rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-37009 
In JetBrains IntelliJ IDEA before 2022.2 local code execution via a Vagrant executable was possible
Problem types: cwe_id: CWE-94
description: CWE-94 Improper Control of Generation of Code ('Code Injection')
Affected products: vendor: JetBrains
product: IntelliJ IDEA
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 3.9
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Published: 2022-07-28T10:25:10.000Z
CVE-2022-37010 
In JetBrains IntelliJ IDEA before 2022.2 email address validation in the "Git User Name Is Not Defined" dialog was missed
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: JetBrains
product: IntelliJ IDEA
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 3.6
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
version: 3.1
Published: 2022-07-28T10:25:16.000Z
CVE-2022-37011 
A vulnerability has been identified in Mendix SAML (Mendix 7 compatible) (All versions < V1.17.0), Mendix SAML (Mendix 8 compatible) (All versions < V2.3.0), Mendix SAML (Mendix 9 compatible, New Track) (All versions < V3.3.1), Mendix SAML (Mendix 9 compatible, Upgrade Track) (All versions < V3.3.0). Affected versions of the module insufficiently protect from packet capture replay. This could allow unauthorized remote attackers to bypass authentication and get access to the application. For compatibility reasons, fix versions still contain this issue, but only when the not recommended, non default configuration option `'Allow Idp Initiated Authentication'` is enabled.
Problem types: cwe_id: CWE-294
description: CWE-294: Authentication Bypass by Capture-replay
Affected products: vendor: Siemens
product: Mendix SAML (Mendix 7 compatible)
vendor: Siemens
product: Mendix SAML (Mendix 8 compatible)
vendor: Siemens
product: Mendix SAML (Mendix 9 compatible, New Track)
vendor: Siemens
product: Mendix SAML (Mendix 9 compatible, Upgrade Track)
Published: 2022-09-13T00:00:00.000Z
CVE-2022-37012 
This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Unified Automation OPC UA C++ Demo Server 1.7.6-537. Authentication is not required to exploit this vulnerability. The specific flaw exists within the OpcUa_SecureListener_ProcessSessionCallRequest method. A crafted OPC UA message can force the server to incorrectly update a reference count. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-16927.
Problem types: cwe_id: CWE-911
description: CWE-911: Improper Update of Reference Count
Affected products: vendor: Unified Automation
product: OPC UA C++ Demo Server
Credits: lang: en
value: 20urdjk
Published: 2023-03-29T00:00:00.000Z
CVE-2022-37013 
This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Unified Automation OPC UA C++ Demo Server 1.7.6-537 [with vendor rollup]. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of certificates. A crafted certificate can force the server into an infinite loop. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-17203.
Problem types: cwe_id: CWE-835
description: CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')
Affected products: vendor: Unified Automation
product: OPC UA C++ Demo Server
Credits: lang: en
value: Daan Keuper & Thijs Alkemade from Computest
Published: 2023-03-29T00:00:00.000Z
CVE-2022-37015 
Symantec Endpoint Detection and Response (SEDR) Appliance, prior to 4.7.0, may be susceptible to a privilege escalation vulnerability, which is a type of issue whereby an attacker may attempt to compromise the software application to gain elevated access to resources that are normally protected from an application or user.
Problem types: description: Elevation of Privilege
Affected products: vendor: n/a
product: Symantec Endpoint Detection and Response
Published: 2022-11-08T00:00:00.000Z
CVE-2022-37016 
Symantec Endpoint Protection (Windows) agent may be susceptible to a Privilege Escalation vulnerability, which is a type of issue whereby an attacker may attempt to compromise the software application to gain elevated access to resources that are normally protected from an application or user.
Problem types: description: Privilege Escalation
Affected products: vendor: n/a
product: Symantec Endpoint Protection
Published: 2022-12-01T00:00:00.000Z
CVE-2022-37017 
Symantec Endpoint Protection (Windows) agent, prior to 14.3 RU6/14.3 RU5 Patch 1, may be susceptible to a Security Control Bypass vulnerability, which is a type of issue that can potentially allow a threat actor to circumvent existing security controls. This CVE applies narrowly to the Client User Interface Password protection and Policy Import/Export Password protection, if it has been enabled.
Problem types: description: Security Control Bypass
Affected products: vendor: n/a
product: Symantec Endpoint Protection
Published: 2022-12-01T00:00:00.000Z
CVE-2022-37018 
A potential vulnerability has been identified in the system BIOS for certain HP PC products which may allow escalation of privileges and code execution. HP is releasing firmware updates to mitigate the potential vulnerability.
Problem types: description: n/a
Affected products: vendor: HP Inc.
product: HP PC BIOS
Published: 2022-11-21T21:02:37.037Z
CVE-2022-37019 HP PC BIOS May 2024 Security Updates for Potential Stack Buffer Overflows
Potential vulnerabilities have been identified in the system BIOS for certain HP PC products which may allow escalation of privileges and code execution.  HP is releasing firmware updates to mitigate the potential vulnerabilities.
Affected products: vendor: HP Inc.
product: HP PC products
default_status: affected
Published: 2024-06-10T22:12:52.278Z
CVE-2022-37020 HP PC BIOS May 2024 Security Updates for Potential Stack Buffer Overflows
Potential vulnerabilities have been identified in the system BIOS for certain HP PC products, which might allow escalation of privileges and code execution. HP is releasing firmware updates to mitigate the potential vulnerabilities.
Affected products: vendor: HP Inc.
product: HP PC products
default_status: affected
Published: 2024-06-10T22:13:26.904Z
CVE-2022-37021 Apache Geode deserialization of untrusted data flaw when using JMX over RMI on Java 8.
Apache Geode versions up to 1.12.5, 1.13.4 and 1.14.0 are vulnerable to a deserialization of untrusted data flaw when using JMX over RMI on Java 8. Any user still on Java 8 who wishes to protect against deserialization attacks involving JMX or RMI should upgrade to Apache Geode 1.15 and Java 11. If upgrading to Java 11 is not possible, then upgrade to Apache Geode 1.15 and specify "--J=-Dgeode.enableGlobalSerialFilter=true" when starting any Locators or Servers. Follow the documentation for details on specifying any user classes that may be serialized/deserialized with the "serializable-object-filter" configuration option. Using a global serial filter will impact performance.
Problem types: cwe_id: CWE-502
description: CWE-502 Deserialization of Untrusted Data
Affected products: vendor: Apache Software Foundation
product: Apache Geode
Published: 2022-08-31T07:00:14.000Z
CVE-2022-37022 Apache Geode deserialization of untrusted data flaw when using JMX over RMI on Java 11
Apache Geode versions up to 1.12.2 and 1.13.2 are vulnerable to a deserialization of untrusted data flaw when using JMX over RMI on Java 11. Any user wishing to protect against deserialization attacks involving JMX or RMI should upgrade to Apache Geode 1.15. Use of 1.15 on Java 11 will automatically protect JMX over RMI against deserialization attacks. This should have no impact on performance since it only affects JMX/RMI which Gfsh uses to communicate with the JMX Manager which is hosted on a Locator.
Problem types: cwe_id: CWE-502
description: CWE-502 Deserialization of Untrusted Data
Affected products: vendor: Apache Software Foundation
product: Apache Geode
Published: 2022-08-31T07:00:15.000Z
CVE-2022-37023 Apache Geode deserialization of untrusted data flaw when using REST API on Java 8 or Java 11
Apache Geode versions prior to 1.15.0 are vulnerable to a deserialization of untrusted data flaw when using REST API on Java 8 or Java 11. Any user wishing to protect against deserialization attacks involving REST APIs should upgrade to Apache Geode 1.15 and follow the documentation for details on enabling "validate-serializable-objects=true" and specifying any user classes that may be serialized/deserialized with "serializable-object-filter". Enabling "validate-serializable-objects" may impact performance.
Problem types: cwe_id: CWE-502
description: CWE-502 Deserialization of Untrusted Data
Affected products: vendor: Apache Software Foundation
product: Apache Geode
Published: 2022-08-31T07:00:16.000Z
CVE-2022-37024 
Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, and OpUtils before 2022-07-29 through 2022-07-30 ( 125658, 126003, 126105, and 126120) allow authenticated users to make database changes that lead to remote code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-09T15:15:36.000Z
CVE-2022-37025 
An improper privilege management vulnerability in McAfee Security Scan Plus (MSS+) before 4.1.262.1 could allow a local user to modify a configuration file and perform a LOLBin (Living off the land) attack. This could result in the user gaining elevated permissions and being able to execute arbitrary code due to lack of an integrity check of the configuration file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-18T12:23:57.000Z
CVE-2022-37026 
In Erlang/OTP before 23.3.4.15, 24.x before 24.3.4.2, and 25.x before 25.0.2, there is a Client Authentication Bypass in certain client-certification situations for SSL, TLS, and DTLS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-21T00:00:00.000Z
CVE-2022-37027 
Ahsay AhsayCBS 9.1.4.0 allows an authenticated system user to inject arbitrary Java JVM options. Administrators that can modify the Runtime Options in the web interface can inject Java Runtime Options. These take effect after a restart. For example, an attacker can enable JMX services and consequently achieve remote code execution as the system user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-21T16:53:50.000Z
CVE-2022-37028 
ISAMS 22.2.3.2 is prone to stored Cross-site Scripting (XSS) attack on the title field for groups, allowing an attacker to store a JavaScript payload that will be executed when another user uses the application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-27T17:19:15.000Z
CVE-2022-37030 
Weak permissions on the configuration file in the PAM module in Grommunio Gromox 0.5 through 1.x before 1.28 allow a local unprivileged user in the gromox group to have the PAM stack execute arbitrary code upon loading the Gromox PAM module.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-04T22:04:04.000Z
CVE-2022-37032 
An out-of-bounds read in the BGP daemon of FRRouting FRR before 8.4 may lead to a segmentation fault and denial of service. This occurs in bgp_capability_msg_parse in bgpd/bgp_packet.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-19T00:00:00.000Z
CVE-2022-37033 
In dotCMS 5.x-22.06, TempFileAPI allows a user to create a temporary file based on a passed in URL, while attempting to block any SSRF access to local IP addresses or private subnets. In resolving this URL, the TempFileAPI follows any 302 redirects that the remote URL returns. Because there is no re-validation of the redirect URL, the TempFileAPI can be used to return data from those local/private hosts that should not be accessible remotely.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-01T00:00:00.000Z
CVE-2022-37034 
In dotCMS 5.x-22.06, it is possible to call the TempResource multiple times, each time requesting the dotCMS server to download a large file. If done repeatedly, this will result in Tomcat request-thread exhaustion and ultimately a denial of any other requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-01T00:00:00.000Z
CVE-2022-37035 
An issue was discovered in bgpd in FRRouting (FRR) 8.3. In bgp_notify_send_with_data() and bgp_process_packet() in bgp_packet.c, there is a possible use-after-free due to a race condition. This could lead to Remote Code Execution or Information Disclosure by sending crafted BGP packets. User interaction is not needed for exploitation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-02T00:00:00.000Z
CVE-2022-37041 
An issue was discovered in ProxyServlet.java in the /proxy servlet in Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0. The value of the X-Forwarded-Host header overwrites the value of the Host header in proxied requests. The value of X-Forwarded-Host header is not checked against the whitelist of hosts that ZCS is allowed to proxy to (the zimbraProxyAllowedDomains setting).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-11T19:06:49.000Z
CVE-2022-37042 
Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. By bypassing authentication (i.e., not having an authtoken), an attacker can upload arbitrary files to the system, leading to directory traversal and remote code execution. NOTE: this issue exists because of an incomplete fix for CVE-2022-27925.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-11T19:37:27.000Z
CVE-2022-37043 
An issue was discovered in the webmail component in Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0. When using preauth, CSRF tokens are not checked on some POST endpoints. Thus, when an authenticated user views an attacker-controlled page, a request will be sent to the application that appears to be intended. The CSRF token is omitted from the request, but the request still succeeds.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-11T19:40:25.000Z
CVE-2022-37044 
In Zimbra Collaboration Suite (ZCS) 8.8.15, the URL at /h/search?action accepts parameters called extra, title, and onload that are partially sanitised and lead to reflected XSS that allows executing arbitrary JavaScript on the victim's machine.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-11T19:44:46.000Z
CVE-2022-37047 
The component tcprewrite in Tcpreplay v4.4.1 was discovered to contain a heap-based buffer overflow in get_ipv6_next at common/get.c:713. NOTE: this is different from CVE-2022-27940.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-18T00:00:00.000Z
CVE-2022-37048 
The component tcprewrite in Tcpreplay v4.4.1 was discovered to contain a heap-based buffer overflow in get_l2len_protocol at common/get.c:344. NOTE: this is different from CVE-2022-27941.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-18T00:00:00.000Z
CVE-2022-37049 
The component tcpprep in Tcpreplay v4.4.1 was discovered to contain a heap-based buffer overflow in parse_mpls at common/get.c:150. NOTE: this is different from CVE-2022-27942.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-18T00:00:00.000Z
CVE-2022-37050 
In Poppler 22.07.0, PDFDoc::savePageAs in PDFDoc.c callows attackers to cause a denial-of-service (application crashes with SIGABRT) by crafting a PDF file in which the xref data structure is mishandled in getCatalog processing. Note that this vulnerability is caused by the incomplete patch of CVE-2018-20662.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-22T00:00:00.000Z
CVE-2022-37051 
An issue was discovered in Poppler 22.07.0. There is a reachable abort which leads to denial of service because the main function in pdfunite.cc lacks a stream check before saving an embedded file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-22T00:00:00.000Z
CVE-2022-37052 
A reachable Object::getString assertion in Poppler 22.07.0 allows attackers to cause a denial of service due to a failure in markObject.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-22T00:00:00.000Z
CVE-2022-37053 
TRENDnet TEW733GR v1.03B01 is vulnerable to Command injection via /htdocs/upnpinc/gena.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-28T15:54:53.000Z
CVE-2022-37055 
D-Link Go-RT-AC750 GORTAC750_revA_v101b03 and GO-RT-AC750_revB_FWv200b02 are vulnerable to Buffer Overflow via cgibin, hnap_main,
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-28T16:05:21.000Z
CVE-2022-37056 
D-Link GO-RT-AC750 GORTAC750_revA_v101b03 and GO-RT-AC750_revB_FWv200b02 is vulnerable to Command Injection via /cgibin, hnap_main,
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: n/a
product: n/a
Published: 2022-08-28T16:03:48.000Z
CVE-2022-37057 
D-Link Go-RT-AC750 GORTAC750_revA_v101b03 and GO-RT-AC750_revB_FWv200b02 are vulnerable to Command Injection via cgibin, ssdpcgi_main.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-28T16:00:15.000Z
CVE-2022-37059 
Cross Site Scripting (XSS) in Admin Panel of Subrion CMS 4.2.1 allows attacker to inject arbitrary code via Login Field
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-29T12:54:51.000Z
CVE-2022-37060 
FLIR AX8 thermal sensor cameras version up to and including 1.46.16 is vulnerable to Directory Traversal due to an improper access restriction. An unauthenticated, remote attacker can exploit this by sending a URI that contains directory traversal characters to disclose the contents of files located outside of the server's restricted path. NOTE: The vendor has stated that with the introduction of firmware version 1.49.16 (Jan 2023) the FLIR AX8 should no longer be affected by the vulnerability reported. Latest firmware version (as of Oct 2025, was released Jun 2024) is 1.55.16.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-18T00:00:00.000Z
CVE-2022-37061 
All FLIR AX8 thermal sensor cameras version up to and including 1.46.16 are vulnerable to Remote Command Injection. This can be exploited to inject and execute arbitrary shell commands as the root user through the id HTTP POST parameter in the res.php endpoint. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with the root privileges. NOTE: The vendor has stated that with the introduction of firmware version 1.49.16 (Jan 2023) the FLIR AX8 should no longer be affected by the vulnerability reported. Latest firmware version (as of Oct 2025, was released Jun 2024) is 1.55.16.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-18T00:00:00.000Z
CVE-2022-37062 
All FLIR AX8 thermal sensor cameras version up to and including 1.46.16 are affected by an insecure design vulnerability due to an improper directory access restriction. An unauthenticated, remote attacker can exploit this by sending a URI that contains the path of the SQLite users database and download it. A successful exploit could allow the attacker to extract usernames and hashed passwords. NOTE: The vendor has stated that with the introduction of firmware version 1.49.16 (Jan 2023) the FLIR AX8 should no longer be affected by the vulnerability reported. Latest firmware version (as of Oct 2025, was released Jun 2024) is 1.55.16.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-18T17:05:48.000Z
CVE-2022-37063 
All FLIR AX8 thermal sensor cameras versions up to and including 1.46.16 are vulnerable to Cross Site Scripting (XSS) due to improper input sanitization. An authenticated remote attacker can execute arbitrary JavaScript code in the web management interface. A successful exploit could allow the attacker to insert malicious JavaScript code. NOTE: The vendor has stated that with the introduction of firmware version 1.49.16 (Jan 2023) the FLIR AX8 should no longer be affected by the vulnerability reported. Latest firmware version (as of Oct 2025, was released Jun 2024) is 1.55.16.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-18T17:09:51.000Z
CVE-2022-37066 
H3C GR-1200W MiniGRW1A0V100R006 was discovered to contain a stack overflow via the function UpdateDDNS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-25T13:59:57.000Z
CVE-2022-37067 
H3C GR-1200W MiniGRW1A0V100R006 was discovered to contain a stack overflow via the function UpdateWanParamsMulti.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-25T13:59:57.000Z
CVE-2022-37068 
H3C GR-1200W MiniGRW1A0V100R006 was discovered to contain a stack overflow via the function UpdateMacCloneFinal.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-25T13:59:58.000Z
CVE-2022-37069 
H3C GR-1200W MiniGRW1A0V100R006 was discovered to contain a stack overflow via the function UpdateSnat.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-25T13:59:59.000Z
CVE-2022-37070 
H3C GR-1200W MiniGRW1A0V100R006 was discovered to contain a command injection vulnerability via the param parameter at DelL2tpLNSList.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-25T14:00:00.000Z
CVE-2022-37071 
H3C GR-1200W MiniGRW1A0V100R006 was discovered to contain a stack overflow via the function UpdateOne2One.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-25T14:00:18.000Z
CVE-2022-37072 
H3C GR-1200W MiniGRW1A0V100R006 was discovered to contain a stack overflow via the function UpdateWanLinkspyMulti.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-25T14:00:23.000Z
CVE-2022-37073 
H3C GR-1200W MiniGRW1A0V100R006 was discovered to contain a stack overflow via the function UpdateWanModeMulti.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-25T14:00:18.000Z
CVE-2022-37074 
H3C GR-1200W MiniGRW1A0V100R006 was discovered to contain a stack overflow via the function switch_debug_info_set.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-25T14:00:28.000Z
CVE-2022-37075 
TOTOLink A7000R V9.1.0u.6115_B20201022 was discovered to contain a stack overflow via the ip parameter in the function setDiagnosisCfg.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-25T14:00:23.000Z
CVE-2022-37076 
TOTOLINK A7000R V9.1.0u.6115_B20201022 was discovered to contain a command injection vulnerability via the FileName parameter in the function UploadFirmwareFile.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-25T14:00:28.000Z