rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-26109 
When a user opens a manipulated Portable Document Format (.pdf, PDFView.x3d) received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9.0, the application crashes and becomes temporarily unavailable to the user until restart of the application.
Problem types: cwe_id: CWE-20
description: CWE-20
Affected products: vendor: SAP SE
product: SAP 3D Visual Enterprise Viewer
Published: 2022-04-12T16:11:21.000Z
CVE-2022-26110 
An issue was discovered in HTCondor 8.8.x before 8.8.16, 9.0.x before 9.0.10, and 9.1.x before 9.6.0. When a user authenticates to an HTCondor daemon via the CLAIMTOBE method, the user can then impersonate any entity when issuing additional commands to that daemon.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-06T01:07:11.000Z
CVE-2022-26111 
The BeanShell components of IRISNext through 9.8.28 allow execution of arbitrary commands on the target server by creating a custom search (or editing an existing/predefined search) of the documents. The search components permit adding BeanShell expressions that result in Remote Code Execution in the context of the IRISNext application user, running on the web server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-25T14:38:12.000Z
CVE-2022-26112 Pinot query endpoint and the realtime ingestion layer has a vulnerability in unprotected environments due to a groovy function support
In 0.10.0 or older versions of Apache Pinot, Pinot query endpoint and realtime ingestion layer has a vulnerability in unprotected environments due to a groovy function support. In order to avoid this, we disabled the groovy function support by default from Pinot release 0.11.0. See https://docs.pinot.apache.org/basics/releases/0.11.0
Problem types: description: Pinot query endpoint and the realtime ingestion layer has a vulnerability in unprotected environments due to a groovy function support
Affected products: vendor: Apache Software Foundation
product: Apache Pinot
Credits: lang: en
value: Apache Pinot would like to thank Haoruo Chen(chenhaoruo0128@gmail.com) for reporting the issue
Published: 2022-09-23T08:05:13.000Z
CVE-2022-26113 
An execution with unnecessary privileges vulnerability [CWE-250] in FortiClientWindows 7.0.0 through 7.0.3, 6.4.0 through 6.4.7, 6.2.0 through 6.2.9, 6.0.0 through 6.0.10 may allow a local attacker to perform an arbitrary file write on the system.
Problem types: description: Execute unauthorized code or commands
Affected products: vendor: Fortinet
product: Fortinet FortiClientWindows
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.7
baseSeverity: HIGH
confidentialityImpact: NONE
exploitCodeMaturity: FUNCTIONAL
integrityImpact: HIGH
privilegesRequired: NONE
remediationLevel: UNAVAILABLE
reportConfidence: CONFIRMED
scope: UNCHANGED
temporalScore: 7.5
temporalSeverity: HIGH
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H/E:F/RL:U/RC:C
version: 3.1
Published: 2022-07-18T16:36:04.000Z
CVE-2022-26114 
An improper neutralization of input during web page generation vulnerability [CWE-79] in the Webmail of FortiMail before 7.2.0 may allow an unauthenticated attacker to trigger a cross-site scripting (XSS) attack via sending specially crafted mail messages.
Problem types: description: Execute unauthorized code or commands
Affected products: vendor: Fortinet
product: Fortinet FortiMail
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
exploitCodeMaturity: PROOF_OF_CONCEPT
integrityImpact: LOW
privilegesRequired: LOW
remediationLevel: UNAVAILABLE
reportConfidence: CONFIRMED
scope: CHANGED
temporalScore: 5.1
temporalSeverity: MEDIUM
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:P/RL:U/RC:C
version: 3.1
Published: 2022-09-06T15:15:12.000Z
CVE-2022-26115 
A use of password hash with insufficient computational effort vulnerability [CWE-916] in FortiSandbox before 4.2.0 may allow an attacker with access to the password database to efficiently mount bulk guessing attacks to recover the passwords.
Problem types: cwe_id: CWE-916
description: Execute unauthorized code or commands
Affected products: vendor: Fortinet
product: FortiSandbox
default_status: unaffected
CVSS v3.1: version: 3.1
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:X/RC:X
Published: 2023-02-16T18:07:32.040Z
CVE-2022-26116 
Multiple improper neutralization of special elements used in SQL commands ('SQL Injection') vulnerability [CWE-89] in FortiNAC version 8.3.7 and below, 8.5.2 and below, 8.5.4, 8.6.0, 8.6.5 and below, 8.7.6 and below, 8.8.11 and below, 9.1.5 and below, 9.2.2 and below may allow an authenticated attacker to execute unauthorized code or commands via specifically crafted strings parameters.
Problem types: description: Execute unauthorized code or commands
Affected products: vendor: Fortinet
product: Fortinet FortiNAC
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.2
baseSeverity: HIGH
confidentialityImpact: HIGH
exploitCodeMaturity: PROOF_OF_CONCEPT
integrityImpact: HIGH
privilegesRequired: HIGH
remediationLevel: NOT_DEFINED
reportConfidence: CONFIRMED
scope: UNCHANGED
temporalScore: 6.8
temporalSeverity: MEDIUM
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:C
version: 3.1
Published: 2022-05-11T07:20:10.000Z
CVE-2022-26117 
An empty password in configuration file vulnerability [CWE-258] in FortiNAC version 8.3.7 and below, 8.5.2 and below, 8.5.4, 8.6.0, 8.6.5 and below, 8.7.6 and below, 8.8.11 and below, 9.1.5 and below, 9.2.3 and below may allow an authenticated attacker to access the MySQL databases via the CLI.
Problem types: description: Execute unauthorized code or commands
Affected products: vendor: Fortinet
product: Fortinet FortiNAC
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitCodeMaturity: PROOF_OF_CONCEPT
remediationLevel: NOT_DEFINED
reportConfidence: REASONABLE
baseScore: 8.8
temporalScore: 8
baseSeverity: HIGH
temporalSeverity: HIGH
Published: 2022-07-18T00:00:00.000Z
CVE-2022-26118 
A privilege chaining vulnerability [CWE-268] in FortiManager and FortiAnalyzer 6.0.x, 6.2.x, 6.4.0 through 6.4.7, 7.0.0 through 7.0.3 may allow a local and authenticated attacker with a restricted shell to escalate their privileges to root due to incorrect permissions of some folders and executable files on the system.
Problem types: description: Escalation of privilege
Affected products: vendor: Fortinet
product: Fortinet FortiManager , FortiAnalyzer
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.7
baseSeverity: MEDIUM
confidentialityImpact: HIGH
exploitCodeMaturity: FUNCTIONAL
integrityImpact: HIGH
privilegesRequired: HIGH
remediationLevel: UNAVAILABLE
reportConfidence: CONFIRMED
scope: UNCHANGED
temporalScore: 6.5
temporalSeverity: MEDIUM
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:F/RL:U/RC:C
version: 3.1
Published: 2022-07-18T16:40:52.000Z
CVE-2022-26119 
A improper authentication vulnerability in Fortinet FortiSIEM before 6.5.0 allows a local attacker with CLI access to perform operations on the Glassfish server directly via a hardcoded password.
Problem types: description: Improper access control
Affected products: vendor: Fortinet
product: Fortinet FortiSIEM
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitCodeMaturity: PROOF_OF_CONCEPT
remediationLevel: UNAVAILABLE
reportConfidence: CONFIRMED
baseScore: 7.8
temporalScore: 7.4
baseSeverity: HIGH
temporalSeverity: HIGH
Published: 2022-11-02T00:00:00.000Z
CVE-2022-26120 
Multiple improper neutralization of special elements used in an SQL Command ('SQL Injection') vulnerabilities [CWE-89] in FortiADC management interface 7.0.0 through 7.0.1, 5.0.0 through 6.2.2 may allow an authenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests.
Problem types: description: Execute unauthorized code or commands
Affected products: vendor: Fortinet
product: Fortinet FortiADC
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
exploitCodeMaturity: PROOF_OF_CONCEPT
integrityImpact: LOW
privilegesRequired: LOW
remediationLevel: UNAVAILABLE
reportConfidence: CONFIRMED
scope: UNCHANGED
temporalScore: 5.1
temporalSeverity: MEDIUM
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N/E:P/RL:U/RC:C
version: 3.1
Published: 2022-07-18T16:41:00.000Z
CVE-2022-26121 
An exposure of resource to wrong sphere vulnerability [CWE-668] in FortiAnalyzer and FortiManager GUI 7.0.0 through 7.0.3, 6.4.0 through 6.4.8, 6.2.0 through 6.2.9, 6.0.0 through 6.0.11, 5.6.0 through 5.6.11 may allow an unauthenticated and remote attacker to access report template images via referencing the name in the URL path.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
exploitCodeMaturity: PROOF_OF_CONCEPT
remediationLevel: OFFICIAL_FIX
reportConfidence: CONFIRMED
baseScore: 3.7
temporalScore: 3.4
baseSeverity: LOW
temporalSeverity: LOW
Published: 2022-10-10T00:00:00.000Z
CVE-2022-26122 
An insufficient verification of data authenticity vulnerability [CWE-345] in FortiClient, FortiMail and FortiOS AV engines version 6.2.168 and below and version 6.4.274 and below may allow an attacker to bypass the AV engine via manipulating MIME attachment with junk and pad characters in base64.
Problem types: description: Denial of service
Affected products: vendor: Fortinet
product: Fortinet AV Engine, FortiMail, FortiOS, FortiClient
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N/E:P/RL:U/RC:R
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: NONE
integrityImpact: LOW
availabilityImpact: NONE
exploitCodeMaturity: PROOF_OF_CONCEPT
remediationLevel: UNAVAILABLE
reportConfidence: REASONABLE
baseScore: 4.7
temporalScore: 4.3
baseSeverity: MEDIUM
temporalSeverity: MEDIUM
Published: 2022-11-02T00:00:00.000Z
CVE-2022-26124 
Improper buffer restrictions in BIOS firmware for some Intel(R) NUC Boards, Intel(R) NUC 8 Boards, Intel(R) NUC 8 Rugged Boards and Intel(R) NUC 8 Rugged Kits before version CHAPLCEL.0059 may allow a privileged user to potentially enable escalation of privilege via local access.
Problem types: description: escalation of privilege
Affected products: vendor: n/a
product: Intel(R) NUC Boards, Intel(R) NUC 8 Boards, Intel(R) NUC 8 Rugged Boards and Intel(R) NUC 8 Rugged Kits
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 7.5
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Published: 2022-11-11T15:48:53.869Z
CVE-2022-26125 
Buffer overflow vulnerabilities exist in FRRouting through 8.1.0 due to wrong checks on the input packet length in isisd/isis_tlvs.c.
Problem types: cwe_id: CWE-119
description: CWE-119
Affected products: vendor: n/a
product: FRRouting
Published: 2022-03-03T00:00:00.000Z
CVE-2022-26126 
Buffer overflow vulnerabilities exist in FRRouting through 8.1.0 due to the use of strdup with a non-zero-terminated binary string in isis_nb_notifications.c.
Problem types: cwe_id: CWE-119
description: CWE-119
Affected products: vendor: n/a
product: FRRouting
Published: 2022-03-03T00:00:00.000Z
CVE-2022-26127 
A buffer overflow vulnerability exists in FRRouting through 8.1.0 due to missing a check on the input packet length in the babel_packet_examin function in babeld/message.c.
Problem types: cwe_id: CWE-119
description: CWE-119
Affected products: vendor: n/a
product: FRRouting
Published: 2022-03-03T17:21:19.000Z
CVE-2022-26128 
A buffer overflow vulnerability exists in FRRouting through 8.1.0 due to a wrong check on the input packet length in the babel_packet_examin function in babeld/message.c.
Problem types: cwe_id: CWE-119
description: CWE-119
Affected products: vendor: n/a
product: FRRouting
Published: 2022-03-03T17:22:29.000Z
CVE-2022-26129 
Buffer overflow vulnerabilities exist in FRRouting through 8.1.0 due to wrong checks on the subtlv length in the functions, parse_hello_subtlv, parse_ihu_subtlv, and parse_update_subtlv in babeld/message.c.
Problem types: cwe_id: CWE-119
description: CWE-119
Affected products: vendor: n/a
product: FRRouting
Published: 2022-03-03T17:24:08.000Z
CVE-2022-26130 
On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, and 13.1.x versions prior to 13.1.5, when an Active mode-enabled FTP profile is configured on a virtual server, undisclosed traffic can cause the virtual server to stop processing active FTP data channel connections. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
Problem types: cwe_id: CWE-754
description: CWE-754 Improper Check for Unusual or Exceptional Conditions
Affected products: vendor: F5
product: BIG-IP
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
version: 3.1
Published: 2022-05-05T16:24:09.410Z
CVE-2022-26131 ICSA-22-063-01 Improper Protection against Electromagnetic Fault Injection in Trailer Power Line Communications (PLC) J2497
Power Line Communications PLC4TRUCKS J2497 trailer receivers are susceptible to remote RF induced signals.
Problem types: cwe_id: CWE-1319
description: CWE-1319
Affected products: vendor: Power Line Communications
product: PLC4TRUCKS
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 9.3
baseSeverity: CRITICAL
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H
version: 3.1
Credits: lang: en
value: National Motor Freight Traffic Association, Inc. (NMFTA) researcher Ben Gardiner, NMFTA motor freight carrier members, and Assured Information Security researchers Chris Poore, Dan Salloum, and Eric Thayer reported this vulnerability to CISA.
Published: 2022-03-07T15:28:28.000Z
CVE-2022-26133 
SharedSecretClusterAuthenticator in Atlassian Bitbucket Data Center versions 5.14.0 and later before 7.6.14, 7.7.0 and later prior to 7.17.6, 7.18.0 and later prior to 7.18.4, 7.19.0 and later prior to 7.19.4, and 7.20.0 allow a remote, unauthenticated attacker to execute arbitrary code via Java deserialization.
Problem types: description: Deserialization of untrusted data
Affected products: vendor: Atlassian
product: Bitbucket Data Center
Published: 2022-04-20T18:30:19.225Z
CVE-2022-26134 
In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are from 1.3.0 before 7.4.17, from 7.13.0 before 7.13.7, from 7.14.0 before 7.14.3, from 7.15.0 before 7.15.2, from 7.16.0 before 7.16.4, from 7.17.0 before 7.17.4, and from 7.18.0 before 7.18.1.
Problem types: description: Remote Code Execution
Affected products: vendor: Atlassian
product: Confluence Data Center
vendor: Atlassian
product: Confluence Server
Published: 2022-06-03T21:51:57.134Z
CVE-2022-26135 
A vulnerability in Mobile Plugin for Jira Data Center and Server allows a remote, authenticated user (including a user who joined via the sign-up feature) to perform a full read server-side request forgery via a batch endpoint. This affects Atlassian Jira Server and Data Center from version 8.0.0 before version 8.13.22, from version 8.14.0 before 8.20.10, from version 8.21.0 before 8.22.4. This also affects Jira Management Server and Data Center versions from version 4.0.0 before 4.13.22, from version 4.14.0 before 4.20.10 and from version 4.21.0 before 4.22.4.
Problem types: description: Server-side Request Forgery
Affected products: vendor: Atlassian
product: Jira Core Server
vendor: Atlassian
product: Jira Software Server
vendor: Atlassian
product: Jira Software Data Center
vendor: Atlassian
product: Jira Service Management Server
vendor: Atlassian
product: Jira Service Management Data Center
Published: 2022-06-30T05:20:15.269Z
CVE-2022-26136 
A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to bypass Servlet Filters used by first and third party apps. The impact depends on which filters are used by each app, and how the filters are used. This vulnerability can result in authentication bypass and cross-site scripting. Atlassian has released updates that fix the root cause of this vulnerability, but has not exhaustively enumerated all potential consequences of this vulnerability. Atlassian Bamboo versions are affected before 8.0.9, from 8.1.0 before 8.1.8, and from 8.2.0 before 8.2.4. Atlassian Bitbucket versions are affected before 7.6.16, from 7.7.0 before 7.17.8, from 7.18.0 before 7.19.5, from 7.20.0 before 7.20.2, from 7.21.0 before 7.21.2, and versions 8.0.0 and 8.1.0. Atlassian Confluence versions are affected before 7.4.17, from 7.5.0 before 7.13.7, from 7.14.0 before 7.14.3, from 7.15.0 before 7.15.2, from 7.16.0 before 7.16.4, from 7.17.0 before 7.17.4, and version 7.21.0. Atlassian Crowd versions are affected before 4.3.8, from 4.4.0 before 4.4.2, and version 5.0.0. Atlassian Fisheye and Crucible versions before 4.8.10 are affected. Atlassian Jira versions are affected before 8.13.22, from 8.14.0 before 8.20.10, and from 8.21.0 before 8.22.4. Atlassian Jira Service Management versions are affected before 4.13.22, from 4.14.0 before 4.20.10, and from 4.21.0 before 4.22.4.
Problem types: cwe_id: CWE-180
description: Incorrect Behavior Order: Validate Before Canonicalize (CWE-180).
Affected products: vendor: Atlassian
product: Bamboo Server
vendor: Atlassian
product: Bamboo Data Center
vendor: Atlassian
product: Bitbucket Server
vendor: Atlassian
product: Bitbucket Data Center
vendor: Atlassian
product: Confluence Server
vendor: Atlassian
product: Confluence Data Center
vendor: Atlassian
product: Crowd Server
vendor: Atlassian
product: Crowd Data Center
vendor: Atlassian
product: Crucible
vendor: Atlassian
product: Fisheye
vendor: Atlassian
product: Jira Core Server
vendor: Atlassian
product: Jira Software Server
vendor: Atlassian
product: Jira Software Data Center
vendor: Atlassian
product: Jira Service Management Server
vendor: Atlassian
product: Jira Service Management Data Center
Published: 2022-07-20T17:25:18.803Z
CVE-2022-26137 
A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to cause additional Servlet Filters to be invoked when the application processes requests or responses. Atlassian has confirmed and fixed the only known security issue associated with this vulnerability: Cross-origin resource sharing (CORS) bypass. Sending a specially crafted HTTP request can invoke the Servlet Filter used to respond to CORS requests, resulting in a CORS bypass. An attacker that can trick a user into requesting a malicious URL can access the vulnerable application with the victim’s permissions. Atlassian Bamboo versions are affected before 8.0.9, from 8.1.0 before 8.1.8, and from 8.2.0 before 8.2.4. Atlassian Bitbucket versions are affected before 7.6.16, from 7.7.0 before 7.17.8, from 7.18.0 before 7.19.5, from 7.20.0 before 7.20.2, from 7.21.0 before 7.21.2, and versions 8.0.0 and 8.1.0. Atlassian Confluence versions are affected before 7.4.17, from 7.5.0 before 7.13.7, from 7.14.0 before 7.14.3, from 7.15.0 before 7.15.2, from 7.16.0 before 7.16.4, from 7.17.0 before 7.17.4, and version 7.21.0. Atlassian Crowd versions are affected before 4.3.8, from 4.4.0 before 4.4.2, and version 5.0.0. Atlassian Fisheye and Crucible versions before 4.8.10 are affected. Atlassian Jira versions are affected before 8.13.22, from 8.14.0 before 8.20.10, and from 8.21.0 before 8.22.4. Atlassian Jira Service Management versions are affected before 4.13.22, from 4.14.0 before 4.20.10, and from 4.21.0 before 4.22.4.
Problem types: cwe_id: CWE-180
description: Incorrect Behavior Order: Validate Before Canonicalize (CWE-180)
Affected products: vendor: Atlassian
product: Bamboo Server
vendor: Atlassian
product: Bamboo Data Center
vendor: Atlassian
product: Bitbucket Server
vendor: Atlassian
product: Bitbucket Data Center
vendor: Atlassian
product: Confluence Server
vendor: Atlassian
product: Confluence Data Center
vendor: Atlassian
product: Crowd Server
vendor: Atlassian
product: Crowd Data Center
vendor: Atlassian
product: Crucible
vendor: Atlassian
product: Fisheye
vendor: Atlassian
product: Jira Core Server
vendor: Atlassian
product: Jira Software Server
vendor: Atlassian
product: Jira Software Data Center
vendor: Atlassian
product: Jira Service Management Server
vendor: Atlassian
product: Jira Service Management Data Center
Published: 2022-07-20T17:25:23.603Z
CVE-2022-26138 
The Atlassian Questions For Confluence app for Confluence Server and Data Center creates a Confluence user account in the confluence-users group with the username disabledsystemuser and a hardcoded password. A remote, unauthenticated attacker with knowledge of the hardcoded password could exploit this to log into Confluence and access all content accessible to users in the confluence-users group. This user account is created when installing versions 2.7.34, 2.7.35, and 3.0.2 of the app.
Problem types: cwe_id: CWE-798
description: Use of Hard-coded Credentials (CWE-798)
Affected products: vendor: Atlassian
product: Questions For Confluence
Published: 2022-07-20T17:25:26.913Z
CVE-2022-26143 
The TP-240 (aka tp240dvr) component in Mitel MiCollab before 9.4 SP1 FP1 and MiVoice Business Express through 8.1 allows remote attackers to obtain sensitive information and cause a denial of service (performance degradation and excessive outbound traffic). This was exploited in the wild in February and March 2022 for the TP240PhoneHome DDoS attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-09T15:32:54.000Z
CVE-2022-26144 
An XSS issue was discovered in MantisBT before 2.25.3. Improper escaping of a Plugin name allows execution of arbitrary code (if CSP allows it) in manage_plugin_page.php and manage_plugin_uninstall.php when a crafted plugin is installed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-13T13:54:05.000Z
CVE-2022-26146 
Tricentis qTest before 10.4 allows stored XSS by an authenticated attacker.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-26T19:03:30.000Z
CVE-2022-26147 
The Quectel RG502Q-EA modem before 2022-02-23 allow OS Command Injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-21T14:26:40.000Z