stasvinokur/cve-and-cwe-dataset-1999-2025 huggingface dataset:
CVE-2022-33637 (severity: MEDIUM, weakness: NVD-CWE-Other)
Microsoft Defender for Endpoint Tampering Vulnerability
CVE-2022-33638 (severity: HIGH, weakness: NVD-CWE-Other)
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
CVE-2022-33639 (severity: HIGH, weakness: NVD-CWE-Other)
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
CVE-2022-3364 (severity: MEDIUM, weakness: CWE-770)
Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.0a3.
CVE-2022-33640 (severity: HIGH, weakness: NVD-CWE-Other)
System Center Operations Manager: Open Management Infrastructure (OMI) Elevation of Privilege Vulnerability
CVE-2022-33641 (severity: MEDIUM, weakness: NVD-CWE-Other)
Azure Site Recovery Elevation of Privilege Vulnerability
CVE-2022-33642 (severity: MEDIUM, weakness: NVD-CWE-Other)
Azure Site Recovery Elevation of Privilege Vulnerability
CVE-2022-33643 (severity: MEDIUM, weakness: NVD-CWE-Other)
Azure Site Recovery Elevation of Privilege Vulnerability
CVE-2022-33644 (severity: HIGH, weakness: NVD-CWE-Other)
Xbox Live Save Service Elevation of Privilege Vulnerability
CVE-2022-33645 (severity: HIGH, weakness: NVD-CWE-Other)
Windows TCP/IP Driver Denial of Service Vulnerability
CVE-2022-33646 (severity: HIGH, weakness: NVD-CWE-Other)
Azure Batch Node Agent Elevation of Privilege Vulnerability
CVE-2022-33647 (severity: HIGH, weakness: NVD-CWE-Other)
Windows Kerberos Elevation of Privilege Vulnerability
CVE-2022-33648 (severity: HIGH, weakness: NVD-CWE-Other)
Microsoft Excel Remote Code Execution Vulnerability
CVE-2022-33649 (severity: CRITICAL, weakness: NVD-CWE-Other)
Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability
CVE-2022-3365 (severity: CRITICAL, weakness: CWE-327)
Due to reliance on a trivial substitution cipher, sent in cleartext, and the reliance on a default password when the user does not set a password, the Remote Mouse Server by Emote Interactive can be abused by attackers to inject OS commands over theproduct's custom control protocol. A Metasploit module was written and tested against version 4.110, the current version when this CVE was reserved.
CVE-2022-33650 (severity: MEDIUM, weakness: NVD-CWE-Other)
Azure Site Recovery Elevation of Privilege Vulnerability
CVE-2022-33651 (severity: MEDIUM, weakness: NVD-CWE-Other)
Azure Site Recovery Elevation of Privilege Vulnerability
CVE-2022-33652 (severity: MEDIUM, weakness: NVD-CWE-Other)
Azure Site Recovery Elevation of Privilege Vulnerability
CVE-2022-33653 (severity: MEDIUM, weakness: NVD-CWE-Other)
Azure Site Recovery Elevation of Privilege Vulnerability
CVE-2022-33654 (severity: MEDIUM, weakness: NVD-CWE-Other)
Azure Site Recovery Elevation of Privilege Vulnerability
CVE-2022-33655 (severity: MEDIUM, weakness: NVD-CWE-Other)
Azure Site Recovery Elevation of Privilege Vulnerability
CVE-2022-33656 (severity: MEDIUM, weakness: NVD-CWE-Other)
Azure Site Recovery Elevation of Privilege Vulnerability
CVE-2022-33657 (severity: MEDIUM, weakness: NVD-CWE-Other)
Azure Site Recovery Elevation of Privilege Vulnerability
CVE-2022-33658 (severity: MEDIUM, weakness: NVD-CWE-Other)
Azure Site Recovery Elevation of Privilege Vulnerability
CVE-2022-33659 (severity: MEDIUM, weakness: NVD-CWE-Other)
Azure Site Recovery Elevation of Privilege Vulnerability
CVE-2022-3366 (severity: HIGH, weakness: CWE-502)
The PublishPress Capabilities WordPress plugin before 2.5.2, PublishPress Capabilities Pro WordPress plugin before 2.5.2 unserializes the content of imported files, which could lead to PHP object injection attacks by administrators, on multisite WordPress configurations. Successful exploitation in this case requires other plugins with a suitable gadget chain to be present on the site.
CVE-2022-33660 (severity: MEDIUM, weakness: NVD-CWE-Other)
Azure Site Recovery Elevation of Privilege Vulnerability
CVE-2022-33661 (severity: MEDIUM, weakness: NVD-CWE-Other)
Azure Site Recovery Elevation of Privilege Vulnerability
CVE-2022-33662 (severity: MEDIUM, weakness: NVD-CWE-Other)
Azure Site Recovery Elevation of Privilege Vulnerability
CVE-2022-33663 (severity: MEDIUM, weakness: NVD-CWE-Other)
Azure Site Recovery Elevation of Privilege Vulnerability
CVE-2022-33664 (severity: MEDIUM, weakness: NVD-CWE-Other)
Azure Site Recovery Elevation of Privilege Vulnerability
CVE-2022-33665 (severity: MEDIUM, weakness: NVD-CWE-Other)
Azure Site Recovery Elevation of Privilege Vulnerability
CVE-2022-33666 (severity: MEDIUM, weakness: NVD-CWE-Other)
Azure Site Recovery Elevation of Privilege Vulnerability
CVE-2022-33667 (severity: MEDIUM, weakness: NVD-CWE-Other)
Azure Site Recovery Elevation of Privilege Vulnerability
CVE-2022-33668 (severity: MEDIUM, weakness: NVD-CWE-Other)
Azure Site Recovery Elevation of Privilege Vulnerability
CVE-2022-33669 (severity: MEDIUM, weakness: NVD-CWE-Other)
Azure Site Recovery Elevation of Privilege Vulnerability
CVE-2022-33670 (severity: HIGH, weakness: NVD-CWE-Other)
Windows Partition Management Driver Elevation of Privilege Vulnerability
CVE-2022-33671 (severity: MEDIUM, weakness: NVD-CWE-Other)
Azure Site Recovery Elevation of Privilege Vulnerability
CVE-2022-33672 (severity: MEDIUM, weakness: NVD-CWE-Other)
Azure Site Recovery Elevation of Privilege Vulnerability
CVE-2022-33673 (severity: MEDIUM, weakness: NVD-CWE-Other)
Azure Site Recovery Elevation of Privilege Vulnerability
CVE-2022-33674 (severity: HIGH, weakness: NVD-CWE-Other)
Azure Site Recovery Elevation of Privilege Vulnerability
CVE-2022-33675 (severity: HIGH, weakness: NVD-CWE-Other)
Azure Site Recovery Elevation of Privilege Vulnerability
CVE-2022-33676 (severity: HIGH, weakness: NVD-CWE-Other)
Azure Site Recovery Remote Code Execution Vulnerability
CVE-2022-33677 (severity: HIGH, weakness: NVD-CWE-Other)
Azure Site Recovery Elevation of Privilege Vulnerability
CVE-2022-33678 (severity: HIGH, weakness: NVD-CWE-Other)
Azure Site Recovery Remote Code Execution Vulnerability
CVE-2022-33679 (severity: HIGH, weakness: NVD-CWE-Other)
Windows Kerberos Elevation of Privilege Vulnerability
CVE-2022-3368 (severity: HIGH, weakness: CWE-276)
A vulnerability within the Software Updater functionality of Avira Security for Windows allowed an attacker with write access to the filesystem, to escalate his privileges in certain scenarios. The issue was fixed with Avira Security version 1.1.72.30556.
CVE-2022-33680 (severity: HIGH, weakness: NVD-CWE-Other)
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
CVE-2022-33681 (severity: MEDIUM, weakness: CWE-295)
Delayed TLS hostname verification in the Pulsar Java Client and the Pulsar Proxy make each client vulnerable to a man in the middle attack. Connections from the Pulsar Java Client to the Pulsar Broker/Proxy and connections from the Pulsar Proxy to the Pulsar Broker are vulnerable. Authentication data is sent before verifying the server’s TLS certificate matches the hostname, which means authentication data could be exposed to an attacker. An attacker can only take advantage of this vulnerability by taking control of a machine 'between' the client and the server. The attacker must then actively manipulate traffic to perform the attack by providing the client with a cryptographically valid certificate for an unrelated host. Because the client sends authentication data before performing hostname verification, an attacker could gain access to the client’s authentication data. The client eventually closes the connection when it verifies the hostname and identifies the targeted hostname does not match a hostname on the certificate. Because the client eventually closes the connection, the value of the intercepted authentication data depends on the authentication method used by the client. Token based authentication and username/password authentication methods are vulnerable because the authentication data can be used to impersonate the client in a separate session. This issue affects Apache Pulsar Java Client versions 2.7.0 to 2.7.4; 2.8.0 to 2.8.3; 2.9.0 to 2.9.2; 2.10.0; 2.6.4 and earlier.
CVE-2022-33682 (severity: MEDIUM, weakness: CWE-295)
TLS hostname verification cannot be enabled in the Pulsar Broker's Java Client, the Pulsar Broker's Java Admin Client, the Pulsar WebSocket Proxy's Java Client, and the Pulsar Proxy's Admin Client leaving intra-cluster connections and geo-replication connections vulnerable to man in the middle attacks, which could leak credentials, configuration data, message data, and any other data sent by these clients. The vulnerability is for both the pulsar+ssl protocol and HTTPS. An attacker can only take advantage of this vulnerability by taking control of a machine 'between' the client and the server. The attacker must then actively manipulate traffic to perform the attack by providing the client with a cryptographically valid certificate for an unrelated host. This issue affects Apache Pulsar Broker, Proxy, and WebSocket Proxy versions 2.7.0 to 2.7.4; 2.8.0 to 2.8.3; 2.9.0 to 2.9.2; 2.10.0; 2.6.4 and earlier.
CVE-2022-33683 (severity: MEDIUM, weakness: CWE-295)
Apache Pulsar Brokers and Proxies create an internal Pulsar Admin Client that does not verify peer TLS certificates, even when tlsAllowInsecureConnection is disabled via configuration. The Pulsar Admin Client's intra-cluster and geo-replication HTTPS connections are vulnerable to man in the middle attacks, which could leak authentication data, configuration data, and any other data sent by these clients. An attacker can only take advantage of this vulnerability by taking control of a machine 'between' the client and the server. The attacker must then actively manipulate traffic to perform the attack. This issue affects Apache Pulsar Broker and Proxy versions 2.7.0 to 2.7.4; 2.8.0 to 2.8.3; 2.9.0 to 2.9.2; 2.10.0; 2.6.4 and earlier.
CVE-2022-33684 (severity: HIGH, weakness: CWE-295)
The Apache Pulsar C++ Client does not verify peer TLS certificates when making HTTPS calls for the OAuth2.0 Client Credential Flow, even when tlsAllowInsecureConnection is disabled via configuration. This vulnerability allows an attacker to perform a man in the middle attack and intercept and/or modify the GET request that is sent to the ClientCredentialFlow 'issuer url'. The intercepted credentials can be used to acquire authentication data from the OAuth2.0 server to then authenticate with an Apache Pulsar cluster. An attacker can only take advantage of this vulnerability by taking control of a machine 'between' the client and the server. The attacker must then actively manipulate traffic to perform the attack. The Apache Pulsar Python Client wraps the C++ client, so it is also vulnerable in the same way. This issue affects Apache Pulsar C++ Client and Python Client versions 2.7.0 to 2.7.4; 2.8.0 to 2.8.3; 2.9.0 to 2.9.2; 2.10.0 to 2.10.1; 2.6.4 and earlier. Any users running affected versions of the C++ Client or the Python Client should rotate vulnerable OAuth2.0 credentials, including client_id and client_secret. 2.7 C++ and Python Client users should upgrade to 2.7.5 and rotate vulnerable OAuth2.0 credentials. 2.8 C++ and Python Client users should upgrade to 2.8.4 and rotate vulnerable OAuth2.0 credentials. 2.9 C++ and Python Client users should upgrade to 2.9.3 and rotate vulnerable OAuth2.0 credentials. 2.10 C++ and Python Client users should upgrade to 2.10.2 and rotate vulnerable OAuth2.0 credentials. 3.0 C++ users are unaffected and 3.0 Python Client users will be unaffected when it is released. Any users running the C++ and Python Client for 2.6 or less should upgrade to one of the above patched versions.
CVE-2022-33685 (severity: MEDIUM, weakness: CWE-561)
Unprotected dynamic receiver in Wearable Manager Service prior to SMR Jul-2022 Release 1 allows attacker to launch arbitray activity and access senstive information.
CVE-2022-33686 (severity: LOW, weakness: CWE-200)
Exposure of Sensitive Information in GsmAlarmManager prior to SMR Jul-2022 Release 1 allows local attacker to access iccid via log.
CVE-2022-33687 (severity: LOW, weakness: CWE-200)
Exposure of Sensitive Information in telephony-common.jar prior to SMR Jul-2022 Release 1 allows local attackers to access IMSI via log.
CVE-2022-33688 (severity: LOW, weakness: CWE-532)
Sensitive information exposure vulnerability in EventType in SecTelephonyProvider prior to SMR Jul-2022 Release 1 allows local attackers with log access permission to get IMSI through device log.
CVE-2022-33689 (severity: LOW, weakness: CWE-287)
Improper access control vulnerability in TelephonyUI prior to SMR Jul-2022 Release 1 allows attackers to change preferred network type by unprotected binder call.
CVE-2022-3369 (severity: MEDIUM, weakness: CWE-269)
An Improper Access Control vulnerability in the bdservicehost.exe component, as used in Bitdefender Engines for Windows, allows an attacker to delete privileged registry keys by pointing a Registry symlink to a privileged key. This issue affects: Bitdefender Engines versions prior to 7.92659. It also affects Bitdefender Antivirus Free, Bitdefender Antivirus Plus, Bitdefender Internet Security, Bitdefender Total Security, as well as Bitdefender Endpoint Security Tools for Windows with engine versions prior to 7.92659.
CVE-2022-33690 (severity: LOW, weakness: CWE-20)
Improper input validation in Contacts Storage prior to SMR Jul-2022 Release 1 allows attacker to access arbitrary file.
CVE-2022-33691 (severity: MEDIUM, weakness: CWE-367)
A possible race condition vulnerability in score driver prior to SMR Jul-2022 Release 1 can allow local attackers to interleave malicious operations.
CVE-2022-33692 (severity: LOW, weakness: CWE-213)
Exposure of Sensitive Information in Messaging application prior to SMR Jul-2022 Release 1 allows local attacker to access imsi and iccid via log.
CVE-2022-33693 (severity: LOW, weakness: CWE-200)
Exposure of Sensitive Information in CID Manager prior to SMR Jul-2022 Release 1 allows local attacker to access iccid via log.
CVE-2022-33694 (severity: LOW, weakness: CWE-213)
Exposure of Sensitive Information in CSC application prior to SMR Jul-2022 Release 1 allows local attacker to access wifi information via unprotected intent broadcasting.
CVE-2022-33695 (severity: HIGH, weakness: CWE-732)
Use of improper permission in InputManagerService prior to SMR Jul-2022 Release 1 allows unauthorized access to the service.
CVE-2022-33696 (severity: LOW, weakness: CWE-213)
Exposure of Sensitive Information in Telephony service prior to SMR Jul-2022 Release 1 allows local attacker to access imsi and iccid via log.
CVE-2022-33697 (severity: LOW, weakness: CWE-532)
Sensitive information exposure vulnerability in ImsServiceSwitchBase in ImsCore prior to SMR Jul-2022 Release 1 allows local attackers with log access permission to get IMSI through device log.
CVE-2022-33698 (severity: LOW, weakness: CWE-200)
Exposure of Sensitive Information in Telecom application prior to SMR Jul-2022 Release 1 allows local attackers to access ICCID via log.
CVE-2022-33699 (severity: LOW, weakness: CWE-200)
Exposure of Sensitive Information in getDsaSimImsi in TelephonyUI prior to SMR Jul-2022 Release 1 allows local attacker to access imsi via log.
CVE-2022-3370 (severity: HIGH, weakness: CWE-416)
Use after free in Custom Elements in Google Chrome prior to 106.0.5249.91 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVE-2022-33700 (severity: LOW, weakness: CWE-200)
Exposure of Sensitive Information in putDsaSimImsi in TelephonyUI prior to SMR Jul-2022 Release 1 allows local attacker to access imsi via log.
CVE-2022-33701 (severity: LOW, weakness: CWE-284)
Improper access control vulnerability in KnoxCustomManagerService prior to SMR Jul-2022 Release 1 allows attacker to call PowerManaer.goToSleep method which is protected by system permission by sending braodcast intent.
CVE-2022-33702 (severity: MEDIUM, weakness: CWE-285)
Improper authorization vulnerability in Knoxguard prior to SMR Jul-2022 Release 1 allows local attacker to disable keyguard and bypass Knoxguard lock by factory reset.
CVE-2022-33703 (severity: HIGH, weakness: CWE-20)
Improper validation vulnerability in CACertificateInfo prior to SMR Jul-2022 Release 1 allows attackers to launch certain activities.
CVE-2022-33704 (severity: HIGH, weakness: CWE-20)
Improper validation vulnerability in ucmRetParcelable of KnoxSDK prior to SMR Jul-2022 Release 1 allows attackers to launch certain activities.
CVE-2022-33705 (severity: LOW, weakness: CWE-285)
Information exposure in Calendar prior to version 12.3.05.10000 allows attacker to access calendar schedule without READ_CALENDAR permission.
CVE-2022-33706 (severity: LOW, weakness: CWE-284)
Improper access control vulnerability in Samsung Gallery prior to version 13.1.05.8 allows physical attackers to access the pictures using S Pen air gesture.
CVE-2022-33707 (severity: MEDIUM, weakness: CWE-334)
Improper identifier creation logic in Find My Mobile prior to version 7.2.24.12 allows attacker to identify the device.
CVE-2022-33708 (severity: HIGH, weakness: CWE-20)
Improper input validation vulnerability in AppsPackageInstaller in Galaxy Store prior to version 4.5.41.8 allows local attackers to launch activities as Galaxy Store privilege.
CVE-2022-33709 (severity: HIGH, weakness: CWE-20)
Improper input validation vulnerability in ApexPackageInstaller in Galaxy Store prior to version 4.5.41.8 allows local attackers to launch activities as Galaxy Store privilege.
CVE-2022-3371 (severity: HIGH, weakness: CWE-770)
Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.0a3.
CVE-2022-33710 (severity: HIGH, weakness: CWE-20)
Improper input validation vulnerability in BillingPackageInsraller in Galaxy Store prior to version 4.5.41.8 allows local attackers to launch activities as Galaxy Store privilege.
CVE-2022-33711 (severity: MEDIUM, weakness: CWE-354)
Improper validation of integrity check vulnerability in Samsung USB Driver Windows Installer for Mobile Phones prior to version 1.7.56.0 allows local attackers to delete arbitrary directory using directory junction.
CVE-2022-33712 (severity: MEDIUM, weakness: CWE-285)
Intent redirection vulnerability using implict intent in Camera prior to versions 12.0.01.64 ,12.0.3.23, 12.0.0.98, 12.0.6.11, 12.0.3.19 in Android S(12) allows attacker to get sensitive information.
CVE-2022-33713 (severity: HIGH, weakness: CWE-285)
Implicit Intent hijacking vulnerability in Samsung Cloud prior to version 5.2.0 allows attacker to get sensitive information.
CVE-2022-33714 (severity: LOW, weakness: CWE-284)
Improper access control vulnerability in SemWifiApBroadcastReceiver prior to SMR Aug-2022 Release 1 allows attacker to reset a setting value related to mobile hotspot.
CVE-2022-33715 (severity: MEDIUM, weakness: CWE-20)
Improper access control and path traversal vulnerability in LauncherProvider prior to SMR Aug-2022 Release 1 allow local attacker to access files of One UI.
CVE-2022-33716 (severity: MEDIUM, weakness: CWE-457)
An absence of variable initialization in ICCC TA prior to SMR Aug-2022 Release 1 allows local attacker to read uninitialized memory.
CVE-2022-33717 (severity: MEDIUM, weakness: CWE-125)
A missing input validation before memory read in SEM TA prior to SMR Aug-2022 Release 1 allows local attackers to read out of bound memory.
CVE-2022-33718 (severity: LOW, weakness: CWE-863)
An improper access control vulnerability in Wi-Fi Service prior to SMR AUG-2022 Release 1 allows untrusted applications to manipulate the list of apps that can use mobile data.
CVE-2022-33719 (severity: CRITICAL, weakness: CWE-20)
Improper input validation in baseband prior to SMR Aug-2022 Release 1 allows attackers to cause integer overflow to heap overflow.
CVE-2022-3372 (severity: HIGH, weakness: CWE-352)
There is a CSRF vulnerability on Netman-204 version 02.05. An attacker could manage to change administrator passwords through a Cross Site Request Forgery due to the lack of proper validation on the CRSF token. This vulnerability could allow a remote attacker to access the administrator panel, being able to modify different parameters that are critical for industrial operations.
CVE-2022-33720 (severity: LOW, weakness: CWE-284)
Improper authentication vulnerability in AppLock prior to SMR Aug-2022 Release 1 allows physical attacker to access Chrome locked by AppLock via new tap shortcut.
CVE-2022-33721 (severity: MEDIUM, weakness: CWE-94)
A vulnerability using PendingIntent in DeX for PC prior to SMR Aug-2022 Release 1 allows attackers to access files with system privilege.
CVE-2022-33722 (severity: LOW, weakness: CWE-285)
Implicit Intent hijacking vulnerability in Smart View prior to SMR Aug-2022 Release 1 allows attacker to access connected device MAC address.
CVE-2022-33723 (severity: MEDIUM, weakness: CWE-1021)
A vulnerable code in onCreate of BluetoothScanDialog prior to SMR Aug-2022 Release 1, allows attackers to trick the user to select an unwanted bluetooth device via tapjacking/overlay attack.
CVE-2022-33724 (severity: LOW, weakness: CWE-200)
Exposure of Sensitive Information in Samsung Dialer application?prior to SMR Aug-2022 Release 1 allows local attackers to access ICCID via log.
CVE-2022-33725 (severity: LOW, weakness: CWE-94)
A vulnerability using PendingIntent in Knox VPN prior to SMR Aug-2022 Release 1 allows attackers to access content providers with system privilege.
CVE-2022-33726 (severity: LOW, weakness: CWE-561)
Unprotected dynamic receiver in Samsung Galaxy Friends prior to SMR Aug-2022 Release 1 allows attacker to launch activity.
CVE-2022-33727 (severity: MEDIUM, weakness: CWE-1021)
A vulnerable code in onCreate of SecDevicePickerDialog prior to SMR Aug-2022 Release 1, allows attackers to trick the user to select an unwanted bluetooth device via tapjacking/overlay attack.
CVE-2022-33728 (severity: LOW, weakness: CWE-200)
Exposure of sensitive information in Bluetooth prior to SMR Aug-2022 Release 1 allows local attackers to access connected BT macAddress via Settings.Gloabal.
CVE-2022-33729 (severity: LOW, weakness: CWE-20)
Improper restriction of broadcasting Intent in ConfirmConnectActivity of?NFC prior to SMR Aug-2022 Release 1 leaks MAC address of the connected Bluetooth device.
CVE-2022-3373 (severity: HIGH, weakness: CWE-787)
Out of bounds write in V8 in Google Chrome prior to 106.0.5249.91 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: High)
CVE-2022-33730 (severity: MEDIUM, weakness: CWE-787)
Heap-based buffer overflow vulnerability in Samsung Dex for PC prior to SMR Aug-2022 Release 1 allows arbitrary code execution by physical attackers.
CVE-2022-33731 (severity: HIGH, weakness: CWE-284)
Improper access control vulnerability in DesktopSystemUI prior to SMR Aug-2022 Release 1 allows attackers to enable and disable arbitrary components.
CVE-2022-33732 (severity: HIGH, weakness: CWE-287)
Improper access control vulnerability in Samsung Dex for PC prior to SMR Aug-2022 Release 1 allows local attackers to scan and connect to PC by unprotected binder call.
CVE-2022-33733 (severity: LOW, weakness: CWE-927)
Sensitive information exposure in onCharacteristicRead in Charm by Samsung prior to version 1.2.3 allows attacker to get bluetooth connection information without permission.
CVE-2022-33734 (severity: MEDIUM, weakness: CWE-927)
Sensitive information exposure in onCharacteristicChanged in Charm by Samsung prior to version 1.2.3 allows attacker to get bluetooth connection information without permission.
CVE-2022-33735 (severity: MEDIUM, weakness: CWE-307)
There is a password verification vulnerability in WS7200-10 11.0.2.13. Attackers on the LAN may use brute force cracking to obtain passwords, which may cause sensitive system information to be disclosed.
CVE-2022-33736 (severity: HIGH, weakness: CWE-303)
A vulnerability has been identified in Opcenter Quality V13.1 (All versions < V13.1.20220624), Opcenter Quality V13.2 (All versions < V13.2.20220624). The affected applications do not properly validate login information during authentication. This could lead to denial of service condition for existing users or allow unauthenticated remote attackers to successfully login without credentials.