rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-45115 
A buffer overflow vulnerability exists in the Attribute Arena functionality of Ichitaro 2022 1.0.1.57600. A specially crafted document can lead to memory corruption. An attacker can provide a malicious file to trigger this vulnerability.
Problem types: cwe_id: CWE-122
description: CWE-122: Heap-based Buffer Overflow
Affected products: vendor: Ichitaro
product: Ichitaro
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
Credits: lang: en
value: Discovered by a member of Cisco Talos.
Published: 2023-04-05T15:18:03.347Z
CVE-2022-45118 Telephony in communication subsystem sends public events with personal data, but the permission is not set.
OpenHarmony-v3.1.2 and prior versions had a vulnerability that telephony in communication subsystem sends public events with personal data, but the permission is not set. Malicious apps could listen to public events and obtain information such as mobile numbers and SMS data without permissions.
Problem types: cwe_id: CWE-287
description: CWE-287 Improper Authentication
Affected products: vendor: OpenHarmony
product: OpenHarmony
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 6.2
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2022-12-08T00:00:00.000Z
CVE-2022-45121 CVE-2022-45121
Versions of VISAM VBASE Automation Base prior to 11.7.5 may disclose information if a valid user opens a specially crafted file.
Problem types: description: CWE-611
Affected products: vendor: VISAM
product: VBASE
Published: 2023-03-21T22:22:53.204Z
CVE-2022-45122 
Cross-site scripting vulnerability in Movable Type Movable Type 7 r.5301 and earlier (Movable Type 7 Series), Movable Type Advanced 7 r.5301 and earlier (Movable Type Advanced 7 Series), Movable Type 6.8.7 and earlier (Movable Type 6 Series), Movable Type Advanced 6.8.7 and earlier (Movable Type Advanced 6 Series), Movable Type Premium 1.53 and earlier, and Movable Type Premium Advanced 1.53 and earlier allows a remote unauthenticated attacker to inject an arbitrary script.
Problem types: description: Cross-site scripting
Affected products: vendor: Six Apart Ltd.
product: Movable Type
Published: 2022-12-07T00:00:00.000Z
CVE-2022-45124 
An information disclosure vulnerability exists in the User authentication functionality of WellinTech KingHistorian 35.01.00.05. A specially crafted network packet can lead to a disclosure of sensitive information. An attacker can sniff network traffic to leverage this vulnerability.
Problem types: cwe_id: CWE-200
description: CWE-200: Information Exposure
Affected products: vendor: WellinTech
product: KingHistorian
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
Published: 2023-03-20T20:16:01.634Z
CVE-2022-45126 Kernel subsystem in kernel_liteos_a has a kernel stack overflow vulnerability when call SysClockGettime.
Kernel subsystem within OpenHarmony-v3.1.4 and prior versions in kernel_liteos_a has a kernel stack overflow vulnerability when call SysClockGettime. 4 bytes padding data from kernel stack are copied to user space incorrectly and leaked.
Problem types: cwe_id: CWE-120
description: CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Affected products: vendor: OpenHarmony
product: OpenHarmony
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 4
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
version: 3.1
Published: 2023-01-09T02:22:23.465Z
CVE-2022-45127 CVE-2022-45127
Sewio’s Real-Time Location System (RTLS) Studio version 2.0.0 up to and including version 2.6.2 is vulnerable to cross-site request forgery in its backup services. An attacker could take advantage of this vulnerability to execute arbitrary backup operations and cause a denial-of-service condition.


Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Sewio
product: RTLS Studio
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
version: 3.1
Credits: lang: en
value: Andrea Palanca of Nozomi Networks
Published: 2023-01-18T00:39:40.324Z
CVE-2022-45128 
Improper authorization in the Intel(R) EMA software before version 1.9.0.0 may allow an authenticated user to potentially enable denial of service via local access.
Problem types: description: denial of service
cwe_id: CWE-285
description: Improper authorization
Affected products: vendor: n/a
product: Intel(R) EMA software
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 5
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
Published: 2023-05-10T13:17:21.859Z
CVE-2022-45129 
Payara before 2022-11-04, when deployed to the root context, allows attackers to visit META-INF and WEB-INF, a different vulnerability than CVE-2022-37422. This affects Payara Platform Community before 4.1.2.191.38, 5.x before 5.2022.4, and 6.x before 6.2022.1, and Payara Platform Enterprise before 5.45.0.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-10T00:00:00.000Z
CVE-2022-45130 
Plesk Obsidian allows a CSRF attack, e.g., via the /api/v2/cli/commands REST API to change an Admin password. NOTE: Obsidian is a specific version of the Plesk product: version numbers were used through version 12, and then the convention was changed so that versions are identified by names ("Obsidian"), not numbers.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-10T00:00:00.000Z
CVE-2022-45132 
In Linaro Automated Validation Architecture (LAVA) before 2022.11.1, remote code execution can be achieved through user-submitted Jinja2 template. The REST API endpoint for validating device configuration files in lava-server loads input as a Jinja2 template in a way that can be used to trigger remote code execution in the LAVA server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-18T00:00:00.000Z
CVE-2022-45133 
Mahara 21.10 before 21.10.6, 22.04 before 22.04.4, and 22.10 before 22.10.1 allows unsafe font upload for skins. A particularly structured XML file could allow one to traverse the server to obtain access to secure files or cause code execution based on the payload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-22T00:00:00.000Z
CVE-2022-45134 
Mahara 21.10 before 21.10.6, 22.04 before 22.04.4, and 22.10 before 22.10.1 deserializes user input unsafely during skin import. A particularly structured XML file could cause code execution when being processed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-22T00:00:00.000Z
CVE-2022-45135 Apache Cocoon: SQL injection in DatabaseCookieAuthenticatorAction
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Cocoon.This issue affects Apache Cocoon: from 2.2.0 before 2.3.0.

Users are recommended to upgrade to version 2.3.0, which fixes the issue.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Apache Software Foundation
product: Apache Cocoon
default_status: unknown
Credits: lang: en
value: QSec-Team
Published: 2023-11-30T08:05:45.604Z
CVE-2022-45136 Apache Jena SDB allows arbitrary deserialisation via JDBC
Apache Jena SDB 3.17.0 and earlier is vulnerable to a JDBC Deserialisation attack if the attacker is able to control the JDBC URL used or cause the underlying database server to return malicious data. The mySQL JDBC driver in particular is known to be vulnerable to this class of attack. As a result an application using Apache Jena SDB can be subject to RCE when connected to a malicious database server. Apache Jena SDB has been EOL since December 2020 and users should migrate to alternative options e.g. Apache Jena TDB 2.
Problem types: cwe_id: CWE-502
description: CWE-502 Deserialization of Untrusted Data
Affected products: vendor: Apache Software Foundation
product: Apache Jena SDB
Credits: lang: en
value: Apache Jena would like to thank Crilwa & LaNyer640 for reporting this issue
Published: 2022-11-14T00:00:00.000Z
CVE-2022-45137 WAGO: Reflective Cross-Site Scripting
The configuration backend of the web-based management is vulnerable to reflected XSS (Cross-Site Scripting) attacks that targets the users browser. This leads to a limited impact of confidentiality and integrity but no impact of availability.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: WAGO
product: Compact Controller CC100 (751-9301)
default_status: unaffected
vendor: WAGO
product: Edge Controller (752-8303/8000-002)
default_status: unaffected
vendor: WAGO
product: PFC100 (750-81xx/xxx-xxx)
default_status: unaffected
vendor: WAGO
product: PFC200 (750-82xx/xxx-xxx)
default_status: unaffected
vendor: WAGO
product: Touch Panel 600 Advanced Line (762-5xxx)
default_status: unaffected
vendor: WAGO
product: Touch Panel 600 Marine Line (762-6xxx)
default_status: unaffected
vendor: WAGO
product: Touch Panel 600 Standard Line (762-4xxx)
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: Ryan Pickren of Georgia Institute of Technologys Cyber-Physical Security Lab
Published: 2023-02-27T14:36:03.411Z
CVE-2022-45138 WAGO: Missing Authentication for Critical Function
The configuration backend of the web-based management can be used by unauthenticated users, although only authenticated users should be able to use the API. The vulnerability allows an unauthenticated attacker to read and set several device parameters that can lead to full compromise of the device.
Problem types: cwe_id: CWE-306
description: CWE-306 Missing Authentication for Critical Function
Affected products: vendor: WAGO
product: Compact Controller CC100 (751-9301)
default_status: unaffected
vendor: WAGO
product: Edge Controller (752-8303/8000-002)
default_status: unaffected
vendor: WAGO
product: PFC100 (750-81xx/xxx-xxx)
default_status: unaffected
vendor: WAGO
product: PFC200 (750-82xx/xxx-xxx)
default_status: unaffected
vendor: WAGO
product: Touch Panel 600 Advanced Line (762-5xxx)
default_status: unaffected
vendor: WAGO
product: Touch Panel 600 Marine Line (762-6xxx)
default_status: unaffected
vendor: WAGO
product: Touch Panel 600 Standard Line (762-4xxx)
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Ryan Pickren of Georgia Institute of Technologys Cyber-Physical Security Lab
Published: 2023-02-27T14:36:20.474Z
CVE-2022-45139 WAGO: Origin validation error through CORS misconfiguration
A CORS Misconfiguration in the web-based management allows a malicious third party webserver to misuse all basic information pages on the webserver. In combination with CVE-2022-45138 this could lead to disclosure of device information like CPU diagnostics. As there is just a limited amount of information readable the impact only affects a small subset of confidentiality.
Problem types: cwe_id: CWE-346
description: CWE-346 Origin Validation Error
Affected products: vendor: WAGO
product: Compact Controller CC100 (751-9301)
default_status: unaffected
vendor: WAGO
product: Edge Controller (752-8303/8000-002)
default_status: unaffected
vendor: WAGO
product: PFC100 (750-81xx/xxx-xxx)
default_status: unaffected
vendor: WAGO
product: PFC200 (750-82xx/xxx-xxx)
default_status: unaffected
vendor: WAGO
product: Touch Panel 600 Advanced Line (762-5xxx)
default_status: unaffected
vendor: WAGO
product: Touch Panel 600 Marine Line (762-6xxx)
default_status: unaffected
vendor: WAGO
product: Touch Panel 600 Standard Line (762-4xxx)
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: Ryan Pickren of Georgia Institute of Technologys Cyber-Physical Security Lab
Published: 2023-02-27T14:36:32.016Z
CVE-2022-45140 WAGO: Missing Authentication for Critical Function 
The configuration backend allows an unauthenticated user to write arbitrary data with root privileges to the storage, which could lead to unauthenticated remote code execution and full system compromise.
Problem types: cwe_id: CWE-306
description: CWE-306 Missing Authentication for Critical Function
Affected products: vendor: WAGO
product: Compact Controller CC100 (751-9301)
default_status: unaffected
vendor: WAGO
product: Edge Controller (752-8303/8000-002)
default_status: unaffected
vendor: WAGO
product: PFC100 (750-81xx/xxx-xxx)
default_status: unaffected
vendor: WAGO
product: PFC200 (750-82xx/xxx-xxx)
default_status: unaffected
vendor: WAGO
product: Touch Panel 600 Advanced Line (762-5xxx)
default_status: unaffected
vendor: WAGO
product: Touch Panel 600 Marine Line (762-6xxx)
default_status: unaffected
vendor: WAGO
product: Touch Panel 600 Standard Line (762-4xxx)
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Ryan Pickren of Georgia Institute of Technologys Cyber-Physical Security Lab
Published: 2023-02-27T14:36:39.448Z
CVE-2022-45141 
Since the Windows Kerberos RC4-HMAC Elevation of Privilege Vulnerability was disclosed by Microsoft on Nov 8 2022 and per RFC8429 it is assumed that rc4-hmac is weak, Vulnerable Samba Active Directory DCs will issue rc4-hmac encrypted tickets despite the target server supporting better encryption (eg aes256-cts-hmac-sha1-96).
Problem types: cwe_id: CWE-328
description: CWE-328
Affected products: vendor: n/a
product: Samba
Published: 2023-03-06T00:00:00.000Z
CVE-2022-45142 
The fix for CVE-2022-3437 included changing memcmp to be constant time and a workaround for a compiler bug by adding "!= 0" comparisons to the result of memcmp. When these patches were backported to the heimdal-7.7.1 and heimdal-7.8.0 branches (and possibly other branches) a logic inversion sneaked in causing the validation of message integrity codes in gssapi/arcfour to be inverted.
Problem types: cwe_id: CWE-354
description: CWE-354
Affected products: vendor: n/a
product: Samba
Published: 2023-03-06T00:00:00.000Z
CVE-2022-45143 Apache Tomcat: JsonErrorReportValve escaping
The JsonErrorReportValve in Apache Tomcat 8.5.83, 9.0.40 to 9.0.68 and 10.1.0-M1 to 10.1.1 did not escape the type, message or description values. In some circumstances these are constructed from user provided data and it was therefore possible for users to supply values that invalidated or manipulated the JSON output.
Problem types: cwe_id: CWE-116
description: CWE-116 Improper Encoding or Escaping of Output
Affected products: vendor: Apache Software Foundation
product: Apache Tomcat
default_status: affected
Published: 2023-01-03T18:12:28.351Z
CVE-2022-45144 
Algoo Tracim before 4.4.2 allows XSS via HTML file upload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-17T00:00:00.000Z
CVE-2022-45145 
egg-compile.scm in CHICKEN 5.x before 5.3.1 allows arbitrary OS command execution during package installation via escape characters in a .egg file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-10T00:00:00.000Z
CVE-2022-45146 
An issue was discovered in the FIPS Java API of Bouncy Castle BC-FJA before 1.0.2.4. Changes to the JVM garbage collector in Java 13 and later trigger an issue in the BC-FJA FIPS modules where it is possible for temporary keys used by the module to be zeroed out while still in use by the module, resulting in errors or potential information loss. NOTE: FIPS compliant users are unaffected because the FIPS certification is only for Java 7, 8, and 11.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-21T00:00:00.000Z
CVE-2022-45147 
A vulnerability has been identified in SIMATIC PCS neo V4.0 (All versions), SIMATIC STEP 7 V16 (All versions), SIMATIC STEP 7 V17 (All versions), SIMATIC STEP 7 V18 (All versions < V18 Update 2). Affected applications do not properly restrict the .NET BinaryFormatter when deserializing user-controllable input. This could allow an attacker to cause a type confusion and execute arbitrary code within the affected application.

This is the same issue that exists for .NET BinaryFormatter https://docs.microsoft.com/en-us/visualstudio/code-quality/ca2300.
Problem types: cwe_id: CWE-502
description: CWE-502: Deserialization of Untrusted Data
Affected products: vendor: Siemens
product: SIMATIC PCS neo V4.0
default_status: unknown
vendor: Siemens
product: SIMATIC STEP 7 V16
default_status: unknown
vendor: Siemens
product: SIMATIC STEP 7 V17
default_status: unknown
vendor: Siemens
product: SIMATIC STEP 7 V18
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
baseScore: 7.8
baseSeverity: HIGH
Published: 2024-07-09T12:04:22.545Z
CVE-2022-45149 
A vulnerability was found in Moodle which exists due to insufficient validation of the HTTP request origin in course redirect URL. A user's CSRF token was unnecessarily included in the URL when being redirected to a course they have just restored. A remote attacker can trick the victim to visit a specially crafted web page and perform arbitrary actions on behalf of the victim on the vulnerable website. This flaw allows an attacker to perform cross-site request forgery attacks.
Problem types: cwe_id: CWE-352
description: CWE-352 - Cross-Site Request Forgery (CSRF)
Affected products: vendor: n/a
product: Moodle
Published: 2022-11-23T00:00:00.000Z
CVE-2022-45150 
A reflected cross-site scripting vulnerability was discovered in Moodle. This flaw exists due to insufficient sanitization of user-supplied data in policy tool. An attacker can trick the victim to open a specially crafted link that executes an arbitrary HTML and script code in user's browser in context of vulnerable website. This vulnerability may allow an attacker to perform cross-site scripting (XSS) attacks to gain access potentially sensitive information and modification of web pages.
Problem types: cwe_id: CWE-79
description: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: n/a
product: Moodle
Published: 2022-11-23T00:00:00.000Z
CVE-2022-45151 
The stored-XSS vulnerability was discovered in Moodle which exists due to insufficient sanitization of user-supplied data in several "social" user profile fields. An attacker could inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Problem types: cwe_id: CWE-79
description: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: n/a
product: Moodle
Published: 2022-11-23T00:00:00.000Z
CVE-2022-45152 
A blind Server-Side Request Forgery (SSRF) vulnerability was found in Moodle. This flaw exists due to insufficient validation of user-supplied input in LTI provider library. The library does not utilise Moodle's inbuilt cURL helper, which resulted in a blind SSRF risk. An attacker can send a specially crafted HTTP request and trick the application to initiate requests to arbitrary systems. This vulnerability allows a remote attacker to perform SSRF attacks.
Problem types: cwe_id: CWE-918
description: CWE-918 - Server-Side Request Forgery (SSRF)
Affected products: vendor: n/a
product: Moodle
Published: 2022-11-25T00:00:00.000Z
CVE-2022-45153 saphanabootstrap-formula: Escalation to root for arbitrary users in hana/ha_cluster.sls
An Incorrect Default Permissions vulnerability in saphanabootstrap-formula of SUSE Linux Enterprise Module for SAP Applications 15-SP1, SUSE Linux Enterprise Server for SAP 12-SP5; openSUSE Leap 15.4 allows local attackers to escalate to root by manipulating the sudo configuration that is created. This issue affects: SUSE Linux Enterprise Module for SAP Applications 15-SP1 saphanabootstrap-formula versions prior to 0.13.1+git.1667812208.4db963e. SUSE Linux Enterprise Server for SAP 12-SP5 saphanabootstrap-formula versions prior to 0.13.1+git.1667812208.4db963e. openSUSE Leap 15.4 saphanabootstrap-formula versions prior to 0.13.1+git.1667812208.4db963e.
Problem types: cwe_id: CWE-276
description: CWE-276: Incorrect Default Permissions
Affected products: vendor: SUSE
product: SUSE Linux Enterprise Module for SAP Applications 15-SP1
vendor: SUSE
product: SUSE Linux Enterprise Server for SAP 12-SP5
vendor: openSUSE
product: openSUSE Leap 15.4
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 7
baseSeverity: HIGH
Credits: lang: en
value: Johannes Segitz of SUSE
Published: 2023-02-15T00:00:00.000Z