rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-30302 
Multiple relative path traversal vulnerabilities [CWE-23] in FortiDeceptor management interface 1.0.0 through 3.2.x, 3.3.0 through 3.3.2, 4.0.0 through 4.0.1 may allow a remote and authenticated attacker to retrieve and delete arbitrary files from the underlying filesystem via specially crafted web requests.
Problem types: description: Information disclosure
Affected products: vendor: Fortinet
product: Fortinet FortiDeceptor
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
exploitCodeMaturity: FUNCTIONAL
integrityImpact: NONE
privilegesRequired: LOW
remediationLevel: UNAVAILABLE
reportConfidence: CONFIRMED
scope: UNCHANGED
temporalScore: 6.4
temporalSeverity: MEDIUM
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:F/RL:U/RC:C
version: 3.1
Published: 2022-07-18T16:40:27.000Z
CVE-2022-30303 
An improper neutralization of special elements used in an os command ('OS Command Injection') [CWE-78] in FortiWeb 7.0.0 through 7.0.1, 6.3.0 through 6.3.19, 6.4 all versions may allow an authenticated attacker to execute arbitrary shell code as `root` user via crafted HTTP requests.
Problem types: cwe_id: CWE-78
description: Execute unauthorized code or commands
Affected products: vendor: Fortinet
product: FortiWeb
default_status: unaffected
CVSS v3.1: version: 3.1
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.6
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:U/RC:C
Published: 2023-02-16T18:05:22.629Z
CVE-2022-30304 
An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiAnalyzer versions prior to 7.2.1, 7.0.4 and 6.4.8 may allow a remote unauthenticated attacker to perform a stored cross site scripting (XSS) attack via the URL parameter observed in the FortiWeb attack event logview in FortiAnalyzer.
Problem types: cwe_id: CWE-79
description: Execute unauthorized code or commands
Affected products: vendor: Fortinet
product: FortiAnalyzer
default_status: unaffected
CVSS v3.1: version: 3.1
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.2
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:F/RL:X/RC:X
Published: 2023-02-16T18:06:27.170Z
CVE-2022-30305 
An insufficient logging [CWE-778] vulnerability in FortiSandbox versions 4.0.0 to 4.0.2, 3.2.0 to 3.2.3 and 3.1.0 to 3.1.5 and FortiDeceptor versions 4.2.0, 4.1.0 through 4.1.1, 4.0.0 through 4.0.2, 3.3.0 through 3.3.3, 3.2.0 through 3.2.2,3.1.0 through 3.1.1 and 3.0.0 through 3.0.2  may allow a remote attacker to repeatedly enter incorrect credentials without causing a log entry, and with no limit on the number of failed authentication attempts.
Problem types: cwe_id: CWE-778
description: Improper access control
Affected products: vendor: Fortinet
product: FortiSandbox
default_status: unaffected
vendor: Fortinet
product: FortiDeceptor
default_status: unaffected
CVSS v3.1: version: 3.1
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 3.6
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:F/RL:X/RC:C
Published: 2022-12-06T16:00:54.500Z
CVE-2022-30306 
A stack-based buffer overflow vulnerability [CWE-121] in the CA sign functionality of FortiWeb version 7.0.1 and below, 6.4 all versions, version 6.3.19 and below may allow an authenticated attacker to achieve arbitrary code execution via specifically crafted password.
Problem types: cwe_id: CWE-121
description: Denial of service
Affected products: vendor: Fortinet
product: FortiWeb
default_status: unaffected
CVSS v3.1: version: 3.1
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.3
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C
Published: 2023-02-16T18:06:14.226Z
CVE-2022-30307 
A key management error vulnerability [CWE-320] affecting the RSA SSH host key in FortiOS 7.2.0 and below, 7.0.6 and below, 6.4.9 and below may allow an unauthenticated attacker to perform a man in the middle attack.
Problem types: description: Improper access control
Affected products: vendor: Fortinet
product: Fortinet FortiOS
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L/E:X/RL:U/RC:R
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: HIGH
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: LOW
exploitCodeMaturity: NOT_DEFINED
remediationLevel: UNAVAILABLE
reportConfidence: REASONABLE
baseScore: 3.9
temporalScore: 3.8
baseSeverity: LOW
temporalSeverity: LOW
Published: 2022-11-02T00:00:00.000Z
CVE-2022-30308 FESTO: CECC-X-M1 and Servo Press Kit YJKP OS Command Injection vulnerability
In Festo Controller CECC-X-M1 product family in multiple versions, the http-endpoint "cecc-x-web-viewer-request-on" POST request doesn’t check for port syntax. This can result in unauthorized execution of system commands with root privileges due to improper access control command injection.
Problem types: cwe_id: CWE-863
description: CWE-863 Incorrect Authorization
cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: Festo
product: Controller CECC-X-M1 (4407603)
default_status: unaffected
vendor: Festo
product: Controller CECC-X-M1 (8124922)
default_status: unaffected
vendor: Festo
product: Controller CECC-X-M1-MV (4407605)
default_status: unaffected
vendor: Festo
product: Controller CECC-X-M1-MV (8124923)
default_status: unaffected
vendor: Festo
product: Controller CECC-X-M1-MV-S1 (4407606)
default_status: unaffected
vendor: Festo
product: Controller CECC-X-M1-MV-S1 (8124924)
default_status: unaffected
vendor: Festo
product: Controller CECC-X-M1-YS-L1 (8082793)
default_status: unaffected
vendor: Festo
product: Controller CECC-X-M1-YS-L2 (8082794)
default_status: unaffected
vendor: Festo
product: Controller CECC-X-M1-Y-YJKP (4803891)
default_status: unaffected
vendor: Festo
product: Servo Press Kit YJKP (8077950)
default_status: unaffected
vendor: Festo
product: Servo Press Kit YJKP- (8058596)
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Q. Kaiser, M. Illes from ONEKEY Research Labs for reported to Festo
Published: 2022-06-13T13:45:20.015Z
CVE-2022-30309 FESTO: CECC-X-M1 and Servo Press Kit YJKP OS Command Injection vulnerability
In Festo Controller CECC-X-M1 product family in multiple versions, the http-endpoint "cecc-x-web-viewer-request-off" POST request doesn’t check for port syntax. This can result in unauthorized execution of system commands with root privileges due to improper access control command injection.
Problem types: cwe_id: CWE-863
description: CWE-863 Incorrect Authorization
cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: Festo
product: Controller CECC-X-M1 (4407603)
default_status: unaffected
vendor: Festo
product: Controller CECC-X-M1 (8124922)
default_status: unaffected
vendor: Festo
product: Controller CECC-X-M1-MV (4407605)
default_status: unaffected
vendor: Festo
product: Controller CECC-X-M1-MV (8124923)
default_status: unaffected
vendor: Festo
product: Controller CECC-X-M1-MV-S1 (4407606)
default_status: unaffected
vendor: Festo
product: Controller CECC-X-M1-MV-S1 (8124924)
default_status: unaffected
vendor: Festo
product: Controller CECC-X-M1-YS-L1 (8082793)
default_status: unaffected
vendor: Festo
product: Controller CECC-X-M1-YS-L2 (8082794)
default_status: unaffected
vendor: Festo
product: Controller CECC-X-M1-Y-YJKP (4803891)
default_status: unaffected
vendor: Festo
product: Servo Press Kit YJKP (8077950)
default_status: unaffected
vendor: Festo
product: Servo Press Kit YJKP- (8058596)
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Q. Kaiser, M. Illes from ONEKEY Research Labs for reported to Festo
Published: 2022-06-13T13:45:21.634Z
CVE-2022-30310 FESTO: CECC-X-M1 and Servo Press Kit YJKP OS Command Injection vulnerability
In Festo Controller CECC-X-M1 product family in multiple versions, the http-endpoint "cecc-x-acknerr-request" POST request doesn’t check for port syntax. This can result in unauthorized execution of system commands with root privileges due to improper access control command injection.
Problem types: cwe_id: CWE-863
description: CWE-863 Incorrect Authorization
cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: Festo
product: Controller CECC-X-M1 (4407603)
default_status: unaffected
vendor: Festo
product: Controller CECC-X-M1 (8124922)
default_status: unaffected
vendor: Festo
product: Controller CECC-X-M1-MV (4407605)
default_status: unaffected
vendor: Festo
product: Controller CECC-X-M1-MV (8124923)
default_status: unaffected
vendor: Festo
product: Controller CECC-X-M1-MV-S1 (4407606)
default_status: unaffected
vendor: Festo
product: Controller CECC-X-M1-MV-S1 (8124924)
default_status: unaffected
vendor: Festo
product: Controller CECC-X-M1-YS-L1 (8082793)
default_status: unaffected
vendor: Festo
product: Controller CECC-X-M1-YS-L2 (8082794)
default_status: unaffected
vendor: Festo
product: Controller CECC-X-M1-Y-YJKP (4803891)
default_status: unaffected
vendor: Festo
product: Servo Press Kit YJKP (8077950)
default_status: unaffected
vendor: Festo
product: Servo Press Kit YJKP- (8058596)
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Q. Kaiser, M. Illes from ONEKEY Research Labs for reported to Festo
Published: 2022-06-13T13:45:23.105Z
CVE-2022-30311 FESTO: CECC-X-M1 and Servo Press Kit YJKP OS Command Injection vulnerability
In Festo Controller CECC-X-M1 product family in multiple versions, the http-endpoint "cecc-x-refresh-request" POST request doesn’t check for port syntax. This can result in unauthorized execution of system commands with root privileges due to improper access control command injection.
Problem types: cwe_id: CWE-863
description: CWE-863 Incorrect Authorization
cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: Festo
product: Controller CECC-X-M1 (4407603)
default_status: unaffected
vendor: Festo
product: Controller CECC-X-M1 (8124922)
default_status: unaffected
vendor: Festo
product: Controller CECC-X-M1-MV (4407605)
default_status: unaffected
vendor: Festo
product: Controller CECC-X-M1-MV (8124923)
default_status: unaffected
vendor: Festo
product: Controller CECC-X-M1-MV-S1 (4407606)
default_status: unaffected
vendor: Festo
product: Controller CECC-X-M1-MV-S1 (8124924)
default_status: unaffected
vendor: Festo
product: Controller CECC-X-M1-YS-L1 (8082793)
default_status: unaffected
vendor: Festo
product: Controller CECC-X-M1-YS-L2 (8082794)
default_status: unaffected
vendor: Festo
product: Controller CECC-X-M1-Y-YJKP (4803891)
default_status: unaffected
vendor: Festo
product: Servo Press Kit YJKP (8077950)
default_status: unaffected
vendor: Festo
product: Servo Press Kit YJKP- (8058596)
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Q. Kaiser, M. Illes from ONEKEY Research Labs for reported to Festo
Published: 2022-06-13T13:45:24.763Z
CVE-2022-30312 
The Trend Controls IC protocol through 2022-05-06 allows Cleartext Transmission of Sensitive Information. According to FSCT-2022-0050, there is a Trend Controls Inter-Controller (IC) protocol cleartext transmission of credentials issue. The affected components are characterized as: Inter-Controller (IC) protocol (57612/UDP). The potential impact is: Compromise of credentials. Several Trend Controls building automation controllers utilize the Inter-Controller (IC) protocol in for information exchange and automation purposes. This protocol offers authentication in the form of a 4-digit PIN in order to protect access to sensitive operations like strategy uploads and downloads as well as optional 0-30 character username and password protection for web page access protection. Both the PIN and usernames and passwords are transmitted in cleartext, allowing an attacker with passive interception capabilities to obtain these credentials. Credentials are transmitted in cleartext. An attacker who obtains Trend IC credentials can carry out sensitive engineering actions such as manipulating controller strategy or configuration settings. If the credentials in question are (re)used for other applications, their compromise could potentially facilitate lateral movement.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-07T17:54:02.000Z
CVE-2022-30313 
Honeywell Experion PKS Safety Manager through 2022-05-06 has Missing Authentication for a Critical Function. According to FSCT-2022-0051, there is a Honeywell Experion PKS Safety Manager multiple proprietary protocols with unauthenticated functionality issue. The affected components are characterized as: Honeywell Experion TCP (51000/TCP), Safety Builder (51010/TCP). The potential impact is: Manipulate controller state, Manipulate controller configuration, Manipulate controller logic, Manipulate controller files, Manipulate IO. The Honeywell Experion PKS Distributed Control System (DCS) Safety Manager utilizes several proprietary protocols for a wide variety of functionality, including process data acquisition, controller steering and configuration management. These protocols include: Experion TCP (51000/TCP) and Safety Builder (51010/TCP). None of these protocols have any authentication features, allowing any attacker capable of communicating with the ports in question to invoke (a subset of) desired functionality. There is no authentication functionality on the protocols in question. An attacker capable of invoking the protocols' functionalities could achieve a wide range of adverse impacts, including (but not limited to), the following: for Experion TCP (51000/TCP): Issue IO manipulation commands, Issue file read/write commands; and for Safety Builder (51010/TCP): Issue controller start/stop commands, Issue logic download/upload commands, Issue file read commands, Issue system time change commands. A mitigating factor with regards to some, but not all, of the above functionality is that these require the Safety Manager physical keyswitch to be in the right position.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-28T15:41:25.000Z
CVE-2022-30314 
Honeywell Experion PKS Safety Manager 5.02 uses Hard-coded Credentials. According to FSCT-2022-0052, there is a Honeywell Experion PKS Safety Manager hardcoded credentials issue. The affected components are characterized as: POLO bootloader. The potential impact is: Manipulate firmware. The Honeywell Experion PKS Safety Manager utilizes the DCOM-232/485 serial interface for firmware management purposes. When booting, the Safety Manager exposes the Enea POLO bootloader via this interface. Access to the boot configuration is controlled by means of credentials hardcoded in the Safety Manager firmware. The credentials for the bootloader are hardcoded in the firmware. An attacker with access to the serial interface (either through physical access, a compromised EWS or an exposed serial-to-ethernet gateway) can utilize these credentials to control the boot process and manipulate the unauthenticated firmware image (see FSCT-2022-0054).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-28T15:41:20.000Z
CVE-2022-30315 
Honeywell Experion PKS Safety Manager (SM and FSC) through 2022-05-06 has Insufficient Verification of Data Authenticity. According to FSCT-2022-0053, there is a Honeywell Experion PKS Safety Manager insufficient logic security controls issue. The affected components are characterized as: Honeywell FSC runtime (FSC-CPU, QPP), Honeywell Safety Builder. The potential impact is: Remote Code Execution, Denial of Service. The Honeywell Experion PKS Safety Manager family of safety controllers utilize the unauthenticated Safety Builder protocol (FSCT-2022-0051) for engineering purposes, including downloading projects and control logic to the controller. Control logic is downloaded to the controller on a block-by-block basis. The logic that is downloaded consists of FLD code compiled to native machine code for the CPU module (which applies to both the Safety Manager and FSC families). Since this logic does not seem to be cryptographically authenticated, it allows an attacker capable of triggering a logic download to execute arbitrary machine code on the controller's CPU module in the context of the runtime. While the researchers could not verify this in detail, the researchers believe that the microprocessor underpinning the FSC and Safety Manager CPU modules is incapable of offering memory protection or privilege separation capabilities which would give an attacker full control of the CPU module. There is no authentication on control logic downloaded to the controller. Memory protection and privilege separation capabilities for the runtime are possibly lacking. The researchers confirmed the issues in question on Safety Manager R145.1 and R152.2 but suspect the issue affects all FSC and SM controllers and associated Safety Builder versions regardless of software or firmware revision. An attacker who can communicate with a Safety Manager controller via the Safety Builder protocol can execute arbitrary code without restrictions on the CPU module, allowing for covert manipulation of control operations and implanting capabilities similar to the TRITON malware (MITRE ATT&CK software ID S1009). A mitigating factor with regards to some, but not all, of the above functionality is that these require the Safety Manager physical keyswitch to be in the right position.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-28T15:41:18.000Z
CVE-2022-30316 
Honeywell Experion PKS Safety Manager 5.02 has Insufficient Verification of Data Authenticity. According to FSCT-2022-0054, there is a Honeywell Experion PKS Safety Manager unauthenticated firmware update issue. The affected components are characterized as: Firmware update functionality. The potential impact is: Firmware manipulation. The Honeywell Experion PKS Safety Manager utilizes the DCOM-232/485 communication FTA serial interface and Enea POLO bootloader for firmware management purposes. An engineering workstation running the Safety Builder software communicates via serial or serial-over-ethernet link with the DCOM-232/485 interface. Firmware images were found to have no authentication (in the form of firmware signing) and only relied on insecure checksums for regular integrity checks. Firmware images are unsigned. An attacker with access to the serial interface (either through physical access, a compromised EWS or an exposed serial-to-ethernet gateway) can utilize hardcoded credentials (see FSCT-2022-0052) for the POLO bootloader to control the boot process and push malicious firmware images to the controller allowing for firmware manipulation, remote code execution and denial of service impacts. A mitigating factor is that in order for a firmware update to be initiated, the Safety Manager has to be rebooted which is typically done by means of physical controls on the Safety Manager itself. As such, an attacker would have to either lay dormant until a legitimate reboot occurs or possibly attempt to force a reboot through a secondary vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-28T15:41:12.000Z
CVE-2022-30317 
Honeywell Experion LX through 2022-05-06 has Missing Authentication for a Critical Function. According to FSCT-2022-0055, there is a Honeywell Experion LX Control Data Access (CDA) EpicMo protocol with unauthenticated functionality issue. The affected components are characterized as: Honeywell Control Data Access (CDA) EpicMo (55565/TCP). The potential impact is: Firmware manipulation, Denial of service. The Honeywell Experion LX Distributed Control System (DCS) utilizes the Control Data Access (CDA) EpicMo protocol (55565/TCP) for device diagnostics and maintenance purposes. This protocol does not have any authentication features, allowing any attacker capable of communicating with the ports in question to invoke (a subset of) desired functionality. There is no authentication functionality on the protocol in question. An attacker capable of invoking the protocols' functionalities could issue firmware download commands potentially allowing for firmware manipulation and reboot devices causing denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-31T15:22:02.000Z
CVE-2022-30318 
Honeywell ControlEdge through R151.1 uses Hard-coded Credentials. According to FSCT-2022-0056, there is a Honeywell ControlEdge hardcoded credentials issue. The affected components are characterized as: SSH. The potential impact is: Remote code execution, manipulate configuration, denial of service. The Honeywell ControlEdge PLC and RTU product line exposes an SSH service on port 22/TCP. Login as root to this service is permitted and credentials for the root user are hardcoded without automatically changing them upon first commissioning. The credentials for the SSH service are hardcoded in the firmware. The credentials grant an attacker access to a root shell on the PLC/RTU, allowing for remote code execution, configuration manipulation and denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-31T15:39:14.000Z