deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-20665
Published: 2022-04-06
Description: A vulnerability in the CLI of Cisco StarOS could allow an authenticated, local attacker to elevate privileges on an affected device. This vulnerability is due to insufficient input validation of CLI commands. An attacker could exploit this vulnerability by sending crafted commands to the CLI. A successful exploit could allow the attacker to execute arbitrary code with the privileges of the root user. To exploit this vulnerability, an attacker would need to have valid administrative credentials on an affected device.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-77, CWE-77
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-staros-cmdinj-759mNT4n; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-staros-cmdinj-759mNT4n
CVE: CVE-2022-20675
Published: 2022-04-06
Description: A vulnerability in the TCP/IP stack of Cisco Email Security Appliance (ESA), Cisco Web Security Appliance (WSA), and Cisco Secure Email and Web Manager, formerly Security Management Appliance, could allow an unauthenticated, remote attacker to crash the Simple Network Management Protocol (SNMP) service, resulting in a denial of service (DoS) condition. This vulnerability is due to an open port listener on TCP port 199. An attacker could exploit this vulnerability by connecting to TCP port 199. A successful exploit could allow the attacker to crash the SNMP service, resulting in a DoS condition.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-248
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ESA-SNMP-JLAJksWK; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ESA-SNMP-JLAJksWK
CVE: CVE-2022-20741
Published: 2022-04-06
Description: A vulnerability in the web-based management interface of the Network Diagrams application for Cisco Secure Network Analytics, formerly Stealthwatch Enterprise, could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. This vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of the affected software. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sna-xss-mCA9tQnJ; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sna-xss-mCA9tQnJ
CVE: CVE-2022-20754
Published: 2022-04-06
Description: Multiple vulnerabilities in the API and web-based management interfaces of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker with read/write privileges to the application to write files or execute arbitrary code on the underlying operating system of an affected device as the root user. For more information about these vulnerabilities, see the Details section of this advisory.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-23
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-filewrite-87Q5YRk; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-filewrite-87Q5YRk
CVE: CVE-2022-20755
Published: 2022-04-06
Description: Multiple vulnerabilities in the API and web-based management interfaces of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker with read/write privileges to the application to write files or execute arbitrary code on the underlying operating system of an affected device as the root user. For more information about these vulnerabilities, see the Details section of this advisory.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-23
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-filewrite-87Q5YRk; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-filewrite-87Q5YRk
CVE: CVE-2022-20756
Published: 2022-04-06
Description: A vulnerability in the RADIUS feature of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to cause the affected system to stop processing RADIUS packets. This vulnerability is due to improper handling of certain RADIUS requests. An attacker could exploit this vulnerability by attempting to authenticate to a network or a service where the access server is using Cisco ISE as the RADIUS server. A successful exploit could allow the attacker to cause Cisco ISE to stop processing RADIUS requests, causing authentication/authorization timeouts, which would then result in legitimate requests being denied access. Note: To recover the ability to process RADIUS packets, a manual restart of the affected Policy Service Node (PSN) is required. See the Details section for more information.
CVSS Score: 8.6 (HIGH)
CWE: CWE-399
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-dos-JLh9TxBp; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-dos-JLh9TxBp
CVE: CVE-2022-20762
Published: 2022-04-06
Description: A vulnerability in the Common Execution Environment (CEE) ConfD CLI of Cisco Ultra Cloud Core - Subscriber Microservices Infrastructure (SMI) software could allow an authenticated, local attacker to escalate privileges on an affected device. This vulnerability is due to insufficient access control in the affected CLI. An attacker could exploit this vulnerability by authenticating as a CEE ConfD CLI user and executing a specific CLI command. A successful exploit could allow an attacker to access privileged containers with root privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-284
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-uccsmi-prvesc-BQHGe4cm; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-uccsmi-prvesc-BQHGe4cm
CVE: CVE-2022-20763
Published: 2022-04-06
Description: A vulnerability in the login authorization components of Cisco Webex Meetings could allow an authenticated, remote attacker to inject arbitrary Java code. This vulnerability is due to improper deserialization of Java code within login requests. An attacker could exploit this vulnerability by sending malicious login requests to the Cisco Webex Meetings service. A successful exploit could allow the attacker to inject arbitrary Java code and take arbitrary actions within the Cisco Webex Meetings application.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-502, CWE-502
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-java-MVX6crH9; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-java-MVX6crH9
CVE: CVE-2022-20774
Published: 2022-04-06
Description: A vulnerability in the web-based management interface of Cisco IP Phone 6800, 7800, and 8800 Series with Multiplatform Firmware could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack against a user of the web-based interface of an affected system. This vulnerability is due to insufficient CSRF protections for the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading an authenticated user of the interface to follow a crafted link. A successful exploit could allow the attacker to perform configuration changes on the affected device, resulting in a denial of service (DoS) condition.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-345, CWE-352
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-voip-phone-csrf-K56vXvVx; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-voip-phone-csrf-K56vXvVx
CVE: CVE-2022-20781
Published: 2022-04-06
Description: A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Web Security Appliance (WSA) could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface of an affected device. The vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by inserting malicious data into a specific data field in an affected interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wsa-stored-xss-XPsJghMY; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wsa-stored-xss-XPsJghMY
CVE: CVE-2022-20782
Published: 2022-04-06
Description: A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to obtain sensitive information from an affected device. This vulnerability is due to improper enforcement of administrative privilege levels for high-value sensitive data. An attacker with read-only Administrator privileges to the web-based management interface on an affected device could exploit this vulnerability by browsing to a page that contains sensitive data. A successful exploit could allow the attacker to collect sensitive information regarding the configuration of the system.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-266, CWE-269
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-info-exp-YXAWYP3s; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-info-exp-YXAWYP3s
CVE: CVE-2022-26591
Published: 2022-04-06
Description: FANTEC GmbH MWiD25-DS Firmware v2.000.030 allows unauthenticated attackers to access and download arbitrary files via a crafted GET request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-384
References: https://drive.google.com/file/d/1aY4LYjUskte8Z3grdbjCnPh8nMEAtH2v/view?usp=sharing; https://drive.google.com/file/d/1aY4LYjUskte8Z3grdbjCnPh8nMEAtH2v/view?usp=sharing
CVE: CVE-2022-26605
Published: 2022-04-06
Description: eZiosuite v2.0.7 contains an authenticated arbitrary file upload via the Avatar upload functionality.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://github.com/Chu1z1/Chuizi/issues/1; https://github.com/Chu1z1/Chuizi/issues/1
CVE: CVE-2022-26607
Published: 2022-04-06
Description: A remote code execution (RCE) vulnerability in baigo CMS v3.0-alpha-2 was discovered to allow attackers to execute arbitrary code via uploading a crafted PHP file.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: http://baigocms.com; https://github.com/baigoStudio/baigoCMS/; https://github.com/baigoStudio/baigoCMS/issues/9
CVE: CVE-2022-26613
Published: 2022-04-06
Description: PHP-CMS v1.0 was discovered to contain a SQL injection vulnerability via the category parameter in categorymenu.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/harshitbansal373/PHP-CMS/issues/14; https://github.com/harshitbansal373/PHP-CMS/issues/15; https://github.com/nu11secur1ty/CVE-mitre/tree/main/2022/CVE-2022-26613
CVE: CVE-2020-22253
Published: 2022-04-06
Description: Xiongmai Technology Co devices AHB7008T-MH-V2, AHB7804R-ELS, AHB7804R-MH-V2, AHB7808R-MS-V2, AHB7808R-MS, AHB7808T-MS-V2, AHB7804R-LMS, and HI3518E_50H10L_S39 were all discovered to have port 9530 open which allows unauthenticated attackers to make arbitrary Telnet connections with the victim device.
CVSS Score: 9.8 (CRITICAL)
References: http://www.xiongmaitech.com/en/index.php/news/info/12/68; http://www.xiongmaitech.com/en/index.php/news/info/12/68
CVE: CVE-2020-27373
Published: 2022-04-07
Description: Dr Trust USA iCheck Connect BP Monitor BP Testing 118 1.2.1 is vulnerable to Plain text command over BLE.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: http://dr.com; https://drtrust.in/collections/dr-trust-blood-pressure-testing/products/dr-trust-usa-icheck-connect-bp-monitor; https://nvermaa.medium.com/cve-on-radio-technology-d-4b65efa1ba5c
CVE: CVE-2020-27374
Published: 2022-04-07
Description: Dr Trust USA iCheck Connect BP Monitor BP Testing 118 1.2.1 is vulnerable to a Replay Attack to BP Monitoring.
CVSS Score: 7.5 (HIGH)
CWE: CWE-294
References: http://dr.com; https://drtrust.in/collections/dr-trust-blood-pressure-testing/products/dr-trust-usa-icheck-connect-bp-monitor; https://nvermaa.medium.com/cve-on-radio-technology-d-4b65efa1ba5c
CVE: CVE-2020-27375
Published: 2022-04-07
Description: Dr Trust USA iCheck Connect BP Monitor BP Testing 118 version 1.2.1 is vulnerable to Transmitting Write Requests and Chars.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-918
References: http://dr.com; https://drtrust.in/collections/dr-trust-blood-pressure-testing/products/dr-trust-usa-icheck-connect-bp-monitor; https://nvermaa.medium.com/cve-on-radio-technology-d-4b65efa1ba5c
CVE: CVE-2020-27376
Published: 2022-04-07
Description: Dr Trust USA iCheck Connect BP Monitor BP Testing 118 version 1.2.1 is vulnerable to Missing Authentication.
CVSS Score: 8.8 (HIGH)
CWE: CWE-306
References: http://dr.com; https://drtrust.in/collections/dr-trust-blood-pressure-testing/products/dr-trust-usa-icheck-connect-bp-monitor; https://nvermaa.medium.com/cve-on-radio-technology-d-4b65efa1ba5c
CVE: CVE-2022-27818
Published: 2022-04-07
Description: SWHKD 1.1.5 unsafely uses the /tmp/swhkd.sock pathname. There can be an information leak or denial of service.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-668
References: http://www.openwall.com/lists/oss-security/2022/04/14/1; https://github.com/waycrate/swhkd/commit/f70b99dd575fab79d8a942111a6980431f006818; https://github.com/waycrate/swhkd/releases
CVE: CVE-2022-27819
Published: 2022-04-07
Description: SWHKD 1.1.5 allows unsafe parsing via the -c option. An information leak might occur but there is a simple denial of service (memory exhaustion) upon an attempt to parse a large or infinite file (such as a block or character device).
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-770
References: http://www.openwall.com/lists/oss-security/2022/04/14/1; https://github.com/waycrate/swhkd/commit/b4e6dc76f4845ab03104187a42ac6d1bbc1e0021; https://github.com/waycrate/swhkd/releases
CVE: CVE-2021-46416
Published: 2022-04-07
Description: Insecure direct object reference in SUNNY TRIPOWER 5.0 Firmware version 3.10.16.R leads to unauthorized user groups accessing due to insecure cookie handling.
CVSS Score: 8.1 (HIGH)
CWE: CWE-639
References: http://packetstormsecurity.com/files/166670/SAM-SUNNY-TRIPOWER-5.0-Insecure-Direct-Object-Reference.html; https://drive.google.com/drive/folders/1BPULhDC_g__seH_VnQlVtkrKdOLkXdzV?usp=sharing; https://www.sma.de/en/products/solarinverters/sunny-tripower-30-40-50-60.html
CVE: CVE-2021-46417
Published: 2022-04-07
Description: Insecure handling of a download function leads to disclosure of internal files due to path traversal with root privileges in Franklin Fueling Systems Colibri Controller Module 1.8.19.8580.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://packetstormsecurity.com/files/166610/FFS-Colibri-Controller-Module-1.8.19.8580-Directory-Traversal.html; http://packetstormsecurity.com/files/166671/Franklin-Fueling-Systems-Colibri-Controller-Module-1.8.19.8580-Local-File-Inclusion.html; https://drive.google.com/drive/folders/1Yu4aVDdrgvs-F9jP3R8Cw7qo_TC7VB-R
CVE: CVE-2022-23900
Published: 2022-04-07
Description: A command injection vulnerability in the API of the Wavlink WL-WN531P3 router, version M31G3.V5030.201204, allows an attacker to achieve unauthorized remote code execution via a malicious POST request through /cgi-bin/adm.cgi.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://stigward.medium.com/wavlink-command-injection-cve-2022-23900-51988f6f15df; https://www.wavlink.com/en_us/product/WL-WN531P3.html; https://stigward.medium.com/wavlink-command-injection-cve-2022-23900-51988f6f15df
CVE: CVE-2021-46418
Published: 2022-04-07
Description: An unauthorized file creation vulnerability in Telesquare TLR-2855KS6 via PUT method can allow creation of CGI scripts.
CVSS Score: 7.5 (HIGH)
References: http://packetstormsecurity.com/files/166674/Telesquare-TLR-2855KS6-Arbitrary-File-Creation.html; https://drive.google.com/drive/folders/1avIfk1MZNmNQYePE1_n4irC24daxCeBA; http://packetstormsecurity.com/files/166674/Telesquare-TLR-2855KS6-Arbitrary-File-Creation.html
CVE: CVE-2021-46419
Published: 2022-04-07
Description: An unauthorized file deletion vulnerability in Telesquare TLR-2855KS6 via DELETE method can allow deletion of system files and scripts.
CVSS Score: 9.1 (CRITICAL)
References: http://packetstormsecurity.com/files/166675/Telesquare-TLR-2855KS6-Arbitrary-File-Deletion.html; https://drive.google.com/drive/folders/1TWw3Oy0wZImSHK_hj-tKkbn9sFgqqySp; http://packetstormsecurity.com/files/166675/Telesquare-TLR-2855KS6-Arbitrary-File-Deletion.html
CVE: CVE-2022-25338
Published: 2022-04-07
Description: ownCloud owncloud/android before 2.20 has Incorrect Access Control for physically proximate attackers.
CVSS Score: 6.8 (MEDIUM)
References: https://owncloud.com/security-advisories/cve-2022-25338/; https://owncloud.com/security-advisories/cve-2022-25338/
CVE: CVE-2022-25339
Published: 2022-04-07
Description: ownCloud owncloud/android 2.20 has Incorrect Access Control for local attackers.
CVSS Score: 5.5 (MEDIUM)
References: https://owncloud.com/security-advisories/cve-2022-25339/; https://owncloud.com/security-advisories/cve-2022-25339/
CVE: CVE-2022-26627
Published: 2022-04-07
Description: Online Project Time Management System v1.0 was discovered to contain an arbitrary file write vulnerability which allows attackers to execute arbitrary code via a crafted HTML file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://github.com/qerogram/BUG_WEB/tree/main/OpenSource/PTMS; https://github.com/qerogram/BUG_WEB/tree/main/OpenSource/PTMS
CVE: CVE-2022-27016
Published: 2022-04-07
Description: There is a stack overflow vulnerability in the SetStaticRouteCfg() function in the httpd service of Tenda AC9 15.03.2.21_cn.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/EPhaha/IOT_vuln/tree/main/Tenda/AC9/10; https://github.com/EPhaha/IOT_vuln/tree/main/Tenda/AC9/10
CVE: CVE-2022-27022
Published: 2022-04-07
Description: There is a stack overflow vulnerability in the SetSysTimeCfg() function in the httpd service of Tenda AC9 V15.03.2.21_cn. The attacker can obtain a stable root shell through a constructed payload.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/EPhaha/IOT_vuln/tree/main/Tenda/AC9/14; https://github.com/EPhaha/IOT_vuln/tree/main/Tenda/AC9/14
CVE: CVE-2021-43421
Published: 2022-04-07
Description: A File Upload vulnerability exists in Studio-42 elFinder 2.0.4 to 2.1.59 via connector.minimal.php, which allows a remote malicious user to upload arbitrary files and execute PHP code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/Studio-42/elFinder/issues/3429; https://twitter.com/infosec_90/status/[PII_REDACTED]54919425; https://github.com/Studio-42/elFinder/issues/3429
CVE: CVE-2021-43429
Published: 2022-04-07
Description: A Denial of Service vulnerability exists in CORTX-S3 Server as of 11/7/2021 via the mempool_destroy method due to a failture to release locks pool->lock.
CVSS Score: 7.5 (HIGH)
CWE: CWE-667
References: https://github.com/Seagate/cortx-s3server/issues/1037; https://github.com/Seagate/cortx-s3server/pull/1041; https://github.com/Seagate/cortx-s3server/issues/1037
CVE: CVE-2021-43430
Published: 2022-04-07
Description: An Access Control vulnerability exists in BigAntSoft BigAnt office messenger 5.6 via im_webserver, which could let a malicious user upload PHP Trojan files.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://github.com/Flash1201/bug/blob/main/bigant; https://github.com/Flash1201/bug/blob/main/bigant
CVE: CVE-2021-43432
Published: 2022-04-07
Description: A Cross Site Scripting (XSS) vulnerability exists in Exrick XMall Admin Panel as of 11/7/2021 via the GET parameter in product-add.jsp.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://exrick.com; https://github.com/Exrick/xmall; https://github.com/Exrick/xmall/blob/b146cceb21ca42d4237f31dbd7af5ced49048a56/xmall-manager-web/src/main/webapp/WEB-INF/jsp/product-add.jsp#L38
CVE: CVE-2022-0677
Published: 2022-04-07
Description: Improper Handling of Length Parameter Inconsistency vulnerability in the Update Server component of Bitdefender Endpoint Security Tools (in relay role), GravityZone (in Update Server role) allows an attacker to cause a Denial-of-Service. This issue affects: Bitdefender Update Server versions prior to 3.4.0.276. Bitdefender GravityZone versions prior to 26.4-1. Bitdefender Endpoint Security Tools for Linux versions prior to 6.2.21.171. Bitdefender Endpoint Security Tools for Windows versions prior to 7.4.1.111.
CVSS Score: 7.5 (HIGH)
CWE: CWE-130
References: https://www.bitdefender.com/support/security-advisories/improper-handling-of-length-parameter-inconsistency-vulnerability-in-bitdefender-update-server-va-10144; https://www.bitdefender.com/support/security-advisories/improper-handling-of-length-parameter-inconsistency-vulnerability-in-bitdefender-update-server-va-10144
CVE: CVE-2022-0935
Published: 2022-04-07
Description: Host Header injection in password Reset in GitHub repository livehelperchat/livehelperchat prior to 3.97.
CVSS Score: 8.8 (HIGH)
CWE: CWE-840, CWE-116
References: https://github.com/livehelperchat/livehelperchat/commit/ce96791cb4c7420266b668fc234c211914259ba7; https://huntr.dev/bounties/a7e40fdf-a333-4a50-8a53-d11b16ce3ec2; https://github.com/livehelperchat/livehelperchat/commit/ce96791cb4c7420266b668fc234c211914259ba7
CVE: CVE-2022-22513
Published: 2022-04-07
Description: An authenticated remote attacker can cause a null pointer dereference in the CmpSettings component of the affected CODESYS products which leads to a crash.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=17093&token=15cd8424832ea10dcd4873a409a09a539ee381ca&download=; https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=17093&token=15cd8424832ea10dcd4873a409a09a539ee381ca&download=
CVE: CVE-2022-22514
Published: 2022-04-07
Description: An authenticated, remote attacker can gain access to a dereferenced pointer contained in a request. The accesses can subsequently lead to local overwriting of memory in the CmpTraceMgr, whereby the attacker can neither gain the values read internally nor control the values to be written. If invalid memory is accessed, this results in a crash.
CVSS Score: 7.1 (HIGH)
CWE: CWE-822, CWE-119
References: https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=17093&token=15cd8424832ea10dcd4873a409a09a539ee381ca&download=; https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=17093&token=15cd8424832ea10dcd4873a409a09a539ee381ca&download=
CVE: CVE-2022-22515
Published: 2022-04-07
Description: A remote, authenticated attacker could utilize the control program of the CODESYS Control runtime system to use the vulnerability in order to read and modify the configuration file(s) of the affected products.
CVSS Score: 8.1 (HIGH)
CWE: CWE-668
References: https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=17089&token=cc5041e24fc744a397a6f6e3b78200a40e6fcd53&download=; https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=17089&token=cc5041e24fc744a397a6f6e3b78200a40e6fcd53&download=
CVE: CVE-2022-22516
Published: 2022-04-07
Description: The SysDrv3S driver in the CODESYS Control runtime system on Microsoft Windows allows any system user to read and write within restricted memory space.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=17090&token=6cd08b169916366df31388d2e7ba58e7bce93508&download=; https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=17090&token=6cd08b169916366df31388d2e7ba58e7bce93508&download=