rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-3156 Rockwell Automation Studio 5000 Logix Emulate Vulnerable to a Remote Code Execution Vulnerability
A remote code execution vulnerability exists in Rockwell Automation Studio 5000 Logix Emulate software.  Users are granted elevated permissions on certain product services when the software is installed. Due to 
this misconfiguration, a malicious user could potentially achieve remote code execution on the targeted software.

 



Problem types: cwe_id: CWE-287
description: CWE-287 Improper Authentication
Affected products: vendor: Rockwell Automation
product: Studio 5000 Logix Emulate
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2022-12-27T18:17:50.219Z
CVE-2022-3157 Rockwell Automation GuardLogix and ControlLogix controllers Vulnerable to Denial-Of-Service Attack

A vulnerability exists in the Rockwell Automation controllers that allows a malformed CIP request to cause a major non-recoverable fault (MNRF) and a denial-of-service condition (DOS). 


Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Rockwell Automation
product: CompactLogix 5370
default_status: unaffected
vendor: Rockwell Automation
product: Compact GuardLogix
default_status: unaffected
vendor: Rockwell Automation
product: ControlLogix 5570
default_status: unaffected
vendor: Rockwell Automation
product: ControlLogix 5570 Redundancy
default_status: unaffected
vendor: Rockwell Automation
product: GuardLogix 5570
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.6
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
version: 3.1
Published: 2022-12-16T20:35:55.689Z
CVE-2022-3158 
Rockwell Automation FactoryTalk VantagePoint versions 8.0, 8.10, 8.20, 8.30, 8.31 are vulnerable to an input validation vulnerability. The FactoryTalk VantagePoint SQL Server lacks input validation when users enter SQL statements to retrieve information from the back-end database. If successfully exploited, this could allow a user with basic user privileges to perform remote code execution on the server.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: n/a
product: FactoryTalk VantagePoint
Published: 2022-10-17T00:00:00.000Z
CVE-2022-3159 
The APDFL.dll contains a stack-based buffer overflow vulnerability that 
could be triggered while parsing specially crafted PDF files. This could
 allow an attacker to execute code in the context of the current 
process.


Problem types: cwe_id: CWE-121
description: CWE-121 
Affected products: vendor: Siemens 
product: JT2Go
default_status: unaffected
vendor: Siemens 
product: Teamcenter Visualization V13.3
default_status: unaffected
vendor: Siemens 
product: Teamcenter Visualization V14.0
default_status: unaffected
vendor: Siemens 
product: Teamcenter Visualization V14.1
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Michael Heinz and Nafiez reported these vulnerabilities to Siemens. 
Published: 2023-01-13T00:15:15.775Z
CVE-2022-3160 

The APDFL.dll contains an out-of-bounds write past the fixed-length 
heap-based buffer while parsing specially crafted PDF files. This could 
allow an attacker to execute code in the context of the current process.




Problem types: cwe_id: CWE-122
description: CWE-122
Affected products: vendor: Siemens 
product: JT2Go
default_status: unaffected
vendor: Siemens 
product: Teamcenter Visualization V13.3
default_status: unaffected
vendor: Siemens 
product: Teamcenter Visualization V14.0
default_status: unaffected
vendor: Siemens 
product: Teamcenter Visualization V14.1
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Michael Heinz and Nafiez reported these vulnerabilities to Siemens. 
Published: 2023-01-13T00:16:30.069Z
CVE-2022-3161 


The APDFL.dll contains a memory corruption vulnerability while parsing 
specially crafted PDF files. This could allow an attacker to execute 
code in the context of the current process.






Problem types: cwe_id: CWE-119
description: CWE-119
Affected products: vendor: Siemens 
product: JT2Go
default_status: unaffected
vendor: Siemens 
product: Teamcenter Visualization V13.3
default_status: unaffected
vendor: Siemens 
product: Teamcenter Visualization V14.0
default_status: unaffected
vendor: Siemens 
product: Teamcenter Visualization V14.1
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Michael Heinz and Nafiez reported these vulnerabilities to Siemens. 
Published: 2023-01-13T00:17:06.310Z
CVE-2022-3162 Unauthorized read of Custom Resources
Users authorized to list or watch one type of namespaced custom resource cluster-wide can read custom resources of a different type in the same API group without authorization. Clusters are impacted by this vulnerability if all of the following are true: 1. There are 2+ CustomResourceDefinitions sharing the same API group 2. Users have cluster-wide list or watch authorization on one of those custom resources. 3. The same users are not authorized to read another custom resource in the same API group.
Problem types: cwe_id: CWE-23
description: CWE-23 Relative Path Traversal
Affected products: vendor: Kubernetes
product: Kubernetes
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
Credits: lang: en
value: Richard Turnbull of NCC Group
Published: 2023-03-01T00:00:00.000Z
CVE-2022-3165 
An integer underflow issue was found in the QEMU VNC server while processing ClientCutText messages in the extended format. A malicious client could use this flaw to make QEMU unresponsive by sending a specially crafted payload message, resulting in a denial of service.
Problem types: cwe_id: CWE-191
description: CWE-191
Affected products: vendor: n/a
product: QEMU
Published: 2022-10-17T00:00:00.000Z
CVE-2022-3166 MicroLogix 1100 & 1400 Product Web Server Application Vulnerable to Denial-Of-Service Condition Attack

Rockwell Automation was made aware that the webservers of the Micrologix 1100 and 1400 controllers contain a vulnerability that may lead to a denial-of-service condition. The security vulnerability could be exploited by an attacker with network access to the affected systems by sending TCP packets to webserver and closing it abruptly which would cause a denial-of-service condition for the web server application on the device


Problem types: cwe_id: CWE-924
description: CWE-924 Improper Enforcement of Message Integrity During Transmission in a Communication Channel
Affected products: vendor: Rockwell Automation
product: MicroLogix 1100
default_status: unaffected
vendor: Rockwell Automation
product: MicroLogix 1400-B/C
default_status: unaffected
vendor: Rockwell Automation
product: MicroLogix 1400-A
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: Parul Sindhwad and Dr. Faruk Kazi of CoE-CNDS Lab, VJTI, Mumbai, India reported this vulnerability to Rockwell Automation
Published: 2022-12-16T19:59:25.261Z
CVE-2022-3167 Improper Restriction of Rendered UI Layers or Frames in ikus060/rdiffweb
Improper Restriction of Rendered UI Layers or Frames in GitHub repository ikus060/rdiffweb prior to 2.4.1.
Problem types: cwe_id: CWE-1021
description: CWE-1021 Improper Restriction of Rendered UI Layers or Frames
Affected products: vendor: ikus060
product: ikus060/rdiffweb
Published: 2022-09-08T18:35:09.000Z
CVE-2022-3169 
A flaw was found in the Linux kernel. A denial of service flaw may occur if there is a consecutive request of the NVME_IOCTL_RESET and the NVME_IOCTL_SUBSYS_RESET through the device file of the driver, resulting in a PCIe link disconnect.
Problem types: cwe_id: CWE-20
description: CWE-20
Affected products: vendor: n/a
product: Kernel
Published: 2022-09-09T00:00:00.000Z
CVE-2022-3170 
An out-of-bounds access issue was found in the Linux kernel sound subsystem. It could occur when the 'id->name' provided by the user did not end with '\0'. A privileged local user could pass a specially crafted name through ioctl() interface and crash the system or potentially escalate their privileges on the system.
Problem types: cwe_id: CWE-125
description: CWE-125
Affected products: vendor: n/a
product: kernel
Published: 2022-09-13T15:36:36.000Z
CVE-2022-3171 Memory handling vulnerability in ProtocolBuffers Java core and lite
A parsing issue with binary data in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses. We recommend updating to the versions mentioned above.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Google LLC
product: Protocolbuffers
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
attackVector: ADJACENT_NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: LOW
baseScore: 4.3
baseSeverity: MEDIUM
Published: 2022-10-12T00:00:00.000Z
CVE-2022-3172 Kubernetes - API server - Aggregated API server can cause clients to be redirected (SSRF)
A security issue was discovered in kube-apiserver that allows an 
aggregated API server to redirect client traffic to any URL.  This could
 lead to the client performing unexpected actions as well as forwarding 
the client's API server credentials to third parties.
Problem types: cwe_id: CWE-918
description: CWE-918 Server-Side Request Forgery (SSRF)
Affected products: vendor: Kubernetes
product: kube-apiserver
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.1
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Nicolas Joly
lang: en
value: Weinong Wang
Published: 2023-11-03T18:11:53.835Z
CVE-2022-3173 Improper Authentication in snipe/snipe-it
Improper Authentication in GitHub repository snipe/snipe-it prior to 6.0.10.
Problem types: cwe_id: CWE-287
description: CWE-287 Improper Authentication
Affected products: vendor: snipe
product: snipe/snipe-it
Published: 2022-09-17T06:50:08.000Z
CVE-2022-3174 Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in ikus060/rdiffweb
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository ikus060/rdiffweb prior to 2.4.2.
Problem types: cwe_id: CWE-614
description: CWE-614 Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
Affected products: vendor: ikus060
product: ikus060/rdiffweb
Published: 2022-09-13T09:20:16.000Z
CVE-2022-3175 Missing Custom Error Page in ikus060/rdiffweb
Missing Custom Error Page in GitHub repository ikus060/rdiffweb prior to 2.4.2.
Problem types: cwe_id: CWE-756
description: CWE-756 Missing Custom Error Page
Affected products: vendor: ikus060
product: ikus060/rdiffweb
Published: 2022-09-13T09:20:10.000Z
CVE-2022-3176 Use-after-free in io_uring in Linux Kernel
There exists a use-after-free in io_uring in the Linux kernel. Signalfd_poll() and binder_poll() use a waitqueue whose lifetime is the current task. It will send a POLLFREE notification to all waiters before the queue is freed. Unfortunately, the io_uring poll doesn't handle POLLFREE. This allows a use-after-free to occur if a signalfd or binder fd is polled with io_uring poll, and the waitqueue gets freed. We recommend upgrading past commit fc78b2fc21f10c4c9c4d5d659a685710ffa63659
Problem types: cwe_id: CWE-416
description: CWE-416 Use After Free
Affected products: vendor: Linux
product: Kernel
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
Credits: lang: en
value: Bing-Jhong Billy Jheng <billy@starlabs.sg>
Published: 2022-09-16T13:55:09.907Z
CVE-2022-3178 Buffer Over-read in gpac/gpac
Buffer Over-read in GitHub repository gpac/gpac prior to 2.1.0-DEV.
Problem types: cwe_id: CWE-126
description: CWE-126 Buffer Over-read
Affected products: vendor: gpac
product: gpac/gpac
Published: 2022-09-12T16:30:12.000Z
CVE-2022-3179 Weak Password Requirements in ikus060/rdiffweb
Weak Password Requirements in GitHub repository ikus060/rdiffweb prior to 2.4.2.
Problem types: cwe_id: CWE-521
description: CWE-521 Weak Password Requirements
Affected products: vendor: ikus060
product: ikus060/rdiffweb
Published: 2022-09-13T16:35:09.000Z
CVE-2022-3180 WPGateway <= 3.5 - Unauthenticated Privilege Escalation
The WPGateway Plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 3.5. This allows unauthenticated attackers to create arbitrary malicious administrator accounts.
Problem types: cwe_id: CWE-290
description: CWE-290 Authentication Bypass by Spoofing
Affected products: vendor: Jack Hopman
product: WPGateway
default_status: unaffected
Published: 2025-02-11T21:38:57.038Z
CVE-2022-3181 
An Improper Input Validation vulnerability exists in Trihedral VTScada version 12.0.38 and prior. A specifically malformed HTTP request could cause the affected VTScada to crash. Both local area network (LAN)-only and internet facing systems are affected. 


Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Trihedral
product: VTScada
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: Trihedral
Published: 2022-11-02T20:11:14.114Z
CVE-2022-3182 
Improper Access Control vulnerability in the Duo SMS two-factor of Devolutions Remote Desktop Manager 2022.2.14 and earlier allows attackers to bypass the application lock. This issue affects: Devolutions Remote Desktop Manager version 2022.2.14 and prior versions.
Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Control
Affected products: vendor: Devolutions
product: Remote Desktop Manager
Published: 2022-09-13T19:27:28.000Z
CVE-2022-3183 
Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 contain a vulnerability where a specific function does not sanitize the input provided by the user, which may expose the affected to an OS command injection vulnerability. 




Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: Dataprobe
product: iBoot-PDU FW
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Uri Katz
lang: en
value: Claroty Research
Published: 2022-12-21T22:24:46.297Z
CVE-2022-3184 
Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 contain a vulnerability where the device’s existing firmware allows unauthenticated users to access an old PHP page vulnerable to directory traversal, which may allow a user to write a file to the webroot directory.

 




Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Dataprobe
product: iBoot-PDU FW
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Uri Katz
lang: en
value: Claroty Research
Published: 2022-12-21T22:26:26.255Z
CVE-2022-3185 
Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 contain a vulnerability where the affected product exposes sensitive data concerning the device.


Problem types: cwe_id: CWE-200
description: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: Dataprobe
product: iBoot-PDU FW
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: Uri Katz
lang: en
value: Claroty Research
Published: 2022-12-21T22:28:05.014Z
CVE-2022-3186 
Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 contain a vulnerability where the affected product allows an attacker to access the device’s main management page from the cloud. This feature enables users to remotely connect devices, however, the current implementation permits users to access other device's information.


Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Control
Affected products: vendor: Dataprobe
product: iBoot-PDU FW
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 8.6
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Uri Katz
lang: en
value: Claroty Research
Published: 2022-12-21T22:28:58.579Z
CVE-2022-3187 
Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 contain a vulnerability where certain PHP pages only validate when a valid connection is established with the database. However, these PHP pages do not verify the validity of a user. Attackers could leverage this lack of verification to read the state of outlets. 




Problem types: cwe_id: CWE-285
description: CWE-285 Improper Authorization
Affected products: vendor: Dataprobe
product: iBoot-PDU FW
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: Uri Katz
lang: en
value: Claroty Research
Published: 2022-12-21T22:29:36.679Z
CVE-2022-3188 
Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 contain a vulnerability where unauthenticated users could open PHP index pages without authentication and download the history file from the device; the history file includes the latest actions completed by specific users.

 




Problem types: cwe_id: CWE-863
description: CWE-863 Incorrect Authorization
Affected products: vendor: Dataprobe
product: iBoot-PDU FW
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: Uri Katz
lang: en
value: Claroty Research
Published: 2022-12-21T22:30:19.937Z
CVE-2022-3189 
Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 contain a vulnerability where a specially crafted PHP script could use parameters from a HTTP request to create a URL capable of changing the host parameter. The changed host parameter in the HTTP could point to another host that will send a request to the host or IP specified in the changed host parameter.



 




Problem types: cwe_id: CWE-918
description: CWE-918 Server-Side Request Forgery (SSRF)
Affected products: vendor: Dataprobe
product: iBoot-PDU FW
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: Uri Katz
lang: en
value: Claroty Research
Published: 2022-12-21T22:30:58.192Z
CVE-2022-3190 
Infinite loop in the F5 Ethernet Trailer protocol dissector in Wireshark 3.6.0 to 3.6.7 and 3.4.0 to 3.4.15 allows denial of service via packet injection or crafted capture file
Problem types: description: Loop with unreachable exit condition ('infinite loop') in Wireshark
Affected products: vendor: SharkFest Foundation
product: Wireshark
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: LOW
baseScore: 6.3
baseSeverity: MEDIUM
Credits: lang: en
value: Jason Cohen
Published: 2022-09-13T00:00:00.000Z
CVE-2022-3191 Information Exposure Vulnerability in Hitachi Ops Center Analyzer
Insertion of Sensitive Information into Log File vulnerability in Hitachi Ops Center Analyzer on Linux (Virtual Strage Software Agent component) allows local users to gain sensitive information.
This issue affects Hitachi Ops Center Analyzer: from 10.8.1-00 before 10.9.0-00

Problem types: cwe_id: CWE-532
description: CWE-532 Insertion of Sensitive Information into Log File
Affected products: vendor: Hitachi
product: Hitachi Ops Center Analyzer
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 6.6
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
version: 3.1
Published: 2022-11-01T02:09:13.688Z