Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ervice Pack 1, Windows 8.1, Windows Server 2008 Service Pack 2, Windows Server 2008 Service Pack 2 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 R2 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) Problem Types: Remote Code Execution Description: Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-34731
CVE ID: CVE-2022-34732 State: PUBLISHED Published: 2022-09-13T18:41:46 Last Updated: 2025-03-11T16:10:36.751Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows 10 Version 21H1, Windows Server 2022, Windows 10 Version 20H2, Windows 11 version 21H2, Windows 10 Version 21H2, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows 7, Windows 7 Service Pack 1, Windows 8.1, Windows Server 2008 Service Pack 2, Windows Server 2008 Service Pack 2 (Server Core installa
ervice Pack 1, Windows 8.1, Windows Server 2008 Service Pack 2, Windows Server 2008 Service Pack 2 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 R2 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) Problem Types: Remote Code Execution Description: Microsoft ODBC Driver Remote Code Execution Vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-34732
CVE ID: CVE-2022-34733 State: PUBLISHED Published: 2022-09-13T18:41:47 Last Updated: 2025-03-11T16:10:37.232Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows 10 Version 21H1, Windows Server 2022, Windows 10 Version 20H2, Windows 11 version 21H2, Windows 10 Version 21H2, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows 7, Windows 7 Service Pack 1, Windows 8.1, Windows Server 2008 Service Pack 2, Windows Server 2008 Service Pack 2 (Server Core installa
ervice Pack 1, Windows 8.1, Windows Server 2008 Service Pack 2, Windows Server 2008 Service Pack 2 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 R2 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) Problem Types: Remote Code Execution Description: Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-34733
CVE ID: CVE-2022-34734 State: PUBLISHED Published: 2022-09-13T18:41:48 Last Updated: 2025-03-11T16:10:37.783Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows 10 Version 21H1, Windows Server 2022, Windows 10 Version 20H2, Windows 11 version 21H2, Windows 10 Version 21H2, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows 7, Windows 7 Service Pack 1, Windows 8.1, Windows Server 2008 Service Pack 2, Windows Server 2008 Service Pack 2 (Server Core installa
ervice Pack 1, Windows 8.1, Windows Server 2008 Service Pack 2, Windows Server 2008 Service Pack 2 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 R2 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) Problem Types: Remote Code Execution Description: Microsoft ODBC Driver Remote Code Execution Vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-34734
CVE ID: CVE-2022-34735 State: PUBLISHED Published: 2022-07-11T13:52:53 Last Updated: 2024-08-03T09:22:09.211Z Vendors: Huawei Products: HarmonyOS, EMUI Problem Types: Null pointer dereference vulnerability Description: The frame scheduling module has a null pointer dereference vulnerability. Successful exploitation of this vulnerability will affect the kernel availability. Additional Analyst Notes: - CVE Program Container: References: - https://consumer.huawei.com/en/support/bulletin/2022/7/ - https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202207-0000001342389149
CVE ID: CVE-2022-34736 State: PUBLISHED Published: 2022-07-11T13:52:58 Last Updated: 2024-08-03T09:22:09.053Z Vendors: Huawei Products: HarmonyOS, EMUI Problem Types: Null pointer dereference vulnerability Description: The frame scheduling module has a null pointer dereference vulnerability. Successful exploitation of this vulnerability will affect the kernel availability. Additional Analyst Notes: - CVE Program Container: References: - https://consumer.huawei.com/en/support/bulletin/2022/7/ - https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202207-0000001342389149
CVE ID: CVE-2022-34737 State: PUBLISHED Published: 2022-07-11T13:53:35 Last Updated: 2024-08-03T09:22:09.075Z Vendors: Huawei Products: HarmonyOS, EMUI, Magic UI Problem Types: Improper permission assignment vulnerability Description: The application security module has a vulnerability in permission assignment. Successful exploitation of this vulnerability may affect data integrity and confidentiality. Additional Analyst Notes: - CVE Program Container: References: - https://consumer.huawei.com/en/support/bulletin/2022/7/ - https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202207-0000001342389149
CVE ID: CVE-2022-34738 State: PUBLISHED Published: 2022-07-11T13:53:41 Last Updated: 2024-08-03T09:22:09.054Z Vendors: Huawei Products: HarmonyOS, EMUI, Magic UI Problem Types: Improper permission control vulnerability Description: The SystemUI module has a vulnerability in permission control. If this vulnerability is successfully exploited, users are unaware of the service running in the background. Additional Analyst Notes: - CVE Program Container: References: - https://consumer.huawei.com/en/support/bulletin/2022/7/ - https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202207-0000001342389149
CVE ID: CVE-2022-34739 State: PUBLISHED Published: 2022-07-11T13:53:23 Last Updated: 2024-08-03T09:22:09.048Z Vendors: Huawei Products: HarmonyOS, EMUI, Magic UI Problem Types: Addition overflow vulnerability Description: The fingerprint module has a vulnerability of overflow in arithmetic addition. Successful exploitation of this vulnerability may result in the acquisition of data from unknown addresses in address mappings. Additional Analyst Notes: - CVE Program Container: References: - https://consumer.huawei.com/en/support/bulletin/2022/7/ - https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202207-0000001342389149
CVE ID: CVE-2022-34740 State: PUBLISHED Published: 2022-07-11T13:53:10 Last Updated: 2024-08-03T09:22:09.234Z Vendors: Huawei Products: HarmonyOS, EMUI, Magic UI Problem Types: Buffer overflow vulnerability Description: The NFC module has a buffer overflow vulnerability. Successful exploitation of this vulnerability may cause exceptions in NFC card registration, deletion, and activation. Additional Analyst Notes: - CVE Program Container: References: - https://consumer.huawei.com/en/support/bulletin/2022/7/ - https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202207-0000001342389149
CVE ID: CVE-2022-34741 State: PUBLISHED Published: 2022-07-11T13:53:17 Last Updated: 2024-08-03T09:22:09.210Z Vendors: Huawei Products: HarmonyOS, EMUI, Magic UI Problem Types: Buffer overflow vulnerability Description: The NFC module has a buffer overflow vulnerability. Successful exploitation of this vulnerability may cause exceptions in NFC card registration, deletion, and activation. Additional Analyst Notes: - CVE Program Container: References: - https://consumer.huawei.com/en/support/bulletin/2022/7/ - https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202207-0000001342389149
CVE ID: CVE-2022-34742 State: PUBLISHED Published: 2022-07-11T13:53:29 Last Updated: 2024-08-03T09:22:09.283Z Vendors: Huawei Products: HarmonyOS, EMUI, Magic UI Problem Types: Read/Write vulnerability Description: The system module has a read/write vulnerability. Successful exploitation of this vulnerability may affect data confidentiality. Additional Analyst Notes: - CVE Program Container: References: - https://consumer.huawei.com/en/support/bulletin/2022/7/ - https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202207-0000001342389149 - https://consumer.huawei.com/en/support/bulletin/2022/8/
CVE ID: CVE-2022-34743 State: PUBLISHED Published: 2022-07-11T13:53:04 Last Updated: 2024-08-03T09:22:09.298Z Vendors: Huawei Products: HarmonyOS, EMUI, Magic UI Problem Types: Out-of-bounds read vulnerability Description: The AT commands of the USB port have an out-of-bounds read vulnerability. Successful exploitation of this vulnerability may affect system availability. Additional Analyst Notes: - CVE Program Container: References: - https://consumer.huawei.com/en/support/bulletin/2022/7/ - https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202207-0000001342389149
CVE ID: CVE-2022-34746 State: PUBLISHED Published: 2022-09-20T01:50:09.000Z Last Updated: 2025-05-29T13:42:48.236Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Zyxel Products: Zyxel GS1900 series firmware Problem Types: CWE-331 Description: An insufficient entropy vulnerability caused by the improper use of randomness sources with low entropy for RSA key pair generation was found in Zyxel GS1900 series firmware versions prior to V2.70. This vulnerability could allow an unauthenticated attacker to retrieve a private key by factoring the RSA modulus N in the certificate of the web administration interface. Additional Analyst Notes: - CVE Program Container:
SA modulus N in the certificate of the web administration interface. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-insufficient-entropy-vulnerability-of-gs1900-series-switches
CVE ID: CVE-2022-34747 State: PUBLISHED Published: 2022-09-06T01:20:10 Last Updated: 2024-08-03T09:22:09.239Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Zyxel Products: Zyxel NAS326 firmware Problem Types: CWE-134 Description: A format string vulnerability in Zyxel NAS326 firmware versions prior to V5.21(AAZF.12)C0 could allow an attacker to achieve unauthorized remote code execution via a crafted UDP packet. Additional Analyst Notes: - CVE Program Container: References: - https://www.zyxel.com/support/Zyxel-security-advisory-for-format-string-vulnerability-in-NAS.shtml
CVE ID: CVE-2022-34748 State: PUBLISHED Published: 2022-07-12T10:07:26 Last Updated: 2024-08-03T09:22:10.269Z Vendors: Siemens Products: Simcenter Femap Problem Types: CWE-787 Description: A vulnerability has been identified in Simcenter Femap (All versions < V2022.2). The affected application contains an out of bounds write past the end of an allocated structure while parsing specially crafted X_T files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-17293) Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-474231.pdf
CVE ID: CVE-2022-34749 State: PUBLISHED Published: 2022-07-25T00:00:00 Last Updated: 2024-08-03T09:22:10.438Z Vendors: n/a Products: n/a Problem Types: n/a Description: In mistune through 2.0.2, support of inline markup is implemented by using regular expressions that can involve a high amount of backtracking on certain edge cases. This behavior is commonly named catastrophic backtracking. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/lepture/mistune/releases - https://github.com/lepture/mistune/commit/a6d43215132fe4f3d93f8d7e90ba83b16a0838b2 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TQHXITQ2DSBYOI
0838b2 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TQHXITQ2DSBYOILKHXBSBB7PFBPZHF63/
CVE ID: CVE-2022-34750 State: PUBLISHED Published: 2022-06-28T12:20:42 Last Updated: 2024-08-03T09:22:09.260Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in MediaWiki through 1.38.1. The lemma length of a Wikibase lexeme is currently capped at a thousand characters. Unfortunately, this length is not validated, allowing much larger lexemes to be created, which introduces various denial-of-service attack vectors within the Wikibase and WikibaseLexeme extensions. This is related to Special:NewLexeme and Special:NewProperty. Additional Analyst Notes: - CVE Program Container: References: - https://phabricator.wikimedia.org/T308659 - https://gerrit.wikimedia.
lyst Notes: - CVE Program Container: References: - https://phabricator.wikimedia.org/T308659 - https://gerrit.wikimedia.org/r/q/I8171bfef73e525d73efa60b407ce147130ea4742 - https://gerrit.wikimedia.org/r/q/Id89a9b08e40f075d2d422cafd03668dff3ce7fc9
CVE ID: CVE-2022-34753 State: PUBLISHED Published: 2022-07-13T21:10:25.007418Z Last Updated: 2024-09-16T19:14:26.516Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Schneider Electric Products: SpaceLogic C-Bus Home Controller Problem Types: CWE-78 Description: A CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause remote root exploit when the command is compromised. Affected Products: SpaceLogic C-Bus Home Controller (5200WHC2), formerly known as C-Bus Wiser Homer Controller MK2 (V1.31.460 and prior) Additional Analyst Notes: - CVE Program Container: References: - https://dow
Homer Controller MK2 (V1.31.460 and prior) Additional Analyst Notes: - CVE Program Container: References: - https://download.schneider-electric.com/files?p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2022-193-02_SpaceLogic-C-Bus-Home-Controller-Wiser_MK2_Security_Notification.pdf - http://packetstormsecurity.com/files/167783/Schneider-Electric-SpaceLogic-C-Bus-Home-Controller-5200WHC2-Remote-Root.html
CVE ID: CVE-2022-34754 State: PUBLISHED Published: 2022-07-13T21:10:27.769215Z Last Updated: 2024-09-17T02:27:11.795Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Schneider Electric Products: Acti9 PowerTag Link C Problem Types: CWE-269 Description: A CWE-269: Improper Privilege Management vulnerability exists that could allow elevated functionality when guessing credentials. Affected Products: Acti9 PowerTag Link C (A9XELC10-A) (V1.7.5 and prior), Acti9 PowerTag Link C (A9XELC10-B) (V2.12.0 and prior) Additional Analyst Notes: - CVE Program Container: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-193-03&p_enDocType=Secur
gram Container: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-193-03&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2022-193-03_Acti9_PowerTag_Link_C_Security_Notification.pdf
CVE ID: CVE-2022-34755 State: PUBLISHED Published: 2023-04-18T19:50:33.416Z Last Updated: 2025-03-03T19:21:32.890Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H) Vendors: Schneider Electric Products: Easergy Builder Installer Problem Types: CWE-427 Description: A CWE-427 - Uncontrolled Search Path Element vulnerability exists that could allow an attacker with a local privileged account to place a specially crafted file on the target machine, which may give the attacker the ability to execute arbitrary code during the installation process initiated by a valid user. Affected Products: Easergy Builder Installer (1.7.23 and prior) Additional Analyst Notes: - CVE Program
by a valid user. Affected Products: Easergy Builder Installer (1.7.23 and prior) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-101-06&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-101-06.pdf
CVE ID: CVE-2022-34756 State: PUBLISHED Published: 2022-07-13T21:10:32.649361Z Last Updated: 2024-09-17T04:09:06.583Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Schneider Electric Products: Easergy P5 Problem Types: CWE-120 Description: A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could result in remote code execution or the crash of HTTPs stack which is used for the device Web HMI. Affected Products: Easergy P5 (V01.401.102 and prior) Additional Analyst Notes: - CVE Program Container: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-193-04&p_enDocType=Security+and+Safety+Notice&p_File_Name
ps://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-193-04&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2022-193-04_Easergy_P5_Security_Notification.pdf
CVE ID: CVE-2022-34757 State: PUBLISHED Published: 2022-07-13T21:10:36.346512Z Last Updated: 2024-09-16T22:40:53.810Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:H) Vendors: Schneider Electric Products: Easergy P5 Problem Types: CWE-327 Description: A CWE-327: Use of a Broken or Risky Cryptographic Algorithm vulnerability exists where weak cipher suites can be used for the SSH connection between Easergy Pro software and the device, which may allow an attacker to observe protected communication details. Affected Products: Easergy P5 (V01.401.102 and prior) Additional Analyst Notes: - CVE Program Container: References: - https://download.schneider-electric.com/files?p
prior) Additional Analyst Notes: - CVE Program Container: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-193-04&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2022-193-04_Easergy_P5_Security_Notification.pdf
CVE ID: CVE-2022-34758 State: PUBLISHED Published: 2022-07-13T21:10:41.744629Z Last Updated: 2024-09-17T00:50:40.234Z Severity: MEDIUM (CVSS 5.1 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L) Vendors: Schneider Electric Products: Easergy P5 Problem Types: CWE-20 Description: A CWE-20: Improper Input Validation vulnerability exists that could cause the device watchdog function to be disabled if the attacker had access to privileged user credentials. Affected Products: Easergy P5 (V01.401.102 and prior) Additional Analyst Notes: - CVE Program Container: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-193-04&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-
ownload.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-193-04&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2022-193-04_Easergy_P5_Security_Notification.pdf
CVE ID: CVE-2022-34759 State: PUBLISHED Published: 2022-07-13T21:10:46.820541Z Last Updated: 2024-09-16T22:29:47.753Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Schneider Electric Products: OPC UA Modicon Communication Module, X80 advanced RTU Communication Module Problem Types: CWE-787 Description: A CWE-787: Out-of-bounds Write vulnerability exists that could cause a denial of service of the webserver due to improper parsing of the HTTP Headers. Affected Products: X80 advanced RTU Communication Module (BMENOR2200H) (V1.0), OPC UA Modicon Communication Module (BMENUA0100) (V1.10 and prior) Additional Analyst Notes: - CVE Program Container: References: -
on Communication Module (BMENUA0100) (V1.10 and prior) Additional Analyst Notes: - CVE Program Container: References: - https://download.schneider-electric.com/files?p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2022-193-01_OPC_UA_X80_Advanced_RTU_Modicon_Communication_Modules+_Security_Notification.pdf
CVE ID: CVE-2022-34760 State: PUBLISHED Published: 2022-07-13T21:10:49.692735Z Last Updated: 2024-09-17T01:30:30.169Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Schneider Electric Products: OPC UA Modicon Communication Module, X80 advanced RTU Communication Module Problem Types: CWE-835 Description: A CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability exists that could cause a denial of service of the webserver due to improper handling of the cookies. Affected Products: X80 advanced RTU Communication Module (BMENOR2200H) (V1.0), OPC UA Modicon Communication Module (BMENUA0100) (V1.10 and prior) Additional Analyst Notes: - CVE Pr
ENOR2200H) (V1.0), OPC UA Modicon Communication Module (BMENUA0100) (V1.10 and prior) Additional Analyst Notes: - CVE Program Container: References: - https://download.schneider-electric.com/files?p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2022-193-01_OPC_UA_X80_Advanced_RTU_Modicon_Communication_Modules+_Security_Notification.pdf
CVE ID: CVE-2022-34761 State: PUBLISHED Published: 2022-07-13T21:10:52.734686Z Last Updated: 2024-09-16T16:52:55.761Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Schneider Electric Products: OPC UA Modicon Communication Module, X80 advanced RTU Communication Module Problem Types: CWE-476 Description: A CWE-476: NULL Pointer Dereference vulnerability exists that could cause a denial of service of the webserver when parsing JSON content type. Affected Products: X80 advanced RTU Communication Module (BMENOR2200H) (V2.01 and later), OPC UA Modicon Communication Module (BMENUA0100) (V1.10 and prior) Additional Analyst Notes: - CVE Program Container: References:
dicon Communication Module (BMENUA0100) (V1.10 and prior) Additional Analyst Notes: - CVE Program Container: References: - https://download.schneider-electric.com/files?p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2022-193-01_OPC_UA_X80_Advanced_RTU_Modicon_Communication_Modules+_Security_Notification.pdf
CVE ID: CVE-2022-34762 State: PUBLISHED Published: 2022-07-13T21:10:56.827229Z Last Updated: 2024-09-16T16:22:52.936Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:H) Vendors: Schneider Electric Products: OPC UA Modicon Communication Module, X80 advanced RTU Communication Module Problem Types: CWE-22 Description: A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause unauthorized firmware image loading when unsigned images are added to the firmware image path. Affected Products: X80 advanced RTU Communication Module (BMENOR2200H) (V2.01 and later), OPC UA Modicon Communication Module (BMENUA0100)
X80 advanced RTU Communication Module (BMENOR2200H) (V2.01 and later), OPC UA Modicon Communication Module (BMENUA0100) (V1.10 and prior) Additional Analyst Notes: - CVE Program Container: References: - https://download.schneider-electric.com/files?p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2022-193-01_OPC_UA_X80_Advanced_RTU_Modicon_Communication_Modules+_Security_Notification.pdf