rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-29686 
CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/singer/admin/lists/zhuan.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-26T13:27:46.000Z
CVE-2022-29687 
CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/user/level_del.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-26T13:27:47.000Z
CVE-2022-29688 
CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/singer/admin/singer/hy.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-26T13:27:48.000Z
CVE-2022-29689 
CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/singer/admin/singer/del.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-26T13:27:49.000Z
CVE-2022-29692 
Unicorn Engine v1.0.3 was discovered to contain a use-after-free vulnerability via the hook function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-27T19:07:44.000Z
CVE-2022-29693 
Unicorn Engine v2.0.0-rc7 and below was discovered to contain a memory leak via the function uc_close at /my/unicorn/uc.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-27T19:07:45.000Z
CVE-2022-29694 
Unicorn Engine v2.0.0-rc7 and below was discovered to contain a NULL pointer dereference via qemu_ram_free.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-27T19:07:46.000Z
CVE-2022-29695 
Unicorn Engine v2.0.0-rc7 contains memory leaks caused by an incomplete unicorn engine initialization.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-27T19:07:46.000Z
CVE-2022-29700 
A lack of password length restriction in Zammad v5.1.0 allows for the creation of extremely long passwords which can cause a Denial of Service (DoS) during password verification.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-27T02:47:13.000Z
CVE-2022-29701 
A lack of rate limiting in the 'forgot password' feature of Zammad v5.1.0 allows attackers to send an excessive amount of reset requests for a legitimate user, leading to a possible Denial of Service (DoS) via a large amount of generated e-mail messages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-27T02:47:11.000Z
CVE-2022-29704 
BrowsBox CMS v4.0 was discovered to contain a SQL injection vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-02T16:04:46.000Z
CVE-2022-29709 
CommuniLink Internet Limited CLink Office v2.0 was discovered to contain multiple SQL injection vulnerabilities via the username and password parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-25T11:32:20.000Z
CVE-2022-29710 
A cross-site scripting (XSS) vulnerability in uploadConfirm.php of LimeSurvey v5.3.9 and below allows attackers to execute arbitrary web scripts or HTML via a crafted plugin.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-24T23:56:15.000Z
CVE-2022-29711 
LibreNMS v22.3.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /Table/GraylogController.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-31T13:14:49.000Z
CVE-2022-29712 
LibreNMS v22.3.0 was discovered to contain multiple command injection vulnerabilities via the service_ip, hostname, and service_param parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-31T13:14:52.000Z
CVE-2022-29718 
Caddy v2.4 was discovered to contain an open redirect vulnerability. A remote unauthenticated attacker may exploit this vulnerability to redirect users to arbitrary web URLs by tricking the victim users to click on crafted links.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-02T00:00:00.000Z
CVE-2022-29720 
74cmsSE v3.5.1 was discovered to contain an arbitrary file read vulnerability via the component \index\controller\Download.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-26T12:55:03.000Z
CVE-2022-29721 
74cmsSE v3.5.1 was discovered to contain a SQL injection vulnerability via the keyword parameter at /home/jobfairol/resumelist.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-26T12:55:08.000Z
CVE-2022-29725 
An arbitrary file upload in the image upload component of wityCMS v0.6.2 allows attackers to execute arbitrary code via a crafted PHP file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-31T13:31:32.000Z
CVE-2022-29727 
Survey Sparrow Enterprise Survey Software 2022 has a Stored cross-site scripting (XSS) vulnerability in the Signup parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-11T12:57:58.000Z
CVE-2022-29728 
Survey Sparrow Enterprise Survey Software 2022 has a Reflected cross-site scripting (XSS) vulnerability in the test parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-11T12:59:32.000Z
CVE-2022-29729 
Verizon 4G LTE Network Extender GA4.38 - V0.4.038.2131 utilizes a weak default admin password generation algorithm which generates passwords that are accessible to unauthenticated attackers via the webUI login page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-27T12:56:14.000Z
CVE-2022-29730 
USR IOT 4G LTE Industrial Cellular VPN Router v1.0.36 was discovered to contain hard-coded credentials for its highest privileged account. The credentials cannot be altered through normal operation of the device.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-27T12:56:14.000Z
CVE-2022-29731 
An access control issue in ICT Protege GX/WX 2.08 allows attackers to leak SHA1 password hashes of other users.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-27T12:56:15.000Z
CVE-2022-29732 
Delta Controls enteliTOUCH 3.40.3935, 3.40.3706, and 3.33.4005 was discovered to contain a cross-site scripting (XSS) vulnerability via the Username parameter. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-27T12:56:16.000Z
CVE-2022-29733 
Delta Controls enteliTOUCH 3.40.3935, 3.40.3706, and 3.33.4005 was discovered to transmit and store sensitive information in cleartext. This vulnerability allows attackers to intercept HTTP Cookie authentication credentials via a man-in-the-middle attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-27T12:56:17.000Z
CVE-2022-29734 
A cross-site scripting (XSS) vulnerability in ICT Protege GX/WX v2.08 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-27T12:56:18.000Z
CVE-2022-29735 
Delta Controls enteliTOUCH 3.40.3935, 3.40.3706, and 3.33.4005 allows attackers to execute arbitrary commands via a crafted HTTP request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-27T12:56:19.000Z
CVE-2022-29738 
Money Transfer Management System 1.0 is vulnerable to SQL Injection via /mtms/admin/?page=transaction/send&id=, id.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-12T15:35:41.000Z
CVE-2022-29739 
Money Transfer Management System 1.0 is vulnerable to SQL Injection via /mtms/admin/?page=user/manage_user&id=.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-12T15:34:26.000Z
CVE-2022-29741 
Money Transfer Management System 1.0 is vulnerable to SQL Injection via \mtms\classes\Master.php?f=delete_fee.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-12T15:32:04.000Z
CVE-2022-29745 
Money Transfer Management System 1.0 is vulnerable to SQL Injection via \mtms\classes\Master.php?f=delete_transaction.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-12T15:27:34.000Z
CVE-2022-29746 
Money Transfer Management System 1.0 is vulnerable to SQL Injection via /mtms/classes/Users.php?f=delete.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-12T15:26:28.000Z
CVE-2022-29747 
Simple Client Management System 1.0 is vulnerable to SQL Injection via /cms/admin/?page=invoice/manage_invoice&id= // Leak place ---> id.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-12T14:36:52.000Z
CVE-2022-29748 
Simple Client Management System 1.0 is vulnerable to SQL Injection via \cms\admin?page=client/manage_client&id=.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-12T14:34:59.000Z
CVE-2022-29749 
Simple Client Management System 1.0 is vulnerable to SQL Injection via /cms/classes/Master.php?f=delete_invoice.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-12T14:33:17.000Z
CVE-2022-29750 
Simple Client Management System 1.0 is vulnerable to SQL Injection via /cms/classes/Master.php?f=delete_service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-12T14:31:52.000Z
CVE-2022-29751 
Simple Client Management System 1.0 is vulnerable to SQL Injection via /cms/classes/Master.php?f=delete_client.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-12T14:30:16.000Z
CVE-2022-29767 
adbyby v2.7 allows external users to make connections via port 8118. This can cause a program logic error and lead to a Denial of Service (DoS) via high CPU usage due to a large number of connections.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-03T00:43:54.000Z
CVE-2022-29770 
XXL-Job v2.3.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via /xxl-job-admin/jobinfo.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-03T20:03:59.000Z
CVE-2022-29773 
An access control issue in aleksis/core/util/auth_helpers.py: ClientProtectedResourceMixin of AlekSIS-Core v2.8.1 and below allows attackers to access arbitrary scopes if no allowed scopes are specifically set.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-03T20:11:07.000Z
CVE-2022-29774 
iSpy v7.2.2.0 is vulnerable to remote command execution via path traversal.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-21T14:00:19.000Z
CVE-2022-29775 
iSpyConnect iSpy v7.2.2.0 allows attackers to bypass authentication via a crafted URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-21T13:59:16.000Z
CVE-2022-29776 
Onlyoffice Document Server v6.0.0 and below and Core 6.1.0.26 and below were discovered to contain a stack overflow via the component DesktopEditor/common/File.cpp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-01T12:51:10.000Z
CVE-2022-29777 
Onlyoffice Document Server v6.0.0 and below and Core 6.1.0.26 and below were discovered to contain a heap overflow via the component DesktopEditor/fontengine/fontconverter/FontFileBase.h.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-01T12:51:11.000Z
CVE-2022-29778 
D-Link DIR-890L 1.20b01 allows attackers to execute arbitrary code due to the hardcoded option Wake-On-Lan for the parameter 'descriptor' at SetVirtualServerSettings.php
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-03T20:19:24.000Z
CVE-2022-29779 
Nginx NJS v0.7.2 was discovered to contain a segmentation violation in the function njs_value_own_enumerate at src/njs_value.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-27T13:13:47.000Z
CVE-2022-29780 
Nginx NJS v0.7.2 was discovered to contain a segmentation violation in the function njs_array_prototype_sort at src/njs_array.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-27T13:13:48.000Z
CVE-2022-29784 
PublicCMS V4.0.202204.a and below contains an information leak via the component /views/directive/sys/SysConfigDataDirective.java.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-03T20:27:07.000Z
CVE-2022-29788 
libmobi before v0.10 contains a NULL pointer dereference via the component mobi_buffer_getpointer. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted mobi file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-02T13:02:58.000Z
CVE-2022-29789 
The HiAIserver has a vulnerability in verifying the validity of the properties used in the model.Successful exploitation of this vulnerability will affect AI services.
Problem types: description: Unstrict verification vulnerability
Affected products: vendor: Huawei
product: HarmonyOS
vendor: Huawei
product: EMUI
Published: 2022-05-13T15:03:59.000Z
CVE-2022-29790 
The graphics acceleration service has a vulnerability in multi-thread access to the database.Successful exploitation of this vulnerability may cause service exceptions.
Problem types: description: Multi-threaded access to the database vulnerability
Affected products: vendor: Huawei
product: HarmonyOS
vendor: Huawei
product: EMUI
Published: 2022-05-13T15:04:14.000Z
CVE-2022-29791 
The HiAIserver has a vulnerability in verifying the validity of the weight used in the model.Successful exploitation of this vulnerability will affect AI services.
Problem types: description: Unstrict verification vulnerability
Affected products: vendor: Huawei
product: HarmonyOS
vendor: Huawei
product: EMUI
Published: 2022-05-13T15:04:30.000Z
CVE-2022-29792 
The chip component has a vulnerability of disclosing CPU SNs.Successful exploitation of this vulnerability may affect data confidentiality.
Problem types: description: Serial number obtaining vulnerability
Affected products: vendor: Huawei
product: HarmonyOS
vendor: Huawei
product: EMUI
Published: 2022-05-13T15:04:46.000Z
CVE-2022-29793 
There is a configuration defect in the activation lock of mobile phones.Successful exploitation of this vulnerability may affect application availability.
Problem types: description: Configuration defect vulnerability
Affected products: vendor: n/a
product: HarmonyOS;EMUI;Magic UI
Published: 2022-05-13T15:05:15.000Z
CVE-2022-29794 
The frame scheduling module has a Use After Free (UAF) vulnerability.Successful exploitation of this vulnerability will affect data integrity, availability, and confidentiality.
Problem types: description: UAF vulnerability
Affected products: vendor: Huawei
product: HarmonyOS
vendor: Huawei
product: EMUI
Published: 2022-05-13T15:05:27.000Z
CVE-2022-29795 
The frame scheduling module has a null pointer dereference vulnerability. Successful exploitation of this vulnerability will affect the kernel availability.
Problem types: description: Null pointer dereference vulnerability
Affected products: vendor: Huawei
product: HarmonyOS
vendor: Huawei
product: EMUI
Published: 2022-05-13T15:05:43.000Z
CVE-2022-29796 
The HiAIserver has a vulnerability in verifying the validity of the weight used in the model.Successful exploitation of this vulnerability will affect AI services.
Problem types: description: Unstrict verification vulnerability
Affected products: vendor: Huawei
product: HarmonyOS
vendor: Huawei
product: EMUI
Published: 2022-05-13T15:05:59.000Z
CVE-2022-29797 
There is a buffer overflow vulnerability in CV81-WDM FW 01.70.49.29.46. Successful exploitation of this vulnerability may lead to privilege escalation.
Problem types: description: Buffer Overflow
Affected products: vendor: n/a
product: CV81-WDM FW
Published: 2022-06-13T18:55:10.000Z
CVE-2022-29798 
There is a denial of service vulnerability in CV81-WDM FW versions 01.70.49.29.46. Successful exploitation could cause denial of service.
Problem types: description: Denial of Service
Affected products: vendor: n/a
product: CV81-WDM FW
Published: 2022-06-13T18:55:03.000Z
CVE-2022-29799 
A vulnerability was found in networkd-dispatcher. This flaw exists because no functions are sanitized by the OperationalState or the AdministrativeState of networkd-dispatcher. This attack leads to a directory traversal to escape from the “/etc/networkd-dispatcher” base directory.
Problem types: cwe_id: CWE-22
description: CWE-22
Affected products: vendor: n/a
product: networkd-dispatcher
Published: 2022-09-21T18:21:10.000Z
CVE-2022-29800 
A time-of-check-time-of-use (TOCTOU) race condition vulnerability was found in networkd-dispatcher. This flaw exists because there is a certain time between the scripts being discovered and them being run. An attacker can abuse this vulnerability to replace scripts that networkd-dispatcher believes to be owned by root with ones that are not.
Problem types: cwe_id: CWE-367
description: CWE-367
Affected products: vendor: n/a
product: networkd-dispatcher
Published: 2022-09-21T18:21:17.000Z
CVE-2022-29801 
A vulnerability has been identified in Teamcenter V12.4 (All versions < V12.4.0.13), Teamcenter V13.0 (All versions < V13.0.0.9). The application contains a XML External Entity Injection (XXE) vulnerability. This could allow an attacker to view files on the application server filesystem.
Problem types: cwe_id: CWE-611
description: CWE-611: Improper Restriction of XML External Entity Reference
Affected products: vendor: Siemens
product: Teamcenter V12.4
vendor: Siemens
product: Teamcenter V13.0
Published: 2022-05-10T09:47:13.000Z
CVE-2022-29804 Path traversal via Clean on Windows in path/filepath
Incorrect conversion of certain invalid paths to valid, absolute paths in Clean in path/filepath before Go 1.17.11 and Go 1.18.3 on Windows allows potential directory traversal attack.
Problem types: description: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Go standard library
product: path/filepath
default_status: unaffected
Credits: lang: en
value: Unrud
Published: 2022-08-09T00:00:00.000Z
CVE-2022-29805 
A Java Deserialization vulnerability in the Fishbowl Server in Fishbowl Inventory before 2022.4.1 allows remote attackers to execute arbitrary code via a crafted XML payload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-19T11:40:49.000Z
CVE-2022-29806 
ZoneMinder before 1.36.13 allows remote code execution via an invalid language. Ability to create a debug log file at an arbitrary pathname contributes to exploitability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-26T03:15:08.000Z
CVE-2022-29807 
A SQL injection vulnerability exists within Quest KACE Systems Management Appliance (SMA) through 12.0 that can allow for remote code execution via download_agent_installer.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-02T21:42:14.000Z
CVE-2022-29808 
In Quest KACE Systems Management Appliance (SMA) through 12.0, predictable token generation occurs when appliance linking is enabled.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-02T21:35:42.000Z
CVE-2022-29810 
The Hashicorp go-getter library before 1.5.11 does not redact an SSH key from a URL query parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-27T05:50:30.000Z
CVE-2022-29811 
In JetBrains Hub before 2022.1.14638 stored XSS via project icon was possible.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: JetBrains
product: Hub
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N
version: 3.1
Credits: lang: en
value: Julian Muñoz
Published: 2022-04-28T09:55:17.000Z
CVE-2022-29812 
In JetBrains IntelliJ IDEA before 2022.1 notification mechanisms about using Unicode directionality formatting characters were insufficient
Problem types: cwe_id: CWE-176
description: CWE-176: Improper Handling of Unicode Encoding
Affected products: vendor: JetBrains
product: IntelliJ IDEA
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 2.3
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: HIGH
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:N/I:L/A:N
version: 3.1
Published: 2022-04-28T09:55:19.000Z
CVE-2022-29813 
In JetBrains IntelliJ IDEA before 2022.1 local code execution via custom Pandoc path was possible
Problem types: cwe_id: CWE-94
description: CWE-94: Improper Control of Generation of Code ('Code Injection')
Affected products: vendor: JetBrains
product: IntelliJ IDEA
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 6.9
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:N
version: 3.1
Published: 2022-04-28T09:55:20.000Z
CVE-2022-29814 
In JetBrains IntelliJ IDEA before 2022.1 local code execution via HTML descriptions in custom JSON schemas was possible
Problem types: cwe_id: CWE-94
description: CWE-94: Improper Control of Generation of Code ('Code Injection')
Affected products: vendor: JetBrains
product: IntelliJ IDEA
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 6.9
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:N
version: 3.1
Published: 2022-04-28T09:55:21.000Z
CVE-2022-29815 
In JetBrains IntelliJ IDEA before 2022.1 local code execution via workspace settings was possible
Problem types: cwe_id: CWE-94
description: CWE-94: Improper Control of Generation of Code ('Code Injection')
Affected products: vendor: JetBrains
product: IntelliJ IDEA
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 6.9
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:N
version: 3.1
Published: 2022-04-28T09:55:23.000Z
CVE-2022-29816 
In JetBrains IntelliJ IDEA before 2022.1 HTML injection into IDE messages was possible
Problem types: cwe_id: CWE-74
description: CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Affected products: vendor: JetBrains
product: IntelliJ IDEA
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 2.8
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
version: 3.1
Published: 2022-04-28T09:55:24.000Z