Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-3709 State: PUBLISHED Published: 2022-12-01T00:00:00.000Z Last Updated: 2025-04-24T20:14:18.242Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H) Vendors: Sophos Products: Sophos Firewall Problem Types: n/a Description: A stored XSS vulnerability allows admin to super-admin privilege escalation in the Webadmin import group wizard of Sophos Firewall releases older than version 19.5 GA. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.sophos.com/en-us/security-advisories/sophos-sa-20221201-sfos-19-5-0
CVE ID: CVE-2022-3710 State: PUBLISHED Published: 2022-12-01T00:00:00.000Z Last Updated: 2025-04-23T20:23:36.334Z Severity: LOW (CVSS 2.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N) Vendors: Sophos Products: Sophos Firewall Problem Types: n/a Description: A post-auth read-only SQL injection vulnerability allows API clients to read non-sensitive configuration database contents in the API controller of Sophos Firewall releases older than version 19.5 GA. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.sophos.com/en-us/security-advisories/sophos-sa-20221201-sfos-19-5-0
CVE ID: CVE-2022-3711 State: PUBLISHED Published: 2022-12-01T00:00:00.000Z Last Updated: 2025-04-23T15:14:27.550Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Sophos Products: Sophos Firewall Problem Types: n/a Description: A post-auth read-only SQL injection vulnerability allows users to read non-sensitive configuration database contents in the User Portal of Sophos Firewall releases older than version 19.5 GA. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.sophos.com/en-us/security-advisories/sophos-sa-20221201-sfos-19-5-0
CVE ID: CVE-2022-3713 State: PUBLISHED Published: 2022-12-01T00:00:00.000Z Last Updated: 2025-04-24T20:14:46.346Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Sophos Products: Sophos Firewall Problem Types: n/a Description: A code injection vulnerability allows adjacent attackers to execute code in the Wifi controller of Sophos Firewall releases older than version 19.5 GA. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.sophos.com/en-us/security-advisories/sophos-sa-20221201-sfos-19-5-0
CVE ID: CVE-2022-3714 State: PUBLISHED Published: 2022-10-27T00:00:00 Last Updated: 2024-11-20T14:39:38.106Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: SourceCodester Products: Online Medicine Ordering System Problem Types: CWE-707 Description: A vulnerability classified as critical has been found in SourceCodester Online Medicine Ordering System 1.0. Affected is an unknown function of the file admin/?page=orders/view_order. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. VDB-212346 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnr
46 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.212346
CVE ID: CVE-2022-3715 State: PUBLISHED Published: 2023-01-05T00:00:00.000Z Last Updated: 2025-11-03T21:46:30.575Z Vendors: n/a Products: bash Problem Types: CWE-119 Description: A flaw was found in the bash package, where a heap-buffer overflow can occur in valid parameter_transform. This issue may lead to memory problems. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2126720
CVE ID: CVE-2022-3716 State: PUBLISHED Published: 2022-10-27T00:00:00 Last Updated: 2024-08-03T01:20:57.102Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: SourceCodester Products: Online Medicine Ordering System Problem Types: CWE-707 Description: A vulnerability classified as problematic was found in SourceCodester Online Medicine Ordering System 1.0. Affected by this vulnerability is an unknown functionality of the file /omos/admin/?page=user/list. The manipulation of the argument First Name/Middle Name/Last Name leads to cross site scripting. The attack can be launched remotely. The associated identifier of this vulnerability is VDB-212347. Additional Anal
ing. The attack can be launched remotely. The associated identifier of this vulnerability is VDB-212347. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.212347
CVE ID: CVE-2022-3717 State: REJECTED Published: N/A Last Updated: 2022-11-21T00:00:00 Description: No description available.
CVE ID: CVE-2022-3718 State: REJECTED Published: N/A Last Updated: 2022-11-21T00:00:00 Description: No description available.
CVE ID: CVE-2022-3719 State: REJECTED Published: N/A Last Updated: 2022-11-21T00:00:00 Description: No description available.
CVE ID: CVE-2022-3720 State: PUBLISHED Published: 2022-11-21T00:00:00.000Z Last Updated: 2025-04-30T15:32:41.083Z Vendors: Unknown Products: Event Monster Problem Types: CWE-89 SQL Injection Description: The Event Monster WordPress plugin before 1.2.0 does not validate and escape some parameters before using them in SQL statements, which could lead to SQL Injection exploitable by high privilege users Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/0139a23c-4896-4aef-ab56-dcf7f07f01e5
CVE ID: CVE-2022-3721 State: PUBLISHED Published: 2022-11-04T00:00:00.000Z Last Updated: 2025-05-02T18:44:34.632Z Severity: HIGH (CVSS 7.6 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L) Vendors: froxlor Products: froxlor/froxlor Problem Types: CWE-94 Description: Code Injection in GitHub repository froxlor/froxlor prior to 0.10.39. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/a3c506f0-5f8a-4eaa-b8cc-46fb9e35cf7a - https://github.com/froxlor/froxlor/commit/1182453c18a83309a3470b2775c148ede740806c
CVE ID: CVE-2022-3723 State: PUBLISHED Published: 2022-11-01T00:00:00.000Z Last Updated: 2025-10-21T23:15:32.690Z Vendors: Google Products: Chrome Problem Types: Type Confusion Description: Type confusion in V8 in Google Chrome prior to 107.0.5304.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2022/10/stable-channel-update-for-desktop_27.html - https://crbug.com/1378239 - https://security.gentoo.org/glsa/202305-10
CVE ID: CVE-2022-3724 State: PUBLISHED Published: 2022-12-09T00:00:00.000Z Last Updated: 2025-04-22T19:27:54.111Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: Wireshark Foundation Products: Wireshark Problem Types: Use of externally-controlled format string in Wireshark Description: Crash in the USB HID protocol dissector in Wireshark 3.6.0 to 3.6.8 allows denial of service via packet injection or crafted capture file on Windows Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wireshark.org/security/wnpa-sec-2022-08.html - https://gitlab.com/wireshark/wireshark/-/issues/18384 - https://gitlab.com/gitlab
k.org/security/wnpa-sec-2022-08.html - https://gitlab.com/wireshark/wireshark/-/issues/18384 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3724.json
CVE ID: CVE-2022-3725 State: PUBLISHED Published: 2022-10-27T00:00:00.000Z Last Updated: 2025-05-09T19:14:30.824Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: Wireshark Foundation Products: Wireshark Problem Types: Buffer copy without checking size of input ('classic buffer overflow') in Wireshark Description: Crash in the OPUS protocol dissector in Wireshark 3.6.0 to 3.6.8 allows denial of service via packet injection or crafted capture file Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wireshark.org/security/wnpa-sec-2022-07.html - https://gitlab.com/wireshark/wireshark/-/issues/18378 - https://git
//www.wireshark.org/security/wnpa-sec-2022-07.html - https://gitlab.com/wireshark/wireshark/-/issues/18378 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3725.json - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OIEIFFZ27YKCTK5C2VT4OEQSHPQDBNSF/ - https://security.gentoo.org/glsa/202309-02
CVE ID: CVE-2022-3726 State: PUBLISHED Published: 2022-11-09T00:00:00.000Z Last Updated: 2025-05-01T19:23:10.307Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N) Vendors: GitLab Products: GitLab Problem Types: Protection mechanism failure in GitLab Description: Lack of sand-boxing of OpenAPI documents in GitLab CE/EE affecting all versions from 12.6 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allows an attacker to trick a user to click on the Swagger OpenAPI viewer and issue HTTP requests that affect the victim's account. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/
nal Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/362509 - https://hackerone.com/reports/1563383 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3726.json
CVE ID: CVE-2022-3728 State: PUBLISHED Published: 2023-10-09T20:48:31.533Z Last Updated: 2024-09-19T13:50:29.916Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) Vendors: Lenovo Products: ThinkPad T14s Gen 3 BIOS, ThinkPad X13 Gen3 BIOS Problem Types: CWE-1263 Description: A vulnerability was reported in ThinkPad T14s Gen 3 and X13 Gen3 that could cause the BIOS tamper detection mechanism to not trigger under specific circumstances which could allow unauthorized access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.lenovo.com/us/en/product_security/LEN-106014
CVE ID: CVE-2022-3729 State: PUBLISHED Published: 2022-10-28T00:00:00 Last Updated: 2024-08-03T01:20:57.204Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: seccome Products: Ehoney Problem Types: CWE-707 Description: A vulnerability, which was classified as critical, has been found in seccome Ehoney. This issue affects some unknown processing of the file /api/v1/attack. The manipulation of the argument AttackIP leads to sql injection. The attack may be initiated remotely. The associated identifier of this vulnerability is VDB-212411. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.212411
CVE ID: CVE-2022-3730 State: PUBLISHED Published: 2022-10-28T00:00:00.000Z Last Updated: 2025-04-15T13:24:12.603Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: seccome Products: Ehoney Problem Types: CWE-707 Description: A vulnerability, which was classified as critical, was found in seccome Ehoney. Affected is an unknown function of the file /api/v1/attack/falco. The manipulation of the argument Payload leads to sql injection. It is possible to launch the attack remotely. The identifier of this vulnerability is VDB-212412. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.212412
CVE ID: CVE-2022-3731 State: PUBLISHED Published: 2022-10-28T00:00:00.000Z Last Updated: 2025-04-15T13:24:03.846Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: seccome Products: Ehoney Problem Types: CWE-707 Description: A vulnerability has been found in seccome Ehoney and classified as critical. Affected by this vulnerability is an unknown functionality of the file /api/v1/attack/token. The manipulation of the argument Payload leads to sql injection. The attack can be launched remotely. The identifier VDB-212413 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?
erability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.212413
CVE ID: CVE-2022-3732 State: PUBLISHED Published: 2022-10-28T00:00:00.000Z Last Updated: 2025-04-15T13:23:57.123Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: seccome Products: Ehoney Problem Types: CWE-707 Description: A vulnerability was found in seccome Ehoney and classified as critical. Affected by this issue is some unknown functionality of the file /api/v1/bait/set. The manipulation of the argument Payload leads to sql injection. The attack may be launched remotely. VDB-212414 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.212414
CVE ID: CVE-2022-3733 State: PUBLISHED Published: 2022-10-28T00:00:00.000Z Last Updated: 2025-04-15T13:23:49.779Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: SourceCodester Products: Web-Based Student Clearance System Problem Types: CWE-707 Description: A vulnerability was found in SourceCodester Web-Based Student Clearance System. It has been classified as critical. This affects an unknown part of the file Admin/edit-admin.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-212415
exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-212415. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://blog.csdn.net/qq_41988749/article/details/127552717?spm=1001.2014.3001.5502 - https://vuldb.com/?id.212415
CVE ID: CVE-2022-3734 State: PUBLISHED Published: 2022-10-28T00:00:00 Last Updated: 2024-08-03T01:20:57.545Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: unspecified Products: Redis Problem Types: CWE-426 Description: A vulnerability was found in a port or fork of Redis. It has been declared as critical. This vulnerability affects unknown code in the library C:/Program Files/Redis/dbghelp.dll. The manipulation leads to uncontrolled search path. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The identifier of this vulnerability is V
used. The real existence of this vulnerability is still doubted at the moment. The identifier of this vulnerability is VDB-212416. NOTE: The official Redis release is not affected. This issue might affect an unofficial fork or port on Windows only. Additional Analyst Notes: - CVE Program Container: References: - https://www.cnblogs.com/J0o1ey/p/16829380.html - https://vuldb.com/?id.212416
CVE ID: CVE-2022-3735 State: PUBLISHED Published: 2022-10-28T00:00:00.000Z Last Updated: 2025-04-15T13:23:40.648Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: seccome Products: Ehoney Problem Types: CWE-266 Description: A vulnerability was found in seccome Ehoney. It has been rated as critical. This issue affects some unknown processing of the file /api/public/signup. The manipulation leads to improper access controls. The identifier VDB-212417 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.212417
CVE ID: CVE-2022-3736 State: PUBLISHED Published: 2023-01-25T21:39:18.187Z Last Updated: 2025-04-01T14:10:47.439Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: ISC Products: BIND 9 Problem Types: n/a Description: BIND 9 resolver can crash when stale cache and stale answers are enabled, option `stale-answer-client-timeout` is set to a positive integer, and the resolver receives an RRSIG query. This issue affects BIND 9 versions 9.16.12 through 9.16.36, 9.18.0 through 9.18.10, 9.19.0 through 9.19.8, and 9.16.12-S1 through 9.16.36-S1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://kb.isc.org/docs/cve-2022-3736
CVE ID: CVE-2022-3737 State: PUBLISHED Published: 2022-11-15T10:59:00.713Z Last Updated: 2025-04-28T20:18:28.564Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: PHOENIX CONTACT Products: Config+, PC Worx, PC Worx Express Problem Types: CWE-125 Description: In PHOENIX CONTACT Automationworx Software Suite up to version 1.89 memory can be read beyond the intended scope due to insufficient validation of input data. Availability, integrity, or confidentiality of an application programming workstation might be compromised by attacks using these vulnerabilities. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert.v
ulnerabilities. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert.vde.com/en/advisories/VDE-2022-048/
CVE ID: CVE-2022-3738 State: PUBLISHED Published: 2023-01-19T11:27:51.814Z Last Updated: 2025-04-02T14:55:51.603Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: WAGO Products: Series WAGO PFC100, Series WAGO PFC200, Series WAGO Touch Panel 600 Advanced Line, Series WAGO Touch Panel 600 Marine Line, Series WAGO Touch Panel 600 Standard Line, WAGO Compact Controller CC100, WAGO Edge Controller Problem Types: CWE-306 Description: The vulnerability allows a remote unauthenticated attacker to download a backup file, if one exists. That backup file might contain sensitive information like credentials and cryptographic material. A valid user has to create a backup
ile might contain sensitive information like credentials and cryptographic material. A valid user has to create a backup after the last reboot for this attack to be successfull. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert.vde.com/en/advisories/VDE-2022-054/
CVE ID: CVE-2022-3739 State: PUBLISHED Published: 2024-01-16T15:53:10.932Z Last Updated: 2025-06-20T16:57:28.497Z Vendors: Unknown Products: WP Best Quiz Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The WP Best Quiz WordPress plugin through 1.0 does not sanitize and escape some parameters, which could allow users with a role as low as Author to perform Cross-Site Scripting attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/b9f39ced-1e0f-4559-b861-39ddcbcd1249/
CVE ID: CVE-2022-3740 State: PUBLISHED Published: 2023-01-24T00:00:00.000Z Last Updated: 2025-04-02T15:03:23.934Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N) Vendors: GitLab Products: GitLab Problem Types: Improper access control in GitLab Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.9 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2. A group owner may be able to bypass External Authorization check, if it is enabled, to access git repositories and package registries by using Deploy tokens or Deploy keys . Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - ht
loy tokens or Deploy keys . Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/368416 - https://hackerone.com/reports/1602904 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3740.json
CVE ID: CVE-2022-3741 State: PUBLISHED Published: 2022-10-28T00:00:00.000Z Last Updated: 2025-05-09T19:19:52.573Z Severity: CRITICAL (CVSS 9.4 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L) Vendors: chatwoot Products: chatwoot/chatwoot Problem Types: CWE-307 Description: Impact varies for each individual vulnerability in the application. For generation of accounts, it may be possible, depending on the amount of system resources available, to create a DoS event in the server. These accounts still need to be activated; however, it is possible to identify the output Status Code to separate accounts that are generated and waiting for email verification. \n\nFor the sign in directories, it is poss
to separate accounts that are generated and waiting for email verification. \n\nFor the sign in directories, it is possible to brute force login attempts to either login portal, which could lead to account compromise. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/46f6e07e-f438-4540-938a-510047f987d0 - https://github.com/chatwoot/chatwoot/commit/9525d4f0346a2fdac13a0253f9180d20104a72d3
CVE ID: CVE-2022-3742 State: PUBLISHED Published: 2023-08-23T19:42:15.848Z Last Updated: 2024-10-09T19:17:23.103Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Lenovo Products: Notebook Problem Types: CWE-120 Description: A potential vulnerability was discovered in LCFC BIOS for some Lenovo consumer notebook models that could allow a local attacker with elevated privileges to execute arbitrary code due to improper buffer validation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.lenovo.com/us/en/product_security/LEN-103710
CVE ID: CVE-2022-3743 State: PUBLISHED Published: 2023-08-23T19:42:59.163Z Last Updated: 2024-10-01T15:50:12.756Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: Lenovo Products: Notebook Problem Types: CWE-200 Description: A potential vulnerability was discovered in LCFC BIOS for some Lenovo consumer notebook models that could allow a local attacker with elevated privileges under certain conditions the ability to enumerate Embedded Controller (EC) commands. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.lenovo.com/us/en/product_security/LEN-103710
CVE ID: CVE-2022-3744 State: PUBLISHED Published: 2023-08-23T19:43:17.503Z Last Updated: 2024-08-03T01:20:57.610Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Lenovo Products: Notebook Problem Types: CWE-798 Description: A potential vulnerability was discovered in LCFC BIOS for some Lenovo consumer notebook models that could allow a local attacker with elevated privileges to unlock UEFI variables due to a hard-coded SMI handler credential. Additional Analyst Notes: - CVE Program Container: References: - https://support.lenovo.com/us/en/product_security/LEN-103710
CVE ID: CVE-2022-3745 State: PUBLISHED Published: 2023-08-23T19:43:34.512Z Last Updated: 2024-10-01T15:49:56.403Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: Lenovo Products: Notebook Problem Types: CWE-200 Description: A potential vulnerability was discovered in LCFC BIOS for some Lenovo consumer notebook models that could allow a local attacker with elevated privileges to view incoming and returned data from SMI. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.lenovo.com/us/en/product_security/LEN-103710
CVE ID: CVE-2022-3746 State: PUBLISHED Published: 2023-08-23T19:43:54.077Z Last Updated: 2024-08-03T01:20:57.662Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Lenovo Products: Notebook Problem Types: CWE-284 Description: A potential vulnerability was discovered in LCFC BIOS for some Lenovo consumer notebook models that could allow a local attacker with elevated privileges to cause some peripherals to work abnormally due to an exposed Embedded Controller (EC) interface. Additional Analyst Notes: - CVE Program Container: References: - https://support.lenovo.com/us/en/product_security/LEN-103710