Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-26593 State: PUBLISHED Published: 2022-04-19T12:46:15 Last Updated: 2024-08-03T05:03:33.251Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Asset module's asset categories selector in Liferay Portal 7.3.3 through 7.4.0, and Liferay DXP 7.3 before service pack 3 allows remote attackers to inject arbitrary web script or HTML via the name of a asset category. Additional Analyst Notes: - CVE Program Container: References: - http://liferay.com - https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-26593-stored-xss-with-category-name-in-asset-categories-selector
CVE ID: CVE-2022-26594 State: PUBLISHED Published: 2022-04-15T15:50:26 Last Updated: 2024-08-03T05:03:32.874Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.3.5 through 7.4.0, and Liferay DXP 7.3 before service pack 3 allow remote attackers to inject arbitrary web script or HTML via a form field's help text to (1) Forms module's form builder, or (2) App Builder module's object form view's form builder. Additional Analyst Notes: - CVE Program Container: References: - http://liferay.com - https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-26594-xss-vu
s://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-26594-xss-vulnerability-with-form-field-help-text
CVE ID: CVE-2022-26595 State: PUBLISHED Published: 2022-04-19T12:52:20 Last Updated: 2024-08-03T05:03:33.282Z Vendors: n/a Products: n/a Problem Types: n/a Description: Liferay Portal 7.3.7, 7.4.0, and 7.4.1, and Liferay DXP 7.2 fix pack 13, and 7.3 fix pack 2 does not properly check user permission when accessing a list of sites/groups, which allows remote authenticated users to view sites/groups via the user's site membership assignment UI. Additional Analyst Notes: - CVE Program Container: References: - http://liferay.com - https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-26595-unauthorized-access-to-site-group-list
CVE ID: CVE-2022-26596 State: PUBLISHED Published: 2022-04-25T15:41:28 Last Updated: 2024-08-03T05:03:32.954Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Journal module's web content display configuration page in Liferay Portal 7.1.0 through 7.3.3, and Liferay DXP 7.0 before fix pack 94, 7.1 before fix pack 19, and 7.2 before fix pack 8, allows remote attackers to inject arbitrary web script or HTML via web content template names. Additional Analyst Notes: - CVE Program Container: References: - http://liferay.com
CVE ID: CVE-2022-26597 State: PUBLISHED Published: 2022-04-25T15:02:53 Last Updated: 2024-08-03T05:11:42.693Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Layout module's Open Graph integration in Liferay Portal 7.3.0 through 7.4.0, and Liferay DXP 7.3 before service pack 3 allows remote attackers to inject arbitrary web script or HTML via the site name. Additional Analyst Notes: - CVE Program Container: References: - http://liferay.com
CVE ID: CVE-2022-26605 State: PUBLISHED Published: 2022-04-06T20:14:36 Last Updated: 2024-08-03T05:11:43.332Z Vendors: n/a Products: n/a Problem Types: n/a Description: eZiosuite v2.0.7 contains an authenticated arbitrary file upload via the Avatar upload functionality. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Chu1z1/Chuizi/issues/1
CVE ID: CVE-2022-26607 State: PUBLISHED Published: 2022-04-06T20:29:48 Last Updated: 2024-08-03T05:11:42.690Z Vendors: n/a Products: n/a Problem Types: n/a Description: A remote code execution (RCE) vulnerability in baigo CMS v3.0-alpha-2 was discovered to allow attackers to execute arbitrary code via uploading a crafted PHP file. Additional Analyst Notes: - CVE Program Container: References: - http://baigocms.com - https://github.com/baigoStudio/baigoCMS/ - https://github.com/baigoStudio/baigoCMS/issues/9
CVE ID: CVE-2022-26612 State: PUBLISHED Published: 2022-04-07T18:20:12 Last Updated: 2024-08-03T05:11:43.529Z Vendors: Apache Software Foundation Products: Apache Hadoop Problem Types: unpackEntries during TAR extraction follows symbolic links which allows writing outside expected base directory on Windows Description: In Apache Hadoop, The unTar function uses unTarUsingJava function on Windows and the built-in tar utility on Unix and other OSes. As a result, a TAR entry may create a symlink under the expected extraction directory which points to an external directory. A subsequent TAR entry may extract an arbitrary file into the external directory using the symlink name. This however would
bsequent TAR entry may extract an arbitrary file into the external directory using the symlink name. This however would be caught by the same targetDirPath check on Unix because of the getCanonicalPath call. However on Windows, getCanonicalPath doesn't resolve symbolic links, which bypasses the check. unpackEntries during TAR extraction follows symbolic links which allows writing outside expected base directory on Windows. This was addressed in Apache Hadoop 3.2.3 Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread/hslo7wzw2449gv1jyjk8g6ttd7935fyz - https://security.netapp.com/advisory/ntap-20220519-0004/
CVE ID: CVE-2022-26613 State: PUBLISHED Published: 2022-04-06T20:55:28 Last Updated: 2024-08-03T05:11:42.711Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP-CMS v1.0 was discovered to contain a SQL injection vulnerability via the category parameter in categorymenu.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/harshitbansal373/PHP-CMS/issues/14 - https://github.com/harshitbansal373/PHP-CMS/issues/15 - https://github.com/nu11secur1ty/CVE-mitre/tree/main/2022/CVE-2022-26613
CVE ID: CVE-2022-26615 State: PUBLISHED Published: 2022-04-05T01:18:42 Last Updated: 2024-08-03T05:11:42.696Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in College Website Content Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the User Profile Name text fields. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nsparker1337/OpenSource/blob/main/exploit_xss_cwms
CVE ID: CVE-2022-26616 State: PUBLISHED Published: 2022-04-04T12:24:13 Last Updated: 2024-08-03T05:11:42.693Z Vendors: n/a Products: n/a Problem Types: n/a Description: PKP Vendor Open Journal System v2.4.8 to v3.3.8 allows attackers to perform reflected cross-site scripting (XSS) attacks via crafted HTTP headers. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pkp/pkp-lib/issues/7649 - https://forum.pkp.sfu.ca/t/ojs-omp-ops-3-3-0-9-released/72236
CVE ID: CVE-2022-26619 State: PUBLISHED Published: 2022-04-05T00:49:49 Last Updated: 2024-08-03T05:11:42.687Z Vendors: n/a Products: n/a Problem Types: n/a Description: Halo Blog CMS v1.4.17 was discovered to allow attackers to upload arbitrary files via the Attachment Upload function. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/halo-dev/halo/issues/1702
CVE ID: CVE-2022-26620 State: REJECTED Published: 2022-03-26T23:39:15 Last Updated: 2022-03-27T12:54:35 Description: No description available.
CVE ID: CVE-2022-26624 State: PUBLISHED Published: 2022-04-08T08:23:33 Last Updated: 2024-08-03T05:11:43.552Z Vendors: n/a Products: n/a Problem Types: n/a Description: Bootstrap v3.1.11 and v3.3.7 was discovered to contain a cross-site scripting (XSS) vulnerability via the Title parameter in /vendor/views/add_product.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/kirilkirkov/Ecommerce-CodeIgniter-Bootstrap/blob/master/application/modules/vendor/views/add_product.php#L35 - https://drive.google.com/file/d/1Dp0dD9PNcwamjRi0ldD0hUOEivu48SR6/view?usp=sharing
CVE ID: CVE-2022-26627 State: PUBLISHED Published: 2022-04-07T14:24:48 Last Updated: 2024-08-03T05:11:43.280Z Vendors: n/a Products: n/a Problem Types: n/a Description: Online Project Time Management System v1.0 was discovered to contain an arbitrary file write vulnerability which allows attackers to execute arbitrary code via a crafted HTML file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/qerogram/BUG_WEB/tree/main/OpenSource/PTMS
CVE ID: CVE-2022-26628 State: PUBLISHED Published: 2022-04-05T19:03:00 Last Updated: 2024-08-03T05:11:43.327Z Vendors: n/a Products: n/a Problem Types: n/a Description: Matrimony v1.0 was discovered to contain a SQL injection vulnerability via the Password parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/vetbossel.in/2022/Matrimony
CVE ID: CVE-2022-26629 State: PUBLISHED Published: 2022-03-24T16:00:37 Last Updated: 2024-08-03T05:11:43.592Z Vendors: n/a Products: n/a Problem Types: n/a Description: An Access Control vulnerability exists in SoroushPlus+ Messenger 1.0.30 in the Lock Screen Security Feature function due to insufficient permissions and privileges, which allows a malicious attacker bypass the lock screen function. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sysenter-eip/CVE-2022-26629
CVE ID: CVE-2022-26630 State: PUBLISHED Published: 2022-04-05T18:01:11 Last Updated: 2024-08-03T05:11:43.325Z Vendors: n/a Products: n/a Problem Types: n/a Description: Jellycms v3.8.1 and below was discovered to contain an arbitrary file upload vulnerability via \app.\admin\Controllers\db.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/guodongtech/jellycms/issues/1
CVE ID: CVE-2022-26631 State: PUBLISHED Published: 2022-04-18T13:18:14 Last Updated: 2024-08-03T05:11:43.540Z Vendors: n/a Products: n/a Problem Types: n/a Description: Automatic Question Paper Generator v1.0 contains a Time-Based Blind SQL injection vulnerability via the id GET parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.sourcecodester.com/php/15190/automatic-question-paper-generator-system-phpoop-free-source-code.html - https://github.com/Cyb3rR3ap3r/CVE-2022-26631
CVE ID: CVE-2022-26632 State: PUBLISHED Published: 2022-05-20T12:47:58 Last Updated: 2024-08-03T05:11:43.343Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multi-Vendor Online Groceries Management System v1.0 was discovered to contain a blind SQL injection vulnerability via the id parameter in /products/view_product.php. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/50739
CVE ID: CVE-2022-26633 State: PUBLISHED Published: 2022-05-20T12:47:59 Last Updated: 2024-08-03T05:11:43.688Z Vendors: n/a Products: n/a Problem Types: n/a Description: Simple Student Quarterly Result/Grade System v1.0 was discovered to contain a SQL injection vulnerability via /sqgs/Actions.php. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/50740
CVE ID: CVE-2022-26634 State: PUBLISHED Published: 2022-05-20T12:47:59 Last Updated: 2024-08-03T05:11:42.712Z Vendors: n/a Products: n/a Problem Types: n/a Description: HMA VPN v5.3.5913.0 contains an unquoted service path which allows attackers to escalate privileges to the system level. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/50765 - https://cxsecurity.com/issue/WLB-2022020111
CVE ID: CVE-2022-26635 State: PUBLISHED Published: 2022-04-05T17:00:33 Last Updated: 2024-08-03T05:11:43.291Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP-Memcached v2.2.0 and below contains an improper NULL termination which allows attackers to execute CLRF injection. Note: Third parties have disputed this as not affecting PHP-Memcached directly. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://xhzeem.me/posts/Php5-memcached-Injection-Bypass/read/ - https://github.com/php-memcached-dev/php-memcached/issues/519
CVE ID: CVE-2022-26639 State: PUBLISHED Published: 2022-03-28T22:42:46 Last Updated: 2024-08-03T05:11:42.702Z Vendors: n/a Products: n/a Problem Types: n/a Description: TP-LINK TL-WR840N(ES)_V6.20 was discovered to contain a buffer overflow via the DNSServers parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Quadron-Research-Lab/Hardware-IoT/blob/main/tp-link%20tl-wr840n_DNSServers%3D.pdf
CVE ID: CVE-2022-26640 State: PUBLISHED Published: 2022-03-28T22:42:46 Last Updated: 2024-08-03T05:11:43.955Z Vendors: n/a Products: n/a Problem Types: n/a Description: TP-LINK TL-WR840N(ES)_V6.20 was discovered to contain a buffer overflow via the minAddress parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Quadron-Research-Lab/Hardware-IoT/blob/main/tp-link%20tl-wr840n_minAddress%3D.pdf
CVE ID: CVE-2022-26641 State: PUBLISHED Published: 2022-03-28T22:42:47 Last Updated: 2024-08-03T05:11:44.043Z Vendors: n/a Products: n/a Problem Types: n/a Description: TP-LINK TL-WR840N(ES)_V6.20 was discovered to contain a buffer overflow via the httpRemotePort parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Quadron-Research-Lab/Hardware-IoT/blob/main/tp-link%20tl-wr840n_httpRemotePort%3D.pdf
CVE ID: CVE-2022-26642 State: PUBLISHED Published: 2022-03-28T22:42:47 Last Updated: 2024-08-03T05:11:43.390Z Vendors: n/a Products: n/a Problem Types: n/a Description: TP-LINK TL-WR840N(ES)_V6.20 was discovered to contain a buffer overflow via the X_TP_ClonedMACAddress parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Quadron-Research-Lab/Hardware-IoT/blob/main/tp-link%20tl-wr840n_X_TP_ClonedMACAddress%3D.pdf
CVE ID: CVE-2022-26643 State: PUBLISHED Published: 2022-04-13T13:28:18 Last Updated: 2024-08-03T05:11:43.351Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in EasyIO CPT Graphics v0.8 allows attackers to discover valid users in the application. Additional Analyst Notes: - CVE Program Container: References: - http://cpt.com - http://easyio.com - https://gist.github.com/rvismit/3fd33b47a753e1b7065421f42b2dd496
CVE ID: CVE-2022-26644 State: PUBLISHED Published: 2022-03-30T22:51:04 Last Updated: 2024-08-03T05:11:44.266Z Vendors: n/a Products: n/a Problem Types: n/a Description: Online Banking System Protect v1.0 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities via parameters on user profile, system_info and accounts management. Additional Analyst Notes: - CVE Program Container: References: - http://online.com - https://github.com/erik-451/CVE/tree/main/CVE-2022-26644
CVE ID: CVE-2022-26645 State: PUBLISHED Published: 2022-03-30T22:23:47 Last Updated: 2024-08-03T05:11:43.554Z Vendors: n/a Products: n/a Problem Types: n/a Description: A remote code execution (RCE) vulnerability in Online Banking System Protect v1.0 allows attackers to execute arbitrary code via a crafted PHP file uploaded through the Upload Image function. Additional Analyst Notes: - CVE Program Container: References: - http://online.com - https://github.com/erik-451/CVE/tree/main/CVE-2022-26645
CVE ID: CVE-2022-26646 State: PUBLISHED Published: 2022-03-30T22:47:20 Last Updated: 2024-08-03T05:11:43.321Z Vendors: n/a Products: n/a Problem Types: n/a Description: Online Banking System Protect v1.0 was discovered to contain a local file inclusion (LFI) vulnerability via the pages parameter. Additional Analyst Notes: - CVE Program Container: References: - http://online.com - https://github.com/erik-451/CVE/blob/main/CVE-2022-26646/README.md
CVE ID: CVE-2022-26647 State: PUBLISHED Published: 2022-07-12T10:06:32.000Z Last Updated: 2025-04-21T13:52:17.065Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: SCALANCE X200-4P IRT, SCALANCE X201-3P IRT, SCALANCE X201-3P IRT PRO, SCALANCE X202-2IRT, SCALANCE X202-2P IRT, SCALANCE X202-2P IRT PRO, SCALANCE X204-2, SCALANCE X204-2FM, SCALANCE X204-2LD, SCALANCE X204-2LD TS, SCALANCE X204-2TS, SCALANCE X204IRT, SCALANCE X204IRT PRO, SCALANCE X206-1, SCALANCE X206-1LD, SCALANCE X208, SCALANCE X208PRO, SCALANCE X212-2, SCALANCE X212-2LD, SCALANCE X216, SCALANCE X224, SCALANCE XF201-3P IRT, SCALANCE XF202-2P IRT, SCALANCE XF204, SC
212-2, SCALANCE X212-2LD, SCALANCE X216, SCALANCE X224, SCALANCE XF201-3P IRT, SCALANCE XF202-2P IRT, SCALANCE XF204, SCALANCE XF204-2, SCALANCE XF204-2BA IRT, SCALANCE XF204IRT, SCALANCE XF206-1, SCALANCE XF208 Problem Types: CWE-330 Description: A vulnerability has been identified in SCALANCE X200-4P IRT (All versions < V5.5.2), SCALANCE X201-3P IRT (All versions < V5.5.2), SCALANCE X201-3P IRT PRO (All versions < V5.5.2), SCALANCE X202-2IRT (All versions < V5.5.2), SCALANCE X202-2IRT (All versions < V5.5.2), SCALANCE X202-2P IRT (All versions < V5.5.2), SCALANCE X202-2P IRT PRO (All versions < V5.5.2), SCALANCE X204-2 (All versions < V5.2.6), SCALANCE X204-2FM (All versions < V5.2.6), SCA
IRT PRO (All versions < V5.5.2), SCALANCE X204-2 (All versions < V5.2.6), SCALANCE X204-2FM (All versions < V5.2.6), SCALANCE X204-2LD (All versions < V5.2.6), SCALANCE X204-2LD TS (All versions < V5.2.6), SCALANCE X204-2TS (All versions < V5.2.6), SCALANCE X204IRT (All versions < V5.5.2), SCALANCE X204IRT (All versions < V5.5.2), SCALANCE X204IRT PRO (All versions < V5.5.2), SCALANCE X206-1 (All versions < V5.2.6), SCALANCE X206-1LD (All versions < V5.2.6), SCALANCE X208 (All versions < V5.2.6), SCALANCE X208PRO (All versions < V5.2.6), SCALANCE X212-2 (All versions < V5.2.6), SCALANCE X212-2LD (All versions < V5.2.6), SCALANCE X216 (All versions < V5.2.6), SCALANCE X224 (All versions < V5.
.6), SCALANCE X212-2LD (All versions < V5.2.6), SCALANCE X216 (All versions < V5.2.6), SCALANCE X224 (All versions < V5.2.6), SCALANCE XF201-3P IRT (All versions < V5.5.2), SCALANCE XF202-2P IRT (All versions < V5.5.2), SCALANCE XF204 (All versions < V5.2.6), SCALANCE XF204-2 (All versions < V5.2.6), SCALANCE XF204-2BA IRT (All versions < V5.5.2), SCALANCE XF204IRT (All versions < V5.5.2), SCALANCE XF206-1 (All versions < V5.2.6), SCALANCE XF208 (All versions < V5.2.6). The webserver of affected devices calculates session ids and nonces in an insecure manner. This could allow an unauthenticated remote attacker to brute-force session ids and hijack existing sessions. Additional Analyst Notes:
ow an unauthenticated remote attacker to brute-force session ids and hijack existing sessions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-310038.pdf
CVE ID: CVE-2022-26648 State: PUBLISHED Published: 2022-07-12T10:06:34.000Z Last Updated: 2025-04-21T13:52:07.405Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: SCALANCE X200-4P IRT, SCALANCE X201-3P IRT, SCALANCE X201-3P IRT PRO, SCALANCE X202-2IRT, SCALANCE X202-2P IRT, SCALANCE X202-2P IRT PRO, SCALANCE X204-2, SCALANCE X204-2FM, SCALANCE X204-2LD, SCALANCE X204-2LD TS, SCALANCE X204-2TS, SCALANCE X204IRT, SCALANCE X204IRT PRO, SCALANCE X206-1, SCALANCE X206-1LD, SCALANCE X208, SCALANCE X208PRO, SCALANCE X212-2, SCALANCE X212-2LD, SCALANCE X216, SCALANCE X224, SCALANCE XF201-3P IRT, SCALANCE XF202-2P IRT, SCALANCE XF204, SC
212-2, SCALANCE X212-2LD, SCALANCE X216, SCALANCE X224, SCALANCE XF201-3P IRT, SCALANCE XF202-2P IRT, SCALANCE XF204, SCALANCE XF204-2, SCALANCE XF204-2BA IRT, SCALANCE XF204IRT, SCALANCE XF206-1, SCALANCE XF208 Problem Types: CWE-120 Description: A vulnerability has been identified in SCALANCE X200-4P IRT (All versions < V5.5.2), SCALANCE X201-3P IRT (All versions < V5.5.2), SCALANCE X201-3P IRT PRO (All versions < V5.5.2), SCALANCE X202-2IRT (All versions < V5.5.2), SCALANCE X202-2IRT (All versions < V5.5.2), SCALANCE X202-2P IRT (All versions < V5.5.2), SCALANCE X202-2P IRT PRO (All versions < V5.5.2), SCALANCE X204-2 (All versions < V5.2.6), SCALANCE X204-2FM (All versions < V5.2.6), SCA
.6), SCALANCE X212-2LD (All versions < V5.2.6), SCALANCE X216 (All versions < V5.2.6), SCALANCE X224 (All versions < V5.2.6), SCALANCE XF201-3P IRT (All versions < V5.5.2), SCALANCE XF202-2P IRT (All versions < V5.5.2), SCALANCE XF204 (All versions < V5.2.6), SCALANCE XF204-2 (All versions < V5.2.6), SCALANCE XF204-2BA IRT (All versions < V5.5.2), SCALANCE XF204IRT (All versions < V5.5.2), SCALANCE XF206-1 (All versions < V5.2.6), SCALANCE XF208 (All versions < V5.2.6). Affected devices do not properly validate the GET parameter XNo of incoming HTTP requests. This could allow an unauthenticated remote attacker to crash affected devices. Additional Analyst Notes: - CVE Program Container: - CI
ow an unauthenticated remote attacker to crash affected devices. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-310038.pdf
CVE ID: CVE-2022-26649 State: PUBLISHED Published: 2022-07-12T10:06:35.000Z Last Updated: 2025-04-21T13:51:58.286Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: SCALANCE X200-4P IRT, SCALANCE X201-3P IRT, SCALANCE X201-3P IRT PRO, SCALANCE X202-2IRT, SCALANCE X202-2P IRT, SCALANCE X202-2P IRT PRO, SCALANCE X204-2, SCALANCE X204-2FM, SCALANCE X204-2LD, SCALANCE X204-2LD TS, SCALANCE X204-2TS, SCALANCE X204IRT, SCALANCE X204IRT PRO, SCALANCE X206-1, SCALANCE X206-1LD, SCALANCE X208, SCALANCE X208PRO, SCALANCE X212-2, SCALANCE X212-2LD, SCALANCE X216, SCALANCE X224, SCALANCE XF201-3P IRT, SCALANCE XF202-2P IRT, SCALANCE XF204
CE X212-2, SCALANCE X212-2LD, SCALANCE X216, SCALANCE X224, SCALANCE XF201-3P IRT, SCALANCE XF202-2P IRT, SCALANCE XF204, SCALANCE XF204-2, SCALANCE XF204-2BA IRT, SCALANCE XF204IRT, SCALANCE XF206-1, SCALANCE XF208 Problem Types: CWE-120 Description: A vulnerability has been identified in SCALANCE X200-4P IRT (All versions < V5.5.2), SCALANCE X201-3P IRT (All versions < V5.5.2), SCALANCE X201-3P IRT PRO (All versions < V5.5.2), SCALANCE X202-2IRT (All versions < V5.5.2), SCALANCE X202-2IRT (All versions < V5.5.2), SCALANCE X202-2P IRT (All versions < V5.5.2), SCALANCE X202-2P IRT PRO (All versions < V5.5.2), SCALANCE X204-2 (All versions < V5.2.6), SCALANCE X204-2FM (All versions < V5.2.6),
-2P IRT PRO (All versions < V5.5.2), SCALANCE X204-2 (All versions < V5.2.6), SCALANCE X204-2FM (All versions < V5.2.6), SCALANCE X204-2LD (All versions < V5.2.6), SCALANCE X204-2LD TS (All versions < V5.2.6), SCALANCE X204-2TS (All versions < V5.2.6), SCALANCE X204IRT (All versions < V5.5.2), SCALANCE X204IRT (All versions < V5.5.2), SCALANCE X204IRT PRO (All versions < V5.5.2), SCALANCE X206-1 (All versions < V5.2.6), SCALANCE X206-1LD (All versions < V5.2.6), SCALANCE X208 (All versions < V5.2.6), SCALANCE X208PRO (All versions < V5.2.6), SCALANCE X212-2 (All versions < V5.2.6), SCALANCE X212-2LD (All versions < V5.2.6), SCALANCE X216 (All versions < V5.2.6), SCALANCE X224 (All versions <
V5.2.6), SCALANCE X212-2LD (All versions < V5.2.6), SCALANCE X216 (All versions < V5.2.6), SCALANCE X224 (All versions < V5.2.6), SCALANCE XF201-3P IRT (All versions < V5.5.2), SCALANCE XF202-2P IRT (All versions < V5.5.2), SCALANCE XF204 (All versions < V5.2.6), SCALANCE XF204-2 (All versions < V5.2.6), SCALANCE XF204-2BA IRT (All versions < V5.5.2), SCALANCE XF204IRT (All versions < V5.5.2), SCALANCE XF206-1 (All versions < V5.2.6), SCALANCE XF208 (All versions < V5.2.6). Affected devices do not properly validate the URI of incoming HTTP GET requests. This could allow an unauthenticated remote attacker to crash affected devices. Additional Analyst Notes: - CVE Program Container: - CISA ADP