rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-46329 
Protection mechanism failure for some Intel(R) PROSet/Wireless WiFi software may allow a privileged user to potentially enable escalation of privilege via local access.
Problem types: description: escalation of privilege
cwe_id: CWE-693
description: Protection mechanism failure
Affected products: vendor: n/a
product: Intel(R) PROSet/Wireless WiFi software
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 8.2
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
Published: 2023-08-11T02:36:53.416Z
CVE-2022-46330 
Squirrel.Windows is both a toolset and a library that provides installation and update functionality for Windows desktop applications. Installers generated by Squirrel.Windows 2.0.1 and earlier contain an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries. As a result, arbitrary code may be executed with the privilege of the user invoking the installer.
Problem types: description: Uncontrolled Search Path Element
Affected products: vendor: Squirrel
product: Installers generated by Squirrel.Windows
Published: 2022-12-21T00:00:00.000Z
CVE-2022-46331 



An unauthorized user could possibly delete any file on the system. 

 

 

 


Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Control
Affected products: vendor: GE Digital 
product: Proficy Historian
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
version: 3.1
Credits: lang: en
value: Uri Katz of Claroty Research reported these vulnerabilities to GE. 
Published: 2023-01-17T23:49:42.351Z
CVE-2022-46332 Proofpoint Enterprise Protection (PPS/PoD) XSS in "Attachment Names"
The Admin Smart Search feature in Proofpoint Enterprise Protection (PPS/PoD) contains a stored cross-site scripting vulnerability that enables an anonymous email sender to gain admin privileges within the user interface.  This affects all versions 8.19.0 and below.


Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: proofpoint
product: enterprise_protection
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.6
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: ly1g3
Published: 2022-12-06T19:52:02.111Z
CVE-2022-46333 Proofpoint Enterprise Protection perl eval() arbitrary command execution
The admin user interface in Proofpoint Enterprise Protection (PPS/PoD) contains a command injection vulnerability that enables an admin to execute commands beyond their allowed scope.  This affects all versions 8.19.0 and below.


Problem types: cwe_id: CWE-94
description: CWE-94 Improper Control of Generation of Code ('Code Injection')
Affected products: vendor: proofpoint
product: enterprise_protection
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: ly1g3
Published: 2022-12-06T19:52:36.587Z
CVE-2022-46334 Proofpoint Enterprise Protection Local Privilege Escalation
Proofpoint Enterprise Protection (PPS/PoD) contains a vulnerability which allows the pps user to escalate to root privileges due to unnecessary permissions. This affects all versions 8.19.0 and below.


Problem types: cwe_id: CWE-269
description: CWE-269 Improper Privilege Management
Affected products: vendor: Proofpoint
product: enterprise_protection
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: ly1g3
Published: 2022-12-21T20:05:38.584Z
CVE-2022-46337 Apache Derby: LDAP injection vulnerability in authenticator
A cleverly devised username might bypass LDAP authentication checks. In 
LDAP-authenticated Derby installations, this could let an attacker fill 
up the disk by creating junk Derby databases. In LDAP-authenticated 
Derby installations, this could also allow the attacker to execute 
malware which was visible to and executable by the account which booted 
the Derby server. In LDAP-protected databases which weren't also 
protected by SQL GRANT/REVOKE authorization, this vulnerability could 
also let an attacker view and corrupt sensitive data and run sensitive 
database functions and procedures.

Mitigation:

Users should upgrade to Java 21 and Derby 10.17.1.0.

Alternatively, users who wish to remain on older Java versions should 
build their own Derby distribution from one of the release families to 
which the fix was backported: 10.16, 10.15, and 10.14. Those are the 
releases which correspond, respectively, with Java LTS versions 17, 11, 
and 8.


Problem types: description: LDAP Injection
Affected products: vendor: Apache Software Foundation
product: Apache Derby
default_status: unaffected
Credits: lang: en
value: This issue was discovered by ﻿4ra1n and Y4tacker, who also proposed the fix.
Published: 2023-11-20T08:49:38.619Z
CVE-2022-46338 
g810-led 0.4.2, a LED configuration tool for Logitech Gx10 keyboards, contained a udev rule to make supported device nodes world-readable and writable, allowing any process on the system to read traffic from keyboards, including sensitive data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-30T00:00:00.000Z
CVE-2022-46340 
A vulnerability was found in X.Org. This security flaw occurs becuase the swap handler for the XTestFakeInput request of the XTest extension may corrupt the stack if GenericEvents with lengths larger than 32 bytes are sent through a the XTestFakeInput request. This issue can lead to local privileges elevation on systems where the X server is running privileged and remote code execution for ssh X forwarding sessions. This issue does not affect systems where client and server use the same byte order.
Problem types: description: stack overflow
Affected products: vendor: n/a
product: xorg-x11-server
Published: 2022-12-14T00:00:00.000Z
CVE-2022-46341 
A vulnerability was found in X.Org. This security flaw occurs because the handler for the XIPassiveUngrab request accesses out-of-bounds memory when invoked with a high keycode or button code. This issue can lead to local privileges elevation on systems where the X server is running privileged and remote code execution for ssh X forwarding sessions.
Problem types: description: out-of-bounds access
Affected products: vendor: n/a
product: xorg-x11-server
Published: 2022-12-14T00:00:00.000Z
CVE-2022-46342 
A vulnerability was found in X.Org. This security flaw occurs because the handler for the XvdiSelectVideoNotify request may write to memory after it has been freed. This issue can lead to local privileges elevation on systems where the X se
Problem types: description: use-after-free
Affected products: vendor: n/a
product: xorg-x11-server
Published: 2022-12-14T00:00:00.000Z
CVE-2022-46343 
A vulnerability was found in X.Org. This security flaw occurs because the handler for the ScreenSaverSetAttributes request may write to memory after it has been freed. This issue can lead to local privileges elevation on systems where the X server is running privileged and remote code execution for ssh X forwarding sessions.
Problem types: description: use-after-free
Affected products: vendor: n/a
product: xorg-x11-server
Published: 2022-12-14T00:00:00.000Z
CVE-2022-46344 
A vulnerability was found in X.Org. This security flaw occurs because the handler for the XIChangeProperty request has a length-validation issues, resulting in out-of-bounds memory reads and potential information disclosure. This issue can lead to local privileges elevation on systems where the X server is running privileged and remote code execution for ssh X forwarding sessions.
Problem types: description: out-of-bounds access
Affected products: vendor: n/a
product: xorg-x11-server
Published: 2022-12-14T00:00:00.000Z
CVE-2022-46345 
A vulnerability has been identified in Parasolid V33.1 (All versions < V33.1.264), Parasolid V34.0 (All versions < V34.0.252), Parasolid V34.1 (All versions < V34.1.242), Parasolid V35.0 (All versions < V35.0.170), Solid Edge SE2022 (All versions < V222.0MP12), Solid Edge SE2022 (All versions), Solid Edge SE2023 (All versions < V223.0Update2). The affected applications contain an out of bounds write past the end of an allocated structure while parsing specially crafted X_B files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-19070)
Problem types: cwe_id: CWE-787
description: CWE-787: Out-of-bounds Write
Affected products: vendor: Siemens
product: Parasolid V33.1
default_status: unknown
vendor: Siemens
product: Parasolid V34.0
default_status: unknown
vendor: Siemens
product: Parasolid V34.1
default_status: unknown
vendor: Siemens
product: Parasolid V35.0
default_status: unknown
vendor: Siemens
product: Solid Edge SE2022
default_status: unknown
vendor: Siemens
product: Solid Edge SE2022
default_status: unknown
vendor: Siemens
product: Solid Edge SE2023
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
baseScore: 7.8
baseSeverity: HIGH
Published: 2022-12-13T00:00:00.000Z
CVE-2022-46346 
A vulnerability has been identified in Parasolid V33.1 (All versions < V33.1.264), Parasolid V34.0 (All versions < V34.0.252), Parasolid V34.1 (All versions < V34.1.242), Parasolid V35.0 (All versions < V35.0.170), Solid Edge SE2022 (All versions < V222.0MP12), Solid Edge SE2022 (All versions), Solid Edge SE2023 (All versions < V223.0Update2). The affected applications contain an out of bounds write past the end of an allocated structure while parsing specially crafted X_B files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-19071)
Problem types: cwe_id: CWE-787
description: CWE-787: Out-of-bounds Write
Affected products: vendor: Siemens
product: Parasolid V33.1
default_status: unknown
vendor: Siemens
product: Parasolid V34.0
default_status: unknown
vendor: Siemens
product: Parasolid V34.1
default_status: unknown
vendor: Siemens
product: Parasolid V35.0
default_status: unknown
vendor: Siemens
product: Solid Edge SE2022
default_status: unknown
vendor: Siemens
product: Solid Edge SE2022
default_status: unknown
vendor: Siemens
product: Solid Edge SE2023
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
baseScore: 7.8
baseSeverity: HIGH
Published: 2022-12-13T00:00:00.000Z
CVE-2022-46347 
A vulnerability has been identified in Parasolid V33.1 (All versions < V33.1.264), Parasolid V34.0 (All versions < V34.0.252), Parasolid V34.1 (All versions < V34.1.242), Parasolid V35.0 (All versions < V35.0.170), Solid Edge SE2022 (All versions < V222.0MP12), Solid Edge SE2022 (All versions), Solid Edge SE2023 (All versions < V223.0Update2). The affected applications contain an out of bounds write past the end of an allocated structure while parsing specially crafted X_B files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-19079)
Problem types: cwe_id: CWE-787
description: CWE-787: Out-of-bounds Write
Affected products: vendor: Siemens
product: Parasolid V33.1
default_status: unknown
vendor: Siemens
product: Parasolid V34.0
default_status: unknown
vendor: Siemens
product: Parasolid V34.1
default_status: unknown
vendor: Siemens
product: Parasolid V35.0
default_status: unknown
vendor: Siemens
product: Solid Edge SE2022
default_status: unknown
vendor: Siemens
product: Solid Edge SE2022
default_status: unknown
vendor: Siemens
product: Solid Edge SE2023
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
baseScore: 7.8
baseSeverity: HIGH
Published: 2022-12-13T00:00:00.000Z
CVE-2022-46348 
A vulnerability has been identified in Parasolid V33.1 (All versions < V33.1.264), Parasolid V34.0 (All versions < V34.0.252), Parasolid V34.1 (All versions < V34.1.242), Parasolid V35.0 (All versions < V35.0.170), Solid Edge SE2022 (All versions < V222.0MP12), Solid Edge SE2022 (All versions), Solid Edge SE2023 (All versions < V223.0Update2). The affected applications contain an out of bounds write past the end of an allocated structure while parsing specially crafted X_B files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-19383)
Problem types: cwe_id: CWE-787
description: CWE-787: Out-of-bounds Write
Affected products: vendor: Siemens
product: Parasolid V33.1
default_status: unknown
vendor: Siemens
product: Parasolid V34.0
default_status: unknown
vendor: Siemens
product: Parasolid V34.1
default_status: unknown
vendor: Siemens
product: Parasolid V35.0
default_status: unknown
vendor: Siemens
product: Solid Edge SE2022
default_status: unknown
vendor: Siemens
product: Solid Edge SE2022
default_status: unknown
vendor: Siemens
product: Solid Edge SE2023
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
baseScore: 7.8
baseSeverity: HIGH
Published: 2022-12-13T00:00:00.000Z
CVE-2022-46349 
A vulnerability has been identified in Parasolid V33.1 (All versions < V33.1.264), Parasolid V34.0 (All versions < V34.0.252), Parasolid V34.1 (All versions < V34.1.242), Parasolid V35.0 (All versions < V35.0.170), Solid Edge SE2022 (All versions < V222.0MP12), Solid Edge SE2022 (All versions), Solid Edge SE2023 (All versions < V223.0Update2). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted X_B files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-19384)
Problem types: cwe_id: CWE-125
description: CWE-125: Out-of-bounds Read
Affected products: vendor: Siemens
product: Parasolid V33.1
default_status: unknown
vendor: Siemens
product: Parasolid V34.0
default_status: unknown
vendor: Siemens
product: Parasolid V34.1
default_status: unknown
vendor: Siemens
product: Parasolid V35.0
default_status: unknown
vendor: Siemens
product: Solid Edge SE2022
default_status: unknown
vendor: Siemens
product: Solid Edge SE2022
default_status: unknown
vendor: Siemens
product: Solid Edge SE2023
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
baseScore: 7.8
baseSeverity: HIGH
Published: 2022-12-13T00:00:00.000Z
CVE-2022-46350 
A vulnerability has been identified in SCALANCE X204RNA (HSR) (All versions < V3.2.7), SCALANCE X204RNA (PRP) (All versions < V3.2.7), SCALANCE X204RNA EEC (HSR) (All versions < V3.2.7), SCALANCE X204RNA EEC (PRP) (All versions < V3.2.7), SCALANCE X204RNA EEC (PRP/HSR) (All versions < V3.2.7). The integrated web server could allow Cross-Site Scripting (XSS) attacks if unsuspecting users are tricked into accessing a malicious link. This can be used by an attacker to trigger a malicious request on the affected device.
Problem types: cwe_id: CWE-80
description: CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Affected products: vendor: Siemens
product: SCALANCE X204RNA (HSR)
vendor: Siemens
product: SCALANCE X204RNA (PRP)
vendor: Siemens
product: SCALANCE X204RNA EEC (HSR)
vendor: Siemens
product: SCALANCE X204RNA EEC (PRP)
vendor: Siemens
product: SCALANCE X204RNA EEC (PRP/HSR)
Published: 2022-12-13T00:00:00.000Z
CVE-2022-46351 
A vulnerability has been identified in SCALANCE X204RNA (HSR) (All versions < V3.2.7), SCALANCE X204RNA (PRP) (All versions < V3.2.7), SCALANCE X204RNA EEC (HSR) (All versions < V3.2.7), SCALANCE X204RNA EEC (PRP) (All versions < V3.2.7), SCALANCE X204RNA EEC (PRP/HSR) (All versions < V3.2.7). Specially crafted PROFINET DCP packets could cause a denial of service condition of affected products on a local Ethernet segment (Layer 2).
Problem types: cwe_id: CWE-400
description: CWE-400: Uncontrolled Resource Consumption
Affected products: vendor: Siemens
product: SCALANCE X204RNA (HSR)
vendor: Siemens
product: SCALANCE X204RNA (PRP)
vendor: Siemens
product: SCALANCE X204RNA EEC (HSR)
vendor: Siemens
product: SCALANCE X204RNA EEC (PRP)
vendor: Siemens
product: SCALANCE X204RNA EEC (PRP/HSR)
Published: 2022-12-13T00:00:00.000Z
CVE-2022-46352 
A vulnerability has been identified in SCALANCE X204RNA (HSR) (All versions < V3.2.7), SCALANCE X204RNA (PRP) (All versions < V3.2.7), SCALANCE X204RNA EEC (HSR) (All versions < V3.2.7), SCALANCE X204RNA EEC (PRP) (All versions < V3.2.7), SCALANCE X204RNA EEC (PRP/HSR) (All versions < V3.2.7). Specially crafted PROFINET DCP packets could cause a denial of service condition of affected products.
Problem types: cwe_id: CWE-400
description: CWE-400: Uncontrolled Resource Consumption
Affected products: vendor: Siemens
product: SCALANCE X204RNA (HSR)
vendor: Siemens
product: SCALANCE X204RNA (PRP)
vendor: Siemens
product: SCALANCE X204RNA EEC (HSR)
vendor: Siemens
product: SCALANCE X204RNA EEC (PRP)
vendor: Siemens
product: SCALANCE X204RNA EEC (PRP/HSR)
Published: 2022-12-13T00:00:00.000Z
CVE-2022-46353 
A vulnerability has been identified in SCALANCE X204RNA (HSR) (All versions < V3.2.7), SCALANCE X204RNA (PRP) (All versions < V3.2.7), SCALANCE X204RNA EEC (HSR) (All versions < V3.2.7), SCALANCE X204RNA EEC (PRP) (All versions < V3.2.7), SCALANCE X204RNA EEC (PRP/HSR) (All versions < V3.2.7). The webserver of affected devices calculates session ids and nonces in an insecure manner. This could allow an unauthenticated remote attacker to brute-force session ids and hijack existing sessions.
Problem types: cwe_id: CWE-330
description: CWE-330: Use of Insufficiently Random Values
Affected products: vendor: Siemens
product: SCALANCE X204RNA (HSR)
vendor: Siemens
product: SCALANCE X204RNA (PRP)
vendor: Siemens
product: SCALANCE X204RNA EEC (HSR)
vendor: Siemens
product: SCALANCE X204RNA EEC (PRP)
vendor: Siemens
product: SCALANCE X204RNA EEC (PRP/HSR)
Published: 2022-12-13T00:00:00.000Z
CVE-2022-46354 
A vulnerability has been identified in SCALANCE X204RNA (HSR) (All versions < V3.2.7), SCALANCE X204RNA (PRP) (All versions < V3.2.7), SCALANCE X204RNA EEC (HSR) (All versions < V3.2.7), SCALANCE X204RNA EEC (PRP) (All versions < V3.2.7), SCALANCE X204RNA EEC (PRP/HSR) (All versions < V3.2.7). The webserver of an affected device is missing specific security headers. This could allow an remote attacker to extract confidential session information under certain circumstances.
Problem types: cwe_id: CWE-284
description: CWE-284: Improper Access Control
Affected products: vendor: Siemens
product: SCALANCE X204RNA (HSR)
vendor: Siemens
product: SCALANCE X204RNA (PRP)
vendor: Siemens
product: SCALANCE X204RNA EEC (HSR)
vendor: Siemens
product: SCALANCE X204RNA EEC (PRP)
vendor: Siemens
product: SCALANCE X204RNA EEC (PRP/HSR)
Published: 2022-12-13T00:00:00.000Z
CVE-2022-46355 
A vulnerability has been identified in SCALANCE X204RNA (HSR) (All versions < V3.2.7), SCALANCE X204RNA (PRP) (All versions < V3.2.7), SCALANCE X204RNA EEC (HSR) (All versions < V3.2.7), SCALANCE X204RNA EEC (PRP) (All versions < V3.2.7), SCALANCE X204RNA EEC (PRP/HSR) (All versions < V3.2.7). The affected products are vulnerable to an "Exposure of Sensitive Information to an Unauthorized Actor" vulnerability by leaking sensitive data in the HTTP Referer.
Problem types: cwe_id: CWE-200
description: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: Siemens
product: SCALANCE X204RNA (HSR)
vendor: Siemens
product: SCALANCE X204RNA (PRP)
vendor: Siemens
product: SCALANCE X204RNA EEC (HSR)
vendor: Siemens
product: SCALANCE X204RNA EEC (PRP)
vendor: Siemens
product: SCALANCE X204RNA EEC (PRP/HSR)
Published: 2022-12-13T00:00:00.000Z
CVE-2022-46356 
Potential vulnerabilities have been identified in HP Security Manager which may allow escalation of privilege, arbitrary code execution, and information disclosure.
Problem types: description: n/a
Affected products: vendor: HP Inc.
product: HP Security Manager
Published: 2023-01-27T23:22:47.741Z
CVE-2022-46357 
Potential vulnerabilities have been identified in HP Security Manager which may allow escalation of privilege, arbitrary code execution, and information disclosure.
Problem types: description: n/a
Affected products: vendor: HP Inc.
product: HP Security Manager
Published: 2023-01-27T23:22:09.622Z
CVE-2022-46358 
Potential vulnerabilities have been identified in HP Security Manager which may allow escalation of privilege, arbitrary code execution, and information disclosure.
Problem types: description: n/a
Affected products: vendor: HP Inc.
product: HP Security Manager
Published: 2023-01-27T23:21:04.607Z
CVE-2022-46359 
Potential vulnerabilities have been identified in HP Security Manager which may allow escalation of privilege, arbitrary code execution, and information disclosure.
Problem types: description: n/a
Affected products: vendor: HP Inc.
product: HP Security Manager 
Published: 2023-01-27T23:20:16.899Z
CVE-2022-46360 
Out-of-bounds read vulnerability in V-SFT v6.1.7.0 and earlier and TELLUS v4.0.12.0 and earlier allows a local attacker to obtain the information and/or execute arbitrary code by having a user to open a specially crafted image file.
Problem types: description: Out-of-bounds Read
Affected products: vendor: FUJI ELECTRIC CO., LTD. and Hakko Electronics Co., Ltd.
product: V-SFT and TELLUS
Published: 2023-01-03T00:00:00.000Z
CVE-2022-46361 Physical access to the WDM enables use of USB device to gain access to the WDM
An attacker having physical access to WDM can plug USB device to gain access and execute unwanted commands. A malicious user could enter a system command along with a backup configuration, which could result in the execution of unwanted commands. This issue affects OneWireless all versions up to 322.1 and fixed in version 322.2.
Problem types: cwe_id: CWE-77
description: CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
Affected products: vendor: Honeywell
product: OneWireless
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: PHYSICAL
availabilityImpact: HIGH
baseScore: 6.9
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:P/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Published: 2023-05-30T16:21:37.079Z
CVE-2022-46363 Apache CXF directory listing / code exfiltration
A vulnerability in Apache CXF before versions 3.5.5 and 3.4.10 allows an attacker to perform a remote directory listing or code exfiltration. The vulnerability only applies when the CXFServlet is configured with both the static-resources-list and redirect-query-check attributes. These attributes are not supposed to be used together, and so the vulnerability can only arise if the CXF service is misconfigured.


Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Apache Software Foundation
product: Apache CXF
default_status: unaffected
Credits: lang: en
value: thanat0s from Beijin Qihoo 360 adlab
Published: 2022-12-13T14:46:55.619Z