deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-28318
Published: 2023-03-29
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.02.34. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of IFC files. Crafted data in an IFC file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-16379.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0006; https://www.zerodayinitiative.com/advisories/ZDI-22-618/; https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0006
CVE: CVE-2022-28319
Published: 2023-03-29
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.02.034. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of 3DM files. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-16340.
CVSS Score: 7.8 (HIGH)
CWE: CWE-457
References: https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0002; https://www.zerodayinitiative.com/advisories/ZDI-22-591/; https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0002
CVE: CVE-2022-28320
Published: 2023-03-29
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.16.02.022. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of 3DM files. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-16282.
CVSS Score: 7.8 (HIGH)
CWE: CWE-457
References: https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0002; https://www.zerodayinitiative.com/advisories/ZDI-22-597/; https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0002
CVE: CVE-2022-28641
Published: 2023-03-29
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.02.34. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of IFC files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-16390.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0006; https://www.zerodayinitiative.com/advisories/ZDI-22-613/; https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0006
CVE: CVE-2022-28642
Published: 2023-03-29
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.02.34. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DGN files. Crafted data in a DGN file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-16424.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0004; https://www.zerodayinitiative.com/advisories/ZDI-22-608/; https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0004
CVE: CVE-2022-28643
Published: 2023-03-29
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.02.34. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DGN files. Crafted data in a DGN file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-16468.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0004; https://www.zerodayinitiative.com/advisories/ZDI-22-609/; https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0004
CVE: CVE-2022-28644
Published: 2023-03-29
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.02.34. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DGN files. Crafted data in a DGN file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-16469.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0004; https://www.zerodayinitiative.com/advisories/ZDI-22-611/; https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0004
CVE: CVE-2022-28645
Published: 2023-03-29
Description: This vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley MicroStation CONNECT 10.16.02.34. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DGN files. Crafted data in a DGN file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-16470.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0004; https://www.zerodayinitiative.com/advisories/ZDI-22-610/; https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0004
CVE: CVE-2022-28646
Published: 2023-03-29
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.2.034. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of IFC files. Crafted data in an IFC file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-16570.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0006; https://www.zerodayinitiative.com/advisories/ZDI-22-616/; https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0006
CVE: CVE-2022-28647
Published: 2023-03-29
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.2.034. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of IFC files. Crafted data in an IFC file can trigger a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-16573.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0006; https://www.zerodayinitiative.com/advisories/ZDI-22-617/; https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0006
CVE: CVE-2022-28685
Published: 2023-03-29
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of AVEVA Edge 2020 SP2 Patch 0(4201.2111.1802.0000). User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of APP files. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17212.
CVSS Score: 7.8 (HIGH)
CWE: CWE-502, CWE-502
References: https://www.aveva.com/content/dam/aveva/documents/support/cyber-security-updates/SecurityBulletin_AVEVA-2022-005.pdf; https://www.zerodayinitiative.com/advisories/ZDI-22-1124/; https://www.aveva.com/content/dam/aveva/documents/support/cyber-security-updates/SecurityBulletin_AVEVA-2022-005.pdf
CVE: CVE-2022-28686
Published: 2023-03-29
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of AVEVA Edge 2020 SP2 Patch 0(4201.2111.1802.0000). User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of APP files. The process loads a library from an unsecured location. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17114.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://www.aveva.com/content/dam/aveva/documents/support/cyber-security-updates/SecurityBulletin_AVEVA-2022-005.pdf; https://www.zerodayinitiative.com/advisories/ZDI-22-1125/; https://www.aveva.com/content/dam/aveva/documents/support/cyber-security-updates/SecurityBulletin_AVEVA-2022-005.pdf
CVE: CVE-2022-28687
Published: 2023-03-29
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of AVEVA Edge 2020 SP2 Patch 0(4201.2111.1802.0000). User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of APP files. The process loads a library from an unsecured location. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-16257.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://www.aveva.com/content/dam/aveva/documents/support/cyber-security-updates/SecurityBulletin_AVEVA-2022-005.pdf; https://www.zerodayinitiative.com/advisories/ZDI-22-1126/; https://www.aveva.com/content/dam/aveva/documents/support/cyber-security-updates/SecurityBulletin_AVEVA-2022-005.pdf
CVE: CVE-2022-28688
Published: 2023-03-29
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of AVEVA Edge 2020 SP2 Patch 0(4201.2111.1802.0000). User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of APP files. The process loads a library from an unsecured location. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17201.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://www.aveva.com/content/dam/aveva/documents/support/cyber-security-updates/SecurityBulletin_AVEVA-2022-005.pdf; https://www.zerodayinitiative.com/advisories/ZDI-22-1127/; https://www.aveva.com/content/dam/aveva/documents/support/cyber-security-updates/SecurityBulletin_AVEVA-2022-005.pdf
CVE: CVE-2022-2560
Published: 2023-03-29
Description: This vulnerability allows remote attackers to delete arbitrary files on affected installations of EnterpriseDT CompleteFTP 22.1.0 Server. Authentication is not required to exploit this vulnerability. The specific flaw exists within the HttpFile class. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to delete files in the context of SYSTEM. Was ZDI-CAN-17481.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-22, CWE-22
References: https://www.zerodayinitiative.com/advisories/ZDI-22-1032/; https://www.zerodayinitiative.com/advisories/ZDI-22-1032/
CVE: CVE-2022-2561
Published: 2023-03-29
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of OPC Labs QuickOPC 2022.1. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of XML files in Connectivity Explorer. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-16596.
CVSS Score: 7.8 (HIGH)
CWE: CWE-502
References: https://kb.opclabs.com/ZDI-CAN-16596_Connectivity_Explorer_file_vulnerability; https://www.zerodayinitiative.com/advisories/ZDI-22-1031/; https://kb.opclabs.com/ZDI-CAN-16596_Connectivity_Explorer_file_vulnerability
CVE: CVE-2022-2825
Published: 2023-03-29
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Kepware KEPServerEX 6.11.718.0. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of text encoding conversions. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-18411.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-121
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-242-10; https://www.zerodayinitiative.com/advisories/ZDI-22-1455/; https://www.cisa.gov/uscert/ics/advisories/icsa-22-242-10
CVE: CVE-2022-2848
Published: 2023-03-29
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Kepware KEPServerEX 6.11.718.0. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of text encoding conversions. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-16486.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-122, CWE-119
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-242-10; https://www.zerodayinitiative.com/advisories/ZDI-22-1454/; https://www.cisa.gov/uscert/ics/advisories/icsa-22-242-10
CVE: CVE-2022-36969
Published: 2023-03-29
Description: This vulnerability allows remote attackers to disclose sensitive information on affected installations of AVEVA Edge 2020 SP2 Patch 0(4201.2111.1802.0000). User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the LoadImportedLibraries method. Due to the improper restriction of XML External Entity (XXE) references, a crafted document specifying a URI causes the XML parser to access the URI and embed the contents back into the XML document for further processing. An attacker can leverage this vulnerability to disclose information in the context of the current process. Was ZDI-CAN-17394.
CVSS Score: 7.1 (HIGH)
CWE: CWE-611
References: https://www.aveva.com/content/dam/aveva/documents/support/cyber-security-updates/SecurityBulletin_AVEVA-2022-005.pdf; https://www.zerodayinitiative.com/advisories/ZDI-22-1128/; https://www.aveva.com/content/dam/aveva/documents/support/cyber-security-updates/SecurityBulletin_AVEVA-2022-005.pdf
CVE: CVE-2022-36970
Published: 2023-03-29
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of AVEVA Edge 20.0 Build: 4201.2111.1802.0000 Service Pack 2. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of APP files. Crafted data in a APP file can cause the application to execute arbitrary Visual Basic scripts. The user interface fails to provide sufficient indication of the hazard. An attacker can leverage this vulnerability to execute code in the context of current process. Was ZDI-CAN-17370.
CVSS Score: 7.8 (HIGH)
CWE: CWE-356
References: https://www.aveva.com/content/dam/aveva/documents/support/cyber-security-updates/SecurityBulletin_AVEVA-2022-005.pdf; https://www.zerodayinitiative.com/advisories/ZDI-22-1129/; https://www.aveva.com/content/dam/aveva/documents/support/cyber-security-updates/SecurityBulletin_AVEVA-2022-005.pdf
CVE: CVE-2022-36971
Published: 2023-03-29
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Avalanche 6.3.2.3490. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the JwtTokenUtility class. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-15301.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502, CWE-502
References: https://download.wavelink.com/Files/avalanche_v6.3.4_release_notes.txt; https://www.zerodayinitiative.com/advisories/ZDI-22-776/; https://download.wavelink.com/Files/avalanche_v6.3.4_release_notes.txt
CVE: CVE-2022-36972
Published: 2023-03-29
Description: This vulnerability allows remote attackers to bypass authentication on affected installations of Ivanti Avalanche 6.3.2.3490. The specific flaw exists within the ProfileDaoImpl class. A crafted request can trigger execution of SQL queries composed from a user-supplied string. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-15328.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://download.wavelink.com/Files/avalanche_v6.3.4_release_notes.txt; https://www.zerodayinitiative.com/advisories/ZDI-22-777/; https://download.wavelink.com/Files/avalanche_v6.3.4_release_notes.txt
CVE: CVE-2022-36973
Published: 2023-03-29
Description: This vulnerability allows remote attackers to bypass authentication on affected installations of Ivanti Avalanche 6.3.2.3490. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the ProfileDaoImpl class. A crafted request can trigger execution of SQL queries composed from a user-supplied string. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-15329.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://download.wavelink.com/Files/avalanche_v6.3.4_release_notes.txt; https://www.zerodayinitiative.com/advisories/ZDI-22-778/; https://download.wavelink.com/Files/avalanche_v6.3.4_release_notes.txt
CVE: CVE-2022-36974
Published: 2023-03-29
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Avalanche 6.3.2.3490. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the Web File Server service. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-15330.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://download.wavelink.com/Files/avalanche_v6.3.4_release_notes.txt; https://www.zerodayinitiative.com/advisories/ZDI-22-779/; https://download.wavelink.com/Files/avalanche_v6.3.4_release_notes.txt
CVE: CVE-2022-36975
Published: 2023-03-29
Description: This vulnerability allows remote attackers to bypass authentication on affected installations of Ivanti Avalanche 6.3.2.3490. The specific flaw exists within the ProfileDaoImpl class. A crafted request can trigger execution of SQL queries composed from a user-supplied string. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-15332.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://download.wavelink.com/Files/avalanche_v6.3.4_release_notes.txt; https://www.zerodayinitiative.com/advisories/ZDI-22-780/; https://download.wavelink.com/Files/avalanche_v6.3.4_release_notes.txt
CVE: CVE-2022-36976
Published: 2023-03-29
Description: This vulnerability allows remote attackers to bypass authentication on affected installations of Ivanti Avalanche 6.3.2.3490. The specific flaw exists within the GroupDaoImpl class. A crafted request can trigger execution of SQL queries composed from a user-supplied string. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-15333.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://download.wavelink.com/Files/avalanche_v6.3.4_release_notes.txt; https://www.zerodayinitiative.com/advisories/ZDI-22-781/; https://download.wavelink.com/Files/avalanche_v6.3.4_release_notes.txt
CVE: CVE-2022-36977
Published: 2023-03-29
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Avalanche 6.3.2.3490. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the Certificate Management Server service. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-15449.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://download.wavelink.com/Files/avalanche_v6.3.4_release_notes.txt; https://www.zerodayinitiative.com/advisories/ZDI-22-782/; https://download.wavelink.com/Files/avalanche_v6.3.4_release_notes.txt
CVE: CVE-2022-36978
Published: 2023-03-29
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Avalanche 6.3.2.3490. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the Notification Server service. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-15448.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://download.wavelink.com/Files/avalanche_v6.3.4_release_notes.txt; https://www.zerodayinitiative.com/advisories/ZDI-22-783/; https://download.wavelink.com/Files/avalanche_v6.3.4_release_notes.txt