rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-25980 Delta Electronics DIAEnergie SQL Injection in HandlerCommon.ashx
Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability that exists in HandlerCommon.ashx. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system commands.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Delta Electronics
product: DIAEnergie
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Michael Heinzl and Dusan Stevanovic of Trend Micro’s Zero Day Initiative reported these vulnerabilities to CISA.
Published: 2022-03-29T16:37:03.370Z
CVE-2022-25986 
Browse restriction bypass vulnerability in Scheduler of Cybozu Office 10.0.0 to 10.8.5 allows a remote authenticated attacker to obtain the data of Scheduler.
Problem types: description: Improper Access Control
Affected products: vendor: Cybozu, Inc.
product: Cybozu Office
Published: 2022-08-18T07:10:27.000Z
CVE-2022-25987 
Improper handling of Unicode encoding in source code to be compiled by the Intel(R) C++ Compiler Classic before version 2021.6 for Intel(R) oneAPI Toolkits before version 2022.2 may allow an unauthenticated user to potentially enable escalation of privilege via network access.
Problem types: description: escalation of privilege
Affected products: vendor: n/a
product: Intel(R) C++ Compiler Classic
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 8.3
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
Published: 2023-02-16T19:59:43.645Z
CVE-2022-25989 
An authentication bypass vulnerability exists in the libxm_av.so getpeermac() functionality of Anker Eufy Homebase 2 2.1.8.5h. A specially-crafted DHCP packet can lead to authentication bypass. An attacker can DHCP poison to trigger this vulnerability.
Problem types: cwe_id: CWE-290
description: CWE-290: Authentication Bypass by Spoofing
Affected products: vendor: Anker
product: Eufy Homebase 2
Published: 2022-05-05T17:35:09.869Z
CVE-2022-25990 
On 1.0.x versions prior to 1.0.1, systems running F5OS-A software may expose certain registry ports externally. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
Problem types: cwe_id: CWE-200
description: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: F5
product: F5OS-A
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Published: 2022-05-05T16:22:13.962Z
CVE-2022-25992 
Insecure inherited permissions in the Intel(R) oneAPI Toolkits oneapi-cli before version 0.2.0 may allow an authenticated user to potentially enable escalation of privilege via local access.
Problem types: description: escalation of privilege
Affected products: vendor: n/a
product: Intel(R) oneAPI Toolkits oneapi-cli
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 7.5
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
Published: 2023-02-16T19:59:44.883Z
CVE-2022-25995 
A command execution vulnerability exists in the console inhand functionality of InHand Networks InRouter302 V3.5.4. A specially-crafted network request can lead to arbitrary command execution. An attacker can send a sequence of requests to trigger this vulnerability.
Problem types: cwe_id: CWE-489
description: CWE-489: Leftover Debug Code
Affected products: vendor: InHand Networks
product: InRouter302
Published: 2022-05-12T17:01:36.120Z
CVE-2022-25996 
A stack-based buffer overflow vulnerability exists in the confsrv addTimeGroup functionality of TCL LinkHub Mesh Wi-Fi MS1G_00_01.00_14. A specially-crafted network packet can lead to a buffer overflow. An attacker can send a malicious packet to trigger this vulnerability.
Problem types: cwe_id: CWE-121
description: CWE-121: Stack-based Buffer Overflow
Affected products: vendor: TCL
product: LinkHub Mesh Wifi
Published: 2022-08-05T21:17:52.741Z
CVE-2022-25999 
Uncontrolled search path element in the Intel(R) Enpirion(R) Digital Power Configurator GUI software, all versions may allow an authenticated user to potentially enable escalation of privilege via local access.
Problem types: description: escalation of privilege
Affected products: vendor: n/a
product: version
Published: 2022-08-18T19:56:15.000Z
CVE-2022-26002 
A stack-based buffer overflow vulnerability exists in the console factory functionality of InHand Networks InRouter302 V3.5.4. A specially-crafted network request can lead to remote code execution. An attacker can send a sequence of malicious packets to trigger this vulnerability.
Problem types: cwe_id: CWE-121
description: CWE-121: Stack-based Buffer Overflow
Affected products: vendor: InHand Networks
product: InRouter302
Published: 2022-05-12T17:01:37.845Z
CVE-2022-26006 
Improper input validation in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access.
Problem types: description: escalation of privilege
Affected products: vendor: n/a
product: Intel(R) Processors
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 8.2
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Published: 2022-11-11T15:49:10.339Z
CVE-2022-26007 
An OS command injection vulnerability exists in the console factory functionality of InHand Networks InRouter302 V3.5.4. A specially-crafted network request can lead to command execution. An attacker can send a sequence of requests to trigger this vulnerability.
Problem types: cwe_id: CWE-77
description: CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
Affected products: vendor: InHand Networks
product: InRouter302
Published: 2022-05-12T17:01:39.208Z
CVE-2022-26009 
A stack-based buffer overflow vulnerability exists in the confsrv ucloud_set_node_location functionality of TCL LinkHub Mesh Wi-Fi MS1G_00_01.00_14. A specially-crafted network packet can lead to stack-based buffer overflow. An attacker can send a malicious packet to trigger this vulnerability.
Problem types: cwe_id: CWE-121
description: CWE-121: Stack-based Buffer Overflow
Affected products: vendor: TCL
product: LinkHub Mesh Wifi
Published: 2022-08-05T21:18:08.938Z
CVE-2022-26013 Delta Electronics DIAEnergie SQL Injection in DIAE_dmdsetHandler.ashx
Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability that exists in DIAE_dmdsetHandler.ashx. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system commands.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Delta Electronics
product: DIAEnergie
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Michael Heinzl and Dusan Stevanovic of Trend Micro’s Zero Day Initiative reported these vulnerabilities to CISA.
Published: 2022-03-29T16:37:07.369Z
CVE-2022-26017 
Improper access control in the Intel(R) DSA software for before version 22.2.14 may allow an authenticated user to potentially enable escalation of privilege via adjacent access.
Problem types: description: escalation of privilege
Affected products: vendor: n/a
product: Intel(R) DSA software for
Published: 2022-08-18T19:57:44.000Z
CVE-2022-26019 
Improper access control vulnerability in pfSense CE and pfSense Plus (pfSense CE software versions prior to 2.6.0 and pfSense Plus software versions prior to 22.01) allows a remote attacker with the privilege to change NTP GPS settings to rewrite existing files on the file system, which may result in arbitrary command execution.
Problem types: description: Improper Access Control
Affected products: vendor: pfSense
product: pfSense CE and pfSense Plus
Published: 2022-03-31T07:21:31.000Z
CVE-2022-26020 
An information disclosure vulnerability exists in the router configuration export functionality of InHand Networks InRouter302 V3.5.4. A specially-crafted network request can lead to increased privileges. An attacker can send an HTTP request to trigger this vulnerability.
Problem types: cwe_id: CWE-321
description: CWE-321: Use of Hard-coded Cryptographic Key
Affected products: vendor: InHand Networks
product: InRouter302
Published: 2022-05-12T17:01:40.860Z
CVE-2022-26022 Rockwell Automation Studio 5000 Logix Designer Out-of-Bounds Write
Omron CX-Position (versions 2.5.3 and prior) is vulnerable to an out-of-bounds write while processing a specific project file, which may allow an attacker to execute arbitrary code.
Problem types: cwe_id: CWE-787
description: CWE-787 Out-of-bounds Write
Affected products: vendor: Omron
product: CX-Position
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: xina1i, working with Trend Micro’s Zero Day Initiative, reported these vulnerabilities to CISA.
Published: 2022-04-01T22:17:55.227Z
CVE-2022-26023 
A leftover debug code vulnerability exists in the console verify functionality of InHand Networks InRouter302 V3.5.45. A specially-crafted series of network requests can lead to disabling security features. An attacker can send a sequence of requests to trigger this vulnerability.
Problem types: cwe_id: CWE-489
description: CWE-489: Leftover Debug Code
Affected products: vendor: InHand Networks
product: InRouter302
Published: 2022-11-09T17:35:36.028Z
CVE-2022-26024 
Improper access control in the Intel(R) NUC HDMI Firmware Update Tool for NUC7i3DN, NUC7i5DN and NUC7i7DN before version 1.78.2.0.7 may allow an authenticated user to potentially enable escalation of privilege via local access.
Problem types: description: escalation of privilege
Affected products: vendor: n/a
product: Intel(R) NUC HDMI Firmware Update Tool for NUC7i3DN, NUC7i5DN and NUC7i7DN
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 6.7
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Published: 2022-11-11T15:49:14.302Z
CVE-2022-26026 
A denial of service vulnerability exists in the OAS Engine SecureConfigValues functionality of Open Automation Software OAS Platform V16.00.0112. A specially-crafted network request can lead to loss of communications. An attacker can send a network request to trigger this vulnerability.
Problem types: cwe_id: CWE-306
description: CWE-306: Missing Authentication for Critical Function
Affected products: vendor: Open Automation Software
product: OAS Platform
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
Credits: lang: en
value: Discovered by Jared Rittle of Cisco Talos.
Published: 2022-05-25T20:15:19.304Z
CVE-2022-26028 
Uncontrolled search path in the Intel(R) VTune(TM) Profiler software before version 2022.2.0 may allow an authenticated user to potentially enable escalation of privilege via local access.
Problem types: description: escalation of privilege
Affected products: vendor: n/a
product: Intel(R) VTune(TM) Profiler software
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 6.7
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
Published: 2022-11-11T15:49:15.914Z
CVE-2022-26032 
Uncontrolled search path element in the Intel(R) Distribution for Python programming language before version 2022.1 for Intel(R) oneAPI Toolkits may allow an authenticated user to potentially enable escalation of privilege via local access.
Problem types: description: escalation of privilege
Affected products: vendor: n/a
product: Intel(R) Distribution for Python programming language for Intel(R) oneAPI Toolkits
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 6.7
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
Published: 2023-02-16T19:59:49.508Z
CVE-2022-26034 
Improper authentication vulnerability in the communication protocol provided by AD (Automation Design) server of CENTUM VP R6.01.10 to R6.09.00, CENTUM VP Small R6.01.10 to R6.09.00, CENTUM VP Basic R6.01.10 to R6.09.00, and B/M9000 VP R8.01.01 to R8.03.01 allows an attacker to use the functions provided by AD server. This may lead to leakage or tampering of data managed by AD server.
Problem types: description: Improper Authentication
Affected products: vendor: Yokogawa Electric Corporation
product: CENTUM VP series with VP6E5000(AD Suite Engineering ServerFunction) installed and B/M9000 VP
Published: 2022-04-15T01:45:21.000Z
CVE-2022-26041 
Directory traversal vulnerability in RCCMD 4.26 and earlier allows a remote authenticated attacker with an administrative privilege to read or alter an arbitrary file on the server via unspecified vectors.
Problem types: description: Directory traversal
Affected products: vendor: GENEREX SYSTEMS Computervertriebsgesellschaft mbH
product: RCCMD
Published: 2022-06-13T04:50:25.000Z
CVE-2022-26042 
An OS command injection vulnerability exists in the daretools binary functionality of InHand Networks InRouter302 V3.5.4. A specially-crafted network request can lead to arbitrary command execution. An attacker can send a sequence of requests to trigger this vulnerability.
Problem types: cwe_id: CWE-77
description: CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
Affected products: vendor: InHand Networks
product: InRouter302
Published: 2022-05-12T17:01:42.301Z
CVE-2022-26043 
An external config control vulnerability exists in the OAS Engine SecureAddSecurity functionality of Open Automation Software OAS Platform V16.00.0112. A specially-crafted series of network requests can lead to the creation of a custom Security Group. An attacker can send a sequence of requests to trigger this vulnerability.
Problem types: cwe_id: CWE-306
description: CWE-306: Missing Authentication for Critical Function
Affected products: vendor: Open Automation Software
product: OAS Platform
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: HIGH
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
Credits: lang: en
value: Discovered by Jared Rittle of Cisco Talos.
Published: 2022-05-25T20:15:20.808Z
CVE-2022-26045 
Improper buffer restrictions in some Intel(R) XMM(TM) 7560 Modem software before version M2_7560_R_01.2146.00 may allow a privileged user to potentially enable escalation of privilege via physical access.
Problem types: description: escalation of privilege
Affected products: vendor: n/a
product: Intel(R) XMM(TM) 7560 Modem software
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 3.3
baseSeverity: LOW
vectorString: CVSS:3.1/AV:P/AC:H/PR:H/UI:N/S:C/C:N/I:L/A:L
Published: 2022-11-11T15:48:48.801Z
CVE-2022-26047 
Improper input validation for some Intel(R) PROSet/Wireless WiFi, Intel vPro(R) CSME WiFi and Killer(TM) WiFi products may allow unauthenticated user to potentially enable denial of service via local access.
Problem types: description: denial of service
Affected products: vendor: n/a
product: Intel(R) PROSet/Wireless WiFi, Intel vPro(R) CSME WiFi and Killer(TM) WiFi products
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 4.3
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Published: 2022-11-11T15:49:13.792Z
CVE-2022-26049 Arbitrary File Write via Archive Extraction (Zip Slip)
This affects the package com.diffplug.gradle:goomph before 3.37.2. It allows a malicious zip file to potentially break out of the expected destination directory, writing contents into arbitrary locations on the file system. Overwriting certain files/directories could allow an attacker to achieve remote code execution on a target system by exploiting this vulnerability. **Note:** This could have allowed a malicious zip file to extract itself into an arbitrary directory. The only file that Goomph extracts is the p2 bootstrapper and eclipse metadata files hosted at eclipse.org, which are not malicious, so the only way this vulnerability could have affected you is if you had set a custom bootstrap zip, and that zip was malicious.
Problem types: description: Arbitrary File Write via Archive Extraction (Zip Slip)
Affected products: vendor: n/a
product: com.diffplug.gradle:goomph
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
version: 3.1
Credits: lang: en
value: Jonathan Leitschuh
Published: 2022-09-11T13:45:15.592Z
CVE-2022-26051 
Operation restriction bypass vulnerability in Portal of Cybozu Garoon 4.0.0 to 5.5.1 allows a remote authenticated attacker to alter the data of Portal.
Problem types: description: Improper Authorization
Affected products: vendor: Cybozu, Inc.
product: Cybozu Garoon
Published: 2022-07-04T06:55:34.000Z
CVE-2022-26052 
Uncontrolled search path element in the Intel(R) MPI Library before version 2021.6 for Intel(R) oneAPI HPC Toolkit may allow an authenticated user to potentially enable escalation of privilege via local access.
Problem types: description: escalation of privilege
Affected products: vendor: n/a
product: Intel(R) MPI Library for Intel(R) oneAPI HPC Toolkit
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 6.7
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
Published: 2023-02-16T19:59:50.826Z
CVE-2022-26054 
Operation restriction bypass vulnerability in Link of Cybozu Garoon 4.0.0 to 5.5.1 allows a remote authenticated attacker to alter the data of Link.
Problem types: description: Improper Authorization
Affected products: vendor: Cybozu, Inc.
product: Cybozu Garoon
Published: 2022-07-04T06:55:39.000Z
CVE-2022-26057 Mint WorkBench Link Following Local Privilege Escalation Vulnerability
Vulnerabilities in the Mint WorkBench allow a low privileged attacker to create and write to a file anywhere on the file system as SYSTEM with arbitrary content as long as the file does not already exist. The Mint WorkBench installer file allows a low-privileged user to run a "repair" operation on the product
Problem types: cwe_id: CWE-269
description: CWE-269 Improper Privilege Management
Affected products: vendor: ABB
product: Mint WorkBench
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.7
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: This vulnerability was discovered by Michael DePlante (@izobashi) of Trend Micro Zero Day Initiative. ABB appreciates their actions to keep our products safe for our customers.
Published: 2022-06-15T18:47:01.086Z
CVE-2022-26059 Delta Electronics DIAEnergie SQL Injection in GetQueryData
Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability that exists in GetQueryData. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system commands.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Delta Electronics
product: DIAEnergie
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Michael Heinzl and Dusan Stevanovic of Trend Micro’s Zero Day Initiative reported these vulnerabilities to CISA.
Published: 2022-03-29T16:37:01.122Z
CVE-2022-26061 
A heap-based buffer overflow vulnerability exists in the gif2h5 functionality of HDF5 Group libhdf5 1.10.4. A specially-crafted GIF file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability.
Problem types: cwe_id: CWE-122
description: CWE-122: Heap-based Buffer Overflow
Affected products: vendor: HDF5 Group
product: libhdf5
Published: 2022-08-22T18:21:43.633Z
CVE-2022-26062 
Uncontrolled search path element in the Intel(R) Trace Analyzer and Collector before version 2021.6 for Intel(R) oneAPI HPC Toolkit may allow an authenticated user to potentially enable escalation of privilege via local access.
Problem types: description: escalation of privilege
Affected products: vendor: n/a
product: Intel(R) Trace Analyzer and Collector for Intel(R) oneAPI HPC Toolkit 
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 6.7
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
Published: 2023-02-16T19:59:46.697Z
CVE-2022-26065 Delta Electronics DIAEnergie SQL Injection in GetLatestDemandNode and GetDemandAnalysisData
Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in GetLatestDemandNode. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system commands.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Delta Electronics
product: DIAEnergie
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Michael Heinzl and Dusan Stevanovic of Trend Micro’s Zero Day Initiative reported these vulnerabilities to CISA.
Published: 2022-03-29T16:37:08.222Z