rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-22339 
IBM Planning Analytics 2.0 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 219736.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: Planning Analytics
Published: 2022-04-08T15:30:21.703Z
CVE-2022-22344 
IBM Spectrum Copy Data Management 2.2.0.0 through 2.2.14.3 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking. IBM X-Force ID: 220038
Problem types: description: Gain Access
Affected products: vendor: IBM
product: Spectrum Copy Data Management
Published: 2022-03-14T16:45:21.409Z
CVE-2022-22345 
IBM QRadar 7.3, 7.4, and 7.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 220041.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: QRadar SIEM
Published: 2022-04-27T15:20:41.328Z
CVE-2022-22346 
IBM Spectrum Protect Operations Center 8.1.0.000 through 8.1.13.xxx is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 220048.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: Spectrum Protect Operations Center
Published: 2022-03-14T17:00:22.782Z
CVE-2022-22348 
IBM Spectrum Protect Operations Center 8.1.0.000 through 8.1.13.xxx is vulnerable to reverse tabnabbing where it could allow a page linked to from within Operations Center to rewrite it. An administrator could enter a link to a malicious URL that another administrator could then click. Once clicked, that malicious URL could then rewrite the original page with a phishing page. IBM X-Force ID: 220139.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Spectrum Protect Operations Center
Published: 2022-03-14T17:00:24.258Z
CVE-2022-22349 
IBM Sterling External Authentication Server 3.4.3.2, 6.0.2.0, and 6.0.3.0 is vulnerable to path traversals, due to not properly validating RESTAPI configuration data. An authorized user could import invalid data which could be used for an attack. IBM X-Force ID: 220144.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: Sterling External Authentication Server
Published: 2022-02-24T17:10:14.818Z
CVE-2022-22350 
IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in CAA to cause a denial of service. IBM X-Force ID: 220394.
Problem types: description: Denial of Service
Affected products: vendor: IBM
product: AIX
vendor: IBM
product: VIOS
Published: 2022-03-02T16:35:17.039Z
CVE-2022-22351 
IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged trusted host user to exploit a vulnerability in the nimsh daemon to cause a denial of service in the nimsh daemon on another trusted host. IBM X-Force ID: 220396
Problem types: description: Denial of Service
Affected products: vendor: IBM
product: AIX
vendor: IBM
product: VIOS
Published: 2022-03-07T16:55:17.127Z
CVE-2022-22352 IBM Sterling B2B Integrator Standard Edition cross-site scripting
IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.2.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.  IBM X-Force ID:  220398.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: IBM
product: Sterling B2B Integrator Standard Edition
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Published: 2023-01-04T17:00:11.456Z
CVE-2022-22353 
IBM Big SQL on IBM Cloud Pak for Data 7.1.0, 7.1.1, 7.2.0, and 7.2.3 could allow an authenticated user with appropriate permissions to obtain sensitive information by bypassing data masking rules using a CREATE TABLE SELECT statement. IBM X-Force ID: 220480.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Big SQL on Cloud Pak for Data
Published: 2022-03-14T17:00:25.751Z
CVE-2022-22354 
IBM Spectrum Protect Plus 10.1.0.0 through 10.1.9.2 and IBM Spectrum Copy Data Management 2.2.0.0 through 2.2.14.3 do not limit the length of a connection which could allow for a Slowloris HTTP denial of service attack to take place. This can cause the Admin Console to become unresponsive. IBM X-Force ID: 220485.
Problem types: description: Denial of Service
Affected products: vendor: IBM
product: Spectrum Copy Data Management
vendor: IBM
product: Spectrum Protect Plus
Published: 2022-03-14T16:45:22.864Z
CVE-2022-22355 
IBM MQ Appliance 9.2 CD and 9.2 LTS are vulnerable to a denial of service in the Login component of the application which could allow an attacker to cause a drop in performance.
Problem types: description: Denial of Service
Affected products: vendor: IBM
product: MQ Appliance
Published: 2022-04-05T16:45:21.335Z
CVE-2022-22356 
IBM MQ Appliance 9.2 CD and 9.2 LTS could allow an attacker to enumerate account credentials due to an observable discrepancy in valid and invalid login attempts. IBM X-Force ID: 220487.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: MQ Appliance
Published: 2022-04-05T16:45:22.946Z
CVE-2022-22358 
IBM Sterling Partner Engagement Manager 6.1.2, 6.2, and Cloud/SasS 22.2 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 220651.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: Sterling Partner Engagement Manager
vendor: IBM
product: Sterling Partner Engagement Manager on Cloud
Published: 2022-07-19T16:25:17.821Z
CVE-2022-22359 
IBM Sterling Partner Engagement Manager 6.1.2, 6.2, and Cloud/SasS 22.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 220652.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: Sterling Partner Engagement Manager on Cloud
vendor: IBM
product: Sterling Partner Engagement Manager
Published: 2022-07-19T16:25:19.483Z
CVE-2022-22360 
IBM Sterling Partner Engagement Manager 6.1.2, 6.2, and Cloud/SasS 22.2 could allow a remote authenticated attacker to conduct an LDAP injection. By using a specially crafted request, an attacker could exploit this vulnerability and could result in in granting permission to unauthorized resources. IBM X-Force ID: 220782.
Problem types: description: Gain Privileges
Affected products: vendor: IBM
product: Sterling Partner Engagement Manager
vendor: IBM
product: Sterling Partner Engagement Manager on Cloud
Published: 2022-07-19T16:25:20.916Z
CVE-2022-22361 
IBM Business Automation Workflow traditional 21.0.1 through 21.0.3, 20.0.0.1 through 20.0.0.2, 19.0.0.1 through 19.0.0.3, 18.0.0.0 through 18.0.0.1, IBM Business Automation Workflow containers V21.0.1 - V21.0.3 20.0.0.1 through 20.0.0.2, IBM Business Process Manager 8.6.0.0 through 8.6.0.201803, and 8.5.0.0 through 8.5.0.201706 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: Business Process Manager
vendor: IBM
product: Business Automation Workflow
Published: 2022-05-31T15:45:13.828Z
CVE-2022-22363 IBM Cognos Controller information disclosure
IBM Cognos Controller 11.0.0 through 11.0.1 and IBM Controller 11.1.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system.
Problem types: cwe_id: CWE-209
description: CWE-209 Generation of Error Message Containing Sensitive Information
Affected products: vendor: IBM
product: Controller
cpes: cpe:2.3:a:ibm:controller:11.1.0:*:*:*:*:*:*:*
default_status: unaffected
vendor: IBM
product: Cognos Controller
cpes: cpe:2.3:a:ibm:cognos_controller:11.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:cognos_controller:11.0.1:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Published: 2025-01-07T16:07:00.578Z
CVE-2022-22364 IBM Cognos Controller security bypass
IBM Cognos Controller 10.4.1, 10.4.2, and 11.0.0 is vulnerable to external service interaction attack, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability to induce the application to perform server-side DNS lookups or HTTP requests to arbitrary domain names. By submitting suitable payloads, an attacker can cause the application server to attack other systems that it can interact with.  IBM X-Force ID:  220903.
Problem types: cwe_id: CWE-350
description: CWE-350 Reliance on Reverse DNS Resolution for a Security-Critical Action
Affected products: vendor: IBM
product: Cognos Controller
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
version: 3.1
Published: 2024-05-03T18:14:34.420Z
CVE-2022-22365 
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0, with the Ajax Proxy Web Application (AjaxProxy.war) deployed, is vulnerable to spoofing by allowing a man-in-the-middle attacker to spoof SSL server hostnames. IBM X-Force ID: 220904.
Problem types: description: Gain Privileges
Affected products: vendor: IBM
product: WebSphere Application Server
Published: 2022-05-20T16:20:19.096Z
CVE-2022-22366 
IBM UrbanCode Deploy (UCD) 6.2.7.15, 7.0.5.10, 7.1.2.6, and 7.2.2.1 stores user credentials in plain clear text which can be read by a local user. IBM X-Force ID: 22106.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: UrbanCode Deploy
Published: 2022-07-01T18:00:24.317Z
CVE-2022-22367 
IBM UrbanCode Deploy (UCD) 6.2.7.15, 7.0.5.10, 7.1.2.6, and 7.2.2.1 could disclose sensitive database information to a local user in plain text. IBM X-Force ID: 221008.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: UrbanCode Deploy
Published: 2022-07-01T18:00:46.781Z
CVE-2022-22368 
IBM Spectrum Scale 5.1.0 through 5.1.3.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 221012.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Spectrum Scale
Published: 2022-05-03T18:20:13.382Z
CVE-2022-22369 
IBM Workload Scheduler 9.4 and 9.5 could allow a local user to overwrite key system files which would cause the system to crash. IBM X-Force ID: 221187.
Problem types: description: Denial of Service
Affected products: vendor: IBM
product: Workload Scheduler
Published: 2022-08-10T16:50:19.326Z
CVE-2022-22370 
IBM Security Verify Access 10.0.0.0, 10.0.1.0, 10.0.2.0, and 10.0.3.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 221194.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Security Verify Access
Published: 2022-07-08T17:45:19.536Z
CVE-2022-22371 IBM Sterling B2B Integrator Standard Edition session fixation
IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.2.1 does not invalidate session after a password change which could allow an authenticated user to impersonate another user on the system.  IBM X-Force ID:  221195.
Problem types: cwe_id: CWE-613
description: CWE-613 Insufficient Session Expiration
Affected products: vendor: IBM
product: Sterling B2B Integrator Standard Edition
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: LOW
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
version: 3.1
Published: 2023-01-04T17:31:51.591Z
CVE-2022-22373 
An improper validation vulnerability in IBM InfoSphere Information Server 11.7 Pack for SAP Apps and BW Packs may lead to creation of directories and files on the server file system that may contain non-sensitive debugging information like stack traces. IBM X-Force ID: 221323.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: InfoSphere Information Server
Published: 2022-07-01T18:01:10.061Z
CVE-2022-22374 
The BMC (IBM Power 9 AC922 OP910, OP920, OP930, and OP940) may be subject to a firmware downgrade attack which may affect its ability to operate its host. IBM X-Force ID: 221442.
Problem types: description: Denial of Service
Affected products: vendor: IBM
product: Power 9 AC922
Published: 2022-03-24T17:20:11.247Z
CVE-2022-22375 IBM Security Verify Privilege command execution

IBM Security Verify Privilege On-Premises 11.5 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request.  IBM X-Force ID:  221681.


Problem types: cwe_id: CWE-434
description: CWE-434 Unrestricted Upload of File with Dangerous Type
Affected products: vendor: IBM
product: Security Verify Privilege
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2023-10-17T01:21:58.685Z
CVE-2022-22377 IBM Security Verify Privilege information disclosure
IBM Security Verify Privilege On-Premises 11.5 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques.  IBM X-Force ID:  221827.
Problem types: cwe_id: CWE-311
description: CWE-311 Missing Encryption of Sensitive Data
Affected products: vendor: IBM
product: Security Verify Privilege
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
version: 3.1
Published: 2023-10-17T00:36:36.434Z
CVE-2022-22380 IBM Security Verify Privilege improper authentication

IBM Security Verify Privilege On-Premises 11.5 could allow an attacker to spoof a trusted entity due to improperly validating certificates.  IBM X-Force ID:  221957.


Problem types: cwe_id: CWE-295
description: CWE-295 Improper Certificate Validation
Affected products: vendor: IBM
product: Security Verify Privilege
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
version: 3.1
Published: 2023-10-17T01:25:30.232Z
CVE-2022-22384 IBM Security Verify Privilege improper input validation

IBM Security Verify Privilege On-Premises 11.5 could allow an attacker to modify messages returned from the server due to hazardous input validation. IBM X-Force ID: 221961.


Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: IBM
product: Security Verify Privilege
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
version: 3.1
Published: 2023-10-17T00:43:12.513Z
CVE-2022-22385 IBM Security Verify Privilege information disclosure

IBM Security Verify Privilege On-Premises 11.5 could disclose sensitive information to an attacked due to the transmission of data in clear text.  IBM X-Force ID:  221962.


Problem types: cwe_id: CWE-319
description: CWE-319 Cleartext Transmission of Sensitive Information
Affected products: vendor: IBM
product: Security Verify Privilege
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2023-10-17T01:11:48.947Z
CVE-2022-22386 IBM Security Verify Privilege information disclosure

IBM Security Verify Privilege On-Premises 11.5 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques.  IBM X-Force ID:  221963.


Problem types: cwe_id: CWE-311
description: CWE-311 Missing Encryption of Sensitive Data
Affected products: vendor: IBM
product: Security Verify Privilege
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
version: 3.1
Published: 2023-10-17T01:08:15.928Z
CVE-2022-22387 
IBM Application Gateway is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 221965.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Application Gateway
Published: 2022-09-28T15:55:13.564Z
CVE-2022-22389 
IBM Db2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, 11.1, and 11.5 is vulnerable to a denial of service as the server may terminate abnormally when executing specially crafted SQL statements by an authenticated user. IBM X-Force ID: 2219740.
Problem types: description: Denial of Service
Affected products: vendor: IBM
product: DB2 for Linux, UNIX and Windows
Published: 2022-06-24T16:45:17.882Z
CVE-2022-22390 
IBM Db2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, 11.1, and 11.5 may be vulnerable to an information disclosure caused by improper privilege management when table function is used. IBM X-Force ID: 221973.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: DB2 for Linux, UNIX and Windows
Published: 2022-06-24T16:45:19.526Z
CVE-2022-22391 
IBM Aspera High-Speed Transfer 4.3.1 and earlier could allow an authenticated user to obtain information from non sensitive operating system files that they should not have access to. IBM X-Force ID: 222059.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Aspera High-Speed Transfer Endpoint
vendor: IBM
product: Aspera High-Speed Transfer Server
Published: 2022-04-14T17:35:10.761Z
CVE-2022-22392 
IBM Planning Analytics Local 2.0 could allow an attacker to upload arbitrary executable files which, when executed by an unsuspecting victim could result in code execution. IBM X-Force ID: 222066.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: Planning Analytics Workspace
Published: 2022-04-25T15:20:17.203Z
CVE-2022-22393 
IBM WebSphere Application Server Liberty 17.0.0.3 through 22.0.0.5 , with the adminCenter-1.0 feature configured, could allow an authenticated user to issue a request to obtain the status of HTTP/HTTPS ports which are accessible by the application server. IBM X-Force ID: 222078.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: WebSphere Application Server Liberty
Published: 2022-05-13T16:15:20.221Z
CVE-2022-22394 
The IBM Spectrum Protect 8.1.14.000 server could allow a remote attacker to bypass security restrictions, caused by improper enforcement of access controls. By signing in, an attacker could exploit this vulnerability to bypass security and gain unauthorized administrator or node access to the vulnerable server.
Problem types: description: Gain Privileges
Affected products: vendor: IBM
product: Spectrum Protect Server
Published: 2022-03-21T16:20:14.517Z
CVE-2022-22396 
Credentials are printed in clear text in the IBM Spectrum Protect Plus 10.1.0.0 through 10.1.9.3 virgo log file in certain cases. Credentials could be the remote vSnap, offload targets, or VADP credentials depending on the operation performed. Credentials that are using API key or certificate are not printed. IBM X-Force ID: 222231.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Spectrum Protect Plus
Published: 2022-06-06T16:30:14.969Z
CVE-2022-22399 IBM Aspera Faspex HTTP header injection
IBM Aspera Faspex 5.0.0 and 5.0.1 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers.  This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking.  IBM X-Force ID:  222562.
Problem types: cwe_id: CWE-644
description: CWE-644 Improper Neutralization of HTTP Headers for Scripting Syntax
Affected products: vendor: IBM
product: Aspera Faspex
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
version: 3.1
Published: 2024-03-05T19:58:53.516Z
CVE-2022-22401 IBM Aspera Faspex information disclosure
IBM Aspera Faspex 5.0.5 could allow a remote attacker to gather or persuade a naive user to supply sensitive information.  IBM X-Force ID:  222567.
Problem types: description: 693 Protection Mechanism Failure
Affected products: vendor: IBM
product: Aspera Faspex
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2023-09-08T21:21:08.972Z