deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-42756
Published: 2023-02-16
Description: Multiple stack-based buffer overflow vulnerabilities [CWE-121] in the proxy daemon of FortiWeb 5.x all versions, 6.0.7 and below, 6.1.2 and below, 6.2.6 and below, 6.3.16 and below, 6.4 all versions may allow an unauthenticated remote attacker to achieve arbitrary code execution via specifically crafted HTTP requests.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-121, CWE-787
References: https://fortiguard.com/psirt/FG-IR-21-186; https://fortiguard.com/psirt/FG-IR-21-186
CVE: CVE-2021-42761
Published: 2023-02-16
Description: A condition for session fixation vulnerability [CWE-384] in the session management of FortiWeb versions 6.4 all versions, 6.3.0 through 6.3.16, 6.2.0 through 6.2.6, 6.1.0 through 6.1.2, 6.0.0 through 6.0.7, 5.9.0 through 5.9.1 may allow a remote, unauthenticated attacker to infer the session identifier of other users and possibly usurp their session.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-384, CWE-384
References: https://fortiguard.com/psirt/FG-IR-21-214; https://fortiguard.com/psirt/FG-IR-21-214
CVE: CVE-2021-43074
Published: 2023-02-16
Description: An improper verification of cryptographic signature vulnerability [CWE-347] in FortiWeb 6.4 all versions, 6.3.16 and below, 6.2 all versions, 6.1 all versions, 6.0 all versions; FortiOS 7.0.3 and below, 6.4.8 and below, 6.2 all versions, 6.0 all versions; FortiSwitch 7.0.3 and below, 6.4.10 and below, 6.2 all versions, 6.0 all versions; FortiProxy 7.0.1 and below, 2.0.7 and below, 1.2 all versions, 1.1 all versions, 1.0 all versions may allow an attacker to decrypt portions of the administrative session management cookie if able to intercept the latter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-347, CWE-347
References: https://fortiguard.com/psirt/FG-IR-21-126; https://fortiguard.com/psirt/FG-IR-21-126
CVE: CVE-2022-26115
Published: 2023-02-16
Description: A use of password hash with insufficient computational effort vulnerability [CWE-916] in FortiSandbox before 4.2.0 may allow an attacker with access to the password database to efficiently mount bulk guessing attacks to recover the passwords.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-916, CWE-916
References: https://fortiguard.com/psirt/FG-IR-20-220; https://fortiguard.com/psirt/FG-IR-20-220
CVE: CVE-2022-27482
Published: 2023-02-16
Description: A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiADC version 7.0.0 through 7.0.1, 6.2.0 through 6.2.2, 6.1.0 through 6.1.6, 6.0.x, 5.x.x allows attacker to execute arbitrary shell code as `root` via CLI commands.
CVSS Score: 7.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://fortiguard.com/psirt/FG-IR-22-046; https://fortiguard.com/psirt/FG-IR-22-046
CVE: CVE-2022-27489
Published: 2023-02-16
Description: A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiExtender 7.0.0 through 7.0.3, 5.3.2, 4.2.4 and below allows attacker to execute unauthorized code or commands via crafted HTTP requests.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78, CWE-78
References: https://fortiguard.com/psirt/FG-IR-22-048; https://fortiguard.com/psirt/FG-IR-22-048
CVE: CVE-2022-29054
Published: 2023-02-16
Description: A missing cryptographic steps vulnerability [CWE-325] in the functions that encrypt the DHCP and DNS keys in Fortinet FortiOS version 7.2.0, 7.0.0 through 7.0.5, 6.4.0 through 6.4.9, 6.2.x and 6.0.x may allow an attacker in possession of the encrypted key to decipher it.
CVSS Score: 3.3 (LOW)
CWE: CWE-329
References: https://fortiguard.com/psirt/FG-IR-22-080; https://fortiguard.com/psirt/FG-IR-22-080
CVE: CVE-2022-30299
Published: 2023-02-16
Description: A path traversal vulnerability [CWE-23] in the API of FortiWeb 7.0.0 through 7.0.1, 6.3.0 through 6.3.19, 6.4 all versions, 6.2 all versions, 6.1 all versions, 6.0 all versions may allow an authenticated attacker to retrieve specific parts of files from the underlying file system via specially crafted web requests.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-23, CWE-22
References: https://fortiguard.com/psirt/FG-IR-22-146; https://fortiguard.com/psirt/FG-IR-22-146
CVE: CVE-2022-30300
Published: 2023-02-16
Description: A relative path traversal vulnerability [CWE-23] in FortiWeb 7.0.0 through 7.0.1, 6.3.6 through 6.3.18, 6.4 all versions may allow an authenticated attacker to obtain unauthorized access to files and data via specifically crafted HTTP GET requests.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-23, CWE-22
References: https://fortiguard.com/psirt/FG-IR-22-136; https://fortiguard.com/psirt/FG-IR-22-136
CVE: CVE-2022-30303
Published: 2023-02-16
Description: An improper neutralization of special elements used in an os command ('OS Command Injection') [CWE-78] in FortiWeb 7.0.0 through 7.0.1, 6.3.0 through 6.3.19, 6.4 all versions may allow an authenticated attacker to execute arbitrary shell code as `root` user via crafted HTTP requests.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://fortiguard.com/psirt/FG-IR-22-163; https://fortiguard.com/psirt/FG-IR-22-163
CVE: CVE-2022-30304
Published: 2023-02-16
Description: An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiAnalyzer versions prior to 7.2.1, 7.0.4 and 6.4.8 may allow a remote unauthenticated attacker to perform a stored cross site scripting (XSS) attack via the URL parameter observed in the FortiWeb attack event logview in FortiAnalyzer.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://fortiguard.com/psirt/FG-IR-22-166; https://fortiguard.com/psirt/FG-IR-22-166
CVE: CVE-2022-30306
Published: 2023-02-16
Description: A stack-based buffer overflow vulnerability [CWE-121] in the CA sign functionality of FortiWeb version 7.0.1 and below, 6.4 all versions, version 6.3.19 and below may allow an authenticated attacker to achieve arbitrary code execution via specifically crafted password.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-121, CWE-787
References: https://fortiguard.com/psirt/FG-IR-22-167; https://fortiguard.com/psirt/FG-IR-22-167
CVE: CVE-2022-33869
Published: 2023-02-16
Description: An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in the management interface of FortiWAN 4.0.0 through 4.5.9 may allow an authenticated attacker to execute unauthorized commands via specifically crafted arguments to existing commands.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://fortiguard.com/psirt/FG-IR-22-157; https://fortiguard.com/psirt/FG-IR-22-157
CVE: CVE-2022-33871
Published: 2023-02-16
Description: A stack-based buffer overflow vulnerability [CWE-121] in FortiWeb version 7.0.1 and earlier, 6.4 all versions, version 6.3.19 and earlier may allow a privileged attacker to execute arbitrary code or commands via specifically crafted CLI `execute backup-local rename` and `execute backup-local show` operations.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-121, CWE-787
References: https://fortiguard.com/psirt/FG-IR-22-164; https://fortiguard.com/psirt/FG-IR-22-164
CVE: CVE-2022-38375
Published: 2023-02-16
Description: An improper authorization vulnerability [CWE-285]  in Fortinet FortiNAC version 9.4.0 through 9.4.1 and before 9.2.6 allows an unauthenticated user to perform some administrative operations over the FortiNAC instance via crafted HTTP POST requests.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-285
References: https://fortiguard.com/psirt/FG-IR-22-329; https://fortiguard.com/psirt/FG-IR-22-329
CVE: CVE-2022-38376
Published: 2023-02-16
Description: Multiple improper neutralization of input during web page generation ('Cross-site Scripting') vulnerabilities [CWE-79] in Fortinet FortiNAC portal UI before 9.4.1 allows an attacker to perform an XSS attack via crafted HTTP requests.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://fortiguard.com/psirt/FG-IR-22-273; https://fortiguard.com/psirt/FG-IR-22-273
CVE: CVE-2022-38378
Published: 2023-02-16
Description: An improper privilege management vulnerability [CWE-269] in Fortinet FortiOS version 7.2.0 and before 7.0.7 and FortiProxy version 7.2.0 through 7.2.1 and before 7.0.7 allows an attacker that has access to the admin profile section (System subsection Administrator Users) to modify their own profile and upgrade their privileges to Read Write via CLI or GUI commands.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-269, CWE-269
References: https://fortiguard.com/psirt/FG-IR-22-346; https://fortiguard.com/psirt/FG-IR-22-346
CVE: CVE-2022-39948
Published: 2023-02-16
Description: An improper certificate validation vulnerability [CWE-295] in FortiOS 7.2.0 through 7.2.3, 7.0.0 through 7.0.7, 6.4 all versions, 6.2 all versions, 6.0 all versions and FortiProxy 7.0.0 through 7.0.6, 2.0 all versions, 1.2 all versions may allow a remote and unauthenticated attacker to perform a Man-in-the-Middle attack on the communication channel between the FortiOS/FortiProxy device and remote servers hosting threat feeds (when the latter are configured as Fabric connectors in FortiOS/FortiProxy)
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-295, CWE-295
References: https://fortiguard.com/psirt/FG-IR-22-257; https://fortiguard.com/psirt/FG-IR-22-257
CVE: CVE-2022-39952
Published: 2023-02-16
Description: A external control of file name or path in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2.5, 9.1.0 through 9.1.7, 8.8.0 through 8.8.11, 8.7.0 through 8.7.6, 8.6.0 through 8.6.5, 8.5.0 through 8.5.4, 8.3.7 may allow an unauthenticated attacker to execute unauthorized code or commands via specifically crafted HTTP request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-73, CWE-668
References: https://fortiguard.com/psirt/FG-IR-22-300; https://fortiguard.com/psirt/FG-IR-22-300
CVE: CVE-2022-39954
Published: 2023-02-16
Description: An improper restriction of xml external entity reference in Fortinet FortiNAC version 9.4.0 through 9.4.1, FortiNAC version 9.2.0 through 9.2.7, FortiNAC version 9.1.0 through 9.1.8, FortiNAC version 8.8.0 through 8.8.11, FortiNAC version 8.7.0 through 8.7.6, FortiNAC version 8.6.0 through 8.6.5, FortiNAC version 8.5.0 through 8.5.4, FortiNAC version 8.3.7 allows attacker to read arbitrary files or trigger a denial of service via specifically crafted XML documents.
CVSS Score: 7.3 (HIGH)
CWE: CWE-611, CWE-611
References: https://fortiguard.com/psirt/FG-IR-22-304; https://fortiguard.com/psirt/FG-IR-22-304
CVE: CVE-2022-40675
Published: 2023-02-16
Description: Some cryptographic issues in Fortinet FortiNAC versions 9.4.0 through 9.4.1, 9.2.0 through 9.2.7, 9.1.0 through 9.1.8, 8.8.0 through 8.8.11, 8.7.0 through 8.7.6, 8.6.0 through 8.6.5, 8.5.0 through 8.5.4, 8.3.7 may allow an attacker to decrypt and forge protocol communication messages.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-310
References: https://fortiguard.com/psirt/FG-IR-22-312; https://fortiguard.com/psirt/FG-IR-22-312
CVE: CVE-2022-40677
Published: 2023-02-16
Description: A improper neutralization of argument delimiters in a command ('argument injection') in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2.5, 9.1.0 through 9.1.7, 8.8.0 through 8.8.11, 8.7.0 through 8.7.6, 8.6.0 through 8.6.5, 8.5.0 through 8.5.4, 8.3.7 allows attacker to execute unauthorized code or commands via specially crafted input parameters.
CVSS Score: 7.2 (HIGH)
CWE: CWE-88, CWE-88
References: https://fortiguard.com/psirt/FG-IR-22-280; https://fortiguard.com/psirt/FG-IR-22-280
CVE: CVE-2022-40678
Published: 2023-02-16
Description: An insufficiently protected credentials in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2.5, 9.1.0 through 9.1.7, 8.8.0 through 8.8.11, 8.7.0 through 8.7.6, 8.6.0 through 8.6.5, 8.5.0 through 8.5.4, 8.3.7 may allow a local attacker with database access to recover user passwords.
CVSS Score: 7.4 (HIGH)
CWE: CWE-522, CWE-522
References: https://fortiguard.com/psirt/FG-IR-22-265; https://fortiguard.com/psirt/FG-IR-22-265
CVE: CVE-2022-40683
Published: 2023-02-16
Description: A double free in Fortinet FortiWeb version 7.0.0 through 7.0.3 may allows attacker to execute unauthorized code or commands via specially crafted commands
CVSS Score: 7.8 (HIGH)
CWE: CWE-415, CWE-415
References: https://fortiguard.com/psirt/FG-IR-22-348; https://fortiguard.com/psirt/FG-IR-22-348
CVE: CVE-2022-41334
Published: 2023-02-16
Description: An improper neutralization of input during web page generation [CWE-79] vulnerability in FortiOS versions 7.0.0 to 7.0.7 and 7.2.0 to 7.2.3 may allow a remote, unauthenticated attacker to launch a cross site scripting (XSS) attack via the "redir" parameter of the URL seen when the "Sign in with FortiCloud" button is clicked.
CVSS Score: 8.8 (HIGH)
CWE: CWE-79, CWE-79
References: https://fortiguard.com/psirt/FG-IR-22-224; https://fortiguard.com/psirt/FG-IR-22-224
CVE: CVE-2022-41335
Published: 2023-02-16
Description: A relative path traversal vulnerability [CWE-23] in Fortinet FortiOS version 7.2.0 through 7.2.2, 7.0.0 through 7.0.8 and before 6.4.10, FortiProxy version 7.2.0 through 7.2.1, 7.0.0 through 7.0.7 and before 2.0.10, FortiSwitchManager 7.2.0 and before 7.0.0  allows an authenticated attacker to read and write files on the underlying Linux system via crafted HTTP requests.
CVSS Score: 8.8 (HIGH)
CWE: CWE-23, CWE-22
References: https://fortiguard.com/psirt/FG-IR-22-391; https://fortiguard.com/psirt/FG-IR-22-391
CVE: CVE-2022-42472
Published: 2023-02-16
Description: A improper neutralization of crlf sequences in http headers ('http response splitting') in Fortinet FortiOS versions 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, 6.4.0 through 6.4.11, 6.2.0 through 6.2.12, 6.0.0 through 6.0.16, FortiProxy 7.2.0 through 7.2.1, 7.0.0 through 7.0.7, 2.0.0 through 2.0.10, 1.2.0 through 1.2.13, 1.1.0 through 1.1.6 may allow an authenticated and remote attacker to perform an HTTP request splitting attack which gives attackers control of the remaining headers and body of the response.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-113, CWE-74
References: https://fortiguard.com/psirt/FG-IR-22-362; https://fortiguard.com/psirt/FG-IR-22-362
CVE: CVE-2022-43954
Published: 2023-02-16
Description: An insertion of sensitive information into log file vulnerability [CWE-532] in the FortiPortal management interface 7.0.0 through 7.0.2 may allow a remote authenticated attacker to read other devices' passwords in the audit log page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-532, CWE-532
References: https://fortiguard.com/psirt/FG-IR-22-430; https://fortiguard.com/psirt/FG-IR-22-430
CVE: CVE-2023-0475
Published: 2023-02-16
Description: HashiCorp go-getter up to 1.6.2 and 2.1.1 is vulnerable to decompression bombs. Fixed in 1.7.0 and 2.2.0.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-409
References: https://discuss.hashicorp.com/t/hcsec-2023-4-go-getter-vulnerable-to-denial-of-service-via-malicious-compressed-archive/50125; https://discuss.hashicorp.com/t/hcsec-2023-4-go-getter-vulnerable-to-denial-of-service-via-malicious-compressed-archive/50125
CVE: CVE-2023-22638
Published: 2023-02-16
Description: Several improper neutralization of inputs during web page generation vulnerability [CWE-79] in FortiNAC  9.4.1 and below, 9.2.6 and below, 9.1.8 and below, 8.8.11 and below, 8.7.6 and below, 8.6.5 and below, 8.5.4 and below, 8.3.7 and below may allow an authenticated attacker to perform several XSS attacks via crafted HTTP GET requests.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79, CWE-79
References: https://fortiguard.com/psirt/FG-IR-22-260; https://fortiguard.com/psirt/FG-IR-22-260
CVE: CVE-2023-23778
Published: 2023-02-16
Description: A relative path traversal vulnerability [CWE-23] in FortiWeb version 7.0.1 and below, 6.4 all versions, 6.3 all versions, 6.2 all versions may allow an authenticated user to obtain unauthorized access to files and data via specifically crafted web requests.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-23, CWE-22
References: https://fortiguard.com/psirt/FG-IR-22-142; https://fortiguard.com/psirt/FG-IR-22-142
CVE: CVE-2023-23779
Published: 2023-02-16
Description: Multiple improper neutralization of special elements used in an OS Command ('OS Command Injection') vulnerabilities [CWE-78] in FortiWeb version 7.0.1 and below, 6.4 all versions, version 6.3.19 and below may allow an authenticated attacker to execute unauthorized code or commands via crafted parameters of HTTP requests.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-78, CWE-78
References: https://fortiguard.com/psirt/FG-IR-22-133; https://fortiguard.com/psirt/FG-IR-22-133
CVE: CVE-2023-23780
Published: 2023-02-16
Description: A stack-based buffer overflow in Fortinet FortiWeb version 7.0.0 through 7.0.1, Fortinet FortiWeb version 6.3.6 through 6.3.19, Fortinet FortiWeb 6.4 all versions allows attacker to escalation of privilege via specifically crafted HTTP requests.
CVSS Score: 8.0 (HIGH)
CWE: CWE-121, CWE-787
References: https://fortiguard.com/psirt/FG-IR-22-118; https://fortiguard.com/psirt/FG-IR-22-118
CVE: CVE-2023-23781
Published: 2023-02-16
Description: A stack-based buffer overflow vulnerability [CWE-121] in FortiWeb version 7.0.1 and below, 6.4 all versions, version 6.3.19 and below SAML server configuration may allow an authenticated attacker to achieve arbitrary code execution via specifically crafted XML files.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-121, CWE-787
References: https://fortiguard.com/psirt/FG-IR-22-151; https://fortiguard.com/psirt/FG-IR-22-151
CVE: CVE-2023-23782
Published: 2023-02-16
Description: A heap-based buffer overflow in Fortinet FortiWeb version 7.0.0 through 7.0.1, FortiWeb version 6.3.0 through 6.3.19, FortiWeb 6.4 all versions, FortiWeb 6.2 all versions, FortiWeb 6.1 all versions allows attacker to escalation of privilege via specifically crafted arguments to existing commands.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://fortiguard.com/psirt/FG-IR-22-111; https://fortiguard.com/psirt/FG-IR-22-111
CVE: CVE-2023-23783
Published: 2023-02-16
Description: A use of externally-controlled format string in Fortinet FortiWeb version 7.0.0 through 7.0.1, FortiWeb 6.4 all versions allows attacker to execute unauthorized code or commands via specially crafted command arguments.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-134, CWE-134
References: https://fortiguard.com/psirt/FG-IR-22-187; https://fortiguard.com/psirt/FG-IR-22-187
CVE: CVE-2023-23784
Published: 2023-02-16
Description: A relative path traversal in Fortinet FortiWeb version 7.0.0 through 7.0.2, FortiWeb version 6.3.6 through 6.3.20, FortiWeb 6.4 all versions allows attacker to information disclosure via specially crafted web requests.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-23, CWE-22
References: https://fortiguard.com/psirt/FG-IR-22-251; https://fortiguard.com/psirt/FG-IR-22-251
CVE: CVE-2023-25602
Published: 2023-02-16
Description: A stack-based buffer overflow in Fortinet FortiWeb 6.4 all versions, FortiWeb versions 6.3.17 and earlier, FortiWeb versions 6.2.6 and earlier, FortiWeb versions 6.1.2 and earlier, FortiWeb versions 6.0.7 and earlier, FortiWeb versions 5.9.1 and earlier, FortiWeb 5.8 all versions, FortiWeb 5.7 all versions, FortiWeb 5.6 all versions allows attacker to execute unauthorized code or commands via specially crafted command arguments.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://fortiguard.com/psirt/FG-IR-21-234; https://fortiguard.com/psirt/FG-IR-21-234
CVE: CVE-2023-25653
Published: 2023-02-16
Description: node-jose is a JavaScript implementation of the JSON Object Signing and Encryption (JOSE) for web browsers and node.js-based servers. Prior to version 2.2.0, when using the non-default "fallback" crypto back-end, ECC operations in `node-jose` can trigger a Denial-of-Service (DoS) condition, due to a possible infinite loop in an internal calculation.  For some ECC operations, this condition is triggered randomly; for others, it can be triggered by malicious input. The issue has been patched in version 2.2.0. Since this issue is only present in the "fallback" crypto implementation, it can be avoided by ensuring that either WebCrypto or the Node `crypto` module is available in the JS environment where `node-jose` is being run.
CVSS Score: 7.5 (HIGH)
CWE: CWE-835, CWE-835
References: https://github.com/cisco/node-jose/commit/901d91508a70e3b9bdfc45688ea07bb4e1b8210d; https://github.com/cisco/node-jose/security/advisories/GHSA-5h4j-qrvg-9xhw; https://github.com/cisco/node-jose/commit/901d91508a70e3b9bdfc45688ea07bb4e1b8210d
CVE: CVE-2021-0187
Published: 2023-02-16
Description: Improper access control in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable an escalation of privilege via local access.
CVSS Score: 3.2 (LOW)
References: http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00717.html; http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00717.html
CVE: CVE-2022-21216
Published: 2023-02-16
Description: Insufficient granularity of access control in out-of-band management in some Intel(R) Atom and Intel Xeon Scalable Processors may allow a privileged user to potentially enable escalation of privilege via adjacent network access.
CVSS Score: 7.5 (HIGH)
References: http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00700.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00700.html
CVE: CVE-2022-25905
Published: 2023-02-16
Description: Uncontrolled search path element in the Intel(R) oneAPI Data Analytics Library (oneDAL) before version 2021.5 for Intel(R) oneAPI Base Toolkit may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-427
References: http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00674.html; http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00674.html
CVE: CVE-2022-25987
Published: 2023-02-16
Description: Improper handling of Unicode encoding in source code to be compiled by the Intel(R) C++ Compiler Classic before version 2021.6 for Intel(R) oneAPI Toolkits before version 2022.2 may allow an unauthenticated user to potentially enable escalation of privilege via network access.
CVSS Score: 8.3 (HIGH)
References: http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00674.html; http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00674.html
CVE: CVE-2022-25992
Published: 2023-02-16
Description: Insecure inherited permissions in the Intel(R) oneAPI Toolkits oneapi-cli before version 0.2.0 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 7.5 (HIGH)
CWE: CWE-732
References: http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00674.html; http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00674.html
CVE: CVE-2022-26032
Published: 2023-02-16
Description: Uncontrolled search path element in the Intel(R) Distribution for Python programming language before version 2022.1 for Intel(R) oneAPI Toolkits may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-427
References: http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00674.html; http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00674.html
CVE: CVE-2022-26052
Published: 2023-02-16
Description: Uncontrolled search path element in the Intel(R) MPI Library before version 2021.6 for Intel(R) oneAPI HPC Toolkit may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-427
References: http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00674.html; http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00674.html
CVE: CVE-2022-26062
Published: 2023-02-16
Description: Uncontrolled search path element in the Intel(R) Trace Analyzer and Collector before version 2021.6 for Intel(R) oneAPI HPC Toolkit may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-427
References: http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00674.html; http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00674.html