Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-26829 State: PUBLISHED Published: 2022-04-15T19:05:23 Last Updated: 2025-01-02T18:52:12.065Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: Microsoft Products: Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows Server version 20H2, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 Service Pack 2 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 R2 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Server Core installation), Windows Server 2012, Windows Server 2012 (Serv
Pack 1, Windows Server 2008 R2 Service Pack 1 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) Problem Types: Remote Code Execution Description: Windows DNS Server Remote Code Execution Vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26829
CVE ID: CVE-2022-26830 State: PUBLISHED Published: 2022-04-15T19:05:24 Last Updated: 2025-01-02T18:52:12.697Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows Server 2022, Windows 11 version 21H2 Problem Types: Remote Code Execution Description: DiskUsage.exe Remote Code Execution Vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26830
CVE ID: CVE-2022-26831 State: PUBLISHED Published: 2022-04-15T19:05:26 Last Updated: 2025-01-02T18:52:13.404Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows 10 Version 1909, Windows 10 Version 21H1, Windows Server 2022, Windows 10 Version 20H2, Windows Server version 20H2, Windows 11 version 21H2, Windows 10 Version 21H2, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows 7, Windows 7 Service Pack 1, Windows 8.1, Windows Server 2008 Service Pack 2, Wi
016 (Server Core installation), Windows 7, Windows 7 Service Pack 1, Windows 8.1, Windows Server 2008 Service Pack 2, Windows Server 2008 Service Pack 2 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 R2 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) Problem Types: Denial of Service Description: Windows Lightweight Directory Access Protocol (LDAP) Denial of Service Vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://msrc.microsoft.com/update-guide
e Vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26831
CVE ID: CVE-2022-26832 State: PUBLISHED Published: 2022-04-15T19:05:27 Last Updated: 2025-01-02T18:52:13.987Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft .NET Framework 3.5 AND 4.8, Microsoft .NET Framework 4.5.2, Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.2, Microsoft .NET Framework 4.8, Microsoft .NET Framework 3.5 AND 4.7.2, Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2, Microsoft .NET Framework 4.6, Microsoft .NET Framework 2.0 Service Pack 2, Microsoft .NET Framework 3.0 Service Pack 2, Microsoft .NET Framework 3.5, Microsoft .NET Framework 3.5.1 Problem Types: Denial of Service Descript
0 Service Pack 2, Microsoft .NET Framework 3.5, Microsoft .NET Framework 3.5.1 Problem Types: Denial of Service Description: .NET Framework Denial of Service Vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26832
CVE ID: CVE-2022-26833 State: PUBLISHED Published: 2022-05-25T20:15:28.072723Z Last Updated: 2024-09-16T23:11:11.171Z Severity: CRITICAL (CVSS 9.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H) Vendors: Open Automation Software Products: OAS Platform Problem Types: CWE-306 Description: An improper authentication vulnerability exists in the REST API functionality of Open Automation Software OAS Platform V16.00.0121. A specially-crafted series of HTTP requests can lead to unauthenticated use of the REST API. An attacker can send a series of HTTP requests to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_re
ability. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2022-1513
CVE ID: CVE-2022-26834 State: PUBLISHED Published: 2022-06-13T04:50:27 Last Updated: 2024-08-03T05:11:44.548Z Vendors: Rakuten Mobile, Inc. Products: Rakuten Casa Problem Types: Improper Access Control Description: Improper access control vulnerability in Rakuten Casa version AP_F_V1_4_1 or AP_F_V2_0_0 allows a remote attacker to obtain the information stored in the product because the product is set to accept HTTP connections from the WAN side by default. Additional Analyst Notes: - CVE Program Container: References: - https://network.mobile.rakuten.co.jp/information/news/product/1033/ - https://jvn.jp/en/jp/JVN46892984/index.html
CVE ID: CVE-2022-26835 State: PUBLISHED Published: 2022-05-05T16:04:43.223591Z Last Updated: 2024-09-17T03:38:10.123Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: F5 Products: BIG-IP Problem Types: CWE-22 Description: On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions of 12.1.x and 11.6.x, directory traversal vulnerabilities exist in undisclosed iControl REST endpoints and TMOS Shell (tmsh) commands in F5 BIG-IP Guided Configuration, which may allow an authenticated attacker with at least resource administrator role privileges to read arbit
figuration, which may allow an authenticated attacker with at least resource administrator role privileges to read arbitrary files. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K53197140
CVE ID: CVE-2022-26836 State: PUBLISHED Published: 2022-03-29T16:37:09.752Z Last Updated: 2025-04-16T16:36:05.108Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Delta Electronics Products: DIAEnergie Problem Types: CWE-89 Description: Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability that exists in HandlerExport.ashx/Calendar. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system commands. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-081-01
CVE ID: CVE-2022-26837 State: PUBLISHED Published: 2023-02-16T19:59:58.036Z Last Updated: 2025-01-27T18:21:34.067Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) Processors Problem Types: escalation of privilege Description: Improper input validation in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00717.html
CVE ID: CVE-2022-26838 State: PUBLISHED Published: 2023-08-03T13:16:16.712Z Last Updated: 2024-10-17T14:14:01.224Z Vendors: Cybozu, Inc. Products: Cybozu Remote Service Problem Types: Path traversal Description: Path traversal vulnerability in Importing Mobile Device Data of Cybozu Remote Service 3.1.2 allows a remote authenticated attacker to cause a denial-of-service (DoS) condition. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jvn.jp/en/jp/JVN52694228/ - https://kb.cybozu.support/article/37653/
CVE ID: CVE-2022-26839 State: PUBLISHED Published: 2022-03-29T16:37:14.522Z Last Updated: 2025-04-16T17:58:28.610Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Delta Electronics Products: DIAEnergie Problem Types: CWE-276 Description: Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) is vulnerable to an incorrect default permission in the DIAEnergie application, which may allow an attacker to plant new files (such as DLLs) or replace existing executable files. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-081-01
CVE ID: CVE-2022-26840 State: PUBLISHED Published: 2023-02-16T19:59:54.631Z Last Updated: 2025-01-27T18:22:38.567Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) Quartus Prime Pro and Standard edition software Problem Types: escalation of privilege Description: Improper neutralization in the Intel(R) Quartus Prime Pro and Standard edition software may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00714.html
CVE ID: CVE-2022-26841 State: PUBLISHED Published: 2023-02-16T19:59:52.294Z Last Updated: 2025-01-27T18:23:26.492Z Severity: LOW (CVSS 2.5 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: n/a Products: Intel(R) SGX SDK software for Linux Problem Types: information disclosure Description: Insufficient control flow management for the Intel(R) SGX SDK software for Linux before version 2.16.100.1 may allow an authenticated user to potentially enable information disclosure via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00677.html
CVE ID: CVE-2022-26842 State: PUBLISHED Published: 2022-08-22T18:22:05.537Z Last Updated: 2025-04-15T18:52:14.185Z Severity: CRITICAL (CVSS 9.6 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: WWBN Products: AVideo Problem Types: CWE-79 Description: A reflected cross-site scripting (xss) vulnerability exists in the charts tab selection functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get an authenticated user to send a crafted HTTP request to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintell
erability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2022-1537 - https://github.com/WWBN/AVideo/blob/e04b1cd7062e16564157a82bae389eedd39fa088/updatedb/updateDb.v12.0.sql
CVE ID: CVE-2022-26843 State: PUBLISHED Published: 2023-02-16T19:59:44.276Z Last Updated: 2025-01-27T18:25:36.454Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) oneAPI DPC++/C++ Compiler Problem Types: escalation of privilege Description: Insufficient visual distinction of homoglyphs presented to user in the Intel(R) oneAPI DPC++/C++ Compiler before version 2022.1 for Intel(R) oneAPI Toolkits before version 2022.2 may allow an unauthenticated user to potentially enable escalation of privilege via network access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.intel.com/content/www/us
ional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00674.html
CVE ID: CVE-2022-26844 State: PUBLISHED Published: 2022-08-18T19:58:27.000Z Last Updated: 2025-02-25T17:14:15.216Z Vendors: n/a Products: version Problem Types: escalation of privilege Description: Insufficiently protected credentials in the installation binaries for Intel(R) SEAPI in all versions may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00701.html
CVE ID: CVE-2022-26845 State: PUBLISHED Published: 2022-11-11T15:48:35.294Z Last Updated: 2025-02-05T20:54:33.714Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N) Vendors: n/a Products: Intel(R) AMT Problem Types: escalation of privilege Description: Improper authentication in firmware for Intel(R) AMT before versions 11.8.93, 11.22.93, 11.12.93, 12.0.92, 14.1.67, 15.0.42, 16.1.25 may allow an unauthenticated user to potentially enable escalation of privilege via network access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00610.html
CVE ID: CVE-2022-26846 State: PUBLISHED Published: 2022-03-10T04:58:29 Last Updated: 2024-08-03T05:11:44.562Z Vendors: n/a Products: n/a Problem Types: n/a Description: SPIP before 3.2.14 and 4.x before 4.0.5 allows remote authenticated editors to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-security-announce/2022/msg00060.html - https://blog.spip.net/Mise-a-jour-critique-de-securite-sorties-de-SPIP-4-0-5-et-SPIP-3-2-14.html - https://git.spip.net/spip/medias/commit/3014b845da2dd8ad15ff04b50fd9dbba388a9ca2 - https://lists.debian.org/debian-lts-announce/2022/03/msg00020.html
CVE ID: CVE-2022-26847 State: PUBLISHED Published: 2022-03-10T04:58:16 Last Updated: 2024-08-03T05:11:44.557Z Vendors: n/a Products: n/a Problem Types: n/a Description: SPIP before 3.2.14 and 4.x before 4.0.5 allows unauthenticated access to information about editorial objects. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-security-announce/2022/msg00060.html - https://blog.spip.net/Mise-a-jour-critique-de-securite-sorties-de-SPIP-4-0-5-et-SPIP-3-2-14.html - https://git.spip.net/spip/medias/commit/3014b845da2dd8ad15ff04b50fd9dbba388a9ca2 - https://lists.debian.org/debian-lts-announce/2022/03/msg00020.html
CVE ID: CVE-2022-26850 State: PUBLISHED Published: 2022-04-06T17:40:09 Last Updated: 2024-08-03T05:11:45.347Z Vendors: Apache Software Foundation Products: Apache NiFi Problem Types: Insufficiently protected credentials Description: When creating or updating credentials for single-user access, Apache NiFi wrote a copy of the Login Identity Providers configuration to the operating system temporary directory. On most platforms, the operating system temporary directory has global read permissions. NiFi immediately moved the temporary file to the final configuration directory, which significantly limited the window of opportunity for access. NiFi 1.16.0 includes updates to replace the Login Iden
which significantly limited the window of opportunity for access. NiFi 1.16.0 includes updates to replace the Login Identity Providers configuration without writing a file to the operating system temporary directory. Additional Analyst Notes: - CVE Program Container: References: - https://nifi.apache.org/security.html#CVE-2022-26850 - http://www.openwall.com/lists/oss-security/2022/04/06/2
CVE ID: CVE-2022-26851 State: PUBLISHED Published: 2022-04-08T19:50:30.796434Z Last Updated: 2024-09-16T16:58:03.640Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) Vendors: Dell Products: PowerScale OneFS Problem Types: CWE-330 Description: Dell PowerScale OneFS, 8.2.2-9.3.x, contains a predictable file name from observable state vulnerability. An unprivileged network attacker could potentially exploit this vulnerability, leading to data loss. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/en-us/000197991/dell-emc-powerscale-onefs-security-update-for-multiple-component-vulnerabilities
CVE ID: CVE-2022-26852 State: PUBLISHED Published: 2022-04-08T19:50:32.150020Z Last Updated: 2024-09-17T01:16:28.737Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Dell Products: PowerScale OneFS Problem Types: CWE-337 Description: Dell PowerScale OneFS, versions 8.2.x-9.3.x, contain a predictable seed in pseudo-random number generator. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to an account compromise. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/en-us/000197991/dell-emc-powerscale-onefs-security-update-for-multiple-component-vulnerabilities
CVE ID: CVE-2022-26853 State: REJECTED Published: N/A Last Updated: 2023-05-12T00:00:00 Description: No description available.
CVE ID: CVE-2022-26854 State: PUBLISHED Published: 2022-04-08T19:50:33.620082Z Last Updated: 2024-09-17T00:15:32.647Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Dell Products: PowerScale OneFS Problem Types: CWE-327 Description: Dell PowerScale OneFS, versions 8.2.x-9.2.x, contain risky cryptographic algorithms. A remote unprivileged malicious attacker could potentially exploit this vulnerability, leading to full system access Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/en-us/000197991/dell-emc-powerscale-onefs-security-update-for-multiple-component-vulnerabilities
CVE ID: CVE-2022-26855 State: PUBLISHED Published: 2022-04-08T19:50:35.306069Z Last Updated: 2024-09-17T01:36:38.734Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Dell Products: PowerScale OneFS Problem Types: CWE-276 Description: Dell PowerScale OneFS, versions 8.2.x-9.3.0.x, contains an incorrect default permissions vulnerability. A local malicious user could potentially exploit this vulnerability, leading to a denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/en-us/000197991/dell-emc-powerscale-onefs-security-update-for-multiple-component-vulnerabilities
CVE ID: CVE-2022-26856 State: PUBLISHED Published: 2022-04-21T20:50:18.125891Z Last Updated: 2024-09-16T22:41:04.293Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: Dell Products: Dell Repository Manager (DRM) Problem Types: CWE-522 Description: Dell EMC Repository Manager version 3.4.0 contains a plain-text password storage vulnerability. A local attacker could potentially exploit this vulnerability, leading to the disclosure of certain user credentials. The attacker may be able to use the exposed credentials to access the vulnerable application's database with privileges of the compromised account. Additional Analyst Notes: - CVE Program Container: Referenc
ation's database with privileges of the compromised account. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/000197797
CVE ID: CVE-2022-26857 State: PUBLISHED Published: 2022-05-26T15:20:23.567062Z Last Updated: 2024-09-17T02:41:43.074Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: Dell Products: OpenManage Enterprise Problem Types: CWE-285 Description: Dell OpenManage Enterprise Versions 3.8.3 and prior contain an improper authorization vulnerability. A remote authenticated malicious user with low privileges may potentially exploit this vulnerability to bypass blocked functionalities and perform unauthorized actions. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/en-us/000197800/dsa-2022-077
CVE ID: CVE-2022-26858 State: PUBLISHED Published: 2022-09-06T20:15:17.414515Z Last Updated: 2024-09-17T04:03:52.706Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:N) Vendors: Dell Products: CPG BIOS Problem Types: CWE-287 Description: Dell BIOS versions contain an Improper Authentication vulnerability. A locally authenticated malicious user could potentially exploit this vulnerability by sending malicious input to an SMI in order to bypass security controls. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/000202194
CVE ID: CVE-2022-26859 State: PUBLISHED Published: 2022-09-06T20:15:18.435805Z Last Updated: 2024-09-16T20:27:09.531Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:H/A:N) Vendors: Dell Products: CPG BIOS Problem Types: CWE-367 Description: Dell BIOS contains a race condition vulnerability. A local attacker could exploit this vulnerability by sending malicious input via SMI in order to bypass security checks during SMM. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/000202194
CVE ID: CVE-2022-26860 State: PUBLISHED Published: 2022-09-06T20:15:19.312759Z Last Updated: 2024-09-17T04:04:28.424Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Dell Products: CPG BIOS Problem Types: CWE-121 Description: Dell BIOS versions contain a stack-based buffer overflow vulnerability. A local attacker could exploit this vulnerability by sending malicious input via SMI to bypass security checks resulting in arbitrary code execution in SMM. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/000202194
CVE ID: CVE-2022-26861 State: PUBLISHED Published: 2022-09-06T20:15:20.148780Z Last Updated: 2024-09-16T20:47:50.610Z Severity: HIGH (CVSS 7.9 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N) Vendors: Dell Products: CPG BIOS Problem Types: CWE-1038 Description: Dell BIOS versions contain an Insecure Automated Optimization vulnerability. A local authenticated malicious user could exploit this vulnerability by sending malicious input via SMI to obtain arbitrary code execution during SMM. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/000202194
CVE ID: CVE-2022-26862 State: PUBLISHED Published: 2022-06-23T17:55:12.018068Z Last Updated: 2024-09-16T17:49:05.234Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L) Vendors: Dell Products: CPG BIOS Problem Types: CWE-20 Description: Prior Dell BIOS versions contain an Input Validation vulnerability. A locally authenticated malicious user could potentially exploit this vulnerability by sending malicious input to an SMI in order to bypass security controls in SMM. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/en-us/000200568/dsa-2022-096
CVE ID: CVE-2022-26863 State: PUBLISHED Published: 2022-06-23T17:55:13.573946Z Last Updated: 2024-09-16T20:48:18.563Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L) Vendors: Dell Products: CPG BIOS Problem Types: CWE-20 Description: Prior Dell BIOS versions contain an Input Validation vulnerability. A locally authenticated malicious user could potentially exploit this vulnerability by sending malicious input to an SMI in order to bypass security controls in SMM. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/en-us/000200568/dsa-2022-096