rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-38716 WordPress Motors – Car Dealer & Classified Ads Plugin <= 1.4.4 is vulnerable to Cross Site Request Forgery (CSRF)
Cross-Site Request Forgery (CSRF) vulnerability in StylemixThemes Motors – Car Dealer, Classifieds & Listing plugin <= 1.4.4 versions.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: StylemixThemes
product: Motors – Car Dealer, Classifieds & Listing
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
version: 3.1
Credits: lang: en
value: Lana Codes (Patchstack Alliance)
Published: 2023-05-25T10:28:42.253Z
CVE-2022-38723 
Gravitee API Management before 3.15.13 allows path traversal through HTML injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-01-03T00:00:00.000Z
CVE-2022-38724 
Silverstripe silverstripe/framework through 4.11.0, silverstripe/assets through 1.11.0, and silverstripe/asset-admin through 1.11.0 allow XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-22T00:00:00.000Z
CVE-2022-38725 
An integer overflow in the RFC3164 parser in One Identity syslog-ng 3.0 through 3.37 allows remote attackers to cause a Denial of Service via crafted syslog input that is mishandled by the tcp or network function. syslog-ng Premium Edition 7.0.30 and syslog-ng Store Box 6.10.0 are also affected.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-01-23T00:00:00.000Z
CVE-2022-38730 
Docker Desktop for Windows before 4.6 allows attackers to overwrite any file through the windowscontainers/start dockerBackendV2 API by controlling the data-root field inside the DaemonJSON field in the WindowsContainerStartRequest class. This allows exploiting a symlink vulnerability in ..\dataRoot\network\files\local-kv.db because of a TOCTOU race condition.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-27T00:00:00.000Z
CVE-2022-38731 
Qaelum DOSE 18.08 through 21.1 before 21.2 allows Directory Traversal via the loadimages name parameter. It allows a user to specify an arbitrary location on the server's filesystem from which to load an image. (Only images are displayed to the attacker. All other files are loaded but not displayed.) The Content-Type response header reflects the actual content type of the file being requested. This allows an attacker to enumerate files on the local system. Additionally, remote resources can be requested via a UNC path, allowing an attacker to coerce authentication out from the server to the attackers machine.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-16T00:00:00.000Z
CVE-2022-38732 
SnapCenter versions prior to 4.7 shipped without Content Security Policy (CSP) implemented which could allow certain types of attacks that otherwise would be prevented.
Problem types: description: Missing Content Security Policy
Affected products: vendor: n/a
product: SnapCenter
Published: 2022-09-29T14:36:58.000Z
CVE-2022-38733 
OnCommand Insight versions 7.3.1 through 7.3.14 are susceptible to an authentication bypass vulnerability in the Data Warehouse component.
Problem types: description: Authentication Bypas
Affected products: vendor: n/a
product: OnCommand Insight
Published: 2022-12-20T00:00:00.000Z
CVE-2022-38734 
StorageGRID (formerly StorageGRID Webscale) versions prior to 11.6.0.8 are susceptible to a Denial of Service (DoS) vulnerability. A successful exploit could lead to to a crash of the Local Distribution Router (LDR) service.
Problem types: description: Denial of Service
Affected products: vendor: n/a
product: Denial of Service Vulnerability in StorageGRID (formerly StorageGRID Webscale)
Published: 2023-03-02T00:00:00.000Z
CVE-2022-38742 Rockwell Automation ThinManager Software Vulnerable to Arbitrary Code Execution and Denial-Of-Service Attack
Rockwell Automation ThinManager ThinServer versions 11.0.0 - 13.0.0 is vulnerable to a heap-based buffer overflow. An attacker could send a specifically crafted TFTP or HTTPS request, causing a heap-based buffer overflow that crashes the ThinServer process. If successfully exploited, this could expose the server to arbitrary remote code execution.
Problem types: cwe_id: CWE-122
description: CWE-122 Heap-based Buffer Overflow
Affected products: vendor: Rockwell Automation
product: ThinManager ThinServer
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2022-09-23T15:24:18.224Z
CVE-2022-38743 
Rockwell Automation FactoryTalk VantagePoint versions 8.0, 8.10, 8.20, 8.30, 8.31 are vulnerable to an improper access control vulnerability. The FactoryTalk VantagePoint SQL Server account could allow a malicious user with read-only privileges to execute SQL statements in the back-end database. If successfully exploited, this could allow the attacker to execute arbitrary code and gain access to restricted data.
Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Control
Affected products: vendor: n/a
product: FactoryTalk VantagePoint
Published: 2022-10-17T00:00:00.000Z
CVE-2022-38744 FactoryTalk Alarm and Events Server Vulnerable to Denial-Of-Service Attack

An unauthenticated attacker with network access to a victim's Rockwell Automation FactoryTalk Alarm and 
Events service could open a connection, causing the service to fault and become unavailable. The affected port 
could be used as a server ping port and uses messages structured with XML.



Problem types: cwe_id: CWE-287
description: CWE-287 Improper Authentication
Affected products: vendor: Rockwell Automation
product: FactoryTalk Alarm and Events Server
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2022-10-27T13:25:17.957Z
CVE-2022-38745 Apache OpenOffice: Empty entry in Java class path
Apache OpenOffice versions before 4.1.14 may be configured to add an empty entry to the Java class path. This may lead to run arbitrary Java code from the current directory.



Problem types: cwe_id: CWE-94
description: CWE-94 Improper Control of Generation of Code ('Code Injection')
cwe_id: CWE-1188
description: CWE-1188 Insecure Default Initialization of Resource
cwe_id: CWE-427
description: CWE-427 Uncontrolled Search Path Element
Affected products: vendor: Apache Software Foundation
product: Apache OpenOffice
default_status: unaffected
Credits: lang: en
value: European Commission's Open Source Programme Office
Published: 2023-03-24T15:56:48.549Z
CVE-2022-38749 DoS in SnakeYAML
Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow.
Problem types: cwe_id: CWE-121
description: CWE-121 Stack-based Buffer Overflow
Affected products: vendor: snakeyaml
product: SnakeYAML
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
Published: 2022-09-05T00:00:00.000Z
CVE-2022-38750 DoS in SnakeYAML
Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow.
Problem types: cwe_id: CWE-121
description: CWE-121 Stack-based Buffer Overflow
Affected products: vendor: snakeyaml
product: SnakeYAML
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
Published: 2022-09-05T00:00:00.000Z
CVE-2022-38751 DoS in SnakeYAML
Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow.
Problem types: cwe_id: CWE-121
description: CWE-121 Stack-based Buffer Overflow
Affected products: vendor: snakeyaml
product: SnakeYAML
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
Published: 2022-09-05T00:00:00.000Z
CVE-2022-38752 DoS in SnakeYAML
Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stack-overflow.
Problem types: cwe_id: CWE-121
description: CWE-121 Stack-based Buffer Overflow
Affected products: vendor: snakeyaml
product: SnakeYAML
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
Published: 2022-09-05T00:00:00.000Z
CVE-2022-38753 
This update resolves a multi-factor authentication bypass attack
Problem types: description: MFA Factor Authentication bypass
Affected products: vendor: n/a
product: NetIQ Advanced Authentication
Published: 2022-11-28T00:00:00.000Z
CVE-2022-38754 CVE-2022-38754 - Micro Focus Operations Bridge Manager and OpsBridge Containerized - Cross Site Scripting (XSS)
A potential vulnerability has been identified in Micro Focus Operations Bridge - Containerized. The vulnerability could be exploited by a malicious authenticated OBM (Operations Bridge Manager) user to run Java Scripts in the browser context of another OBM user. Please note: The vulnerability is only applicable if the Operations Bridge Manager capability is deployed. A potential vulnerability has been identified in Micro Focus Operations Bridge Manager (OBM). The vulnerability could be exploited by a malicious authenticated OBM user to run Java Scripts in the browser context of another OBM user. This issue affects: Micro Focus Micro Focus Operations Bridge Manager versions prior to 2022.11. Micro Focus Micro Focus Operations Bridge- Containerized versions prior to 2022.11.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Micro Focus
product: Micro Focus Operations Bridge Manager
vendor: Micro Focus
product: Micro Focus Operations Bridge- Containerized
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 8
baseSeverity: HIGH
Credits: lang: en
value: Micro Focus would like to thank Adam Silviu for discovering and reporting the vulnerability.
Published: 2022-12-08T00:00:00.000Z
CVE-2022-38755 Filr Remote unauthenticated user enumeration for versions prior to 4.3.1.1
A vulnerability has been identified in Micro Focus Filr in versions prior to 4.3.1.1. The vulnerability could be exploited to allow a remote unauthenticated attacker to enumerate valid users of the system. Remote unauthenticated user enumeration. This issue affects: Micro Focus Filr versions prior to 4.3.1.1.
Problem types: description: Remote unauthenticated user enumeration
Affected products: vendor: Micro Focus
product: Micro Focus Filr 
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
Credits: lang: en
value: Micro Focus would like to thank Christopher Haller and Matthew Sparrow from Centripetal for their work discovering and reporting this vulnerability.
Published: 2022-11-21T00:00:00.000Z
CVE-2022-38756 CVE-2022-38756 vulnerability in GW Web prior to 18.4.2
A vulnerability has been identified in Micro Focus GroupWise Web in versions prior to 18.4.2. The GW Web component makes a request to the Post Office Agent that contains sensitive information in the query parameters that could be logged by any intervening HTTP proxies.
Problem types: description: A vulnerability has been identified in Micro Focus GroupWise Web in versions prior to 18.4.2. The GW Web component makes a request to the Post Office Agent that contains sensitive information in the query parameters that could be logged by any intervening HTTP proxies.
Affected products: vendor: Micro Focus
product: Micro Focus GroupWise Web
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
Credits: lang: en
value:  Micro Focus would like to thank Stefan Pietsch from Trovent Security GmbH for their work discovering and reporting this vulnerability.
Published: 2022-12-16T00:00:00.000Z
CVE-2022-38757 CVE-2022-38757 ZENworks
A vulnerability has been identified in Micro Focus ZENworks 2020 Update 3a and prior versions. This vulnerability allows administrators with rights to perform actions (e.g., install a bundle) on a set of managed devices, to be able to exercise these rights on managed devices in the ZENworks zone but which are outside the scope of the administrator. This vulnerability does not result in the administrators gaining additional rights on the managed devices, either in the scope or outside the scope of the administrator.
Problem types: cwe_id: CWE-269
description: CWE-269 Improper Privilege Management
Affected products: vendor: Micro Focus
product: ZENworks Configuration Management (ZCM)
vendor: Micro Focus
product: ZENworks Asset Management
vendor: Micro Focus
product: ZENworks Endpoint Security Management (ZESM)
vendor: Micro Focus
product: ZENworks Patch Management (ZPM)
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 7.2
baseSeverity: HIGH
Published: 2022-12-23T00:00:00.000Z
CVE-2022-38758 XSS vulnerabilities in iManager
Cross-site Scripting (XSS) vulnerability in NetIQ iManager prior to version 3.2.6 allows attacker to execute malicious scripts on the user's browser. This issue affects: Micro Focus NetIQ iManager NetIQ iManager versions prior to 3.2.6 on ALL.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Micro Focus
product: NetIQ iManager
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:L
attackVector: ADJACENT_NETWORK
attackComplexity: HIGH
privilegesRequired: HIGH
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: LOW
baseScore: 7.2
baseSeverity: HIGH
Credits: lang: en
value: Special thanks to Kajetan Rostojek for responsibly disclosing this information to us.
Published: 2023-01-25T00:00:00.000Z
CVE-2022-38764 
A vulnerability on Trend Micro HouseCall version 1.62.1.1133 and below could allow a local attacker to escalate privlieges due to an overly permissive folder om the product installer.
Problem types: description: Incorrect Permissions Assignment
Affected products: vendor: Trend Micro
product: Trend Micro HouseCall (Consumer)
Published: 2022-09-19T18:01:00.000Z
CVE-2022-38765 
Canon Medical Informatics Vitrea Vision 7.7.76.1 does not adequately enforce access controls. An authenticated user is able to gain unauthorized access to imaging records by tampering with the vitrea-view/studies/search patientId parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-08T00:00:00.000Z
CVE-2022-38766 
The remote keyless system on Renault ZOE 2021 vehicles sends 433.92 MHz RF signals from the same Rolling Codes set for each door-open request, which allows for a replay attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-01-03T00:00:00.000Z
CVE-2022-38767 
An issue was discovered in Wind River VxWorks 6.9 and 7, that allows a specifically crafted packet sent by a Radius server, may cause Denial of Service during the IP Radius access procedure.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-25T00:00:00.000Z
CVE-2022-38768 
The mobile application in Transtek Mojodat FAM (Fixed Asset Management) 2.4.6 allows remote attackers to bypass authorization.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-13T22:11:58.000Z
CVE-2022-38769 
The mobile application in Transtek Mojodat FAM (Fixed Asset Management) 2.4.6 allows remote attackers to fetch cleartext passwords upon a successful login request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-13T22:12:06.000Z
CVE-2022-38770 
The mobile application in Transtek Mojodat FAM (Fixed Asset Management) 2.4.6 allows remote attackers to fetch other users' data upon a successful login request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-13T22:12:11.000Z
CVE-2022-38771 
The mobile application in Transtek Mojodat FAM (Fixed Asset Management) 2.4.6 allows remote attackers to send SCRIPT tags as injected input to the API request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-13T22:12:18.000Z
CVE-2022-38772 
Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, and OpUtils before 125658, 126003, 126105, and 126120 allow authenticated users to make database changes that lead to remote code execution in the NMAP feature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-29T20:21:57.000Z
CVE-2022-38774 
An issue was discovered in the quarantine feature of Elastic Endpoint Security and Elastic Endgame for Windows, which could allow unprivileged users to elevate their privileges to those of the LocalSystem account.
Problem types: cwe_id: CWE-269
description: CWE-269
Affected products: vendor: Elastic
product: Elastic Endpoint Security and Elastic Endgame Security
Published: 2023-01-24T00:00:00.000Z
CVE-2022-38775 
An issue was discovered in the rollback feature of Elastic Endpoint Security for Windows, which could allow unprivileged users to elevate their privileges to those of the LocalSystem account.
Problem types: cwe_id: CWE-269
description: CWE-269
Affected products: vendor: Elastic
product: Elastic Endpoint Security
Published: 2023-01-24T00:00:00.000Z
CVE-2022-38777 
An issue was discovered in the rollback feature of Elastic Endpoint Security for Windows, which could allow unprivileged users to elevate their privileges to those of the LocalSystem account.
Problem types: cwe_id: CWE-269
description: CWE-269
Affected products: vendor: Elastic
product: Elastic Endpoint Security
Published: 2023-02-08T00:00:00.000Z
CVE-2022-38778 
A flaw (CVE-2022-38900) was discovered in one of Kibana’s third party dependencies, that could allow an authenticated user to perform a request that crashes the Kibana server process.
Problem types: cwe_id: CWE-20
description: CWE-20
Affected products: vendor: Elastic
product: kibana
Published: 2023-02-08T00:00:00.000Z
CVE-2022-38779 
An open redirect issue was discovered in Kibana that could lead to a user being redirected to an arbitrary website if they use a maliciously crafted Kibana URL.
Problem types: cwe_id: CWE-601
description: CWE-601
Affected products: vendor: Elastic
product: kibana
Published: 2023-02-21T00:00:00.000Z
CVE-2022-38784 
Poppler prior to and including 22.08.0 contains an integer overflow in the JBIG2 decoder (JBIG2Stream::readTextRegionSeg() in JBIGStream.cc). Processing a specially crafted PDF file or JBIG2 image could lead to a crash or the execution of arbitrary code. This is similar to the vulnerability described by CVE-2022-38171 in Xpdf.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-30T02:58:33.566Z
CVE-2022-38786 
Improper access control in some Intel Battery Life Diagnostic Tool software before version 2.2.1 may allow an authenticated user to potentially enable escalation of privilege via local access.
Problem types: description: escalation of privilege
cwe_id: CWE-284
description: Improper access control
Affected products: vendor: n/a
product: Intel Battery Life Diagnostic Tool software
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 6.7
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
Published: 2023-11-14T19:05:04.006Z
CVE-2022-38787 
Improper input validation in firmware for some Intel(R) FPGA products before version 2.7.0 Hotfix may allow an authenticated user to potentially enable escalation of privilege via local access.
Problem types: description: escalation of privilege
cwe_id: CWE-20
description: Improper input validation
Affected products: vendor: n/a
product: Intel(R) FPGA products
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 5.7
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: NONE
Published: 2023-05-10T13:17:02.449Z
CVE-2022-38788 
An issue was discovered in Nokia FastMile 5G Receiver 5G14-B 1.2104.00.0281. Bluetooth on the Nokia ODU uses outdated pairing mechanisms, allowing an attacker to passively intercept a paring handshake and (after offline cracking) retrieve the PIN and LTK (long-term key).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-15T11:58:50.000Z
CVE-2022-38789 
An issue was discovered in Airties Smart Wi-Fi before 2020-08-04. It allows attackers to change the main/guest SSID and the PSK to arbitrary values, and map the LAN, because of Insecure Direct Object Reference.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-15T11:56:10.000Z
CVE-2022-38790 
Weave GitOps Enterprise before 0.9.0-rc.5 has a cross-site scripting (XSS) bug allowing a malicious user to inject a javascript: link in the UI. When clicked by a victim user, the script will execute with the victim's permission. The exposure appears in Weave GitOps Enterprise UI via a GitopsCluster dashboard link. An annotation can be added to a GitopsCluster custom resource.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-01T12:55:42.000Z