Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-41642 State: PUBLISHED Published: 2022-12-05T00:00:00.000Z Last Updated: 2025-04-24T14:32:55.446Z Vendors: kujirahand Products: Nadesiko3 (PC Version) Problem Types: OS Command Injection Description: OS command injection vulnerability in Nadesiko3 (PC Version) v3.3.61 and earlier allows a remote attacker to execute an arbitrary OS command when processing compression and decompression on the product. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/kujirahand/nadesiko3/issues/1325 - https://github.com/kujirahand/nadesiko3/issues/1347 - https://jvn.jp/en/jp/JVN56968681/index.html
CVE ID: CVE-2022-41643 State: PUBLISHED Published: 2022-11-18T22:21:00.915754Z Last Updated: 2024-09-16T20:21:25.533Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: Octa Code Products: Accessibility (WordPress plugin) Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Accessibility plugin <= 1.0.3 on WordPress. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/accessibility/wordpress-accessibility-plugin-1-0-1-auth-stored-cross-site-scripting-xss-vulnerability?_s_id=cve - https://wordpress.org/plugins/accessibility/#developers
CVE ID: CVE-2022-41644 State: PUBLISHED Published: 2022-10-31T19:47:21.832Z Last Updated: 2025-04-16T17:43:36.141Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Delta Electronics Products: InfraSuite Device Master Problem Types: CWE-306 Description: Delta Electronics InfraSuite Device Master versions 00.00.01a and prior lacks authentication for a function that changes group privileges. An attacker could use this to create a denial-of-service state or escalate their own privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-298-07
CVE ID: CVE-2022-41645 State: PUBLISHED Published: 2023-01-03T00:00:00.000Z Last Updated: 2025-04-10T17:05:49.343Z Vendors: FUJI ELECTRIC CO., LTD. and Hakko Electronics Co., Ltd. Products: V-Server Problem Types: Out-of-bounds Read Description: Out-of-bounds read vulnerability in V-Server v4.0.12.0 and earlier allows a local attacker to obtain the information and/or execute arbitrary code by having a user to open a specially crafted project file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://monitouch.fujielectric.com/site/download-e/03tellus_inf/index.php - https://jvn.jp/en/vu/JVNVU92811888/index.html
CVE ID: CVE-2022-41646 State: PUBLISHED Published: 2023-05-10T13:16:53.379Z Last Updated: 2025-01-27T18:07:00.168Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: n/a Products: Intel(R) IPP Cryptography software Problem Types: information disclosure, CWE-691 Description: Insufficient control flow management in the Intel(R) IPP Cryptography software before version 2021.6 may allow an unauthenticated user to potentially enable information disclosure via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00788.html
CVE ID: CVE-2022-41648 State: PUBLISHED Published: 2022-10-28T17:09:41.162Z Last Updated: 2025-10-13T12:09:37.939Z Vendors: HEIDENHAIN Products: HEIDENHAIN Controller TNC 640 NC Software Problem Types: CWE-1188 Description: The HEIDENHAIN Controller TNC 640 NC software Version 340590 07 SP5, is vulnerable to improper authentication in its DNC communication for CNC machines. Authentication is not enabled by default for DNC communication. This vulnerability may allow an attacker to deny service on the production line, steal sensitive data from the production line, and alter any products created by the production line. Note: CNC machines running the TNC 640 controller require DNC to be enabled
ny products created by the production line. Note: CNC machines running the TNC 640 controller require DNC to be enabled for DNC communication to be present. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-22-298-02
CVE ID: CVE-2022-41649 State: PUBLISHED Published: 2022-12-23T23:03:51.372Z Last Updated: 2025-04-15T14:29:40.594Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: OpenImageIO Project Products: OpenImageIO Problem Types: CWE-125 Description: A heap out of bounds read vulnerability exists in the handling of IPTC data while parsing TIFF images in OpenImageIO v2.3.19.0. A specially-crafted TIFF file can cause a read of adjacent heap memory, which can leak sensitive process information. An attacker can provide a malicious file to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintell
erability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2022-1631 - https://www.debian.org/security/2023/dsa-5384 - https://security.gentoo.org/glsa/202305-33 - https://lists.debian.org/debian-lts-announce/2023/08/msg00005.html
CVE ID: CVE-2022-41651 State: PUBLISHED Published: 2022-10-27T20:15:39.114Z Last Updated: 2025-04-16T17:44:44.667Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N) Vendors: Delta Electronics Products: DIAEnergie Problem Types: CWE-79 Description: The affected product DIAEnergie (versions prior to v1.9.01.002) is vulnerable to a stored cross-site scripting vulnerability through the SetPF API. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-298-06
CVE ID: CVE-2022-41652 State: PUBLISHED Published: 2022-11-18T18:32:08.699Z Last Updated: 2025-02-20T19:53:04.472Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: ExpressTech Products: Quiz And Survey Master (WordPress plugin) Problem Types: Bypass Description: Bypass vulnerability in Quiz And Survey Master plugin <= 7.3.10 on WordPress. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/quiz-master-next/wordpress-quiz-and-survey-master-plugin-7-3-10-bypass-vulnerability?_s_id=cve
CVE ID: CVE-2022-41653 State: PUBLISHED Published: 2022-12-13T21:08:36.871Z Last Updated: 2025-04-16T16:05:02.144Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Daikin Products: SVMPC1 , SVMPC2 Problem Types: CWE-259 Description: Daikin SVMPC1 version 2.1.22 and prior and SVMPC2 version 1.2.3 and prior are vulnerable to an attacker obtaining user login credentials and control the system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-284-02
CVE ID: CVE-2022-41654 State: PUBLISHED Published: 2022-12-23T23:03:51.372Z Last Updated: 2025-04-14T18:08:15.772Z Severity: CRITICAL (CVSS 9.6 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: Ghost Foundation Products: Ghost Problem Types: CWE-284 Description: An authentication bypass vulnerability exists in the newsletter subscription functionality of Ghost Foundation Ghost 5.9.4. A specially-crafted HTTP request can lead to increased privileges. An attacker can send an HTTP request to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2022-1624 - https://githu
CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2022-1624 - https://github.com/TryGhost/Ghost/security/advisories/GHSA-9gh8-wp53-ccc6
CVE ID: CVE-2022-41655 State: PUBLISHED Published: 2022-11-18T22:22:13.793Z Last Updated: 2025-02-20T19:50:28.500Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: AlgolPlus Products: Phone Orders for WooCommerce (WordPress plugin) Problem Types: CWE-200 Description: Auth. (subscriber+) Sensitive Data Exposure vulnerability in Phone Orders for WooCommerce plugin <= 3.7.1 on WordPress. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/phone-orders-for-woocommerce/wordpress-phone-orders-for-woocommerce-plugin-3-7-1-auth-sensitive-data-exposure-vulnerability?_s_id=cve - https:/
merce/wordpress-phone-orders-for-woocommerce-plugin-3-7-1-auth-sensitive-data-exposure-vulnerability?_s_id=cve - https://wordpress.org/plugins/phone-orders-for-woocommerce/#developers
CVE ID: CVE-2022-41657 State: PUBLISHED Published: 2022-10-31T19:24:37.976Z Last Updated: 2025-04-16T16:06:59.095Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Delta Electronics Products: InfraSuite Device Master Problem Types: CWE-22 Description: Delta Electronics InfraSuite Device Master Versions 00.00.01a and prior allow attacker provided data already serialized into memory to be used in file operation application programmable interfaces (APIs). This could create arbitrary files, which could be used in API operations and could ultimately result in remote code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Refer
ately result in remote code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-298-07
CVE ID: CVE-2022-41658 State: PUBLISHED Published: 2023-05-10T13:16:38.556Z Last Updated: 2025-01-27T18:11:52.240Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) VTune(TM) Profiler software Problem Types: escalation of privilege, CWE-277 Description: Insecure inherited permissions in the Intel(R) VTune(TM) Profiler software before version 2023.0 may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00771.html
CVE ID: CVE-2022-41659 State: PUBLISHED Published: 2023-11-14T19:04:37.885Z Last Updated: 2024-08-03T12:49:43.467Z Severity: LOW (CVSS 1.9 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L) Vendors: n/a Products: Intel Unison software Problem Types: denial of service, CWE-284 Description: Improper access control for some Intel Unison software may allow a privileged user to potentially enable denial of service via local access. Additional Analyst Notes: - CVE Program Container: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00963.html
CVE ID: CVE-2022-41660 State: PUBLISHED Published: 2022-11-08T00:00:00.000Z Last Updated: 2025-04-21T13:47:05.532Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: JT2Go, Teamcenter Visualization V13.2, Teamcenter Visualization V13.3, Teamcenter Visualization V14.0, Teamcenter Visualization V14.1 Problem Types: CWE-787 Description: A vulnerability has been identified in JT2Go (All versions < V14.1.0.4), Teamcenter Visualization V13.2 (All versions < V13.2.0.12), Teamcenter Visualization V13.3 (All versions < V13.3.0.7), Teamcenter Visualization V14.0 (All versions < V14.0.0.3), Teamcenter Visualization V14.1 (All versions < V14.1
.3.0.7), Teamcenter Visualization V14.0 (All versions < V14.0.0.3), Teamcenter Visualization V14.1 (All versions < V14.1.0.4). The affected products contain an out of bounds write vulnerability when parsing a CGM file. An attacker can leverage this vulnerability to execute code in the context of the current process. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-120378.pdf
CVE ID: CVE-2022-41661 State: PUBLISHED Published: 2022-11-08T00:00:00.000Z Last Updated: 2025-04-21T13:46:57.615Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: JT2Go, Teamcenter Visualization V13.2, Teamcenter Visualization V13.3, Teamcenter Visualization V14.0, Teamcenter Visualization V14.1 Problem Types: CWE-125 Description: A vulnerability has been identified in JT2Go (All versions < V14.1.0.4), Teamcenter Visualization V13.2 (All versions < V13.2.0.12), Teamcenter Visualization V13.3 (All versions < V13.3.0.7), Teamcenter Visualization V14.0 (All versions < V14.0.0.3), Teamcenter Visualization V14.1 (All versions < V14.1
.3.0.7), Teamcenter Visualization V14.0 (All versions < V14.0.0.3), Teamcenter Visualization V14.1 (All versions < V14.1.0.4). The affected products contain an out of bounds read vulnerability when parsing a CGM file. An attacker can leverage this vulnerability to execute code in the context of the current process. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-120378.pdf
CVE ID: CVE-2022-41662 State: PUBLISHED Published: 2022-11-08T00:00:00.000Z Last Updated: 2025-04-21T13:46:50.092Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: JT2Go, Teamcenter Visualization V13.2, Teamcenter Visualization V13.3, Teamcenter Visualization V14.0, Teamcenter Visualization V14.1 Problem Types: CWE-125 Description: A vulnerability has been identified in JT2Go (All versions < V14.1.0.4), Teamcenter Visualization V13.2 (All versions < V13.2.0.12), Teamcenter Visualization V13.3 (All versions < V13.3.0.7), Teamcenter Visualization V14.0 (All versions < V14.0.0.3), Teamcenter Visualization V14.1 (All versions < V14.1
CVE ID: CVE-2022-41663 State: PUBLISHED Published: 2022-11-08T00:00:00.000Z Last Updated: 2025-04-21T13:46:42.304Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: JT2Go, Teamcenter Visualization V13.2, Teamcenter Visualization V13.3, Teamcenter Visualization V14.0, Teamcenter Visualization V14.1 Problem Types: CWE-416 Description: A vulnerability has been identified in JT2Go (All versions < V14.1.0.4), Teamcenter Visualization V13.2 (All versions < V13.2.0.12), Teamcenter Visualization V13.3 (All versions < V13.3.0.7), Teamcenter Visualization V14.0 (All versions < V14.0.0.3), Teamcenter Visualization V14.1 (All versions < V14.1
.3.0.7), Teamcenter Visualization V14.0 (All versions < V14.0.0.3), Teamcenter Visualization V14.1 (All versions < V14.1.0.4). The affected applications contain a use-after-free vulnerability that could be triggered while parsing specially crafted CGM files. An attacker could leverage this vulnerability to execute code in the context of the current process. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-120378.pdf
CVE ID: CVE-2022-41664 State: PUBLISHED Published: 2022-11-08T00:00:00.000Z Last Updated: 2025-04-21T13:46:34.995Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: JT2Go, Teamcenter Visualization V13.2, Teamcenter Visualization V13.3, Teamcenter Visualization V14.0, Teamcenter Visualization V14.1 Problem Types: CWE-121 Description: A vulnerability has been identified in JT2Go (All versions < V14.1.0.4), Teamcenter Visualization V13.2 (All versions < V13.2.0.12), Teamcenter Visualization V13.3 (All versions < V13.3.0.7), Teamcenter Visualization V14.0 (All versions < V14.0.0.3), Teamcenter Visualization V14.1 (All versions < V14.1
.3.0.7), Teamcenter Visualization V14.0 (All versions < V14.0.0.3), Teamcenter Visualization V14.1 (All versions < V14.1.0.4). The affected application contains a stack-based buffer overflow vulnerability that could be triggered while parsing specially crafted PDF files. This could allow an attacker to execute code in the context of the current process. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-120378.pdf
CVE ID: CVE-2022-41665 State: PUBLISHED Published: 2022-10-11T00:00:00.000Z Last Updated: 2025-04-21T13:48:05.692Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: SICAM P850, SICAM P855 Problem Types: CWE-141 Description: A vulnerability has been identified in SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P850 (All versi
P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM
V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10). Affected devices do not properly validate the parameter of a specific GET request. This could allow an unauthenticated attacker to set the device to a denial of service state or to control the program counter and, thus, execute arbitrary code on the device. Additional An
denial of service state or to control the program counter and, thus, execute arbitrary code on the device. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-572005.pdf
CVE ID: CVE-2022-41666 State: PUBLISHED Published: 2022-11-04T00:00:00.000Z Last Updated: 2025-05-02T18:26:02.139Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Schneider Electric Products: EcoStruxure Operator Terminal Expert, Pro-face BLUE Problem Types: CWE-347 Description: A CWE-347: Improper Verification of Cryptographic Signature vulnerability exists that allows adversaries with local user privileges to load a malicious DLL which could lead to execution of malicious code. Affected Products: EcoStruxure Operator Terminal Expert(V3.3 Hotfix 1 or prior), Pro-face BLUE(V3.3 Hotfix1 or prior). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vuln
ix 1 or prior), Pro-face BLUE(V3.3 Hotfix1 or prior). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.se.com/ww/en/download/document/SEVD-2022-284-01/
CVE ID: CVE-2022-41667 State: PUBLISHED Published: 2022-11-04T00:00:00.000Z Last Updated: 2025-05-02T18:26:43.222Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Schneider Electric Products: EcoStruxure Operator Terminal Expert, Pro-face BLUE Problem Types: CWE-22 Description: A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that allows adversaries with local user privileges to load a malicious DLL which could lead to execution of malicious code. Affected Products: EcoStruxure Operator Terminal Expert(V3.3 Hotfix 1 or prior), Pro-face BLUE(V3.3 Hotfix1 or prior). Additional Analyst Notes: - CVE Progra
or Terminal Expert(V3.3 Hotfix 1 or prior), Pro-face BLUE(V3.3 Hotfix1 or prior). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.se.com/ww/en/download/document/SEVD-2022-284-01/
CVE ID: CVE-2022-41668 State: PUBLISHED Published: 2022-11-04T00:00:00.000Z Last Updated: 2025-05-02T18:27:23.419Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Schneider Electric Products: EcoStruxure Operator Terminal Expert, Pro-face BLUE Problem Types: CWE-704 Description: A CWE-704: Incorrect Project Conversion vulnerability exists that allows adversaries with local user privileges to load a project file from an adversary-controlled network share which could result in execution of malicious code. Affected Products: EcoStruxure Operator Terminal Expert(V3.3 Hotfix 1 or prior), Pro-face BLUE(V3.3 Hotfix1 or prior). Additional Analyst Notes: - CVE Program Co
erminal Expert(V3.3 Hotfix 1 or prior), Pro-face BLUE(V3.3 Hotfix1 or prior). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.se.com/ww/en/download/document/SEVD-2022-284-01/
CVE ID: CVE-2022-41669 State: PUBLISHED Published: 2022-11-04T00:00:00.000Z Last Updated: 2025-05-02T18:28:02.037Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Schneider Electric Products: EcoStruxure Operator Terminal Expert, Pro-face BLUE Problem Types: CWE-347 Description: A CWE-347: Improper Verification of Cryptographic Signature vulnerability exists in the SGIUtility component that allows adversaries with local user privileges to load a malicious DLL which could result in execution of malicious code. Affected Products: EcoStruxure Operator Terminal Expert(V3.3 Hotfix 1 or prior), Pro-face BLUE(V3.3 Hotfix1 or prior). Additional Analyst Notes: - CVE Prog
ator Terminal Expert(V3.3 Hotfix 1 or prior), Pro-face BLUE(V3.3 Hotfix1 or prior). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.se.com/ww/en/download/document/SEVD-2022-284-01/
CVE ID: CVE-2022-41670 State: PUBLISHED Published: 2022-11-04T00:00:00.000Z Last Updated: 2025-04-30T20:10:42.160Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Schneider Electric Products: EcoStruxure Operator Terminal Expert, Pro-face BLUE Problem Types: CWE-22 Description: A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in the SGIUtility component that allows adversaries with local user privileges to load malicious DLL which could result in execution of malicious code. Affected Products: EcoStruxure Operator Terminal Expert(V3.3 Hotfix 1 or prior), Pro-face BLUE(V3.3 Hotfix1 or prior). Additional
Products: EcoStruxure Operator Terminal Expert(V3.3 Hotfix 1 or prior), Pro-face BLUE(V3.3 Hotfix1 or prior). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.se.com/ww/en/download/document/SEVD-2022-284-01/
CVE ID: CVE-2022-41671 State: PUBLISHED Published: 2022-11-04T00:00:00.000Z Last Updated: 2025-05-01T19:03:13.270Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Schneider Electric Products: EcoStruxure Operator Terminal Expert, Pro-face BLUE Problem Types: CWE-89 Description: A CWE-89: Improper Neutralization of Special Elements used in SQL Command (‘SQL Injection’) vulnerability exists that allows adversaries with local user privileges to craft a malicious SQL query and execute as part of project migration which could result in execution of malicious code. Affected Products: EcoStruxure Operator Terminal Expert(V3.3 Hotfix 1 or prior), Pro-face BLUE(V3.3 Hotf