00:00.000Z
CVE-2022-22737 
Constructing audio sinks could have lead to a race condition when playing audio files and closing windows. This could have lead to a use-after-free causing a potentially exploitable crash. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5.
Problem types: description: Race condition when playing audio files
Affected products: vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Thunderbird
Published: 2022-12-22T00:00:00.000Z
CVE-2022-22738 
Applying a CSS filter effect could have accessed out of bounds memory. This could have lead to a heap-buffer-overflow causing a potentially exploitable crash. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5.
Problem types: description: Heap-buffer-overflow in blendGaussianBlur
Affected products: vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Thunderbird
Published: 2022-12-22T00:00:00.000Z
CVE-2022-22739 
Malicious websites could have tricked users into accepting launching a program to handle an external URL protocol. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5.
Problem types: description: Missing throttling on external protocol launch dialog
Affected products: vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Thunderbird
Published: 2022-12-22T00:00:00.000Z
CVE-2022-22740 
Certain network request objects were freed too early when releasing a network request handle. This could have lead to a use-after-free causing a potentially exploitable crash. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5.
Problem types: description: Use-after-free of ChannelEventQueue::mOwner
Affected products: vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Thunderbird
Published: 2022-12-22T00:00:00.000Z
CVE-2022-22741 
When resizing a popup while requesting fullscreen access, the popup would have become unable to leave fullscreen mode. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5.
Problem types: description: Browser window spoof using fullscreen mode
Affected products: vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Thunderbird
Published: 2022-12-22T00:00:00.000Z
CVE-2022-22742 
When inserting text while in edit mode, some characters might have lead to out-of-bounds memory access causing a potentially exploitable crash. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5.
Problem types: description: Out-of-bounds memory access when inserting text in edit mode
Affected products: vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Thunderbird
Published: 2022-12-22T00:00:00.000Z
CVE-2022-22743 
When navigating from inside an iframe while requesting fullscreen access, an attacker-controlled tab could have made the browser unable to leave fullscreen mode. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5.
Problem types: description: Browser window spoof using fullscreen mode
Affected products: vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Thunderbird
Published: 2022-12-22T00:00:00.000Z
CVE-2022-22744 
The constructed curl command from the "Copy as curl" feature in DevTools was not properly escaped for PowerShell. This could have lead to command injection if pasted into a Powershell prompt.<br>*This bug only affects Thunderbird for Windows. Other operating systems are unaffected.*. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5.
Problem types: description: The 'Copy as curl' feature in DevTools did not fully escape website-controlled data, potentially leading to command injection
Affected products: vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Thunderbird
Published: 2022-12-22T00:00:00.000Z
CVE-2022-22745 
Securitypolicyviolation events could have leaked cross-origin information for frame-ancestors violations. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5.
Problem types: description: Leaking cross-origin URLs through securitypolicyviolation event
Affected products: vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Thunderbird
Published: 2022-12-22T00:00:00.000Z
CVE-2022-22746 
A race condition could have allowed bypassing the fullscreen notification which could have lead to a fullscreen window spoof being unnoticed.<br>*This bug only affects Firefox for Windows. Other operating systems are unaffected.*. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5.
Problem types: description: Calling into reportValidity could have lead to fullscreen window spoof
Affected products: vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Thunderbird
Published: 2022-12-22T00:00:00.000Z
CVE-2022-22747 
After accepting an untrusted certificate, handling an empty pkcs7 sequence as part of the certificate data could have lead to a crash. This crash is believed to be unexploitable. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5.
Problem types: description: Crash when handling empty pkcs7 sequence
Affected products: vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Thunderbird
Published: 2022-12-22T00:00:00.000Z
CVE-2022-22748 
Malicious websites could have confused Firefox into showing the wrong origin when asking to launch a program and handling an external URL protocol. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5.
Problem types: description: Spoofed origin on external protocol launch dialog
Affected products: vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Thunderbird
Published: 2022-12-22T00:00:00.000Z
CVE-2022-22749 
When scanning QR codes, Firefox for Android would have allowed navigation to some URLs that do not point to web content.<br>*This bug only affects Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 96.
Problem types: description: Lack of URL restrictions when scanning QR codes
Affected products: vendor: Mozilla
product: Firefox
Published: 2022-12-22T00:00:00.000Z
CVE-2022-22750 
By generally accepting and passing resource handles across processes, a compromised content process might have confused higher privileged processes to interact with handles that the unprivileged process should not have access to.<br>*This bug only affects Firefox for Windows and MacOS. Other operating systems are unaffected.*. This vulnerability affects Firefox < 96.
Problem types: description: IPC passing of resource handles could have lead to sandbox bypass
Affected products: vendor: Mozilla
product: Firefox
Published: 2022-12-22T00:00:00.000Z
CVE-2022-22751 
Mozilla developers Calixte Denizet, Kershaw Chang, Christian Holler, Jason Kratzer, Gabriele Svelto, Tyson Smith, Simon Giesecke, and Steve Fink reported memory safety bugs present in Firefox 95 and Firefox ESR 91.4. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5.
Problem types: description: Memory safety bugs fixed in Thunderbird 91.5
Affected products: vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Thunderbird
Published: 2022-12-22T00:00:00.000Z
CVE-2022-22752 
Mozilla developers Christian Holler and Jason Kratzer reported memory safety bugs present in Firefox 95. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 96.
Problem types: description: Memory safety bugs fixed in Firefox 96
Affected products: vendor: Mozilla
product: Firefox
Published: 2022-12-22T00:00:00.000Z
CVE-2022-22753 
A Time-of-Check Time-of-Use bug existed in the Maintenance (Updater) Service that could be abused to grant Users write access to an arbitrary directory. This could have been used to escalate to SYSTEM access.<br>*This bug only affects Firefox on Windows. Other operating systems are unaffected.*. This vulnerability affects Firefox < 97, Thunderbird < 91.6, and Firefox ESR < 91.6.
Problem types: description: Privilege Escalation to SYSTEM on Windows via Maintenance Service
Affected products: vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Thunderbird
vendor: Mozilla
product: Firefox ESR
Published: 2022-12-22T00:00:00.000Z
CVE-2022-22754 
If a user installed an extension of a particular type, the extension could have auto-updated itself and while doing so, bypass the prompt which grants the new version the new requested permissions. This vulnerability affects Firefox < 97, Thunderbird < 91.6, and Firefox ESR < 91.6.
Problem types: description: Extensions could have bypassed permission confirmation during update
Affected products: vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Thunderbird
vendor: Mozilla
product: Firefox ESR
Published: 2022-12-22T00:00:00.000Z
CVE-2022-22755 
By using XSL Transforms, a malicious webserver could have served a user an XSL document that would continue to execute JavaScript (within the bounds of the same-origin policy) even after the tab was closed. This vulnerability affects Firefox < 97.
Problem types: description: XSL could have allowed JavaScript execution after a tab was closed
Affected products: vendor: Mozilla
product: Firefox
Published: 2022-12-22T00:00:00.000Z
CVE-2022-22756 
If a user was convinced to drag and drop an image to their desktop or other folder, the resulting object could have been changed into an executable script which would have run arbitrary code after the user clicked on it. This vulnerability affects Firefox < 97, Thunderbird < 91.6, and Firefox ESR < 91.6.
Problem types: description: Drag and dropping an image could have resulted in the dropped object being an executable
Affected products: vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Thunderbird
vendor: Mozilla
product: Firefox ESR
Published: 2022-12-22T00:00:00.000Z
CVE-2022-22757 
Remote Agent, used in WebDriver, did not validate the Host or Origin headers. This could have allowed websites to connect back locally to the user's browser to control it. <br>*This bug only affected Firefox when WebDriver was enabled, which is not the default configuration.*. This vulnerability affects Firefox < 97.
Problem types: description: Remote Agent did not prevent local websites from connecting
Affected products: vendor: Mozilla
product: Firefox
Published: 2022-12-22T00:00:00.000Z
CVE-2022-22758 
When clicking on a tel: link, USSD codes, specified after a <code>\*</code> character, would be included in the phone number. On certain phones, or on certain carriers, if the number was dialed this could perform actions on a user's account, similar to a cross-site request forgery attack.<br>*This bug only affects Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 97.
Problem types: description: tel: links could have sent USSD codes to the dialer on Firefox for Android
Affected products: vendor: Mozilla
product: Firefox
Published: 2022-12-22T00:00:00.000Z
CVE-2022-22759 
If a document created a sandboxed iframe without <code>allow-scripts</code>, and subsequently appended an element to the iframe's document that e.g. had a JavaScript event handler - the event handler would have run despite the iframe's sandbox. This vulnerability affects Firefox < 97, Thunderbird < 91.6, and Firefox ESR < 91.6.
Problem types: description: Sandboxed iframes could have executed script if the parent appended elements
Affected products: vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Thunderbird
vendor: Mozilla
product: Firefox ESR
Published: 2022-12-22T00:00:00.000Z
CVE-2022-22760 
When importing resources using Web Workers, error messages would distinguish the difference between <code>application/javascript</code> responses and non-script responses. This could have been abused to learn information cross-origin. This vulnerability affects Firefox < 97, Thunderbird < 91.6, and Firefox ESR < 91.6.
Problem types: description: Cross-Origin responses could be distinguished between script and non-script content-types
Affected products: vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Thunderbird
vendor: Mozilla
product: Firefox ESR
Published: 2022-12-22T00:00:00.000Z
CVE-2022-22761 
Web-accessible extension pages (pages with a moz-extension:// scheme) were not correctly enforcing the frame-ancestors directive when it was used in the Web Extension's Content Security Policy. This vulnerability affects Firefox < 97, Thunderbird < 91.6, and Firefox ESR < 91.6.
Problem types: description: frame-ancestors Content Security Policy directive was not enforced for framed extension pages
Affected products: vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Thunderbird
vendor: Mozilla
product: Firefox ESR
Published: 2022-12-22T00:00:00.000Z
CVE-2022-22762 
Under certain circumstances, a JavaScript alert (or prompt) could have been shown while another website was displayed underneath it. This could have been abused to trick the user. <br>*This bug only affects Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 97.
Problem types: description: JavaScript Dialogs could have been displayed over other domains on Firefox for Android
Affected products: vendor: Mozilla
product: Firefox
Published: 2022-12-22T00:00:00.000Z
CVE-2022-22763 
When a worker is shutdown, it was possible to cause script to run late in the lifecycle, at a point after where it should not be possible. This vulnerability affects Firefox < 96, Thunderbird < 91.6, and Firefox ESR < 91.6.
Problem types: description: Script Execution during invalid object state
Affected products: vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Thunderbird
vendor: Mozilla
product: Firefox ESR
Published: 2022-12-22T00:00:00.000Z
CVE-2022-22764 
Mozilla developers Paul Adenot and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 96 and Firefox ESR 91.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 97, Thunderbird < 91.6, and Firefox ESR < 91.6.
Problem types: description: Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6
Affected products: vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Thunderbird
vendor: Mozilla
product: Firefox ESR
Published: 2022-12-22T00:00:00.000Z
CVE-2022-22765 BD Viper LT System - Hardcoded Credentials
BD Viper LT system, versions 2.0 and later, contains hardcoded credentials. If exploited, threat actors may be able to access, modify or delete sensitive information, including electronic protected health information (ePHI), protected health information (PHI) and personally identifiable information (PII). BD Viper LT system versions 4.0 and later utilize Microsoft Windows 10 and have additional Operating System hardening configurations which increase the attack complexity required to exploit this vulnerability.
Problem types: cwe_id: CWE-798
description: CWE-798 Use of Hard-coded Credentials
Affected products: vendor: Becton Dickinson (BD)
product: BD Viper LT System
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
version: 3.1
Published: 2022-02-12T02:30:40.024Z