rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-26529 Realtek Linux/Android Bluetooth Mesh SDK - Buffer Overflow
Realtek Linux/Android Bluetooth Mesh SDK has a buffer overflow vulnerability due to insufficient validation for segmented packets’ link parameter. An unauthenticated attacker in the adjacent network can exploit this vulnerability to cause buffer overflow and disrupt service.
Problem types: cwe_id: CWE-120
description: CWE-120 Buffer Overflow
Affected products: vendor: Realtek
product: Linux/Android Bluetooth Mesh SDK
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2022-08-30T04:25:26.637Z
CVE-2022-26530 
swaylock before 1.6 allows attackers to trigger a crash and achieve unlocked access to a Wayland compositor.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-03T22:11:23.000Z
CVE-2022-26531 
Multiple improper input validation flaws were identified in some CLI commands of Zyxel USG/ZyWALL series firmware versions 4.09 through 4.71, USG FLEX series firmware versions 4.50 through 5.21, ATP series firmware versions 4.32 through 5.21, VPN series firmware versions 4.30 through 5.21, NSG series firmware versions 1.00 through 1.33 Patch 4, NXC2500 firmware version 6.10(AAIG.3) and earlier versions, NAP203 firmware version 6.25(ABFA.7) and earlier versions, NWA50AX firmware version 6.25(ABYW.5) and earlier versions, WAC500 firmware version 6.30(ABVS.2) and earlier versions, and WAX510D firmware version 6.30(ABTF.2) and earlier versions, that could allow a local authenticated attacker to cause a buffer overflow or a system crash via a crafted payload.
Problem types: cwe_id: CWE-20
description: CWE-20: Improper Input Validation
Affected products: vendor: Zyxel
product: USG/ZyWALL series firmware
vendor: Zyxel
product: USG FLEX series firmware
vendor: Zyxel
product: ATP series firmware
vendor: Zyxel
product: VPN series firmware
vendor: Zyxel
product: NSG series firmware
vendor: Zyxel
product: NXC2500 firmware
vendor: Zyxel
product: NAP203 firmware
vendor: Zyxel
product: NWA50AX firmware
vendor: Zyxel
product: WAC500 firmware
vendor: Zyxel
product: WAX510D firmware
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: LOW
availabilityImpact: HIGH
baseScore: 6.1
baseSeverity: MEDIUM
Published: 2022-05-24T00:00:00.000Z
CVE-2022-26532 
A argument injection vulnerability in the 'packet-trace' CLI command of Zyxel USG/ZyWALL series firmware versions 4.09 through 4.71, USG FLEX series firmware versions 4.50 through 5.21, ATP series firmware versions 4.32 through 5.21, VPN series firmware versions 4.30 through 5.21, NSG series firmware versions 1.00 through 1.33 Patch 4, NXC2500 firmware version 6.10(AAIG.3) and earlier versions, NAP203 firmware version 6.25(ABFA.7) and earlier versions, NWA50AX firmware version 6.25(ABYW.5) and earlier versions, WAC500 firmware version 6.30(ABVS.2) and earlier versions, and WAX510D firmware version 6.30(ABTF.2) and earlier versions, that could allow a local authenticated attacker to execute arbitrary OS commands by including crafted arguments to the CLI command.
Problem types: cwe_id: CWE-88
description: CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Affected products: vendor: Zyxel
product: USG/ZyWALL series firmware
vendor: Zyxel
product: USG FLEX series firmware
vendor: Zyxel
product: ATP series firmware
vendor: Zyxel
product: VPN series firmware
vendor: Zyxel
product: NSG series firmware
vendor: Zyxel
product: NXC2500 firmware
vendor: Zyxel
product: NAP203 firmware
vendor: Zyxel
product: NWA50AX firmware
vendor: Zyxel
product: WAC500 firmware
vendor: Zyxel
product: WAX510D firmware
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2022-05-24T05:20:09.000Z
CVE-2022-26533 
Alist v2.1.0 and below was discovered to contain a cross-site scripting (XSS) vulnerability via /i/:data/ipa.plist.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-12T00:29:32.000Z
CVE-2022-26534 
FISCO-BCOS release-3.0.0-rc2 was discovered to contain an issue where a malicious node, via a malicious viewchange packet, will cause normal nodes to change view excessively and stop generating blocks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-16T23:02:08.000Z
CVE-2022-26536 
Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/setFixTools.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-23T23:24:59.000Z
CVE-2022-26546 
Hospital Management System v1.0 was discovered to lack an authorization component, allowing attackers to access sensitive information and obtain the admin password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-31T20:18:44.000Z
CVE-2022-26555 
A stored cross-site scripting (XSS) vulnerability in the Add a Button function of Eova v1.6.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the button name text box.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-20T18:35:01.000Z
CVE-2022-26562 
An issue in provider/libserver/ECKrbAuth.cpp of Kopano Core <= v11.0.2.51 contains an issue which allows attackers to authenticate even if the user account or password is expired. It also exists in the predecessor Zarafa Collaboration Platform (ZCP) in provider/libserver/ECPamAuth.cpp of Zarafa >= 6.30 (introduced between 6.30.0 RC1e and 6.30.8 final).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-01T00:00:00.000Z
CVE-2022-26563 
An issue was discovered in Tildeslash Monit before 5.31.0, allows remote attackers to gain escilated privlidges due to improper PAM-authorization.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-07-18T00:00:00.000Z
CVE-2022-26564 
HotelDruid Hotel Management Software v3.0.3 contains a cross-site scripting (XSS) vulnerability via the prezzoperiodo4 parameter in creaprezzi.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-26T22:30:17.000Z
CVE-2022-26565 
A cross-site scripting (XSS) vulnerability in Totaljs all versions before commit 95f54a5commit, allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Page Name text field when creating a new page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-01T21:24:11.000Z
CVE-2022-26572 
Xerox ColorQube 8580 was discovered to contain an access control issue which allows attackers to print, view the status, and obtain sensitive information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-04T18:31:13.000Z
CVE-2022-26573 
Maccms v10 was discovered to contain multiple reflected cross-site scripting (XSS) vulnerabilities in /admin.php/admin/art/data.html via the select and input parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-25T18:50:12.000Z
CVE-2022-26579 
PAX A930 device with PayDroid_7.1.1_Virgo_V04.3.26T1_20210419 can allow a root privileged attacker to install unsigned packages. The attacker must have shell access to the device and gain root privileges in order to exploit this vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-16T00:00:00.000Z
CVE-2022-26580 
PAX A930 device with PayDroid_7.1.1_Virgo_V04.3.26T1_20210419 can allow the execution of specific command injections on selected binaries in the ADB daemon shell service. The attacker must have physical USB access to the device in order to exploit this vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-16T00:00:00.000Z
CVE-2022-26581 
PAX A930 device with PayDroid_7.1.1_Virgo_V04.3.26T1_20210419 can allow an unauthorized attacker to perform privileged actions through the execution of specific binaries listed in ADB daemon. The attacker must have physical USB access to the device in order to exploit this vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-16T00:00:00.000Z
CVE-2022-26582 
PAX A930 device with PayDroid_7.1.1_Virgo_V04.3.26T1_20210419 can allow an attacker to gain root access through command injection in systool client. The attacker must have shell access to the device in order to exploit this vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-16T00:00:00.000Z
CVE-2022-26585 
Mingsoft MCMS v5.2.7 was discovered to contain a SQL injection vulnerability via /cms/content/list.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-05T00:16:57.000Z
CVE-2022-26588 
A Cross-Site Request Forgery (CSRF) in IceHrm 31.0.0.OS allows attackers to delete arbitrary users or achieve account takeover via the app/service.php URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-08T20:12:28.000Z
CVE-2022-26589 
A Cross-Site Request Forgery (CSRF) in Pluck CMS v4.7.15 allows attackers to delete arbitrary pages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-12T23:32:09.000Z
CVE-2022-26591 
FANTEC GmbH MWiD25-DS Firmware v2.000.030 allows unauthenticated attackers to access and download arbitrary files via a crafted GET request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-06T19:42:27.000Z
CVE-2022-26592 
Stack Overflow vulnerability in libsass 3.6.5 via the CompoundSelector::has_real_parent_ref function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-22T00:00:00.000Z
CVE-2022-26593 
Cross-site scripting (XSS) vulnerability in the Asset module's asset categories selector in Liferay Portal 7.3.3 through 7.4.0, and Liferay DXP 7.3 before service pack 3 allows remote attackers to inject arbitrary web script or HTML via the name of a asset category.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-19T12:46:15.000Z
CVE-2022-26594 
Multiple cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.3.5 through 7.4.0, and Liferay DXP 7.3 before service pack 3 allow remote attackers to inject arbitrary web script or HTML via a form field's help text to (1) Forms module's form builder, or (2) App Builder module's object form view's form builder.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-15T15:50:26.000Z
CVE-2022-26595 
Liferay Portal 7.3.7, 7.4.0, and 7.4.1, and Liferay DXP 7.2 fix pack 13, and 7.3 fix pack 2 does not properly check user permission when accessing a list of sites/groups, which allows remote authenticated users to view sites/groups via the user's site membership assignment UI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-19T12:52:20.000Z
CVE-2022-26596 
Cross-site scripting (XSS) vulnerability in Journal module's web content display configuration page in Liferay Portal 7.1.0 through 7.3.3, and Liferay DXP 7.0 before fix pack 94, 7.1 before fix pack 19, and 7.2 before fix pack 8, allows remote attackers to inject arbitrary web script or HTML via web content template names.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-25T15:41:28.000Z
CVE-2022-26597 
Cross-site scripting (XSS) vulnerability in the Layout module's Open Graph integration in Liferay Portal 7.3.0 through 7.4.0, and Liferay DXP 7.3 before service pack 3 allows remote attackers to inject arbitrary web script or HTML via the site name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-25T15:02:53.000Z
CVE-2022-26605 
eZiosuite v2.0.7 contains an authenticated arbitrary file upload via the Avatar upload functionality.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-06T20:14:36.000Z
CVE-2022-26607 
A remote code execution (RCE) vulnerability in baigo CMS v3.0-alpha-2 was discovered to allow attackers to execute arbitrary code via uploading a crafted PHP file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-06T20:29:48.000Z
CVE-2022-26612 Arbitrary file write in FileUtil#unpackEntries on Windows
In Apache Hadoop, The unTar function uses unTarUsingJava function on Windows and the built-in tar utility on Unix and other OSes. As a result, a TAR entry may create a symlink under the expected extraction directory which points to an external directory. A subsequent TAR entry may extract an arbitrary file into the external directory using the symlink name. This however would be caught by the same targetDirPath check on Unix because of the getCanonicalPath call. However on Windows, getCanonicalPath doesn't resolve symbolic links, which bypasses the check. unpackEntries during TAR extraction follows symbolic links which allows writing outside expected base directory on Windows. This was addressed in Apache Hadoop 3.2.3
Problem types: description: unpackEntries during TAR extraction follows symbolic links which allows writing outside expected base directory on Windows
Affected products: vendor: Apache Software Foundation
product: Apache Hadoop
Credits: lang: en
value: This issue was reported by a member of GitHub Security Lab, Jaroslav Lobačevski (https://github.com/JarLob).
Published: 2022-04-07T18:20:12.000Z
CVE-2022-26613 
PHP-CMS v1.0 was discovered to contain a SQL injection vulnerability via the category parameter in categorymenu.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-06T20:55:28.000Z
CVE-2022-26615 
A cross-site scripting (XSS) vulnerability in College Website Content Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the User Profile Name text fields.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-05T01:18:42.000Z
CVE-2022-26616 
PKP Vendor Open Journal System v2.4.8 to v3.3.8 allows attackers to perform reflected cross-site scripting (XSS) attacks via crafted HTTP headers.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-04T12:24:13.000Z
CVE-2022-26619 
Halo Blog CMS v1.4.17 was discovered to allow attackers to upload arbitrary files via the Attachment Upload function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-05T00:49:49.000Z
CVE-2022-26624 
Bootstrap v3.1.11 and v3.3.7 was discovered to contain a cross-site scripting (XSS) vulnerability via the Title parameter in /vendor/views/add_product.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-08T08:23:33.000Z
CVE-2022-26627 
Online Project Time Management System v1.0 was discovered to contain an arbitrary file write vulnerability which allows attackers to execute arbitrary code via a crafted HTML file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-07T14:24:48.000Z
CVE-2022-26628 
Matrimony v1.0 was discovered to contain a SQL injection vulnerability via the Password parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-05T19:03:00.000Z
CVE-2022-26629 
An Access Control vulnerability exists in SoroushPlus+ Messenger 1.0.30 in the Lock Screen Security Feature function due to insufficient permissions and privileges, which allows a malicious attacker bypass the lock screen function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-24T16:00:37.000Z
CVE-2022-26630 
Jellycms v3.8.1 and below was discovered to contain an arbitrary file upload vulnerability via \app.\admin\Controllers\db.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-05T18:01:11.000Z
CVE-2022-26631 
Automatic Question Paper Generator v1.0 contains a Time-Based Blind SQL injection vulnerability via the id GET parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-18T13:18:14.000Z
CVE-2022-26632 
Multi-Vendor Online Groceries Management System v1.0 was discovered to contain a blind SQL injection vulnerability via the id parameter in /products/view_product.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-20T12:47:58.000Z
CVE-2022-26633 
Simple Student Quarterly Result/Grade System v1.0 was discovered to contain a SQL injection vulnerability via /sqgs/Actions.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-20T12:47:59.000Z
CVE-2022-26634 
HMA VPN v5.3.5913.0 contains an unquoted service path which allows attackers to escalate privileges to the system level.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-20T12:47:59.000Z
CVE-2022-26635 
PHP-Memcached v2.2.0 and below contains an improper NULL termination which allows attackers to execute CLRF injection. Note: Third parties have disputed this as not affecting PHP-Memcached directly.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-05T17:00:33.000Z
CVE-2022-26639 
TP-LINK TL-WR840N(ES)_V6.20 was discovered to contain a buffer overflow via the DNSServers parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-28T22:42:46.000Z
CVE-2022-26640 
TP-LINK TL-WR840N(ES)_V6.20 was discovered to contain a buffer overflow via the minAddress parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-28T22:42:46.000Z
CVE-2022-26641 
TP-LINK TL-WR840N(ES)_V6.20 was discovered to contain a buffer overflow via the httpRemotePort parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-28T22:42:47.000Z
CVE-2022-26642 
TP-LINK TL-WR840N(ES)_V6.20 was discovered to contain a buffer overflow via the X_TP_ClonedMACAddress parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-28T22:42:47.000Z
CVE-2022-26643 
An issue in EasyIO CPT Graphics v0.8 allows attackers to discover valid users in the application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-13T13:28:18.000Z
CVE-2022-26644 
Online Banking System Protect v1.0 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities via parameters on user profile, system_info and accounts management.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-30T22:51:04.000Z
CVE-2022-26645 
A remote code execution (RCE) vulnerability in Online Banking System Protect v1.0 allows attackers to execute arbitrary code via a crafted PHP file uploaded through the Upload Image function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-30T22:23:47.000Z
CVE-2022-26646 
Online Banking System Protect v1.0 was discovered to contain a local file inclusion (LFI) vulnerability via the pages parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-30T22:47:20.000Z
CVE-2022-26650 Apache ShenYu (incubating) Regular expression denial of service
In Apache ShenYui, ShenYu-Bootstrap, RegexPredicateJudge.java uses Pattern.matches(conditionData.getParamValue(), realData) to make judgments, where both parameters are controllable by the user. This can cause an attacker pass in malicious regular expressions and characters causing a resource exhaustion. This issue affects Apache ShenYu (incubating) 2.4.0, 2.4.1 and 2.4.2 and is fixed in 2.4.3.
Problem types: cwe_id: CWE-1333
description: CWE-1333 Inefficient Regular Expression Complexity
Affected products: vendor: Apache Software Foundation
product: Apache ShenYu (incubating)
Published: 2022-05-17T08:05:10.000Z
CVE-2022-26651 
An issue was discovered in Asterisk through 19.x and Certified Asterisk through 16.8-cert13. The func_odbc module provides possibly inadequate escaping functionality for backslash characters in SQL queries, resulting in user-provided data creating a broken SQL query or possibly a SQL injection. This is fixed in 16.25.2, 18.11.2, and 19.3.2, and 16.8-cert14.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-15T00:00:00.000Z
CVE-2022-26652 
NATS nats-server before 2.7.4 allows Directory Traversal (with write access) via an element in a ZIP archive for JetStream streams. nats-streaming-server before 0.24.3 is also affected.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-10T03:48:44.000Z
CVE-2022-26653 
Zoho ManageEngine Remote Access Plus before 10.1.2137.15 allows guest users to view domain details (such as the username and GUID of an administrator).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-16T15:23:56.000Z
CVE-2022-26654 
Pexip Infinity before 27.3 allows remote attackers to force a software abort via HTTP.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-17T20:14:33.000Z
CVE-2022-26655 
Pexip Infinity 27.x before 27.3 has Improper Input Validation. The client API allows remote attackers to trigger a software abort via a gateway call into Teams.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-17T20:18:02.000Z
CVE-2022-26656 
Pexip Infinity before 27.3 allows remote attackers to trigger a software abort, and possibly enumerate usernames, via One Touch Join.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-17T20:30:10.000Z
CVE-2022-26657 
Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via One Touch Join.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-17T20:30:27.000Z
CVE-2022-26659 
Docker Desktop installer on Windows in versions before 4.6.0 allows an attacker to overwrite any administrator writable files by creating a symlink in place of where the installer writes its log file. Starting from version 4.6.0, the Docker Desktop installer, when run elevated, will write its log files to a location not writable by non-administrator users.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-25T20:50:50.000Z
CVE-2022-26660 
RunAsSpc 4.0 uses a universal and recoverable encryption key. In possession of a file encrypted by RunAsSpc, an attacker can recover the credentials that were used.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-16T14:34:43.000Z