rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-29937 
USU Oracle Optimization before 5.17.5 allows authenticated DataCollection users to achieve agent root access because some common OS commands are blocked but (for example) an OS command for base64 decoding is not blocked. NOTE: this is not an Oracle Corporation product.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-29T16:34:36.000Z
CVE-2022-29938 
In LibreHealth EHR 2.0.0, lack of sanitization of the GET parameter payment_id in interface\billing\new_payment.php via interface\billing\payment_master.inc.php leads to SQL injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-05T11:40:35.000Z
CVE-2022-29939 
In LibreHealth EHR 2.0.0, lack of sanitization of the GET parameters debug and InsId in interface\billing\sl_eob_process.php leads to multiple cross-site scripting (XSS) vulnerabilities.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-05T11:40:32.000Z
CVE-2022-29940 
In LibreHealth EHR 2.0.0, lack of sanitization of the GET parameters formseq and formid in interface\orders\find_order_popup.php leads to multiple cross-site scripting (XSS) vulnerabilities.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-05T11:40:30.000Z
CVE-2022-29942 
Talend Administration Center has a vulnerability that allows an authenticated user to use the Service Registry 'Add' functionality to perform SSRF HTTP GET requests on URLs in the internal network. The issue is fixed for versions 8.0.x in TPS-5189, versions 7.3.x in TPS-5175, and versions 7.2.x in TPS-5201. Earlier versions of Talend Administration Center may also be impacted; users are encouraged to update to a supported version.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-04T17:26:23.000Z
CVE-2022-29943 
Talend Administration Center has a vulnerability that allows an authenticated user to use XML External Entity (XXE) processing to achieve read access as root on the remote filesystem. The issue is fixed for versions 8.0.x in TPS-5189, versions 7.3.x in TPS-5175, and versions 7.2.x in TPS-5201. Earlier versions of Talend Administration Center may also be impacted; users are encouraged to update to a supported version.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-04T17:26:26.000Z
CVE-2022-29944 
An issue was discovered in ONOS 2.5.1. There is an incorrect comparison of paths installed by intents. An existing intents does not redirect to a new path, even if a new intent that shares the path with higher priority is installed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-20T00:00:00.000Z
CVE-2022-29945 
DJI drone devices sold in 2017 through 2022 broadcast unencrypted information about the drone operator's physical location via the AeroScope protocol.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AC:H/AV:N/A:N/C:L/I:N/PR:N/S:C/UI:N
version: 3.1
Published: 2022-04-29T19:39:43.000Z
CVE-2022-29946 
NATS.io NATS Server before 2.8.2 and Streaming Server before 0.24.6 could allow a remote attacker to bypass security restrictions, caused by the failure to enforce negative user permissions in one scenario. By using a queue subscription on the wildcard, an attacker could exploit this vulnerability to allow denied subjects.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-11T00:00:00.000Z
CVE-2022-29947 
Woodpecker before 0.15.1 allows XSS via build logs because web/src/components/repo/build/BuildLog.vue lacks escaping.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-29T20:23:22.000Z
CVE-2022-29948 
Due to an insecure design, the Lepin EP-KP001 flash drive through KP001_V19 is vulnerable to an authentication bypass attack that enables an attacker to gain access to the stored encrypted data. Normally, the encrypted disk partition with this data is unlocked by entering the correct passcode (6 to 14 digits) via the keypad and pressing the Unlock button. This authentication is performed by an unknown microcontroller. By replacing this microcontroller on a target device with one from an attacker-controlled Lepin EP-KP001 whose passcode is known, it is possible to successfully unlock the target device and read the stored data in cleartext.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-10T16:39:13.000Z
CVE-2022-29950 
Experian Hunter 1.16 allows remote authenticated users to modify assumed-immutable elements via the (1) rule name parameter to the Rules page or the (2) subrule name or (3) categories name parameter to the Subrules page. NOTE: the vendor disputes this because version 1.16 has never existed
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-04T14:23:43.000Z
CVE-2022-29951 
JTEKT TOYOPUC PLCs through 2022-04-29 mishandle authentication. They utilize the CMPLink/TCP protocol (configurable on ports 1024-65534 on either TCP or UDP) for a wide variety of engineering purposes such as starting and stopping the PLC, downloading and uploading projects, and changing configuration settings. This protocol does not have any authentication features, allowing any attacker capable of communicating with the port in question to invoke (a subset of) desired functionality.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-26T21:04:47.000Z
CVE-2022-29952 
Bently Nevada condition monitoring equipment through 2022-04-29 mishandles authentication. It utilizes the TDI command and data protocols (60005/TCP, 60007/TCP) for communications between the monitoring controller and System 1 and/or Bently Nevada Monitor Configuration (BNMC) software. These protocols provide configuration management and historical data related functionality. Neither protocol has any authentication features, allowing any attacker capable of communicating with the ports in question to invoke (a subset of) desired functionality.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-26T21:42:17.000Z
CVE-2022-29953 
The Bently Nevada 3700 series of condition monitoring equipment through 2022-04-29 has a maintenance interface on port 4001/TCP with undocumented, hardcoded credentials. An attacker capable of connecting to this interface can thus trivially take over its functionality.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-26T21:42:30.000Z
CVE-2022-29957 
The Emerson DeltaV Distributed Control System (DCS) through 2022-04-29 mishandles authentication. It utilizes several proprietary protocols for a wide variety of functionality. These protocols include Firmware upgrade (18508/TCP, 18518/TCP); Plug-and-Play (18510/UDP); Hawk services (18507/UDP); Management (18519/TCP); Cold restart (18512/UDP); SIS communications (12345/TCP); and Wireless Gateway Protocol (18515/UDP). None of these protocols have any authentication features, allowing any attacker capable of communicating with the ports in question to invoke (a subset of) desired functionality.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-26T21:14:50.000Z
CVE-2022-29958 
JTEKT TOYOPUC PLCs through 2022-04-29 do not ensure data integrity. They utilize the unauthenticated CMPLink/TCP protocol for engineering purposes, including downloading projects and control logic to the PLC. Control logic is downloaded to the PLC on a block-by-block basis with a given memory address and a blob of machine code. The logic that is downloaded to the PLC is not cryptographically authenticated, allowing an attacker to execute arbitrary machine code on the PLC's CPU module in the context of the runtime. In the case of the PC10G-CPU, and likely for other CPU modules of the TOYOPUC family, a processor without MPU or MMU is used and this no memory protection or privilege-separation capabilities are available, giving an attacker full control over the CPU.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-26T21:04:34.000Z
CVE-2022-29959 
Emerson OpenBSI through 2022-04-29 mishandles credential storage. It is an engineering environment for the ControlWave and Bristol Babcock line of RTUs. This environment provides access control functionality through user authentication and privilege management. The credentials for various users are stored insecurely in the SecUsers.ini file by using a simple string transformation rather than a cryptographic mechanism.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-16T12:23:42.000Z
CVE-2022-29960 
Emerson OpenBSI through 2022-04-29 uses weak cryptography. It is an engineering environment for the ControlWave and Bristol Babcock line of RTUs. DES with hardcoded cryptographic keys is used for protection of certain system credentials, engineering files, and sensitive utilities.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-26T21:14:45.000Z
CVE-2022-29962 
The Emerson DeltaV Distributed Control System (DCS) controllers and IO cards through 2022-04-29 misuse passwords. FTP has hardcoded credentials (but may often be disabled in production). This affects S-series, P-series, and CIOC/EIOC nodes. NOTE: this is different from CVE-2014-2350.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-26T21:14:40.000Z
CVE-2022-29963 
The Emerson DeltaV Distributed Control System (DCS) controllers and IO cards through 2022-04-29 misuse passwords. TELNET on port 18550 provides access to a root shell via hardcoded credentials. This affects S-series, P-series, and CIOC/EIOC nodes. NOTE: this is different from CVE-2014-2350.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-26T21:14:35.000Z
CVE-2022-29964 
The Emerson DeltaV Distributed Control System (DCS) controllers and IO cards through 2022-04-29 misuse passwords. WIOC SSH provides access to a shell as root, DeltaV, or backup via hardcoded credentials. NOTE: this is different from CVE-2014-2350.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-26T21:14:35.000Z
CVE-2022-29965 
The Emerson DeltaV Distributed Control System (DCS) controllers and IO cards through 2022-04-29 misuse passwords. Access to privileged operations on the maintenance port TELNET interface (23/TCP) on M-series and SIS (CSLS/LSNB/LSNG) nodes is controlled by means of utility passwords. These passwords are generated using a deterministic, insecure algorithm using a single seed value composed of a day/hour/minute timestamp with less than 16 bits of entropy. The seed value is fed through a lookup table and a series of permutation operations resulting in three different four-character passwords corresponding to different privilege levels. An attacker can easily reconstruct these passwords and thus gain access to privileged maintenance operations. NOTE: this is different from CVE-2014-2350.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-26T21:14:24.000Z
CVE-2022-29967 
static_compressed_inmemory_website_callback.c in Glewlwyd through 2.6.2 allows directory traversal.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-29T22:34:16.000Z
CVE-2022-29968 
An issue was discovered in the Linux kernel through 5.17.5. io_rw_init_file in fs/io_uring.c lacks initialization of kiocb->private.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-02T04:00:27.000Z
CVE-2022-29969 
The RSS extension before 2022-04-29 for MediaWiki allows XSS via an rss element (if the feed is in $wgRSSUrlWhitelist and $wgRSSAllowLinkTag is true).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-02T04:18:27.000Z
CVE-2022-29970 
Sinatra before 2.2.0 does not validate that the expanded path matches public_dir when serving static files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-02T00:00:00.000Z
CVE-2022-29971 
An argument injection vulnerability in the browser-based authentication component of the Magnitude Simba Amazon Athena ODBC Driver 1.1.1 through 1.1.x before 1.1.17 may allow a local user to execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-09T17:14:59.000Z
CVE-2022-29972 
An argument injection vulnerability in the browser-based authentication component of the Magnitude Simba Amazon Redshift ODBC Driver (1.4.14 through 1.4.21.1001 and 1.4.22 through 1.4.x before 1.4.52) may allow a local user to execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-09T17:15:04.000Z
CVE-2022-29973 
relan exFAT 1.3.0 allows local users to obtain sensitive information (data from deleted files in the filesystem) in certain situations involving offsets beyond ValidDataLength.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-02T05:09:22.000Z
CVE-2022-29974 
AMI (aka American Megatrends) NTFS driver 1.0.0 (fixed in late 2021 or early 2022) has a buffer overflow. This driver is, for example, used in certain ASUS devices.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-12-09T00:00:00.000Z
CVE-2022-29975 
An Authenticated Reflected Cross-site scripting at CC Parameter was discovered in MDaemon before 22.0.0 .
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-11T12:53:23.000Z
CVE-2022-29976 
An Authenticated Reflected Cross-site scripting at BCC Parameter was discovered in MDaemon before 22.0.0 .
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-11T12:54:14.000Z
CVE-2022-29977 
There is an assertion failure error in stbi__jpeg_huff_decode, stb_image.h:1894 in libsixel img2sixel 1.8.6. Remote attackers could leverage this vulnerability to cause a denial-of-service via a crafted JPEG file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-11T13:10:13.000Z
CVE-2022-29978 
There is a floating point exception error in sixel_encoder_do_resize, encoder.c:633 in libsixel img2sixel 1.8.6. Remote attackers could leverage this vulnerability to cause a denial-of-service via a crafted JPEG file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-11T13:12:05.000Z
CVE-2022-29979 
Simple Client Management System 1.0 is vulnerable to SQL Injection via /cms/classes/Master.php?f=delete_designation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-12T14:15:44.000Z
CVE-2022-29980 
Simple Client Management System 1.0 is vulnerable to SQL Injection via /cms/admin/?page=user/manage_user&id=.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-12T14:14:23.000Z
CVE-2022-29981 
Simple Client Management System 1.0 is vulnerable to SQL Injection via /cms/classes/Users.php?f=delete.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-12T14:22:43.000Z
CVE-2022-29982 
Simple Client Management System 1.0 is vulnerable to SQL Injection via /cms/admin/maintenance/manage_service.php?id=.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-12T14:10:53.000Z
CVE-2022-29983 
Simple Client Management System 1.0 is vulnerable to SQL Injection via /cms/admin/?page=invoice/view_invoice&id=.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-12T14:09:21.000Z
CVE-2022-29984 
Simple Client Management System 1.0 is vulnerable to SQL Injection via /cms/admin/?page=client/view_client&id=.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-12T14:06:46.000Z
CVE-2022-29985 
Online Sports Complex Booking System 1.0 is vulnerable to SQL Injection via \scbs\classes\Master.php?f=delete_category.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-12T15:01:42.000Z
CVE-2022-29986 
Online Sports Complex Booking System 1.0 is vulnerable to SQL Injection via \scbs\classes\Master.php?f=delete_facility.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-12T15:00:32.000Z
CVE-2022-29987 
Online Sports Complex Booking System 1.0 is vulnerable to SQL Injection via /scbs/admin/?page=user/manage_user&id=.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-12T14:59:05.000Z
CVE-2022-29988 
Online Sports Complex Booking System 1.0 is vulnerable to SQL Injection via \scbs\classes\Master.php?f=delete.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-12T14:57:53.000Z
CVE-2022-29989 
Online Sports Complex Booking System 1.0 is vulnerable to SQL Injection via \scbs\classes\Master.php?f=delete_booking.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-12T14:56:39.000Z
CVE-2022-29990 
Online Sports Complex Booking System 1.0 is vulnerable to SQL Injection via /scbs/admin/categories/view_category.php?id=.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-12T14:55:26.000Z
CVE-2022-29992 
Online Sports Complex Booking System 1.0 is vulnerable to SQL Injection via /scbs/admin/categories/manage_category.php?id=.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-12T14:51:27.000Z
CVE-2022-29993 
Online Sports Complex Booking System 1.0 is vulnerable to SQL Injection via /scbs/admin/bookings/view_booking.php?id=.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-12T14:48:52.000Z
CVE-2022-29994 
Online Sports Complex Booking System 1.0 is vulnerable to SQL Injection via /scbs/admin/?page=facilities/manage_facility&id=.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-12T14:46:53.000Z
CVE-2022-29995 
Online Sports Complex Booking System 1.0 is vulnerable to SQL Injection via /scbs/admin/?page=clients/manage_client&id=.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-12T14:45:40.000Z
CVE-2022-29998 
Insurance Management System 1.0 is vulnerable to SQL Injection via /insurance/clientStatus.php?client_id=.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-12T15:18:26.000Z
CVE-2022-29999 
Insurance Management System 1.0 is vulnerable to SQL Injection via /insurance/editClient.php?client_id=.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-12T15:17:19.000Z
CVE-2022-2000 Out-of-bounds Write in vim/vim
Out-of-bounds Write in GitHub repository vim/vim prior to 8.2.
Problem types: cwe_id: CWE-787
description: CWE-787 Out-of-bounds Write
Affected products: vendor: vim
product: vim/vim
Published: 2022-06-07T00:00:00.000Z
CVE-2022-2001 DX Share Selection <= 1.4 - Cross-Site Request Forgery to Cross-Site Scripting
The DX Share Selection plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.4. This is due to missing nonce protection on the dxss_admin_page() function found in the ~/dx-share-selection.php file. This makes it possible for unauthenticated attackers to inject malicious web scripts into the page, granted they can trick a site's administrator into performing an action such as clicking on a link.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: nofearinc
product: DX Share Selection
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
baseScore: 8.8
baseSeverity: HIGH
Credits: lang: en
value: Sho Sakata
Published: 2022-07-18T16:17:07.000Z
CVE-2022-2002 GE CIMPLICITY Untrusted Pointer Dereference
GE CIMPICITY versions 2022 and prior is 



vulnerable when data from faulting address controls code flow starting at gmmiObj!CGmmiOptionContainer, which could allow an attacker to execute arbitrary code. 

 

 


Problem types: cwe_id: CWE-822
description: CWE-822 Untrusted Pointer Dereference
Affected products: vendor: GE
product: CIMPLICITY
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Kimiya working with Trend micro Zero Day Initiative reported these vulnerabilities to CISA.
Published: 2022-12-07T22:56:50.504Z
CVE-2022-2003 AutomationDirect DirectLOGIC with Serial Communication Cleartext Transmission
AutomationDirect DirectLOGIC is vulnerable to a specifically crafted serial message to the CPU serial port that will cause the PLC to respond with the PLC password in cleartext. This could allow an attacker to access and make unauthorized changes. This issue affects: AutomationDirect DirectLOGIC D0-06 series CPUs D0-06DD1 versions prior to 2.72; D0-06DD2 versions prior to 2.72; D0-06DR versions prior to 2.72; D0-06DA versions prior to 2.72; D0-06AR versions prior to 2.72; D0-06AA versions prior to 2.72; D0-06DD1-D versions prior to 2.72; D0-06DD2-D versions prior to 2.72; D0-06DR-D versions prior to 2.72;
Problem types: cwe_id: CWE-319
description: CWE-319 Cleartext Transmission of Sensitive Information
Affected products: vendor: AutomationDirect
product: DirectLOGIC D0-06 series CPUs
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 7.7
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
version: 3.1
Credits: lang: en
value: Sam Hanson of Dragos reported this vulnerability to CISA.
Published: 2022-08-31T15:59:33.369Z
CVE-2022-2004 AutomationDirect DirectLOGIC with Ethernet Communication Uncontrolled Resource Consumption
AutomationDirect DirectLOGIC is vulnerable to a a specially crafted packet can be sent continuously to the PLC to prevent access from DirectSoft and other devices, causing a denial-of-service condition. This issue affects: AutomationDirect DirectLOGIC D0-06 series CPUs D0-06DD1 versions prior to 2.72; D0-06DD2 versions prior to 2.72; D0-06DR versions prior to 2.72; D0-06DA versions prior to 2.72; D0-06AR versions prior to 2.72; D0-06AA versions prior to 2.72; D0-06DD1-D versions prior to 2.72; D0-06DD2-D versions prior to 2.72; D0-06DR-D versions prior to 2.72;
Problem types: cwe_id: CWE-400
description: CWE-400 Uncontrolled Resource Consumption
Affected products: vendor: AutomationDirect
product: DirectLOGIC D0-06 series CPUs
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: Sam Hanson of Dragos reported this vulnerability to CISA.
Published: 2022-08-31T15:59:33.591Z