Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
FortiOS. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-22-223
CVE ID: CVE-2022-35843 State: PUBLISHED Published: 2022-12-06T16:00:33.269Z Last Updated: 2024-10-23T14:51:54.623Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C) Vendors: Fortinet Products: FortiOS, FortiProxy Problem Types: CWE-284 Description: An authentication bypass by assumed-immutable data vulnerability [CWE-302] in the FortiOS SSH login component 7.2.0, 7.0.0 through 7.0.7, 6.4.0 through 6.4.9, 6.2 all versions, 6.0 all versions and FortiProxy SSH login component 7.0.0 through 7.0.5, 2.0.0 through 2.0.10, 1.2.0 all versions may allow a remote and unauthenticated attacker to login into the device via sending specially crafted Access-Challenge respo
llow a remote and unauthenticated attacker to login into the device via sending specially crafted Access-Challenge response from the Radius server. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-22-255
CVE ID: CVE-2022-35844 State: PUBLISHED Published: 2022-10-10T00:00:00 Last Updated: 2024-10-25T13:28:53.141Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:F/RL:U/RC:C) Vendors: Fortinet Products: Fortinet FortiTester Problem Types: Execute unauthorized code or commands Description: An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in the management interface of FortiTester 2.3.0 through 3.9.1, 4.0.0 through 4.2.0, 7.0.0 through 7.1.0 may allow an authenticated attacker to execute unauthorized commands via specifically crafted arguments to commands of the certificate import feature. Additional Analyst Notes: - CVE Program
a specifically crafted arguments to commands of the certificate import feature. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-22-247
CVE ID: CVE-2022-35845 State: PUBLISHED Published: 2023-01-03T16:57:58.754Z Last Updated: 2024-10-23T14:51:17.532Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:U/RC:C) Vendors: Fortinet Products: FortiTester Problem Types: CWE-78 Description: Multiple improper neutralization of special elements used in an OS Command ('OS Command Injection') vulnerabilities [CWE-78] in FortiTester 7.1.0, 7.0 all versions, 4.0.0 through 4.2.0, 2.3.0 through 3.9.1 may allow an authenticated attacker to execute arbitrary commands in the underlying shell. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-22-
al Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-22-274
CVE ID: CVE-2022-35846 State: PUBLISHED Published: 2022-10-10T00:00:00 Last Updated: 2024-10-25T13:27:31.536Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C) Vendors: Fortinet Products: Fortinet FortiTester Problem Types: Improper access control Description: An improper restriction of excessive authentication attempts vulnerability [CWE-307] in FortiTester Telnet port 2.3.0 through 3.9.1, 4.0.0 through 4.2.0, 7.0.0 through 7.1.0 may allow an unauthenticated attacker to guess the credentials of an admin user via a brute force attack. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR
tional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-22-244
CVE ID: CVE-2022-35847 State: PUBLISHED Published: 2022-09-06T15:15:28 Last Updated: 2024-10-22T20:53:52.298Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:F/RL:U/RC:R) Vendors: Fortinet Products: Fortinet FortiSOAR Problem Types: Execute unauthorized code or commands Description: An improper neutralization of special elements used in a template engine vulnerability [CWE-1336] in FortiSOAR management interface 7.2.0, 7.0.0 through 7.0.3, 6.4.0 through 6.4.4 may allow a remote and authenticated attacker to execute arbitrary code via a crafted payload. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/ps
oad. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-22-306
CVE ID: CVE-2022-35849 State: PUBLISHED Published: 2023-09-13T12:30:04.264Z Last Updated: 2024-10-22T20:59:34.914Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C) Vendors: Fortinet Products: FortiADC Problem Types: CWE-78 Description: An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in the management interface of FortiADC 7.1.0 through 7.1.1, 7.0.0 through 7.0.3, 6.2.0 through 6.2.5 and 6.1.0 all versions may allow an authenticated attacker to execute unauthorized commands via specifically crafted arguments to existing commands. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Reference
ed arguments to existing commands. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-22-310
CVE ID: CVE-2022-35850 State: PUBLISHED Published: 2023-04-11T16:07:22.760Z Last Updated: 2024-10-22T20:46:56.508Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:F/RL:U/RC:C) Vendors: Fortinet Products: FortiAuthenticator Problem Types: CWE-80 Description: An improper neutralization of script-related HTML tags in a web page vulnerability [CWE-80] in FortiAuthenticator versions 6.4.0 through 6.4.4, 6.3.0 through 6.3.3, all versions of 6.2 and 6.1 may allow a remote unauthenticated attacker to trigger a reflected cross site scripting (XSS) attack via the "reset-password" page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - h
a the "reset-password" page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-22-275
CVE ID: CVE-2022-35851 State: PUBLISHED Published: 2022-11-02T00:00:00 Last Updated: 2024-10-25T13:26:57.968Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:F/RL:U/RC:R) Vendors: Fortinet Products: Fortinet FortiADC Problem Types: Execute unauthorized code or commands Description: An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiADC management interface 7.1.0 may allow a remote and authenticated attacker to trigger a stored cross site scripting (XSS) attack via configuring a specially crafted IP Address. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-
ditional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-22-314
CVE ID: CVE-2022-35857 State: PUBLISHED Published: 2022-07-13T21:22:31 Last Updated: 2024-08-03T09:44:22.095Z Vendors: n/a Products: n/a Problem Types: n/a Description: kvf-admin through 2022-02-12 allows remote attackers to execute arbitrary code because deserialization is mishandled. The rememberMe parameter is encrypted with a hardcoded key from the com.kalvin.kvf.common.shiro.ShiroConfig file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/kalvinGit/kvf-admin/issues/16
CVE ID: CVE-2022-35858 State: PUBLISHED Published: 2022-08-04T19:42:37 Last Updated: 2024-08-03T09:44:22.150Z Vendors: n/a Products: n/a Problem Types: n/a Description: The TEE_PopulateTransientObject and __utee_from_attr functions in Samsung mTower 0.3.0 allow a trusted application to trigger a memory overwrite, denial of service, and information disclosure by invoking the function TEE_PopulateTransientObject with a large number in the parameter attrCount. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Samsung/mTower/blob/18f4b592a8a973ce5972f4e2658ea0f6e3686284/tee/lib/libutee/tee_api_objects.c#L283 - https://github.com/Samsung/mTower/issues/71
CVE ID: CVE-2022-35860 State: PUBLISHED Published: 2022-10-19T00:00:00.000Z Last Updated: 2025-05-09T14:25:55.778Z Vendors: n/a Products: n/a Problem Types: n/a Description: Missing AES encryption in Corsair K63 Wireless 3.1.3 allows physically proximate attackers to inject and sniff keystrokes via 2.4 GHz radio transmissions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.corsair.com/us/en/Categories/Products/Gaming-Keyboards/Wireless-Keyboards/K63-Wireless-Mechanical-Gaming-Keyboard-%E2%80%94-Blue-LED-%E2%80%94-CHERRY%C2%AE-MX-Red/p/CH-9145030-NA - http://kth.diva-portal.org/smash/get/diva2:1701492/FULLTEXT01.pdf - http://kth.diva-port
%C2%AE-MX-Red/p/CH-9145030-NA - http://kth.diva-portal.org/smash/get/diva2:1701492/FULLTEXT01.pdf - http://kth.diva-portal.org/smash/record.jsf?pid=diva2%3A1701492&dswid=-3616
CVE ID: CVE-2022-35861 State: PUBLISHED Published: 2022-07-17T16:31:03 Last Updated: 2024-08-03T09:44:22.146Z Vendors: n/a Products: n/a Problem Types: n/a Description: pyenv 1.2.24 through 2.3.2 allows local users to gain privileges via a .python-version file in the current working directory. An attacker can craft a Python version string in .python-version to execute shims under their control. (Shims are executables that pass a command along to a specific version of pyenv. The version string is used to construct the path to the command, and there is no validation of whether the version specified is a valid version. Thus, relative path traversal can occur.) Additional Analyst Notes: - CVE Pr
r the version specified is a valid version. Thus, relative path traversal can occur.) Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pyenv/pyenv/commit/22fa683571d98b59ea16e5fe48ac411c67939653
CVE ID: CVE-2022-35864 State: PUBLISHED Published: 2022-08-03T15:21:39 Last Updated: 2024-08-03T09:44:22.081Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: BMC Products: Track-It! Problem Types: CWE-89 Description: This vulnerability allows remote attackers to disclose sensitive information on affected installations of BMC Track-It! 20.21.02.109. Authentication is required to exploit this vulnerability. The specific flaw exists within the GetPopupSubQueryDetails endpoint. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to disclose stored cre
lied string before using it to construct SQL queries. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-16690. Additional Analyst Notes: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-22-967/ - https://community.bmc.com/s/article/Security-vulnerabilities-patched-in-Track-It-Version-2
CVE ID: CVE-2022-35865 State: PUBLISHED Published: 2022-08-03T15:21:53 Last Updated: 2024-08-03T09:44:22.099Z Severity: HIGH (CVSS 7.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: BMC Products: Track-It! Problem Types: CWE-306 Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of BMC Track-It! 20.21.2.109. Authentication is not required to exploit this vulnerability. The specific flaw exists within the authorization of HTTP requests. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to execute code in the context of the service account. Was
to functionality. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-16709. Additional Analyst Notes: - CVE Program Container: References: - https://community.bmc.com/s/article/Security-vulnerabilities-patched-in-Track-It-Version-2 - https://www.zerodayinitiative.com/advisories/ZDI-22-968/
CVE ID: CVE-2022-35866 State: PUBLISHED Published: 2022-08-03T00:00:00 Last Updated: 2024-11-20T16:17:40.829Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Vinchin Products: Backup and Recovery Problem Types: CWE-798 Description: This vulnerability allows remote attackers to bypass authentication on affected installations of Vinchin Backup and Recovery 6.5.0.17561. Authentication is not required to exploit this vulnerability. The specific flaw exists within the configuration of the MySQL server. The server uses a hard-coded password for the administrator user. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN
the administrator user. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-17139. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-22-959/ - http://seclists.org/fulldisclosure/2024/Jan/30 - http://packetstormsecurity.com/files/176794/Vinchin-Backup-And-Recovery-7.2-Default-MySQL-Credentials.html
CVE ID: CVE-2022-35867 State: PUBLISHED Published: 2022-08-03T15:22:14 Last Updated: 2024-08-03T09:44:22.250Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: xhyve Products: xhyve Problem Types: CWE-121 Description: This vulnerability allows local attackers to escalate privileges on affected installations of xhyve. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the e1000 virtual device. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can le
of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the hypervisor. Was ZDI-CAN-15056. Additional Analyst Notes: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-22-949/
CVE ID: CVE-2022-35868 State: PUBLISHED Published: 2023-02-14T10:36:08.964Z Last Updated: 2024-08-13T07:50:22.699Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: TIA Multiuser Server V14, TIA Multiuser Server V15, TIA Project-Server, TIA Project-Server V16, TIA Project-Server V17 Problem Types: CWE-426 Description: A vulnerability has been identified in TIA Multiuser Server V14 (All versions), TIA Multiuser Server V15 (All versions < V15.1 Update 8), TIA Project-Server (All versions < V1.1), TIA Project-Server V16 (All versions), TIA Project-Server V17 (All versions < V17 Update 6). Affected applications contain an untrusted
er V16 (All versions), TIA Project-Server V17 (All versions < V17 Update 6). Affected applications contain an untrusted search path vulnerability that could allow an attacker to escalate privileges, when tricking a legitimate user to start the service from an attacker controlled path. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-640968.pdf - https://cert-portal.siemens.com/productcert/html/ssa-640968.html
CVE ID: CVE-2022-35869 State: PUBLISHED Published: 2022-07-25T18:16:27 Last Updated: 2024-08-03T09:44:22.094Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: Inductive Automation Products: Ignition Problem Types: CWE-288 Description: This vulnerability allows remote attackers to bypass authentication on affected installations of Inductive Automation Ignition 8.1.15 (b2022030114). Authentication is not required to exploit this vulnerability. The specific flaw exists within com.inductiveautomation.ignition.gateway.web.pages. The issue results from the lack of proper authentication prior to access to functionality. An attacker can leverage this vulnerability to b
rom the lack of proper authentication prior to access to functionality. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-17211. Additional Analyst Notes: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-22-1016/ - https://support.inductiveautomation.com/hc/en-us/articles/7625759776653-Regarding-Pwn2Own-2022-Vulnerabilities
CVE ID: CVE-2022-35870 State: PUBLISHED Published: 2022-07-25T18:16:35 Last Updated: 2024-08-03T09:44:22.285Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Inductive Automation Products: Ignition Problem Types: CWE-502 Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition 8.1.15 (b2022030114). Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within com.inductiveautomation.metro.impl. The issue results from the lack of proper validation of user-supplied data, which can result i
iveautomation.metro.impl. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-17265. Additional Analyst Notes: - CVE Program Container: References: - https://support.inductiveautomation.com/hc/en-us/articles/7625759776653-Regarding-Pwn2Own-2022-Vulnerabilities - https://www.zerodayinitiative.com/advisories/ZDI-22-1017/
CVE ID: CVE-2022-35871 State: PUBLISHED Published: 2022-07-25T18:16:39 Last Updated: 2024-08-03T09:44:22.103Z Severity: HIGH (CVSS 8.1 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Inductive Automation Products: Ignition Problem Types: CWE-306 Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition 8.1.15 (b2022030114). Authentication is not required to exploit this vulnerability. The specific flaw exists within the authenticateAdSso method. The issue results from the lack of authentication prior to allowing the execution of python code. An attacker can leverage this vulnerability to execute code in
ntication prior to allowing the execution of python code. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-17206. Additional Analyst Notes: - CVE Program Container: References: - https://support.inductiveautomation.com/hc/en-us/articles/7625759776653-Regarding-Pwn2Own-2022-Vulnerabilities - https://www.zerodayinitiative.com/advisories/ZDI-22-1018/
CVE ID: CVE-2022-35872 State: PUBLISHED Published: 2022-07-25T18:16:47 Last Updated: 2024-08-03T09:44:22.147Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Inductive Automation Products: Ignition Problem Types: CWE-502 Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition 8.1.15 (b2022030114). User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of ZIP files. The issue results from the lack of proper validation of user-supplied data, which can result i
the parsing of ZIP files. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-17115. Additional Analyst Notes: - CVE Program Container: References: - https://support.inductiveautomation.com/hc/en-us/articles/7625759776653-Regarding-Pwn2Own-2022-Vulnerabilities - https://www.zerodayinitiative.com/advisories/ZDI-22-1019/
CVE ID: CVE-2022-35873 State: PUBLISHED Published: 2022-07-25T18:17:01 Last Updated: 2024-08-03T09:44:22.090Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Inductive Automation Products: Ignition Problem Types: CWE-356 Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition 8.1.15 (b2022030114). User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of ZIP files. Crafted data in a ZIP file can cause the application to execute arbitrary Python scripts. T
the processing of ZIP files. Crafted data in a ZIP file can cause the application to execute arbitrary Python scripts. The user interface fails to provide sufficient indication of the hazard. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-16949. Additional Analyst Notes: - CVE Program Container: References: - https://support.inductiveautomation.com/hc/en-us/articles/7625759776653-Regarding-Pwn2Own-2022-Vulnerabilities - https://www.zerodayinitiative.com/advisories/ZDI-22-1020/
CVE ID: CVE-2022-35874 State: PUBLISHED Published: 2022-10-25T16:34:13.296Z Last Updated: 2025-04-15T18:43:28.700Z Severity: HIGH (CVSS 8.2 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H) Vendors: abode systems, inc. Products: iota All-In-One Security Kit Problem Types: CWE-134 Description: Four format string injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. Specially-crafted configuration values can lead to memory corruption, information disclosure and denial of service. An attacker can modify a configuration value and then execute an XCMD to trigger these vulnerabilities.This vulnerability arises from forma
ify a configuration value and then execute an XCMD to trigger these vulnerabilities.This vulnerability arises from format string injection via the `ssid` and `ssid_hex` configuration parameters, as used within the `testWifiAP` XCMD handler Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2022-1581
CVE ID: CVE-2022-35875 State: PUBLISHED Published: 2022-10-25T16:34:14.376Z Last Updated: 2025-04-15T18:43:18.131Z Severity: HIGH (CVSS 8.2 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H) Vendors: abode systems, inc. Products: iota All-In-One Security Kit Problem Types: CWE-134 Description: Four format string injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. Specially-crafted configuration values can lead to memory corruption, information disclosure and denial of service. An attacker can modify a configuration value and then execute an XCMD to trigger these vulnerabilities.This vulnerability arises from forma
ify a configuration value and then execute an XCMD to trigger these vulnerabilities.This vulnerability arises from format string injection via the `wpapsk` configuration parameter, as used within the `testWifiAP` XCMD handler Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2022-1581
CVE ID: CVE-2022-35876 State: PUBLISHED Published: 2022-10-25T16:34:15.364Z Last Updated: 2025-04-15T18:43:08.175Z Severity: HIGH (CVSS 8.2 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H) Vendors: abode systems, inc. Products: iota All-In-One Security Kit Problem Types: CWE-134 Description: Four format string injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. Specially-crafted configuration values can lead to memory corruption, information disclosure and denial of service. An attacker can modify a configuration value and then execute an XCMD to trigger these vulnerabilities.This vulnerability arises from forma