Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-22780 State: PUBLISHED Published: 2022-02-09T22:05:15.893138Z Last Updated: 2024-09-16T21:04:27.677Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:L) Vendors: Zoom Video Communications Inc Products: Zoom Client for Meetings for Android, Zoom Client for Meetings for iOS, Zoom Client for Meetings for Linux, Zoom Client for Meetings for macOS, Zoom Client for Meetings for Windows Problem Types: Allocation of Resources Without Limits or Throttling Description: The Zoom Client for Meetings chat functionality was susceptible to Zip bombing attacks in the following product versions: Android before version 5.8.6, iOS before version 5.9.0, Linux before version
attacks in the following product versions: Android before version 5.8.6, iOS before version 5.9.0, Linux before version 5.8.6, macOS before version 5.7.3, and Windows before version 5.6.3. This could lead to availability issues on the client host by exhausting system resources. Additional Analyst Notes: - CVE Program Container: References: - https://explore.zoom.us/en/trust/security/security-bulletin
CVE ID: CVE-2022-22781 State: PUBLISHED Published: 2022-04-28T14:59:42.884834Z Last Updated: 2024-09-16T21:03:45.189Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Zoom Video Communications Inc Products: Zoom Client for Meetings for MacOS (Standard and for IT Admin) Problem Types: Use of Less Trusted Source Description: The Zoom Client for Meetings for MacOS (Standard and for IT Admin) prior to version 5.9.6 failed to properly check the package version during the update process. This could lead to a malicious actor updating an unsuspecting user’s currently installed version to a less secure version. Additional Analyst Notes: - CVE Program Container: Referenc
user’s currently installed version to a less secure version. Additional Analyst Notes: - CVE Program Container: References: - https://explore.zoom.us/en/trust/security/security-bulletin/
CVE ID: CVE-2022-22782 State: PUBLISHED Published: 2022-04-28T15:00:14.188227Z Last Updated: 2024-09-17T02:37:08.661Z Severity: HIGH (CVSS 7.9 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H) Vendors: Zoom Video Communications Inc Products: Zoom Client for Meetings for Windows, Zoom Rooms for Conference Room for Windows, Zoom Plugins for Microsoft Outlook for Windows, Zoom VDI Windows Meeting Clients Problem Types: Incorrect Privilege Assignment Description: The Zoom Client for Meetings for Windows prior to version 5.9.7, Zoom Rooms for Conference Room for Windows prior to version 5.10.0, Zoom Plugins for Microsoft Outlook for Windows prior to version 5.10.3, and Zoom VDI Windows Meeting Client
sion 5.10.0, Zoom Plugins for Microsoft Outlook for Windows prior to version 5.10.3, and Zoom VDI Windows Meeting Clients prior to version 5.9.6; was susceptible to a local privilege escalation issue during the installer repair operation. A malicious actor could utilize this to potentially delete system level files or folders, causing integrity or availability issues on the user’s host machine. Additional Analyst Notes: - CVE Program Container: References: - https://explore.zoom.us/en/trust/security/security-bulletin/
CVE ID: CVE-2022-22783 State: PUBLISHED Published: 2022-04-28T15:00:36.785255Z Last Updated: 2024-09-17T01:16:05.149Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Zoom Video Communications Inc Products: Zoom On-Premise Meeting Connector Controller, Zoom On-Premise Meeting Connector MMR Problem Types: Missing Initialization of a Variable Description: A vulnerability in Zoom On-Premise Meeting Connector Controller version 4.8.102.20220310 and On-Premise Meeting Connector MMR version 4.8.102.20220310 exposes process memory fragments to connected clients, which could be observed by a passive attacker. Additional Analyst Notes: - CVE Program Container: Referen
ected clients, which could be observed by a passive attacker. Additional Analyst Notes: - CVE Program Container: References: - https://explore.zoom.us/en/trust/security/security-bulletin/
CVE ID: CVE-2022-22784 State: PUBLISHED Published: 2022-05-18T15:41:50.592964Z Last Updated: 2024-09-16T17:59:18.129Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: Zoom Video Communications Inc Products: Zoom Client for Meetings for Android, Zoom Client for Meetings for iOS, Zoom Client for Meetings for Linux, Zoom Client for Meetings for MacOS, Zoom Client for Meetings for Windows Problem Types: Improper Input Validation Description: The Zoom Client for Meetings (for Android, iOS, Linux, MacOS, and Windows) before version 5.10.0 failed to properly parse XML stanzas in XMPP messages. This can allow a malicious user to break out of the current XMPP message co
properly parse XML stanzas in XMPP messages. This can allow a malicious user to break out of the current XMPP message context and create a new message context to have the receiving users client perform a variety of actions.This issue could be used in a more sophisticated attack to forge XMPP messages from the server. Additional Analyst Notes: - CVE Program Container: References: - https://explore.zoom.us/en/trust/security/security-bulletin
CVE ID: CVE-2022-22785 State: PUBLISHED Published: 2022-05-18T15:42:19.156563Z Last Updated: 2024-09-17T02:41:15.335Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:L) Vendors: Zoom Video Communications Inc Products: Zoom Client for Meetings for Android, Zoom Client for Meetings for iOS, Zoom Client for Meetings for Linux, Zoom Client for Meetings for MacOS, Zoom Client for Meetings for Windows Problem Types: Exposure of Resource to Wrong Sphere Description: The Zoom Client for Meetings (for Android, iOS, Linux, MacOS, and Windows) before version 5.10.0 failed to properly constrain client session cookies to Zoom domains. This issue could be used in a more sophisticated
.0 failed to properly constrain client session cookies to Zoom domains. This issue could be used in a more sophisticated attack to send an unsuspecting users Zoom-scoped session cookies to a non-Zoom domain. This could potentially allow for spoofing of a Zoom user. Additional Analyst Notes: - CVE Program Container: References: - https://explore.zoom.us/en/trust/security/security-bulletin
CVE ID: CVE-2022-22786 State: PUBLISHED Published: 2022-05-18T15:42:46.414562Z Last Updated: 2024-09-16T18:38:27.311Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Zoom Video Communications Inc Products: Zoom Client for Meetings for Windows, Zoom Rooms for Conference Room for Windows Problem Types: Use of Less Trusted Source Description: The Zoom Client for Meetings for Windows before version 5.10.0 and Zoom Rooms for Conference Room for Windows before version 5.10.0, fails to properly check the installation version during the update process. This issue could be used in a more sophisticated attack to trick a user into downgrading their Zoom client to a less
s. This issue could be used in a more sophisticated attack to trick a user into downgrading their Zoom client to a less secure version. Additional Analyst Notes: - CVE Program Container: References: - https://explore.zoom.us/en/trust/security/security-bulletin
CVE ID: CVE-2022-22787 State: PUBLISHED Published: 2022-05-18T16:03:18.179310Z Last Updated: 2024-09-17T04:14:00.754Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:L) Vendors: Zoom Video Communications Inc Products: Zoom Client for Meetings for Android, Zoom Client for Meetings for iOS, Zoom Client for Meetings for Linux, Zoom Client for Meetings for MacOS, Zoom Client for Meetings for Windows Problem Types: Improper Input Validation Description: The Zoom Client for Meetings (for Android, iOS, Linux, macOS, and Windows) before version 5.10.0 fails to properly validate the hostname during a server switch request. This issue could be used in a more sophisticated attack
properly validate the hostname during a server switch request. This issue could be used in a more sophisticated attack to trick an unsuspecting users client to connect to a malicious server when attempting to use Zoom services. Additional Analyst Notes: - CVE Program Container: References: - https://explore.zoom.us/en/trust/security/security-bulletin - http://packetstormsecurity.com/files/167238/Zoom-XMPP-Stanza-Smuggling-Remote-Code-Execution.html
CVE ID: CVE-2022-22788 State: PUBLISHED Published: 2022-06-15T20:12:24.369929Z Last Updated: 2024-09-16T20:17:33.912Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Zoom Video Communications Inc Products: Zoom Client for Meetings, All Zoom Rooms for Conference Room for Windows Problem Types: Uncontrolled Search Path Element Description: The Zoom Opener installer is downloaded by a user from the Launch meeting page, when attempting to join a meeting without having the Zoom Meeting Client installed. The Zoom Opener installer for Zoom Client for Meetings before version 5.10.3 and Zoom Rooms for Conference Room for Windows before version 5.10.3 are susceptible to
r Meetings before version 5.10.3 and Zoom Rooms for Conference Room for Windows before version 5.10.3 are susceptible to a DLL injection attack. This vulnerability could be used to run arbitrary code on the victims host. Additional Analyst Notes: - CVE Program Container: References: - https://explore.zoom.us/en/trust/security/security-bulletin/
CVE ID: CVE-2022-22789 State: PUBLISHED Published: 2022-01-25T19:11:08 Last Updated: 2024-08-03T03:21:49.165Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L) Vendors: Charactell Products: FormStorm Enterprise Problem Types: Account Take Over Description: Charactell - FormStorm Enterprise Account takeover – An attacker can modify (add, remove and update) passwords file for all the users. The xx_users.ini file in the FormStorm folder contains usernames in cleartext and an obfuscated password. Malicious user can take over an account by replacing existing password in the file. Additional Analyst Notes: - CVE Program Container: References: - https://www.gov.il/en/departme
ng password in the file. Additional Analyst Notes: - CVE Program Container: References: - https://www.gov.il/en/departments/faq/cve_advisories
CVE ID: CVE-2022-22790 State: PUBLISHED Published: 2022-01-28T19:09:51 Last Updated: 2024-08-03T03:21:49.118Z Severity: MEDIUM (CVSS 5.6 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N) Vendors: n/a Products: n/a Problem Types: n/a Description: SYNEL - eharmony Directory Traversal. Directory Traversal - is an attack against a server or a Web application aimed at unauthorized access to the file system. on the "Name" parameter the attacker can return to the root directory and open the host file. The path exposes sensitive files that users upload Additional Analyst Notes: - CVE Program Container: References: - https://www.gov.il/en/departments/faq/cve_advisories
CVE ID: CVE-2022-22791 State: PUBLISHED Published: 2022-01-28T19:09:52 Last Updated: 2024-08-03T03:21:49.200Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N) Vendors: n/a Products: n/a Problem Types: n/a Description: SYNEL - eharmony Authenticated Blind & Stored XSS. Inject JS code into the "comments" field could lead to potential stealing of cookies, loading of HTML tags and JS code onto the system. Additional Analyst Notes: - CVE Program Container: References: - https://www.gov.il/en/departments/faq/cve_advisories
CVE ID: CVE-2022-22792 State: PUBLISHED Published: 2022-02-16T16:38:07.784746Z Last Updated: 2024-09-17T02:48:02.992Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L) Vendors: MobiSoft Products: eharmony Problem Types: CWE-233 Description: MobiSoft - MobiPlus User Take Over and Improper Handling of url Parameters Attacker can navigate to specific url which will expose all the users and password in clear text. http://IP/MobiPlusWeb/Handlers/MainHandler.ashx?MethodName=GridData&amp;GridName=Users Additional Analyst Notes: - CVE Program Container: References: - https://www.gov.il/en/departments/faq/cve_advisories
CVE ID: CVE-2022-22793 State: PUBLISHED Published: 2022-02-24T16:14:16.769448Z Last Updated: 2024-09-16T16:52:49.532Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:H) Vendors: Cybonet Products: Pineapp Mail Relay Problem Types: Local File Inclusion Description: Cybonet - PineApp Mail Relay Local File Inclusion. Attacker can send a request to : /manage/mailpolicymtm/log/eml_viewer/email.content.body.php?filesystem_path=ENCDODED PATH and by doing that, the attacker can read Local Files inside the server. Additional Analyst Notes: - CVE Program Container: References: - https://www.gov.il/en/departments/faq/cve_advisories
CVE ID: CVE-2022-22794 State: PUBLISHED Published: 2022-02-24T16:14:15.767373Z Last Updated: 2024-09-17T03:44:00.986Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:H) Vendors: Cybonet Products: Pineapp Mail Relay Problem Types: Unauthenticated Sql Injection to Remote Code Execution. Description: Cybonet - PineApp Mail Relay Unauthenticated Sql Injection. Attacker can send a request to: /manage/emailrichment/userlist.php?CUSTOMER_ID_INNER=1 /admin/emailrichment/userlist.php?CUSTOMER_ID_INNER=1 /manage/emailrichment/usersunlist.php?CUSTOMER_ID_INNER=1 /admin/emailrichment/usersunlist.php?CUSTOMER_ID_INNER=1 and by doing that, the attacker can run Remote Code Execution i
/admin/emailrichment/usersunlist.php?CUSTOMER_ID_INNER=1 and by doing that, the attacker can run Remote Code Execution in one liner. Additional Analyst Notes: - CVE Program Container: References: - https://www.gov.il/en/departments/faq/cve_advisories
CVE ID: CVE-2022-22795 State: PUBLISHED Published: 2022-03-09T14:56:32.876195Z Last Updated: 2024-09-17T04:19:02.100Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:P/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H) Vendors: Signiant Products: Signiant Problem Types: CWE-611 Description: Signiant - Manager+Agents XML External Entity (XXE) - Extract internal files of the affected machine An attacker can read all the system files, the product is running with root on Linux systems and nt/authority on windows systems, which allows him to access and extract any file on the systems, such as passwd, shadow, hosts and so on. By gaining access to these files, attackers can steal sensitive information from the victims machine
w, hosts and so on. By gaining access to these files, attackers can steal sensitive information from the victims machine. Additional Analyst Notes: - CVE Program Container: References: - https://www.gov.il/en/departments/faq/cve_advisories
CVE ID: CVE-2022-22796 State: PUBLISHED Published: 2022-05-12T19:47:32.643968Z Last Updated: 2024-09-17T02:27:31.416Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L) Vendors: SysAid Products: Sysaid Problem Types: System Take Over Description: Sysaid – Sysaid System Takeover - An attacker can bypass the authentication process by accessing to: /wmiwizard.jsp, Then to: /ConcurrentLogin.jsp, then click on the login button, and it will redirect you to /home.jsp without any authentication. Additional Analyst Notes: - CVE Program Container: References: - https://www.gov.il/en/departments/faq/cve_advisories
CVE ID: CVE-2022-22797 State: PUBLISHED Published: 2022-05-12T19:48:08.939813Z Last Updated: 2024-09-16T19:51:58.210Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: SysAid Products: Sysaid Problem Types: CWE-601 Description: Sysaid – sysaid Open Redirect - An Attacker can change the redirect link at the parameter "redirectURL" from"GET" request from the url location: /CommunitySSORedirect.jsp?redirectURL=https://google.com. Unvalidated redirects and forwards are possible when a web application accepts untrusted input that could cause the web application to redirect the request to a URL contained within untrusted input. By modifying untrusted URL input to a
eb application to redirect the request to a URL contained within untrusted input. By modifying untrusted URL input to a malicious site, an attacker may successfully launch a phishing scam and steal user credentials. Additional Analyst Notes: - CVE Program Container: References: - https://www.gov.il/en/departments/faq/cve_advisories
CVE ID: CVE-2022-22798 State: PUBLISHED Published: 2022-05-12T19:48:42.372877Z Last Updated: 2024-09-17T02:47:50.302Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L) Vendors: SysAid Products: Sysaid Problem Types: Broken Access Control Description: Sysaid – Pro Plus Edition, SysAid Help Desk Broken Access Control v20.4.74 b10, v22.1.20 b62, v22.1.30 b49 - An attacker needs to log in as a guest after that the system redirects him to the service portal or EndUserPortal.JSP, then he needs to change the path in the URL to /ConcurrentLogin%2ejsp after that he will receive an error message with a login button, by clicking on it, he will connect to the system dashboard. The
at he will receive an error message with a login button, by clicking on it, he will connect to the system dashboard. The attacker can receive sensitive data like server details, usernames, workstations, etc. He can also perform actions such as uploading files, deleting calls from the system. Additional Analyst Notes: - CVE Program Container: References: - https://www.gov.il/en/departments/faq/cve_advisories
CVE ID: CVE-2022-22804 State: PUBLISHED Published: 2022-02-04T22:29:39 Last Updated: 2024-08-03T03:21:49.127Z Vendors: n/a Products: EcoStruxure Power Monitoring Expert (Versions 2020 and prior) Problem Types: CWE-79 Description: A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could allow an authenticated attacker to view data, change settings, or impact availability of the software when the user visits a page containing the injected payload. Affected Product: EcoStruxure Power Monitoring Expert (Versions 2020 and prior) Additional Analyst Notes: - CVE Program Container: References: - https://download.schneider-electric
ons 2020 and prior) Additional Analyst Notes: - CVE Program Container: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-011-07
CVE ID: CVE-2022-22805 State: PUBLISHED Published: 2022-03-09T19:30:16 Last Updated: 2024-08-03T03:21:49.170Z Vendors: Schneider Electric Products: SmartConnect Problem Types: CWE-120 Description: A CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability exists that could cause remote code execution when an improperly handled TLS packet is reassembled. Affected Product: SmartConnect Family: SMT Series (SMT Series ID=1015: UPS 04.5 and prior), SMC Series (SMC Series ID=1018: UPS 04.2 and prior), SMTL Series (SMTL Series ID=1026: UPS 02.9 and prior), SCL Series (SCL Series ID=1029: UPS 02.5 and prior / SCL Series ID=1030: UPS 02.5 and prior / SCL Series ID
and prior), SCL Series (SCL Series ID=1029: UPS 02.5 and prior / SCL Series ID=1030: UPS 02.5 and prior / SCL Series ID=1036: UPS 02.5 and prior / SCL Series ID=1037: UPS 03.1 and prior), SMX Series (SMX Series ID=1031: UPS 03.1 and prior) Additional Analyst Notes: - CVE Program Container: References: - https://www.se.com/ww/en/download/document/SEVD-2022-067-02/
CVE ID: CVE-2022-22806 State: PUBLISHED Published: 2022-03-09T19:30:17 Last Updated: 2024-08-03T03:21:49.161Z Vendors: Schneider Electric Products: SmartConnect Problem Types: CWE-294 Description: A CWE-294: Authentication Bypass by Capture-replay vulnerability exists that could cause an unauthenticated connection to the UPS when a malformed connection is sent. Affected Product: SmartConnect Family: SMT Series (SMT Series ID=1015: UPS 04.5 and prior), SMC Series (SMC Series ID=1018: UPS 04.2 and prior), SMTL Series (SMTL Series ID=1026: UPS 02.9 and prior), SCL Series (SCL Series ID=1029: UPS 02.5 and prior / SCL Series ID=1030: UPS 02.5 and prior / SCL Series ID=1036: UPS 02.5 and prior / S
Series ID=1029: UPS 02.5 and prior / SCL Series ID=1030: UPS 02.5 and prior / SCL Series ID=1036: UPS 02.5 and prior / SCL Series ID=1037: UPS 03.1 and prior), SMX Series (SMX Series ID=1031: UPS 03.1 and prior) Additional Analyst Notes: - CVE Program Container: References: - https://www.se.com/ww/en/download/document/SEVD-2022-067-02/
CVE ID: CVE-2022-22807 State: PUBLISHED Published: 2022-02-09T00:00:00 Last Updated: 2024-08-03T03:21:49.162Z Vendors: n/a Products: EcoStruxure EV Charging Expert (formerly known as EVlink Load Management System): (HMIBSCEA53D1EDB, HMIBSCEA53D1EDS, HMIBSCEA53D1EDM, HMIBSCEA53D1EDL, HMIBSCEA53D1ESS, HMIBSCEA53D1ESM, HMIBSCEA53D1EML) (All Versions prior to SP8 (Version 01) V4.0.0.13) Problem Types: CWE-1021 Description: A CWE-1021 Improper Restriction of Rendered UI Layers or Frames vulnerability exists that could cause unintended modifications of the product settings or user accounts when deceiving the user to use the web interface rendered within iframes. Affected Product: EcoStruxure EV Ch
r accounts when deceiving the user to use the web interface rendered within iframes. Affected Product: EcoStruxure EV Charging Expert (formerly known as EVlink Load Management System): (HMIBSCEA53D1EDB, HMIBSCEA53D1EDS, HMIBSCEA53D1EDM, HMIBSCEA53D1EDL, HMIBSCEA53D1ESS, HMIBSCEA53D1ESM, HMIBSCEA53D1EML) (All Versions prior to SP8 (Version 01) V4.0.0.13) Additional Analyst Notes: - CVE Program Container: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-039-02
CVE ID: CVE-2022-22808 State: PUBLISHED Published: 2022-02-09T00:00:00 Last Updated: 2024-08-03T03:21:49.150Z Vendors: n/a Products: EcoStruxure EV Charging Expert (formerly known as EVlink Load Management System): (HMIBSCEA53D1EDB, HMIBSCEA53D1EDS, HMIBSCEA53D1EDM, HMIBSCEA53D1EDL, HMIBSCEA53D1ESS, HMIBSCEA53D1ESM, HMIBSCEA53D1EML) (All Versions prior to SP8 (Version 01) V4.0.0.13) Problem Types: CWE-352 Description: A CWE-352: Cross-Site Request Forgery (CSRF) exists that could cause a remote attacker to gain unauthorized access to the product when conducting cross-domain attacks based on same-origin policy or cross-site request forgery protections bypass. Affected Product: EcoStruxure EV
attacks based on same-origin policy or cross-site request forgery protections bypass. Affected Product: EcoStruxure EV Charging Expert (formerly known as EVlink Load Management System): (HMIBSCEA53D1EDB, HMIBSCEA53D1EDS, HMIBSCEA53D1EDM, HMIBSCEA53D1EDL, HMIBSCEA53D1ESS, HMIBSCEA53D1ESM, HMIBSCEA53D1EML) (All Versions prior to SP8 (Version 01) V4.0.0.13) Additional Analyst Notes: - CVE Program Container: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-039-02
CVE ID: CVE-2022-22809 State: PUBLISHED Published: 2022-02-09T00:00:00 Last Updated: 2024-08-03T03:21:49.171Z Vendors: n/a Products: spaceLYnk (V2.6.2 and prior), Wiser for KNX (formerly homeLYnk) (V2.6.2 and prior), fellerLYnk (V2.6.2 and prior) Problem Types: CWE-306 Description: A CWE-306: Missing Authentication for Critical Function vulnerability exists that could allow modifications of the touch configurations in an unauthorized manner when an attacker attempts to modify the touch configurations. Affected Product: spaceLYnk (V2.6.2 and prior), Wiser for KNX (formerly homeLYnk) (V2.6.2 and prior), fellerLYnk (V2.6.2 and prior) Additional Analyst Notes: - CVE Program Container: References
omeLYnk) (V2.6.2 and prior), fellerLYnk (V2.6.2 and prior) Additional Analyst Notes: - CVE Program Container: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-039-04