Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ify a configuration value and then execute an XCMD to trigger these vulnerabilities.This vulnerability arises from format string injection via the `default_key_id` and `key` configuration parameters, as used within the `testWifiAP` XCMD handler Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2022-1581
CVE ID: CVE-2022-35877 State: PUBLISHED Published: 2022-10-25T16:34:16.353Z Last Updated: 2025-04-15T18:42:57.864Z Severity: HIGH (CVSS 8.2 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H) Vendors: abode systems, inc. Products: iota All-In-One Security Kit Problem Types: CWE-134 Description: Four format string injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. Specially-crafted configuration values can lead to memory corruption, information disclosure and denial of service. An attacker can modify a configuration value and then execute an XCMD to trigger these vulnerabilities.This vulnerability arises from forma
ify a configuration value and then execute an XCMD to trigger these vulnerabilities.This vulnerability arises from format string injection via the `default_key_id` configuration parameter, as used within the `testWifiAP` XCMD handler Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2022-1581
CVE ID: CVE-2022-35878 State: PUBLISHED Published: 2022-10-25T16:34:17.358Z Last Updated: 2025-04-15T18:42:48.179Z Severity: HIGH (CVSS 7.1 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H) Vendors: abode systems, inc. Products: iota All-In-One Security Kit Problem Types: CWE-134 Description: Four format string injection vulnerabilities exist in the UPnP logging functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9Z and 6.9X. A specially-crafted UPnP negotiation can lead to memory corruption, information disclosure, and denial of service. An attacker can host a malicious UPnP service to trigger these vulnerabilities.This vulnerability arises from format string injection via `ST`
malicious UPnP service to trigger these vulnerabilities.This vulnerability arises from format string injection via `ST` and `Location` HTTP response headers, as used within the `DoEnumUPnPService` action handler. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2022-1583
CVE ID: CVE-2022-35879 State: PUBLISHED Published: 2022-10-25T16:34:18.345Z Last Updated: 2025-04-15T18:42:35.804Z Severity: HIGH (CVSS 7.1 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H) Vendors: abode systems, inc. Products: iota All-In-One Security Kit Problem Types: CWE-134 Description: Four format string injection vulnerabilities exist in the UPnP logging functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9Z and 6.9X. A specially-crafted UPnP negotiation can lead to memory corruption, information disclosure, and denial of service. An attacker can host a malicious UPnP service to trigger these vulnerabilities.This vulnerability arises from format string injection via `cont
malicious UPnP service to trigger these vulnerabilities.This vulnerability arises from format string injection via `controlURL` XML tag, as used within the `DoUpdateUPnPbyService` action handler. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2022-1583
CVE ID: CVE-2022-35880 State: PUBLISHED Published: 2022-10-25T16:34:19.367Z Last Updated: 2025-04-15T18:42:26.814Z Severity: HIGH (CVSS 7.1 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H) Vendors: abode systems, inc. Products: iota All-In-One Security Kit Problem Types: CWE-134 Description: Four format string injection vulnerabilities exist in the UPnP logging functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9Z and 6.9X. A specially-crafted UPnP negotiation can lead to memory corruption, information disclosure, and denial of service. An attacker can host a malicious UPnP service to trigger these vulnerabilities.This vulnerability arises from format string injection via `NewI
malicious UPnP service to trigger these vulnerabilities.This vulnerability arises from format string injection via `NewInternalClient` XML tag, as used within the `DoUpdateUPnPbyService` action handler. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2022-1583
CVE ID: CVE-2022-35881 State: PUBLISHED Published: 2022-10-25T16:34:20.328Z Last Updated: 2025-04-15T18:42:12.665Z Severity: HIGH (CVSS 7.1 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H) Vendors: abode systems, inc. Products: iota All-In-One Security Kit Problem Types: CWE-134 Description: Four format string injection vulnerabilities exist in the UPnP logging functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9Z and 6.9X. A specially-crafted UPnP negotiation can lead to memory corruption, information disclosure, and denial of service. An attacker can host a malicious UPnP service to trigger these vulnerabilities.This vulnerability arises from format string injection via `erro
malicious UPnP service to trigger these vulnerabilities.This vulnerability arises from format string injection via `errorCode` and `errorDescription` XML tags, as used within the `DoUpdateUPnPbyService` action handler. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2022-1583
CVE ID: CVE-2022-35882 State: PUBLISHED Published: 2022-07-28T14:22:48.114Z Last Updated: 2025-02-20T20:14:42.293Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: GS Plugins Products: GS Testimonial Slider (WordPress plugin) Problem Types: CWE-79 Description: Authenticated (author or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in GS Plugins GS Testimonial Slider plugin <= 1.9.5 at WordPress. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/gs-testimonial/#developers - https://patchstack.com/database/vulnerability/gs-testimonial/wordpress-gs-testimonial-slider-plugin-
onial/#developers - https://patchstack.com/database/vulnerability/gs-testimonial/wordpress-gs-testimonial-slider-plugin-1-9-1-authenticated-stored-cross-site-scripting-xss-vulnerability
CVE ID: CVE-2022-35883 State: PUBLISHED Published: 2023-02-16T20:00:18.116Z Last Updated: 2025-01-27T18:16:13.402Z Severity: LOW (CVSS 2.2 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L) Vendors: n/a Products: Intel(R) Media SDK software Problem Types: denial of service Description: NULL pointer dereference in the Intel(R) Media SDK software before version 22.2.2 may allow an authenticated user to potentially enable denial of service via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00731.html
CVE ID: CVE-2022-35884 State: PUBLISHED Published: 2022-10-25T16:34:21.353Z Last Updated: 2025-04-15T18:41:57.938Z Severity: HIGH (CVSS 8.2 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H) Vendors: abode systems, inc. Products: iota All-In-One Security Kit Problem Types: CWE-134 Description: Four format string injection vulnerabilities exist in the web interface /action/wirelessConnect functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9Z and 6.9X. A specially-crafted HTTP request can lead to memory corruption, information disclosure and denial of service. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.This vulnerability arises from format s
attacker can make an authenticated HTTP request to trigger these vulnerabilities.This vulnerability arises from format string injection via the `ssid_hex` HTTP parameter, as used within the `/action/wirelessConnect` handler. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2022-1585
CVE ID: CVE-2022-35885 State: PUBLISHED Published: 2022-10-25T16:34:22.339Z Last Updated: 2025-04-15T18:41:46.855Z Severity: HIGH (CVSS 8.2 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H) Vendors: abode systems, inc. Products: iota All-In-One Security Kit Problem Types: CWE-134 Description: Four format string injection vulnerabilities exist in the web interface /action/wirelessConnect functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9Z and 6.9X. A specially-crafted HTTP request can lead to memory corruption, information disclosure and denial of service. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.This vulnerability arises from format s
attacker can make an authenticated HTTP request to trigger these vulnerabilities.This vulnerability arises from format string injection via the `wpapsk_hex` HTTP parameter, as used within the `/action/wirelessConnect` handler. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2022-1585
CVE ID: CVE-2022-35886 State: PUBLISHED Published: 2022-10-25T16:34:23.373Z Last Updated: 2025-04-15T18:41:35.798Z Severity: HIGH (CVSS 8.2 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H) Vendors: abode systems, inc. Products: iota All-In-One Security Kit Problem Types: CWE-134 Description: Four format string injection vulnerabilities exist in the web interface /action/wirelessConnect functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9Z and 6.9X. A specially-crafted HTTP request can lead to memory corruption, information disclosure and denial of service. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.This vulnerability arises from format s
attacker can make an authenticated HTTP request to trigger these vulnerabilities.This vulnerability arises from format string injection via the `default_key_id` and `key` HTTP parameters, as used within the `/action/wirelessConnect` handler. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2022-1585
CVE ID: CVE-2022-35887 State: PUBLISHED Published: 2022-10-25T16:34:24.333Z Last Updated: 2025-04-15T18:41:27.106Z Severity: HIGH (CVSS 8.2 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H) Vendors: abode systems, inc. Products: iota All-In-One Security Kit Problem Types: CWE-134 Description: Four format string injection vulnerabilities exist in the web interface /action/wirelessConnect functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9Z and 6.9X. A specially-crafted HTTP request can lead to memory corruption, information disclosure and denial of service. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.This vulnerability arises from format s
attacker can make an authenticated HTTP request to trigger these vulnerabilities.This vulnerability arises from format string injection via the `default_key_id` HTTP parameter, as used within the `/action/wirelessConnect` handler. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2022-1585
CVE ID: CVE-2022-35888 State: PUBLISHED Published: 2022-09-29T00:41:53.000Z Last Updated: 2025-05-20T19:55:11.567Z Vendors: n/a Products: n/a Problem Types: n/a Description: Ampere Altra and Ampere Altra Max devices through 2022-07-15 allow attacks via Hertzbleed, which is a power side-channel attack that extracts secret information from the CPU by correlating the power consumption with data being processed on the system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://amperecomputing.com/products/security-bulletins/hertzbleed.html - https://developer.arm.com/documentation/ka005111/1-0/?lang=en
CVE ID: CVE-2022-35890 State: PUBLISHED Published: 2022-07-15T20:07:28 Last Updated: 2024-08-03T09:44:22.143Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Inductive Automation Ignition before 7.9.20 and 8.x before 8.1.17. Designer and Vision Client Session IDs are mishandled. An attacker can determine which session IDs were generated in the past and then hijack sessions assigned to these IDs via Randy. Additional Analyst Notes: - CVE Program Container: References: - https://support.inductiveautomation.com/hc/en-us/articles/7625759776653 - https://github.com/sourceincite/randy
CVE ID: CVE-2022-35893 State: PUBLISHED Published: 2022-09-23T18:01:47.000Z Last Updated: 2025-05-05T16:14:35.222Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. An SMM memory corruption vulnerability in the FvbServicesRuntimeDxe driver allows an attacker to write fixed or predictable data to SMRAM. Exploiting this issue could lead to escalating privileges to SMM. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.insyde.com/security-pledge - https://www.insyde.com/security-pledge/SA-2022035 - https://binarly.io/advisories/BRLY-2022-026/index.html
CVE ID: CVE-2022-35894 State: PUBLISHED Published: 2022-09-22T17:07:10.000Z Last Updated: 2025-05-05T16:14:25.982Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. The SMI handler for the FwBlockServiceSmm driver uses an untrusted pointer as the location to copy data to an attacker-specified buffer, leading to information disclosure. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.insyde.com/security-pledge - https://binarly.io/advisories/BRLY-2022-018/index.html - https://www.insyde.com/security-pledge/SA-2022030
CVE ID: CVE-2022-35895 State: PUBLISHED Published: 2022-09-21T20:36:15.000Z Last Updated: 2025-05-05T16:14:15.843Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. The FwBlockSericceSmm driver does not properly validate input parameters for a software SMI routine, leading to memory corruption of arbitrary addresses including SMRAM, and possible arbitrary code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.insyde.com/security-pledge - https://binarly.io/advisories/BRLY-2022-024/index.html - https://www.insyde.com/security-pledge/SA-2022033
CVE ID: CVE-2022-35896 State: PUBLISHED Published: 2022-09-21T23:33:01.000Z Last Updated: 2025-05-05T16:14:05.901Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue SMM memory leak vulnerability in SMM driver (SMRAM was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. An attacker can dump SMRAM contents via the software SMI provided by the FvbServicesRuntimeDxe driver to read the contents of SMRAM, leading to information disclosure. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.insyde.com/security-pledge - https://www.insyde.com/security-pledge/SA-2022034 - https://binarly.io/advisories/BRLY-2022-025/index.h
ecurity-pledge - https://www.insyde.com/security-pledge/SA-2022034 - https://binarly.io/advisories/BRLY-2022-025/index.html
CVE ID: CVE-2022-35897 State: PUBLISHED Published: 2022-11-21T00:00:00.000Z Last Updated: 2025-04-30T15:19:58.103Z Vendors: n/a Products: n/a Problem Types: n/a Description: An stack buffer overflow vulnerability leads to arbitrary code execution issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. If the attacker modifies specific UEFI variables, it can cause a stack overflow, leading to arbitrary code execution. The specific variables are normally locked (read-only) at the OS level and therefore an attack would require direct SPI modification. If an attacker can change the values of at least two variables out of three (SecureBootEnforce, SecureBoot, RestoreBootSettings), i
ker can change the values of at least two variables out of three (SecureBootEnforce, SecureBoot, RestoreBootSettings), it is possible to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.insyde.com/security-pledge - https://www.insyde.com/security-pledge/SA-2022041
CVE ID: CVE-2022-35898 State: PUBLISHED Published: 2023-05-01T00:00:00.000Z Last Updated: 2025-01-30T16:57:04.270Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenText BizManager before 16.6.0.1 does not perform proper validation during the change-password operation. This allows any authenticated user to change the password of any other user, including the Administrator account. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://businessnetwork.opentext.com/b2b-gateway/ - https://hackandpwn.com/disclosures/CVE-2022-35898.pdf
CVE ID: CVE-2022-35899 State: PUBLISHED Published: 2022-07-21T16:14:44 Last Updated: 2024-08-03T09:44:22.164Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is an unquoted service path in ASUSTeK Aura Ready Game SDK service (GameSDK.exe) 1.0.0.4. This might allow a local user to escalate privileges by creating a %PROGRAMFILES(X86)%\ASUS\GameSDK.exe file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/AngeloPioAmirante/CVE-2022-35899 - https://packetstormsecurity.com/files/167763/Asus-GameSDK-1.0.0.4-Unquoted-Service-Path.html - https://www.exploit-db.com/exploits/50985
CVE ID: CVE-2022-35900 State: PUBLISHED Published: 2022-07-15T22:40:38 Last Updated: 2024-08-03T09:44:22.148Z Severity: LOW (CVSS 3.3 CVSS:3.1/AC:L/AV:L/A:N/C:L/I:N/PR:N/S:U/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Bentley MicroStation before 10.17.0.x and Bentley View before 10.17.0.x. Using an affected version of MicroStation or MicroStation-based application to open a JP2 file containing crafted data can force an out-of-bounds read. Exploitation of these vulnerabilities within the parsing of JP2 files could enable an attacker to read information in the context of the current process. Additional Analyst Notes: - CVE Program Container: Refe
acker to read information in the context of the current process. Additional Analyst Notes: - CVE Program Container: References: - https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0015
CVE ID: CVE-2022-35901 State: PUBLISHED Published: 2022-07-15T22:40:53 Last Updated: 2024-08-03T09:44:22.181Z Severity: LOW (CVSS 3.3 CVSS:3.1/AC:L/AV:L/A:N/C:L/I:N/PR:N/S:U/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Bentley MicroStation before 10.17.0.x and Bentley View before 10.17.0.x. Using an affected version of MicroStation or MicroStation-based application to open a J2K file containing crafted data can force an out-of-bounds read. Exploitation of these vulnerabilities within the parsing of J2K files could enable an attacker to read information in the context of the current process. Additional Analyst Notes: - CVE Program Container: Refe
acker to read information in the context of the current process. Additional Analyst Notes: - CVE Program Container: References: - https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0014
CVE ID: CVE-2022-35902 State: PUBLISHED Published: 2022-07-15T22:42:30 Last Updated: 2024-08-03T09:44:22.154Z Severity: LOW (CVSS 3.3 CVSS:3.1/AC:L/AV:L/A:N/C:L/I:N/PR:N/S:U/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Bentley MicroStation before 10.17.0.x and Bentley View before 10.17.0.x. Using an affected version of MicroStation or MicroStation-based application to open an OBJ file containing crafted data can force an out-of-bounds read. Exploitation of these vulnerabilities within the parsing of OBJ files could enable an attacker to read information in the context of the current process. Additional Analyst Notes: - CVE Program Container: Ref
tacker to read information in the context of the current process. Additional Analyst Notes: - CVE Program Container: References: - https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0016
CVE ID: CVE-2022-35903 State: PUBLISHED Published: 2022-07-15T22:44:39 Last Updated: 2024-08-03T09:44:22.158Z Severity: LOW (CVSS 3.3 CVSS:3.1/AC:L/AV:L/A:N/C:L/I:N/PR:N/S:U/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Bentley MicroStation before 10.17.0.x and Bentley View before 10.17.0.x. Using an affected version of MicroStation or MicroStation-based application to open a 3DS file containing crafted data can force an out-of-bounds read. Exploitation of these vulnerabilities within the parsing of 3DS files could enable an attacker to read information in the context of the current process. Additional Analyst Notes: - CVE Program Container: Refe
acker to read information in the context of the current process. Additional Analyst Notes: - CVE Program Container: References: - https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0010
CVE ID: CVE-2022-35904 State: PUBLISHED Published: 2022-07-15T22:44:56 Last Updated: 2024-08-03T09:44:22.178Z Severity: LOW (CVSS 3.3 CVSS:3.1/AC:L/AV:L/A:N/C:L/I:N/PR:N/S:U/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Bentley MicroStation before 10.17.0.x and Bentley View before 10.17.0.x. Using an affected version of MicroStation or MicroStation-based application to open an IFC file containing crafted data can force an out-of-bounds read. Exploitation of these vulnerabilities within the parsing of IFC files could enable an attacker to read information in the context of the current process. Additional Analyst Notes: - CVE Program Container: Ref
tacker to read information in the context of the current process. Additional Analyst Notes: - CVE Program Container: References: - https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0013
CVE ID: CVE-2022-35905 State: PUBLISHED Published: 2022-07-15T22:45:09 Last Updated: 2024-08-03T09:44:22.129Z Severity: LOW (CVSS 3.3 CVSS:3.1/AC:L/AV:L/A:N/C:L/I:N/PR:N/S:U/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Bentley MicroStation before 10.17.0.x and Bentley View before 10.17.0.x. Using an affected version of MicroStation or MicroStation-based application to open an FBX file containing crafted data can force an out-of-bounds read. Exploitation of these vulnerabilities within the parsing of FBX files could enable an attacker to read information in the context of the current process. Additional Analyst Notes: - CVE Program Container: Ref
tacker to read information in the context of the current process. Additional Analyst Notes: - CVE Program Container: References: - https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0012
CVE ID: CVE-2022-35906 State: PUBLISHED Published: 2022-07-15T22:45:28 Last Updated: 2024-08-03T09:44:22.192Z Severity: LOW (CVSS 3.3 CVSS:3.1/AC:L/AV:L/A:N/C:L/I:N/PR:N/S:U/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Bentley MicroStation before 10.17.0.x and Bentley View before 10.17.0.x. Using an affected version of MicroStation or MicroStation-based application to open a DGN file containing crafted data can force an out-of-bounds read. Exploitation of these vulnerabilities within the parsing of DGN files could enable an attacker to read information in the context of the current process. Additional Analyst Notes: - CVE Program Container: Refe
acker to read information in the context of the current process. Additional Analyst Notes: - CVE Program Container: References: - https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0011