rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-32203 
There is a command injection vulnerability in Huawei terminal printer product. Successful exploitation could result in the highest privileges of the printer. (Vulnerability ID: HWPSIRT-2022-51773)

This vulnerability has been assigned a Common Vulnerabilities and Exposures (CVE) ID: CVE-2022-32203.
Problem types: cwe_id: CWE-77
description: CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
Affected products: vendor: Huawei
product: CV81-WDM FW
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2024-12-20T01:54:16.686Z
CVE-2022-32204 
There is an improper input verification vulnerability in Huawei printer product. Successful exploitation of this vulnerability may cause service abnormal. (Vulnerability ID: HWPSIRT-2022-87185)

This vulnerability has been assigned a Common Vulnerabilities and Exposures (CVE) ID: CVE-2022-32204.
Problem types: cwe_id: CWE-20
description: CWE-20: Improper Input Validation
Affected products: vendor: Huawei
product: CV81-WDM FW
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2024-12-20T01:57:06.968Z
CVE-2022-32205 
A malicious server can serve excessive amounts of `Set-Cookie:` headers in a HTTP response to curl and curl < 7.84.0 stores all of them. A sufficiently large amount of (big) cookies make subsequent HTTP requests to this, or other servers to which the cookies match, create requests that become larger than the threshold that curl uses internally to avoid sending crazy large requests (1048576 bytes) and instead returns an error.This denial state might remain for as long as the same cookies are kept, match and haven't expired. Due to cookie matching rules, a server on `foo.example.com` can set cookies that also would match for `bar.example.com`, making it it possible for a "sister server" to effectively cause a denial of service for a sibling site on the same second level domain using this method.
Problem types: cwe_id: CWE-770
description: Allocation of Resources Without Limits or Throttling (CWE-770)
Affected products: vendor: n/a
product: https://github.com/curl/curl
Published: 2022-07-07T00:00:00.000Z
CVE-2022-32206 
curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially with different algorithms. The number of acceptable "links" in this "decompression chain" was unbounded, allowing a malicious server to insert a virtually unlimited number of compression steps.The use of such a decompression chain could result in a "malloc bomb", makingcurl end up spending enormous amounts of allocated heap memory, or trying toand returning out of memory errors.
Problem types: cwe_id: CWE-770
description: Allocation of Resources Without Limits or Throttling (CWE-770)
Affected products: vendor: n/a
product: https://github.com/curl/curl
Published: 2022-07-07T00:00:00.000Z
CVE-2022-32207 
When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the operation with a rename from a temporary name to the final target file name.In that rename operation, it might accidentally *widen* the permissions for the target file, leaving the updated file accessible to more users than intended.
Problem types: cwe_id: CWE-840
description: Business Logic Errors (CWE-840)
Affected products: vendor: n/a
product: https://github.com/curl/curl
Published: 2022-07-07T00:00:00.000Z
CVE-2022-32208 
When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly. This flaw makes it possible for a Man-In-The-Middle attack to go unnoticed and even allows it to inject data to the client.
Problem types: cwe_id: CWE-840
description: Business Logic Errors (CWE-840)
Affected products: vendor: n/a
product: https://github.com/curl/curl
Published: 2022-07-07T00:00:00.000Z
CVE-2022-32209 
# Possible XSS Vulnerability in Rails::Html::SanitizerThere is a possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer.This vulnerability has been assigned the CVE identifier CVE-2022-32209.Versions Affected: ALLNot affected: NONEFixed Versions: v1.4.3## ImpactA possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer may allow an attacker to inject content if the application developer has overridden the sanitizer's allowed tags to allow both `select` and `style` elements.Code is only impacted if allowed tags are being overridden. This may be done via application configuration:```ruby# In config/application.rbconfig.action_view.sanitized_allowed_tags = ["select", "style"]```see https://guides.rubyonrails.org/configuring.html#configuring-action-viewOr it may be done with a `:tags` option to the Action View helper `sanitize`:```<%= sanitize @comment.body, tags: ["select", "style"] %>```see https://api.rubyonrails.org/classes/ActionView/Helpers/SanitizeHelper.html#method-i-sanitizeOr it may be done with Rails::Html::SafeListSanitizer directly:```ruby# class-level optionRails::Html::SafeListSanitizer.allowed_tags = ["select", "style"]```or```ruby# instance-level optionRails::Html::SafeListSanitizer.new.sanitize(@article.body, tags: ["select", "style"])```All users overriding the allowed tags by any of the above mechanisms to include both "select" and "style" should either upgrade or use one of the workarounds immediately.## ReleasesThe FIXED releases are available at the normal locations.## WorkaroundsRemove either `select` or `style` from the overridden allowed tags.## CreditsThis vulnerability was responsibly reported by [windshock](https://hackerone.com/windshock?type=user).
Problem types: cwe_id: CWE-79
description: Cross-site Scripting (XSS) - Generic (CWE-79)
Affected products: vendor: n/a
product: https://github.com/rails/rails-html-sanitizer
Published: 2022-06-24T00:00:00.000Z
CVE-2022-32210 
`Undici.ProxyAgent` never verifies the remote server's certificate, and always exposes all request & response data to the proxy. This unexpectedly means that proxies can MitM all HTTPS traffic, and if the proxy's URL is HTTP then it also means that nominally HTTPS requests are actually sent via plain-text HTTP between Undici and the proxy server.
Problem types: cwe_id: CWE-295
description: Improper Certificate Validation (CWE-295)
Affected products: vendor: n/a
product: https://github.com/nodejs/undici
Published: 2022-07-14T14:51:40.000Z
CVE-2022-32211 
A SQL injection vulnerability exists in Rocket.Chat <v3.18.6, <v4.4.4 and <v4.7.3 which can allow an attacker to retrieve a reset password token through or a 2fa secret.
Problem types: cwe_id: CWE-89
description: SQL Injection (CWE-89)
Affected products: vendor: n/a
product: Rocket.Chat
Published: 2022-09-23T18:28:14.000Z
CVE-2022-32212 
A OS Command Injection vulnerability exists in Node.js versions <14.20.0, <16.20.0, <18.5.0 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid before making DBS requests allowing rebinding attacks.
Problem types: cwe_id: CWE-284
description: Improper Access Control - Generic (CWE-284)
Affected products: vendor: NodeJS
product: Node
default_status: unaffected
Published: 2022-07-14T00:00:00.000Z
CVE-2022-32213 
The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly parse and validate Transfer-Encoding headers and can lead to HTTP Request Smuggling (HRS).
Problem types: cwe_id: CWE-444
description: HTTP Request Smuggling (CWE-444)
Affected products: vendor: NodeJS
product: Node
default_status: unaffected
Published: 2022-07-14T00:00:00.000Z
CVE-2022-32214 
The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS).
Problem types: cwe_id: CWE-444
description: HTTP Request Smuggling (CWE-444)
Affected products: vendor: NodeJS
product: Node
default_status: unaffected
Published: 2022-07-14T00:00:00.000Z
CVE-2022-32215 
The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly handle multi-line Transfer-Encoding headers. This can lead to HTTP Request Smuggling (HRS).
Problem types: cwe_id: CWE-444
description: HTTP Request Smuggling (CWE-444)
Affected products: vendor: NodeJS
product: Node
default_status: unaffected
Published: 2022-07-14T00:00:00.000Z
CVE-2022-32217 
A cleartext storage of sensitive information exists in Rocket.Chat <v4.6.4 due to Oauth token being leaked in plaintext in Rocket.chat logs.
Problem types: cwe_id: CWE-312
description: Cleartext Storage of Sensitive Information (CWE-312)
Affected products: vendor: n/a
product: Rocket.chat
Published: 2022-09-23T18:28:14.000Z
CVE-2022-32218 
An information disclosure vulnerability exists in Rocket.Chat <v5, <v4.8.2 and <v4.7.5 due to the actionLinkHandler method was found to allow Message ID Enumeration with Regex MongoDB queries.
Problem types: cwe_id: CWE-200
description: Information Disclosure (CWE-200)
Affected products: vendor: n/a
product: Rocket.chat
Published: 2022-09-23T18:28:13.000Z
CVE-2022-32219 
An information disclosure vulnerability exists in Rocket.Chat <v4.7.5 which allowed the "users.list" REST endpoint gets a query parameter from JSON and runs Users.find(queryFromClientSide). This means virtually any authenticated user can access any data (except password hashes) of any user authenticated.
Problem types: cwe_id: CWE-200
description: Information Disclosure (CWE-200)
Affected products: vendor: n/a
product: Rocket.Chat
Published: 2022-09-23T18:28:14.000Z
CVE-2022-32220 
An information disclosure vulnerability exists in Rocket.Chat <v5 due to the getUserMentionsByChannel meteor server method discloses messages from private channels and direct messages regardless of the users access permission to the room.
Problem types: cwe_id: CWE-200
description: Information Disclosure (CWE-200)
Affected products: vendor: n/a
product: Rocket.Chat
Published: 2022-09-23T18:28:14.000Z
CVE-2022-32221 
When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been set, if the same handle previously was used to issue a `PUT` request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the subsequent `POST` request. The problem exists in the logic for a reused handle when it is changed from a PUT to a POST.
Problem types: cwe_id: CWE-200
description: Information Disclosure (CWE-200)
Affected products: vendor: n/a
product: https://github.com/curl/curl
Published: 2022-12-05T00:00:00.000Z
CVE-2022-32222 
A cryptographic vulnerability exists on Node.js on linux in versions of 18.x prior to 18.40.0 which allowed a default path for openssl.cnf that might be accessible under some circumstances to a non-admin user instead of /etc/ssl as was the case in versions prior to the upgrade to OpenSSL 3.
Problem types: cwe_id: CWE-310
description: Cryptographic Issues - Generic (CWE-310)
Affected products: vendor: NodeJS
product: Node
default_status: unaffected
Published: 2022-07-14T00:00:00.000Z
CVE-2022-32223 
Node.js is vulnerable to Hijack Execution Flow: DLL Hijacking under certain conditions on Windows platforms.This vulnerability can be exploited if the victim has the following dependencies on a Windows machine:* OpenSSL has been installed and “C:\Program Files\Common Files\SSL\openssl.cnf” exists.Whenever the above conditions are present, `node.exe` will search for `providers.dll` in the current user directory.After that, `node.exe` will try to search for `providers.dll` by the DLL Search Order in Windows.It is possible for an attacker to place the malicious file `providers.dll` under a variety of paths and exploit this vulnerability.
Problem types: cwe_id: CWE-427
description: Uncontrolled Search Path Element (CWE-427)
Affected products: vendor: NodeJS
product: Node
default_status: unaffected
Published: 2022-07-14T14:51:18.000Z
CVE-2022-32224 
A possible escalation to RCE vulnerability exists when using YAML serialized columns in Active Record < 7.0.3.1, <6.1.6.1, <6.0.5.1 and <5.2.8.1 which could allow an attacker, that can manipulate data in the database (via means like SQL injection), the ability to escalate to an RCE.
Problem types: cwe_id: CWE-502
description: Deserialization of Untrusted Data (CWE-502)
Affected products: vendor: n/a
product: https://github.com/rails/rails
Published: 2022-12-05T00:00:00.000Z
CVE-2022-32225 
A reflected DOM-Based XSS vulnerability has been discovered in the Help directory of Veeam Management Pack for Microsoft System Center 8.0. This vulnerability could be exploited by an attacker by convincing a legitimate user to visit a crafted URL on a Veeam Management Pack for Microsoft System Center server, allowing for the execution of arbitrary scripts.
Problem types: cwe_id: CWE-79
description: Cross-site Scripting (XSS) - DOM (CWE-79)
Affected products: vendor: n/a
product: Veeam Management Pack for Microsoft System Center
Published: 2022-07-14T14:51:29.000Z
CVE-2022-32226 
An improper access control vulnerability exists in Rocket.Chat <v5, <v4.8.2 and <v4.7.5 due to input data in the getUsersOfRoom Meteor server method is not type validated, so that MongoDB query operator objects are accepted by the server, so that instead of a matching rid String a$regex query can be executed, bypassing the room access permission check for every but the first matching room.
Problem types: cwe_id: CWE-284
description: Improper Access Control - Generic (CWE-284)
Affected products: vendor: n/a
product: Rocket.Chat
Published: 2022-09-23T18:28:13.000Z
CVE-2022-32227 
A cleartext transmission of sensitive information exists in Rocket.Chat <v5, <v4.8.2 and <v4.7.5 relating to Oauth tokens by having the permission "view-full-other-user-info", this could cause an oauth token leak in the product.
Problem types: cwe_id: CWE-319
description: Cleartext Transmission of Sensitive Information (CWE-319)
Affected products: vendor: n/a
product: Rocket.Chat
Published: 2022-09-23T18:28:13.000Z
CVE-2022-32228 
An information disclosure vulnerability exists in Rocket.Chat <v5, <v4.8.2 and <v4.7.5 since the getReadReceipts Meteor server method does not properly filter user inputs that are passed to MongoDB queries, allowing $regex queries to enumerate arbitrary Message IDs.
Problem types: cwe_id: CWE-200
description: Information Disclosure (CWE-200)
Affected products: vendor: n/a
product: Rocket.Chat
Published: 2022-09-23T18:28:13.000Z
CVE-2022-32229 
A information disclosure vulnerability exists in Rockert.Chat <v5 due to /api/v1/chat.getThreadsList lack of sanitization of user inputs and can therefore leak private thread messages to unauthorized users via Mongo DB injection.
Problem types: cwe_id: CWE-200
description: Information Disclosure (CWE-200)
Affected products: vendor: n/a
product: Rocket.Chat
Published: 2022-09-23T18:28:13.000Z
CVE-2022-32230 SMBv3 FileNormalizedNameInformation NULL Pointer Dereference
Microsoft Windows SMBv3 suffers from a null pointer dereference in versions of Windows prior to the April, 2022 patch set. By sending a malformed FileNormalizedNameInformation SMBv3 request over a named pipe, an attacker can cause a Blue Screen of Death (BSOD) crash of the Windows kernel. For most systems, this attack requires authentication, except in the special case of Windows Domain Controllers, where unauthenticated users can always open named pipes as long as they can establish an SMB session. Typically, after the BSOD, the victim SMBv3 server will reboot.
Problem types: cwe_id: CWE-476
description: CWE-476 NULL Pointer Dereference
Affected products: vendor: Microsoft
product: Windows 10 Version 20H2
vendor: Microsoft
product: Windows Server Version 20H2
vendor: Microsoft
product: Windows 10 Version 21H1
vendor: Microsoft
product: Windows 10 Version 21H2
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: Spencer McIntyre of Rapid7
Published: 2022-06-14T21:40:12.731Z
CVE-2022-32231 
Improper initialization in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access.
Problem types: description: escalation of privilege
Affected products: vendor: n/a
product: Intel(R) Processors
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 7.5
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: HIGH
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
Published: 2023-02-16T19:59:57.497Z
CVE-2022-32234 
An out of bounds write in hermes, while handling large arrays, prior to commit 06eaec767e376bfdb883d912cb15e987ddf2bda1 allows attackers to potentially execute arbitrary code via crafted JavaScript. Note that this is only exploitable if the application using Hermes permits evaluation of untrusted JavaScript. Hence, most React Native applications are not affected.
Problem types: cwe_id: CWE-787
description: CWE-787: Out-of-Bounds Write
Affected products: vendor: Facebook
product: Hermes
Published: 2022-10-11T00:00:00.000Z
CVE-2022-32235 
When a user opens manipulated AutoCAD (.dwg, TeighaTranslator.exe) files received from untrusted sources in SAP 3D Visual Enterprise Viewer, the application crashes and becomes temporarily unavailable to the user until restart of the application.
Problem types: cwe_id: CWE-20
description: CWE-20
Affected products: vendor: SAP SE
product: SAP 3D Visual Enterprise Viewer
Published: 2022-06-14T18:48:02.000Z
CVE-2022-32236 
When a user opens manipulated Windows Bitmap (.bmp, 2d.x3d) files received from untrusted sources in SAP 3D Visual Enterprise Viewer, the application crashes and becomes temporarily unavailable to the user until restart of the application.
Problem types: cwe_id: CWE-20
description: CWE-20
Affected products: vendor: SAP SE
product: SAP 3D Visual Enterprise Viewer
Published: 2022-06-14T19:15:48.000Z
CVE-2022-32237 
When a user opens manipulated Computer Graphics Metafile (.cgm, CgmCore.dll) files received from untrusted sources in SAP 3D Visual Enterprise Viewer, the application crashes and becomes temporarily unavailable to the user until restart of the application.
Problem types: cwe_id: CWE-20
description: CWE-20
Affected products: vendor: SAP SE
product: SAP 3D Visual Enterprise Viewer
Published: 2022-06-14T19:16:31.000Z
CVE-2022-32238 
When a user opens manipulated Encapsulated Post Script (.eps, ai.x3d) files received from untrusted sources in SAP 3D Visual Enterprise Viewer, the application crashes and becomes temporarily unavailable to the user until restart of the application.
Problem types: cwe_id: CWE-20
description: CWE-20
Affected products: vendor: SAP SE
product: SAP 3D Visual Enterprise Viewer
Published: 2022-06-14T19:17:48.000Z
CVE-2022-32239 
When a user opens manipulated JPEG 2000 (.jp2, jp2k.x3d) files received from untrusted sources in SAP 3D Visual Enterprise Viewer, the application crashes and becomes temporarily unavailable to the user until restart of the application.
Problem types: cwe_id: CWE-20
description: CWE-20
Affected products: vendor: SAP SE
product: SAP 3D Visual Enterprise Viewer
Published: 2022-06-14T19:27:06.000Z
CVE-2022-32240 
When a user opens manipulated Jupiter Tesselation (.jt, JTReader.x3d) files received from untrusted sources in SAP 3D Visual Enterprise Viewer, the application crashes and becomes temporarily unavailable to the user until restart of the application.
Problem types: cwe_id: CWE-20
description: CWE-20
Affected products: vendor: SAP SE
product: SAP 3D Visual Enterprise Viewer
Published: 2022-06-14T22:30:35.000Z
CVE-2022-32241 
When a user opens manipulated Portable Document Format (.pdf, PDFView.x3d) files received from untrusted sources in SAP 3D Visual Enterprise Viewer, the application crashes and becomes temporarily unavailable to the user until restart of the application.
Problem types: cwe_id: CWE-20
description: CWE-20
Affected products: vendor: SAP SE
product: SAP 3D Visual Enterprise Viewer
Published: 2022-06-14T22:31:27.000Z
CVE-2022-32242 
When a user opens manipulated Radiance Picture (.hdr, hdr.x3d) files received from untrusted sources in SAP 3D Visual Enterprise Viewer, the application crashes and becomes temporarily unavailable to the user until restart of the application.
Problem types: cwe_id: CWE-20
description: CWE-20
Affected products: vendor: SAP SE
product: SAP 3D Visual Enterprise Viewer
Published: 2022-06-14T22:32:12.000Z
CVE-2022-32243 
When a user opens manipulated Scalable Vector Graphics (.svg, svg.x3d) files received from untrusted sources in SAP 3D Visual Enterprise Viewer, the application crashes and becomes temporarily unavailable to the user until restart of the application.
Problem types: cwe_id: CWE-20
description: CWE-20
Affected products: vendor: SAP SE
product: SAP 3D Visual Enterprise Viewer
Published: 2022-06-14T22:32:55.000Z
CVE-2022-32244 
Under certain conditions an attacker authenticated as a CMS administrator access the BOE Commentary database and retrieve (non-personal) system data, modify system data but can't make the system unavailable. This needs the attacker to have high privilege access to the same physical/logical network to access information which would otherwise be restricted, leading to low impact on confidentiality and high impact on integrity of the application.
Problem types: cwe_id: CWE-200
description: CWE-200
Affected products: vendor: SAP SE
product: SAP BusinessObjects Business Intelligence Platform (Commentary DB)
Published: 2022-09-13T19:24:35.000Z
CVE-2022-32245 
SAP BusinessObjects Business Intelligence Platform (Open Document) - versions 420, 430, allows an unauthenticated attacker to retrieve sensitive information plain text over the network. On successful exploitation, the attacker can view any data available for a business user and put load on the application by an automated attack. Thus, completely compromising confidentiality but causing a limited impact on the availability of the application.
Problem types: cwe_id: CWE-319
description: CWE-319
Affected products: vendor: SAP SE
product: SAP BusinessObjects Business Intelligence Platform (Open Document)
Published: 2022-08-09T20:13:29.000Z
CVE-2022-32246 
SAP Busines Objects Business Intelligence Platform (Visual Difference Application) - versions 420, 430, allows an authenticated attacker who has access to BI admin console to send crafted queries and extract data from the SQL backend. On successful exploitation, the attacker can cause limited impact on confidentiality and integrity of the application
Problem types: cwe_id: CWE-89
description: CWE-89
Affected products: vendor: SAP SE
product: SAP BusinessObjects Business Intelligence Platform (Visual Difference Application)
Published: 2022-07-12T20:26:21.000Z