deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-1700
Published: 2022-09-12
Description: Improper Restriction of XML External Entity Reference ('XXE') vulnerability in the Policy Engine of Forcepoint Data Loss Prevention (DLP), which is also leveraged by Forcepoint One Endpoint (F1E), Web Security Content Gateway, Email Security with DLP enabled, and Cloud Security Gateway prior to June 20, 2022. The XML parser in the Policy Engine was found to be improperly configured to support external entities and external DTD (Document Type Definitions), which can lead to an XXE attack. This issue affects: Forcepoint Data Loss Prevention (DLP) versions prior to 8.8.2. Forcepoint One Endpoint (F1E) with Policy Engine versions prior to 8.8.2. Forcepoint Web Security Content Gateway versions prior to 8.5.5. Forcepoint Email Security with DLP enabled versions prior to 8.5.5. Forcepoint Cloud Security Gateway prior to June 20, 2022.
CVSS Score: 7.5 (HIGH)
CWE: CWE-611, CWE-611
References: https://help.forcepoint.com/security/CVE/CVE-2022-1700.html; https://help.forcepoint.com/security/CVE/CVE-2022-1700.html
CVE: CVE-2022-31220
Published: 2022-09-12
Description: Dell BIOS versions contain an Unchecked Return Value vulnerability. A local authenticated administrator user could potentially exploit this vulnerability in order to change the state of the system or cause unexpected failures.
CVSS Score: 3.0 (LOW)
CWE: CWE-1038, CWE-252
References: https://www.dell.com/support/kbdoc/000202196; https://www.dell.com/support/kbdoc/000202196
CVE: CVE-2022-31221
Published: 2022-09-12
Description: Dell BIOS versions contain an Information Exposure vulnerability. A local authenticated administrator user could potentially exploit this vulnerability in order access sensitive state information on the system.
CVSS Score: 2.3 (LOW)
CWE: CWE-200, CWE-200
References: https://www.dell.com/support/kbdoc/000202196; https://www.dell.com/support/kbdoc/000202196
CVE: CVE-2022-31222
Published: 2022-09-12
Description: Dell BIOS versions contain a Missing Release of Resource after Effective Lifetime vulnerability. A local authenticated administrator user could potentially exploit this vulnerability by consuming excess memory in order to cause the application to crash.
CVSS Score: 2.3 (LOW)
CWE: CWE-401, CWE-772
References: https://www.dell.com/support/kbdoc/000202196; https://www.dell.com/support/kbdoc/000202196
CVE: CVE-2022-31223
Published: 2022-09-12
Description: Dell BIOS versions contain an Improper Neutralization of Null Byte vulnerability. A local authenticated administrator user could potentially exploit this vulnerability by sending unexpected null bytes in order to read memory on the system.
CVSS Score: 2.3 (LOW)
CWE: CWE-158
References: https://www.dell.com/support/kbdoc/000202196; https://www.dell.com/support/kbdoc/000202196
CVE: CVE-2022-31224
Published: 2022-09-12
Description: Dell BIOS versions contain an Improper Protection Against Voltage and Clock Glitches vulnerability. An attacker with physical access to the system could potentially exploit this vulnerability by triggering a fault condition in order to change the behavior of the system.
CVSS Score: 2.0 (LOW)
CWE: CWE-1247
References: https://www.dell.com/support/kbdoc/000202196; https://www.dell.com/support/kbdoc/000202196
CVE: CVE-2022-31225
Published: 2022-09-12
Description: Dell BIOS versions contain an Unchecked Return Value vulnerability. A local authenticated administrator user could potentially exploit this vulnerability in order to change the state of the system or cause unexpected failures.
CVSS Score: 3.0 (LOW)
CWE: CWE-252, CWE-252
References: https://www.dell.com/support/kbdoc/000202196; https://www.dell.com/support/kbdoc/000202196
CVE: CVE-2022-31226
Published: 2022-09-12
Description: Dell BIOS versions contain a Stack-based Buffer Overflow vulnerability. A local authenticated malicious user could potentially exploit this vulnerability by sending excess data to a function in order to gain arbitrary code execution on the system.
CVSS Score: 7.1 (HIGH)
CWE: CWE-121, CWE-787
References: https://www.dell.com/support/kbdoc/000202196; https://www.dell.com/support/kbdoc/000202196
CVE: CVE-2022-36101
Published: 2022-09-12
Description: Shopware is an open source e-commerce software. In affected versions the request for the customer detail view in the backend administration contained sensitive data like the hashed password and the session ID. These fields are now explicitly unset in version 5.7.15. Users are advised to update and may get the update either via the Auto-Updater or directly via the download overview. There are no known workarounds for this issue.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-200
References: https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-09-2022; https://github.com/shopware/shopware/commit/af5cdbc81d60f21b728e1433aeb8837f25938d2a; https://github.com/shopware/shopware/security/advisories/GHSA-6vfq-jmxg-g58r
CVE: CVE-2022-36102
Published: 2022-09-12
Description: Shopware is an open source e-commerce software. In affected versions if backend admin controllers are called with a certain notation, the ACL could be bypassed. Users could execute actions, which they are normally not able to do. Users are advised to update to the current version (5.7.15). Users can get the update via the Auto-Updater or directly via the download overview. There are no known workarounds for this issue.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-281, CWE-281
References: https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-09-2022; https://github.com/shopware/shopware/commit/de92d3a78279119a5bbe203054f8fa1d25126af6; https://github.com/shopware/shopware/security/advisories/GHSA-qc43-pgwq-3q2q
CVE: CVE-2022-39200
Published: 2022-09-12
Description: Dendrite is a Matrix homeserver written in Go. In affected versions events retrieved from a remote homeserver using the `/get_missing_events` path did not have their signatures verified correctly. This could potentially allow a remote homeserver to provide invalid/modified events to Dendrite via this endpoint. Note that this does not apply to events retrieved through other endpoints (e.g. `/event`, `/state`) as they have been correctly verified. Homeservers that have federation disabled are not vulnerable. The problem has been fixed in Dendrite 0.9.8. Users are advised to upgrade. There are no known workarounds for this issue.
CVSS Score: 7.3 (HIGH)
CWE: CWE-347
References: https://github.com/matrix-org/dendrite/commit/2792d0490f3771488bad346981b8c26479a872c3; https://github.com/matrix-org/dendrite/security/advisories/GHSA-pfw4-xjgm-267c; https://github.com/matrix-org/dendrite/commit/2792d0490f3771488bad346981b8c26479a872c3
CVE: CVE-2021-44425
Published: 2022-09-12
Description: An issue was discovered in AnyDesk before 6.2.6 and 6.3.x before 6.3.3. An unnecessarily open listening port on a machine in the LAN of an attacker, opened by the Anydesk Windows client when using the tunneling feature, allows the attacker unauthorized access to the local machine's AnyDesk tunneling protocol stack (and also to any remote destination machine software that is listening to the AnyDesk tunneled port).
CVSS Score: 6.5 (MEDIUM)
References: https://anydesk.com/en/downloads/windows; https://argus-sec.com/discovering-tunneling-service-security-flaws-in-anydesk-remote-application/; https://anydesk.com/en/downloads/windows
CVE: CVE-2021-44426
Published: 2022-09-12
Description: An issue was discovered in AnyDesk before 6.2.6 and 6.3.x before 6.3.5. An upload of an arbitrary file to a victim's local ~/Downloads/ directory is possible if the victim is using the AnyDesk Windows client to connect to a remote machine, if an attacker is also connected remotely with AnyDesk to the same remote machine. The upload is done without any approval or action taken by the victim.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://anydesk.com/en/downloads/windows; https://argus-sec.com/discovering-tunneling-service-security-flaws-in-anydesk-remote-application/; https://anydesk.com/en/downloads/windows
CVE: CVE-2022-29490
Published: 2022-09-12
Description: Improper Authorization vulnerability exists in the Workplace X WebUI of the Hitachi Energy MicroSCADA X SYS600 allows an authenticated user to execute any MicroSCADA internal scripts irrespective of the authenticated user's role. This issue affects: Hitachi Energy MicroSCADA X SYS600 version 10 to version 10.3.1. cpe:2.3:a:hitachienergy:microscada_x_sys600:10:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:microscada_x_sys600:10.1:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:microscada_x_sys600:10.1.1:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:microscada_x_sys600:10.2:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:microscada_x_sys600:10.2.1:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:microscada_x_sys600:10.3:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:microscada_x_sys600:10.3.1:*:*:*:*:*:*:*
CVSS Score: 8.5 (HIGH)
CWE: CWE-285
References: https://search.abb.com/library/Download.aspx?DocumentID=8DBD000106&LanguageCode=en&DocumentPartId=&Action=Launch; https://search.abb.com/library/Download.aspx?DocumentID=8DBD000106&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2022-2979
Published: 2022-09-12
Description: Opening a specially crafted file could cause the affected product to fail to release its memory reference potentially resulting in arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-242-09; https://www.cisa.gov/uscert/ics/advisories/icsa-22-242-09
CVE: CVE-2022-36173
Published: 2022-09-12
Description: FreshService macOS Agent < 4.4.0 and FreshServce Linux Agent < 3.4.0 are vulnerable to TLS Man-in-The-Middle via the FreshAgent client and scheduled update service.
CVSS Score: 8.1 (HIGH)
CWE: CWE-295
References: https://community.freshworks.com/product-updates/freshservice-release-notes-april-2022-23982#Security+updates:+Discovery+Probe+and+Discovery+Agent; https://public-exposure.inform.social/post/integrity-checking/; https://community.freshworks.com/product-updates/freshservice-release-notes-april-2022-23982#Security+updates:+Discovery+Probe+and+Discovery+Agent
CVE: CVE-2022-36174
Published: 2022-09-12
Description: FreshService Windows Agent < 2.11.0 and FreshService macOS Agent < 4.2.0 and FreshService Linux Agent < 3.3.0. are vulnerable to Broken integrity checking via the FreshAgent client and scheduled update service.
CVSS Score: 8.1 (HIGH)
CWE: CWE-354
References: https://community.freshworks.com/product-updates/freshservice-release-notes-april-2022-23982#Security+updates:+Discovery+Probe+and+Discovery+Agent; https://public-exposure.inform.social/post/integrity-checking/; https://community.freshworks.com/product-updates/freshservice-release-notes-april-2022-23982#Security+updates:+Discovery+Probe+and+Discovery+Agent
CVE: CVE-2022-38135
Published: 2022-09-12
Description: Broken Access Control vulnerability in Dean Oakley's Photospace Gallery plugin <= 2.3.5 at WordPress allows users with subscriber or higher role to change plugin settings.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-264
References: https://patchstack.com/database/vulnerability/photospace/wordpress-photospace-gallery-plugin-2-3-5-broken-access-control-vulnerability; https://wordpress.org/plugins/photospace/; https://patchstack.com/database/vulnerability/photospace/wordpress-photospace-gallery-plugin-2-3-5-broken-access-control-vulnerability
CVE: CVE-2022-38291
Published: 2022-09-12
Description: SLiMS Senayan Library Management System v9.4.2 was discovered to contain a cross-site scripting (XSS) vulnerability via the Search function. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Search bar.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/slims/slims9_bulian/issues/156; https://github.com/slims/slims9_bulian/issues/156
CVE: CVE-2022-38292
Published: 2022-09-12
Description: SLiMS Senayan Library Management System v9.4.2 was discovered to contain multiple Server-Side Request Forgeries via the components /bibliography/marcsru.php and /bibliography/z3950sru.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-918
References: https://github.com/slims/slims9_bulian/issues/158; https://github.com/slims/slims9_bulian/issues/158
CVE: CVE-2022-38295
Published: 2022-09-12
Description: Cuppa CMS v1.0 was discovered to contain a cross-site scripting vulnerability at /table_manager/view/cu_user_groups. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field under the Add New Group function.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/CuppaCMS/CuppaCMS/issues/34; https://github.com/CuppaCMS/CuppaCMS/issues/34
CVE: CVE-2022-38296
Published: 2022-09-12
Description: Cuppa CMS v1.0 was discovered to contain an arbitrary file upload vulnerability via the File Manager.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/CuppaCMS/CuppaCMS/issues/33; https://github.com/CuppaCMS/CuppaCMS/issues/33
CVE: CVE-2022-38605
Published: 2022-09-12
Description: Church Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/edit_event.php.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/sunaono1/bug_report/blob/main/vendors/Godfrey%20De%20Blessed/church-management-system/SQLi-1.md; https://github.com/sunaono1/bug_report/blob/main/vendors/Godfrey%20De%20Blessed/church-management-system/SQLi-1.md
CVE: CVE-2022-38606
Published: 2022-09-12
Description: Garage Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /garage/editcategory.php.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/sunaono1/bug_report/blob/main/vendors/mayuri_k/garage-management-system/SQLi-1.md; https://github.com/sunaono1/bug_report/blob/main/vendors/mayuri_k/garage-management-system/SQLi-1.md
CVE: CVE-2022-38610
Published: 2022-09-12
Description: Garage Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /garage/editclient.php.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/sunaono1/bug_report/blob/main/vendors/mayuri_k/garage-management-system/SQLi-2.md; https://github.com/sunaono1/bug_report/blob/main/vendors/mayuri_k/garage-management-system/SQLi-2.md
CVE: CVE-2022-35572
Published: 2022-09-12
Description: On Linksys E5350 WiFi Router with firmware version 1.0.00.037 and lower, (and potentially other vendors/devices due to code reuse), the /SysInfo.htm URI does not require a session ID. This web page calls a show_sysinfo function which retrieves WPA passwords, SSIDs, MAC Addresses, serial numbers, WPS Pins, and hardware/firmware versions, and prints this information into the web page. This web page is visible when remote management is enabled. A user who has access to the web interface of the device can extract these secrets. If the device has remote management enabled and is connected directly to the internet, this vulnerability is exploitable over the internet without interaction.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: https://willgu.es/?p=76; https://willgu.es/?p=76
CVE: CVE-2022-38298
Published: 2022-09-12
Description: Appsmith v1.7.11 was discovered to allow attackers to execute an authenticated Server-Side Request Forgery (SSRF) via redirecting incoming requests to the AWS internal metadata endpoint.
CVSS Score: 8.8 (HIGH)
CWE: CWE-918
References: https://github.com/appsmithorg/appsmith/pull/15782; https://github.com/appsmithorg/appsmith/pull/15782
CVE: CVE-2022-38299
Published: 2022-09-12
Description: An issue in the Elasticsearch plugin of Appsmith v1.7.11 allows attackers to connect disallowed hosts to the AWS/GCP internal metadata endpoint.
CVSS Score: 4.3 (MEDIUM)
References: https://github.com/appsmithorg/appsmith/pull/15834; https://github.com/appsmithorg/appsmith/pull/15834
CVE: CVE-2022-38297
Published: 2022-09-12
Description: UCMS v1.6.0 contains an authentication bypass vulnerability which is exploited via cookie poisoning.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-565
References: https://github.com/tobysunyaya/UCMS_vulunerablities/blob/main/UCMS%20v1.6%20cookies%20poisoning%20attack%20vulnerability; https://github.com/tobysunyaya/UCMS_vulunerablities/blob/main/UCMS%20v1.6%20cookies%20poisoning%20attack%20vulnerability
CVE: CVE-2022-38302
Published: 2022-09-12
Description: Online Leave Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /maintenance/manage_department.php.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/GGMMNN/bug_report/blob/main/vendors/oretnom23/online-leave-management-system/SQLi-1.md; https://github.com/GGMMNN/bug_report/blob/main/vendors/oretnom23/online-leave-management-system/SQLi-1.md
CVE: CVE-2022-38303
Published: 2022-09-12
Description: Online Leave Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /employees/manage_leave_type.php.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/GGMMNN/bug_report/blob/main/vendors/oretnom23/online-leave-management-system/SQLi-2.md; https://github.com/GGMMNN/bug_report/blob/main/vendors/oretnom23/online-leave-management-system/SQLi-2.md
CVE: CVE-2022-38304
Published: 2022-09-12
Description: Online Leave Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /maintenance/manage_leave_type.php.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/GGMMNN/bug_report/blob/main/vendors/oretnom23/online-leave-management-system/SQLi-3.md; https://github.com/GGMMNN/bug_report/blob/main/vendors/oretnom23/online-leave-management-system/SQLi-3.md
CVE: CVE-2022-37011
Published: 2022-09-13
Description: A vulnerability has been identified in Mendix SAML (Mendix 7 compatible) (All versions < V1.17.0), Mendix SAML (Mendix 8 compatible) (All versions < V2.3.0), Mendix SAML (Mendix 9 compatible, New Track) (All versions < V3.3.1), Mendix SAML (Mendix 9 compatible, Upgrade Track) (All versions < V3.3.0). Affected versions of the module insufficiently protect from packet capture replay. This could allow unauthorized remote attackers to bypass authentication and get access to the application. For compatibility reasons, fix versions still contain this issue, but only when the not recommended, non default configuration option `'Allow Idp Initiated Authentication'` is enabled.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-294
References: https://cert-portal.siemens.com/productcert/pdf/ssa-638652.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-638652.pdf
CVE: CVE-2022-37302
Published: 2022-09-13
Description: A CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could cause a crash of the Control Expert software when an incorrect project file is opened. Affected Products: EcoStruxure Control Expert(V15.1 HF001 and prior).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: https://www.se.com/us/en/download/document/SEVD-2022-221-03/; https://www.se.com/us/en/download/document/SEVD-2022-221-03/
CVE: CVE-2022-38466
Published: 2022-09-13
Description: A vulnerability has been identified in CoreShield One-Way Gateway (OWG) Software (All versions < V2.2). The default installation sets insecure file permissions that could allow a local attacker to escalate privileges to local administrator.
CVSS Score: 7.8 (HIGH)
CWE: CWE-284, CWE-276
References: https://cert-portal.siemens.com/productcert/pdf/ssa-589975.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-589975.pdf
CVE: CVE-2022-39137
Published: 2022-09-13
Description: A vulnerability has been identified in Parasolid V33.1 (All versions < V33.1.262), Parasolid V34.0 (All versions < V34.0.252), Parasolid V34.1 (All versions < V34.1.242), Parasolid V35.0 (All versions < V35.0.161), Simcenter Femap V2022.1 (All versions < V2022.1.3), Simcenter Femap V2022.2 (All versions < V2022.2.2). The affected application is vulnerable to out of bounds read past the end of an allocated buffer when parsing X_T files. An attacker could leverage this vulnerability to leak information in the context of the current process. (ZDI-CAN-17276)
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://cert-portal.siemens.com/productcert/pdf/ssa-518824.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-518824.pdf
CVE: CVE-2022-39138
Published: 2022-09-13
Description: A vulnerability has been identified in Parasolid V33.1 (All versions < V33.1.262), Parasolid V34.0 (All versions < V34.0.252), Parasolid V34.1 (All versions < V34.1.242), Parasolid V35.0 (All versions < V35.0.161), Simcenter Femap V2022.1 (All versions < V2022.1.3), Simcenter Femap V2022.2 (All versions < V2022.2.2). The affected application contains an out of bounds write past the end of an allocated buffer while parsing specially crafted X_T files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-17284)
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://cert-portal.siemens.com/productcert/pdf/ssa-518824.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-518824.pdf
CVE: CVE-2022-39139
Published: 2022-09-13
Description: A vulnerability has been identified in Parasolid V33.1 (All versions < V33.1.262), Parasolid V34.0 (All versions < V34.0.252), Parasolid V34.1 (All versions < V34.1.242), Parasolid V35.0 (All versions < V35.0.161), Simcenter Femap V2022.1 (All versions < V2022.1.3), Simcenter Femap V2022.2 (All versions < V2022.2.2). The affected application contains an out of bounds write past the end of an allocated buffer while parsing specially crafted X_T files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-17289)
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://cert-portal.siemens.com/productcert/pdf/ssa-518824.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-518824.pdf
CVE: CVE-2022-39140
Published: 2022-09-13
Description: A vulnerability has been identified in Parasolid V33.1 (All versions < V33.1.262), Parasolid V34.0 (All versions < V34.0.252), Parasolid V34.1 (All versions < V34.1.242), Parasolid V35.0 (All versions < V35.0.161), Simcenter Femap V2022.1 (All versions < V2022.1.3), Simcenter Femap V2022.2 (All versions < V2022.2.2). The affected application contains an out of bounds write past the end of an allocated buffer while parsing specially crafted X_T files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-17292)
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://cert-portal.siemens.com/productcert/pdf/ssa-518824.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-518824.pdf
CVE: CVE-2022-39141
Published: 2022-09-13
Description: A vulnerability has been identified in Parasolid V33.1 (All versions < V33.1.262), Parasolid V34.0 (All versions < V34.0.252), Parasolid V34.1 (All versions < V34.1.242), Parasolid V35.0 (All versions < V35.0.161), Simcenter Femap V2022.1 (All versions < V2022.1.3), Simcenter Femap V2022.2 (All versions < V2022.2.2). The affected application is vulnerable to out of bounds read past the end of an allocated buffer when parsing X_T files. An attacker could leverage this vulnerability to leak information in the context of the current process. (ZDI-CAN-17296)
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://cert-portal.siemens.com/productcert/pdf/ssa-518824.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-518824.pdf