rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-22766 BD Pyxis Products - Hardcoded Credentials
Hardcoded credentials are used in specific BD Pyxis products. If exploited, threat actors may be able to gain access to the underlying file system and could potentially exploit application files for information that could be used to decrypt application credentials or gain access to electronic protected health information (ePHI) or other sensitive information.
Problem types: cwe_id: CWE-798
description: CWE-798 Use of Hard-coded Credentials
Affected products: vendor: Becton Dickinson (BD)
product: BD Pyxis Anesthesia Station ES
vendor: Becton Dickinson (BD)
product: BD Pyxis Anesthesia Station 4000
vendor: Becton Dickinson (BD)
product: BD Pyxis CATO
vendor: Becton Dickinson (BD)
product: BD Pyxis CIISafe
vendor: Becton Dickinson (BD)
product: BD Pyxis Inventory Connect
vendor: Becton Dickinson (BD)
product: BD Pyxis IV Prep
vendor: Becton Dickinson (BD)
product: BD Pyxis JITrBUD
vendor: Becton Dickinson (BD)
product: BD Pyxis KanBan RF
vendor: Becton Dickinson (BD)
product: BD Pyxis Logistics
vendor: Becton Dickinson (BD)
product: BD Pyxis Med Link Family
vendor: Becton Dickinson (BD)
product: BD Pyxis MedBank
vendor: Becton Dickinson (BD)
product: BD Pyxis MedStation 4000
vendor: Becton Dickinson (BD)
product: BD Pyxis MedStation ES
vendor: Becton Dickinson (BD)
product: BD Pyxis MedStation ES Server
vendor: Becton Dickinson (BD)
product: BD Pyxis ParAssist
vendor: Becton Dickinson (BD)
product: BD Pyxis PharmoPack
vendor: Becton Dickinson (BD)
product: BD Pyxis ProcedureStation (including EC)
vendor: Becton Dickinson (BD)
product: BD Pyxis Rapid Rx
vendor: Becton Dickinson (BD)
product: BD Pyxis StockStation
vendor: Becton Dickinson (BD)
product: BD Pyxis SupplyCenter
vendor: Becton Dickinson (BD)
product: BD Pyxis SupplyRoller
vendor: Becton Dickinson (BD)
product: BD Pyxis SupplyStation (including RF, EC, CP)
vendor: Becton Dickinson (BD)
product: BD Pyxis Track and Deliver
vendor: Becton Dickinson (BD)
product: BD Rowa Pouch Packaging Systems
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2022-02-11T18:12:07.247Z
CVE-2022-22767 BD Pyxis™ Products – Default Credentials
Specific BD Pyxis™ products were installed with default credentials and may presently still operate with these credentials. There may be scenarios where BD Pyxis™ products are installed with the same default local operating system credentials or domain-joined server(s) credentials that may be shared across product types. If exploited, threat actors may be able to gain privileged access to the underlying file system and could potentially exploit or gain access to ePHI or other sensitive information.
Problem types: cwe_id: CWE-262
description: CWE-262: Not Using Password Aging
Affected products: vendor: Becton Dickinson (BD)
product: BD Pyxis™ Anesthesia ES Station
vendor: Becton Dickinson (BD)
product: BD Pyxis™ CIISafe
vendor: Becton Dickinson (BD)
product: BD Pyxis™ Logistics
vendor: Becton Dickinson (BD)
product: BD Pyxis™ MedBank
vendor: Becton Dickinson (BD)
product: BD Pyxis™ MedStation™ 4000
vendor: Becton Dickinson (BD)
product: BD Pyxis™ MedStation™ ES
vendor: Becton Dickinson (BD)
product: BD Pyxis™ MedStation™ ES Server
vendor: Becton Dickinson (BD)
product: BD Pyxis™ ParAssist
vendor: Becton Dickinson (BD)
product: BD Pyxis™ Rapid Rx
vendor: Becton Dickinson (BD)
product: BD Pyxis™ StockStation
vendor: Becton Dickinson (BD)
product: BD Pyxis™ SupplyCenter
vendor: Becton Dickinson (BD)
product: BD Pyxis™ SupplyRoller
vendor: Becton Dickinson (BD)
product: BD Pyxis™ SupplyStation™
vendor: Becton Dickinson (BD)
product: BD Pyxis™ SupplyStation™ EC
vendor: Becton Dickinson (BD)
product: BD Pyxis™ SupplyStation™ RF auxiliary
vendor: Becton Dickinson (BD)
product: BD Rowa™ Pouch Packaging Systems
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2022-06-01T16:35:38.991Z
CVE-2022-22769 TIBCO EBX vulnerabilities
The Web server component of TIBCO Software Inc.'s TIBCO EBX, TIBCO EBX, TIBCO EBX, TIBCO EBX Add-ons, TIBCO EBX Add-ons, TIBCO EBX Add-ons, and TIBCO Product and Service Catalog powered by TIBCO EBX contains an easily exploitable vulnerability that allows a low privileged attacker with network access to execute Stored Cross Site Scripting (XSS) on the affected system. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.'s TIBCO EBX: versions 5.8.124 and below, TIBCO EBX: versions 5.9.3, 5.9.4, 5.9.5, 5.9.6, 5.9.7, 5.9.8, 5.9.9, 5.9.10, 5.9.11, 5.9.12, 5.9.13, 5.9.14, and 5.9.15, TIBCO EBX: versions 6.0.0, 6.0.1, 6.0.2, and 6.0.3, TIBCO EBX Add-ons: versions 3.20.18 and below, TIBCO EBX Add-ons: versions 4.1.0, 4.2.0, 4.2.1, 4.2.2, 4.3.0, 4.3.1, 4.3.2, 4.3.3, 4.3.4, 4.4.0, 4.4.1, 4.4.2, 4.4.3, 4.5.0, 4.5.1, 4.5.2, 4.5.3, 4.5.4, 4.5.5, and 4.5.6, TIBCO EBX Add-ons: versions 5.0.0, 5.0.1, 5.1.0, 5.1.1, and 5.2.0, and TIBCO Product and Service Catalog powered by TIBCO EBX: versions 1.1.0 and below.
Problem types: description: In the worst case, if the victim is a privileged administrator, successful execution of these vulnerabilities can result in an attacker gaining full administrative access to the affected system.
Affected products: vendor: TIBCO Software Inc.
product: TIBCO EBX
vendor: TIBCO Software Inc.
product: TIBCO EBX
vendor: TIBCO Software Inc.
product: TIBCO EBX
vendor: TIBCO Software Inc.
product: TIBCO EBX Add-ons
vendor: TIBCO Software Inc.
product: TIBCO EBX Add-ons
vendor: TIBCO Software Inc.
product: TIBCO EBX Add-ons
vendor: TIBCO Software Inc.
product: TIBCO Product and Service Catalog powered by TIBCO EBX
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Published: 2022-01-19T19:25:10.795Z
CVE-2022-22770 TIBCO AuditSafe API Authentication vulnerability
The Web Server component of TIBCO Software Inc.'s TIBCO AuditSafe contains an easily exploitable vulnerability that allows an unauthenticated attacker with network access to execute API methods on the affected system. Affected releases are TIBCO Software Inc.'s TIBCO AuditSafe: versions 1.1.0 and below.
Problem types: description: In the worst case, if the victim is a privileged administrator, successful execution of these vulnerabilities can result in an attacker gaining full administrative access to the API methods of the affected system.
Affected products: vendor: TIBCO Software Inc.
product: TIBCO AuditSafe
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2022-02-15T18:00:11.463Z
CVE-2022-22771 TIBCO JasperReports Library Directory Traversal Vulnerability
The Server component of TIBCO Software Inc.'s TIBCO JasperReports Library, TIBCO JasperReports Library for ActiveMatrix BPM, TIBCO JasperReports Server, TIBCO JasperReports Server for AWS Marketplace, TIBCO JasperReports Server for ActiveMatrix BPM, and TIBCO JasperReports Server for Microsoft Azure contains a directory-traversal vulnerability that may theoretically allow web server users to access contents of the host system. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Library: version 7.9.0, TIBCO JasperReports Library for ActiveMatrix BPM: version 7.9.0, TIBCO JasperReports Server: versions 7.9.0 and 7.9.1, TIBCO JasperReports Server for AWS Marketplace: versions 7.9.0 and 7.9.1, TIBCO JasperReports Server for ActiveMatrix BPM: versions 7.9.0 and 7.9.1, and TIBCO JasperReports Server for Microsoft Azure: version 7.9.1.
Problem types: description: The impact of this vulnerability includes the theoretical possibility that a web server using the provided DefaultWebResourceHandler could expose details of the host system. The disclosed data could include credentials to access other systems.
Affected products: vendor: TIBCO Software Inc.
product: TIBCO JasperReports Library
vendor: TIBCO Software Inc.
product: TIBCO JasperReports Library for ActiveMatrix BPM
vendor: TIBCO Software Inc.
product: TIBCO JasperReports Server
vendor: TIBCO Software Inc.
product: TIBCO JasperReports Server for AWS Marketplace
vendor: TIBCO Software Inc.
product: TIBCO JasperReports Server for ActiveMatrix BPM
vendor: TIBCO Software Inc.
product: TIBCO JasperReports Server for Microsoft Azure
Published: 2022-03-15T17:05:11.270Z
CVE-2022-22772 TIBCO Managed File Transfer Platform Server Remote Code Execution Vulnerability
The cfsend, cfrecv, and CyberResp components of TIBCO Software Inc.'s TIBCO Managed File Transfer Platform Server for UNIX and TIBCO Managed File Transfer Platform Server for z/Linux contain a difficult to exploit Remote Code Execution (RCE) vulnerability that allows a low privileged attacker with network access to execute arbitrary code on the affected system. Affected releases are TIBCO Software Inc.'s TIBCO Managed File Transfer Platform Server for UNIX: versions 8.1.0 and below and TIBCO Managed File Transfer Platform Server for z/Linux: versions 8.1.0 and below.
Problem types: description: Successful execution of this vulnerability can result in a low privileged attacker gaining full user access to the affected system.
Affected products: vendor: TIBCO Software Inc.
product: TIBCO Managed File Transfer Platform Server for UNIX
vendor: TIBCO Software Inc.
product: TIBCO Managed File Transfer Platform Server for z/Linux
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Published: 2022-03-30T16:40:10.158Z
CVE-2022-22773 TIBCO JasperReports Server Reflected Cross Site Scripting (XSS) vulnerability
The REST API component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server - Community Edition, TIBCO JasperReports Server - Developer Edition, TIBCO JasperReports Server for AWS Marketplace, TIBCO JasperReports Server for ActiveMatrix BPM, and TIBCO JasperReports Server for Microsoft Azure contains difficult to exploit Reflected Cross Site Scripting (XSS) vulnerabilities that allow a low privileged attacker with network access to execute scripts targeting the affected system or the victim's local system. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Server: versions 8.0.1 and below, TIBCO JasperReports Server - Community Edition: versions 8.0.1 and below, TIBCO JasperReports Server - Developer Edition: versions 8.0.0 and below, TIBCO JasperReports Server for AWS Marketplace: versions 8.0.1 and below, TIBCO JasperReports Server for ActiveMatrix BPM: versions 7.9.2 and below, and TIBCO JasperReports Server for Microsoft Azure: versions 8.0.1 and below.
Problem types: description: In the worst case, if the victim is a privileged administrator, successful execution of these vulnerabilities can result in an attacker gaining full administrative access to the affected system.
Affected products: vendor: TIBCO Software Inc.
product: TIBCO JasperReports Server
vendor: TIBCO Software Inc.
product: TIBCO JasperReports Server - Community Edition
vendor: TIBCO Software Inc.
product: TIBCO JasperReports Server - Developer Edition
vendor: TIBCO Software Inc.
product: TIBCO JasperReports Server for AWS Marketplace
vendor: TIBCO Software Inc.
product: TIBCO JasperReports Server for ActiveMatrix BPM
vendor: TIBCO Software Inc.
product: TIBCO JasperReports Server for Microsoft Azure
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.7
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N
version: 3.1
Credits: lang: en
value: TIBCO would like to extend its appreciation to Mohamed Rezgui for discovery of this vulnerability.
Published: 2022-05-17T17:30:13.151Z
CVE-2022-22774 TIBCO Managed File Transfer Command Center XXE Vulnerability
The DOM XML parser and SAX XML parser components of TIBCO Software Inc.'s TIBCO Managed File Transfer Command Center, TIBCO Managed File Transfer Command Center, TIBCO Managed File Transfer Internet Server, and TIBCO Managed File Transfer Internet Server contains an easily exploitable vulnerability that allows an unauthenticated attacker with network access to execute XML External Entity (XXE) attacks on the affected system. Affected releases are TIBCO Software Inc.'s TIBCO Managed File Transfer Command Center: versions 8.3.1 and below, TIBCO Managed File Transfer Command Center: versions 8.4.0 and 8.4.1, TIBCO Managed File Transfer Internet Server: versions 8.3.1 and below, and TIBCO Managed File Transfer Internet Server: versions 8.4.0 and 8.4.1.
Problem types: description: Successful execution of this vulnerability can result in unauthorized update, insert or delete access to data on the affected system and associated resources.
Affected products: vendor: TIBCO Software Inc.
product: TIBCO Managed File Transfer Command Center
vendor: TIBCO Software Inc.
product: TIBCO Managed File Transfer Command Center
vendor: TIBCO Software Inc.
product: TIBCO Managed File Transfer Internet Server
vendor: TIBCO Software Inc.
product: TIBCO Managed File Transfer Internet Server
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 8.6
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
version: 3.1
Credits: lang: en
value: TIBCO would like to extend its appreciation to Niv Levy for discovery of this vulnerability.
Published: 2022-05-10T17:00:20.130Z
CVE-2022-22775 TIBCO ActiveMatrix BPM Reflected Cross Site Scripting (XSS) vulnerability
The Workspace client component of TIBCO Software Inc.'s TIBCO BPM Enterprise and TIBCO BPM Enterprise Distribution for TIBCO Silver Fabric contains difficult to exploit Reflected Cross Site Scripting (XSS) vulnerabilities that allow low privileged attackers with network access to execute scripts targeting the affected system or the victim's local system. Affected releases are TIBCO Software Inc.'s TIBCO BPM Enterprise: versions 4.3.1 and below and TIBCO BPM Enterprise Distribution for TIBCO Silver Fabric: versions 4.3.1 and below.
Problem types: description: In the worst case, if the victim is a privileged administrator, successful execution of these vulnerabilities can result in an attacker gaining full administrative access to the affected system.
Affected products: vendor: TIBCO Software Inc.
product: TIBCO BPM Enterprise
vendor: TIBCO Software Inc.
product: TIBCO BPM Enterprise Distribution for TIBCO Silver Fabric
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
version: 3.1
Published: 2022-05-17T17:30:14.875Z
CVE-2022-22776 TIBCO BusinessConnect Trading Community Management Stored Cross Site Scripting Vulnerability
The Web Server component of TIBCO Software Inc.'s TIBCO BusinessConnect Trading Community Management contains easily exploitable vulnerabilities that allows a low privileged attacker with network access to execute Stored Cross Site Scripting (XSS) on the affected system. A successful attack using these vulnerabilities requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.'s TIBCO BusinessConnect Trading Community Management: versions 6.1.0 and below.
Problem types: description: In the worst case, if the victim is a privileged administrator, successful execution of these vulnerabilities can result in an attacker gaining full administrative access to the affected system.
Affected products: vendor: TIBCO Software Inc.
product: TIBCO BusinessConnect Trading Community Management
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Published: 2022-05-18T17:00:16.324Z
CVE-2022-22777 TIBCO BusinessConnect Trading Community Management Reflected Cross Site Scripting Vulnerability
The Web Server component of TIBCO Software Inc.'s TIBCO BusinessConnect Trading Community Management contains easily exploitable Reflected Cross Site Scripting (XSS) vulnerabilities that allow an unauthenticated attacker with network access to execute scripts targeting the affected system or the victim's local system. Affected releases are TIBCO Software Inc.'s TIBCO BusinessConnect Trading Community Management: versions 6.1.0 and below.
Problem types: description: Successful execution of this vulnerability can result in an attacker gaining partial access to the affected system and can result in unauthorized read, update, insert or delete access to a subset of resources.
Affected products: vendor: TIBCO Software Inc.
product: TIBCO BusinessConnect Trading Community Management
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Published: 2022-05-18T17:00:17.717Z
CVE-2022-22778 TIBCO BusinessConnect Trading Community Management Cross-Site Request Forgery Vulnerability
The Web Server component of TIBCO Software Inc.'s TIBCO BusinessConnect Trading Community Management contains an easily exploitable vulnerability that allows an unauthenticated attacker with network access to execute Cross-Site Request Forgery (CSRF) on the affected system. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.'s TIBCO BusinessConnect Trading Community Management: versions 6.1.0 and below.
Problem types: description: In the worst case, if the victim is a privileged administrator, successful execution of these vulnerabilities can result in an attacker gaining full administrative access to the affected system.
Affected products: vendor: TIBCO Software Inc.
product: TIBCO BusinessConnect Trading Community Management
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Published: 2022-05-18T17:00:19.096Z
CVE-2022-22779 Retained exploded messages in Keybase clients for macOS and Windows
The Keybase Clients for macOS and Windows before version 5.9.0 fails to properly remove exploded messages initiated by a user. This can occur if the receiving user switches to a non-chat feature and places the host in a sleep state before the sending user explodes the messages. This could lead to disclosure of sensitive information which was meant to be deleted from a user’s filesystem.
Problem types: description: Improper Enforcement of Behavioral Workflow
Affected products: vendor: Zoom Video Communications Inc
product: Keybase Client for macOS
vendor: Zoom Video Communications Inc
product: Keybase Client for Windows
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 3.7
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: Olivia O'Hara
Published: 2022-02-09T22:05:15.143Z
CVE-2022-22780 Zoom Chat Susceptible to Zip Bombing
The Zoom Client for Meetings chat functionality was susceptible to Zip bombing attacks in the following product versions: Android before version 5.8.6, iOS before version 5.9.0, Linux before version 5.8.6, macOS before version 5.7.3, and Windows before version 5.6.3. This could lead to availability issues on the client host by exhausting system resources.
Problem types: description: Allocation of Resources Without Limits or Throttling
Affected products: vendor: Zoom Video Communications Inc
product: Zoom Client for Meetings for Android
vendor: Zoom Video Communications Inc
product: Zoom Client for Meetings for iOS
vendor: Zoom Video Communications Inc
product: Zoom Client for Meetings for Linux
vendor: Zoom Video Communications Inc
product: Zoom Client for Meetings for macOS
vendor: Zoom Video Communications Inc
product: Zoom Client for Meetings for Windows
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 4.7
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:L
version: 3.1
Credits: lang: en
value: Johnny Yu of Walmart Global Tech
Published: 2022-02-09T22:05:15.893Z
CVE-2022-22781 Update package downgrade in Zoom Client for Meetings for MacOS
The Zoom Client for Meetings for MacOS (Standard and for IT Admin) prior to version 5.9.6 failed to properly check the package version during the update process. This could lead to a malicious actor updating an unsuspecting user’s currently installed version to a less secure version.
Problem types: description: Use of Less Trusted Source
Affected products: vendor: Zoom Video Communications Inc
product: Zoom Client for Meetings for MacOS (Standard and for IT Admin)
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Patrick Wardle of Objective-See
Published: 2022-04-28T14:59:42.884Z