rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-32021 
Car Rental Management System v1.0 is vulnerable to SQL Injection via /car-rental-management-system/admin/manage_movement.php?id=.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-02T15:59:43.000Z
CVE-2022-32022 
Car Rental Management System v1.0 is vulnerable to SQL Injection via /ip/car-rental-management-system/admin/ajax.php?action=login.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-02T15:58:14.000Z
CVE-2022-32024 
Car Rental Management System v1.0 is vulnerable to SQL Injection via car-rental-management-system/booking.php?car_id=.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-02T15:50:38.000Z
CVE-2022-32025 
Car Rental Management System v1.0 is vulnerable to SQL Injection via /car-rental-management-system/admin/view_car.php?id=.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-02T15:49:30.000Z
CVE-2022-32026 
Car Rental Management System v1.0 is vulnerable to SQL Injection via /car-rental-management-system/admin/manage_booking.php?id=.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-02T15:44:51.000Z
CVE-2022-32027 
Car Rental Management System v1.0 is vulnerable to SQL Injection via /car-rental-management-system/admin/index.php?page=manage_car&id=.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-02T15:43:09.000Z
CVE-2022-32028 
Car Rental Management System v1.0 is vulnerable to SQL Injection via /car-rental-management-system/admin/manage_user.php?id=.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-02T15:41:13.000Z
CVE-2022-32030 
Tenda AX1806 v1.0.0.1 was discovered to contain a stack overflow via the list parameter in the function formSetQosBand.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-01T17:28:04.000Z
CVE-2022-32031 
Tenda AX1806 v1.0.0.1 was discovered to contain a stack overflow via the list parameter in the function fromSetRouteStatic.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-01T17:28:03.000Z
CVE-2022-32032 
Tenda AX1806 v1.0.0.1 was discovered to contain a stack overflow via the deviceList parameter in the function formAddMacfilterRule.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-01T17:28:02.000Z
CVE-2022-32033 
Tenda AX1806 v1.0.0.1 was discovered to contain a stack overflow via the function formSetVirtualSer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-01T17:28:01.000Z
CVE-2022-32034 
Tenda M3 V1.0.0.12 was discovered to contain a stack overflow via the items parameter in the function formdelMasteraclist.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-01T17:27:57.000Z
CVE-2022-32035 
Tenda M3 V1.0.0.12 was discovered to contain a stack overflow via the function formMasterMng.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-01T17:27:56.000Z
CVE-2022-32036 
Tenda M3 V1.0.0.12 was discovered to contain multiple stack overflow vulnerabilities via the ssidList, storeName, and trademark parameters in the function formSetStoreWeb.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-01T17:27:55.000Z
CVE-2022-32037 
Tenda M3 V1.0.0.12 was discovered to contain a stack overflow via the function formSetAPCfg.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-01T17:27:55.000Z
CVE-2022-32039 
Tenda M3 V1.0.0.12 was discovered to contain a stack overflow via the listN parameter in the function fromDhcpListClient.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-01T17:27:54.000Z
CVE-2022-32040 
Tenda M3 V1.0.0.12 was discovered to contain a stack overflow via the function formSetCfm.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-01T17:27:53.000Z
CVE-2022-32041 
Tenda M3 V1.0.0.12 was discovered to contain a stack overflow via the function formGetPassengerAnalyseData.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-01T17:27:51.000Z
CVE-2022-32043 
Tenda M3 V1.0.0.12 was discovered to contain a stack overflow via the function formSetAccessCodeInfo.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-01T17:27:49.000Z
CVE-2022-32044 
TOTOLINK T6 V4.1.9cu.5179_B20201015 was discovered to contain a stack overflow via the password parameter in the function FUN_00413f80.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-01T17:27:48.000Z
CVE-2022-32045 
TOTOLINK T6 V4.1.9cu.5179_B20201015 was discovered to contain a stack overflow via the desc parameter in the function FUN_00413be4.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-01T17:27:45.000Z
CVE-2022-32046 
TOTOLINK T6 V4.1.9cu.5179_B20201015 was discovered to contain a stack overflow via the desc parameter in the function FUN_0041880c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-01T17:27:44.000Z
CVE-2022-32047 
TOTOLINK T6 V4.1.9cu.5179_B20201015 was discovered to contain a stack overflow via the desc parameter in the function FUN_00412ef4.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-01T17:27:44.000Z
CVE-2022-32048 
TOTOLINK T6 V4.1.9cu.5179_B20201015 was discovered to contain a stack overflow via the command parameter in the function FUN_0041cc88.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-01T17:27:43.000Z
CVE-2022-32049 
TOTOLINK T6 V4.1.9cu.5179_B20201015 was discovered to contain a stack overflow via the url parameter in the function FUN_00418540.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-01T17:27:42.000Z
CVE-2022-32050 
TOTOLINK T6 V4.1.9cu.5179_B20201015 was discovered to contain a stack overflow via the cloneMac parameter in the function FUN_0041af40.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-01T17:27:41.000Z
CVE-2022-32051 
TOTOLINK T6 V4.1.9cu.5179_B20201015 was discovered to contain a stack overflow via the desc, week, sTime, eTime parameters in the function FUN_004133c4.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-01T17:27:41.000Z
CVE-2022-32052 
TOTOLINK T6 V4.1.9cu.5179_B20201015 was discovered to contain a stack overflow via the desc parameter in the function FUN_004137a4.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-01T17:27:40.000Z
CVE-2022-32053 
TOTOLINK T6 V4.1.9cu.5179_B20201015 was discovered to contain a stack overflow via the cloneMac parameter in the function FUN_0041621c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-01T17:27:39.000Z
CVE-2022-32054 
Tenda AC10 US_AC10V1.0RTL_V15.03.06.26_multi_TD01 was discovered to contain a remote code execution (RCE) vulnerability via the lanIp parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-07T17:08:33.000Z
CVE-2022-32055 
Inout Homestay v2.2 was discovered to contain a SQL injection vulnerability via the guests parameter at /index.php?page=search/rentals.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-07T17:15:05.000Z
CVE-2022-32056 
Online Accreditation Management v1.0 was discovered to contain a SQL injection vulnerability via the USERNAME parameter at process.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-07T17:25:33.000Z
CVE-2022-32058 
An infinite loop in the function httpRpmPass of TP-Link TL-WR741N/TL-WR742N V1/V2/V3_130415 allows attackers to cause a Denial of Service (DoS) via a crafted packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-07T17:47:26.000Z
CVE-2022-32060 
An arbitrary file upload vulnerability in the Update Branding Settings component of Snipe-IT v6.0.2 allows attackers to execute arbitrary code via a crafted file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-07T00:00:00.000Z
CVE-2022-32061 
An arbitrary file upload vulnerability in the Select User function under the People Menu component of Snipe-IT v6.0.2 allows attackers to execute arbitrary code via a crafted file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-07T22:12:33.000Z
CVE-2022-32065 
An arbitrary file upload vulnerability in the background management module of RuoYi v4.7.3 and below allows attackers to execute arbitrary code via a crafted HTML file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-13T14:51:51.000Z
CVE-2022-32073 
WolfSSH v1.4.7 was discovered to contain an integer overflow via the function wolfSSH_SFTP_RecvRMDIR.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-13T15:29:10.000Z
CVE-2022-32074 
A stored cross-site scripting (XSS) vulnerability in the component audit/class.audit.php of osTicket-plugins - Storage-FS before commit a7842d494889fd5533d13deb3c6a7789768795ae allows attackers to execute arbitrary web scripts or HTML via a crafted SVG file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-13T15:35:28.000Z
CVE-2022-32081 
MariaDB v10.4 to v10.7 was discovered to contain an use-after-poison in prepare_inplace_add_virtual at /storage/innobase/handler/handler0alter.cc.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-01T00:00:00.000Z
CVE-2022-32082 
MariaDB v10.5 to v10.7 was discovered to contain an assertion failure at table->get_ref_count() == 0 in dict0dict.cc.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-01T00:00:00.000Z
CVE-2022-32083 
MariaDB v10.2 to v10.6.1 was discovered to contain a segmentation fault via the component Item_subselect::init_expr_cache_tracker.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-01T19:10:31.000Z
CVE-2022-32084 
MariaDB v10.2 to v10.7 was discovered to contain a segmentation fault via the component sub_select.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-01T00:00:00.000Z
CVE-2022-32085 
MariaDB v10.2 to v10.7 was discovered to contain a segmentation fault via the component Item_func_in::cleanup/Item::cleanup_processor.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-01T19:10:32.000Z
CVE-2022-32086 
MariaDB v10.4 to v10.8 was discovered to contain a segmentation fault via the component Item_field::fix_outer_field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-01T19:10:33.000Z
CVE-2022-32087 
MariaDB v10.2 to v10.7 was discovered to contain a segmentation fault via the component Item_args::walk_args.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-01T19:10:34.000Z
CVE-2022-32088 
MariaDB v10.2 to v10.7 was discovered to contain a segmentation fault via the component Exec_time_tracker::get_loops/Filesort_tracker::report_use/filesort.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-01T19:10:45.000Z
CVE-2022-32089 
MariaDB v10.5 to v10.7 was discovered to contain a segmentation fault via the component st_select_lex_unit::exclude_level.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-01T00:00:00.000Z
CVE-2022-32091 
MariaDB v10.7 was discovered to contain an use-after-poison in in __interceptor_memset at /libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-01T00:00:00.000Z
CVE-2022-32092 
D-Link DIR-645 v1.03 was discovered to contain a command injection vulnerability via the QUERY_STRING parameter at __ajax_explorer.sgi.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-27T21:37:27.000Z
CVE-2022-32093 
Hospital Management System v1.0 was discovered to contain a SQL injection vulnerability via the loginid parameter at adminlogin.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-01T20:57:44.000Z
CVE-2022-32094 
Hospital Management System v1.0 was discovered to contain a SQL injection vulnerability via the loginid parameter at doctorlogin.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-01T20:57:47.000Z
CVE-2022-32095 
Hospital Management System v1.0 was discovered to contain a SQL injection vulnerability via the editid parameter at orders.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-01T20:57:49.000Z
CVE-2022-32096 
Rhonabwy before v1.1.5 was discovered to contain a buffer overflow via the component r_jwe_aesgcm_key_unwrap. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted JWE token.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-13T15:42:14.000Z
CVE-2022-32101 
kkcms v1.3.7 was discovered to contain a SQL injection vulnerability via the cid parameter at /template/wapian/vlist.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-15T16:21:05.000Z
CVE-2022-32114 
An unrestricted file upload vulnerability in the Add New Assets function of Strapi 4.1.12 allows attackers to conduct XSS attacks via a crafted PDF file. NOTE: the project documentation suggests that a user with the Media Library "Create (upload)" permission is supposed to be able to upload PDF files containing JavaScript, and that all files in a public assets folder are accessible to the outside world (unless the filename begins with a dot character). The administrator can choose to allow only image, video, and audio files (i.e., not PDF) if desired.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-13T00:00:00.000Z
CVE-2022-32115 
An issue in the isSVG() function of Known v1.2.2+2020061101 allows attackers to execute arbitrary code via a crafted SVG file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-08T11:10:39.000Z
CVE-2022-32117 
Jerryscript v2.4.0 was discovered to contain a stack buffer overflow via the function jerryx_print_unhandled_exception in /util/print.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-13T20:49:21.000Z
CVE-2022-32118 
Arox School ERP Pro v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the dispatchcategory parameter in backoffice.inc.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-15T11:13:25.000Z
CVE-2022-32119 
Arox School ERP Pro v1.0 was discovered to contain multiple arbitrary file upload vulnerabilities via the Add Photo function at photogalleries.inc.php and the import staff excel function at 1finance_master.inc.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-15T11:13:17.000Z
CVE-2022-32124 
74cmsSE v3.5.1 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the component /index/jobfairol/show/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-22T18:42:01.000Z
CVE-2022-32125 
74cmsSE v3.5.1 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the path /job.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-22T18:42:02.000Z
CVE-2022-32126 
74cmsSE v3.5.1 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the path /company.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-22T18:42:03.000Z
CVE-2022-32127 
74cmsSE v3.5.1 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the path /company/view_be_browsed/total.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-22T18:42:03.000Z
CVE-2022-32128 
74cmsSE v3.5.1 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the path /company/service/increment/add/im.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-22T18:42:05.000Z
CVE-2022-32129 
74cmsSE v3.5.1 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the path /company/account/safety/trade.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-22T18:42:06.000Z
CVE-2022-32130 
74cmsSE v3.5.1 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the path /company/down_resume/total/nature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-22T18:42:07.000Z
CVE-2022-32131 
74cmsSE v3.5.1 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the path /index/notice/show.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-22T18:42:08.000Z
CVE-2022-32136 Codesys runtime systems: Access of uninitialised pointer lead to denial of service.
In multiple CODESYS products, a low privileged remote attacker may craft a request that cause a read access to an uninitialized pointer, resulting in a denial-of-service. User interaction is not required.
Problem types: cwe_id: CWE-824
description: CWE-824 Access of Uninitialized Pointer
Affected products: vendor: CODESYS
product: Runtime Toolkit
vendor: CODESYS
product: PLCWinNT
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2022-06-24T07:46:18.799Z
CVE-2022-32137 CODESYS Runtime System prone to heap based buffer overflow
In multiple CODESYS products, a low privileged remote attacker may craft a request, which may cause a heap-based buffer overflow, resulting in a denial-of-service condition or memory overwrite. User interaction is not required.
Problem types: cwe_id: CWE-122
description: CWE-122 Heap-based Buffer Overflow
Affected products: vendor: CODESYS
product: Runtime Toolkit
vendor: CODESYS
product: PLCWinNT
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2022-06-24T07:46:20.466Z
CVE-2022-32138 CODESYS runtime system prone to denial of service due to Unexpected Sign Extension
In multiple CODESYS products, a remote attacker may craft a request which may cause an unexpected sign extension, resulting in a denial-of-service condition or memory overwrite.
Problem types: cwe_id: CWE-194
description: CWE-194: Unexpected Sign Extension
Affected products: vendor: CODESYS
product: Runtime Toolkit
vendor: CODESYS
product: PLCWinNT
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2022-06-24T07:46:21.898Z
CVE-2022-32139 CODESYS runtime system prone to denial of service due to out of bounds read
In multiple CODESYS products, a low privileged remote attacker may craft a request, which cause an out-of-bounds read, resulting in a denial-of-service condition. User Interaction is not required.
Problem types: cwe_id: CWE-125
description: CWE-125 Out-of-bounds Read
Affected products: vendor: CODESYS
product: Runtime Toolkit
vendor: CODESYS
product: PLCWinNT
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2022-06-24T07:46:23.482Z
CVE-2022-32140 CODESYS runtime system prone to denial of service due to buffer copy
Multiple CODESYS products are affected to a buffer overflow.A low privileged remote attacker may craft a request, which can cause a buffer copy without checking the size of the service, resulting in a denial-of-service condition. User Interaction is not required.
Problem types: cwe_id: CWE-120
description: CWE-120 Buffer Overflow
Affected products: vendor: CODESYS
product: Runtime Toolkit
vendor: CODESYS
product: PLCWinNT
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2022-06-24T07:46:25.218Z
CVE-2022-32141 CODESYS runtime system prone to denial of service due to buffer over read
Multiple CODESYS Products are prone to a buffer over read. A low privileged remote attacker may craft a request with an invalid offset, which can cause an internal buffer over-read, resulting in a denial-of-service condition. User interaction is not required.
Problem types: cwe_id: CWE-126
description: CWE-126 Buffer Over-read
Affected products: vendor: CODESYS
product: Runtime Toolkit
vendor: CODESYS
product: PLCWinNT
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2022-06-24T07:46:26.865Z
CVE-2022-32142 CODESYS runtime system prone to denial of service due to use of out of range pointer
Multiple CODESYS Products are prone to a out-of bounds read or write access. A low privileged remote attacker may craft a request with invalid offset, which can cause an out-of-bounds read or write access, resulting in denial-of-service condition or local memory overwrite, which can lead to a change of local files. User interaction is not required.
Problem types: cwe_id: CWE-823
description: CWE-823 Use of Out-of-range Pointer Offset
Affected products: vendor: CODESYS
product: Runtime Toolkit
vendor: CODESYS
product: PLCWinNT
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
version: 3.1
Published: 2022-06-24T07:46:28.408Z