rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-34814 
Jenkins Request Rename Or Delete Plugin 1.1.0 and earlier does not correctly perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to view an administrative configuration page listing pending requests.
Affected products: vendor: Jenkins project
product: Jenkins Request Rename Or Delete Plugin
Published: 2022-06-30T17:49:22.000Z
CVE-2022-34815 
A cross-site request forgery (CSRF) vulnerability in Jenkins Request Rename Or Delete Plugin 1.1.0 and earlier allows attackers to accept pending requests, thereby renaming or deleting jobs.
Affected products: vendor: Jenkins project
product: Jenkins Request Rename Or Delete Plugin
Published: 2022-06-30T17:49:28.000Z
CVE-2022-34816 
Jenkins HPE Network Virtualization Plugin 1.0 stores passwords unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system.
Affected products: vendor: Jenkins project
product: Jenkins HPE Network Virtualization Plugin
Published: 2022-06-30T17:49:33.000Z
CVE-2022-34817 
A cross-site request forgery (CSRF) vulnerability in Jenkins Failed Job Deactivator Plugin 1.2.1 and earlier allows attackers to disable jobs.
Affected products: vendor: Jenkins project
product: Jenkins Failed Job Deactivator Plugin
Published: 2022-06-30T17:49:39.000Z
CVE-2022-34818 
Jenkins Failed Job Deactivator Plugin 1.2.1 and earlier does not perform permission checks in several views and HTTP endpoints, allowing attackers with Overall/Read permission to disable jobs.
Affected products: vendor: Jenkins project
product: Jenkins Failed Job Deactivator Plugin
Published: 2022-06-30T17:49:44.000Z
CVE-2022-34819 
A vulnerability has been identified in SIMATIC CP 1242-7 V2 (All versions < V3.3.46), SIMATIC CP 1243-1 (All versions < V3.3.46), SIMATIC CP 1243-7 LTE EU (All versions < V3.3.46), SIMATIC CP 1243-7 LTE US (All versions < V3.3.46), SIMATIC CP 1243-8 IRC (All versions < V3.3.46), SIMATIC CP 1542SP-1 IRC (All versions >= V2.0 < V2.2.28), SIMATIC CP 1543-1 (All versions < V3.0.22), SIMATIC CP 1543SP-1 (All versions >= V2.0 < V2.2.28), SIPLUS ET 200SP CP 1542SP-1 IRC TX RAIL (All versions >= V2.0 < V2.2.28), SIPLUS ET 200SP CP 1543SP-1 ISEC (All versions >= V2.0 < V2.2.28), SIPLUS ET 200SP CP 1543SP-1 ISEC TX RAIL (All versions >= V2.0 < V2.2.28), SIPLUS NET CP 1242-7 V2 (All versions < V3.3.46), SIPLUS NET CP 1543-1 (All versions < V3.0.22), SIPLUS S7-1200 CP 1243-1 (All versions < V3.3.46), SIPLUS S7-1200 CP 1243-1 RAIL (All versions < V3.3.46). The application lacks proper validation of user-supplied data when parsing specific messages. This could result in a heap-based buffer overflow. An attacker could leverage this vulnerability to execute code in the context of device.
Problem types: cwe_id: CWE-122
description: CWE-122: Heap-based Buffer Overflow
Affected products: vendor: Siemens
product: SIMATIC CP 1242-7 V2
default_status: unknown
vendor: Siemens
product: SIMATIC CP 1243-1
default_status: unknown
vendor: Siemens
product: SIMATIC CP 1243-7 LTE EU
default_status: unknown
vendor: Siemens
product: SIMATIC CP 1243-7 LTE US
default_status: unknown
vendor: Siemens
product: SIMATIC CP 1243-8 IRC
default_status: unknown
vendor: Siemens
product: SIMATIC CP 1542SP-1 IRC
default_status: unknown
vendor: Siemens
product: SIMATIC CP 1543-1
default_status: unknown
vendor: Siemens
product: SIMATIC CP 1543SP-1
default_status: unknown
vendor: Siemens
product: SIPLUS ET 200SP CP 1542SP-1 IRC TX RAIL
default_status: unknown
vendor: Siemens
product: SIPLUS ET 200SP CP 1543SP-1 ISEC
default_status: unknown
vendor: Siemens
product: SIPLUS ET 200SP CP 1543SP-1 ISEC TX RAIL
default_status: unknown
vendor: Siemens
product: SIPLUS NET CP 1242-7 V2
default_status: unknown
vendor: Siemens
product: SIPLUS NET CP 1543-1
default_status: unknown
vendor: Siemens
product: SIPLUS S7-1200 CP 1243-1
default_status: unknown
vendor: Siemens
product: SIPLUS S7-1200 CP 1243-1 RAIL
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C
baseScore: 10
baseSeverity: CRITICAL
Published: 2022-07-12T10:07:27.000Z
CVE-2022-34820 
A vulnerability has been identified in SIMATIC CP 1242-7 V2 (All versions < V3.3.46), SIMATIC CP 1243-1 (All versions < V3.3.46), SIMATIC CP 1243-7 LTE EU (All versions < V3.3.46), SIMATIC CP 1243-7 LTE US (All versions < V3.3.46), SIMATIC CP 1243-8 IRC (All versions < V3.3.46), SIMATIC CP 1542SP-1 IRC (All versions >= V2.0 < V2.2.28), SIMATIC CP 1543-1 (All versions < V3.0.22), SIMATIC CP 1543SP-1 (All versions >= V2.0 < V2.2.28), SIPLUS ET 200SP CP 1542SP-1 IRC TX RAIL (All versions >= V2.0 < V2.2.28), SIPLUS ET 200SP CP 1543SP-1 ISEC (All versions >= V2.0 < V2.2.28), SIPLUS ET 200SP CP 1543SP-1 ISEC TX RAIL (All versions >= V2.0 < V2.2.28), SIPLUS NET CP 1242-7 V2 (All versions < V3.3.46), SIPLUS NET CP 1543-1 (All versions < V3.0.22), SIPLUS S7-1200 CP 1243-1 (All versions < V3.3.46), SIPLUS S7-1200 CP 1243-1 RAIL (All versions < V3.3.46). The application does not correctly escape some user provided fields during the authentication process. This could allow an attacker to inject custom commands and execute arbitrary code with elevated privileges.
Problem types: cwe_id: CWE-77
description: CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
Affected products: vendor: Siemens
product: SIMATIC CP 1242-7 V2
default_status: unknown
vendor: Siemens
product: SIMATIC CP 1243-1
default_status: unknown
vendor: Siemens
product: SIMATIC CP 1243-7 LTE EU
default_status: unknown
vendor: Siemens
product: SIMATIC CP 1243-7 LTE US
default_status: unknown
vendor: Siemens
product: SIMATIC CP 1243-8 IRC
default_status: unknown
vendor: Siemens
product: SIMATIC CP 1542SP-1 IRC
default_status: unknown
vendor: Siemens
product: SIMATIC CP 1543-1
default_status: unknown
vendor: Siemens
product: SIMATIC CP 1543SP-1
default_status: unknown
vendor: Siemens
product: SIPLUS ET 200SP CP 1542SP-1 IRC TX RAIL
default_status: unknown
vendor: Siemens
product: SIPLUS ET 200SP CP 1543SP-1 ISEC
default_status: unknown
vendor: Siemens
product: SIPLUS ET 200SP CP 1543SP-1 ISEC TX RAIL
default_status: unknown
vendor: Siemens
product: SIPLUS NET CP 1242-7 V2
default_status: unknown
vendor: Siemens
product: SIPLUS NET CP 1543-1
default_status: unknown
vendor: Siemens
product: SIPLUS S7-1200 CP 1243-1
default_status: unknown
vendor: Siemens
product: SIPLUS S7-1200 CP 1243-1 RAIL
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C
baseScore: 8.4
baseSeverity: HIGH
Published: 2022-07-12T10:07:29.000Z
CVE-2022-34822 
Path traversal vulnerability in CLUSTERPRO X 5.0 for Windows and earlier, EXPRESSCLUSTER X 5.0 for Windows and earlier, CLUSTERPRO X 5.0 SingleServerSafe for Windows and earlier, EXPRESSCLUSTER X 5.0 SingleServerSafe for Windows and earlier allows a remote unauthenticated attacker to overwrite existing files on the file system and to potentially execute arbitrary code.
Problem types: description: Path traversal
Affected products: vendor: NEC Corporation
product: CLUSTERPRO X
Published: 2022-11-08T00:00:00.000Z
CVE-2022-34823 
Buffer overflow vulnerability in CLUSTERPRO X 5.0 for Windows and earlier, EXPRESSCLUSTER X 5.0 for Windows and earlier, CLUSTERPRO X 5.0 SingleServerSafe for Windows and earlier, EXPRESSCLUSTER X 5.0 SingleServerSafe for Windows and earlier allows a remote unauthenticated attacker to overwrite existing files on the file system and to potentially execute arbitrary code.
Problem types: description: Buffer overflow
Affected products: vendor: NEC Corporation
product: CLUSTERPRO X
Published: 2022-11-08T00:00:00.000Z
CVE-2022-34824 
Weak File and Folder Permissions vulnerability in CLUSTERPRO X 5.0 for Windows and earlier, EXPRESSCLUSTER X 5.0 for Windows and earlier, CLUSTERPRO X 5.0 SingleServerSafe for Windows and earlier, EXPRESSCLUSTER X 5.0 SingleServerSafe for Windows and earlier allows a remote unauthenticated attacker to overwrite existing files on the file system and to potentially execute arbitrary code.
Problem types: description: Weak File and Folder Permissions
Affected products: vendor: NEC Corporation
product: CLUSTERPRO X
Published: 2022-11-08T00:00:00.000Z
CVE-2022-34825 
Uncontrolled Search Path Element in CLUSTERPRO X 5.0 for Windows and earlier, EXPRESSCLUSTER X 5.0 for Windows and earlier, CLUSTERPRO X 5.0 SingleServerSafe for Windows and earlier, EXPRESSCLUSTER X 5.0 SingleServerSafe for Windows and earlier allows a remote unauthenticated attacker to overwrite existing files on the file system and to potentially execute arbitrary code.
Problem types: description: Uncontrolled Search Path Element
Affected products: vendor: NEC Corporation
product: CLUSTERPRO X
Published: 2022-11-08T00:00:00.000Z
CVE-2022-34826 
In Couchbase Server 7.1.x before 7.1.1, an encrypted Private Key passphrase may be leaked in the logs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-15T11:29:46.000Z
CVE-2022-34827 
Carel Boss Mini 1.5.0 has Improper Access Control.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-18T00:00:00.000Z
CVE-2022-34829 
Zoho ManageEngine ADSelfService Plus before 6203 allows a denial of service (application restart) via a crafted payload to the Mobile App Deployment API.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-04T19:25:01.000Z
CVE-2022-34830 
An Arm product family through 2022-06-29 has a TOCTOU Race Condition that allows non-privileged user to make improper GPU processing operations to gain access to already freed memory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-23T00:00:00.000Z
CVE-2022-34831 
An issue was discovered in Keyfactor PrimeKey EJBCA before 7.9.0, related to possible inconsistencies in DNS identifiers submitted in an ACME order and the corresponding CSR submitted during finalization. During the ACME enrollment process, an order is submitted containing an identifier for one or multiple dnsNames. These are validated properly in the ACME challenge. However, if the validation passes, a non-compliant client can include additional dnsNames the CSR sent to the finalize endpoint, resulting in EJBCA issuing a certificate including the identifiers that were not validated. This occurs even if the certificate profile is configured to not allow a DN override by the CSR.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-14T02:58:52.000Z
CVE-2022-34832 
An issue was discovered in VERMEG AgileReporter 21.3. XXE can occur via an XML document to the Analysis component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-27T00:00:00.000Z
CVE-2022-34833 
An issue was discovered in VERMEG AgileReporter 21.3. An admin can enter an XSS payload in the Analysis component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-27T00:00:00.000Z
CVE-2022-34834 
An issue was discovered in VERMEG AgileReporter 21.3. Attackers can gain privileges via an XSS payload in an Add Comment action to the Activity log.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-27T00:00:00.000Z
CVE-2022-34835 
In Das U-Boot through 2022.07-rc5, an integer signedness error and resultant stack-based buffer overflow in the "i2c md" command enables the corruption of the return address pointer of the do_i2c_md function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-29T23:48:51.000Z
CVE-2022-34836 ABB Ability TM Operations Data Management Zenon Zenon Log Server file access control
Relative Path Traversal vulnerability in ABB Zenon 8.20 allows the user to access files on the Zenon system and user also can add own log messages and e.g., flood the log entries. An attacker who successfully exploit the vulnerability could access the Zenon runtime activities such as the start and stop of various activity and the last error code etc.
Problem types: cwe_id: CWE-23
description: CWE-23 Relative Path Traversal
Affected products: vendor: ABB
product: ABB Zenon
CVSS v3.1: attackComplexity: HIGH
attackVector: ADJACENT_NETWORK
availabilityImpact: NONE
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
version: 3.1
Credits: lang: en
value: ABB thanks Ruben Santamarta for helping to identify the vulnerabilities and protecting our customers
Published: 2022-08-24T15:15:00.271Z
CVE-2022-34837 ABB Ability TM Operations Data Management Zenon Zenon Log Server file access control
Storing Passwords in a Recoverable Format vulnerability in ABB Zenon 8.20 allows an attacker who successfully exploit the vulnerability may add more network clients that may monitor various activities of the Zenon.
Problem types: cwe_id: CWE-257
description: CWE-257 Storing Passwords in a Recoverable Format
Affected products: vendor: ABB
product: ABB Zenon
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 6.2
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L
version: 3.1
Credits: lang: en
value: ABB thanks Ruben Santamarta for helping to identify the vulnerabilities and protecting our customers
Published: 2022-08-24T15:14:33.829Z
CVE-2022-34838 ABB Ability TM Operations Data Management Zenon Zenon Log Server file access control
Storing Passwords in a Recoverable Format vulnerability in ABB Zenon 8.20 allows an attacker who successfully exploit the vulnerability may add or alter data points and corresponding attributes. Once such engineering data is used the data visualization will be altered for the end user.
Problem types: cwe_id: CWE-257
description: CWE-257 Storing Passwords in a Recoverable Format
Affected products: vendor: ABB
product: ABB Zenon
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: ABB thanks Ruben Santamarta for helping to identify the vulnerabilities and protecting our customers
Published: 2022-08-24T15:15:26.256Z
CVE-2022-34839 WordPress WP OAuth2 Server plugin <= 1.0.1 - Authentication Bypass vulnerability
Authentication Bypass vulnerability in CodexShaper's WP OAuth2 Server plugin <= 1.0.1 at WordPress.
Problem types: description: Bypass
Affected products: vendor: CodexShaper
product: WP OAuth2 Server (WordPress plugin)
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Vulnerability discovered by Lana Codes (Patchstack Alliance)
Published: 2022-07-22T16:44:40.359Z
CVE-2022-34840 
Use of hard-coded credentials vulnerability in multiple Buffalo network devices allows a network-adjacent attacker to alter?configuration settings of the device. The affected products/versions are as follows: WZR-300HP firmware Ver. 2.00 and earlier, WZR-450HP firmware Ver. 2.00 and earlier, WZR-600DHP firmware Ver. 2.00 and earlier, WZR-900DHP firmware Ver. 1.15 and earlier, HW-450HP-ZWE firmware Ver. 2.00 and earlier, WZR-450HP-CWT firmware Ver. 2.00 and earlier, WZR-450HP-UB firmware Ver. 2.00 and earlier, WZR-600DHP2 firmware Ver. 1.15 and earlier, and WZR-D1100H firmware Ver. 2.00 and earlier.
Problem types: description: Use of hard-coded credentials
Affected products: vendor: BUFFALO INC.
product: Buffalo network devices
Published: 2022-12-07T00:00:00.000Z
CVE-2022-34841 
Improper buffer restrictions in the Intel(R) Media SDK software before version 22.2.2 may allow an authenticated user to potentially enable escalation of privilege via local access.
Problem types: description: escalation of privilege
Affected products: vendor: n/a
product: Intel(R) Media SDK software
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 5.7
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: LOW
Published: 2023-02-16T20:00:15.646Z
CVE-2022-34843 
Integer overflow in the Intel(R) Trace Analyzer and Collector software before version 2021.5 may allow an authenticated user to potentially enable escalation of privilege via local access.
Problem types: description: escalation of privilege
Affected products: vendor: n/a
product: Intel(R) Trace Analyzer and Collector software
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 4.8
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: LOW
Published: 2023-02-16T20:00:18.697Z
CVE-2022-34844 BIG-IP and BIG-IQ AWS vulnerability CVE-2022-34844
In BIG-IP Versions 16.1.x before 16.1.3.1 and 15.1.x before 15.1.6.1, and all versions of BIG-IQ 8.x, when the Data Plane Development Kit (DPDK)/Elastic Network Adapter (ENA) driver is used with BIG-IP or BIG-IQ on Amazon Web Services (AWS) systems, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Successful exploitation relies on conditions outside of the attacker's control. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: F5
product: BIG-IP
vendor: F5
product: BIG-IQ Centralized Management
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2022-08-04T17:47:44.666Z
CVE-2022-34845 
A firmware update vulnerability exists in the sysupgrade functionality of Robustel R1510 3.1.16 and 3.3.0. A specially-crafted network packet can lead to arbitrary firmware update. An attacker can send a sequence of requests to trigger this vulnerability.
Problem types: cwe_id: CWE-345
description: CWE-345: Insufficient Verification of Data Authenticity
Affected products: vendor: Robustel
product: R1510
Published: 2022-10-25T16:33:59.090Z
CVE-2022-34848 
Uncontrolled search path for the Intel(R) NUC Pro Software Suite before version 2.0.0.3 may allow an authenticated user to potentially enable escalation of privilege via local access.
Problem types: description: escalation of privilege
cwe_id: CWE-427
description: Uncontrolled search path
Affected products: vendor: n/a
product: Intel(R) NUC Pro Software Suite
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 6.7
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
Published: 2023-05-10T13:16:58.587Z
CVE-2022-34849 
Uncaught exception in the Intel(R) Iris(R) Xe MAX drivers for Windows before version 100.0.5.1436(v2) may allow a privileged user to potentially enable denial of service via local access.
Problem types: description: denial of service
Affected products: vendor: n/a
product: Intel(R) Iris(R) Xe MAX drivers for Windows
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 4.4
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
Published: 2023-02-16T20:00:08.528Z
CVE-2022-34850 
An OS command injection vulnerability exists in the web_server /action/import_authorized_keys/ functionality of Robustel R1510 3.1.16 and 3.3.0. A specially-crafted network request can lead to arbitrary command execution. An attacker can send a sequence of requests to trigger this vulnerability.
Problem types: cwe_id: CWE-78
description: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: Robustel
product: R1510
Published: 2022-10-25T16:34:00.059Z
CVE-2022-34851 BIG-IP and BIG-IQ iControl SOAP vulnerability CVE-2022-34851
In BIG-IP Versions 17.0.x before 17.0.0.1, 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5.1, and all versions of 13.1.x, and BIG-IQ Centralized Management all versions of 8.x, an authenticated attacker may cause iControl SOAP to become unavailable through undisclosed requests. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: F5
product: BIG-IP
vendor: F5
product: BIG-IQ Centralized Management
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
version: 3.1
Credits: lang: en
value: F5 acknowledges the KITRI BOB Team for bringing this issue to our attention and following the highest standards of coordinated disclosure.  KITRI BOB Team: Jeong Su Hwan, Kim Dong Jun, Jung Min Woo, Jang Min Ki, Lee Jung Woo, Heo Seung Hwan
Published: 2022-08-04T17:47:58.281Z
CVE-2022-34853 WordPress Team plugin <= 1.2.6 - Multiple Authenticated Persistent Cross-Site Scripting (XSS) vulnerabilities
Multiple Authenticated (contributor or higher user role) Persistent Cross-Site Scripting (XSS) vulnerabilities in wpWax Team plugin <= 1.2.6 at WordPress.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: wpWax
product: Team (WordPress plugin)
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.1
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: Vulnerability discovered by m0ze (Patchstack)
Published: 2022-07-22T16:49:34.810Z
CVE-2022-34854 
Improper access control in the Intel(R) SUR software before version 2.4.8902 may allow an authenticated user to potentially enable escalation of privilege via local access.
Problem types: description: escalation of privilege
Affected products: vendor: n/a
product: Intel(R) SUR software
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 6.7
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
Published: 2023-02-16T20:00:12.038Z