rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-31694 
InstallBuilder Qt installers built with versions previous to 22.10 try to load DLLs from the installer binary parent directory when displaying popups. This may allow an attacker to plant a malicious DLL in the installer parent directory to allow executing code with the privileges of the installer (when the popup triggers the loading of the library). Exploiting these type of vulnerabilities generally require that an attacker has access to a vulnerable machine to plant the malicious DLL.
Problem types: description: Uncontrolled Search Path Element
Affected products: vendor: n/a
product: VMware InstallBuilder
Published: 2022-11-18T00:00:00.000Z
CVE-2022-31696 
VMware ESXi contains a memory corruption vulnerability that exists in the way it handles a network socket. A malicious actor with local access to ESXi may exploit this issue to corrupt memory leading to an escape of the ESXi sandbox.
Problem types: description: Memory corruption vulnerability
Affected products: vendor: n/a
product: VMware ESXi, VMware Cloud Foundation
Published: 2022-12-13T00:00:00.000Z
CVE-2022-31697 
The vCenter Server contains an information disclosure vulnerability due to the logging of credentials in plaintext. A malicious actor with access to a workstation that invoked a vCenter Server Appliance ISO operation (Install/Upgrade/Migrate/Restore) can access plaintext passwords used during that operation.
Problem types: description: Information disclosure vulnerability
Affected products: vendor: n/a
product: VMware vCenter Server, VMware Cloud Foundation
Published: 2022-12-13T00:00:00.000Z
CVE-2022-31698 
The vCenter Server contains a denial-of-service vulnerability in the content library service. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to trigger a denial-of-service condition by sending a specially crafted header.
Problem types: description: Denial of service vulnerability
Affected products: vendor: n/a
product: VMware vCenter Server, VMware Cloud Foundation
Published: 2022-12-13T00:00:00.000Z
CVE-2022-31699 
VMware ESXi contains a heap-overflow vulnerability. A malicious local actor with restricted privileges within a sandbox process may exploit this issue to achieve a partial information disclosure.
Problem types: description: Heap overflow issues via vulnerability
Affected products: vendor: n/a
product: VMware ESXi, VMware Cloud Foundation
Published: 2022-12-13T00:00:00.000Z
CVE-2022-31700 
VMware Workspace ONE Access and Identity Manager contain an authenticated remote code execution vulnerability. VMware has evaluated the severity of this issue to be in the Important severity range with a maximum CVSSv3 base score of 7.2.
Problem types: description: Authenticated Remote Code Execution Vulnerability
Affected products: vendor: n/a
product: VMware Workspace ONE Access (Access), VMware Identity Manager (vIDM)
Published: 2022-12-14T00:00:00.000Z
CVE-2022-31701 
VMware Workspace ONE Access and Identity Manager contain a broken authentication vulnerability. VMware has evaluated the severity of this issue to be in the Moderate severity range with a maximum CVSSv3 base score of 5.3.
Problem types: description: Broken Authentication Vulnerability
Affected products: vendor: n/a
product: VMware Workspace ONE Access (Access), VMware Identity Manager (vIDM)
Published: 2022-12-14T00:00:00.000Z
CVE-2022-31702 
vRealize Network Insight (vRNI) contains a command injection vulnerability present in the vRNI REST API. A malicious actor with network access to the vRNI REST API can execute commands without authentication.
Problem types: description: VMware vRealize Network Insight (vRNI) contains command injection vulnerability
Affected products: vendor: n/a
product: VMware vRealize Network Insight (vRNI)
Published: 2022-12-14T00:00:00.000Z
CVE-2022-31703 
The vRealize Log Insight contains a Directory Traversal Vulnerability. An unauthenticated, malicious actor can inject files into the operating system of an impacted appliance which can result in remote code execution.
Problem types: description: VMware vRealize Log Insight Directory Traversal Vulnerability
Affected products: vendor: n/a
product: vRealize Log Insight (vRLI)
Published: 2022-12-14T00:00:00.000Z
CVE-2022-31704 
The vRealize Log Insight contains a broken access control vulnerability. An unauthenticated malicious actor can remotely inject code into sensitive files of an impacted appliance which can result in remote code execution.
Problem types: description: VMware vRealize Log Insight broken access control Vulnerability
Affected products: vendor: n/a
product: vRealize Log Insight (vRLI)
Published: 2023-01-25T00:00:00.000Z
CVE-2022-31705 
VMware ESXi, Workstation, and Fusion contain a heap out-of-bounds write vulnerability in the USB 2.0 controller (EHCI). A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host. On ESXi, the exploitation is contained within the VMX sandbox whereas, on Workstation and Fusion, this may lead to code execution on the machine where Workstation or Fusion is installed.
Problem types: description: Heap out-of-bounds write vulnerability
Affected products: vendor: n/a
product: VMware ESXi, VMware Workstation Pro / Player, VMware Fusion Pro / Fusion (Fusion), VMware Cloud Foundation
Published: 2022-12-14T00:00:00.000Z
CVE-2022-31706 
The vRealize Log Insight contains a Directory Traversal Vulnerability. An unauthenticated, malicious actor can inject files into the operating system of an impacted appliance which can result in remote code execution.
Problem types: description: VMware vRealize Log Insight Directory Traversal Vulnerability
Affected products: vendor: n/a
product: vRealize Log Insight (vRLI)
Published: 2023-01-25T00:00:00.000Z
CVE-2022-31707 
vRealize Operations (vROps) contains a privilege escalation vulnerability. VMware has evaluated the severity of this issue to be in the Important severity range with a maximum CVSSv3 base score of 7.2.
Problem types: description: VMware vRealize Operations (vROps) privilege escalation vulnerability
Affected products: vendor: n/a
product: VMware vRealize Operations (vROps)
Published: 2022-12-16T00:00:00.000Z
CVE-2022-31708 
vRealize Operations (vROps) contains a broken access control vulnerability. VMware has evaluated the severity of this issue to be in the Moderate severity range with a maximum CVSSv3 base score of 4.4.
Problem types: description: VMware vRealize Operations (vROps) contains an access control vulnerability
Affected products: vendor: n/a
product: VMware vRealize Operations (vROps)
Published: 2022-12-16T00:00:00.000Z
CVE-2022-31710 
vRealize Log Insight contains a deserialization vulnerability. An unauthenticated malicious actor can remotely trigger the deserialization of untrusted data which could result in a denial of service.
Problem types: description: VMware vRealize Log Insight Deserialization Vulnerability
Affected products: vendor: n/a
product: vRealize Log Insight (vRLI)
Published: 2023-01-25T00:00:00.000Z
CVE-2022-31711 
VMware vRealize Log Insight contains an Information Disclosure Vulnerability. A malicious actor can remotely collect sensitive session and application information without authentication.
Problem types: description: VMware vRealize Log Insight Information Disclosure Vulnerability
Affected products: vendor: n/a
product: vRealize Log Insight (vRLI)
Published: 2023-01-25T00:00:00.000Z
CVE-2022-31733 
Starting with diego-release 2.55.0 and up to 2.69.0, and starting with CF Deployment 17.1 and up to 23.2.0, apps are accessible via another port on diego cells, allowing application ingress without a client certificate. If mTLS route integrity is enabled AND unproxied ports are turned off, then an attacker could connect to an application that should be only reachable via mTLS, without presenting a client certificate.
Problem types: description: Unsecured application port
Affected products: vendor: n/a
product: Cloud Foundry Diego and CF Deployment
Published: 2023-02-03T00:00:00.000Z
CVE-2022-31734 
Cisco Catalyst 2940 Series Switches provided by Cisco Systems, Inc. contain a reflected cross-site scripting vulnerability regarding error page generation. An arbitrary script may be executed on the web browser of the user who is using the product. The affected firmware is prior to 12.2(50)SY released in 2011, and Cisco Catalyst 2940 Series Switches have been retired since January 2015
Problem types: description: Cross-site scripting
Affected products: vendor: Cisco Systems, Inc.
product: Cisco Catalyst 2940 Series Switches
Published: 2022-06-20T09:50:09.000Z
CVE-2022-31735 
OpenAM Consortium Edition version 14.0.0 provided by OpenAM Consortium contains an open redirect vulnerability (CWE-601). When accessing an affected server through some specially crafted URL, the user may be redirected to an arbitrary website.
Problem types: cwe_id: CWE-601
description: CWE-601: Open Redirect
Affected products: vendor: OpenAM consortium
product: OpenAM (OpenAM Consortium Edition)
Published: 2022-09-15T04:25:08.000Z
CVE-2022-31736 
A malicious website could have learned the size of a cross-origin resource that supported Range requests. This vulnerability affects Thunderbird < 91.10, Firefox < 101, and Firefox ESR < 91.10.
Problem types: description: Cross-Origin resource's length leaked
Affected products: vendor: Mozilla
product: Thunderbird
vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Firefox ESR
Published: 2022-12-22T00:00:00.000Z
CVE-2022-31737 
A malicious webpage could have caused an out-of-bounds write in WebGL, leading to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 91.10, Firefox < 101, and Firefox ESR < 91.10.
Problem types: description: Heap buffer overflow in WebGL
Affected products: vendor: Mozilla
product: Thunderbird
vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Firefox ESR
Published: 2022-12-22T00:00:00.000Z
CVE-2022-31738 
When exiting fullscreen mode, an iframe could have confused the browser about the current state of fullscreen, resulting in potential user confusion or spoofing attacks. This vulnerability affects Thunderbird < 91.10, Firefox < 101, and Firefox ESR < 91.10.
Problem types: description: Browser window spoof using fullscreen mode
Affected products: vendor: Mozilla
product: Thunderbird
vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Firefox ESR
Published: 2022-12-22T00:00:00.000Z
CVE-2022-31739 
When downloading files on Windows, the % character was not escaped, which could have lead to a download incorrectly being saved to attacker-influenced paths that used variables such as %HOMEPATH% or %APPDATA%.<br>*This bug only affects Firefox for Windows. Other operating systems are unaffected.*. This vulnerability affects Thunderbird < 91.10, Firefox < 101, and Firefox ESR < 91.10.
Problem types: description: Attacker-influenced path traversal when saving downloaded files
Affected products: vendor: Mozilla
product: Thunderbird
vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Firefox ESR
Published: 2022-12-22T00:00:00.000Z
CVE-2022-31740 
On arm64, WASM code could have resulted in incorrect assembly generation leading to a register allocation problem, and a potentially exploitable crash. This vulnerability affects Thunderbird < 91.10, Firefox < 101, and Firefox ESR < 91.10.
Problem types: description: Register allocation problem in WASM on arm64
Affected products: vendor: Mozilla
product: Thunderbird
vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Firefox ESR
Published: 2022-12-22T00:00:00.000Z
CVE-2022-31741 
A crafted CMS message could have been processed incorrectly, leading to an invalid memory read, and potentially further memory corruption. This vulnerability affects Thunderbird < 91.10, Firefox < 101, and Firefox ESR < 91.10.
Problem types: description: Uninitialized variable leads to invalid memory read
Affected products: vendor: Mozilla
product: Thunderbird
vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Firefox ESR
Published: 2022-12-22T00:00:00.000Z
CVE-2022-31742 
An attacker could have exploited a timing attack by sending a large number of allowCredential entries and detecting the difference between invalid key handles and cross-origin key handles. This could have led to cross-origin account linking in violation of WebAuthn goals. This vulnerability affects Thunderbird < 91.10, Firefox < 101, and Firefox ESR < 91.10.
Problem types: description: Querying a WebAuthn token with a large number of allowCredential entries may have leaked cross-origin information
Affected products: vendor: Mozilla
product: Thunderbird
vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Firefox ESR
Published: 2022-12-22T00:00:00.000Z
CVE-2022-31743 
Firefox's HTML parser did not correctly interpret HTML comment tags, resulting in an incongruity with other browsers. This could have been used to escape HTML comments on pages that put user-controlled data in them. This vulnerability affects Firefox < 101.
Problem types: description: HTML Parsing incorrectly ended HTML comments prematurely
Affected products: vendor: Mozilla
product: Firefox
Published: 2022-12-22T00:00:00.000Z
CVE-2022-31744 
An attacker could have injected CSS into stylesheets accessible via internal URIs, such as resource:, and in doing so bypass a page's Content Security Policy. This vulnerability affects Firefox ESR < 91.11, Thunderbird < 102, Thunderbird < 91.11, and Firefox < 101.
Problem types: description: CSP bypass enabling stylesheet injection
Affected products: vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Thunderbird
vendor: Mozilla
product: Firefox
Published: 2022-12-22T00:00:00.000Z
CVE-2022-31745 
If array shift operations are not used, the Garbage Collector may have become confused about valid objects. This vulnerability affects Firefox < 101.
Problem types: description: Incorrect Assertion caused by unoptimized array shift operations
Affected products: vendor: Mozilla
product: Firefox
Published: 2022-12-22T00:00:00.000Z
CVE-2022-31746 
Internal URLs are protected by a secret UUID key, which could have been leaked to web page through the Referrer header. This vulnerability affects Firefox for iOS < 102.
Problem types: description: Privileged internal URL protection could be bypassed through referrer header.
Affected products: vendor: Mozilla
product: Firefox for iOS
Published: 2022-12-22T00:00:00.000Z
CVE-2022-31747 
Mozilla developers Andrew McCreight, Nicolas B. Pierron, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 100 and Firefox ESR 91.9. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 91.10, Firefox < 101, and Firefox ESR < 91.10.
Problem types: description: Memory safety bugs fixed in Firefox 101 and Firefox ESR 91.10
Affected products: vendor: Mozilla
product: Thunderbird
vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Firefox ESR
Published: 2022-12-22T00:00:00.000Z
CVE-2022-31748 
Mozilla developers Gabriele Svelto, Timothy Nikkel, Randell Jesup, Jon Coppeard, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 100. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 101.
Problem types: description: Memory safety bugs fixed in Firefox 101
Affected products: vendor: Mozilla
product: Firefox
Published: 2022-12-22T00:00:00.000Z
CVE-2022-31749 Authenticated arbitrary file read/write in WatchGuard Fireware OS
An argument injection vulnerability in the diagnose and import pac commands in WatchGuard Fireware OS before 12.8.1, 12.1.4, and 12.5.10 allows an authenticated remote attacker with unprivileged credentials to upload or read files to limited, arbitrary locations on WatchGuard Firebox and XTM appliances
Problem types: cwe_id: CWE-88
description: CWE-88 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Affected products: vendor: WatchGuard
product: Fireware OS
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Jake Baines, Rapid7
Published: 2025-01-27T23:28:40.596Z
CVE-2022-31751 
The kernel emcom module has multi-thread contention. Successful exploitation of this vulnerability may affect system availability.
Problem types: description: Multi-thread contention vulnerability
Affected products: vendor: Huawei
product: HarmonyOS
vendor: Huawei
product: EMUI
vendor: Huawei
product: Magic UI
Published: 2022-06-13T14:55:41.000Z
CVE-2022-31752 
Missing authorization vulnerability in the system components. Successful exploitation of this vulnerability will affect confidentiality.
Problem types: description: Missing authorization vulnerability
Affected products: vendor: Huawei
product: EMUI
vendor: Huawei
product: Magic UI
Published: 2022-06-13T15:07:45.000Z
CVE-2022-31753 
The voice wakeup module has a vulnerability of using externally-controlled format strings. Successful exploitation of this vulnerability may affect system availability.
Problem types: description: Weaknesses Introduced During Design
Affected products: vendor: Huawei
product: HarmonyOS
vendor: Huawei
product: EMUI
vendor: Huawei
product: Magic UI
Published: 2022-06-13T15:06:07.000Z
CVE-2022-31754 
Logical defects in code implementation in some products. Successful exploitation of this vulnerability may affect the availability of some features.
Problem types: description: Logical defects vulnerability
Affected products: vendor: Huawei
product: EMUI
vendor: Huawei
product: Magic UI
Published: 2022-06-13T15:06:39.000Z
CVE-2022-31755 
The communication module has a vulnerability of improper permission preservation. Successful exploitation of this vulnerability may affect system availability.
Problem types: description: Improper permission preservation vulnerability
Affected products: vendor: Huawei
product: HarmonyOS
vendor: Huawei
product: EMUI
vendor: Huawei
product: Magic UI
Published: 2022-06-13T14:56:09.000Z
CVE-2022-31756 
The fingerprint sensor module has design defects. Successful exploitation of this vulnerability may affect data confidentiality.
Problem types: description: Design defects vulnerability
Affected products: vendor: Huawei
product: HarmonyOS
vendor: Huawei
product: EMUI
vendor: Huawei
product: Magic UI
Published: 2022-06-13T14:55:54.000Z
CVE-2022-31757 
The setting module has a vulnerability of improper use of APIs. Successful exploitation of this vulnerability may affect data confidentiality.
Problem types: description: Improper use of APIs vulnerability
Affected products: vendor: Huawei
product: HarmonyOS
vendor: Huawei
product: EMUI
vendor: Huawei
product: Magic UI
Published: 2022-06-13T15:05:48.000Z
CVE-2022-31758 
The kernel module has the race condition vulnerability. Successful exploitation of this vulnerability may affect data confidentiality.
Problem types: description: Race condition vulnerability
Affected products: vendor: Huawei
product: HarmonyOS
vendor: Huawei
product: EMUI
vendor: Huawei
product: Magic UI
Published: 2022-06-13T14:55:25.000Z
CVE-2022-31759 
AppLink has a vulnerability of accessing uninitialized pointers. Successful exploitation of this vulnerability may affect system availability.
Problem types: description: Accessing uninitialized pointers vulnerability
Affected products: vendor: Huawei
product: HarmonyOS
vendor: Huawei
product: EMUI
vendor: Huawei
product: Magic UI
Published: 2022-06-13T14:56:25.000Z
CVE-2022-31760 
Dialog boxes can still be displayed even if the screen is locked in carrier-customized USSD services. Successful exploitation of this vulnerability may affect data integrity and confidentiality.
Problem types: description: Weaknesses Introduced During Design
Affected products: vendor: Huawei
product: HarmonyOS
vendor: Huawei
product: EMUI
vendor: Huawei
product: Magic UI
Published: 2022-06-13T15:03:55.000Z
CVE-2022-31761 
Configuration defects in the secure OS module. Successful exploitation of this vulnerability will affect confidentiality.
Problem types: description: Configuration defectsl vulnerability
Affected products: vendor: Huawei
product: EMUI
vendor: Huawei
product: Magic UI
Published: 2022-06-13T15:07:29.000Z
CVE-2022-31762 
The AMS module has a vulnerability in input validation. Successful exploitation of this vulnerability may cause privilege escalation.
Problem types: description: Input validation vulnerability
Affected products: vendor: Huawei
product: HarmonyOS
vendor: Huawei
product: EMUI
vendor: Huawei
product: Magic UI
Published: 2022-06-13T14:56:38.000Z
CVE-2022-31763 
The kernel module has the null pointer and out-of-bounds array vulnerabilities. Successful exploitation of this vulnerability may affect system availability.
Problem types: description: Out-of-bounds array vulnerability
Affected products: vendor: Huawei
product: HarmonyOS
vendor: Huawei
product: EMUI
Published: 2022-06-13T14:55:11.000Z
CVE-2022-31764 Apache ShardingSphere ElasticJob-UI allows RCE via event trace data source JDBC
The Lite UI of Apache ShardingSphere ElasticJob-UI allows an attacker to perform RCE by constructing a special JDBC URL of H2 database. This issue affects Apache ShardingSphere ElasticJob-UI version 3.0.1 and prior versions. This vulnerability has been fixed in ElasticJob-UI 3.0.2.
The premise of this attack is that the attacker has obtained the account and password. Otherwise, the attacker cannot perform this attack.
Problem types: cwe_id: CWE-913
description: CWE-913 Improper Control of Dynamically-Managed Code Resources
Affected products: vendor: Apache Software Foundation
product: Apache ShardingSphere ElasticJob-UI
Published: 2025-02-06T14:23:03.166Z
CVE-2022-31767 
IBM CICS TX Standard and Advanced 11.1 could allow a remote attacker to execute arbitrary commands on the system by sending a specially crafted request. IBM X-Force ID: 227980.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: CICS TX Advanced
vendor: IBM
product: CICS TX Standard
Published: 2022-06-24T15:35:29.233Z
CVE-2022-31768 
IBM InfoSphere Information Server 11.7 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database.
Problem types: description: Data Manipulation
Affected products: vendor: IBM
product: InfoSphere Information Server
Published: 2022-06-06T16:20:11.652Z
CVE-2022-31769 
IBM Spectrum Copy Data Management 2.2.0.0 through 2.2.15.0 could allow a remote attacker to view product configuration information stored in PostgreSQL, which could be used in further attacks against the system. IBM X-Force ID: 228219.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Spectrum Copy Data Management
Published: 2022-06-10T16:00:27.395Z
CVE-2022-31770 
IBM App Connect Enterprise Certified Container 4.2 could allow a user from the administration console to cause a denial of service by creating a specially crafted request. IBM X-Force ID: 228221.
Problem types: description: Denial of Service
Affected products: vendor: IBM
product: App Connect Enterprise Certified Container
Published: 2022-07-05T16:10:10.491Z