rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-39144 
A vulnerability has been identified in Parasolid V33.1 (All versions < V33.1.262), Parasolid V33.1 (All versions >= V33.1.262 < V33.1.263), Parasolid V34.0 (All versions < V34.0.252), Parasolid V34.1 (All versions < V34.1.242), Parasolid V35.0 (All versions < V35.0.161), Parasolid V35.0 (All versions >= V35.0.161 < V35.0.164), Simcenter Femap V2022.1 (All versions < V2022.1.3), Simcenter Femap V2022.2 (All versions < V2022.2.2). The affected application contains an out of bounds write past the end of an allocated buffer while parsing specially crafted X_T files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-17494)
Problem types: cwe_id: CWE-787
description: CWE-787: Out-of-bounds Write
Affected products: vendor: Siemens
product: Parasolid V33.1
vendor: Siemens
product: Parasolid V33.1
vendor: Siemens
product: Parasolid V34.0
vendor: Siemens
product: Parasolid V34.1
vendor: Siemens
product: Parasolid V35.0
vendor: Siemens
product: Parasolid V35.0
vendor: Siemens
product: Simcenter Femap V2022.1
vendor: Siemens
product: Simcenter Femap V2022.2
Published: 2022-09-13T09:41:00.000Z
CVE-2022-39145 
A vulnerability has been identified in Parasolid V33.1 (All versions < V33.1.262), Parasolid V33.1 (All versions >= V33.1.262 < V33.1.263), Parasolid V34.0 (All versions < V34.0.252), Parasolid V34.1 (All versions < V34.1.242), Parasolid V35.0 (All versions < V35.0.161), Parasolid V35.0 (All versions >= V35.0.161 < V35.0.164), Simcenter Femap V2022.1 (All versions < V2022.1.3), Simcenter Femap V2022.2 (All versions < V2022.2.2). The affected application is vulnerable to out of bounds read past the end of an allocated buffer when parsing X_T files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-17496)
Problem types: cwe_id: CWE-125
description: CWE-125: Out-of-bounds Read
Affected products: vendor: Siemens
product: Parasolid V33.1
vendor: Siemens
product: Parasolid V33.1
vendor: Siemens
product: Parasolid V34.0
vendor: Siemens
product: Parasolid V34.1
vendor: Siemens
product: Parasolid V35.0
vendor: Siemens
product: Parasolid V35.0
vendor: Siemens
product: Simcenter Femap V2022.1
vendor: Siemens
product: Simcenter Femap V2022.2
Published: 2022-09-13T09:41:01.000Z
CVE-2022-39146 
A vulnerability has been identified in Parasolid V33.1 (All versions < V33.1.262), Parasolid V33.1 (All versions >= V33.1.262 < V33.1.263), Parasolid V34.0 (All versions < V34.0.252), Parasolid V34.1 (All versions < V34.1.242), Parasolid V35.0 (All versions < V35.0.161), Parasolid V35.0 (All versions >= V35.0.161 < V35.0.164), Simcenter Femap V2022.1 (All versions < V2022.1.3), Simcenter Femap V2022.2 (All versions < V2022.2.2). The affected application is vulnerable to uninitialized pointer access while parsing specially crafted X_T files. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-17502)
Problem types: cwe_id: CWE-824
description: CWE-824: Access of Uninitialized Pointer
Affected products: vendor: Siemens
product: Parasolid V33.1
vendor: Siemens
product: Parasolid V33.1
vendor: Siemens
product: Parasolid V34.0
vendor: Siemens
product: Parasolid V34.1
vendor: Siemens
product: Parasolid V35.0
vendor: Siemens
product: Parasolid V35.0
vendor: Siemens
product: Simcenter Femap V2022.1
vendor: Siemens
product: Simcenter Femap V2022.2
Published: 2022-09-13T09:41:02.000Z
CVE-2022-39147 
A vulnerability has been identified in Parasolid V33.1 (All versions < V33.1.262), Parasolid V33.1 (All versions >= V33.1.262 < V33.1.263), Parasolid V34.0 (All versions < V34.0.252), Parasolid V34.1 (All versions < V34.1.242), Parasolid V35.0 (All versions < V35.0.161), Parasolid V35.0 (All versions >= V35.0.161 < V35.0.164), Simcenter Femap V2022.1 (All versions < V2022.1.3), Simcenter Femap V2022.2 (All versions < V2022.2.2). The affected application is vulnerable to uninitialized pointer access while parsing specially crafted X_T files. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-17506)
Problem types: cwe_id: CWE-824
description: CWE-824: Access of Uninitialized Pointer
Affected products: vendor: Siemens
product: Parasolid V33.1
vendor: Siemens
product: Parasolid V33.1
vendor: Siemens
product: Parasolid V34.0
vendor: Siemens
product: Parasolid V34.1
vendor: Siemens
product: Parasolid V35.0
vendor: Siemens
product: Parasolid V35.0
vendor: Siemens
product: Simcenter Femap V2022.1
vendor: Siemens
product: Simcenter Femap V2022.2
Published: 2022-09-13T09:41:03.000Z
CVE-2022-39148 
A vulnerability has been identified in Parasolid V33.1 (All versions < V33.1.262), Parasolid V33.1 (All versions >= V33.1.262 < V33.1.263), Parasolid V34.0 (All versions < V34.0.252), Parasolid V34.1 (All versions < V34.1.242), Parasolid V35.0 (All versions < V35.0.161), Parasolid V35.0 (All versions >= V35.0.161 < V35.0.164), Simcenter Femap V2022.1 (All versions < V2022.1.3), Simcenter Femap V2022.2 (All versions < V2022.2.2). The affected application contains an out of bounds write past the end of an allocated buffer while parsing specially crafted X_T files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-17513)
Problem types: cwe_id: CWE-787
description: CWE-787: Out-of-bounds Write
Affected products: vendor: Siemens
product: Parasolid V33.1
vendor: Siemens
product: Parasolid V33.1
vendor: Siemens
product: Parasolid V34.0
vendor: Siemens
product: Parasolid V34.1
vendor: Siemens
product: Parasolid V35.0
vendor: Siemens
product: Parasolid V35.0
vendor: Siemens
product: Simcenter Femap V2022.1
vendor: Siemens
product: Simcenter Femap V2022.2
Published: 2022-09-13T09:41:04.000Z
CVE-2022-39149 
A vulnerability has been identified in Parasolid V33.1 (All versions < V33.1.262), Parasolid V33.1 (All versions >= V33.1.262 < V33.1.263), Parasolid V34.0 (All versions < V34.0.252), Parasolid V34.1 (All versions < V34.1.242), Parasolid V35.0 (All versions < V35.0.161), Parasolid V35.0 (All versions >= V35.0.161 < V35.0.164), Simcenter Femap V2022.1 (All versions < V2022.1.3), Simcenter Femap V2022.2 (All versions < V2022.2.2). The affected application contains an out of bounds write past the end of an allocated buffer while parsing specially crafted X_T files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-17733)
Problem types: cwe_id: CWE-787
description: CWE-787: Out-of-bounds Write
Affected products: vendor: Siemens
product: Parasolid V33.1
vendor: Siemens
product: Parasolid V33.1
vendor: Siemens
product: Parasolid V34.0
vendor: Siemens
product: Parasolid V34.1
vendor: Siemens
product: Parasolid V35.0
vendor: Siemens
product: Parasolid V35.0
vendor: Siemens
product: Simcenter Femap V2022.1
vendor: Siemens
product: Simcenter Femap V2022.2
Published: 2022-09-13T09:41:04.000Z
CVE-2022-39150 
A vulnerability has been identified in Parasolid V33.1 (All versions < V33.1.262), Parasolid V33.1 (All versions >= V33.1.262 < V33.1.263), Parasolid V34.0 (All versions < V34.0.252), Parasolid V34.1 (All versions < V34.1.242), Parasolid V35.0 (All versions < V35.0.161), Parasolid V35.0 (All versions >= V35.0.161 < V35.0.164), Simcenter Femap V2022.1 (All versions < V2022.1.3), Simcenter Femap V2022.2 (All versions < V2022.2.2). The affected application contains an out of bounds write past the end of an allocated buffer while parsing specially crafted X_T files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-17735)
Problem types: cwe_id: CWE-787
description: CWE-787: Out-of-bounds Write
Affected products: vendor: Siemens
product: Parasolid V33.1
vendor: Siemens
product: Parasolid V33.1
vendor: Siemens
product: Parasolid V34.0
vendor: Siemens
product: Parasolid V34.1
vendor: Siemens
product: Parasolid V35.0
vendor: Siemens
product: Parasolid V35.0
vendor: Siemens
product: Simcenter Femap V2022.1
vendor: Siemens
product: Simcenter Femap V2022.2
Published: 2022-09-13T09:41:05.000Z
CVE-2022-39151 
A vulnerability has been identified in Parasolid V33.1 (All versions < V33.1.262), Parasolid V33.1 (All versions >= V33.1.262 < V33.1.263), Parasolid V34.0 (All versions < V34.0.252), Parasolid V34.1 (All versions < V34.1.242), Parasolid V35.0 (All versions < V35.0.161), Parasolid V35.0 (All versions >= V35.0.161 < V35.0.164), Simcenter Femap V2022.1 (All versions < V2022.1.3), Simcenter Femap V2022.2 (All versions < V2022.2.2). The affected application contains an out of bounds write past the end of an allocated buffer while parsing specially crafted X_T files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-17736)
Problem types: cwe_id: CWE-787
description: CWE-787: Out-of-bounds Write
Affected products: vendor: Siemens
product: Parasolid V33.1
vendor: Siemens
product: Parasolid V33.1
vendor: Siemens
product: Parasolid V34.0
vendor: Siemens
product: Parasolid V34.1
vendor: Siemens
product: Parasolid V35.0
vendor: Siemens
product: Parasolid V35.0
vendor: Siemens
product: Simcenter Femap V2022.1
vendor: Siemens
product: Simcenter Femap V2022.2
Published: 2022-09-13T09:41:06.000Z
CVE-2022-39152 
A vulnerability has been identified in Parasolid V33.1 (All versions < V33.1.262), Parasolid V33.1 (All versions >= V33.1.262 < V33.1.263), Parasolid V34.0 (All versions < V34.0.252), Parasolid V34.1 (All versions < V34.1.242), Parasolid V35.0 (All versions < V35.0.161), Parasolid V35.0 (All versions >= V35.0.161 < V35.0.164), Simcenter Femap V2022.1 (All versions < V2022.1.3), Simcenter Femap V2022.2 (All versions < V2022.2.2). The affected application contains an out of bounds write past the end of an allocated buffer while parsing specially crafted X_T files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-17740)
Problem types: cwe_id: CWE-787
description: CWE-787: Out-of-bounds Write
Affected products: vendor: Siemens
product: Parasolid V33.1
vendor: Siemens
product: Parasolid V33.1
vendor: Siemens
product: Parasolid V34.0
vendor: Siemens
product: Parasolid V34.1
vendor: Siemens
product: Parasolid V35.0
vendor: Siemens
product: Parasolid V35.0
vendor: Siemens
product: Simcenter Femap V2022.1
vendor: Siemens
product: Simcenter Femap V2022.2
Published: 2022-09-13T09:41:07.000Z
CVE-2022-39153 
A vulnerability has been identified in Parasolid V33.1 (All versions < V33.1.262), Parasolid V33.1 (All versions >= V33.1.262 < V33.1.263), Parasolid V34.0 (All versions < V34.0.252), Parasolid V34.1 (All versions < V34.1.242), Parasolid V35.0 (All versions < V35.0.161), Parasolid V35.0 (All versions >= V35.0.161 < V35.0.164), Simcenter Femap V2022.1 (All versions < V2022.1.3), Simcenter Femap V2022.2 (All versions < V2022.2.2). The affected application is vulnerable to out of bounds read past the end of an allocated buffer when parsing X_T files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-18187)
Problem types: cwe_id: CWE-125
description: CWE-125: Out-of-bounds Read
Affected products: vendor: Siemens
product: Parasolid V33.1
vendor: Siemens
product: Parasolid V33.1
vendor: Siemens
product: Parasolid V34.0
vendor: Siemens
product: Parasolid V34.1
vendor: Siemens
product: Parasolid V35.0
vendor: Siemens
product: Parasolid V35.0
vendor: Siemens
product: Simcenter Femap V2022.1
vendor: Siemens
product: Simcenter Femap V2022.2
Published: 2022-09-13T09:41:08.000Z
CVE-2022-39154 
A vulnerability has been identified in Parasolid V33.1 (All versions < V33.1.262), Parasolid V33.1 (All versions >= V33.1.262 < V33.1.263), Parasolid V34.0 (All versions < V34.0.252), Parasolid V34.1 (All versions < V34.1.242), Parasolid V35.0 (All versions < V35.0.161), Parasolid V35.0 (All versions >= V35.0.161 < V35.0.164), Simcenter Femap V2022.1 (All versions < V2022.1.3), Simcenter Femap V2022.2 (All versions < V2022.2.2). The affected application contains an out of bounds write past the end of an allocated buffer while parsing specially crafted X_T files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-18188)
Problem types: cwe_id: CWE-787
description: CWE-787: Out-of-bounds Write
Affected products: vendor: Siemens
product: Parasolid V33.1
vendor: Siemens
product: Parasolid V33.1
vendor: Siemens
product: Parasolid V34.0
vendor: Siemens
product: Parasolid V34.1
vendor: Siemens
product: Parasolid V35.0
vendor: Siemens
product: Parasolid V35.0
vendor: Siemens
product: Simcenter Femap V2022.1
vendor: Siemens
product: Simcenter Femap V2022.2
Published: 2022-09-13T09:41:09.000Z
CVE-2022-39155 
A vulnerability has been identified in Parasolid V33.1 (All versions < V33.1.262), Parasolid V33.1 (All versions >= V33.1.262 < V33.1.263), Parasolid V34.0 (All versions < V34.0.252), Parasolid V34.1 (All versions < V34.1.242), Parasolid V35.0 (All versions < V35.0.161), Parasolid V35.0 (All versions >= V35.0.161 < V35.0.164), Simcenter Femap V2022.1 (All versions < V2022.1.3), Simcenter Femap V2022.2 (All versions < V2022.2.2). The affected application contains an out of bounds write past the end of an allocated buffer while parsing specially crafted X_T files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-18192)
Problem types: cwe_id: CWE-787
description: CWE-787: Out-of-bounds Write
Affected products: vendor: Siemens
product: Parasolid V33.1
vendor: Siemens
product: Parasolid V33.1
vendor: Siemens
product: Parasolid V34.0
vendor: Siemens
product: Parasolid V34.1
vendor: Siemens
product: Parasolid V35.0
vendor: Siemens
product: Parasolid V35.0
vendor: Siemens
product: Simcenter Femap V2022.1
vendor: Siemens
product: Simcenter Femap V2022.2
Published: 2022-09-13T09:41:09.000Z
CVE-2022-39156 
A vulnerability has been identified in Parasolid V33.1 (All versions < V33.1.262), Parasolid V33.1 (All versions >= V33.1.262 < V33.1.263), Parasolid V34.0 (All versions < V34.0.252), Parasolid V34.1 (All versions < V34.1.242), Parasolid V35.0 (All versions < V35.0.161), Parasolid V35.0 (All versions >= V35.0.161 < V35.0.164), Simcenter Femap V2022.1 (All versions < V2022.1.3), Simcenter Femap V2022.2 (All versions < V2022.2.2). The affected application is vulnerable to out of bounds read past the end of an allocated buffer when parsing X_T files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-18196)
Problem types: cwe_id: CWE-125
description: CWE-125: Out-of-bounds Read
Affected products: vendor: Siemens
product: Parasolid V33.1
vendor: Siemens
product: Parasolid V33.1
vendor: Siemens
product: Parasolid V34.0
vendor: Siemens
product: Parasolid V34.1
vendor: Siemens
product: Parasolid V35.0
vendor: Siemens
product: Parasolid V35.0
vendor: Siemens
product: Simcenter Femap V2022.1
vendor: Siemens
product: Simcenter Femap V2022.2
Published: 2022-09-13T09:41:10.000Z
CVE-2022-39157 
A vulnerability has been identified in Parasolid V34.0 (All versions < V34.0.252), Parasolid V34.0 (All versions >= V34.0.252 < V34.0.254), Parasolid V34.1 (All versions < V34.1.242), Parasolid V34.1 (All versions >= V34.1.242 < V34.1.244), Parasolid V35.0 (All versions < V35.0.170), Parasolid V35.0 (All versions >= V35.0.170 <  V35.0.184), Simcenter Femap (All versions < V2023.1). The affected application contains an out of bounds read past the end of an allocated structure while parsing specially crafted X_T files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-17745)
Problem types: cwe_id: CWE-125
description: CWE-125: Out-of-bounds Read
Affected products: vendor: Siemens
product: Parasolid V34.0
default_status: unknown
vendor: Siemens
product: Parasolid V34.0
default_status: unknown
vendor: Siemens
product: Parasolid V34.1
default_status: unknown
vendor: Siemens
product: Parasolid V34.1
default_status: unknown
vendor: Siemens
product: Parasolid V35.0
default_status: unknown
vendor: Siemens
product: Parasolid V35.0
default_status: unknown
vendor: Siemens
product: Simcenter Femap
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
baseScore: 7.8
baseSeverity: HIGH
Published: 2022-11-08T00:00:00.000Z
CVE-2022-39160 IBM Cognos Analytics cross-site scripting

IBM Cognos Analytics 11.2.1, 11.2.0, and 11.1.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 235064.


Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: IBM
product: Cognos Analytics
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Published: 2022-12-19T20:57:35.505Z
CVE-2022-39161 IBM WebSphere Application Server information disclosure
IBM WebSphere Application Server 7.0, 8.0, 8.5, 9.0, and IBM WebSphere Application Server Liberty, when configured to communicate with the Web Server Plug-ins for IBM WebSphere Application Server, could allow an authenticated user to conduct spoofing attacks. A man-in-the-middle attacker could exploit this vulnerability using a certificate issued by a trusted authority to obtain sensitive information.  IBM X-Force  ID:  235069.
Problem types: cwe_id: CWE-295
description: CWE-295 Improper Certificate Validation
Affected products: vendor: IBM
product: WebSphere Application Server
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: ADJACENT_NETWORK
availabilityImpact: NONE
baseScore: 4.8
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2023-05-03T19:56:41.894Z
CVE-2022-39163 IBM Cognos Controller HTTP response smuggling
IBM Cognos Controller 11.0.0 through 11.1.0 is vulnerable to a Client-Side Desync (CSD) attack where an attacker could exploit a desynchronized browser connection that could lead to further cross-site scripting (XSS) attacks.
Problem types: cwe_id: CWE-444
description: CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Affected products: vendor: IBM
product: Cognos Controller
cpes: cpe:2.3:a:ibm:controller:11.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:controller:11.0.1:*:*:*:*:*:*:*
cpe:2.3:a:ibm:controller:11.1.0:*:*:*:*:*:*:*
default_status: unaffected
vendor: IBM
product: Controller
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.7
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Published: 2025-03-26T13:51:51.469Z
CVE-2022-39164 IBM AIX denial of service
IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1could allow a non-privileged local user to exploit a vulnerability in the AIX kernel to cause a denial of service.  IBM X-Force ID:  235181.
Problem types: cwe_id: CWE-400
description: CWE-400 Uncontrolled Resource Consumption
Affected products: vendor: IBM
product: AIX
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.2
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2022-12-23T19:26:58.929Z
CVE-2022-39165 IBM AIX denial of service
IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1could allow a non-privileged local user to exploit a vulnerability in CAA to cause a denial of service.  IBM X-Force ID:  235183.
Problem types: cwe_id: CWE-400
description: CWE-400 Uncontrolled Resource Consumption
Affected products: vendor: IBM
product: AIX
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.2
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2022-12-23T18:48:01.722Z
CVE-2022-39166 IBM Security Guardium information disclosure

IBM Security Guardium 11.4 could allow a privileged user to obtain sensitive information inside of an HTTP response. IBM X-Force ID: 235405.


Problem types: cwe_id: CWE-200
description: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: IBM
product: Security Guardium
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.4
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2022-12-20T20:17:33.714Z
CVE-2022-39167 IBM Spectrum Virtualize information disclosure

IBM Spectrum Virtualize 8.5, 8.4, 8.3, 8.2, and 7.8, under certain configurations, could disclose sensitive information to an attacker using man-in-the-middle techniques. IBM X-Force ID: 235408.


Problem types: cwe_id: CWE-200
description: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: IBM
product: Spectrum Virtualize
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2023-01-19T16:44:30.107Z
CVE-2022-39168 
IBM Robotic Process Automation Clients are vulnerable to proxy credentials being exposed in upgrade logs. IBM X-Force ID: 235422.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Robotic Process Automation
Published: 2022-09-29T15:40:09.460Z
CVE-2022-39170 
libdwarf 0.4.1 has a double free in _dwarf_exec_frame_instr in dwarf_frame.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-02T02:28:53.000Z
CVE-2022-39172 
A stored XSS in the process overview (bersicht zugewiesener Vorgaenge) in mbsupport openVIVA c2 20220101 allows a remote, authenticated, low-privileged attacker to execute arbitrary code in the victim's browser via name field of a process.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-30T00:00:00.000Z
CVE-2022-39173 
In wolfSSL before 5.5.1, malicious clients can cause a buffer overflow during a TLS 1.3 handshake. This occurs when an attacker supposedly resumes a previous TLS session. During the resumption Client Hello a Hello Retry Request must be triggered. Both Client Hellos are required to contain a list of duplicate cipher suites to trigger the buffer overflow. In total, two Client Hellos have to be sent: one in the resumed session, and a second one as a response to a Hello Retry Request message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-29T00:00:00.000Z
CVE-2022-39176 
BlueZ before 5.59 allows physically proximate attackers to obtain sensitive information because profiles/audio/avrcp.c does not validate params_len.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-02T00:00:00.000Z
CVE-2022-39177 
BlueZ before 5.59 allows physically proximate attackers to cause a denial of service because malformed and invalid capabilities can be processed in profiles/audio/avdtp.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-02T00:00:00.000Z