deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-30689
Published: 2022-05-17
Description: HashiCorp Vault and Vault Enterprise from 1.10.0 to 1.10.2 did not correctly configure and enforce MFA on login after server restarts. This affects the Login MFA feature introduced in Vault and Vault Enterprise 1.10.0 and does not affect the separate Enterprise MFA feature set. Fixed in 1.10.3.
CVSS Score: 5.3 (MEDIUM)
References: https://discuss.hashicorp.com; https://security.gentoo.org/glsa/202207-01; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2022-1735
Published: 2022-05-17
Description: Classic Buffer Overflow in GitHub repository vim/vim prior to 8.2.4969.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120, CWE-120
References: http://seclists.org/fulldisclosure/2022/Oct/28; http://seclists.org/fulldisclosure/2022/Oct/41; https://github.com/vim/vim/commit/7ce5b2b590256ce53d6af28c1d203fb3bc1d2d97
CVE: CVE-2022-23674
Published: 2022-05-17
Description: A remote authenticated stored cross-site scripting (xss) vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8.9-HF2 and below, 6.7.x and below. Aruba has released updates to ClearPass Policy Manager that address this security vulnerability.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-007.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-007.txt
CVE: CVE-2022-24890
Published: 2022-05-17
Description: Nextcloud Talk is a video and audio conferencing app for Nextcloud. In versions prior to 13.0.5 and 14.0.0, a call moderator can indirectly enable user webcams by granting permissions, if they were enabled before removing the permissions. A patch is available in versions 13.0.5 and 14.0.0. There are currently no known workarounds.
CVSS Score: 2.4 (LOW)
CWE: CWE-200, CWE-359, CWE-276
References: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-vxpr-hcqq-7fw7; https://github.com/nextcloud/spreed/issues/7048; https://github.com/nextcloud/spreed/pull/7034
CVE: CVE-2022-29429
Published: 2022-05-17
Description: Remote Code Execution (RCE) in Alexander Stokmann's Code Snippets Extended plugin <= 1.4.7 on WordPress via Cross-Site Request Forgery.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/code-snippets-extended/wordpress-code-snippets-extended-plugin-1-4-7-cross-site-request-forgery-csrf-leading-to-remote-code-execution-rce-vulnerability; https://wordpress.org/plugins/code-snippets-extended/#developers; https://patchstack.com/database/vulnerability/code-snippets-extended/wordpress-code-snippets-extended-plugin-1-4-7-cross-site-request-forgery-csrf-leading-to-remote-code-execution-rce-vulnerability
CVE: CVE-2022-30688
Published: 2022-05-17
Description: needrestart 0.8 through 3.5 before 3.6 is prone to local privilege escalation. Regexes to detect the Perl, Python, and Ruby interpreters are not anchored, allowing a local user to escalate privileges when needrestart tries to detect if interpreters are using old source files.
CVSS Score: 7.8 (HIGH)
References: http://www.openwall.com/lists/oss-security/2022/05/17/9; https://github.com/liske/needrestart/commit/e6e58136e1e3c92296e2e810cb8372a5fe0dbd30; https://github.com/liske/needrestart/releases/tag/v3.6
CVE: CVE-2021-35249
Published: 2022-05-17
Description: This broken access control vulnerability pertains specifically to a domain admin who can access configuration & user data of other domains which they should not have access to. Please note the admin is unable to modify the data (read only operation). This UAC issue leads to a data leak to unauthorized users for a domain, with no log of them accessing the data unless they attempt to modify it. This read-only activity is logged to the original domain and does not specify which domain was accessed.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284
References: https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_15-3-1_release_notes.htm; https://www.solarwinds.com/trust-center/security-advisories/CVE-2021-35249; https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_15-3-1_release_notes.htm
CVE: CVE-2022-0486
Published: 2022-05-17
Description: Improper file permissions in the CommandPost, Collector, Sensor, and Sandbox components of Fidelis Network and Deception enables an attacker with local, administrative access to the CLI to modify affected files and enable escalation of privileges equivalent to the root user. The vulnerability is present in Fidelis Network and Deception versions prior to 9.4.5. Patches and updates are available to address this vulnerability.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-276, CWE-276
References: https://fidelissecurity.zendesk.com/hc/en-us/articles/[PII_REDACTED]411; https://fidelissecurity.zendesk.com/hc/en-us/articles/[PII_REDACTED]411
CVE: CVE-2022-0997
Published: 2022-05-17
Description: Improper file permissions in the CommandPost, Collector, and Sensor components of Fidelis Network and Deception enables an attacker with local, administrative access to the CLI to modify affected script files, which could result in arbitrary commands being run as root upon subsequent logon by a root user. The vulnerability is present in Fidelis Network and Deception versions prior to 9.4.5. Patches and updates are available to address this vulnerability.
CVSS Score: 3.9 (LOW)
CWE: CWE-276, CWE-276
References: https://fidelissecurity.zendesk.com/hc/en-us/articles/[PII_REDACTED]411; https://fidelissecurity.zendesk.com/hc/en-us/articles/[PII_REDACTED]411
CVE: CVE-2022-1118
Published: 2022-05-17
Description: Connected Components Workbench (v13.00.00 and prior), ISaGRAF Workbench (v6.0 though v6.6.9), and Safety Instrumented System Workstation (v1.2 and prior (for Trusted Controllers)) do not limit the objects that can be deserialized. This allows attackers to craft a malicious serialized object that, if opened by a local user in Connected Components Workbench, may result in arbitrary code execution. This vulnerability requires user interaction to be successfully exploited
CVSS Score: 8.6 (HIGH)
CWE: CWE-502
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-095-01; https://www.cisa.gov/uscert/ics/advisories/icsa-22-095-01
CVE: CVE-2022-23706
Published: 2022-05-17
Description: A remote cross-site scripting (xss) vulnerability was discovered in HPE OneView version(s): Prior to 7.0. HPE has provided a software update to resolve this vulnerability in HPE OneView.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn04278en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn04278en_us
CVE: CVE-2022-24388
Published: 2022-05-17
Description: Vulnerability in rconfig “date” enables an attacker with user level access to the CLI to inject root level commands into Fidelis Network and Deception CommandPost, Collector, Sensor, and Sandbox components as well as neighboring Fidelis components. The vulnerability is present in Fidelis Network and Deception versions prior to 9.4.5. Patches and updates are available to address this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-77
References: https://fidelissecurity.zendesk.com/hc/en-us/articles/[PII_REDACTED]411; https://fidelissecurity.zendesk.com/hc/en-us/articles/[PII_REDACTED]411
CVE: CVE-2022-24389
Published: 2022-05-17
Description: Vulnerability in rconfig “cert_utils” enables an attacker with user level access to the CLI to inject root level commands into Fidelis Network and Deception CommandPost, Collector, Sensor, and Sandbox components as well as neighboring Fidelis components. The vulnerability is present in Fidelis Network and Deception versions prior to 9.4.5. Patches and updates are available to address this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-77
References: https://fidelissecurity.zendesk.com/hc/en-us/articles/[PII_REDACTED]411; https://fidelissecurity.zendesk.com/hc/en-us/articles/[PII_REDACTED]411
CVE: CVE-2022-24390
Published: 2022-05-17
Description: Vulnerability in rconfig “remote_text_file” enables an attacker with user level access to the CLI to inject user level commands into Fidelis Network and Deception CommandPost, Collector, Sensor, and Sandbox components as well as neighboring Fidelis components. The vulnerability is present in Fidelis Network and Deception versions prior to 9.4.5. Patches and updates are available to address this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-77
References: https://fidelissecurity.zendesk.com/hc/en-us/articles/[PII_REDACTED]411; https://fidelissecurity.zendesk.com/hc/en-us/articles/[PII_REDACTED]411
CVE: CVE-2022-24391
Published: 2022-05-17
Description: Vulnerability in Fidelis Network and Deception CommandPost enables SQL injection through the web interface by an attacker with user level access. The vulnerability is present in Fidelis Network and Deception versions prior to 9.4.5. Patches and updates are available to address this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://fidelissecurity.zendesk.com/hc/en-us/articles/[PII_REDACTED]411; https://fidelissecurity.zendesk.com/hc/en-us/articles/[PII_REDACTED]411
CVE: CVE-2022-24392
Published: 2022-05-17
Description: Vulnerability in Fidelis Network and Deception CommandPost enables authenticated command injection through the web interface using the “feed_comm_test” value for the “feed” parameter. The vulnerability could allow a specially crafted HTTP request to execute system commands on the CommandPost and return results in an HTTP response via an authenticated session. The vulnerability is present in Fidelis Network and Deception versions prior to 9.4.5. Patches and updates are available to address this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-77
References: https://fidelissecurity.zendesk.com/hc/en-us/articles/[PII_REDACTED]411; https://fidelissecurity.zendesk.com/hc/en-us/articles/[PII_REDACTED]411
CVE: CVE-2022-24393
Published: 2022-05-17
Description: Vulnerability in Fidelis Network and Deception CommandPost enables authenticated command injection through the web interface using the “check_vertica_upgrade” value for the “cpIp” parameter. The vulnerability could allow a specially crafted HTTP request to execute system commands on the CommandPost and return results in an HTTP response via an authenticated session. The vulnerability is present in Fidelis Network and Deception versions prior to 9.4.5. Patches and updates are available to address this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-77
References: https://fidelissecurity.zendesk.com/hc/en-us/articles/[PII_REDACTED]411; https://fidelissecurity.zendesk.com/hc/en-us/articles/[PII_REDACTED]411
CVE: CVE-2022-24394
Published: 2022-05-17
Description: Vulnerability in Fidelis Network and Deception CommandPost enables authenticated command injection through the web interface using the “update_checkfile” value for the “filename” parameter. The vulnerability could allow a specially crafted HTTP request to execute system commands on the CommandPost and return results in an HTTP response via an authenticated session. The vulnerability is present in Fidelis Network and Deception versions prior to 9.4.5. Patches and updates are available to address this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-77
References: https://fidelissecurity.zendesk.com/hc/en-us/articles/[PII_REDACTED]411; https://fidelissecurity.zendesk.com/hc/en-us/articles/[PII_REDACTED]411
CVE: CVE-2022-28181
Published: 2022-05-17
Description: NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where an unprivileged regular user on the network can cause an out-of-bounds write through a specially crafted shader, which may lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering. The scope of the impact may extend to other components.
CVSS Score: 8.5 (HIGH)
CWE: CWE-787, CWE-787
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5353; https://security.gentoo.org/glsa/202310-02; https://nvidia.custhelp.com/app/answers/detail/a_id/5353
CVE: CVE-2022-28182
Published: 2022-05-17
Description: NVIDIA GPU Display Driver for Windows contains a vulnerability in the DirectX11 user mode driver (nvwgf2um/x.dll), where an unauthorized attacker on the network can cause an out-of-bounds write through a specially crafted shader, which may lead to code execution to cause denial of service, escalation of privileges, information disclosure, and data tampering. The scope of the impact may extend to other components.
CVSS Score: 8.5 (HIGH)
CWE: CWE-787, CWE-787
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5353; https://nvidia.custhelp.com/app/answers/detail/a_id/5353
CVE: CVE-2022-28183
Published: 2022-05-17
Description: NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where an unprivileged regular user can cause an out-of-bounds read, which may lead to denial of service and information disclosure.
CVSS Score: 7.7 (HIGH)
CWE: CWE-125, CWE-125
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5353; https://security.gentoo.org/glsa/202310-02; https://nvidia.custhelp.com/app/answers/detail/a_id/5353
CVE: CVE-2022-28184
Published: 2022-05-17
Description: NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape, where an unprivileged regular user can access administrator- privileged registers, which may lead to denial of service, information disclosure, and data tampering.
CVSS Score: 7.1 (HIGH)
CWE: CWE-284
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5353; https://security.gentoo.org/glsa/202310-02; https://nvidia.custhelp.com/app/answers/detail/a_id/5353
CVE: CVE-2022-28185
Published: 2022-05-17
Description: NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the ECC layer, where an unprivileged regular user can cause an out-of-bounds write, which may lead to denial of service and data tampering.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5353; https://security.gentoo.org/glsa/202310-02; https://nvidia.custhelp.com/app/answers/detail/a_id/5353
CVE: CVE-2022-28186
Published: 2022-05-17
Description: NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape, where the product receives input or data, but does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly, which may lead to denial of service or data tampering.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5353; https://nvidia.custhelp.com/app/answers/detail/a_id/5353
CVE: CVE-2022-28187
Published: 2022-05-17
Description: NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys), where the memory management software does not release a resource after its effective lifetime has ended, which may lead to denial of service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-772, CWE-772
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5353; https://nvidia.custhelp.com/app/answers/detail/a_id/5353
CVE: CVE-2022-28188
Published: 2022-05-17
Description: NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape, where the product receives input or data, but does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly, which may lead to denial of service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5353; https://nvidia.custhelp.com/app/answers/detail/a_id/5353
CVE: CVE-2022-28189
Published: 2022-05-17
Description: NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape, where a NULL pointer dereference may lead to a system crash.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5353; https://nvidia.custhelp.com/app/answers/detail/a_id/5353
CVE: CVE-2022-28190
Published: 2022-05-17
Description: NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape, where improper input validation can cause denial of service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5353; https://nvidia.custhelp.com/app/answers/detail/a_id/5353
CVE: CVE-2022-28191
Published: 2022-05-17
Description: NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (nvidia.ko), where uncontrolled resource consumption can be triggered by an unprivileged regular user, which may lead to denial of service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-400, CWE-400
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5353; https://nvidia.custhelp.com/app/answers/detail/a_id/5353
CVE: CVE-2022-28192
Published: 2022-05-17
Description: NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (nvidia.ko), where it may lead to a use-after-free, which in turn may cause denial of service. This attack is complex to carry out because the attacker needs to have control over freeing some host side resources out of sequence, which requires elevated privileges.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-416, CWE-416
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5353; https://nvidia.custhelp.com/app/answers/detail/a_id/5353
CVE: CVE-2022-28617
Published: 2022-05-17
Description: A remote bypass security restrictions vulnerability was discovered in HPE OneView version(s): Prior to 7.0. HPE has provided a software update to resolve this vulnerability in HPE OneView.
CVSS Score: 9.8 (CRITICAL)
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn04278en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn04278en_us
CVE: CVE-2022-29435
Published: 2022-05-17
Description: Cross-Site Request Forgery (CSRF) vulnerability in Alexander Stokmann's Code Snippets Extended plugin <= 1.4.7 on WordPress allows an attacker to delete or to turn on/off snippets.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/code-snippets-extended/wordpress-code-snippets-extended-plugin-1-4-7-cross-site-request-forgery-csrf-vulnerability; https://wordpress.org/plugins/code-snippets-extended/#developers; https://patchstack.com/database/vulnerability/code-snippets-extended/wordpress-code-snippets-extended-plugin-1-4-7-cross-site-request-forgery-csrf-vulnerability
CVE: CVE-2022-29436
Published: 2022-05-17
Description: Persistent Cross-Site Scripting (XSS) vulnerability in Alexander Stokmann's Code Snippets Extended plugin <= 1.4.7 on WordPress via Cross-Site Request Forgery (vulnerable parameters &title, &snippet_code).
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-79, CWE-352, CWE-79, CWE-352
References: https://patchstack.com/database/vulnerability/code-snippets-extended/wordpress-code-snippets-extended-plugin-1-4-7-cross-site-request-forgery-csrf-vulnerability-leading-to-persistent-cross-site-scripting-xss; https://wordpress.org/plugins/code-snippets-extended/#developers; https://patchstack.com/database/vulnerability/code-snippets-extended/wordpress-code-snippets-extended-plugin-1-4-7-cross-site-request-forgery-csrf-vulnerability-leading-to-persistent-cross-site-scripting-xss
CVE: CVE-2022-30045
Published: 2022-05-17
Description: An issue was discovered in libezxml.a in ezXML 0.8.6. The function ezxml_decode() performs incorrect memory handling while parsing crafted XML files, leading to a heap out-of-bounds read.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://sourceforge.net/p/ezxml/bugs/29/; https://sourceforge.net/p/ezxml/bugs/29/
CVE: CVE-2022-30052
Published: 2022-05-17
Description: In Home Clean Service System 1.0, the password parameter is vulnerable to SQL injection attacks.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/acetech/2022/Home-Clean-Service-System; https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/acetech/2022/Home-Clean-Service-System
CVE: CVE-2022-30053
Published: 2022-05-17
Description: In Toll Tax Management System 1.0, the id parameter appears to be vulnerable to SQL injection attacks.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/2022/Toll-Tax-Management-System; https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/2022/Toll-Tax-Management-System
CVE: CVE-2022-30054
Published: 2022-05-17
Description: In Covid 19 Travel Pass Management 1.0, the code parameter is vulnerable to SQL injection attacks.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/2022/Covid-19-Travel-Pass-Management; https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/2022/Covid-19-Travel-Pass-Management
CVE: CVE-2022-1356
Published: 2022-05-17
Description: cnMaestro is vulnerable to a local privilege escalation. By default, a user does not have root privileges. However, a user can run scripts as sudo, which could allow an attacker to gain root privileges when running user scripts outside allowed commands.
CVSS Score: 7.1 (HIGH)
CWE: CWE-78
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-132-04; https://www.cisa.gov/uscert/ics/advisories/icsa-22-132-04
CVE: CVE-2022-1357
Published: 2022-05-17
Description: The affected On-Premise cnMaestro allows an unauthenticated attacker to access the cnMaestro server and execute arbitrary code in the privileges of the web server. This lack of validation could allow an attacker to append arbitrary data to the logger command.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-132-04; https://www.cisa.gov/uscert/ics/advisories/icsa-22-132-04
CVE: CVE-2022-1358
Published: 2022-05-17
Description: The affected On-Premise is vulnerable to data exfiltration through improper neutralization of special elements used in an SQL command. This could allow an attacker to exfiltrate and dump all data held in the cnMaestro database.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-89
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-132-04; https://www.cisa.gov/uscert/ics/advisories/icsa-22-132-04
CVE: CVE-2022-1359
Published: 2022-05-17
Description: The affected On-Premise cnMaestro is vulnerable to an arbitrary file-write through improper limitation of a pathname to a restricted directory inside a specific route. If an attacker supplied path traversal charters (../) as part of a filename, the server will save the file where the attacker chooses. This could allow an attacker to write any data to any file in the server.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-78, CWE-22
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-132-04; https://www.cisa.gov/uscert/ics/advisories/icsa-22-132-04
CVE: CVE-2022-1360
Published: 2022-05-17
Description: The affected On-Premise cnMaestro is vulnerable to execution of code on the cnMaestro hosting server. This could allow a remote attacker to change server configuration settings.
CVSS Score: 8.2 (HIGH)
CWE: CWE-78
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-132-04; https://www.cisa.gov/uscert/ics/advisories/icsa-22-132-04