rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-28717 
Cross-site scripting vulnerability in Rebooter(WATCH BOOT nino RPC-M2C [End of Sale] all firmware versions, WATCH BOOT light RPC-M5C [End of Sale] all firmware versions, WATCH BOOT L-zero RPC-M4L [End of Sale] all firmware versions, WATCH BOOT mini RPC-M4H [End of Sale] all firmware versions, WATCH BOOT nino RPC-M2CS firmware version 1.00A to 1.00D, WATCH BOOT light RPC-M5CS firmware version 1.00A to 1.00D, WATCH BOOT L-zero RPC-M4LS firmware version 1.00A to 1.20A, and Signage Rebooter RPC-M4HSi firmware version 1.00A), PoE Rebooter(PoE BOOT nino PoE8M2 firmware version 1.00A to 1.20A), Scheduler(TIME BOOT mini RSC-MT4H [End of Sale] all firmware versions, TIME BOOT RSC-MT8F [End of Sale] all firmware versions, TIME BOOT RSC-MT8FP [End of Sale] all firmware versions, TIME BOOT mini RSC-MT4HS firmware version 1.00A to 1.10A, and TIME BOOT RSC-MT8FS firmware version 1.00A to 1.00E), and Contact Converter(POSE SE10-8A7B1 firmware version 1.00A to 1.20A) allows a remote attacker with the administrative privilege to inject an arbitrary script via unspecified vectors.
Problem types: description: Cross-site scripting
Affected products: vendor: MEIKYO ELECTRIC CO.,LTD.
product: Rebooter, PoE Rebooter, Scheduler, and Contact Converter
Published: 2022-05-18T09:50:23.000Z
CVE-2022-28718 
Operation restriction bypass vulnerability in Bulletin of Cybozu Garoon 4.0.0 to 5.5.1 allow a remote authenticated attacker to alter the data of Bulletin.
Problem types: description: Improper Authorization
Affected products: vendor: Cybozu, Inc.
product: Cybozu Garoon
Published: 2022-07-04T06:56:17.000Z
CVE-2022-28719 
Missing authentication for critical function in AssetView prior to Ver.13.2.0 allows a remote unauthenticated attacker with some knowledge on the system configuration to upload a crafted configuration file to the managing server, which may result in the managed clients to execute arbitrary code with the administrative privilege.
Problem types: description: Missing Authentication for Critical Function
Affected products: vendor: Hammock Corporation
product: AssetView
Published: 2022-04-28T08:25:12.000Z
CVE-2022-28721 
Certain HP Print Products are potentially vulnerable to Remote Code Execution.
Problem types: description: Remote Code Execution
Affected products: vendor: n/a
product: Certain HP inkjet printers, HP LaserJet Pro printers, HP PageWide Pro printers.
Published: 2022-09-26T14:54:08.000Z
CVE-2022-28722 
Certain HP Print Products are potentially vulnerable to Buffer Overflow.
Problem types: description: Buffer Overflow
Affected products: vendor: n/a
product: Certain HP inkjet printers, HP LaserJet Pro printers, HP PageWide Pro printers
Published: 2022-09-26T14:54:12.000Z
CVE-2022-28730 Apache JSPWiki Cross-site scripting vulnerability on AJAXPreview.jsp
A carefully crafted request on AJAXPreview.jsp could trigger an XSS vulnerability on Apache JSPWiki, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. This vulnerability leverages CVE-2021-40369, where the Denounce plugin dangerously renders user-supplied URLs. Upon re-testing CVE-2021-40369, it appears that the patch was incomplete as it was still possible to insert malicious input via the Denounce plugin. Apache JSPWiki users should upgrade to 2.11.3 or later.
Problem types: description: XSS
Affected products: vendor: Apache Software Foundation
product: Apache JSPWiki
Credits: lang: en
value: This issue was discovered by Poh Jia Hao, from Star Labs <info AT starlabs DOT sg>
Published: 2022-08-04T06:15:29.000Z
CVE-2022-28731 Apache JSPWiki CSRF in UserPreferences.jsp
A carefully crafted request on UserPreferences.jsp could trigger an CSRF vulnerability on Apache JSPWiki before 2.11.3, which could allow the attacker to modify the email associated with the attacked account, and then a reset password request from the login page.
Problem types: description: CSRF Account Takeover
Affected products: vendor: Apache Software Foundation
product: Apache JSPWiki
Credits: lang: en
value: This issue was discovered by Fabrice Perez, <fabioperez AT gmail DOT com>
Published: 2022-08-04T06:15:43.000Z
CVE-2022-28732 Apache JSPWiki Cross-site scripting vulnerability on WeblogPlugin
A carefully crafted request on WeblogPlugin could trigger an XSS vulnerability on Apache JSPWiki, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. Apache JSPWiki users should upgrade to 2.11.3 or later.
Problem types: description: XSS
Affected products: vendor: Apache Software Foundation
product: Apache JSPWiki
Credits: lang: en
value: This issue was discovered by Wang Ran, from JDArmy, @jd.com
Published: 2022-08-04T06:15:57.000Z
CVE-2022-28733 Integer underflow in grub_net_recv_ip4_packets
Integer underflow in grub_net_recv_ip4_packets; A malicious crafted IP packet can lead to an integer underflow in grub_net_recv_ip4_packets() function on rsm->total_len value. Under certain circumstances the total_len value may end up wrapping around to a small integer number which will be used in memory allocation. If the attack succeeds in such way, subsequent operations can write past the end of the buffer.
Problem types: cwe_id: CWE-191
description: CWE-191
Affected products: vendor: GNU Project
product: GNU GRUB
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
baseScore: 8.1
baseSeverity: HIGH
Credits: lang: en
value: Daniel Axtens
Published: 2023-07-20T00:20:02.458Z
CVE-2022-28734 Out-of-bounds write when handling split HTTP headers
Out-of-bounds write when handling split HTTP headers; When handling split HTTP headers, GRUB2 HTTP code accidentally moves its internal data buffer point by one position. This can lead to a out-of-bound write further when parsing the HTTP request, writing a NULL byte past the buffer. It's conceivable that an attacker controlled set of packets can lead to corruption of the GRUB2's internal memory metadata.
Affected products: vendor: GNU Project
product: GNU GRUB
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
baseScore: 8.1
baseSeverity: HIGH
Credits: lang: en
value: Daniel Axtens
Published: 2023-07-20T00:22:37.840Z
CVE-2022-28735 
The GRUB2's shim_lock verifier allows non-kernel files to be loaded on shim-powered secure boot systems. Allowing such files to be loaded may lead to unverified code and modules to be loaded in GRUB2 breaking the secure boot trust-chain.
Affected products: vendor: GNU Project
product: GNU GRUB
CVSS v3.1: version: 3.1
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
baseScore: 6.7
baseSeverity: MEDIUM
Credits: lang: en
value: Julian Andres Klode
Published: 2023-07-20T00:22:51.229Z
CVE-2022-28736 There's a use-after-free vulnerability in grub_cmd_chainloader() function
There's a use-after-free vulnerability in grub_cmd_chainloader() function; The chainloader command is used to boot up operating systems that doesn't support multiboot and do not have direct support from GRUB2. When executing chainloader more than once a use-after-free vulnerability is triggered. If an attacker can control the GRUB2's memory allocation pattern sensitive data may be exposed and arbitrary code execution can be achieved.
Affected products: vendor: GNU Project
product: GNU GRUB
CVSS v3.1: version: 3.1
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
vectorString: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
baseScore: 6.4
baseSeverity: MEDIUM
Credits: lang: en
value: Chris Coulson
Published: 2023-07-20T00:23:01.952Z
CVE-2022-28737 There's a possible overflow in handle_image() when shim tries to load and execute crafted EFI executables
There's a possible overflow in handle_image() when shim tries to load and execute crafted EFI executables; The handle_image() function takes into account the SizeOfRawData field from each section to be loaded. An attacker can leverage this to perform out-of-bound writes into memory. Arbitrary code execution is not discarded in such scenario.
Affected products: vendor: Red Hat Bootloader Team
product: shim
CVSS v3.1: version: 3.1
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
baseScore: 6.5
baseSeverity: MEDIUM
Credits: lang: en
value: Chris Coulson
Published: 2023-07-20T00:26:15.627Z
CVE-2022-28738 
A double free was found in the Regexp compiler in Ruby 3.x before 3.0.4 and 3.1.x before 3.1.2. If a victim attempts to create a Regexp from untrusted user input, an attacker may be able to write to unexpected memory locations.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-09T00:00:00.000Z
CVE-2022-28739 
There is a buffer over-read in Ruby before 2.6.10, 2.7.x before 2.7.6, 3.x before 3.0.4, and 3.1.x before 3.1.2. It occurs in String-to-Float conversion, including Kernel#Float and String#to_f.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-09T00:00:00.000Z
CVE-2022-28740 
aEnrich eHRD Learning Management Key Performance Indicator System 5+ exposes Sensitive Information to an Unauthorized Actor.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-09T15:59:02.000Z
CVE-2022-28741 
aEnrich a+HRD 5.x Learning Management Key Performance Indicator System has a local file inclusion (LFI) vulnerability that occurs due to missing input validation in v5.x
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-09T15:48:42.000Z
CVE-2022-28742 
aEnrich eHRD Learning Management Key Performance Indicator System 5+ has Improper Access Control. The web application does not validate user session when accessing many application pages. This can allow an attacker to gain unauthenticated access to sensitive functionalities in the application
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-09T15:54:37.000Z
CVE-2022-28743 
Time-of-check Time-of-use (TOCTOU) Race Condition vulerability in Foscam R2C IP camera running System FW <= 1.13.1.6, and Application FW <= 2.91.2.66, allows an authenticated remote attacker with administrator permissions to execute arbitrary remote code via a malicious firmware patch. The impact of this vulnerability is that the remote attacker could gain full remote access to the IP camera and the underlying Linux system with root permissions. With root access to the camera's Linux OS, an attacker could effectively change the code that is running, add backdoor access, or invade the privacy of the user by accessing the live camera stream.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.1
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Sam Quinn from Trellix ATR
Published: 2022-04-21T18:09:16.000Z
CVE-2022-28747 
Key reuse in GoSecure Titan Inbox Detection & Response (IDR) through 2022-04-05 leads to remote code execution. To exploit this vulnerability, an attacker must craft and sign a serialized payload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-25T22:38:12.000Z
CVE-2022-28749 Insufficient Authorization Check During Meeting Join
Zooms On-Premise Meeting Connector MMR before version 4.8.113.20220526 fails to properly check the permissions of a Zoom meeting attendee. As a result, a threat actor in the Zooms waiting room can join the meeting without the consent of the host.
Problem types: description: Improper Authorization
Affected products: vendor: Zoom Video Communications Inc
product: On-Premise Meeting Connectors
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Reported by Zoom Offensive Security Team
Published: 2022-06-15T20:12:51.705Z
CVE-2022-28750 Zoom On-Premise Deployments: Stack Buffer Overflow in Meeting Connector
Zoom On-Premise Meeting Connector Zone Controller (ZC) before version 4.8.20220419.112 fails to properly parse STUN error codes, which can result in memory corruption and could allow a malicious actor to crash the application. In versions older than 4.8.12.20211115, this vulnerability could also be leveraged to execute arbitrary code.
Problem types: cwe_id: CWE-121
description: CWE-121 Stack-based Buffer Overflow
Affected products: vendor: Zoom Video Communications Inc
product: Zoom On-Premise Meeting Connector Zone Controller (ZC)
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2022-08-11T14:55:21.145Z
CVE-2022-28751 Local Privilege Escalation in Zoom Client for Meetings for MacOS
The Zoom Client for Meetings for MacOS (Standard and for IT Admin) before version 5.11.3 contains a vulnerability in the package signature validation during the update process. A local low-privileged user could exploit this vulnerability to escalate their privileges to root.
Problem types: cwe_id: CWE-347
description: CWE-347 Improper Verification of Cryptographic Signature
Affected products: vendor: Zoom Video Communications Inc
product: Zoom Client for Meetings for MacOS
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Patrick Wardle of Objective-See
Published: 2022-08-17T21:06:25.616Z
CVE-2022-28752 Local Privilege Escalation in the Zoom Rooms for Windows Client
Zoom Rooms for Conference Rooms for Windows versions before 5.11.0 are susceptible to a Local Privilege Escalation vulnerability. A local low-privileged malicious user could exploit this vulnerability to escalate their privileges to the SYSTEM user.
Problem types: cwe_id: CWE-347
description: CWE-347 Improper Verification of Cryptographic Signature
Affected products: vendor: Zoom Video Communications Inc
product: Zoom Room for Conference Room for Windows
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: sim0nsecurity
Published: 2022-08-17T21:06:50.206Z
CVE-2022-28753 Zoom On-Premise Deployments: Improper Access Control Vulnerability
Zoom On-Premise Meeting Connector MMR before version 4.8.129.20220714 contains an improper access control vulnerability. As a result, a malicious actor can join a meeting which they are authorized to join without appearing to the other participants, can admit themselves into the meeting from the waiting room, and can become host and cause other meeting disruptions.
Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Control
Affected products: vendor: Zoom Video Communications Inc
product: Zoom On-Premise Meeting Connector MMR
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
version: 3.1
Published: 2022-08-11T14:55:35.585Z
CVE-2022-28754 Zoom On-Premise Deployments: Improper Access Control Vulnerability
Zoom On-Premise Meeting Connector MMR before version 4.8.129.20220714 contains an improper access control vulnerability. As a result, a malicious actor can join a meeting which they are authorized to join without appearing to the other participants, can admit themselves into the meeting from the waiting room, and can become host and cause other meeting disruptions.
Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Control
Affected products: vendor: Zoom Video Communications Inc
product: Zoom On-Premise Meeting Connector MMR
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
version: 3.1
Published: 2022-08-11T14:55:06.492Z
CVE-2022-28755 Improper URL parsing in Zoom Clients
The Zoom Client for Meetings (for Android, iOS, Linux, macOS, and Windows) before version 5.11.0 are susceptible to a URL parsing vulnerability. If a malicious Zoom meeting URL is opened, the malicious link may direct the user to connect to an arbitrary network address, leading to additional attacks including the potential for remote code execution through launching executables from arbitrary paths.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Zoom Video Communications Inc
product: Zoom Client for Meetings (for Android, iOS, Linux, macOS, and Windows)
vendor: Zoom Video Communications Inc
product: Zoom VDI Windows Meeting Clients
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.6
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
version: 3.1
Published: 2022-08-11T14:55:46.515Z
CVE-2022-28756 Local Privilege Escalation in Auto Updater for Zoom Client for Meetings for macOS
The Zoom Client for Meetings for macOS (Standard and for IT Admin) starting with version 5.7.3 and before 5.11.5 contains a vulnerability in the auto update process. A local low-privileged user could exploit this vulnerability to escalate their privileges to root.
Problem types: cwe_id: CWE-347
description: CWE-347 Improper Verification of Cryptographic Signature
Affected products: vendor: Zoom Video Communications Inc
product: Zoom Client for Meetings for MacOS
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Patrick Wardle of Objective-See
Published: 2022-08-15T22:11:03.586Z
CVE-2022-28757 Local Privilege Escalation in Auto Updater for Zoom Client for Meetings for macOS
The Zoom Client for Meetings for macOS (Standard and for IT Admin) starting with version 5.7.3 and before 5.11.6 contains a vulnerability in the auto update process. A local low-privileged user could exploit this vulnerability to escalate their privileges to root.
Problem types: cwe_id: CWE-345
description: CWE-345 Insufficient Verification of Data Authenticity
Affected products: vendor: Zoom Video Communications Inc
product: Zoom Client for Meetings for MacOS
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Csaba Fitzl (theevilbit) of Offensive Security
Published: 2022-08-18T19:31:32.731Z
CVE-2022-28758 Zoom On-Premise Deployments: Improper Access Control
Zoom On-Premise Meeting Connector MMR before version 4.8.20220815.130 contains an improper access control vulnerability. As a result, a malicious actor could obtain the audio and video feed of a meeting they were not authorized to join and cause other meeting disruptions.
Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Control
Affected products: vendor: Zoom Video Communications Inc
product: Zoom On-Premise Meeting Connector MMR
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 8.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
version: 3.1
Published: 2022-09-16T20:13:38.934Z
CVE-2022-28759 Zoom On-Premise Deployments: Improper Access Control
Zoom On-Premise Meeting Connector MMR before version 4.8.20220815.130 contains an improper access control vulnerability. As a result, a malicious actor could obtain the audio and video feed of a meeting they were not authorized to join and cause other meeting disruptions.
Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Control
Affected products: vendor: Zoom Video Communications Inc
product: Zoom On-Premise Meeting Connector MMR
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 8.2
baseSeverity: HIGH
Published: 2022-10-14T14:51:20.203Z
CVE-2022-28760 Zoom On-Premise Deployments: Improper Access Control
Zoom On-Premise Meeting Connector MMR before version 4.8.20220815.130 contains an improper access control vulnerability. As a result, a malicious actor could obtain the audio and video feed of a meeting they were not authorized to join and cause other meeting disruptions.
Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Control
Affected products: vendor: Zoom Video Communications Inc
product: Zoom On-Premise Meeting Connector MMR
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
Published: 2022-10-14T14:51:16.896Z
CVE-2022-28761 Zoom On-Premise Deployments: Improper Access Control
Zoom On-Premise Meeting Connector MMR before version 4.8.20220916.131 contains an improper access control vulnerability. As a result, a malicious actor in a meeting or webinar they are authorized to join could prevent participants from receiving audio and video causing meeting disruptions.
Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Control
Affected products: vendor: Zoom Video Communications Inc
product: Zoom On-Premise Meeting Connector MMR
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
Published: 2022-10-14T14:51:22.410Z