Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-27540 State: PUBLISHED Published: 2024-06-28T19:00:28.307Z Last Updated: 2024-08-22T14:52:53.925Z Vendors: HP Inc. Products: HP PC BIOS Description: A potential Time-of-Check to Time-of Use (TOCTOU) vulnerability has been identified in the HP BIOS for certain HP PC products, which might allow arbitrary code execution, denial of service, and information disclosure. HP is releasing BIOS updates to mitigate the potential vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.hp.com/us-en/document/ish_10810714-10810745-16/hpsbhf03948
CVE ID: CVE-2022-27541 State: PUBLISHED Published: 2023-06-12T18:59:18.253Z Last Updated: 2025-01-03T21:01:56.944Z Vendors: HP Inc. Products: HP PC BIOS Description: Potential Time-of-Check to Time-of Use (TOCTOU) vulnerabilities have been identified in the HP BIOS for certain HP PC products which may allow arbitrary code execution, denial of service, and information disclosure. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.hp.com/us-en/document/ish_7709808-7709835-16/hpsbhf03835
CVE ID: CVE-2022-27544 State: PUBLISHED Published: 2022-07-19T15:40:13.044865Z Last Updated: 2024-09-16T23:36:54.027Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N) Vendors: HCL Software Products: HCL BigFix Problem Types: CWE-522 Description: BigFix Web Reports authorized users may see SMTP credentials in clear text. Additional Analyst Notes: - CVE Program Container: References: - https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0098998
CVE ID: CVE-2022-27545 State: PUBLISHED Published: 2022-07-19T15:40:18.074456Z Last Updated: 2024-09-16T17:03:59.379Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: HCL Software Products: HCL BigFix Problem Types: CWE-79 Description: BigFix Web Reports authorized users may perform HTML injection for the email administrative configuration page. Additional Analyst Notes: - CVE Program Container: References: - https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0098998
CVE ID: CVE-2022-27546 State: PUBLISHED Published: 2022-08-29T16:00:24.786067Z Last Updated: 2024-09-17T03:39:06.738Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L) Vendors: HCL Software Products: HCL iNotes Problem Types: CWE-79 Description: HCL iNotes is susceptible to a Reflected Cross-site Scripting (XSS) vulnerability caused by improper validation of user-supplied input supplied with a form POST request. A remote attacker could exploit this vulnerability using a specially-crafted URL to execute script in a victim's web browser within the security context of the hosting web site and/or steal the victim's cookie-based authentication credentials. Additional Analyst
y context of the hosting web site and/or steal the victim's cookie-based authentication credentials. Additional Analyst Notes: - CVE Program Container: References: - https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0100216
CVE ID: CVE-2022-27547 State: PUBLISHED Published: 2022-08-29T16:00:28.303270Z Last Updated: 2024-09-17T02:01:17.904Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N) Vendors: HCL Software Products: HCL iNotes Problem Types: CWE-601 Description: HCL iNotes is susceptible to a link to non-existent domain vulnerability. An attacker could use this vulnerability to trick a user into supplying sensitive information such as username, password, credit card number, etc. Additional Analyst Notes: - CVE Program Container: References: - https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0100212
CVE ID: CVE-2022-27548 State: PUBLISHED Published: 2022-07-06T20:25:13.132112Z Last Updated: 2024-09-16T18:12:59.889Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: HCL Software Products: HCL Launch Problem Types: CWE-256 Description: HCL Launch stores user credentials in plain clear text which can be read by a local user. Additional Analyst Notes: - CVE Program Container: References: - https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0099253
CVE ID: CVE-2022-27549 State: PUBLISHED Published: 2022-07-06T20:25:14.576797Z Last Updated: 2024-09-16T20:42:45.568Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: HCL Software Products: HCL Launch Problem Types: CWE-532 Description: HCL Launch may store certain data for recurring activities in a plain text format. Additional Analyst Notes: - CVE Program Container: References: - https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0099254
CVE ID: CVE-2022-27551 State: PUBLISHED Published: 2022-08-03T20:00:18.409352Z Last Updated: 2024-09-16T23:31:39.488Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: HCL Software Products: HCL Launch Problem Types: CWE-863 Description: HCL Launch could allow an authenticated user to obtain sensitive information in some instances due to improper security checking. Additional Analyst Notes: - CVE Program Container: References: - https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0099732
CVE ID: CVE-2022-27558 State: PUBLISHED Published: 2022-08-29T16:00:31.939445Z Last Updated: 2024-09-17T01:12:04.670Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: HCL Software Products: HCL iNotes Problem Types: CWE-521 Description: HCL iNotes is susceptible to a Broken Password Strength Checks vulnerability. Custom password policies are not enforced on certain iNotes forms which could allow users to set weak passwords, leading to easier cracking. Additional Analyst Notes: - CVE Program Container: References: - https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0100217
CVE ID: CVE-2022-27560 State: PUBLISHED Published: 2022-08-30T21:25:11.364873Z Last Updated: 2024-09-16T17:27:45.221Z Severity: MEDIUM (CVSS 6 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:H) Vendors: HCL Software Products: HCL VersionVault Express Problem Types: CWE-522 Description: HCL VersionVault Express exposes administrator credentials. Additional Analyst Notes: - CVE Program Container: References: - https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0100150
CVE ID: CVE-2022-27561 State: PUBLISHED Published: 2022-09-15T21:50:16.252030Z Last Updated: 2024-09-16T20:32:02.245Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: HCL Software Products: HCL Traveler Problem Types: CWE-79 Description: There is a reflected Cross-Site Scripting vulnerability in the HCL Traveler web admin (LotusTraveler.nsf). Additional Analyst Notes: - CVE Program Container: References: - https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0100435
CVE ID: CVE-2022-27562 State: PUBLISHED Published: 2025-04-30T20:54:20.782Z Last Updated: 2025-05-01T15:35:17.435Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: HCL Software Products: HCL Domino Volt Problem Types: CWE-434 Description: Unsafe default file type filter policy in HCL Domino Volt allows upload of .html file and execution of unsafe JavaScript in deployed applications. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0120722
CVE ID: CVE-2022-27563 State: PUBLISHED Published: 2022-08-30T21:25:12.351144Z Last Updated: 2024-09-16T16:48:58.039Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: HCL Software Products: HCL VersionVault Express Problem Types: CWE-754 Description: An unauthenticated user can overload a part of HCL VersionVault Express and cause a denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0100274
CVE ID: CVE-2022-27567 State: PUBLISHED Published: 2022-04-11T19:37:09 Last Updated: 2024-08-03T05:32:59.248Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Samsung Mobile Products: Samsung Mobile Devices Problem Types: CWE-476 Description: Null pointer dereference vulnerability in parser_hvcC function of libsimba library prior to SMR Apr-2022 Release 1 allows out of bounds write by remote attackers. Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=4
CVE ID: CVE-2022-27568 State: PUBLISHED Published: 2022-04-11T19:37:10 Last Updated: 2024-08-03T05:32:59.904Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Samsung Mobile Products: Samsung Mobile Devices Problem Types: CWE-122 Description: Heap-based buffer overflow vulnerability in parser_iloc function in libsimba library prior to SMR Apr-2022 Release 1 allows code execution by remote attacker. Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=4
CVE ID: CVE-2022-27569 State: PUBLISHED Published: 2022-04-11T19:37:10 Last Updated: 2024-08-03T05:32:59.309Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Samsung Mobile Products: Samsung Mobile Devices Problem Types: CWE-122 Description: Heap-based buffer overflow vulnerability in parser_infe function in libsimba library prior to SMR Apr-2022 Release 1 allows code execution by remote attacker. Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=4
CVE ID: CVE-2022-27570 State: PUBLISHED Published: 2022-04-11T19:37:11 Last Updated: 2024-08-03T05:32:59.198Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Samsung Mobile Products: Samsung Mobile Devices Problem Types: CWE-122 Description: Heap-based buffer overflow vulnerability in parser_single_iref function in libsimba library prior to SMR Apr-2022 Release 1 allows code execution by remote attacker. Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=4
CVE ID: CVE-2022-27571 State: PUBLISHED Published: 2022-04-11T19:37:12 Last Updated: 2024-08-03T05:32:59.179Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Samsung Mobile Products: Samsung Mobile Devices Problem Types: CWE-122 Description: Heap-based buffer overflow vulnerability in sheifd_get_info_image function in libsimba library prior to SMR Apr-2022 Release 1 allows code execution by remote attacker. Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=4
CVE ID: CVE-2022-27572 State: PUBLISHED Published: 2022-04-11T19:37:13 Last Updated: 2024-08-03T05:32:59.202Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Samsung Mobile Products: Samsung Mobile Devices Problem Types: CWE-122 Description: Heap-based buffer overflow vulnerability in parser_ipma function of libsimba library prior to SMR Apr-2022 Release 1 allows code execution by remote attackers. Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=4
CVE ID: CVE-2022-27573 State: PUBLISHED Published: 2022-04-11T19:37:14 Last Updated: 2024-08-03T05:32:59.273Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: Samsung Mobile Products: Samsung Mobile Devices Problem Types: CWE-20 Description: Improper input validation vulnerability in parser_infe and sheifd_find_itemIndexin fuctions of libsimba library prior to SMR Apr-2022 Release 1 allows out of bounds write by privileged attackers. Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=4
CVE ID: CVE-2022-27574 State: PUBLISHED Published: 2022-04-11T19:37:14 Last Updated: 2024-08-03T05:32:59.942Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: Samsung Mobile Products: Samsung Mobile Devices Problem Types: CWE-20 Description: Improper input validation vulnerability in parser_iloc and sheifd_find_itemIndexin fuctions of libsimba library prior to SMR Apr-2022 Release 1 allows out of bounds write by privileged attacker. Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=4
CVE ID: CVE-2022-27575 State: PUBLISHED Published: 2022-04-11T19:37:15 Last Updated: 2024-08-03T05:32:58.954Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: Samsung Mobile Products: Samsung Mobile Devices Problem Types: CWE-200 Description: Information exposure vulnerability in One UI Home prior to SMR April-2022 Release 1 allows to access currently launched foreground app information without permission. Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=4
CVE ID: CVE-2022-27576 State: PUBLISHED Published: 2022-04-11T19:37:16 Last Updated: 2024-08-03T05:32:59.190Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: Samsung Mobile Products: Samsung Mobile Devices Problem Types: CWE-200 Description: Information exposure vulnerability in Samsung DeX Home prior to SMR April-2022 Release 1 allows to access currently launched foreground app information without permission Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=4
CVE ID: CVE-2022-27577 State: PUBLISHED Published: 2022-04-11T19:37:47 Last Updated: 2024-08-03T05:32:59.251Z Vendors: n/a Products: SICK MSC800 Problem Types: CWE-342 Description: The vulnerability in the MSC800 in all versions before 4.15 allows for an attacker to predict the TCP initial sequence number. When the TCP sequence is predictable, an attacker can send packets that are forged to appear to come from a trusted computer. These forged packets could compromise services on the MSC800. SICK has released a new firmware version of the SICK MSC800 and recommends updating to the newest version. Additional Analyst Notes: - CVE Program Container: References: - https://sick.com/psirt
CVE ID: CVE-2022-27578 State: PUBLISHED Published: 2022-04-11T19:37:46 Last Updated: 2024-08-03T05:32:59.859Z Vendors: n/a Products: SICK Overall Equipment Effectiveness Problem Types: CWE-250 Description: An attacker can perform a privilege escalation through the SICK OEE if the application is installed in a directory where non authenticated or low privilege users can modify its content. Additional Analyst Notes: - CVE Program Container: References: - https://sick.com/psirt
CVE ID: CVE-2022-27579 State: PUBLISHED Published: 2022-07-19T15:52:04 Last Updated: 2024-08-03T05:32:59.224Z Vendors: n/a Products: SICK Flexi Soft Designer Problem Types: CWE-502 Description: A deserialization vulnerability in a .NET framework class used and not properly checked by Flexi Soft Designer in all versions up to and including 1.9.4 SP1 allows an attacker to craft malicious project files. Opening/importing such a malicious project file would execute arbitrary code with the privileges of the current user when opened or imported by the Flexi Soft Designer. This compromises confidentiality integrity and availability. For the attack to succeed a user must manually open a malicious pr
mpromises confidentiality integrity and availability. For the attack to succeed a user must manually open a malicious project file. Additional Analyst Notes: - CVE Program Container: References: - https://sick.com/psirt
CVE ID: CVE-2022-27580 State: PUBLISHED Published: 2022-07-19T15:52:11 Last Updated: 2024-08-03T05:32:59.253Z Vendors: n/a Products: SICK Safety Designer Problem Types: CWE-502 Description: A deserialization vulnerability in a .NET framework class used and not properly checked by Safety Designer all versions up to and including 1.11.0 allows an attacker to craft malicious project files. Opening/importing such a malicious project file would execute arbitrary code with the privileges of the current user when opened or imported by the Safety Designer. This compromises confidentiality integrity and availability. For the attack to succeed a user must manually open a malicious project file. Additi
tiality integrity and availability. For the attack to succeed a user must manually open a malicious project file. Additional Analyst Notes: - CVE Program Container: References: - https://sick.com/psirt
CVE ID: CVE-2022-27581 State: PUBLISHED Published: 2022-12-13T00:00:00.000Z Last Updated: 2025-04-22T15:52:43.462Z Vendors: n/a Products: SICK RFU61x Firmware Problem Types: CWE-327 Description: Use of a Broken or Risky Cryptographic Algorithm in SICK RFU61x firmware version <v2.25 allows a low-privileged remote attacker to decrypt the encrypted data if the user requested weak cipher suites to be used for encryption via the SSH interface. The patch and installation procedure for the firmware update is available from the responsible SICK customer contact person. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://sick.com/psirt
CVE ID: CVE-2022-27582 State: PUBLISHED Published: 2022-11-01T00:00:00.000Z Last Updated: 2025-05-06T14:16:54.441Z Vendors: n/a Products: SICK SIM4000 (PPC) Problem Types: CWE-306 Description: Password recovery vulnerability in SICK SIM4000 (PPC) Partnumber 1078787 allows an unprivileged remote attacker to gain access to the userlevel defined as RecoverableUserLevel by invocating the password recovery mechanism method. This leads to an increase in their privileges on the system and thereby affecting the confidentiality integrity and availability of the system. An attacker can expect repeatable success by exploiting the vulnerability. The firmware versions <=1.10.1 allow to optionally disable
an expect repeatable success by exploiting the vulnerability. The firmware versions <=1.10.1 allow to optionally disable device configuration over the network interfaces. Please make sure that you apply general security practices when operating the SIM4000. A fix is planned but not yet scheduled. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://sick.com/psirt
CVE ID: CVE-2022-27583 State: PUBLISHED Published: 2022-10-31T00:00:00.000Z Last Updated: 2025-05-07T13:30:11.449Z Vendors: n/a Products: SICK FlexiCompact Problem Types: CWE-285 Description: A remote unprivileged attacker can interact with the configuration interface of a Flexi-Compact FLX3-CPUC1 or FLX3-CPUC2 running an affected firmware version to potentially impact the availability of the FlexiCompact. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://sick.com/psirt
CVE ID: CVE-2022-27584 State: PUBLISHED Published: 2022-11-01T00:00:00.000Z Last Updated: 2025-05-06T14:15:30.090Z Vendors: n/a Products: SICK SIM2000ST (PPC) Problem Types: CWE-306 Description: Password recovery vulnerability in SICK SIM2000ST Partnumber 1080579 allows an unprivileged remote attacker to gain access to the userlevel defined as RecoverableUserLevel by invocating the password recovery mechanism method. This leads to an increase in their privileges on the system and thereby affecting the confidentiality integrity and availability of the system. An attacker can expect repeatable success by exploiting the vulnerability. The firmware versions <=1.7.0 allow to optionally disable de
expect repeatable success by exploiting the vulnerability. The firmware versions <=1.7.0 allow to optionally disable device configuration over the network interfaces. Please make sure that you apply general security practices when operating the SIM2000ST. A fix is planned but not yet scheduled. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://sick.com/psirt
CVE ID: CVE-2022-27585 State: PUBLISHED Published: 2022-11-01T00:00:00.000Z Last Updated: 2025-05-02T19:01:48.462Z Vendors: n/a Products: SICK SIM1000 FX Problem Types: CWE-306 Description: Password recovery vulnerability in SICK SIM1000 FX Partnumber 1097816 and 1097817 with firmware version <1.6.0 allows an unprivileged remote attacker to gain access to the userlevel defined as RecoverableUserLevel by invocating the password recovery mechanism method. This leads to an increase in their privileges on the system and thereby affecting the confidentiality integrity and availability of the system. An attacker can expect repeatable success by exploiting the vulnerability. The recommended solutio
bility of the system. An attacker can expect repeatable success by exploiting the vulnerability. The recommended solution is to update the firmware to a version >= 1.6.0 as soon as possible (available in SICK Support Portal). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://sick.com/psirt
CVE ID: CVE-2022-27586 State: PUBLISHED Published: 2022-11-01T00:00:00.000Z Last Updated: 2025-05-06T14:14:18.213Z Vendors: n/a Products: SICK SIM1004 Problem Types: CWE-306 Description: Password recovery vulnerability in SICK SIM1004 Partnumber 1098148 with firmware version <2.0.0 allows an unprivileged remote attacker to gain access to the userlevel defined as RecoverableUserLevel by invocating the password recovery mechanism method. This leads to an increase in their privileges on the system and thereby affecting the confidentiality integrity and availability of the system. An attacker can expect repeatable success by exploiting the vulnerability. The recommended solution is to update the
em. An attacker can expect repeatable success by exploiting the vulnerability. The recommended solution is to update the firmware to a version >= 2.0.0 as soon as possible (available in SICK Support Portal). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://sick.com/psirt
CVE ID: CVE-2022-27588 State: PUBLISHED Published: 2022-05-05T16:50:30.497028Z Last Updated: 2024-09-16T20:21:49.914Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: QNAP Systems Inc. Products: QVR Problem Types: CWE-77 Description: We have already fixed this vulnerability in the following versions of QVR: QVR 5.1.6 build 20220401 and later Additional Analyst Notes: - CVE Program Container: References: - https://www.qnap.com/en/security-advisory/qsa-22-07
CVE ID: CVE-2022-27592 State: PUBLISHED Published: 2024-09-06T16:26:41.790Z Last Updated: 2024-09-06T17:49:51.271Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: QNAP Systems Inc. Products: QVR Smart Client Problem Types: CWE-428 Description: An unquoted search path or element vulnerability has been reported to affect QVR Smart Client. If exploited, the vulnerability could allow local authenticated administrators to execute unauthorized code or commands via unspecified vectors. We have already fixed the vulnerability in the following version: Windows 10 SP1, Windows 11, Mac OS, and Mac M1: QVR Smart Client 2.4.0.0570 and later Additional Analyst Notes: - CI
on: Windows 10 SP1, Windows 11, Mac OS, and Mac M1: QVR Smart Client 2.4.0.0570 and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security-advisory/qsa-24-22
CVE ID: CVE-2022-27593 State: PUBLISHED Published: 2022-09-08T11:00:15.069Z Last Updated: 2025-10-21T23:15:35.935Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H) Vendors: QNAP Systems Inc. Products: Photo Station Problem Types: CWE-610 Description: An externally controlled reference to a resource vulnerability has been reported to affect QNAP NAS running Photo Station. If exploited, This could allow an attacker to modify system files. We have already fixed the vulnerability in the following versions: QTS 5.0.1: Photo Station 6.1.2 and later QTS 5.0.0/4.5.x: Photo Station 6.0.22 and later QTS 4.3.6: Photo Station 5.7.18 and later QTS 4.3.3: Photo Station 5.4.15 and