rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-41552 Server-Side Request Forgery Vulnerability in Hitachi Infrastructure Analytics Advisor, Hitachi Ops Center Analyzer
Server-Side Request Forgery (SSRF) vulnerability in Hitachi Infrastructure Analytics Advisor on Linux (Data Center Analytics, Analytics probe components), Hitachi Ops Center Analyzer on Linux (Hitachi Ops Center Analyzer detail view, Hitachi Ops Center Analyzer probe components) allows Server Side Request Forgery.
This issue affects Hitachi Infrastructure Analytics Advisor: from 2.0.0-00 through 4.4.0-00; Hitachi Ops Center Analyzer: from 10.0.0-00 before 10.9.0-00.

Problem types: cwe_id: CWE-918
description: CWE-918 Server-Side Request Forgery (SSRF)
Affected products: vendor: Hitachi
product: Hitachi Infrastructure Analytics Advisor
default_status: unaffected
vendor: Hitachi
product: Hitachi Ops Center Analyzer
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2022-11-01T02:10:22.868Z
CVE-2022-41553 Information Exposure Vulnerability in Hitachi Infrastructure Analytics Advisor, Hitachi Ops Center Analyzer
Insertion of Sensitive Information into Temporary File vulnerability in Hitachi Infrastructure Analytics Advisor on Linux (Analytics probe component), Hitachi Ops Center Analyzer on Linux (Hitachi Ops Center Analyzer probe component) allows local users to gain sensitive information.
This issue affects Hitachi Infrastructure Analytics Advisor: from 2.0.0-00 through 4.4.0-00; Hitachi Ops Center Analyzer: from 10.0.0-00 before 10.9.0-00.

Problem types: cwe_id: CWE-532
description: CWE-532 Insertion of Sensitive Information into Log File
Affected products: vendor: Hitachi
product: Hitachi Infrastructure Analytics Advisor
default_status: unaffected
vendor: Hitachi
product: Hitachi Ops Center Analyzer
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
version: 3.1
Published: 2022-11-01T02:11:01.157Z
CVE-2022-41554 WordPress Slideshow SE Plugin <= 2.5.5 is vulnerable to Cross Site Scripting (XSS)
Stored Cross-Site Scripting (XSS) vulnerability in John West Slideshow SE plugin <= 2.5.5 versions.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: John West
product: Slideshow SE
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.8
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: thiennv (Patchstack Alliance)
Published: 2023-03-16T09:02:55.310Z
CVE-2022-41555 Delta Electronics DIAEnergie
The affected product DIAEnergie (versions prior to v1.9.01.002) is vulnerable to a stored cross-site scripting vulnerability through the PutLineMessageSetting API.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Delta Electronics
product: DIAEnergie
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: NONE
baseScore: 8.7
baseSeverity: HIGH
Credits: lang: en
value: Michael Heinzl reported these vulnerabilities to CISA.
Published: 2022-10-27T20:15:37.817Z
CVE-2022-41556 
A resource leak in gw_backend.c in lighttpd 1.4.56 through 1.4.66 could lead to a denial of service (connection-slot exhaustion) after a large amount of anomalous TCP behavior by clients. It is related to RDHUP mishandling in certain HTTP/1.1 chunked situations. Use of mod_fastcgi is, for example, affected. This is fixed in 1.4.67.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-06T00:00:00.000Z
CVE-2022-41558 TIBCO Spotfire Stored Cross Site Scripting (XSS) Vulnerability
The Visualizations component of TIBCO Software Inc.'s TIBCO Spotfire Analyst, TIBCO Spotfire Analyst, TIBCO Spotfire Analyst, TIBCO Spotfire Analytics Platform for AWS Marketplace, TIBCO Spotfire Desktop, TIBCO Spotfire Desktop, TIBCO Spotfire Desktop, TIBCO Spotfire Server, TIBCO Spotfire Server, and TIBCO Spotfire Server contains an easily exploitable vulnerability that allows a low privileged attacker with network access to execute Stored Cross Site Scripting (XSS) on the affected system. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.'s TIBCO Spotfire Analyst: versions 11.4.4 and below, TIBCO Spotfire Analyst: versions 11.5.0, 11.6.0, 11.7.0, 11.8.0, 12.0.0, and 12.0.1, TIBCO Spotfire Analyst: version 12.1.0, TIBCO Spotfire Analytics Platform for AWS Marketplace: versions 12.1.0 and below, TIBCO Spotfire Desktop: versions 11.4.4 and below, TIBCO Spotfire Desktop: versions 11.5.0, 11.6.0, 11.7.0, 11.8.0, 12.0.0, and 12.0.1, TIBCO Spotfire Desktop: version 12.1.0, TIBCO Spotfire Server: versions 11.4.8 and below, TIBCO Spotfire Server: versions 11.5.0, 11.6.0, 11.6.1, 11.6.2, 11.6.3, 11.7.0, 11.8.0, 11.8.1, 12.0.0, and 12.0.1, and TIBCO Spotfire Server: version 12.1.0.
Problem types: description: Successful execution of these vulnerabilities will result in an attacker being able to execute commands with the privileges of the affected user.
Affected products: vendor: TIBCO Software Inc.
product: TIBCO Spotfire Analyst
vendor: TIBCO Software Inc.
product: TIBCO Spotfire Analyst
vendor: TIBCO Software Inc.
product: TIBCO Spotfire Analyst
vendor: TIBCO Software Inc.
product: TIBCO Spotfire Analytics Platform for AWS Marketplace
vendor: TIBCO Software Inc.
product: TIBCO Spotfire Desktop
vendor: TIBCO Software Inc.
product: TIBCO Spotfire Desktop
vendor: TIBCO Software Inc.
product: TIBCO Spotfire Desktop
vendor: TIBCO Software Inc.
product: TIBCO Spotfire Server
vendor: TIBCO Software Inc.
product: TIBCO Spotfire Server
vendor: TIBCO Software Inc.
product: TIBCO Spotfire Server
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 9
baseSeverity: CRITICAL
Published: 2022-11-15T18:15:12.527Z
CVE-2022-41559 TIBCO Nimbus Open Redirect Vulnerability
The Web Client component of TIBCO Software Inc.'s TIBCO Nimbus contains an easily exploitable vulnerability that allows an unauthenticated attacker with network access to exploit an open redirect on the affected system. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.'s TIBCO Nimbus: version 10.5.0.
Problem types: description: Successful execution of these vulnerabilities will result in an attacker being able to execute commands with the privileges of the affected user.
Affected products: vendor: TIBCO Software Inc.
product: TIBCO Nimbus
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: NONE
baseScore: 9.3
baseSeverity: CRITICAL
Published: 2022-12-12T01:49:10.008Z
CVE-2022-41560 TIBCO Nimbus Denial of Service Vulnerability
The Statement Set Upload via the Web Client component of TIBCO Software Inc.'s TIBCO Nimbus contains an easily exploitable vulnerability that allows a low privileged attacker with network access to execute a Denial of Service Attack on the affected system. Affected releases are TIBCO Software Inc.'s TIBCO Nimbus: version 10.5.0.
Problem types: description: Successful execution of this vulnerability can result in an unauthorized hang or frequently repeatable crash (complete DOS) of the affected system.
Affected products: vendor: TIBCO Software Inc.
product: TIBCO Nimbus
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
Published: 2022-12-12T01:49:10.008Z
CVE-2022-41561 TIBCO JasperReports Server RCE Vulnerability
The JNDI Data Sources component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server - Community Edition, TIBCO JasperReports Server - Developer Edition, TIBCO JasperReports Server for AWS Marketplace, TIBCO JasperReports Server for AWS Marketplace, TIBCO JasperReports Server for Microsoft Azure, and TIBCO JasperReports Server for Microsoft Azure contains an easily exploitable vulnerability that allows a privileged/administrative attacker with network access to execute Remote Code Execution to obtain a reverse shell on the affected system. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Server: versions 8.0.2 and below, TIBCO JasperReports Server: version 8.1.0, TIBCO JasperReports Server - Community Edition: versions 8.1.0 and below, TIBCO JasperReports Server - Developer Edition: versions 8.1.0 and below, TIBCO JasperReports Server for AWS Marketplace: versions 8.0.2 and below, TIBCO JasperReports Server for AWS Marketplace: version 8.1.0, TIBCO JasperReports Server for Microsoft Azure: versions 8.0.2 and below, and TIBCO JasperReports Server for Microsoft Azure: version 8.1.0.
Problem types: description: Successful execution of this vulnerability can result in an attacker gaining full user access to the affected system.
Affected products: vendor: TIBCO Software Inc.
product: TIBCO JasperReports Server
vendor: TIBCO Software Inc.
product: TIBCO JasperReports Server
vendor: TIBCO Software Inc.
product: TIBCO JasperReports Server - Community Edition
vendor: TIBCO Software Inc.
product: TIBCO JasperReports Server - Developer Edition
vendor: TIBCO Software Inc.
product: TIBCO JasperReports Server for AWS Marketplace
vendor: TIBCO Software Inc.
product: TIBCO JasperReports Server for AWS Marketplace
vendor: TIBCO Software Inc.
product: TIBCO JasperReports Server for Microsoft Azure
vendor: TIBCO Software Inc.
product: TIBCO JasperReports Server for Microsoft Azure
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 9.1
baseSeverity: CRITICAL
Published: 2022-12-15T03:44:03.964Z
CVE-2022-41562 TIBCO JasperReports Server XSS Issue on Roles
The HTML escaping component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server - Community Edition, TIBCO JasperReports Server - Developer Edition, TIBCO JasperReports Server for AWS Marketplace, TIBCO JasperReports Server for AWS Marketplace, TIBCO JasperReports Server for Microsoft Azure, and TIBCO JasperReports Server for Microsoft Azure contains an easily exploitable vulnerability that allows a privileged/administrative attacker with network access to execute an XSS attack on the affected system. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Server: versions 8.0.2 and below, TIBCO JasperReports Server: version 8.1.0, TIBCO JasperReports Server - Community Edition: versions 8.1.0 and below, TIBCO JasperReports Server - Developer Edition: versions 8.1.0 and below, TIBCO JasperReports Server for AWS Marketplace: versions 8.0.2 and below, TIBCO JasperReports Server for AWS Marketplace: version 8.1.0, TIBCO JasperReports Server for Microsoft Azure: versions 8.0.2 and below, and TIBCO JasperReports Server for Microsoft Azure: version 8.1.0.
Problem types: description: Successful execution of this vulnerability can result in unauthorized read, update, insert or delete access to JasperReports Server and hang or frequently repeatable crash (complete DOS) of the affected system. This vulnerability can allow the attacker to exploit associated resources other than the affected system.
Affected products: vendor: TIBCO Software Inc.
product: TIBCO JasperReports Server
vendor: TIBCO Software Inc.
product: TIBCO JasperReports Server
vendor: TIBCO Software Inc.
product: TIBCO JasperReports Server - Community Edition
vendor: TIBCO Software Inc.
product: TIBCO JasperReports Server - Developer Edition
vendor: TIBCO Software Inc.
product: TIBCO JasperReports Server for AWS Marketplace
vendor: TIBCO Software Inc.
product: TIBCO JasperReports Server for AWS Marketplace
vendor: TIBCO Software Inc.
product: TIBCO JasperReports Server for Microsoft Azure
vendor: TIBCO Software Inc.
product: TIBCO JasperReports Server for Microsoft Azure
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 8.4
baseSeverity: HIGH
Published: 2022-12-15T03:44:03.964Z
CVE-2022-41563 TIBCO JasperReports Server Stored XSS Vulnerability
The Dashboard component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server - Developer Edition, TIBCO JasperReports Server for AWS Marketplace, TIBCO JasperReports Server for AWS Marketplace, TIBCO JasperReports Server for Microsoft Azure, and TIBCO JasperReports Server for Microsoft Azure contains an easily exploitable vulnerability that allows a low privileged attacker with network access to execute Stored Cross Site Scripting (XSS) on the affected system. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Server: versions 8.0.2 and below, TIBCO JasperReports Server: version 8.1.0, TIBCO JasperReports Server - Developer Edition: versions 8.1.0 and below, TIBCO JasperReports Server for AWS Marketplace: versions 8.0.2 and below, TIBCO JasperReports Server for AWS Marketplace: version 8.1.0, TIBCO JasperReports Server for Microsoft Azure: versions 8.0.2 and below, and TIBCO JasperReports Server for Microsoft Azure: version 8.1.0.
Problem types: description: Successful execution of these vulnerabilities will result in an attacker being able to execute commands with the privileges of the affected user. This vulnerability can allow the attacker to exploit associated resources other than the affected system.
Affected products: vendor: TIBCO Software Inc.
product: TIBCO JasperReports Server
vendor: TIBCO Software Inc.
product: TIBCO JasperReports Server
vendor: TIBCO Software Inc.
product: TIBCO JasperReports Server - Developer Edition
vendor: TIBCO Software Inc.
product: TIBCO JasperReports Server for AWS Marketplace
vendor: TIBCO Software Inc.
product: TIBCO JasperReports Server for AWS Marketplace
vendor: TIBCO Software Inc.
product: TIBCO JasperReports Server for Microsoft Azure
vendor: TIBCO Software Inc.
product: TIBCO JasperReports Server for Microsoft Azure
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 9
baseSeverity: CRITICAL
Published: 2022-12-15T03:44:03.964Z
CVE-2022-41564 TIBCO Operational Intelligence Hawk Redtail Credential Exposure Vulnerability
The Hawk Console component of TIBCO Software Inc.'s TIBCO Hawk and TIBCO Operational Intelligence Hawk RedTail contains a vulnerability that will return the EMS transport password and EMS SSL password to a privileged user. Affected releases are TIBCO Software Inc.'s TIBCO Hawk: versions 6.1.0 through 6.2.1 and TIBCO Operational Intelligence Hawk RedTail: versions 7.0.0 through 7.2.0.
Problem types: description: The impact of this vulnerability includes the theoretical possibility of an authenticated Hawk Console user gaining administrative access to the EMS server.
Affected products: vendor: TIBCO Software Inc.
product: TIBCO Hawk
vendor: TIBCO Software Inc.
product: TIBCO Operational Intelligence Hawk RedTail
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
baseScore: 6.8
baseSeverity: MEDIUM
Published: 2023-02-14T00:00:00.000Z
CVE-2022-41565 TIBCO EBX Cross Site Scripting (XSS) Vulnerability
The Web Application component of TIBCO Software Inc.'s TIBCO EBX and TIBCO Product and Service Catalog powered by TIBCO EBX contains an easily exploitable vulnerability that allows a low privileged attacker with network access to execute a stored XSS on the affected system. Affected releases are TIBCO Software Inc.'s TIBCO EBX: versions 5.9.21 and below, versions 6.0.11 and below and TIBCO Product and Service Catalog powered by TIBCO EBX: versions 1.2.0 and below.
Problem types: description: The impact of this vulnerability includes the theoretical possibility resulting in unauthorized ability  to update, insert or delete TIBCO EBX data.
Affected products: vendor: TIBCO Software Inc.
product: TIBCO EBX
vendor: TIBCO Software Inc.
product: TIBCO Product and Service Catalog powered by TIBCO EBX
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: NONE
baseScore: 8.7
baseSeverity: HIGH
Published: 2023-02-22T00:00:00.000Z
CVE-2022-41566 TIBCO EBX Add-ons Cross Site Scripting (XSS) Vulnerability
The server component of TIBCO Software Inc.'s TIBCO EBX Add-ons contains an easily exploitable vulnerability that allows a low privileged attacker with network access to execute stored XSS on the affected system. Affected releases are TIBCO Software Inc.'s TIBCO EBX Add-ons: versions 5.6.0 and below.
Problem types: description: The impact of this vulnerability includes the theoretical possibility of unauthorized access  to TIBCO EBX® Add-ons data. This includes the ability to update, insert, or delete data.
Affected products: vendor: TIBCO Software Inc.
product: TIBCO EBX Add-ons
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: NONE
baseScore: 8.7
baseSeverity: HIGH
Published: 2023-02-22T00:00:00.000Z
CVE-2022-41567 TIBCO BusinessConnect Stored XSS Vulnerability
The BusinessConnect UI component of TIBCO Software Inc.'s TIBCO BusinessConnect contains an easily exploitable vulnerability that allows a low privileged attacker with network access to execute a cross-site scripting (XSS) attack on the affected system. Affected releases are TIBCO Software Inc.'s TIBCO BusinessConnect: versions 7.3.0 and below.
Problem types: description: Successful execution of this attack could result in the ability to perform actions within the context of another user including reading, updating, inserting, or deleting data accessible to TIBCO BusinessConnect.
Affected products: vendor: TIBCO Software Inc.
product: TIBCO BusinessConnect
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: NONE
baseScore: 7.3
baseSeverity: HIGH
Published: 2023-02-22T00:00:00.000Z
CVE-2022-41568 
LINE client for iOS before 12.17.0 might be crashed by sharing an invalid shared key of e2ee in group chat.
Problem types: description: na
Affected products: vendor: LINE Corporation
product: LINE client for iOS
Published: 2022-11-29T00:00:00.000Z
CVE-2022-41570 
An issue was discovered in EyesOfNetwork (EON) through 5.3.11. Unauthenticated SQL injection can occur.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-27T01:53:21.000Z
CVE-2022-41571 
An issue was discovered in EyesOfNetwork (EON) through 5.3.11. Local file inclusion can occur.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-27T01:53:53.000Z
CVE-2022-41572 
An issue was discovered in EyesOfNetwork (EON) through 5.3.11. Privilege escalation can be accomplished on the server because nmap can be run as root. The attacker achieves total control over the server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-07T00:00:00.000Z
CVE-2022-41573 
An issue was discovered in Ovidentia 8.3. The file upload feature does not prevent the uploading of executable files. A user can upload a .png file containing PHP code and then rename it to have the .php extension. It will then be accessible at an images/common/ URI for remote code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-07T00:00:00.000Z
CVE-2022-41574 
An access-control vulnerability in Gradle Enterprise 2022.4 through 2022.3.1 allows remote attackers to prevent backups from occurring, and send emails with arbitrary text content to the configured installation-administrator contact address, via HTTP access to an accidentally exposed internal endpoint. This is fixed in 2022.3.2.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-07T00:00:00.000Z
CVE-2022-41575 
A credential-exposure vulnerability in the support-bundle mechanism in Gradle Enterprise 2022.3 through 2022.3.3 allows remote attackers to access a subset of application data (e.g., cleartext credentials). This is fixed in 2022.3.3.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-21T00:00:00.000Z
CVE-2022-41576 
The rphone module has a script that can be maliciously modified.Successful exploitation of this vulnerability may cause irreversible programs to be implanted on user devices.
Problem types: description: Weaknesses Introduced During Design
Affected products: vendor: Huawei
product: HarmonyOS
vendor: Huawei
product: EMUI
Published: 2022-10-14T00:00:00.000Z
CVE-2022-41577 
The kernel server has a vulnerability of not verifying the length of the data transferred in the user space.Successful exploitation of this vulnerability may cause out-of-bounds read in the kernel, which affects the device confidentiality and availability.
Problem types: description: Out-of-bounds read vulnerability
Affected products: vendor: Huawei
product: HarmonyOS
vendor: Huawei
product: EMUI
Published: 2022-10-14T00:00:00.000Z
CVE-2022-41578 
The MPTCP module has an out-of-bounds write vulnerability.Successful exploitation of this vulnerability may cause root privilege escalation attacks implemented by modifying program information.
Problem types: description: Out-of-bounds write vulnerability
Affected products: vendor: Huawei
product: HarmonyOS
vendor: Huawei
product: EMUI
Published: 2022-10-14T00:00:00.000Z