Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-2303 State: PUBLISHED Published: 2022-08-05T15:11:39 Last Updated: 2024-08-03T00:32:09.595Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: GitLab Products: GitLab Problem Types: Improper access control in GitLab Description: An issue has been discovered in GitLab CE/EE affecting all versions before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1. It may be possible for group members to bypass 2FA enforcement enabled at the group level by using Resource Owner Password Credentials grant to obtain an access token without using 2FA. Additional Analyst Notes: - CVE Program Container: Reference
dentials grant to obtain an access token without using 2FA. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/355028 - https://hackerone.com/reports/1498133 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2303.json
CVE ID: CVE-2022-2304 State: PUBLISHED Published: 2022-07-05T00:00:00.000Z Last Updated: 2025-11-03T20:34:45.959Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: vim Products: vim/vim Problem Types: CWE-121 Description: Stack-based Buffer Overflow in GitHub repository vim/vim prior to 9.0. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/eb7402f3-025a-402f-97a7-c38700d9548a - https://github.com/vim/vim/commit/54e5fed6d27b747ff152cdb6edfb72ff60e70939 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UXPO5EHDV6J4B27E65DOQGZFELUFPRSK/ - https://lists.fedoraproject.org/arch
kage-announce%40lists.fedoraproject.org/message/UXPO5EHDV6J4B27E65DOQGZFELUFPRSK/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/43Y3VJPOTTY3NTREDIFUPITM2POG4ZLP/ - https://security.gentoo.org/glsa/202208-32 - https://lists.debian.org/debian-lts-announce/2022/11/msg00009.html - https://security.gentoo.org/glsa/202305-16
CVE ID: CVE-2022-2305 State: PUBLISHED Published: 2022-08-01T12:51:48 Last Updated: 2024-08-03T00:32:09.697Z Vendors: Unknown Products: Popups – WordPress Popup Problem Types: CWE-79 Description: The WordPress Popup WordPress plugin through 1.9.3.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/ea0180cd-e018-43ea-88b9-fa8e71bf34bf
CVE ID: CVE-2022-2306 State: PUBLISHED Published: 2022-07-05T08:30:11 Last Updated: 2024-08-03T00:32:09.620Z Severity: HIGH (CVSS 8.2 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) Vendors: heroiclabs Products: heroiclabs/nakama Problem Types: CWE-613 Description: Old session tokens can be used to authenticate to the application and send authenticated requests. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/35acf263-6db4-4310-ab27-4c3c3a53f796 - https://github.com/heroiclabs/nakama/commit/ce8d3921e2acd44ef8b5e6edfe595b6df067b166
CVE ID: CVE-2022-2307 State: PUBLISHED Published: 2022-08-05T15:11:12 Last Updated: 2024-08-03T00:32:09.596Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N) Vendors: GitLab Products: GitLab Problem Types: Incomplete cleanup in GitLab Description: A lack of cascading deletes in GitLab CE/EE affecting all versions starting from 13.0 before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1 allows a malicious Group Owner to retain a usable Group Access Token even after the Group is deleted, though the APIs usable by that token are limited. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/g
usable by that token are limited. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/360025 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2307.json
CVE ID: CVE-2022-2308 State: PUBLISHED Published: 2022-09-01T20:01:28 Last Updated: 2024-08-03T00:32:09.598Z Vendors: n/a Products: Linux kernel Problem Types: CWE-457 Description: A flaw was found in vDPA with VDUSE backend. There are currently no checks in VDUSE kernel driver to ensure the size of the device config space is in line with the features advertised by the VDUSE userspace application. In case of a mismatch, Virtio drivers config read helpers do not initialize the memory indirectly passed to vduse_vdpa_get_config() returning uninitialized memory from the stack. This could cause undefined behavior or data leaks in Virtio drivers. Additional Analyst Notes: - CVE Program Container:
This could cause undefined behavior or data leaks in Virtio drivers. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2103900
CVE ID: CVE-2022-2309 State: PUBLISHED Published: 2022-07-05T09:00:12.000Z Last Updated: 2025-11-04T16:09:31.952Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: lxml Products: lxml/lxml Problem Types: CWE-476 Description: NULL Pointer Dereference allows attackers to cause a denial of service (or application crash). This only applies when lxml is used together with libxml2 2.9.10 through 2.9.14. libxml2 2.9.9 and earlier are not affected. It allows triggering crashes through forged input data, given a vulnerable code sequence in the application. The vulnerability is caused by the iterwalk function (also used by the canonicalize function). Such code shouldn't
tion. The vulnerability is caused by the iterwalk function (also used by the canonicalize function). Such code shouldn't be in wide-spread use, given that parsing + iterwalk would usually be replaced with the more efficient iterparse function. However, an XML converter that serialises to C14N would also be vulnerable, for example, and there are legitimate use cases for this code sequence. If untrusted input is received (also remotely) and processed via iterwalk function, a crash can be triggered. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/8264e74f-edda-4c40-9956-49de635105ba - https://github.com/lxml/lxml/commit/86368e9cf70a0ad23cccd5ee32de847
.dev/bounties/8264e74f-edda-4c40-9956-49de635105ba - https://github.com/lxml/lxml/commit/86368e9cf70a0ad23cccd5ee32de847149af0c6f - https://security.gentoo.org/glsa/202208-06 - https://security.netapp.com/advisory/ntap-20220915-0006/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/URHHSIBTPTALXMECRLAC2EVDNAFSR5NO/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HGYC6L7ENH5VEGN3YWFBYMGKX6WNS7HZ/
CVE ID: CVE-2022-2310 State: PUBLISHED Published: 2022-07-27T09:20:11 Last Updated: 2024-08-03T00:32:09.383Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Skyhigh Security Products: Skyhigh Secure Web Gateway (SWG) Problem Types: CWE-290 Description: An authentication bypass vulnerability in Skyhigh SWG in main releases 10.x prior to 10.2.12, 9.x prior to 9.2.23, 8.x prior to 8.2.28, and controlled release 11.x prior to 11.2.1 allows a remote attacker to bypass authentication into the administration User Interface. This is possible because of SWG incorrectly whitelisting authentication bypass methods and using a weak crypto password. This can lead to the
se of SWG incorrectly whitelisting authentication bypass methods and using a weak crypto password. This can lead to the attacker logging into the SWG admin interface, without valid credentials, as the super user with complete control over the SWG. Additional Analyst Notes: - CVE Program Container: References: - https://kcm.trellix.com/corporate/index?page=content&id=SB10384&actp=null&viewlocale=en_US&showDraft=false&platinum_status=false&locale=en_US
CVE ID: CVE-2022-2311 State: PUBLISHED Published: 2022-11-28T13:47:13.639Z Last Updated: 2025-04-23T16:34:07.627Z Vendors: Unknown Products: Find and Replace All Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Find and Replace All WordPress plugin before 1.3 does not sanitize and escape some parameters from its setting page before outputting them back to the user, leading to a Reflected Cross-Site Scripting issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/287a14dc-d1fc-481d-84af-7eb172dc68c9
CVE ID: CVE-2022-2312 State: PUBLISHED Published: 2022-08-22T15:01:18 Last Updated: 2024-08-03T00:32:09.589Z Vendors: Unknown Products: Student Result or Employee Database Problem Types: CWE-639, CWE-352 Description: The Student Result or Employee Database WordPress plugin before 1.7.5 does not have CSRF in its AJAX actions, allowing attackers to make logged in user with a role as low as contributor to add/edit and delete students via CSRF attacks. Furthermore, due to the lack of sanitisation and escaping, it could also lead to Stored Cross-Site scripting Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/7548c1fb-77b5-4290-a297-35820edfe0f8
CVE ID: CVE-2022-2313 State: PUBLISHED Published: 2022-07-27T09:25:12 Last Updated: 2024-08-03T00:32:09.568Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: Trellix Products: Trellix Agent (TA) Problem Types: CWE- 427: Uncontrolled Search Path Element Description: A DLL hijacking vulnerability in the MA Smart Installer for Windows prior to 5.7.7, which allows local users to execute arbitrary code and obtain higher privileges via careful placement of a malicious DLL into the folder from where the Smart installer is being executed. Additional Analyst Notes: - CVE Program Container: References: - https://kcm.trellix.com/corporate/index?page=content&id=SB10385&act
nalyst Notes: - CVE Program Container: References: - https://kcm.trellix.com/corporate/index?page=content&id=SB10385&actp=null&viewlocale=en_US&showDraft=false&platinum_status=false&locale=en_US
CVE ID: CVE-2022-2314 State: PUBLISHED Published: 2022-08-15T08:36:40 Last Updated: 2024-08-03T00:32:09.676Z Vendors: Unknown Products: VR Calendar Problem Types: CWE-78 Description: The VR Calendar WordPress plugin through 2.3.2 lets any user execute arbitrary PHP functions on the site. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/b22fe77c-844e-4c24-8023-014441cc1e82
CVE ID: CVE-2022-2315 State: PUBLISHED Published: 2022-09-21T07:50:09.721Z Last Updated: 2025-05-28T15:27:15.424Z Severity: CRITICAL (CVSS 9.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L) Vendors: Database Software Products: Database Software Problem Types: CWE-89 Description: Database Software Accreditation Tracking/Presentation Module product before version 2 has an unauthenticated SQL Injection vulnerability. This is fixed in version 2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-22-0634
CVE ID: CVE-2022-2316 State: PUBLISHED Published: 2022-07-06T18:56:20 Last Updated: 2024-08-03T00:32:09.493Z Vendors: Devolutions Products: Devolutions Server Problem Types: HTML injection Description: HTML injection vulnerability in secure messages of Devolutions Server before 2022.2 allows attackers to alter the rendering of the page or redirect a user to another site. Additional Analyst Notes: - CVE Program Container: References: - https://devolutions.net/security/advisories/DEVO-2022-0006
CVE ID: CVE-2022-2317 State: PUBLISHED Published: 2022-08-01T12:52:01 Last Updated: 2024-08-03T00:32:09.549Z Vendors: Unknown Products: Simple Membership Problem Types: CWE-269 Description: The Simple Membership WordPress plugin before 4.1.3 allows user to change their membership at the registration stage due to insufficient checking of a user supplied parameter. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/77b7ca19-294c-4480-8f57-6fddfc67fffb
CVE ID: CVE-2022-2318 State: PUBLISHED Published: 2022-07-06T00:00:00 Last Updated: 2024-08-03T00:32:09.627Z Vendors: n/a Products: Kernel Problem Types: CWE-416 Description: There are use-after-free vulnerabilities caused by timer handler in net/rose/rose_timer.c of linux that allow attackers to crash linux kernel without any privileges. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/torvalds/linux/commit/9cc02ede696272c5271a401e4f27c262359bc2f6 - https://www.debian.org/security/2022/dsa-5191 - https://lists.debian.org/debian-lts-announce/2022/10/msg00000.html - https://security.netapp.com/advisory/ntap-20230120-0001/
CVE ID: CVE-2022-2319 State: PUBLISHED Published: 2022-09-01T00:00:00 Last Updated: 2024-08-03T00:32:09.879Z Vendors: n/a Products: xorg-x11-server Problem Types: CWE-1320 Description: A flaw was found in the Xorg-x11-server. An out-of-bounds access issue can occur in the ProcXkbSetGeometry function due to improper validation of the request length. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/938 - https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/939 - https://lists.freedesktop.org/archives/xorg-announce/2022-July/003192.html - https://www.zerodayinitiative.com/advisories/ZDI-22-964/ - https://securi
archives/xorg-announce/2022-July/003192.html - https://www.zerodayinitiative.com/advisories/ZDI-22-964/ - https://security.gentoo.org/glsa/202210-30 - https://security.netapp.com/advisory/ntap-20221104-0003/
CVE ID: CVE-2022-2320 State: PUBLISHED Published: 2022-09-01T00:00:00 Last Updated: 2024-08-03T00:32:09.611Z Vendors: n/a Products: xorg-x11-server Problem Types: CWE-787 Description: A flaw was found in the Xorg-x11-server. The specific flaw exists within the handling of ProcXkbSetDeviceInfo requests. The issue results from the lack of proper validation of user-supplied data, which can result in a memory access past the end of an allocated buffer. This flaw allows an attacker to escalate privileges and execute arbitrary code in the context of root. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/938 - https://gitl
: - CVE Program Container: References: - https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/938 - https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/939 - https://github.com/freedesktop/xorg-xserver/commit/dd8caf39e9e15d8f302e54045dd08d8ebf1025dc - https://www.zerodayinitiative.com/advisories/ZDI-22-963/ - https://lists.freedesktop.org/archives/xorg-announce/2022-July/003192.html - https://security.gentoo.org/glsa/202210-30 - https://security.netapp.com/advisory/ntap-20221104-0003/
CVE ID: CVE-2022-2321 State: PUBLISHED Published: 2022-07-05T18:25:11 Last Updated: 2024-08-03T00:32:09.662Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: heroiclabs Products: heroiclabs/nakama Problem Types: CWE-307 Description: Improper Restriction of Excessive Authentication Attempts in GitHub repository heroiclabs/nakama prior to 3.13.0. This results in login brute-force attacks. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/3055b3f5-6b80-4d47-8e00-3500dfb458bc - https://github.com/heroiclabs/nakama/commit/e2e02fce80ff33ce45f8a6ebc0b7a99ee0b03824
CVE ID: CVE-2022-2323 State: PUBLISHED Published: 2022-07-29T19:15:12 Last Updated: 2024-08-03T00:32:09.648Z Vendors: SonicWall Products: SonicWall Switch Problem Types: CWE-77 Description: Improper neutralization of special elements used in a user input allows an authenticated malicious user to perform remote code execution in the host system. This vulnerability impacts SonicWall Switch 1.1.1.0-2s and earlier versions Additional Analyst Notes: - CVE Program Container: References: - https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0013
CVE ID: CVE-2022-2324 State: PUBLISHED Published: 2022-07-29T21:05:26 Last Updated: 2024-08-03T00:32:09.662Z Vendors: SonicWall Products: SonicWall Email Security Problem Types: CWE-358 Description: Improperly Implemented Security Check vulnerability in the SonicWall Hosted Email Security leads to bypass of Capture ATP security service in the appliance. This vulnerability impacts 10.0.17.7319 and earlier versions Additional Analyst Notes: - CVE Program Container: References: - https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0014
CVE ID: CVE-2022-2325 State: PUBLISHED Published: 2022-08-01T12:52:16 Last Updated: 2024-08-03T00:32:09.684Z Vendors: Unknown Products: Invitation Based Registrations Problem Types: CWE-79 Description: The Invitation Based Registrations WordPress plugin through 2.2.84 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/c8dcd7a7-5ad4-452c-a6a5-2362986656e4
CVE ID: CVE-2022-2326 State: PUBLISHED Published: 2022-08-05T15:11:26 Last Updated: 2024-08-03T00:32:09.623Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N) Vendors: GitLab Products: GitLab Problem Types: Vulnerability in GitLab Description: An issue has been discovered in GitLab CE/EE affecting all versions before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1. It may be possible to gain access to a private project through an email invite by using other user's email address as an unverified secondary email. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/iss
ndary email. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/356665 - https://hackerone.com/reports/1517554 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2326.json
CVE ID: CVE-2022-2327 State: PUBLISHED Published: 2022-07-22T00:00:00.000Z Last Updated: 2025-04-21T13:51:20.067Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N) Vendors: Linux Kernel Products: Linux Kernel Problem Types: CWE-416 Description: io_uring use work_flags to determine which identity need to grab from the calling process to make sure it is consistent with the calling process when executing IORING_OP. Some operations are missing some types, which can lead to incorrect reference counts which can then lead to a double free. We recommend upgrading the kernel past commit df3f3bb5059d20ef094d6b2f0256c4bf4127a859 Additional Analyst Notes: - CVE Program Container: -
ng the kernel past commit df3f3bb5059d20ef094d6b2f0256c4bf4127a859 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=linux-5.10.y&id=df3f3bb5059d20ef094d6b2f0256c4bf4127a859 - https://kernel.dance/#df3f3bb5059d20ef094d6b2f0256c4bf4127a859 - https://security.netapp.com/advisory/ntap-20230203-0009/
CVE ID: CVE-2022-2328 State: PUBLISHED Published: 2022-08-01T12:52:29 Last Updated: 2024-08-03T00:32:09.342Z Vendors: Unknown Products: Flexi Quote Rotator Problem Types: CWE-79 Description: The Flexi Quote Rotator WordPress plugin through 0.9.4 does not sanitise and escape its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/dbac391b-fc48-4e5e-b63a-2b3ddb0d5552
CVE ID: CVE-2022-2329 State: PUBLISHED Published: 2023-02-01T00:00:00.000Z Last Updated: 2025-02-05T20:17:16.718Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Schneider Electric Products: IGSS Data Server (IGSSdataServer.exe) Problem Types: CWE-190 Description: A CWE-190: Integer Overflow or Wraparound vulnerability exists that could cause heap-based buffer overflow, leading to denial of service and potentially remote code execution when an attacker sends multiple specially crafted messages. Affected Products: IGSS Data Server - IGSSdataServer.exe (Versions prior to V15.0.0.22073) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichmen
taServer.exe (Versions prior to V15.0.0.22073) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2022-102-01_IGSS_Security_Notification_V2.0.pdf
CVE ID: CVE-2022-2330 State: PUBLISHED Published: 2022-08-30T07:35:13 Last Updated: 2024-08-03T00:32:09.692Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Trellix Products: DLP Endpoint for Windows Problem Types: CWE-611 Description: Improper Restriction of XML External Entity Reference vulnerability in DLP Endpoint for Windows prior to 11.9.100 allows a remote attacker to cause the DLP Agent to access a local service that the attacker wouldn't usually have access to via a carefully constructed XML file, which the DLP Agent doesn't parse correctly. Additional Analyst Notes: - CVE Program Container: References: - https://kcm.trellix.com/corporate/index?page
correctly. Additional Analyst Notes: - CVE Program Container: References: - https://kcm.trellix.com/corporate/index?page=content&id=SB10386
CVE ID: CVE-2022-2331 State: REJECTED Published: N/A Last Updated: 2023-05-12T00:00:00 Description: No description available.
CVE ID: CVE-2022-2332 State: PUBLISHED Published: 2022-09-16T20:18:45.858Z Last Updated: 2025-04-16T16:09:46.592Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: Honeywell Products: SoftMaster Problem Types: CWE-732 Description: A local unprivileged attacker may escalate to administrator privileges in Honeywell SoftMaster version 4.51, due to insecure permission assignment. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-256-02 - https://www.security.honeywell.com/-/media/Security/Resources/PDF/Product-Warranty/Security_Notification_SN_2019-09-13-02_V4-pdf.pdf
CVE ID: CVE-2022-2333 State: PUBLISHED Published: 2022-09-16T20:18:42.695Z Last Updated: 2025-04-16T17:47:27.339Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Honeywell Products: SoftMaster Problem Types: CWE-427 Description: If an attacker manages to trick a valid user into loading a malicious DLL, the attacker may be able to achieve code execution in Honeywell SoftMaster version 4.51 application’s context and permissions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-256-02 - https://www.security.honeywell.com/-/media/Security/Resources/PDF/Product-Warranty/Secu
/ics/advisories/icsa-22-256-02 - https://www.security.honeywell.com/-/media/Security/Resources/PDF/Product-Warranty/Security_Notification_SN_2019-09-13-02_V4-pdf.pdf
CVE ID: CVE-2022-2334 State: PUBLISHED Published: 2022-08-17T20:11:17.000Z Last Updated: 2025-04-16T17:50:24.791Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Softing Products: Secure Integration Server Problem Types: CWE-427 Description: The application searches for a library dll that is not found. If an attacker can place a dll with this name, then the attacker can leverage it to execute arbitrary code on the targeted Softing Secure Integration Server V1.22. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-228-04 - https://industrial.softing.com/fileadmin/psirt/dow
rences: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-228-04 - https://industrial.softing.com/fileadmin/psirt/downloads/syt-2022-5.html