rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-27884 
Maccms v10 was discovered to contain a reflected cross-site scripting (XSS) vulnerability in /admin.php/admin/plog/index.html via the wd parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-25T18:50:13.000Z
CVE-2022-27885 
Maccms v10 was discovered to contain multiple reflected cross-site scripting (XSS) vulnerabilities in /admin.php/admin/website/data.html via the select and input parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-25T18:50:13.000Z
CVE-2022-27886 
Maccms v10 was discovered to contain a reflected cross-site scripting (XSS) vulnerability in /admin.php/admin/ulog/index.html via the wd parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-25T18:50:14.000Z
CVE-2022-27887 
Maccms v10 was discovered to contain a reflected cross-site scripting (XSS) vulnerability in /admin.php/admin/vod/data.html via the repeat parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-25T18:50:14.000Z
CVE-2022-27888 The Foundry Issues service was found to be logging in a manner that captured session tokens.
Foundry Issues service versions 2.244.0 to 2.249.0 was found to be logging in a manner that captured sensitive information (session tokens). This issue was fixed in 2.249.1.
Problem types: cwe_id: CWE-532
description: CWE-532 Information Exposure Through Log Files
Affected products: vendor: Palantir
product: Foundry Issues
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2022-04-26T22:35:08.294Z
CVE-2022-27889 The Foundry Multipass service contains code paths that could be abused to cause a denial of service for authentication and authorization operations.
The Multipass service was found to have code paths that could be abused to cause a denial of service for authentication or authorization operations. A malicious attacker could perform an application-level denial of service attack, potentially causing authentication and/or authorization operations to fail for the duration of the attack. This could lead to performance degradation or login failures for customer Palantir Foundry environments. This vulnerability is resolved in Multipass 3.647.0. This issue affects: Palantir Foundry Multipass versions prior to 3.647.0.
Problem types: cwe_id: CWE-400
description: CWE-400 Uncontrolled Resource Consumption
Affected products: vendor: Palantir
product: Foundry Multipass
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
version: 3.1
Credits: lang: en
value: This issue was identified internally at Palantir. Initial activity was observed as a result of good-faith security research conducted by bug bounty participants.
Published: 2022-06-14T13:45:14.836Z
CVE-2022-27890 
It was discovered that the sls-logging was not verifying hostnames in TLS certificates due to a misuse of the javax.net.ssl.SSLSocketFactory API. A malicious attacker in a privileged network position could abuse this to perform a man-in-the-middle attack. A successful man-in-the-middle attack would allow them to intercept, read, or modify network communications to and from the affected service. In the case of AtlasDB, the vulnerability was mitigated by other network controls such as two-way TLS when deployed as part of a Palantir platform. Palantir still recommends upgrading to a non-vulnerable version out of an abundance of caution.
Problem types: cwe_id: CWE-297
description: CWE-297 Improper Validation of Certificate with Host Mismatch
Affected products: vendor: Palantir
product: AtlasDB
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 6.3
baseSeverity: MEDIUM
Published: 2023-02-16T00:00:00.000Z
CVE-2022-27891 Palantir Gotham included an unauthenticated endpoint that listed all active usernames in the platform with an active session. 
Palantir Gotham included an unauthenticated endpoint that listed all active usernames on the stack with an active session. The affected services have been patched and automatically deployed to all Apollo-managed Gotham instances. It is highly recommended that customers upgrade all affected services to the latest version. This issue affects: Palantir Gotham versions prior to 103.30221005.0.
Problem types: cwe_id: CWE-200
description: CWE-200 Information Exposure
Affected products: vendor: Palantir
product: Gotham
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
Published: 2023-02-16T00:00:00.000Z
CVE-2022-27892 Palantir Gotham included an endpoint that would log arbitrary sized payloads. 
Palantir Gotham versions prior to 3.22.11.2 included an unauthenticated endpoint that would have allowed an attacker to exhaust the memory of the Gotham dispatch service.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Palantir
product: Gotham
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: LOW
baseScore: 5.3
baseSeverity: MEDIUM
Published: 2023-02-16T00:00:00.000Z
CVE-2022-27893 The Foundry Magritte plugin osisoft-pi-web-connector was found to be logging in a manner that captured authentication requests.
The Foundry Magritte plugin osisoft-pi-web-connector versions 0.15.0 - 0.43.0 was found to be logging in a manner that captured authentication requests. This vulnerability is resolved in osisoft-pi-web-connector version 0.44.0.
Problem types: cwe_id: CWE-532
description: CWE-532 Information Exposure Through Log Files
Affected products: vendor: Palantir
product: Foundry Magritte plugin osisoft-pi-web-connector
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
baseScore: 4.2
baseSeverity: MEDIUM
Published: 2022-11-04T16:05:08.352Z
CVE-2022-27894 The Foundry Blobster service was found to have a cross-site scripting (XSS) vulnerability.
The Foundry Blobster service was found to have a cross-site scripting (XSS) vulnerability that could have allowed an attacker with access to Foundry to launch attacks against other users. This vulnerability is resolved in Blobster 3.228.0.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Palantir
product: Foundry Blobster Service
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 4.8
baseSeverity: MEDIUM
Published: 2022-11-04T17:15:11.731Z
CVE-2022-27895 A component in Foundry logging was found to be capturing sensitive information in logs.
Information Exposure Through Log Files vulnerability discovered in Foundry when logs were captured using an underlying library known as Build2. This issue was present in versions earlier than 1.785.0. Upgrade to Build2 version 1.785.0 or greater.
Problem types: cwe_id: CWE-532
description: CWE-532 Information Exposure Through Log Files
Affected products: vendor: Palantir
product: Foundry Build2
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
baseScore: 4.2
baseSeverity: MEDIUM
Published: 2022-11-15T19:45:12.275Z
CVE-2022-27896 The Foundry Code-Workbooks service was found to contain an issue leading to information disclosure.
Information Exposure Through Log Files vulnerability discovered in Foundry Code-Workbooks where the endpoint backing that console was generating service log records of any Python code being run. These service logs included the Foundry token that represents the Code-Workbooks Python console. Upgrade to Code-Workbooks version 4.461.0. This issue affects Palantir Foundry Code-Workbooks version 4.144 to version 4.460.0 and is resolved in 4.461.0.
Problem types: cwe_id: CWE-532
description: CWE-532 Information Exposure Through Log Files
Affected products: vendor: Palantir
product: Foundry Code-Workbooks
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
baseScore: 4.2
baseSeverity: MEDIUM
Published: 2022-11-14T20:55:11.191Z
CVE-2022-27897 Palantir Gotham included an endpoint that would log arbitrary sized zip files. 
Palantir Gotham versions prior to 3.22.11.2 included an unauthenticated endpoint that would load portions of maliciously crafted zip files to memory. An attacker could repeatedly upload a malicious zip file, which would allow them to exhaust memory resources on the dispatch server.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Palantir
product: Gotham
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: LOW
baseScore: 5.3
baseSeverity: MEDIUM
Published: 2023-02-16T00:00:00.000Z
CVE-2022-27903 
An OS Command Injection vulnerability in the configuration parser of Eve-NG Professional through 4.0.1-65 and Eve-NG Community through 2.0.3-112 allows a remote authenticated attacker to execute commands as root by editing virtualization command parameters of imported UNL files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-04T13:16:52.000Z
CVE-2022-27904 
Automox Agent for macOS before version 39 was vulnerable to a time-of-check/time-of-use (TOCTOU) race-condition attack during the agent install process.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-30T23:25:09.000Z
CVE-2022-27905 
In ControlUp Real-Time Agent before 8.6, an unquoted path can result in privilege escalation. An attacker would require write permissions to the root level of the OS drive (C:\) to exploit this.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-27T13:59:10.000Z
CVE-2022-27906 
Mendelson OFTP2 before 1.1 b43 is affected by directory traversal. To access the vulnerable code path, the attacker has to know one of the configured Odette IDs of the OFTP2 server. An attacker can upload files to the server outside of the intended upload directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-25T19:36:10.000Z
CVE-2022-27907 
Sonatype Nexus Repository Manager 3.x before 3.38.0 allows SSRF.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-30T15:51:37.000Z
CVE-2022-27908 
Zoho ManageEngine OpManager before 125588 (and before 125603) is vulnerable to authenticated SQL Injection in the Inventory Reports module.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-18T12:17:13.000Z
CVE-2022-27909 Extension - Incorrect Access Control within jdownloads extension
In Joomla component 'jDownloads 3.9.8.2 Stable' the remote user can change some parameters in the address bar and see the names of other users' files
Problem types: description: Incorrect Access Control
Affected products: vendor: jDownloads
product: jDownloads
Credits: lang: en
value: Massimo Chiriv - HackerHood Team Research
Published: 2022-05-06T17:55:12.660Z
CVE-2022-27910 Extension - Joomlatools - DOCman - Reflected Cross-Site Scripting (XSS) in an image upload function
In Joomla component 'Joomlatools - DOCman 3.5.13 (and likely most versions below)' are affected to an reflected Cross-Site Scripting (XSS) in an image upload function
Problem types: description: Reflected Cross-Site Scripting (XSS)
Affected products: vendor: Joomlatools
product: DOCman
Credits: lang: en
value: Jordan Jurek, CyberCX
Published: 2022-07-10T19:35:10.278Z
CVE-2022-27911 [20220801] - Core - Multiple Full Path Disclosures because of missing '_JEXEC or die check'
An issue was discovered in Joomla! 4.2.0. Multiple Full Path Disclosures because of missing '_JEXEC or die check' caused by the PSR12 changes.
Problem types: description: FPD
Affected products: vendor: Joomla! Project
product: Joomla! CMS
Published: 2022-08-31T10:00:14.200Z
CVE-2022-27912 [20221001] - Core - Debug Mode leaks full request payloads including passwords
An issue was discovered in Joomla! 4.0.0 through 4.2.3. Sites with publicly enabled debug mode exposed data of previous requests.
Problem types: description: Information Disclosure
Affected products: vendor: Joomla! Project
product: Joomla! CMS
default_status: unaffected
Credits: lang: en
value: Peter Martin
Published: 2022-10-25T19:00:14.614Z
CVE-2022-27913 [20221002] - Core - RXSS through reflection of user input in headings
An issue was discovered in Joomla! 4.2.0 through 4.2.3. Inadequate filtering of potentially malicious user input leads to reflected XSS vulnerabilities in various components.
Problem types: description: Reflected Cross-Site Scripting (XSS)
Affected products: vendor: Joomla! Project
product: Joomla! CMS
default_status: unaffected
Credits: lang: en
value: Ajith Menon
Published: 2022-10-25T19:00:15.710Z
CVE-2022-27914 [20221101] - Core - RXSS through reflection of user input in com_media
An issue was discovered in Joomla! 4.0.0 through 4.2.4. Inadequate filtering of potentially malicious user input leads to reflected XSS vulnerabilities in com_media.
Problem types: description: Reflected Cross-Site Scripting (XSS)
Affected products: vendor: Joomla! Project
product: Joomla! CMS
default_status: unaffected
Credits: lang: en
value: Denitz
Published: 2022-11-08T18:50:10.534Z
CVE-2022-27919 
Gradle Enterprise before 2022.1 allows remote code execution if the installation process did not specify an initial configuration file. The configuration allows certain anonymous access to administration and an API.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-25T19:55:17.000Z
CVE-2022-27920 
libkiwix 10.0.0 and 10.0.1 allows XSS in the built-in webserver functionality via the search suggestions URL parameter. This is fixed in 10.1.0.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-25T20:00:38.000Z
CVE-2022-27924 
Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 allows an unauthenticated attacker to inject arbitrary memcache commands into a targeted instance. These memcache commands becomes unescaped, causing an overwrite of arbitrary cached entries.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-20T23:23:17.000Z
CVE-2022-27925 
Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. An authenticated user with administrator rights has the ability to upload arbitrary files to the system, leading to directory traversal.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-20T23:23:25.000Z
CVE-2022-27926 
A reflected cross-site scripting (XSS) vulnerability in the /public/launchNewWindow.jsp component of Zimbra Collaboration (aka ZCS) 9.0 allows unauthenticated attackers to execute arbitrary web script or HTML via request parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-20T23:23:40.000Z
CVE-2022-27927 
A SQL injection vulnerability exists in Microfinance Management System 1.0 when MySQL is being used as the application database. An attacker can issue SQL commands to the MySQL database through the vulnerable course_code and/or customer_number parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-19T12:32:00.000Z
CVE-2022-27928 
Pexip Infinity 27.x before 27.3 allows remote attackers to trigger a software abort via the Session Initiation Protocol.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-17T20:32:37.000Z
CVE-2022-27929 
Pexip Infinity 27.x before 27.3 allows remote attackers to trigger a software abort via HTTP.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-17T20:37:54.000Z
CVE-2022-27930 
Pexip Infinity 27.x before 27.3 allows remote attackers to trigger a software abort via single-sign-on if a random Universally Unique Identifier is guessed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-17T20:41:15.000Z
CVE-2022-27931 
Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via the Session Initiation Protocol.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-17T20:44:05.000Z
CVE-2022-27932 
Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via One Touch Join.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-17T20:47:05.000Z
CVE-2022-27933 
Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via One Touch Join.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-17T20:49:09.000Z
CVE-2022-27934 
Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via HTTP.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-17T20:51:54.000Z
CVE-2022-27935 
Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via Epic Telehealth.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-17T20:55:11.000Z
CVE-2022-27936 
Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via H.323.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-17T20:58:22.000Z
CVE-2022-27937 
Pexip Infinity before 27.3 allows remote attackers to trigger excessive resource consumption via H.264.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-17T21:00:30.000Z
CVE-2022-27938 
stb_image.h (aka the stb image loader) 2.19, as used in libsixel and other products, has a reachable assertion in stbi__create_png_image_raw.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-26T12:49:51.000Z
CVE-2022-27939 
tcprewrite in Tcpreplay 4.4.1 has a reachable assertion in get_layer4_v6 in common/get.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-26T00:00:00.000Z
CVE-2022-27940 
tcprewrite in Tcpreplay 4.4.1 has a heap-based buffer over-read in get_ipv6_next in common/get.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-26T00:00:00.000Z
CVE-2022-27941 
tcprewrite in Tcpreplay 4.4.1 has a heap-based buffer over-read in get_l2len_protocol in common/get.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-26T00:00:00.000Z
CVE-2022-27942 
tcpprep in Tcpreplay 4.4.1 has a heap-based buffer over-read in parse_mpls in common/get.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-26T00:00:00.000Z
CVE-2022-27943 
libiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-26T00:00:00.000Z
CVE-2022-27944 
Foxit PDF Reader before 12.0.1 and PDF Editor before 12.0.1 allow an exportXFAData NULL pointer dereference.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-06T19:19:52.000Z
CVE-2022-27945 
NETGEAR R8500 1.0.2.158 devices allow remote authenticated users to execute arbitrary commands (such as telnetd) via shell metacharacters in the sysNewPasswd and sysConfirmPasswd parameters to password.cgi.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-26T16:13:33.000Z
CVE-2022-27946 
NETGEAR R8500 1.0.2.158 devices allow remote authenticated users to execute arbitrary commands (such as telnetd) via shell metacharacters in the sysNewPasswd and sysConfirmPasswd parameters to admin_account.cgi.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-26T16:14:03.000Z
CVE-2022-27947 
NETGEAR R8500 1.0.2.158 devices allow remote authenticated users to execute arbitrary commands (such as telnetd) via shell metacharacters in the ipv6_fix.cgi ipv6_wan_ipaddr, ipv6_lan_ipaddr, ipv6_wan_length, or ipv6_lan_length parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-26T16:13:45.000Z
CVE-2022-27948 
Certain Tesla vehicles through 2022-03-26 allow attackers to open the charging port via a 315 MHz RF signal containing a fixed sequence of approximately one hundred symbols. NOTE: the vendor's perspective is that the behavior is as intended
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.2
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AC:L/AV:N/A:L/C:N/I:L/PR:N/S:C/UI:N
version: 3.1
Published: 2022-03-27T12:07:15.000Z
CVE-2022-27949 Apache Airflow prior to 2.3.1 may include sensitive values in rendered template
A vulnerability in UI of Apache Airflow allows an attacker to view unmasked secrets in rendered template values for tasks which were not executed (for example when they were depending on past and previous instances of the task failed). This issue affects Apache Airflow prior to 2.3.1.
Problem types: cwe_id: CWE-200
description: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: Apache Software Foundation
product: Apache Airflow
Credits: lang: en
value: Apache Airflow PMC would like to thank James Srinivasan for reporting it.
Published: 2022-11-14T00:00:00.000Z
CVE-2022-27950 
In drivers/hid/hid-elo.c in the Linux kernel before 5.16.11, a memory leak exists for a certain hid_parse error condition.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-28T03:45:55.000Z
CVE-2022-27952 
An arbitrary file upload vulnerability in the file upload module of PayloadCMS v0.15.0 allows attackers to execute arbitrary code via a crafted SVG file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-12T16:29:04.000Z