CVE-2022-22484
published 2022-05-17CVE-2022-22484: IBM Spectrum Protect Operations Center 8.1.12 and 8.1.13 could allow a local attacker to obtain sensitive information, caused by plain text user account…
PriorityP423medium5.5CVSS 3.1
AVLACLPRLUINSUCHINAN
EPSS
0.16%
5.2th percentile
IBM Spectrum Protect Operations Center 8.1.12 and 8.1.13 could allow a local attacker to obtain sensitive information, caused by plain text user account passwords potentially being stored in the browser's application command history. By accessing browser history, an attacker could exploit this vulnerability to obtain other user accounts' passwords. IBM X-Force ID: 226322.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github | cmark-gfm | >= 0 < 0.29.0.gfm.0-4ubuntu0.1~esm1 | 0.29.0.gfm.0-4ubuntu0.1~esm1 |
| github | cmark-gfm | >= 0 < 0.29.0.gfm.3-3ubuntu0.1~esm1 | 0.29.0.gfm.3-3ubuntu0.1~esm1 |
| github | cmark-gfm | >= 0 < 0.29.0.gfm.6-6ubuntu0.24.04.1~esm1 | 0.29.0.gfm.6-6ubuntu0.24.04.1~esm1 |
| ibm | spectrum_protect | >= 8.1.12.000 < 8.1.14 | 8.1.14 |
| ibm | spectrum_protect_operations_center | — | — |
| ibm | spectrum_protect_operations_center | — | — |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
nvdv3.05.1MEDIUMCVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv2.02.1LOWAV:L/AC:L/Au:N/C:P/I:N/A:N
osv6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
cmark-gfm vulnerabilities
osv·2025-03-03·CVSS 6.5
CVE-2022-39209 cmark-gfm vulnerabilities
cmark-gfm vulnerabilities
It was discovered that cmark-gfm's autolink extension did not correctly
handle parsing large inputs. An attacker could possibly use this issue
to cause a denial of service. This issue only affected Ubuntu 20.04 LTS
and Ubuntu 22.04 LTS. (CVE-2022-39209)
It was discovered that cmark-gfm did not correctly handle parsing large
inputs. An attacker could possibly use this issue to cause a denial of
service. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and
Ubuntu 24.10. (CVE-2023-22483)
It was discovered that cmark-gfm did not correctly handle parsing large
inputs. An attacker could possibly use this issue to cause a denial of
service. This issue only affected Ubuntu 24.04 LTS and Ubuntu 24.10.
(CVE-2023-22484)
It was discovered that cmark-gfm did not
GHSA
GHSA-594c-9jx7-c63x: IBM Spectrum Protect Operations Center 8
ghsa_unreviewed·2022-05-18
CVE-2022-22484 [MEDIUM] CWE-312 GHSA-594c-9jx7-c63x: IBM Spectrum Protect Operations Center 8
IBM Spectrum Protect Operations Center 8.1.12 and 8.1.13 could allow a local attacker to obtain sensitive information, caused by plain text user account passwords potentially being stored in the browser's application command history. By accessing browser history, an attacker could exploit this vulnerability to obtain other user accounts' passwords. IBM X-Force ID: 226322.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2022-05-17
Published