Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-42934 State: PUBLISHED Published: 2022-10-21T00:00:00.000Z Last Updated: 2025-05-07T19:40:20.678Z Vendors: n/a Products: Autodesk Design Review Problem Types: Memory corruption Read Description: A malicious crafted .dwf or .pct file when consumed through DesignReview.exe application could lead to memory corruption vulnerability by write access violation. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0004
CVE ID: CVE-2022-42935 State: PUBLISHED Published: 2022-10-21T00:00:00.000Z Last Updated: 2025-05-07T19:39:14.237Z Vendors: n/a Products: Autodesk Design Review Problem Types: Memory corruption Read Description: A malicious crafted .dwf or .pct file when consumed through DesignReview.exe application could lead to memory corruption vulnerability by write access violation. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0004
CVE ID: CVE-2022-42936 State: PUBLISHED Published: 2022-10-21T00:00:00.000Z Last Updated: 2025-05-07T19:37:16.824Z Vendors: n/a Products: Autodesk Design Review Problem Types: Memory corruption Read Description: A malicious crafted .dwf or .pct file when consumed through DesignReview.exe application could lead to memory corruption vulnerability by write access violation. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0004
CVE ID: CVE-2022-42937 State: PUBLISHED Published: 2022-10-21T00:00:00.000Z Last Updated: 2025-05-07T19:36:10.704Z Vendors: n/a Products: Autodesk Design Review Problem Types: Memory corruption Read Description: A malicious crafted .dwf or .pct file when consumed through DesignReview.exe application could lead to memory corruption vulnerability by write access violation. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0004
CVE ID: CVE-2022-42938 State: PUBLISHED Published: 2022-10-21T00:00:00.000Z Last Updated: 2025-05-07T19:33:59.054Z Vendors: n/a Products: Autodesk Design Review Problem Types: Memory corruption vulnerability Description: A malicious crafted TGA file when consumed through DesignReview.exe application could lead to memory corruption vulnerability. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0004
CVE ID: CVE-2022-42939 State: PUBLISHED Published: 2022-10-21T00:00:00.000Z Last Updated: 2025-05-07T19:32:19.605Z Vendors: n/a Products: Autodesk Design Review Problem Types: Memory corruption vulnerability Description: A malicious crafted TGA file when consumed through DesignReview.exe application could lead to memory corruption vulnerability. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0004
CVE ID: CVE-2022-42940 State: PUBLISHED Published: 2022-10-21T00:00:00.000Z Last Updated: 2025-05-07T16:04:31.190Z Vendors: n/a Products: Autodesk Design Review Problem Types: Memory corruption vulnerability Description: A malicious crafted TGA file when consumed through DesignReview.exe application could lead to memory corruption vulnerability. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0004
CVE ID: CVE-2022-42941 State: PUBLISHED Published: 2022-10-21T00:00:00.000Z Last Updated: 2025-05-07T16:02:49.939Z Vendors: n/a Products: Autodesk Design Review Problem Types: Memory corruption vulnerability Description: A malicious crafted dwf or .pct file when consumed through DesignReview.exe application could lead to memory corruption vulnerability by read access violation. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0004
CVE ID: CVE-2022-42942 State: PUBLISHED Published: 2022-10-21T00:00:00.000Z Last Updated: 2025-05-08T14:07:19.137Z Vendors: n/a Products: Autodesk Design Review Problem Types: Memory corruption vulnerability Description: A malicious crafted dwf or .pct file when consumed through DesignReview.exe application could lead to memory corruption vulnerability by read access violation. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0004
CVE ID: CVE-2022-42943 State: PUBLISHED Published: 2022-10-21T00:00:00.000Z Last Updated: 2025-05-07T16:01:24.491Z Vendors: n/a Products: Autodesk Design Review Problem Types: Memory corruption vulnerability Description: A malicious crafted dwf or .pct file when consumed through DesignReview.exe application could lead to memory corruption vulnerability by read access violation. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0004
CVE ID: CVE-2022-42944 State: PUBLISHED Published: 2022-10-21T00:00:00.000Z Last Updated: 2025-05-07T15:58:53.599Z Vendors: n/a Products: Autodesk Design Review Problem Types: Memory corruption vulnerability Description: A malicious crafted dwf or .pct file when consumed through DesignReview.exe application could lead to memory corruption vulnerability by read access violation. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0004
CVE ID: CVE-2022-42945 State: PUBLISHED Published: 2022-12-19T00:00:00.000Z Last Updated: 2025-04-17T14:56:28.442Z Vendors: n/a Products: DWG TrueView Problem Types: Search Order Hijacking Description: DWG TrueViewTM 2023 version has a DLL Search Order Hijacking vulnerability. Successful exploitation by a malicious attacker could result in remote code execution on the target system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0024
CVE ID: CVE-2022-42946 State: PUBLISHED Published: 2022-12-19T00:00:00.000Z Last Updated: 2025-04-17T14:54:48.090Z Vendors: n/a Products: Autodesk Maya Problem Types: Out-of-bound Read Description: Parsing a maliciously crafted X_B and PRT file can force Autodesk Maya 2023 and 2022 to read beyond allocated buffer. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0020
CVE ID: CVE-2022-42947 State: PUBLISHED Published: 2022-12-19T00:00:00.000Z Last Updated: 2025-04-17T14:45:50.307Z Vendors: n/a Products: Autodesk Maya Problem Types: Out-of-bound Write Description: A maliciously crafted X_B file when parsed through Autodesk Maya 2023 and 2022 can be used to write beyond the allocated buffer. This vulnerability can lead to arbitrary code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0020
CVE ID: CVE-2022-42948 State: PUBLISHED Published: 2023-03-24T00:00:00.000Z Last Updated: 2025-10-21T23:15:21.818Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cobalt Strike 4.7.1 fails to properly escape HTML tags when they are displayed on Swing components. By injecting crafted HTML code, it is possible to remotely execute code in the Cobalt Strike UI. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cobaltstrike.com/blog/ - https://www.redpacketsecurity.com/helpsystems-cobalt-strike-code-execution-cve-2022-42948/ - https://thesecmaster.com/how-to-fix-cve-2022-42948-a-critical-rce-vulnerability-in-cobalt-strike/
CVE ID: CVE-2022-42949 State: PUBLISHED Published: 2022-12-20T00:00:00.000Z Last Updated: 2025-04-17T13:48:01.288Z Vendors: n/a Products: n/a Problem Types: n/a Description: Silverstripe silverstripe/subsites through 2.6.0 has Insecure Permissions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.silverstripe.org/download/security-releases/ - https://www.silverstripe.org/download/security-releases/cve-2022-42949
CVE ID: CVE-2022-42950 State: PUBLISHED Published: 2023-02-06T00:00:00.000Z Last Updated: 2025-03-26T14:31:42.349Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Couchbase Server 7.x before 7.0.5 and 7.1.x before 7.1.2. A crafted HTTP REST request from an administrator account to the Couchbase Server Backup Service can exhaust memory resources, causing the process to be killed, which can be used for denial of service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://forums.couchbase.com/tags/security - https://docs.couchbase.com/server/current/release-notes/relnotes.html - https://www.couchbase.com/alerts
tags/security - https://docs.couchbase.com/server/current/release-notes/relnotes.html - https://www.couchbase.com/alerts/
CVE ID: CVE-2022-42951 State: PUBLISHED Published: 2023-02-06T00:00:00.000Z Last Updated: 2025-03-26T14:29:39.706Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Couchbase Server 6.5.x and 6.6.x before 6.6.6, 7.x before 7.0.5, and 7.1.x before 7.1.2. During the start-up of a Couchbase Server node, there is a small window of time (before the cluster management authentication has started) where an attacker can connect to the cluster manager using default credentials. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://forums.couchbase.com/tags/security - https://docs.couchbase.com/server/current/release-notes/
ent: References: - https://forums.couchbase.com/tags/security - https://docs.couchbase.com/server/current/release-notes/relnotes.html - https://www.couchbase.com/alerts/
CVE ID: CVE-2022-42953 State: PUBLISHED Published: 2022-12-25T00:00:00.000Z Last Updated: 2025-04-15T13:33:43.485Z Vendors: n/a Products: n/a Problem Types: n/a Description: Certain ZKTeco products (ZEM500-510-560-760, ZEM600-800, ZEM720, ZMM) allow access to sensitive information via direct requests for the form/DataApp?style=1 and form/DataApp?style=0 URLs. The affected versions may be before 8.88 (ZEM500-510-560-760, ZEM600-800, ZEM720) and 15.00 (ZMM200-220-210). The fixed versions are firmware version 8.88 (ZEM500-510-560-760, ZEM600-800, ZEM720) and firmware version 15.00 (ZMM200-220-210). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https:/
5.00 (ZMM200-220-210). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.redteam-pentesting.de/en/advisories/-advisories-publicised-vulnerability-analyses - https://seclists.org/fulldisclosure/2022/Oct/23
CVE ID: CVE-2022-42954 State: PUBLISHED Published: 2022-11-17T00:00:00.000Z Last Updated: 2025-04-30T14:17:59.518Z Vendors: n/a Products: n/a Problem Types: n/a Description: Keyfactor EJBCA before 7.10.0 allows XSS. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.keyfactor.com/s/detail/a6x1Q000000CwCjQAK
CVE ID: CVE-2022-42955 State: PUBLISHED Published: 2022-11-07T00:00:00.000Z Last Updated: 2025-05-05T17:48:04.680Z Vendors: n/a Products: n/a Problem Types: n/a Description: The PassWork extension 5.0.9 for Chrome and other browsers allows an attacker to obtain cleartext cached credentials. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://chrome.google.com/webstore/detail/passwork-self-hosted/ibiipnmmlnehmeonnhbdajcfagcgihkl - https://passwork.canny.io/changelog/version-5110
CVE ID: CVE-2022-42956 State: PUBLISHED Published: 2022-11-07T00:00:00.000Z Last Updated: 2025-05-05T17:50:05.408Z Vendors: n/a Products: n/a Problem Types: n/a Description: The PassWork extension 5.0.9 for Chrome and other browsers allows an attacker to obtain the cleartext master password. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://chrome.google.com/webstore/detail/passwork-self-hosted/ibiipnmmlnehmeonnhbdajcfagcgihkl - https://passwork.canny.io/changelog/version-5110
CVE ID: CVE-2022-42960 State: PUBLISHED Published: 2022-11-16T00:00:00.000Z Last Updated: 2025-04-30T15:50:34.540Z Vendors: n/a Products: n/a Problem Types: n/a Description: EqualWeb Accessibility Widget 2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.1.10, 3.0.0, 3.0.1, 3.0.2, 4.0.0, and 4.0.1 allows DOM XSS due to improper validation of message events to accessibility.js. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.imperva.com/blog/vulnerability-discovered-in-equalweb-accessibility-widget/
CVE ID: CVE-2022-42961 State: PUBLISHED Published: 2022-10-15T00:00:00.000Z Last Updated: 2025-05-14T14:44:18.814Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in wolfSSL before 5.5.0. A fault injection attack on RAM via Rowhammer leads to ECDSA key disclosure. Users performing signing operations with private ECC keys, such as in server-side TLS connections, might leak faulty ECC signatures. These signatures can be processed via an advanced technique for ECDSA key recovery. (In 5.5.0 and later, WOLFSSL_CHECK_SIG_FAULTS can be used to address the vulnerability.) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http
dress the vulnerability.) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/wolfSSL/wolfssl/releases/tag/v5.5.0-stable
CVE ID: CVE-2022-42964 State: PUBLISHED Published: 2022-11-09T00:00:00.000Z Last Updated: 2025-05-01T19:19:37.705Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: pymatgen Products: pymatgen Problem Types: CWE-1333 Description: An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the pymatgen PyPI package, when an attacker is able to supply arbitrary input to the GaussianInput.from_string method Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://research.jfrog.com/vulnerabilities/pymatgen-redos-xray-257184/
CVE ID: CVE-2022-42965 State: PUBLISHED Published: 2022-11-09T00:00:00.000Z Last Updated: 2025-05-01T19:19:10.818Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: snowflake-connector-python Products: snowflake-connector-python Problem Types: CWE-1333 Description: An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the snowflake-connector-python PyPI package, when an attacker is able to supply arbitrary input to the undocumented get_file_transfer_type method Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://research.jfrog.com/vulnerabilities/snowflake-connector-python-redos-xray-257185/
CVE ID: CVE-2022-42966 State: PUBLISHED Published: 2022-11-09T00:00:00.000Z Last Updated: 2025-05-01T19:18:38.356Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: cleo Products: cleo Problem Types: CWE-1333 Description: An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the cleo PyPI package, when an attacker is able to supply arbitrary input to the Table.set_rows method Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://research.jfrog.com/vulnerabilities/cleo-redos-xray-257186/
CVE ID: CVE-2022-42967 State: PUBLISHED Published: 2023-01-11T00:00:00.000Z Last Updated: 2025-04-08T14:34:55.464Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: careteditor Products: caret Problem Types: CWE-79 Description: Caret is vulnerable to an XSS attack when the user opens a crafted Markdown file when preview mode is enabled. This directly leads to client-side code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://research.jfrog.com/vulnerabilities/caret-xss-rce/
CVE ID: CVE-2022-42968 State: PUBLISHED Published: 2022-10-16T00:00:00.000Z Last Updated: 2025-05-14T14:34:03.454Z Vendors: n/a Products: n/a Problem Types: n/a Description: Gitea before 1.17.3 does not sanitize and escape refs in the git backend. Arguments to git commands are mishandled. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/go-gitea/gitea/pull/21463 - https://github.com/go-gitea/gitea/releases/tag/v1.17.3 - https://security.gentoo.org/glsa/202210-14
CVE ID: CVE-2022-42969 State: PUBLISHED Published: 2022-10-16T00:00:00.000Z Last Updated: 2025-05-14T14:15:50.246Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AC:L/AV:N/A:L/C:N/I:N/PR:N/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: The py library through 1.11.0 for Python allows remote attackers to conduct a ReDoS (Regular expression Denial of Service) attack via a Subversion repository with crafted info data, because the InfoSvnCommand argument is mishandled. Note: This has been disputed by multiple third parties as not being reproduceable and they argue this is not a valid vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References:
s is not a valid vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://pypi.org/project/py - https://github.com/pytest-dev/py/issues/287 - https://github.com/pytest-dev/py/blob/cb87a83960523a2367d0f19226a73aed4ce4291d/py/_path/svnurl.py#L316 - https://news.ycombinator.com/item?id=34163710
CVE ID: CVE-2022-42970 State: PUBLISHED Published: 2023-02-01T00:00:00.000Z Last Updated: 2025-02-05T20:17:08.771Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Schneider Electric Products: APC Easy UPS Online Monitoring Software, Schneider Electric Easy UPS Online Monitoring Software Problem Types: CWE-306 Description: A CWE-306: Missing Authentication for Critical Function The software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. Affected Products: APC Easy UPS Online Monitoring Software (Windows 7, 10, 11 & Windows Server 2016, 2019, 2022 - Versions prior to
oducts: APC Easy UPS Online Monitoring Software (Windows 7, 10, 11 & Windows Server 2016, 2019, 2022 - Versions prior to V2.5-GA), APC Easy UPS Online Monitoring Software (Windows 11, Windows Server 2019, 2022 - Versions prior to V2.5-GA-01-22261), Schneider Electric Easy UPS Online Monitoring Software (Windows 7, 10, 11 & Windows Server 2016, 2019, 2022 - Versions prior to V2.5-GS), Schneider Electric Easy UPS Online Monitoring Software (Windows 11, Windows Server 2019, 2022 - Versions prior to V2.5-GS-01-22261) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_Doc_SEVD-2022-347-01&p_enDocType=Security+a
Vulnrichment: References: - https://download.schneider-electric.com/files?p_Doc_SEVD-2022-347-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2022-347-01_Easy_UPS_Online_Monitoring_Software_Security_Notification.pdf
CVE ID: CVE-2022-42971 State: PUBLISHED Published: 2023-02-01T00:00:00.000Z Last Updated: 2025-02-05T20:16:59.507Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Schneider Electric Products: APC Easy UPS Online Monitoring Software, Schneider Electric Easy UPS Online Monitoring Software Problem Types: CWE-434 Description: A CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists that could cause remote code execution when the attacker uploads a malicious JSP file. Affected Products: APC Easy UPS Online Monitoring Software (Windows 7, 10, 11 & Windows Server 2016, 2019, 2022 - Versions prior to V2.5-GA), APC Easy UPS Online Monitoring
tware (Windows 7, 10, 11 & Windows Server 2016, 2019, 2022 - Versions prior to V2.5-GA), APC Easy UPS Online Monitoring Software (Windows 11, Windows Server 2019, 2022 - Versions prior to V2.5-GA-01-22261), Schneider Electric Easy UPS Online Monitoring Software (Windows 7, 10, 11 & Windows Server 2016, 2019, 2022 - Versions prior to V2.5-GS), Schneider Electric Easy UPS Online Monitoring Software (Windows 11, Windows Server 2019, 2022 - Versions prior to V2.5-GS-01-22261) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_Doc_SEVD-2022-347-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2022-347
oad.schneider-electric.com/files?p_Doc_SEVD-2022-347-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2022-347-01_Easy_UPS_Online_Monitoring_Software_Security_Notification.pdf
CVE ID: CVE-2022-42972 State: PUBLISHED Published: 2023-02-01T00:00:00.000Z Last Updated: 2025-02-05T20:06:37.394Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Schneider Electric Products: APC Easy UPS Online Monitoring Software, Schneider Electric Easy UPS Online Monitoring Software Problem Types: CWE-732 Description: A CWE-732: Incorrect Permission Assignment for Critical Resource vulnerability exists that could cause local privilege escalation when a local attacker modifies the webroot directory. Affected Products: APC Easy UPS Online Monitoring Software (Windows 7, 10, 11 & Windows Server 2016, 2019, 2022 - Versions prior to V2.5-GA), APC Easy UPS Onlin
onitoring Software (Windows 7, 10, 11 & Windows Server 2016, 2019, 2022 - Versions prior to V2.5-GA), APC Easy UPS Online Monitoring Software (Windows 11, Windows Server 2019, 2022 - Versions prior to V2.5-GA-01-22261), Schneider Electric Easy UPS Online Monitoring Software (Windows 7, 10, 11 & Windows Server 2016, 2019, 2022 - Versions prior to V2.5-GS), Schneider Electric Easy UPS Online Monitoring Software (Windows 11, Windows Server 2019, 2022 - Versions prior to V2.5-GS-01-22261) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_Doc_SEVD-2022-347-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=
https://download.schneider-electric.com/files?p_Doc_SEVD-2022-347-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2022-347-01_Easy_UPS_Online_Monitoring_Software_Security_Notification.pdf