rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-27486 
A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiDDoS version 5.5.0 through 5.5.1, 5.4.2 through 5.4.0, 5.3.0 through 5.3.1, 5.2.0, 5.1.0, 5.0.0, 4.7.0, 4.6.0 and 4.5.0 and FortiDDoS-F version 6.3.0 through 6.3.1, 6.2.0 through 6.2.2, 6.1.0 through 6.1.4 allows an authenticated attacker to execute shell code as `root` via `execute` CLI commands.
Problem types: cwe_id: CWE-78
description: Improper access control
Affected products: vendor: Fortinet
product: FortiDDoS
default_status: unaffected
vendor: Fortinet
product: FortiDDoS-F
default_status: unaffected
CVSS v3.1: version: 3.1
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H/E:P/RL:O/RC:C
Published: 2024-08-13T15:51:57.242Z
CVE-2022-27487 
A improper privilege management in Fortinet FortiSandbox version 4.2.0 through 4.2.2, 4.0.0 through 4.0.2 and before 3.2.3 and FortiDeceptor version 4.1.0, 4.0.0 through 4.0.2 and before 3.3.3 allows a remote authenticated attacker to perform unauthorized API calls via crafted HTTP or HTTPS requests.
Problem types: cwe_id: CWE-269
description: Execute unauthorized code or commands
Affected products: vendor: Fortinet
product: FortiDeceptor
default_status: unaffected
vendor: Fortinet
product: FortiSandbox
default_status: unaffected
CVSS v3.1: version: 3.1
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.3
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C
Published: 2023-04-11T16:06:58.797Z
CVE-2022-27488 
A cross-site request forgery (CSRF) in Fortinet FortiVoiceEnterprise version 6.4.x, 6.0.x, FortiSwitch version 7.0.0 through 7.0.4, 6.4.0 through 6.4.10, 6.2.0 through 6.2.7, 6.0.x, FortiMail version 7.0.0 through 7.0.3, 6.4.0 through 6.4.6, 6.2.x, 6.0.x FortiRecorder version 6.4.0 through 6.4.2, 6.0.x, 2.7.x, 2.6.x, FortiNDR version 1.x.x allows a remote unauthenticated attacker to execute commands on the CLI via tricking an authenticated administrator to execute malicious GET requests.
Problem types: cwe_id: CWE-352
description: Execute unauthorized code or commands
Affected products: vendor: Fortinet
product: FortiVoice
default_status: unaffected
vendor: Fortinet
product: FortiRecorder
default_status: unaffected
vendor: Fortinet
product: FortiSwitch
default_status: unaffected
vendor: Fortinet
product: FortiNDR
default_status: unaffected
vendor: Fortinet
product: FortiMail
default_status: unaffected
CVSS v3.1: version: 3.1
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:H/E:P/RL:O/RC:C
Published: 2023-12-13T06:39:42.998Z
CVE-2022-27489 
A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiExtender 7.0.0 through 7.0.3, 5.3.2, 4.2.4 and below allows attacker to execute unauthorized code or commands via crafted HTTP requests.
Problem types: cwe_id: CWE-78
description: Execute unauthorized code or commands
Affected products: vendor: Fortinet
product: FortiExtender
default_status: unaffected
CVSS v3.1: version: 3.1
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:F/RL:U/RC:C
Published: 2023-02-16T18:06:40.150Z
CVE-2022-27490 
A exposure of sensitive information to an unauthorized actor in Fortinet FortiManager version 6.0.0 through 6.0.4, FortiAnalyzer version 6.0.0 through 6.0.4, FortiPortal version 6.0.0 through 6.0.9, 5.3.0 through 5.3.8, 5.2.x, 5.1.0, 5.0.x, 4.2.x, 4.1.x, FortiSwitch version 7.0.0 through 7.0.4, 6.4.0 through 6.4.10, 6.2.x, 6.0.x allows an attacker which has obtained access to a restricted administrative account to obtain sensitive information via `diagnose debug` commands.
Problem types: cwe_id: CWE-200
description: Information disclosure
Affected products: vendor: Fortinet
product: FortiManager
default_status: unaffected
vendor: Fortinet
product: FortiAnalyzer
default_status: unaffected
vendor: Fortinet
product: FortiPortal
default_status: unaffected
vendor: Fortinet
product: FortiSwitch
default_status: unaffected
CVSS v3.1: version: 3.1
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.1
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N/E:P/RL:U/RC:C
Published: 2023-03-07T16:04:57.843Z
CVE-2022-27491 
A improper verification of source of a communication channel in Fortinet FortiOS with IPS engine version 7.201 through 7.214, 7.001 through 7.113, 6.001 through 6.121, 5.001 through 5.258 and before 4.086 allows a remote and unauthenticated attacker to trigger the sending of "blocked page" HTML data to an arbitrary victim via crafted TCP requests, potentially flooding the victim.
Problem types: description: Denial of service
Affected products: vendor: Fortinet
product: Fortinet FortiOS
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.8
baseSeverity: MEDIUM
confidentialityImpact: NONE
exploitCodeMaturity: FUNCTIONAL
integrityImpact: NONE
privilegesRequired: NONE
remediationLevel: UNAVAILABLE
reportConfidence: CONFIRMED
scope: CHANGED
temporalScore: 6.6
temporalSeverity: MEDIUM
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H/E:F/RL:U/RC:C
version: 3.1
Published: 2022-09-06T15:10:10.000Z
CVE-2022-27492 
An integer underflow in WhatsApp could have caused remote code execution when receiving a crafted video file.
Problem types: cwe_id: CWE-191
description: CWE-191
Affected products: vendor: Meta
product: WhatsApp Business for iOS
vendor: Meta
product: WhatsApp for iOS
vendor: Meta
product: WhatsApp for Android
vendor: Meta
product: WhatsApp Business for Android
Published: 2022-09-23T14:00:14.000Z
CVE-2022-27493 
Improper initialization in the firmware for some Intel(R) NUC Laptop Kits before version BC0076 may allow a privileged user to potentially enable an escalation of privilege via local access.
Problem types: description: escalation of privilege
Affected products: vendor: n/a
product: Intel(R) NUC Laptop Kits
Published: 2022-08-18T20:04:00.000Z
CVE-2022-27494 CROSS-SITE SCRIPTING CWE-79
Aethon TUG Home Base Server versions prior to version 24 are affected by un unauthenticated attacker who can freely access hashed user credentials.
Problem types: description: The “Reports” tab of the Fleet Management Console is vulnerable to stored cross-site scripting attacks when new reports are created or edited.
Affected products: vendor: Aethon
product: TUG Home Base Server
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: HIGH
availabilityImpact: NONE
baseScore: 8.2
baseSeverity: HIGH
Published: 2022-10-21T15:39:04.685Z
CVE-2022-27495 
On all versions 1.3.x (fixed in 1.4.0) NGINX Service Mesh control plane endpoints are exposed to the cluster overlay network. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
Problem types: cwe_id: CWE-306
description: CWE-306 Missing Authentication for Critical Function
Affected products: vendor: F5
product: NGINX Service Mesh
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
version: 3.1
Published: 2022-05-05T16:10:52.847Z
CVE-2022-27496 
Cross-site scripting vulnerability in Zero-channel BBS Plus v0.7.4 and earlier allows a remote attacker to inject an arbitrary script via unspecified vectors.
Problem types: description: Cross-site scripting
Affected products: vendor: Zero-Channel BBS Plus Developers
product: Zero-channel BBS Plus
Published: 2022-03-31T07:21:44.000Z
CVE-2022-27497 
Null pointer dereference in firmware for Intel(R) AMT before version 11.8.93, 11.22.93, 11.12.93, 12.0.92, 14.1.67, 15.0.42, 16.1.25 may allow an unauthenticated user to potentially enable denial of service via network access.
Problem types: description: denial of service
Affected products: vendor: n/a
product: Intel(R) AMT
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 8.6
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Published: 2022-11-11T15:48:35.754Z
CVE-2022-27498 
A directory traversal vulnerability exists in the TicketTemplateActions.aspx GetTemplateAttachment functionality of Lansweeper lansweeper 10.1.1.0. A specially-crafted HTTP request can lead to arbitrary file read. An attacker can send an HTTP request to trigger this vulnerability.
Problem types: cwe_id: CWE-22
description: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Lansweeper
product: lansweeper
Published: 2022-12-19T10:00:14.221Z
CVE-2022-27499 
Premature release of resource during expected lifetime in the Intel(R) SGX SDK software may allow a privileged user to potentially enable information disclosure via local access.
Problem types: description: information disclosure
Affected products: vendor: n/a
product: Intel(R) SGX SDK software
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 2.5
baseSeverity: LOW
vectorString: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:N
Published: 2022-11-11T15:48:41.249Z
CVE-2022-27500 
Incorrect default permissions for the Intel(R) Support Android application before 21.07.40 may allow an authenticated user to potentially enable information disclosure via local access.
Problem types: description: information disclosure
Affected products: vendor: n/a
product: Intel(R) Support Android application
Published: 2022-08-18T19:52:28.000Z
CVE-2022-27502 
RealVNC VNC Server 6.9.0 through 5.1.0 for Windows allows local privilege escalation because an installer repair operation executes %TEMP% files as SYSTEM.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-10T12:03:05.000Z
CVE-2022-27503 
Cross-site Scripting (XSS) vulnerability in Citrix StoreFront affects version 1912 before CU5 and version 3.12 before CU9
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Citrix
product: StoreFront
Published: 2022-04-13T17:05:54.000Z
CVE-2022-27505 
Reflected cross site scripting (XSS)
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Citirx
product: Citrix SD-WAN
Published: 2022-04-13T17:06:05.551Z
CVE-2022-27506 
Hard-coded credentials allow administrators to access the shell via the SD-WAN CLI
Problem types: cwe_id: CWE-798
description: CWE-798 Use of Hard-coded Credentials
Affected products: vendor: Citirx
product: Citrix SD-WAN
Published: 2022-04-13T17:06:04.592Z
CVE-2022-27507 Authenticated denial of service 
Authenticated denial of service
Problem types: cwe_id: CWE-400
description: CWE-400 Uncontrolled Resource Consumption
Affected products: vendor: Citirx
product: Citrix Application Delivery Controller (Citrix ADC) and Citrix Gateway
Published: 2023-01-24T00:00:00.000Z
CVE-2022-27508 Unauthenticated denial of service 
Unauthenticated denial of service
Problem types: cwe_id: CWE-400
description: CWE-400 Uncontrolled Resource Consumption
Affected products: vendor: Citirx
product: Citrix Application Delivery Controller (Citrix ADC) and Citrix Gateway
Published: 2023-01-24T00:00:00.000Z
CVE-2022-27509 Unauthenticated redirection to a malicious website
Unauthenticated redirection to a malicious website
Problem types: description: Unauthenticated redirection to a malicious website
Affected products: vendor: Citirx
product: Citrix Application Delivery Management (Citrix ADC) and Citrix Gateway
Credits: lang: en
value: James Kettle
Published: 2022-07-28T13:11:43.072Z
CVE-2022-27510 Unauthorized access to Gateway user capabilities 
Unauthorized access to Gateway user capabilities 

Problem types: cwe_id: CWE-288
description: CWE-288: Authentication Bypass Using an Alternate Path or Channel
Affected products: vendor: Citrix
product: Citrix Gateway, Citrix ADC 
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2022-11-08T21:26:10.688Z
CVE-2022-27511 Corruption of the system by a remote, unauthenticated user potentially leading to the reset of the administrator password
Corruption of the system by a remote, unauthenticated user. The impact of this can include the reset of the administrator password at the next device reboot, allowing an attacker with ssh access to connect with the default administrator credentials after the device has rebooted.
Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Control
Affected products: vendor: Citrix
product: Citrix Application Delivery Management (Citrix ADM)
Published: 2022-06-16T18:53:14.582Z
CVE-2022-27512 Temporary disruption of the ADM license service
Temporary disruption of the ADM license service. The impact of this includes preventing new licenses from being issued or renewed by Citrix ADM.
Problem types: cwe_id: CWE-664
description: CWE-664 Improper Control of a Resource Through its Lifetime
Affected products: vendor: Citrix
product: Citrix Application Delivery Management (Citrix ADM)
Published: 2022-06-16T18:53:33.283Z
CVE-2022-27513 Remote desktop takeover via phishing
Remote desktop takeover via phishing  

Problem types: cwe_id: CWE-345
description: CWE-345: Insufficient Verification of Data Authenticity
Affected products: vendor: Citrix
product: Citrix Gateway, Citrix ADC 
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.3
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
version: 3.1
Published: 2022-11-08T21:26:08.238Z
CVE-2022-27516 User login brute force protection functionality bypass 
User login brute force protection functionality bypass   

Problem types: cwe_id: CWE-693
description: CWE-693: Protection Mechanism Failure
Affected products: vendor: Citrix
product: Citrix Gateway, Citrix ADC 
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
version: 3.1
Published: 2022-11-08T21:26:12.642Z
CVE-2022-27518 Unauthenticated remote arbitrary code execution
Unauthenticated remote arbitrary code execution
Problem types: cwe_id: CWE-664
description: CWE-664: Improper Control of a Resource Through its Lifetime
Affected products: vendor: Citrix
product: Citrix Gateway, Citrix ADC
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2022-12-13T00:00:00.000Z
CVE-2022-27523 
A buffer over-read can be exploited in Autodesk TrueView 2022 may lead to an exposure of sensitive information or a crash through using a maliciously crafted DWG file as an Input. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process.
Problem types: description: Buffer Over Read
Affected products: vendor: n/a
product: Autodesk Trueview
Published: 2022-04-13T17:06:09.000Z
CVE-2022-27524 
An out-of-bounds read can be exploited in Autodesk TrueView 2022 may lead to an exposure of sensitive information or a crash through using a maliciously crafted DWG file as an Input. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process.
Problem types: description: Out-of-bound Read
Affected products: vendor: n/a
product: Autodesk Trueview
Published: 2022-04-13T17:06:10.000Z
CVE-2022-27525 
A malicious crafted .dwf or .pct file when consumed through DesignReview.exe application could lead to memory corruption vulnerability by write access violation. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process.
Problem types: description: Memory Corruption
Affected products: vendor: n/a
product: Autodesk® Design Review
Published: 2022-04-18T16:20:25.000Z
CVE-2022-27526 
A malicious crafted TGA file when consumed through DesignReview.exe application could lead to memory corruption vulnerability. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process.
Problem types: description: Memory Corruption
Affected products: vendor: n/a
product: Autodesk Design Review
Published: 2022-04-18T16:20:26.000Z
CVE-2022-27527 
A Memory Corruption vulnerability may lead to code execution through maliciously crafted DLL files. It was fixed in PDFTron earlier than 9.0.7 version in Autodesk Navisworks 2022, and 2020.
Problem types: description: Memory Corruption vulnerability
Affected products: vendor: n/a
product: Navisworks
Published: 2022-04-19T20:26:32.000Z
CVE-2022-27528 
A maliciously crafted DWFX and SKP files in Autodesk Navisworks 2022 can be used to trigger use-after-free vulnerability. Exploitation of this vulnerability may lead to code execution.
Problem types: description: Use-after-free
Affected products: vendor: n/a
product: Autodesk Navisworks
Published: 2022-04-11T19:37:54.000Z
CVE-2022-27529 
A maliciously crafted PICT, BMP, PSD or TIF file in Autodesk AutoCAD 2022, 2021, 2020, 2019 may be used to write beyond the allocated buffer while parsing PICT, BMP, PSD or TIF file. This vulnerability may be exploited to execute arbitrary code.
Problem types: description: Out-of-bounds Write
Affected products: vendor: n/a
product: Autodesk Advanced Steel, Civil 3D, AutoCAD, AutoCAD LT, AutoCAD Architecture, AutoCAD Electrical, AutoCAD Map 3D, AutoCAD Mechanical, AutoCAD MEP, AutoCAD Plant 3D
Published: 2022-04-18T16:20:27.000Z
CVE-2022-27530 
A maliciously crafted TIF or PICT file in Autodesk AutoCAD 2022, 2021, 2020, 2019 can be used to write beyond the allocated buffer through Buffer overflow vulnerability. This vulnerability may be exploited to execute arbitrary code.
Problem types: description: Buffer Overflow Write
Affected products: vendor: n/a
product: Autodesk Advanced Steel, Civil 3D, AutoCAD, AutoCAD LT, AutoCAD Architecture, AutoCAD Electrical, AutoCAD Map 3D, AutoCAD Mechanical, AutoCAD MEP, AutoCAD Plant 3D
Published: 2022-04-18T16:20:28.000Z
CVE-2022-27531 
A maliciously crafted TIF file can be forced to read beyond allocated boundaries in Autodesk 3ds Max 2022, and 2021 when parsing the TIF files. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process.
Problem types: description: Out-of-bound Read Vulnerability
Affected products: vendor: n/a
product: Autodesk 3ds Max
Published: 2022-06-16T15:46:49.000Z
CVE-2022-27532 
A maliciously crafted TIF file in Autodesk 3ds Max 2022 and 2021 can be used to write beyond the allocated buffer while parsing TIF files. This vulnerability in conjunction with other vulnerabilities could lead to arbitrary code execution.
Problem types: description: Ou-of-bound Write vulnerability
Affected products: vendor: n/a
product: Autodesk 3ds Max
Published: 2022-06-16T15:47:00.000Z
CVE-2022-27534 
Kaspersky Anti-Virus products for home and Kaspersky Endpoint Security with antivirus databases released before 12 March 2022 had a bug in a data parsing module that potentially allowed an attacker to execute arbitrary code. The fix was delivered automatically. Credits: Georgy Zaytsev (Positive Technologies).
Problem types: description: Arbitrary Code Execution
Affected products: vendor: n/a
product: Kaspersky Anti-Virus products for home and Kaspersky Endpoint Security
Published: 2022-04-01T22:17:49.000Z
CVE-2022-27535 
Kaspersky VPN Secure Connection for Windows version up to 21.5 was vulnerable to arbitrary file deletion via abuse of its 'Delete All Service Data And Reports' feature by the local authenticated attacker.
Problem types: description: Local Privilege Escalation (LPE)
Affected products: vendor: n/a
product: Kaspersky VPN Secure Connection for Windows
Published: 2022-08-05T16:47:46.000Z
CVE-2022-27536 
Certificate.Verify in crypto/x509 in Go 1.18.x before 1.18.1 can be caused to panic on macOS when presented with certain malformed certificates. This allows a remote TLS server to cause a TLS client to panic.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-20T00:00:00.000Z
CVE-2022-27537 
Potential vulnerabilities have been identified in the system BIOS of certain HP PC products, which might allow arbitrary code execution, escalation of privilege, denial of service, and information disclosure. HP is releasing BIOS updates to mitigate these potential vulnerabilities.
Problem types: description: n/a
Affected products: vendor: HP Inc.
product: HP PC BIOS
Published: 2023-01-30T21:26:11.879Z
CVE-2022-27538 
A potential Time-of-Check to Time-of-Use (TOCTOU) vulnerability has been identified in the BIOS for certain HP PC products which may allow arbitrary code execution, denial of service, and information disclosure. HP is releasing BIOS updates to mitigate the potential vulnerability.
Problem types: description: n/a
Affected products: vendor: HP Inc.
product: HP PC BIOS
Published: 2023-01-30T20:41:26.690Z
CVE-2022-27539 
Potential Time-of-Check to Time-of Use (TOCTOU) vulnerabilities have been identified in the HP BIOS for certain HP PC products which may allow arbitrary code execution, denial of service, and information disclosure.
Affected products: vendor: HP Inc.
product: HP PC BIOS
Published: 2023-06-12T18:56:55.490Z
CVE-2022-27540 
A potential Time-of-Check to Time-of Use (TOCTOU) vulnerability has been identified in the HP BIOS for certain HP PC products, which might allow arbitrary code execution, denial of service, and information disclosure. HP is releasing BIOS updates to mitigate the potential vulnerability.
Affected products: vendor: HP Inc.
product: HP PC BIOS
default_status: unknown
Published: 2024-06-28T19:00:28.307Z
CVE-2022-27541 
Potential Time-of-Check to Time-of Use (TOCTOU) vulnerabilities have been identified in the HP BIOS for certain HP PC products which may allow arbitrary code execution, denial of service, and information disclosure.
Affected products: vendor: HP Inc.
product: HP PC BIOS
Published: 2023-06-12T18:59:18.253Z