rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-22782 Local privilege escalation in Windows Zoom Clients
The Zoom Client for Meetings for Windows prior to version 5.9.7, Zoom Rooms for Conference Room for Windows prior to version 5.10.0, Zoom Plugins for Microsoft Outlook for Windows prior to version 5.10.3, and Zoom VDI Windows Meeting Clients prior to version 5.9.6; was susceptible to a local privilege escalation issue during the installer repair operation. A malicious actor could utilize this to potentially delete system level files or folders, causing integrity or availability issues on the user’s host machine.
Problem types: description: Incorrect Privilege Assignment
Affected products: vendor: Zoom Video Communications Inc
product: Zoom Client for Meetings for Windows
vendor: Zoom Video Communications Inc
product: Zoom Rooms for Conference Room for Windows
vendor: Zoom Video Communications Inc
product: Zoom Plugins for Microsoft Outlook for Windows
vendor: Zoom Video Communications Inc
product: Zoom VDI Windows Meeting Clients
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.9
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H
version: 3.1
Credits: lang: en
value: Zero Day Initiative
Published: 2022-04-28T15:00:14.188Z
CVE-2022-22783 Process memory exposure in Zoom on-premise Meeting services
A vulnerability in Zoom On-Premise Meeting Connector Controller version 4.8.102.20220310 and On-Premise Meeting Connector MMR version 4.8.102.20220310 exposes process memory fragments to connected clients, which could be observed by a passive attacker.
Problem types: description: Missing Initialization of a Variable
Affected products: vendor: Zoom Video Communications Inc
product: Zoom On-Premise Meeting Connector Controller
vendor: Zoom Video Communications Inc
product: Zoom On-Premise Meeting Connector MMR
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Zoom Offensive Security Team
Published: 2022-04-28T15:00:36.785Z
CVE-2022-22784 Improper XML Parsing in Zoom Client for Meetings
The Zoom Client for Meetings (for Android, iOS, Linux, MacOS, and Windows) before version 5.10.0 failed to properly parse XML stanzas in XMPP messages. This can allow a malicious user to break out of the current XMPP message context and create a new message context to have the receiving users client perform a variety of actions.This issue could be used in a more sophisticated attack to forge XMPP messages from the server.
Problem types: description: Improper Input Validation
Affected products: vendor: Zoom Video Communications Inc
product: Zoom Client for Meetings for Android
vendor: Zoom Video Communications Inc
product: Zoom Client for Meetings for iOS
vendor: Zoom Video Communications Inc
product: Zoom Client for Meetings for Linux
vendor: Zoom Video Communications Inc
product: Zoom Client for Meetings for MacOS
vendor: Zoom Video Communications Inc
product: Zoom Client for Meetings for Windows
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
version: 3.1
Credits: lang: en
value: Ivan Fratric of Google Project Zero
Published: 2022-05-18T15:41:50.592Z
CVE-2022-22785 Improperly constrained session cookies in Zoom Client for Meetings
The Zoom Client for Meetings (for Android, iOS, Linux, MacOS, and Windows) before version 5.10.0 failed to properly constrain client session cookies to Zoom domains. This issue could be used in a more sophisticated attack to send an unsuspecting users Zoom-scoped session cookies to a non-Zoom domain. This could potentially allow for spoofing of a Zoom user.
Problem types: description: Exposure of Resource to Wrong Sphere
Affected products: vendor: Zoom Video Communications Inc
product: Zoom Client for Meetings for Android
vendor: Zoom Video Communications Inc
product: Zoom Client for Meetings for iOS
vendor: Zoom Video Communications Inc
product: Zoom Client for Meetings for Linux
vendor: Zoom Video Communications Inc
product: Zoom Client for Meetings for MacOS
vendor: Zoom Video Communications Inc
product: Zoom Client for Meetings for Windows
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:L
version: 3.1
Credits: lang: en
value: Ivan Fratric of Google Project Zero
Published: 2022-05-18T15:42:19.156Z
CVE-2022-22786 Update package downgrade in Zoom Client for Meetings for Windows
The Zoom Client for Meetings for Windows before version 5.10.0 and Zoom Rooms for Conference Room for Windows before version 5.10.0, fails to properly check the installation version during the update process. This issue could be used in a more sophisticated attack to trick a user into downgrading their Zoom client to a less secure version.
Problem types: description: Use of Less Trusted Source
Affected products: vendor: Zoom Video Communications Inc
product: Zoom Client for Meetings for Windows
vendor: Zoom Video Communications Inc
product: Zoom Rooms for Conference Room for Windows
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Ivan Fratric of Google Project Zero
Published: 2022-05-18T15:42:46.414Z
CVE-2022-22787 Insufficient hostname validation during Clusterswitch message in Zoom Client for Meetings
The Zoom Client for Meetings (for Android, iOS, Linux, macOS, and Windows) before version 5.10.0 fails to properly validate the hostname during a server switch request. This issue could be used in a more sophisticated attack to trick an unsuspecting users client to connect to a malicious server when attempting to use Zoom services.
Problem types: description: Improper Input Validation
Affected products: vendor: Zoom Video Communications Inc
product: Zoom Client for Meetings for Android
vendor: Zoom Video Communications Inc
product: Zoom Client for Meetings for iOS
vendor: Zoom Video Communications Inc
product: Zoom Client for Meetings for Linux
vendor: Zoom Video Communications Inc
product: Zoom Client for Meetings for MacOS
vendor: Zoom Video Communications Inc
product: Zoom Client for Meetings for Windows
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:L
version: 3.1
Credits: lang: en
value: Ivan Fratric of Google Project Zero
Published: 2022-05-18T16:03:18.179Z
CVE-2022-22788 DLL injection in Zoom Opener installer for Zoom and Zoom Rooms clients
The Zoom Opener installer is downloaded by a user from the Launch meeting page, when attempting to join a meeting without having the Zoom Meeting Client installed. The Zoom Opener installer for Zoom Client for Meetings before version 5.10.3 and Zoom Rooms for Conference Room for Windows before version 5.10.3 are susceptible to a DLL injection attack. This vulnerability could be used to run arbitrary code on the victims host.
Problem types: description: Uncontrolled Search Path Element
Affected products: vendor: Zoom Video Communications Inc
product: Zoom Client for Meetings
vendor: Zoom Video Communications Inc
product: All Zoom Rooms for Conference Room for Windows
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Reported by James Tsz Ko Yeung
Published: 2022-06-15T20:12:24.369Z
CVE-2022-22789 Charactell - FormStorm Enterprise Account Take Over
Charactell - FormStorm Enterprise Account takeover – An attacker can modify (add, remove and update) passwords file for all the users. The xx_users.ini file in the FormStorm folder contains usernames in cleartext and an obfuscated password. Malicious user can take over an account by replacing existing password in the file.
Problem types: description: Account Take Over
Affected products: vendor: Charactell
product: FormStorm Enterprise
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 6.1
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L
version: 3.1
Credits: lang: en
value: Michael Starchenko
Published: 2022-01-25T19:11:08.000Z
CVE-2022-22790 SYNEL - eharmony Directory Traversal
SYNEL - eharmony Directory Traversal. Directory Traversal - is an attack against a server or a Web application aimed at unauthorized access to the file system. on the "Name" parameter the attacker can return to the root directory and open the host file. The path exposes sensitive files that users upload
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 5.6
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N
version: 3.1
Credits: lang: en
value: Dudu Moyal & Gad Abuhatziera - Sophtix Security LTD
Published: 2022-01-28T19:09:51.000Z
CVE-2022-22791 SYNEL - eharmony Authenticated Blind & Stored XSS
SYNEL - eharmony Authenticated Blind & Stored XSS. Inject JS code into the "comments" field could lead to potential stealing of cookies, loading of HTML tags and JS code onto the system.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 6.6
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
version: 3.1
Credits: lang: en
value: Moriel Harush - Sophtix Security LTD
Published: 2022-01-28T19:09:52.000Z
CVE-2022-22792 MobiSoft - MobiPlus User Take Over and Improper Handling of url Parameters
MobiSoft - MobiPlus User Take Over and Improper Handling of url Parameters Attacker can navigate to specific url which will expose all the users and password in clear text. http://IP/MobiPlusWeb/Handlers/MainHandler.ashx?MethodName=GridData&amp;GridName=Users
Problem types: cwe_id: CWE-233
description: CWE-233 Improper Handling of url Parameters
Affected products: vendor: MobiSoft
product: eharmony
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 6.6
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L
version: 3.1
Credits: lang: en
value: Dudu Moyal - Sophtix Security LTD
Published: 2022-02-16T16:38:07.784Z
CVE-2022-22793 Cybonet - PineApp Mail Relay Local File Inclusion
Cybonet - PineApp Mail Relay Local File Inclusion. Attacker can send a request to : /manage/mailpolicymtm/log/eml_viewer/email.content.body.php?filesystem_path=ENCDODED PATH and by doing that, the attacker can read Local Files inside the server.
Problem types: description: Local File Inclusion
Affected products: vendor: Cybonet
product: Pineapp Mail Relay
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.1
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:H
version: 3.1
Credits: lang: en
value: Dudu Moyal - Sophtix Security LTD
Published: 2022-02-24T16:14:16.769Z
CVE-2022-22794 Cybonet - PineApp Mail Relay Unauthenticated Sql Injection
Cybonet - PineApp Mail Relay Unauthenticated Sql Injection. Attacker can send a request to: /manage/emailrichment/userlist.php?CUSTOMER_ID_INNER=1 /admin/emailrichment/userlist.php?CUSTOMER_ID_INNER=1 /manage/emailrichment/usersunlist.php?CUSTOMER_ID_INNER=1 /admin/emailrichment/usersunlist.php?CUSTOMER_ID_INNER=1 and by doing that, the attacker can run Remote Code Execution in one liner.
Problem types: description: Unauthenticated Sql Injection to Remote Code Execution.
Affected products: vendor: Cybonet
product: Pineapp Mail Relay
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.8
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:H
version: 3.1
Credits: lang: en
value: Dudu Moyal - Sophtix Security LTD
lang: en
value: Gad Abuhatzeira - Sophtix Security LTD
Published: 2022-02-24T16:14:15.767Z
CVE-2022-22795 Signiant - Manager+Agents XML External Entity (XXE)
Signiant - Manager+Agents XML External Entity (XXE) - Extract internal files of the affected machine An attacker can read all the system files, the product is running with root on Linux systems and nt/authority on windows systems, which allows him to access and extract any file on the systems, such as passwd, shadow, hosts and so on. By gaining access to these files, attackers can steal sensitive information from the victims machine.
Problem types: cwe_id: CWE-611
description: CWE-611 Improper Restriction of XML External Entity Reference ('XXE')
Affected products: vendor: Signiant
product: Signiant
CVSS v3.1: attackComplexity: HIGH
attackVector: PHYSICAL
availabilityImpact: HIGH
baseScore: 6.8
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:P/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Anton Golotin
Published: 2022-03-09T14:56:32.876Z
CVE-2022-22796 Sysaid – Sysaid System Takeover
Sysaid – Sysaid System Takeover - An attacker can bypass the authentication process by accessing to: /wmiwizard.jsp, Then to: /ConcurrentLogin.jsp, then click on the login button, and it will redirect you to /home.jsp without any authentication.
Problem types: description: System Take Over
Affected products: vendor: SysAid
product: Sysaid
vendor: SysAid
product: Sysaid
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: LOW
baseScore: 7
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L
version: 3.1
Credits: lang: en
value: Dudu Moyal, Gad Abuhatziera, Moriel Harush, Alon Zuker - Sophtix Security LTD
Published: 2022-05-12T19:47:32.643Z
CVE-2022-22797 Sysaid – sysaid Open Redirect
Sysaid – sysaid Open Redirect - An Attacker can change the redirect link at the parameter "redirectURL" from"GET" request from the url location: /CommunitySSORedirect.jsp?redirectURL=https://google.com. Unvalidated redirects and forwards are possible when a web application accepts untrusted input that could cause the web application to redirect the request to a URL contained within untrusted input. By modifying untrusted URL input to a malicious site, an attacker may successfully launch a phishing scam and steal user credentials.
Problem types: cwe_id: CWE-601
description: CWE-601 URL Redirection to Untrusted Site ('Open Redirect')
Affected products: vendor: SysAid
product: Sysaid
vendor: SysAid
product: Sysaid
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 4.6
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: Moriel Harush - Sophtix Security LTD
Published: 2022-05-12T19:48:08.939Z
CVE-2022-22798 Sysaid – Pro Plus Edition, SysAid Help Desk Broken Access Control
Sysaid – Pro Plus Edition, SysAid Help Desk Broken Access Control v20.4.74 b10, v22.1.20 b62, v22.1.30 b49 - An attacker needs to log in as a guest after that the system redirects him to the service portal or EndUserPortal.JSP, then he needs to change the path in the URL to /ConcurrentLogin%2ejsp after that he will receive an error message with a login button, by clicking on it, he will connect to the system dashboard. The attacker can receive sensitive data like server details, usernames, workstations, etc. He can also perform actions such as uploading files, deleting calls from the system.
Problem types: description: Broken Access Control
Affected products: vendor: SysAid
product: Sysaid
vendor: SysAid
product: Sysaid
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 6.8
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L
version: 3.1
Credits: lang: en
value: Gad Abuhatzeira, Alon Zuker - Sophtix Security LTD
Published: 2022-05-12T19:48:42.372Z
CVE-2022-22804 
A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could allow an authenticated attacker to view data, change settings, or impact availability of the software when the user visits a page containing the injected payload. Affected Product: EcoStruxure Power Monitoring Expert (Versions 2020 and prior)
Problem types: cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: n/a
product: EcoStruxure Power Monitoring Expert (Versions 2020 and prior)
Published: 2022-02-04T22:29:39.000Z
CVE-2022-22805 
A CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability exists that could cause remote code execution when an improperly handled TLS packet is reassembled. Affected Product: SmartConnect Family: SMT Series (SMT Series ID=1015: UPS 04.5 and prior), SMC Series (SMC Series ID=1018: UPS 04.2 and prior), SMTL Series (SMTL Series ID=1026: UPS 02.9 and prior), SCL Series (SCL Series ID=1029: UPS 02.5 and prior / SCL Series ID=1030: UPS 02.5 and prior / SCL Series ID=1036: UPS 02.5 and prior / SCL Series ID=1037: UPS 03.1 and prior), SMX Series (SMX Series ID=1031: UPS 03.1 and prior)
Problem types: cwe_id: CWE-120
description: CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Affected products: vendor: Schneider Electric
product: SmartConnect
Published: 2022-03-09T19:30:16.000Z
CVE-2022-22806 
A CWE-294: Authentication Bypass by Capture-replay vulnerability exists that could cause an unauthenticated connection to the UPS when a malformed connection is sent. Affected Product: SmartConnect Family: SMT Series (SMT Series ID=1015: UPS 04.5 and prior), SMC Series (SMC Series ID=1018: UPS 04.2 and prior), SMTL Series (SMTL Series ID=1026: UPS 02.9 and prior), SCL Series (SCL Series ID=1029: UPS 02.5 and prior / SCL Series ID=1030: UPS 02.5 and prior / SCL Series ID=1036: UPS 02.5 and prior / SCL Series ID=1037: UPS 03.1 and prior), SMX Series (SMX Series ID=1031: UPS 03.1 and prior)
Problem types: cwe_id: CWE-294
description: CWE-294 Authentication Bypass by Capture-replay
Affected products: vendor: Schneider Electric
product: SmartConnect
Published: 2022-03-09T19:30:17.000Z
CVE-2022-22807 
A CWE-1021 Improper Restriction of Rendered UI Layers or Frames vulnerability exists that could cause unintended modifications of the product settings or user accounts when deceiving the user to use the web interface rendered within iframes. Affected Product: EcoStruxure EV Charging Expert (formerly known as EVlink Load Management System): (HMIBSCEA53D1EDB, HMIBSCEA53D1EDS, HMIBSCEA53D1EDM, HMIBSCEA53D1EDL, HMIBSCEA53D1ESS, HMIBSCEA53D1ESM, HMIBSCEA53D1EML) (All Versions prior to SP8 (Version 01) V4.0.0.13)
Problem types: cwe_id: CWE-1021
description: CWE-1021 Improper Restriction of Rendered UI Layers or Frames
Affected products: vendor: n/a
product: EcoStruxure EV Charging Expert (formerly known as EVlink Load Management System): (HMIBSCEA53D1EDB, HMIBSCEA53D1EDS, HMIBSCEA53D1EDM, HMIBSCEA53D1EDL, HMIBSCEA53D1ESS, HMIBSCEA53D1ESM, HMIBSCEA53D1EML) (All Versions prior to SP8 (Version 01) V4.0.0.13)
Published: 2022-02-09T00:00:00.000Z
CVE-2022-22808 
A CWE-352: Cross-Site Request Forgery (CSRF) exists that could cause a remote attacker to gain unauthorized access to the product when conducting cross-domain attacks based on same-origin policy or cross-site request forgery protections bypass. Affected Product: EcoStruxure EV Charging Expert (formerly known as EVlink Load Management System): (HMIBSCEA53D1EDB, HMIBSCEA53D1EDS, HMIBSCEA53D1EDM, HMIBSCEA53D1EDL, HMIBSCEA53D1ESS, HMIBSCEA53D1ESM, HMIBSCEA53D1EML) (All Versions prior to SP8 (Version 01) V4.0.0.13)
Problem types: cwe_id: CWE-352
description: CWE-352: Cross-Site Request Forgery (CSRF)
Affected products: vendor: n/a
product: EcoStruxure EV Charging Expert (formerly known as EVlink Load Management System): (HMIBSCEA53D1EDB, HMIBSCEA53D1EDS, HMIBSCEA53D1EDM, HMIBSCEA53D1EDL, HMIBSCEA53D1ESS, HMIBSCEA53D1ESM, HMIBSCEA53D1EML) (All Versions prior to SP8 (Version 01) V4.0.0.13)
Published: 2022-02-09T00:00:00.000Z
CVE-2022-22809 
A CWE-306: Missing Authentication for Critical Function vulnerability exists that could allow modifications of the touch configurations in an unauthorized manner when an attacker attempts to modify the touch configurations. Affected Product: spaceLYnk (V2.6.2 and prior), Wiser for KNX (formerly homeLYnk) (V2.6.2 and prior), fellerLYnk (V2.6.2 and prior)
Problem types: cwe_id: CWE-306
description: CWE-306: Missing Authentication for Critical Function
Affected products: vendor: n/a
product: spaceLYnk (V2.6.2 and prior), Wiser for KNX (formerly homeLYnk) (V2.6.2 and prior), fellerLYnk (V2.6.2 and prior)
Published: 2022-02-09T00:00:00.000Z
CVE-2022-22810 
A CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could allow an attacker to manipulate the admin after numerous attempts at guessing credentials. Affected Product: spaceLYnk (V2.6.2 and prior), Wiser for KNX (formerly homeLYnk) (V2.6.2 and prior), fellerLYnk (V2.6.2 and prior)
Problem types: cwe_id: CWE-307
description: CWE-307: Improper Restriction of Excessive Authentication Attempts
Affected products: vendor: n/a
product: spaceLYnk (V2.6.2 and prior), Wiser for KNX (formerly homeLYnk) (V2.6.2 and prior), fellerLYnk (V2.6.2 and prior)
Published: 2022-02-09T22:05:07.000Z
CVE-2022-22811 
A CWE-352: Cross-Site Request Forgery (CSRF) vulnerability exists that could induce users to perform unintended actions, leading to the override of the system�s configurations when an attacker persuades a user to visit a rogue website. Affected Product: spaceLYnk (V2.6.2 and prior), Wiser for KNX (formerly homeLYnk) (V2.6.2 and prior), fellerLYnk (V2.6.2 and prior)
Problem types: cwe_id: CWE-352
description: CWE-352: Cross-Site Request Forgery (CSRF)
Affected products: vendor: n/a
product: spaceLYnk (V2.6.2 and prior), Wiser for KNX (formerly homeLYnk) (V2.6.2 and prior), fellerLYnk (V2.6.2 and prior)
Published: 2022-02-09T22:05:08.000Z