rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-47502 Apache OpenOffice: Macro URL arbitrary script execution
Apache OpenOffice documents can contain links that call internal macros with arbitrary arguments. Several URI Schemes are defined for this purpose.


Links can be activated by clicks, or by automatic document events.

The execution of such links must be subject to user approval.

In the affected versions of OpenOffice, approval for certain links is not   requested; when activated, such links could therefore result in arbitrary script execution.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
cwe_id: CWE-88
description: CWE-88 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Affected products: vendor: Apache Software Foundation
product: Apache OpenOffice
default_status: unaffected
Credits: lang: en
value: Altin Thartori (tin-z)
lang: en
value: Joachim Mammele
Published: 2023-03-24T15:57:28.611Z
CVE-2022-47503 SolarWinds Platform Deserialization of Untrusted Data Vulnerability
SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Orion admin-level account access to SolarWinds Web Console to execute arbitrary commands.


Problem types: cwe_id: CWE-502
description: CWE-502 Deserialization of Untrusted Data
Affected products: vendor: SolarWinds
product: SolarWinds Platform
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: SolarWinds would like to thank Piotr Bazydlo (@chudypb) of Trend Micro Zero Day Initiative for reporting on the issue in a responsible manner.
Published: 2023-02-15T00:00:00.000Z
CVE-2022-47504 SolarWinds Platform Deserialization of Untrusted Data Vulnerability
SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Orion admin-level account access to SolarWinds Web Console to execute arbitrary commands.


Problem types: cwe_id: CWE-502
description: CWE-502 Deserialization of Untrusted Data
Affected products: vendor: SolarWinds
product: SolarWinds Platform
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: SolarWinds would like to thank Piotr Bazydlo (@chudypb) of Trend Micro Zero Day Initiative for reporting on the issue in a responsible manner.
Published: 2023-02-15T00:00:00.000Z
CVE-2022-47505 SolarWinds Platform Local Privilege Escalation Vulnerability
The SolarWinds Platform was susceptible to the Local Privilege Escalation Vulnerability. This vulnerability allows a local adversary with a valid system user account to escalate local privileges.


Problem types: cwe_id: CWE-269
description: CWE-269 Improper Link Resolution Before File Access ('Link Following')
Affected products: vendor: SolarWinds
product: SolarWinds Platform
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: SolarWinds would like to thank Piotr Bazydlo (@chudypb) of Trend Micro Zero Day Initiative for reporting on the issue in a responsible manner.
Published: 2023-04-21T00:00:00.000Z
CVE-2022-47506 SolarWinds Platform Directory Traversal Vulnerability
SolarWinds Platform was susceptible to the Directory Traversal Vulnerability. This vulnerability allows a local adversary with authenticated account access to edit the default configuration, enabling the execution of arbitrary commands.


Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: SolarWinds
product: SolarWinds Platform
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: SolarWinds would like to thank Piotr Bazydlo (@chudypb) of Trend Micro Zero Day Initiative for reporting on the issue in a responsible manner.
Published: 2023-02-15T00:00:00.000Z
CVE-2022-47507 SolarWinds Platform Deserialization of Untrusted Data Vulnerability
SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Orion admin-level account access to SolarWinds Web Console to execute arbitrary commands.


Problem types: cwe_id: CWE-502
description: CWE-502 Deserialization of Untrusted Data
Affected products: vendor: SolarWinds
product: SolarWinds Platform
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: SolarWinds would like to thank Piotr Bazydlo (@chudypb) of Trend Micro Zero Day Initiative for reporting on the issue in a responsible manner.
Published: 2023-02-15T00:00:00.000Z
CVE-2022-47508 Disable NTLM: SAM 2022.4 
Customers who had configured their polling to occur via Kerberos did not expect NTLM Traffic on their environment, but since we were querying for data via IP address this prevented us from utilizing Kerberos.
Problem types: cwe_id: CWE-287
description: CWE-287 Improper Authentication
Affected products: vendor: SolarWinds
product: Server & Application Monitor (SAM)
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
Credits: lang: en
value: SolarWinds would like to thank Piotr Bazydlo (@chudypb) of Trend Micro Zero Day Initiative for reporting on the issue in a responsible manner.
Published: 2023-02-15T00:00:00.000Z
CVE-2022-47509 SolarWinds Platform Incorrect Input Neutralization Vulnerability
The SolarWinds Platform was susceptible to the Incorrect Input Neutralization Vulnerability. This vulnerability allows a remote adversary with a valid SolarWinds Platform account to append URL parameters to inject HTML.


Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: SolarWinds
product: SolarWinds Platform
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: SolarWinds would like to thank Juampa Rodriguez (@UnD3sc0n0c1d0) for reporting on the issue in a responsible manner.
Published: 2023-04-21T00:00:00.000Z
CVE-2022-47512 Sensitive Data Disclosure Vulnerability
Sensitive information was stored in plain text in a file that is accessible by a user with a local account in Hybrid Cloud Observability (HCO)/ SolarWinds Platform 2022.4. No other versions are affected
Problem types: cwe_id: CWE-312
description: CWE-312 Cleartext Storage of Sensitive Information
Affected products: vendor: SolarWinds
product: Hybrid Cloud Observability (HCO)/ SolarWinds Platform
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: SolarWinds would like to thank our Thwack MVP's for reporting on the issue in a responsible manner and working with our security, product, and engineering teams to fix the vulnerability.
Published: 2022-12-21T01:21:43.830Z
CVE-2022-47514 
An XML external entity (XXE) injection vulnerability in XML-RPC.NET before 2.5.0 allows remote authenticated users to conduct server-side request forgery (SSRF) attacks, as demonstrated by a pingback.aspx POST request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-18T00:00:00.000Z
CVE-2022-47515 
An issue was discovered in drachtio-server before 0.8.20. It allows remote attackers to cause a denial of service (daemon crash) via a long message in a TCP request that leads to std::length_error.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-18T00:00:00.000Z
CVE-2022-47516 
An issue was discovered in the libsofia-sip fork in drachtio-server before 0.8.20. It allows remote attackers to cause a denial of service (daemon crash) via a crafted UDP message that leads to a failure of the libsofia-sip-ua/tport/tport.c self assertion.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-18T00:00:00.000Z
CVE-2022-47517 
An issue was discovered in the libsofia-sip fork in drachtio-server before 0.8.19. It allows remote attackers to cause a denial of service (daemon crash) via a crafted UDP message that causes a url_canonize2 heap-based buffer over-read because of an off-by-one error.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-18T00:00:00.000Z
CVE-2022-47518 
An issue was discovered in the Linux kernel before 6.0.11. Missing validation of the number of channels in drivers/net/wireless/microchip/wilc1000/cfg80211.c in the WILC1000 wireless driver can trigger a heap-based buffer overflow when copying the list of operating channels from Wi-Fi management frames.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-18T00:00:00.000Z
CVE-2022-47519 
An issue was discovered in the Linux kernel before 6.0.11. Missing validation of IEEE80211_P2P_ATTR_OPER_CHANNEL in drivers/net/wireless/microchip/wilc1000/cfg80211.c in the WILC1000 wireless driver can trigger an out-of-bounds write when parsing the channel list attribute from Wi-Fi management frames.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-18T00:00:00.000Z
CVE-2022-47520 
An issue was discovered in the Linux kernel before 6.0.11. Missing offset validation in drivers/net/wireless/microchip/wilc1000/hif.c in the WILC1000 wireless driver can trigger an out-of-bounds read when parsing a Robust Security Network (RSN) information element from a Netlink packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-18T00:00:00.000Z
CVE-2022-47521 
An issue was discovered in the Linux kernel before 6.0.11. Missing validation of IEEE80211_P2P_ATTR_CHANNEL_LIST in drivers/net/wireless/microchip/wilc1000/cfg80211.c in the WILC1000 wireless driver can trigger a heap-based buffer overflow when parsing the operating channel attribute from Wi-Fi management frames.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-18T00:00:00.000Z
CVE-2022-47522 
The IEEE 802.11 specifications through 802.11ax allow physically proximate attackers to intercept (possibly cleartext) target-destined frames by spoofing a target's MAC address, sending Power Save frames to the access point, and then sending other frames to the access point (such as authentication frames or re-association frames) to remove the target's original security context. This behavior occurs because the specifications do not require an access point to purge its transmit queue before removing a client's pairwise encryption key.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-15T00:00:00.000Z
CVE-2022-47523 
Zoho ManageEngine Access Manager Plus before 4309, Password Manager Pro before 12210, and PAM360 before 5801 are vulnerable to SQL Injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-01-05T00:00:00.000Z
CVE-2022-47524 
F-Secure SAFE Browser 19.1 before 19.2 for Android allows an IDN homograph attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-23T00:00:00.000Z
CVE-2022-47525 
Fox-IT DataDiode (aka Fox DataDiode) 3.4.3 suffers from a Divide-by-Zero vulnerability in the packet parser. A remote attacker could leverage this vulnerability to cause a denial-of-service. Exploitation of this issue does not require user interaction.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-30T00:00:00.000Z
CVE-2022-47526 
Fox-IT DataDiode (aka Fox DataDiode) 3.4.3 suffers from a path traversal vulnerability with resultant arbitrary writing of files. A remote attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the downstream node user. Exploitation of this issue does not require user interaction.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-30T00:00:00.000Z
CVE-2022-47529 
Insecure Win32 memory objects in Endpoint Windows Agents in RSA NetWitness Platform before 12.2 allow local and admin Windows user accounts to modify the endpoint agent service configuration: to either disable it completely or run user-supplied code or commands, thereby bypassing tamper-protection features via ACL modification.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-03-28T00:00:00.000Z
CVE-2022-47531 
An issue was discovered in Ericsson Evolved Packet Gateway (EPG) versions 3.x before 3.25 and 2.x before 2.16, allows authenticated users to bypass system CLI and execute commands they are authorized to execute directly in the UNIX shell.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-05T00:00:00.000Z
CVE-2022-47532 
FileRun 20220519 allows SQL Injection via the "dir" parameter in a /?module=users&section=cpanel&page=list request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-22T00:00:00.000Z
CVE-2022-47542 
Red Gate SQL Monitor 11.0.14 through 12.1.46 has Incorrect Access Control, exploitable remotely for Escalation of Privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-03-30T00:00:00.000Z
CVE-2022-47543 
An issue was discovered in Siren Investigate before 12.1.7. There is an ACL bypass on global objects.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-01-05T00:00:00.000Z
CVE-2022-47544 
An issue was discovered in Siren Investigate before 12.1.7. Script variable whitelisting is insufficiently sandboxed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-01-05T00:00:00.000Z
CVE-2022-47547 
GossipSub 1.1, as used for Ethereum 2.0, allows a peer to maintain a positive score (and thus not be pruned from the network) even though it continuously misbehaves by never forwarding topic messages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-19T00:00:00.000Z
CVE-2022-47549 
An unprotected memory-access operation in optee_os in TrustedFirmware Open Portable Trusted Execution Environment (OP-TEE) before 3.20 allows a physically proximate adversary to bypass signature verification and install malicious trusted applications via electromagnetic fault injections.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-19T00:00:00.000Z
CVE-2022-47551 
Apiman 1.5.7 through 2.2.3.Final has insufficient checks for read permissions within the Apiman Manager REST API. The root cause of the issue is the Apiman project's accidental acceptance of a large contribution that was not fully compatible with the security model of Apiman versions before 3.0.0.Final. Because of this, 3.0.0.Final is not affected by the vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-19T00:00:00.000Z
CVE-2022-47553 Improper Authorization in Ormazabal products
Incorrect authorisation in ekorCCP and ekorRCI, which could allow a remote attacker to obtain resources with sensitive information for the organisation, without being authenticated within the web server.
Problem types: cwe_id: CWE-285
description: CWE-285 Improper Authorization
Affected products: vendor: Ormazabal
product: ekorCCP
default_status: unaffected
vendor: Ormazabal
product: ekorRCI
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 8.6
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Jacinto Moral Matellán
Published: 2023-09-19T12:30:05.573Z
CVE-2022-47554 Exposure of Sensitive Information in Ormazabal products
Exposure of sensitive information in ekorCCP and ekorRCI, potentially allowing a remote attacker to obtain critical information from various .xml files, including .xml files containing credentials, without being authenticated within the web server.
Problem types: cwe_id: CWE-200
description: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: Ormazabal
product: ekorCCP
default_status: unaffected
vendor: Ormazabal
product: ekorRCI
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 8.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
version: 3.1
Credits: lang: en
value: Jacinto Moral Matellán
Published: 2023-09-19T12:35:56.087Z
CVE-2022-47555 Improper Neutralization of Special Elements in Ormazabal products
Operating system command injection in ekorCCP and ekorRCI, which could allow an authenticated attacker to execute commands, create new users with elevated privileges or set up a backdoor.
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: Ormazabal
product: ekorCCP
default_status: unaffected
vendor: Ormazabal
product: ekorRCI
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 9.3
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
version: 3.1
Credits: lang: en
value: Jacinto Moral Matellán
Published: 2023-09-19T12:47:13.368Z
CVE-2022-47556 Uncontrolled Resource Consumption in Ormazabal products
Uncontrolled resource consumption in ekorRCI, allowing an attacker with low-privileged access to the web server to send continuous legitimate web requests to a functionality that is not properly validated, in order to cause a denial of service (DoS) on the device.
Problem types: cwe_id: CWE-400
description: CWE-400 Uncontrolled Resource Consumption
Affected products: vendor: Ormazabal
product: ekorRCI
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: Jacinto Moral Matellán
Published: 2023-09-19T12:51:19.837Z
CVE-2022-47557 Use of Password Hash With Insufficient Computational Effort in Ormazabal products
Vulnerability in ekorCCP and ekorRCI that could allow an attacker with access to the network where the device is located to decrypt the credentials of privileged users, and subsequently gain access to the system to perform malicious actions.
Problem types: cwe_id: CWE-916
description: CWE-916 Use of Password Hash With Insufficient Computational Effort
Affected products: vendor: Ormazabal
product: ekorCCP
default_status: unaffected
vendor: Ormazabal
product: ekorRCI
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
version: 3.1
Credits: lang: en
value: Jacinto Moral Matellán
Published: 2023-09-19T12:54:52.788Z
CVE-2022-47558 Improper Access Control in Ormazabal products
Devices ekorCCP and ekorRCI are vulnerable due to access to the FTP service using default credentials. Exploitation of this vulnerability can allow an attacker to modify critical files that could allow the creation of new users, delete or modify existing users, modify configuration files, install rootkits or backdoors.
Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Control
Affected products: vendor: Ormazabal
product: ekorCCP
default_status: unaffected
vendor: Ormazabal
product: ekorRCI
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 9.4
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
version: 3.1
Credits: lang: en
value: Jacinto Moral Matellán
Published: 2023-09-19T12:58:48.452Z
CVE-2022-47559 Cross-Site Request Forgery in Ormazabal products
Lack of device control over web requests in ekorCCP and ekorRCI, allowing an attacker to create customised requests to execute malicious actions when a user is logged in, affecting availability, privacy and integrity.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Ormazabal
product: ekorCCP
default_status: unaffected
vendor: Ormazabal
product: ekorRCI
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 8.6
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
version: 3.1
Credits: lang: en
value: Jacinto Moral Matellán
Published: 2023-09-19T13:00:59.770Z
CVE-2022-47560 Cleartext Transmission of Sensitive Information in Ormazabal products
The lack of web request control on ekorCCP and ekorRCI devices allows a potential attacker to create custom requests to execute malicious actions when a user is logged in.
Problem types: cwe_id: CWE-319
description: CWE-319 Cleartext Transmission of Sensitive Information
Affected products: vendor: Ormazabal
product: ekorCCP
default_status: unaffected
vendor: Ormazabal
product: ekorRCI
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: NONE
baseScore: 5.7
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Jacinto Moral Matellán
Published: 2023-09-20T07:52:33.173Z