Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-3907 State: PUBLISHED Published: 2022-12-05T16:50:39.205Z Last Updated: 2025-04-23T15:02:05.806Z Vendors: Unknown Products: Clerk Problem Types: CWE-203 Observable Discrepancy Description: The Clerk WordPress plugin before 4.0.0 is affected by time-based attacks in the validation function for all API requests due to the usage of comparison operators to verify API keys against the ones stored in the site options. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/7920c1c1-709d-4b1f-ac08-f0a02ddb329c
CVE ID: CVE-2022-3908 State: PUBLISHED Published: 2022-12-12T17:54:33.163Z Last Updated: 2025-04-22T15:39:04.139Z Vendors: Unknown Products: Plug your WooCommerce into the largest catalog of customized print products from Helloprint Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Helloprint WordPress plugin before 1.4.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/c44802a0-8cbe-4386-9523-3b6cb44c6505
CVE ID: CVE-2022-3909 State: PUBLISHED Published: 2022-12-05T16:50:29.823Z Last Updated: 2025-04-24T13:35:45.442Z Vendors: Unknown Products: Add Comments Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Add Comments WordPress plugin through 1.0.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/8d57a534-7630-491a-a0fd-90430f85ae78
CVE ID: CVE-2022-3910 State: PUBLISHED Published: 2022-11-22T12:12:16.700Z Last Updated: 2025-04-21T13:46:13.836Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Linux Products: Linux Kernel Problem Types: CWE-416 Description: Use After Free vulnerability in Linux Kernel allows Privilege Escalation. An improper Update of Reference Count in io_uring leads to Use-After-Free and Local Privilege Escalation. When io_msg_ring was invoked with a fixed file, it called io_fput_file() which improperly decreased its reference count (leading to Use-After-Free and Local Privilege Escalation). Fixed files are permanently registered to the ring, and should not be put separat
-Free and Local Privilege Escalation). Fixed files are permanently registered to the ring, and should not be put separately. We recommend upgrading past commit https://github.com/torvalds/linux/commit/fc7222c3a9f56271fba02aabbfbae999042f1679 https://github.com/torvalds/linux/commit/fc7222c3a9f56271fba02aabbfbae999042f1679 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/torvalds/linux/commit/fc7222c3a9f56271fba02aabbfbae999042f1679 - https://kernel.dance/#fc7222c3a9f56271fba02aabbfbae999042f1679
CVE ID: CVE-2022-3911 State: PUBLISHED Published: 2023-01-02T21:49:36.753Z Last Updated: 2025-04-10T18:34:25.760Z Vendors: Unknown Products: iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more Problem Types: CWE-862 Missing Authorization, CWE-352 Cross-Site Request Forgery (CSRF) Description: The iubenda WordPress plugin before 3.3.3 does does not have authorisation and CSRF in an AJAX action, and does not ensure that the options to be updated belong to the plugin as long as they are arrays. As a result, any authenticated users, such as subscriber can grant themselves any privileges, such as edit_plugins etc Additional Analyst Notes: - CVE Program Container: - CISA ADP Vuln
t themselves any privileges, such as edit_plugins etc Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/c47fdca8-74ac-48a4-9780-556927fb4e52
CVE ID: CVE-2022-3912 State: PUBLISHED Published: 2022-12-12T17:54:35.983Z Last Updated: 2025-04-22T15:33:37.802Z Vendors: Unknown Products: User Registration Problem Types: CWE-434 Unrestricted Upload of File with Dangerous Type Description: The User Registration WordPress plugin before 2.2.4.1 does not properly restrict the files to be uploaded via an AJAX action available to both unauthenticated and authenticated users, which could allow unauthenticated users to upload PHP files for example. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/968c677c-1beb-459b-8fd1-7f70bcaa4f74
CVE ID: CVE-2022-3913 State: PUBLISHED Published: 2023-02-01T21:52:21.959Z Last Updated: 2025-03-26T15:05:18.697Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Rapid7 Products: Nexpose, InsightVM Problem Types: CWE-295 Description: Rapid7 Nexpose and InsightVM versions 6.6.82 through 6.6.177 fail to validate the certificate of the update server when downloading updates. This failure could allow an attacker in a privileged position on the network to provide their own HTTPS endpoint, or intercept communications to the legitimate endpoint. The attacker would need some pre-existing access to at least one node on the network path between the Rapid7-controlled u
he attacker would need some pre-existing access to at least one node on the network path between the Rapid7-controlled update server and the Nexpose/InsightVM application, and the ability to either spoof the update server's FQDN or redirect legitimate traffic to the attacker's server in order to exploit this vulnerability. Note that even in this scenario, an attacker could not normally replace an update package with a malicious package, since the update process validates a separate, code-signing certificate, distinct from the HTTPS certificate used for communication. This issue was resolved on February 1, 2023 in update 6.6.178 of Nexpose and InsightVM. Additional Analyst Notes: - CVE Progra
ssue was resolved on February 1, 2023 in update 6.6.178 of Nexpose and InsightVM. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://docs.rapid7.com/release-notes/nexpose/20230201/ - https://www.rapid7.com/blog/post/2022/12/07/cve-2022-4261-rapid7-nexpose-update-validation-issue-fixed/
CVE ID: CVE-2022-3915 State: PUBLISHED Published: 2022-12-12T17:54:43.952Z Last Updated: 2025-04-22T14:58:27.755Z Vendors: Unknown Products: Dokan Problem Types: CWE-89 SQL Injection Description: The Dokan WordPress plugin before 3.7.6 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/fd416d99-1970-418f-81f5-8438490d4479
CVE ID: CVE-2022-3916 State: PUBLISHED Published: 2023-09-20T14:28:52.089Z Last Updated: 2024-08-03T01:20:58.791Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: Red Hat Products: Red Hat Single Sign-On 7, Red Hat Single Sign-On 7.6.1, Red Hat Single Sign-On 7.6 for RHEL 7, Red Hat Single Sign-On 7.6 for RHEL 8, Red Hat Single Sign-On 7.6 for RHEL 9, RHEL-8 based Middleware Containers Problem Types: CWE-384 Description: A flaw was found in the offline_access scope in Keycloak. This issue would affect users of shared computers more (especially if cookies are not cleared), due to a lack of root session validation, and the reuse of session ids across root and u
ly if cookies are not cleared), due to a lack of root session validation, and the reuse of session ids across root and user authentication sessions. This enables an attacker to resolve a user session attached to a previously authenticated user; when utilizing the refresh token, they will be issued a token for the original user. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2022:8961 - https://access.redhat.com/errata/RHSA-2022:8962 - https://access.redhat.com/errata/RHSA-2022:8963 - https://access.redhat.com/errata/RHSA-2022:8964 - https://access.redhat.com/errata/RHSA-2022:8965 - https://access.redhat.com/erra
cess.redhat.com/errata/RHSA-2022:8964 - https://access.redhat.com/errata/RHSA-2022:8965 - https://access.redhat.com/errata/RHSA-2023:1043 - https://access.redhat.com/errata/RHSA-2023:1044 - https://access.redhat.com/errata/RHSA-2023:1045 - https://access.redhat.com/errata/RHSA-2023:1047 - https://access.redhat.com/errata/RHSA-2023:1049 - https://access.redhat.com/security/cve/CVE-2022-3916 - https://bugzilla.redhat.com/show_bug.cgi?id=2141404
CVE ID: CVE-2022-3917 State: PUBLISHED Published: 2022-12-14T21:06:56.816Z Last Updated: 2025-04-17T20:08:29.888Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Motorola Products: Moto e20 Problem Types: CWE-200 Description: Improper access control of bootloader function was discovered in Motorola Mobility Motorola e20 prior to version RONS31.267-38-8 allows attacker with local access to read partition or RAM data. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://en-us.support.motorola.com/app/answers/detail/a_id/175333
CVE ID: CVE-2022-3918 State: PUBLISHED Published: 2023-01-20T00:00:00.000Z Last Updated: 2025-04-02T16:07:17.733Z Vendors: Swift Project Products: Swift Foundation Problem Types: CWE 113: Improper Neutralization of CRLF Sequences in HTTP Headers Description: A program using FoundationNetworking in swift-corelibs-foundation is potentially vulnerable to CRLF ( ) injection in URLRequest headers. In this vulnerability, a client can insert one or several CRLF sequences into a URLRequest header value. When that request is sent via URLSession to an HTTP server, the server may interpret the content after the CRLF as extra headers, or even a second request. For example, consider a URLRequest to http:
rpret the content after the CRLF as extra headers, or even a second request. For example, consider a URLRequest to http://example.com/ with the GET method. Suppose we set the URLRequest header "Foo" to the value "Bar Extra-Header: Added GET /other HTTP/1.1". When this request is sent, it will appear to the server as two requests: GET / HTTP/1.1 Foo: Bar Extra-Header: Added GET /other HTTP/1.1 In this manner, the client is able to inject extra headers and craft an entirely new request to a separate path, despite only making one API call in URLSession. If a developer has total control over the request and its headers, this vulnerability may not pose a threat. However, this vulnerability escala
l control over the request and its headers, this vulnerability may not pose a threat. However, this vulnerability escalates if un-sanitized user input is placed in header values. If so, a malicious user could inject new headers or requests to an intermediary or backend server. Developers should be especially careful to sanitize user input in this case, or upgrade their version of swift-corelibs-foundation to include the patch below. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/apple/swift-corelibs-foundation/security/advisories/GHSA-4pp3-mpf2-rj63
CVE ID: CVE-2022-3919 State: PUBLISHED Published: 2022-12-12T17:54:41.219Z Last Updated: 2025-04-22T15:04:56.418Z Vendors: Unknown Products: Jetpack CRM Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Jetpack CRM WordPress plugin before 5.4.3 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/fe2f1d52-8421-4b46-b829-6953a0472dcb
CVE ID: CVE-2022-3920 State: PUBLISHED Published: 2022-11-15T23:25:30.161Z Last Updated: 2025-04-29T20:02:00.547Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: HashiCorp Products: Consul, Consul Enterprise Problem Types: CWE-862 Description: HashiCorp Consul and Consul Enterprise 1.13.0 up to 1.13.3 do not filter cluster filtering's imported nodes and services for HTTP or RPC endpoints used by the UI. Fixed in 1.14.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://discuss.hashicorp.com/t/hcsec-2022-28-consul-cluster-peering-leaks-imported-nodes-services-information/46946
CVE ID: CVE-2022-3921 State: PUBLISHED Published: 2022-12-12T17:57:09.917Z Last Updated: 2025-04-22T14:42:28.536Z Vendors: Unknown Products: Listingo Problem Types: CWE-434 Unrestricted Upload of File with Dangerous Type Description: The Listingo WordPress theme before 3.2.7 does not validate files to be uploaded via an AJAX action available to unauthenticated users, which could allow them to upload arbitrary files and lead to RCE Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/e39b59b0-f24f-4de5-a21c-c4de34c3a14f
CVE ID: CVE-2022-3922 State: PUBLISHED Published: 2022-12-28T10:37:25.022Z Last Updated: 2025-04-10T20:35:32.022Z Vendors: Unknown Products: Broken Link Checker Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Broken Link Checker WordPress plugin before 1.11.20 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/78054bd7-cdc2-4b14-9b5c-30f10e802d6b
CVE ID: CVE-2022-3923 State: PUBLISHED Published: 2023-01-09T22:13:35.534Z Last Updated: 2025-04-09T18:47:31.592Z Vendors: Unknown Products: ActiveCampaign for WooCommerce Problem Types: CWE-862 Missing Authorization Description: The ActiveCampaign for WooCommerce WordPress plugin before 1.9.8 does not have authorisation check when cleaning up its error logs via an AJAX action, which could allow any authenticated users, such as subscriber to call it and remove error logs. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/6536946a-7ebf-4f8f-9446-36ec2a2a3ad2
CVE ID: CVE-2022-3924 State: PUBLISHED Published: 2023-01-25T21:39:49.110Z Last Updated: 2025-03-31T13:58:09.212Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: ISC Products: BIND 9 Problem Types: n/a Description: This issue can affect BIND 9 resolvers with `stale-answer-enable yes;` that also make use of the option `stale-answer-client-timeout`, configured with a value greater than zero. If the resolver receives many queries that require recursion, there will be a corresponding increase in the number of clients that are waiting for recursion to complete. If there are sufficient clients already waiting when a new client query is received so that it is necessa
n to complete. If there are sufficient clients already waiting when a new client query is received so that it is necessary to SERVFAIL the longest waiting client (see BIND 9 ARM `recursive-clients` limit and soft quota), then it is possible for a race to occur between providing a stale answer to this older client and sending an early timeout SERVFAIL, which may cause an assertion failure. This issue affects BIND 9 versions 9.16.12 through 9.16.36, 9.18.0 through 9.18.10, 9.19.0 through 9.19.8, and 9.16.12-S1 through 9.16.36-S1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://kb.isc.org/docs/cve-2022-3924
CVE ID: CVE-2022-3925 State: PUBLISHED Published: 2022-12-12T17:54:38.632Z Last Updated: 2025-04-22T15:09:13.253Z Vendors: Unknown Products: buddybadges Problem Types: CWE-89 SQL Injection Description: The buddybadges WordPress plugin through 1.0.0 does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/178499a3-97d1-4ab2-abbe-4a9d2ebc85da - https://bulletin.iese.de/post/buddybadges_1-0-0/
CVE ID: CVE-2022-3926 State: PUBLISHED Published: 2022-12-05T16:50:35.245Z Last Updated: 2025-04-23T15:09:27.967Z Vendors: Unknown Products: WP OAuth Server (OAuth Authentication) Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The WP OAuth Server (OAuth Authentication) WordPress plugin before 3.4.2 does not have CSRF check when regenerating secrets, which could allow attackers to make logged in admins regenerate the secret of an arbitrary client given they know the client ID Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/e1fcde2a-91a5-40cb-876b-884f01c80336
CVE ID: CVE-2022-3927 State: PUBLISHED Published: 2023-01-05T21:41:38.258Z Last Updated: 2025-04-10T14:06:59.197Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Hitachi Energy Products: FOXMAN-UN, UNEM Problem Types: CWE-798 Description: The affected products store both public and private key that are used to sign and protect Custom Parameter Set (CPS) file from modification. An attacker that manages to exploit this vulnerability will be able to change the CPS file, sign it so that it is trusted as the legitimate CPS file. This issue affects * FOXMAN-UN product: FOXMAN-UN R15B, FOXMAN-UN R15A, FOXMAN-UN R14B, FOXMAN-UN R14A, FOXMAN-UN R11B, FOXMAN-UN R11A, FOXM
FOXMAN-UN product: FOXMAN-UN R15B, FOXMAN-UN R15A, FOXMAN-UN R14B, FOXMAN-UN R14A, FOXMAN-UN R11B, FOXMAN-UN R11A, FOXMAN-UN R10C, FOXMAN-UN R9C; * UNEM product: UNEM R15B, UNEM R15A, UNEM R14B, UNEM R14A, UNEM R11B, UNEM R11A, UNEM R10C, UNEM R9C. List of CPEs: * cpe:2.3:a:hitachienergy:foxman-un:R15B:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:foxman-un:R15A:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:foxman-un:R14B:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:foxman-un:R14A:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:foxman-un:R11B:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:foxman-un:R11A:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:foxman-un:R10C:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:foxman-un:R9C:*:*:*:*:*:*
*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:foxman-un:R10C:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:foxman-un:R9C:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:unem:R15B:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:unem:R15A:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:unem:R14B:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:unem:R14A:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:unem:R11B:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:unem:R11A:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:unem:R10C:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:unem:R9C:*:*:*:*:*:*:* Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://search.abb.com/library/Download.aspx?DocumentID=8DBD000083&LanguageCode=en&Docum
ADP Vulnrichment: References: - https://search.abb.com/library/Download.aspx?DocumentID=8DBD000083&LanguageCode=en&DocumentPartId=&Action=Launch - https://search.abb.com/library/Download.aspx?DocumentID=8DBD000084&LanguageCode=en&DocumentPartId=&Action=Launch
CVE ID: CVE-2022-3928 State: PUBLISHED Published: 2023-01-05T21:50:47.595Z Last Updated: 2025-04-10T13:51:45.488Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: Hitachi Energy Products: FOXMAN-UN, UNEM Problem Types: CWE-798 Description: Hardcoded credential is found in affected products' message queue. An attacker that manages to exploit this vulnerability will be able to access data to the internal message queue. This issue affects * FOXMAN-UN product: FOXMAN-UN R15B, FOXMAN-UN R15A, FOXMAN-UN R14B, FOXMAN-UN R14A, FOXMAN-UN R11B, FOXMAN-UN R11A, FOXMAN-UN R10C, FOXMAN-UN R9C; * UNEM product: UNEM R15B, UNEM R15A, UNEM R14B, UNEM R14A, UNEM R11B, UNEM R11A,
N R11A, FOXMAN-UN R10C, FOXMAN-UN R9C; * UNEM product: UNEM R15B, UNEM R15A, UNEM R14B, UNEM R14A, UNEM R11B, UNEM R11A, UNEM R10C, UNEM R9C. List of CPEs: * cpe:2.3:a:hitachienergy:foxman-un:R15B:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:foxman-un:R15A:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:foxman-un:R14B:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:foxman-un:R14A:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:foxman-un:R11B:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:foxman-un:R11A:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:foxman-un:R10C:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:foxman-un:R9C:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:unem:R15B:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:unem:R15A:*:*:*:*:*:*:* * cpe
:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:unem:R15B:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:unem:R15A:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:unem:R14B:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:unem:R14A:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:unem:R11B:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:unem:R11A:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:unem:R10C:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:unem:R9C:*:*:*:*:*:*:* Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://search.abb.com/library/Download.aspx?DocumentID=8DBD000083&LanguageCode=en&DocumentPartId=&Action=Launch - https://search.abb.com/library/Download.aspx?DocumentID=8DBD000084&LanguageCode=e
ode=en&DocumentPartId=&Action=Launch - https://search.abb.com/library/Download.aspx?DocumentID=8DBD000084&LanguageCode=en&DocumentPartId=&Action=Launch
CVE ID: CVE-2022-3929 State: PUBLISHED Published: 2023-01-05T21:54:51.823Z Last Updated: 2025-04-10T13:51:12.769Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Hitachi Energy Products: FOXMAN-UN, UNEM Problem Types: CWE-319 Description: Communication between the client and the server application of the affected products is partially done using CORBA (Common Object Request Broker Architecture) over TCP/IP. This protocol is not encrypted and allows tracing of internal messages. This issue affects * FOXMAN-UN product: FOXMAN-UN R15B, FOXMAN-UN R15A, FOXMAN-UN R14B, FOXMAN-UN R14A, FOXMAN-UN R11B, FOXMAN-UN R11A, FOXMAN-UN R10C, FOXMAN-UN R9C; * UNEM product: UN
R15A, FOXMAN-UN R14B, FOXMAN-UN R14A, FOXMAN-UN R11B, FOXMAN-UN R11A, FOXMAN-UN R10C, FOXMAN-UN R9C; * UNEM product: UNEM R15B, UNEM R15A, UNEM R14B, UNEM R14A, UNEM R11B, UNEM R11A, UNEM R10C, UNEM R9C. List of CPEs: * cpe:2.3:a:hitachienergy:foxman-un:R15B:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:foxman-un:R15A:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:foxman-un:R14B:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:foxman-un:R14A:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:foxman-un:R11B:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:foxman-un:R11A:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:foxman-un:R10C:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:foxman-un:R9C:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:unem:R15B:*:*:*:
n-un:R10C:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:foxman-un:R9C:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:unem:R15B:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:unem:R15A:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:unem:R14B:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:unem:R14A:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:unem:R11B:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:unem:R11A:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:unem:R10C:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:unem:R9C:*:*:*:*:*:*:* Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://search.abb.com/library/Download.aspx?DocumentID=8DBD000083&LanguageCode=en&DocumentPartId=&Action=Launch - https://search.abb
h.abb.com/library/Download.aspx?DocumentID=8DBD000083&LanguageCode=en&DocumentPartId=&Action=Launch - https://search.abb.com/library/Download.aspx?DocumentID=8DBD000084&LanguageCode=en&DocumentPartId=&Action=Launch