rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-44427 
In wlan driver, there is a possible missing bounds check. This could lead to local denial of service in wlan services.
Problem types: cwe_id: CWE-122
description: cwe-122 Heap Overflow
Affected products: vendor: Unisoc (Shanghai) Technologies Co., Ltd.
product: SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000
Published: 2023-01-04T00:00:00.000Z
CVE-2022-44428 
In wlan driver, there is a possible missing bounds check. This could lead to local denial of service in wlan services.
Problem types: cwe_id: CWE-122
description: cwe-122 Heap Overflow
Affected products: vendor: Unisoc (Shanghai) Technologies Co., Ltd.
product: SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000
Published: 2023-01-04T00:00:00.000Z
CVE-2022-44429 
In wlan driver, there is a possible missing bounds check. This could lead to local denial of service in wlan services.
Problem types: cwe_id: CWE-122
description: cwe-122 Heap Overflow
Affected products: vendor: Unisoc (Shanghai) Technologies Co., Ltd.
product: SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000
Published: 2023-01-04T00:00:00.000Z
CVE-2022-44430 
In wlan driver, there is a possible missing bounds check. This could lead to local denial of service in wlan services.
Problem types: cwe_id: CWE-122
description: cwe-122 Heap Overflow
Affected products: vendor: Unisoc (Shanghai) Technologies Co., Ltd.
product: SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000
Published: 2023-01-04T00:00:00.000Z
CVE-2022-44431 
In wlan driver, there is a possible missing bounds check. This could lead to local denial of service in wlan services.
Problem types: cwe_id: CWE-787
description: cwe-787 Out-of-bounds Write
Affected products: vendor: Unisoc (Shanghai) Technologies Co., Ltd.
product: SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000
Published: 2023-01-04T00:00:00.000Z
CVE-2022-44432 
In wlan driver, there is a possible missing bounds check. This could lead to local denial of service in wlan services.
Problem types: cwe_id: CWE-190
description: cwe-190 Integer Overflow
Affected products: vendor: Unisoc (Shanghai) Technologies Co., Ltd.
product: SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000
Published: 2023-01-04T00:00:00.000Z
CVE-2022-44433 
In phoneEx service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges.
Affected products: vendor: Unisoc (Shanghai) Technologies Co., Ltd.
product: SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000
default_status: unaffected
Published: 2023-05-09T01:21:36.081Z
CVE-2022-44434 
In messaging service, there is a missing permission check. This could lead to local denial of service in contacts service with no additional execution privileges needed.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: Unisoc (Shanghai) Technologies Co., Ltd.
product: SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000
Published: 2023-01-04T00:00:00.000Z
CVE-2022-44435 
In messaging service, there is a missing permission check. This could lead to local denial of service in contacts service with no additional execution privileges needed.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: Unisoc (Shanghai) Technologies Co., Ltd.
product: SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000
Published: 2023-01-04T00:00:00.000Z
CVE-2022-44436 
In messaging service, there is a missing permission check. This could lead to local denial of service in contacts service with no additional execution privileges needed.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: Unisoc (Shanghai) Technologies Co., Ltd.
product: SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000
Published: 2023-01-04T00:00:00.000Z
CVE-2022-44437 
In messaging service, there is a missing permission check. This could lead to local denial of service in contacts service with no additional execution privileges needed.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: Unisoc (Shanghai) Technologies Co., Ltd.
product: SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000
Published: 2023-01-04T00:00:00.000Z
CVE-2022-44438 
In messaging service, there is a missing permission check. This could lead to local denial of service in contacts service with no additional execution privileges needed.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: Unisoc (Shanghai) Technologies Co., Ltd.
product: SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000
Published: 2023-01-04T00:00:00.000Z
CVE-2022-44439 
In messaging service, there is a missing permission check. This could lead to local denial of service in contacts service with no additional execution privileges needed.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: Unisoc (Shanghai) Technologies Co., Ltd.
product: SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000
Published: 2023-01-04T00:00:00.000Z
CVE-2022-44440 
In wlan driver, there is a possible missing bounds check. This could lead to local denial of service in wlan services.
Problem types: cwe_id: CWE-125
description: CWE-125 Out-of-bounds Read
Affected products: vendor: Unisoc (Shanghai) Technologies Co., Ltd.
product: SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000
Published: 2023-01-04T00:00:00.000Z
CVE-2022-44441 
In wlan driver, there is a possible missing bounds check. This could lead to local denial of service in wlan services.
Problem types: cwe_id: CWE-125
description: CWE-125 Out-of-bounds Read
Affected products: vendor: Unisoc (Shanghai) Technologies Co., Ltd.
product: SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000
Published: 2023-01-04T00:00:00.000Z
CVE-2022-44442 
In wlan driver, there is a possible missing bounds check, This could lead to local denial of service in wlan services.
Problem types: cwe_id: CWE-125
description: CWE-125 Out-of-bounds Read
Affected products: vendor: Unisoc (Shanghai) Technologies Co., Ltd.
product: SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000
Published: 2023-01-04T00:00:00.000Z
CVE-2022-44443 
In wlan driver, there is a possible missing bounds check. This could lead to local denial of service in wlan services.
Problem types: cwe_id: CWE-126
description: CWE-126 Buffer Over-read
Affected products: vendor: Unisoc (Shanghai) Technologies Co., Ltd.
product: SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000
Published: 2023-01-04T00:00:00.000Z
CVE-2022-44444 
In wlan driver, there is a possible missing bounds check. This could lead to local denial of service in wlan services.
Problem types: cwe_id: CWE-191
description: CWE-191 Integer Underflow
Affected products: vendor: Unisoc (Shanghai) Technologies Co., Ltd.
product: SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000
Published: 2023-01-04T00:00:00.000Z
CVE-2022-44445 
In wlan driver, there is a possible missing bounds check. This could lead to local denial of service in wlan services.
Problem types: cwe_id: CWE-126
description: CWE-126 Buffer Over-read
Affected products: vendor: Unisoc (Shanghai) Technologies Co., Ltd.
product: SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000
Published: 2023-01-04T00:00:00.000Z
CVE-2022-44446 
In wlan driver, there is a possible missing bounds check. This could lead to local denial of service in wlan services.
Problem types: cwe_id: CWE-126
description: cwe-126 Buffer Over-read
Affected products: vendor: Unisoc (Shanghai) Technologies Co., Ltd.
product: SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000
Published: 2023-01-04T00:00:00.000Z
CVE-2022-44447 
In wlan driver, there is a possible null pointer dereference issue due to a missing bounds check. This could lead to local denial of service in wlan services.
Problem types: description: n/a
Affected products: vendor: Unisoc (Shanghai) Technologies Co., Ltd.
product: SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000
default_status: unaffected
Published: 2023-02-06T05:27:55.591Z
CVE-2022-44448 
In wlan driver, there is a possible missing params check. This could lead to local denial of service in wlan services.
Problem types: description: n/a
Affected products: vendor: Unisoc (Shanghai) Technologies Co., Ltd.
product: SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000
default_status: unaffected
Published: 2023-02-06T05:27:40.636Z
CVE-2022-44449 
Stored cross-site scripting vulnerability in Zenphoto versions prior to 1.6 allows remote a remote authenticated attacker with an administrative privilege to inject an arbitrary script.
Problem types: description: Cross-site scripting
Affected products: vendor: Zenphoto
product: Zenphoto
Published: 2022-12-21T00:00:00.000Z
CVE-2022-44451 
A use of uninitialized pointer vulnerability exists in the MSI format atom functionality of Open Babel 3.1.1 and master commit 530dbfa3. A specially crafted malformed file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.
Problem types: cwe_id: CWE-824
description: CWE-824: Access of Uninitialized Pointer
Affected products: vendor: Open Babel
product: Open Babel
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
Credits: lang: en
value: Discovered by Claudio Bozzato of Cisco Talos.
Published: 2023-07-21T20:25:39.864Z
CVE-2022-44455 The appspawn and nwebspawn services were found to be vulnerable to buffer overflow vulnerability due to insufficient input validation.
The appspawn and nwebspawn services within OpenHarmony-v3.1.2 and prior versions were found to be vulnerable to buffer overflow vulnerability due to insufficient input validation. An unprivileged malicious application would be able to gain code execution within any application installed on the device or cause application crash.
Problem types: cwe_id: CWE-120
description: CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Affected products: vendor: OpenHarmony
product: OpenHarmony
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 6.8
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
version: 3.1
Published: 2022-12-08T00:00:00.000Z
CVE-2022-44456 
CONPROSYS HMI System (CHS) Ver.3.4.4?and earlier allows a remote unauthenticated attacker to execute an arbitrary OS command on the server where the product is running by sending a specially crafted request.
Problem types: description: OS Command Injection
Affected products: vendor: Contec Co., Ltd.
product: CONPROSYS HMI System (CHS)
Published: 2022-12-19T00:00:00.000Z
CVE-2022-44457 
A vulnerability has been identified in Mendix SAML (Mendix 7 compatible) (All versions < V1.17.0), Mendix SAML (Mendix 7 compatible) (All versions >= V1.17.0 < V1.17.2), Mendix SAML (Mendix 8 compatible) (All versions < V2.3.0), Mendix SAML (Mendix 8 compatible) (All versions >= V2.3.0 < V2.3.2), Mendix SAML (Mendix 9 compatible, New Track) (All versions < V3.3.1), Mendix SAML (Mendix 9 compatible, New Track) (All versions >= V3.3.1 < V3.3.5), Mendix SAML (Mendix 9 compatible, Upgrade Track) (All versions < V3.3.0), Mendix SAML (Mendix 9 compatible, Upgrade Track) (All versions >= V3.3.0 < V3.3.4). Affected versions of the module insufficiently protect from packet capture replay, only when the not recommended, non default configuration option `'Allow Idp Initiated Authentication'` is enabled. This CVE entry describes the incomplete fix for CVE-2022-37011 in a specific non default configuration.
Problem types: cwe_id: CWE-294
description: CWE-294: Authentication Bypass by Capture-replay
Affected products: vendor: Siemens
product: Mendix SAML (Mendix 7 compatible)
vendor: Siemens
product: Mendix SAML (Mendix 7 compatible)
vendor: Siemens
product: Mendix SAML (Mendix 8 compatible)
vendor: Siemens
product: Mendix SAML (Mendix 8 compatible)
vendor: Siemens
product: Mendix SAML (Mendix 9 compatible, New Track)
vendor: Siemens
product: Mendix SAML (Mendix 9 compatible, New Track)
vendor: Siemens
product: Mendix SAML (Mendix 9 compatible, Upgrade Track)
vendor: Siemens
product: Mendix SAML (Mendix 9 compatible, Upgrade Track)
Published: 2022-11-08T00:00:00.000Z
CVE-2022-44462 AEM Reflected XSS Arbitrary code execution
Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
Problem types: cwe_id: CWE-79
description: Cross-site Scripting (Reflected XSS) (CWE-79)
Affected products: vendor: Adobe
product: Experience Manager
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
Published: 2022-12-19T10:00:14.221Z
CVE-2022-44463 AEM Reflected XSS Arbitrary code execution
Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
Problem types: cwe_id: CWE-79
description: Cross-site Scripting (Reflected XSS) (CWE-79)
Affected products: vendor: Adobe
product: Experience Manager
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
Published: 2022-12-21T01:21:43.830Z
CVE-2022-44465 AEM Reflected XSS Arbitrary code execution
Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
Problem types: cwe_id: CWE-79
description: Cross-site Scripting (Reflected XSS) (CWE-79)
Affected products: vendor: Adobe
product: Experience Manager
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
Published: 2022-12-21T01:21:43.830Z
CVE-2022-44466 AEM Reflected XSS Arbitrary code execution
Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
Problem types: cwe_id: CWE-79
description: Cross-site Scripting (Reflected XSS) (CWE-79)
Affected products: vendor: Adobe
product: Experience Manager
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
Published: 2022-12-21T01:21:43.830Z
CVE-2022-44467 AEM Reflected XSS Arbitrary code execution
Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
Problem types: cwe_id: CWE-79
description: Cross-site Scripting (Reflected XSS) (CWE-79)
Affected products: vendor: Adobe
product: Experience Manager
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
Published: 2022-12-21T01:21:43.830Z
CVE-2022-44468 AEM Reflected XSS Arbitrary code execution
Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
Problem types: cwe_id: CWE-79
description: Cross-site Scripting (Reflected XSS) (CWE-79)
Affected products: vendor: Adobe
product: Experience Manager
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
Published: 2022-12-19T10:00:54.974Z
CVE-2022-44469 AEM Reflected XSS Arbitrary code execution
Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
Problem types: cwe_id: CWE-79
description: Cross-site Scripting (Reflected XSS) (CWE-79)
Affected products: vendor: Adobe
product: Experience Manager
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
Published: 2022-12-19T10:00:54.974Z
CVE-2022-44470 AEM Reflected XSS Arbitrary code execution
Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
Problem types: cwe_id: CWE-79
description: Cross-site Scripting (Reflected XSS) (CWE-79)
Affected products: vendor: Adobe
product: Experience Manager
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
Published: 2022-12-21T01:21:43.830Z
CVE-2022-44471 AEM Reflected XSS Arbitrary code execution
Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
Problem types: cwe_id: CWE-79
description: Cross-site Scripting (Reflected XSS) (CWE-79)
Affected products: vendor: Adobe
product: Experience Manager
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
Published: 2022-12-21T01:21:43.830Z
CVE-2022-44473 AEM Reflected XSS Arbitrary code execution
Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
Problem types: cwe_id: CWE-79
description: Cross-site Scripting (Reflected XSS) (CWE-79)
Affected products: vendor: Adobe
product: Experience Manager
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
Published: 2022-12-19T10:00:54.974Z
CVE-2022-44474 AEM Reflected XSS Arbitrary code execution
Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
Problem types: cwe_id: CWE-79
description: Cross-site Scripting (Reflected XSS) (CWE-79)
Affected products: vendor: Adobe
product: Experience Manager
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
Published: 2022-12-21T01:21:43.830Z
CVE-2022-44488 AEM URL Redirection to Untrusted Site Security feature bypass
Adobe Experience Manager version 6.5.14 (and earlier) is affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. A low-privilege authenticated attacker could leverage this vulnerability to redirect users to malicious websites. Exploitation of this issue requires user interaction.
Problem types: cwe_id: CWE-601
description: URL Redirection to Untrusted Site ('Open Redirect') (CWE-601)
Affected products: vendor: Adobe
product: Experience Manager
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 3.5
baseSeverity: LOW
Published: 2022-12-21T01:21:43.830Z