rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-34021 
Multiple Cross Site Scripting (XSS) vulnerabilities in ResIOT IOT Platform + LoRaWAN Network Server through 4.1.1000114 via the form fields.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-13T00:00:00.000Z
CVE-2022-34022 
SQL injection vulnerability in ResIOT IOT Platform + LoRaWAN Network Server through 4.1.1000114 via a crafted POST request to /ResiotQueryDBActive.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-13T00:00:00.000Z
CVE-2022-34023 
Barangay Management System v1.0 was discovered to contain a SQL injection vulnerability via the hidden_id parameter at /officials/officials.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-19T16:49:12.000Z
CVE-2022-34024 
Barangay Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via the resident module editing function at /bmis/pages/resident/resident.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-19T17:18:15.000Z
CVE-2022-34025 
Vesta v1.0.0-5 was discovered to contain a cross-site scripting (XSS) vulnerability via the post function at /web/api/v1/upload/UploadHandler.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-19T18:20:00.000Z
CVE-2022-34026 
ICEcoder v8.1 allows attackers to execute a directory traversal.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-22T17:01:47.000Z
CVE-2022-34027 
Nginx NJS v0.7.4 was discovered to contain a segmentation violation via njs_value_property at njs_value.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-18T20:14:12.000Z
CVE-2022-34028 
Nginx NJS v0.7.5 was discovered to contain a segmentation violation via njs_utf8_next at src/njs_utf8.h.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-18T20:14:13.000Z
CVE-2022-34029 
Nginx NJS v0.7.4 was discovered to contain an out-of-bounds read via njs_scope_value at njs_scope.h.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-18T20:14:14.000Z
CVE-2022-34030 
Nginx NJS v0.7.5 was discovered to contain a segmentation violation via njs_djb_hash at src/njs_djb_hash.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-18T20:14:15.000Z
CVE-2022-34031 
Nginx NJS v0.7.5 was discovered to contain a segmentation violation via njs_value_to_number at src/njs_value_conversion.h.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-18T20:14:16.000Z
CVE-2022-34032 
Nginx NJS v0.7.5 was discovered to contain a segmentation violation in the function njs_value_own_enumerate at src/njs_value.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-18T20:14:17.000Z
CVE-2022-34033 
HTMLDoc v1.9.15 was discovered to contain a heap overflow via (write_header) /htmldoc/htmldoc/html.cxx:273.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-18T20:14:18.000Z
CVE-2022-34035 
HTMLDoc v1.9.12 and below was discovered to contain a heap overflow via e_node htmldoc/htmldoc/html.cxx:588.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-18T20:14:20.000Z
CVE-2022-34037 
An out-of-bounds read in the rewrite function at /modules/caddyhttp/rewrite/rewrite.go in Caddy v2.5.1 allows attackers to cause a Denial of Service (DoS) via a crafted URI. Note: This has been disputed as a bug, not a security vulnerability, in the Caddy web server that emerged when an administrator's bad configuration containing a malformed request URI caused the server to return an empty reply instead of a valid HTTP response to the client.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-22T00:00:00.000Z
CVE-2022-34038 
Etcd v3.5.4 allows remote attackers to cause a denial of service via function PageWriter.write in pagewriter.go. NOTE: the vendor's position is that this is not a vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-22T00:00:00.000Z
CVE-2022-34042 
Barangay Management System v1.0 was discovered to contain a SQL injection vulnerability via the hidden_id parameter at /pages/household/household.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-20T16:06:22.000Z
CVE-2022-34043 
Incorrect permissions for the folder C:\ProgramData\NoMachine\var\uninstall of Nomachine v7.9.2 allows attackers to perform a DLL hijacking attack and execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-29T12:25:32.000Z
CVE-2022-34045 
Wavlink WN530HG4 M30HG4.V5030.191116 was discovered to contain a hardcoded encryption/decryption key for its configuration files at /etc_ro/lighttpd/www/cgi-bin/ExportAllSettings.sh.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-20T16:50:09.000Z
CVE-2022-34046 
An access control issue in Wavlink WN533A8 M33A8.V5030.190716 allows attackers to obtain usernames and passwords via view-source:http://IP_ADDRESS/sysinit.shtml?r=52300 and searching for [logincheck(user);].
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-20T16:50:17.000Z
CVE-2022-34047 
An access control issue in Wavlink WN530HG4 M30HG4.V5030.191116 allows attackers to obtain usernames and passwords via view-source:http://IP_ADDRESS/set_safety.shtml?r=52300 and searching for [var syspasswd].
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-20T16:50:11.000Z
CVE-2022-34048 
Wavlink WN533A8 M33A8.V5030.190716 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the login_page parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-20T16:50:11.000Z
CVE-2022-34049 
An access control issue in Wavlink WN530HG4 M30HG4.V5030.191116 allows unauthenticated attackers to download log files and configuration data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-20T16:50:12.000Z
CVE-2022-34053 
The DR-Web-Engine package in PyPI v0.2.0b0 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-24T20:39:47.000Z
CVE-2022-34054 
The Perdido package in PyPI v0.0.1 to v0.0.2 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-24T20:39:48.000Z
CVE-2022-34055 
The drxhello package in PyPI v0.0.1 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-24T20:39:48.000Z
CVE-2022-34056 
The Watertools package in PyPI v0.0.0 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-24T20:39:49.000Z
CVE-2022-34057 
The Scoptrial package in PyPI version v0.0.5 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-24T20:39:49.000Z
CVE-2022-34059 
The Sixfab-Tool in PyPI v0.0.2 to v0.0.3 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-24T20:39:52.000Z
CVE-2022-34060 
The Togglee package in PyPI version v0.0.8 was discovered to contain a code execution backdoor. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-24T20:39:53.000Z
CVE-2022-34061 
The Catly-Translate package in PyPI v0.0.3 to v0.0.5 was discovered to contain a code execution backdoor. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-24T20:39:54.000Z
CVE-2022-34064 
The Zibal package in PyPI v1.0.0 was discovered to contain a code execution backdoor. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-24T20:39:54.000Z
CVE-2022-34065 
The Rondolu-YT-Concate package in PyPI v0.1.0 was discovered to contain a code execution backdoor. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-24T20:39:55.000Z
CVE-2022-34066 
The Texercise package in PyPI v0.0.1 to v0.0.12 was discovered to contain a code execution backdoor. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-24T20:39:56.000Z
CVE-2022-34067 
Warehouse Management System v1.0 was discovered to contain a SQL injection vulnerability via the cari parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-26T12:57:12.000Z
CVE-2022-34092 
Portal do Software Publico Brasileiro i3geo v7.0.5 was discovered to contain a cross-site scripting (XSS) vulnerability via svg2img.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-14T21:24:23.000Z
CVE-2022-34093 
Portal do Software Publico Brasileiro i3geo v7.0.5 was discovered to contain a cross-site scripting (XSS) vulnerability via access_token.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-14T21:24:23.000Z
CVE-2022-34094 
Portal do Software Publico Brasileiro i3geo v7.0.5 was discovered to contain a cross-site scripting (XSS) vulnerability via request_token.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-14T21:24:24.000Z
CVE-2022-34100 
A vulnerability was discovered in the Crestron AirMedia Windows Application, version 4.3.1.39, in which a low-privileged user can gain a SYSTEM level command prompt by pre-staging a file structure prior to the installation of a trusted service executable and change permissions on that file structure during a repair operation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-13T18:11:22.000Z
CVE-2022-34101 
A vulnerability was discovered in the Crestron AirMedia Windows Application, version 4.3.1.39, in which a user can place a malicious DLL in a certain path to execute code and preform a privilege escalation attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-13T21:47:01.000Z
CVE-2022-34102 
Insufficient access control vulnerability was discovered in the Crestron AirMedia Windows Application, version 4.3.1.39, in which a user can pause the uninstallation of an executable to gain a SYSTEM level command prompt.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-13T21:42:19.000Z
CVE-2022-34108 
An issue in the Feature Navigator of Micro-Star International MSI Feature Nagivator v1.0.1808.0901 allows attackers to cause a Denial of Service (DoS) via a crafted image or video file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-12T03:57:26.000Z
CVE-2022-34109 
An issue in Micro-Star International MSI Feature Navigator v1.0.1808.0901 allows attackers to write arbitrary files to the directory \PromoPhoto\, regardless of file type or size.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-12T03:58:54.000Z
CVE-2022-34110 
An issue in Micro-Star International MSI Feature Navigator v1.0.1808.0901 allows attackers to download arbitrary files regardless of file type or size.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-12T04:00:06.000Z
CVE-2022-34112 
An access control issue in the component /api/plugin/uninstall Dataease v1.11.1 allows attackers to arbitrarily uninstall the plugin, a right normally reserved for the administrator.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-22T22:17:18.000Z
CVE-2022-34113 
An issue in the component /api/plugin/upload of Dataease v1.11.1 allows attackers to execute arbitrary code via a crafted plugin.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-22T22:17:07.000Z
CVE-2022-34114 
Dataease v1.11.1 was discovered to contain a SQL injection vulnerability via the parameter dataSourceId.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-22T22:17:18.000Z
CVE-2022-34115 
DataEase v1.11.1 was discovered to contain a arbitrary file write vulnerability via the parameter dataSourceId.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-22T22:16:54.000Z
CVE-2022-34120 
Barangay Management System v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the module editing function at /pages/activity/activity.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-27T17:12:16.000Z
CVE-2022-34121 
Cuppa CMS v1.0 was discovered to contain a local file inclusion (LFI) vulnerability via the component /templates/default/html/windows/right.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-27T17:59:54.000Z
CVE-2022-34125 
front/icon.send.php in the CMDB plugin before 3.0.3 for GLPI allows attackers to gain read access to sensitive information via a _log/ pathname in the file parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-16T00:00:00.000Z
CVE-2022-34126 
The Activity plugin before 3.1.1 for GLPI allows reading local files via directory traversal in the front/cra.send.php file parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-16T00:00:00.000Z
CVE-2022-34127 
The Managentities plugin before 4.0.2 for GLPI allows reading local files via directory traversal in the inc/cri.class.php file parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-16T00:00:00.000Z
CVE-2022-34128 
The Cartography (aka positions) plugin before 6.0.1 for GLPI allows remote code execution via PHP code in the POST data to front/upload.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-16T00:00:00.000Z
CVE-2022-34132 
Jorani v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at application/controllers/Leaves.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-27T23:09:55.000Z
CVE-2022-34133 
Jorani v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Comment parameter at application/controllers/Leaves.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-27T23:09:50.000Z
CVE-2022-34134 
Jorani v1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /application/controllers/Users.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-27T23:09:50.000Z
CVE-2022-34138 
Insecure direct object references (IDOR) in the web server of Biltema IP and Baby Camera Software v124 allows attackers to access sensitive information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-03T00:00:00.000Z
CVE-2022-34140 
A stored cross-site scripting (XSS) vulnerability in /index.php?r=site%2Fsignup of Feehi CMS v2.1.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the username field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-27T23:44:01.000Z
CVE-2022-34144 Reachable assertion in Modem
Transient DOS due to reachable assertion in Modem during OSI decode scheduling.
Problem types: cwe_id: CWE-617
description: CWE-617 Reachable Assertion
Affected products: vendor: Qualcomm, Inc.
product: Snapdragon
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2023-05-02T05:08:49.075Z
CVE-2022-34145 Buffer over-read in WLAN Host
Transient DOS due to buffer over-read in WLAN Host while parsing frame information.
Problem types: cwe_id: CWE-126
description: CWE-126 Buffer Over-read
Affected products: vendor: Qualcomm, Inc.
product: Snapdragon
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2023-02-09T06:58:47.544Z
CVE-2022-34146 Improper input validation in WLAN Host
Transient DOS due to improper input validation in WLAN Host while parsing frame during defragmentation.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Qualcomm, Inc.
product: Snapdragon
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2023-02-09T06:58:48.744Z
CVE-2022-34147 
Improper input validation in BIOS firmware for some Intel(R) NUC 9 Extreme Laptop Kits, Intel(R) NUC Performance Kits, Intel(R) NUC Performance Mini PC, Intel(R) NUC 8 Compute Element, Intel(R) NUC Pro Kit, Intel(R) NUC Pro Board, and Intel(R) NUC Compute Element may allow a privileged user to potentially enable escalation of privilege via local access.
Problem types: description: escalation of privilege
cwe_id: CWE-20
description: Improper input validation
Affected products: vendor: n/a
product: Intel(R) NUC 9 Extreme Laptop Kits, Intel(R) NUC Performance Kits, Intel(R) NUC Performance Mini PC, Intel(R) NUC 8 Compute Element, Intel(R) NUC Pro Kit, Intel(R) NUC Pro Board, and Intel(R) NUC Compute Element
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 7.5
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: HIGH
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
Published: 2023-05-10T13:16:45.539Z
CVE-2022-34148 WordPress Backup Guard Plugin <= 1.6.9.0 is vulnerable to Cross Site Scripting (XSS)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in JetBackup JetBackup – WP Backup, Migrate & Restore plugin <= 1.6.9.0 versions.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: JetBackup
product: JetBackup – WP Backup, Migrate & Restore
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.8
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: Muhammad Daffa (Patchstack Alliance)
Published: 2023-03-15T14:59:09.378Z
CVE-2022-34149 WordPress WP OAuth Server plugin <= 3.0.4 - Authentication Bypass vulnerability
Authentication Bypass vulnerability in miniOrange WP OAuth Server plugin <= 3.0.4 at WordPress.
Problem types: cwe_id: CWE-264
description: CWE-264 Permissions, Privileges, and Access Controls
Affected products: vendor: miniOrange
product: WP OAuth Server (WordPress plugin)
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Lana Codes (Patchstack Alliance)
Published: 2022-08-22T14:50:02.430Z
CVE-2022-34150 ICSA-22-200-01 MiCODUS MV720 GPS tracker Authorization Bypass Through User-Controlled Key
The main MiCODUS MV720 GPS tracker web server has an authenticated insecure direct object reference vulnerability on endpoint and parameter device IDs, which accept arbitrary device IDs without further verification.
Problem types: cwe_id: CWE-639
description: CWE-639 Authorization Bypass Through User-Controlled Key
Affected products: vendor: MiCODUS
product: MV720
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
version: 3.1
Credits: lang: en
value: Pedro Umbelino, Dan Dahlberg, and Jacob Olcott of BitSight reported these vulnerabilities to CISA.
Published: 2022-07-20T15:24:09.830Z
CVE-2022-34151 
Use of hard-coded credentials vulnerability exists in Machine automation controller NJ series all models V 1.48 and earlier, Machine automation controller NX7 series all models V1.28 and earlier, Machine automation controller NX1 series all models V1.48 and earlier, Automation software 'Sysmac Studio' all models V1.49 and earlier, and Programmable Terminal (PT) NA series NA5-15W/NA5-12W/NA5-9W/NA5-7W models Runtime V1.15 and earlier, which may allow a remote attacker who successfully obtained the user credentials by analyzing the affected product to access the controller.
Problem types: description: Use of Hard-coded Credentials
Affected products: vendor: OMRON Corporation
product: Machine automation controller NJ series, Machine automation controller NX series, Automation software 'Sysmac Studio', and Programmable Terminal (PT) NA series
Published: 2022-07-04T01:51:00.000Z