stasvinokur/cve-and-cwe-dataset-1999-2025 huggingface dataset:
CVE-2022-34642 (severity: MEDIUM, weakness: NVD-CWE-Other)
The component mcontrol.action in RISCV ISA Sim commit ac466a21df442c59962589ba296c702631e041b5 contains the incorrect mask which can cause a Denial of Service (DoS).
CVE-2022-34643 (severity: MEDIUM, weakness: CWE-755)
RISCV ISA Sim commit ac466a21df442c59962589ba296c702631e041b5 implements the incorrect exception priotrity when accessing memory.
CVE-2022-34648 (severity: MEDIUM, weakness: CWE-79)
Authenticated (author+) Stored Cross-Site Scripting (XSS) vulnerability in dmitrylitvinov Uploading SVG, WEBP and ICO files plugin <= 1.0.1 at WordPress.
CVE-2022-3465 (severity: CRITICAL, weakness: CWE-287)
A vulnerability classified as critical was found in Mediabridge Medialink. This vulnerability affects unknown code of the file /index.asp. The manipulation leads to improper authentication. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-210700.
CVE-2022-34650 (severity: MEDIUM, weakness: CWE-79)
Multiple Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerabilities in wpWax Team plugin <= 1.2.6 at WordPress.
CVE-2022-34651 (severity: HIGH, weakness: CWE-476)
In BIG-IP Versions 16.1.x before 16.1.3.1 and 15.1.x before 15.1.6.1, when an LTM Client or Server SSL profile with TLS 1.3 enabled is configured on a virtual server, along with an iRule that calls HTTP::respond, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVE-2022-34652 (severity: HIGH, weakness: CWE-89)
A sql injection vulnerability exists in the ObjectYPT functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to a SQL injection. An attacker can send an HTTP request to trigger this vulnerability.This vulnerability exists in the Live Schedules plugin, allowing an attacker to inject SQL by manipulating the description parameter.
CVE-2022-34654 (severity: HIGH, weakness: CWE-352)
Cross-Site Request Forgery (CSRF) in Virgial Berveling's Manage Notification E-mails plugin <= 1.8.2 on WordPress.
CVE-2022-34655 (severity: HIGH, weakness: CWE-457)
In BIG-IP Versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.6.1, and 14.1.x before 14.1.5, when an iRule containing the HTTP::payload command is configured on a virtual server, undisclosed traffic can cause Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVE-2022-34656 (severity: MEDIUM, weakness: CWE-79)
Authenticated (admin+) Cross-Site Scripting (XSS) vulnerability in wpdevart Poll, Survey, Questionnaire and Voting system plugin <= 1.7.4 at WordPress.
CVE-2022-34657 (severity: MEDIUM, weakness: CWE-20)
Improper input validation in firmware for some Intel(R) PCSD BIOS before version 02.01.0013 may allow a privileged user to potentially enable information disclosure via local access.
CVE-2022-34658 (severity: MEDIUM, weakness: CWE-79)
Multiple Authenticated (contributor+) Persistent Cross-Site Scripting (XSS) vulnerabilities in W3 Eden Download Manager plugin <= 3.2.48 at WordPress.
CVE-2022-34659 (severity: HIGH, weakness: CWE-200)
A vulnerability has been identified in Simcenter STAR-CCM+ (All versions only if the Power-on-Demand public license server is used). Affected applications expose user, host and display name of users, when the public license server is used. This could allow an attacker to retrieve this information.
CVE-2022-3466 (severity: MEDIUM, weakness: CWE-276)
The version of cri-o as released for Red Hat OpenShift Container Platform 4.9.48, 4.10.31, and 4.11.6 via RHBA-2022:6316, RHBA-2022:6257, and RHBA-2022:6658, respectively, included an incorrect version of cri-o missing the fix for CVE-2022-27652, which was previously fixed in OCP 4.9.41 and 4.10.12 via RHBA-2022:5433 and RHSA-2022:1600. This issue could allow an attacker with access to programs with inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs. For more details, see https://access.redhat.com/security/cve/CVE-2022-27652.
CVE-2022-34660 (severity: CRITICAL, weakness: CWE-77)
A vulnerability has been identified in Teamcenter V12.4 (All versions < V12.4.0.15), Teamcenter V13.0 (All versions < V13.0.0.10), Teamcenter V13.1 (All versions < V13.1.0.10), Teamcenter V13.2 (All versions < V13.2.0.9), Teamcenter V13.3 (All versions < V13.3.0.5), Teamcenter V14.0 (All versions < V14.0.0.2). File Server Cache service in Teamcenter consist of a functionality that is vulnerable to command injection. This could potentially allow an attacker to perform remote code execution.
CVE-2022-34661 (severity: HIGH, weakness: CWE-835)
A vulnerability has been identified in Teamcenter V12.4 (All versions < V12.4.0.15), Teamcenter V13.0 (All versions < V13.0.0.10), Teamcenter V13.1 (All versions < V13.1.0.10), Teamcenter V13.2 (All versions < V13.2.0.9), Teamcenter V13.3 (All versions < V13.3.0.5), Teamcenter V14.0 (All versions < V14.0.0.2). File Server Cache service in Teamcenter is vulnerable to denial of service by entering infinite loops and using up CPU cycles. This could allow an attacker to cause denial of service condition.
CVE-2022-34662 (severity: MEDIUM, weakness: CWE-22)
When users add resources to the resource center with a relation path will cause path traversal issues and only for logged-in users. You could upgrade to version 3.0.0 or higher
CVE-2022-34665 (severity: MEDIUM, weakness: CWE-476)
NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a local user with basic capabilities can cause a null-pointer dereference, which may lead to denial of service.
CVE-2022-34666 (severity: MEDIUM, weakness: CWE-476)
NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a local user with basic capabilities can cause a null-pointer dereference, which may lead to denial of service.
CVE-2022-34667 (severity: MEDIUM, weakness: CWE-121)
NVIDIA CUDA Toolkit SDK contains a stack-based buffer overflow vulnerability in cuobjdump, where an unprivileged remote attacker could exploit this buffer overflow condition by persuading a local user to download a specially crafted corrupted file and execute cuobjdump against it locally, which may lead to a limited denial of service and some loss of data integrity for the local user.
CVE-2022-34668 (severity: CRITICAL, weakness: CWE-502)
NVFLARE, versions prior to 2.1.4, contains a vulnerability that deserialization of Untrusted Data due to Pickle usage may allow an unprivileged network attacker to cause Remote Code Execution, Denial Of Service, and Impact to both Confidentiality and Integrity.
CVE-2022-34669 (severity: HIGH, weakness: CWE-73)
NVIDIA GPU Display Driver for Windows contains a vulnerability in the user mode layer, where an unprivileged regular user can access or modify system files or other files that are critical to the application, which may lead to code execution, denial of service, escalation of privileges, information disclosure, or data tampering.
CVE-2022-3467 (severity: CRITICAL, weakness: CWE-707)
A vulnerability classified as critical was found in Jiusi OA. Affected by this vulnerability is an unknown functionality of the file /jsoa/hntdCustomDesktopActionContent. The manipulation of the argument inforid leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier VDB-210709 was assigned to this vulnerability.
CVE-2022-34670 (severity: HIGH, weakness: CWE-197)
NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer handler, where an unprivileged regular user can cause truncation errors when casting a primitive to a primitive of smaller size causes data to be lost in the conversion, which may lead to denial of service or information disclosure.
CVE-2022-34671 (severity: HIGH, weakness: CWE-787)
NVIDIA GPU Display Driver for Windows contains a vulnerability in the user-mode layer, where an unprivileged user can cause an out-of-bounds write, which may lead to code execution, information disclosure, and denial of service.
CVE-2022-34672 (severity: HIGH, weakness: CWE-284)
NVIDIA Control Panel for Windows contains a vulnerability where an unauthorized user or an unprivileged regular user can compromise the security of the software by gaining privileges, reading sensitive information, or executing commands.
CVE-2022-34673 (severity: HIGH, weakness: CWE-190)
NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer (nvidia.ko), where an out-of-bounds array access may lead to denial of service, information disclosure, or data tampering.
CVE-2022-34674 (severity: MEDIUM, weakness: CWE-200)
NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer handler, where a helper function maps more physical pages than were requested, which may lead to undefined behavior or an information leak.
CVE-2022-34675 (severity: MEDIUM, weakness: CWE-476)
NVIDIA Display Driver for Linux contains a vulnerability in the Virtual GPU Manager, where it does not check the return value from a null-pointer dereference, which may lead to denial of service.
CVE-2022-34676 (severity: HIGH, weakness: CWE-197)
NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer handler, where an out-of-bounds read may lead to denial of service, information disclosure, or data tampering.
CVE-2022-34677 (severity: HIGH, weakness: CWE-125)
NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer handler, where an unprivileged regular user can cause an integer to be truncated, which may lead to denial of service or data tampering.
CVE-2022-34678 (severity: MEDIUM, weakness: CWE-476)
NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where an unprivileged user can cause a null-pointer dereference, which may lead to denial of service.
CVE-2022-34679 (severity: MEDIUM, weakness: CWE-476)
NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer handler, where an unhandled return value can lead to a null-pointer dereference, which may lead to denial of service.
CVE-2022-34680 (severity: MEDIUM, weakness: CWE-197)
NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer handler, where an integer truncation can lead to an out-of-bounds read, which may lead to denial of service.
CVE-2022-34681 (severity: MEDIUM, weakness: CWE-20)
NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler, where improper input validation of a display-related data structure may lead to denial of service.
CVE-2022-34682 (severity: MEDIUM, weakness: CWE-476)
NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer, where an unprivileged regular user can cause a null-pointer dereference, which may lead to denial of service.
CVE-2022-34683 (severity: MEDIUM, weakness: CWE-476)
NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape, where a null-pointer dereference occurs, which may lead to denial of service.
CVE-2022-34684 (severity: HIGH, weakness: CWE-125)
NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer (nvidia.ko), where an off-by-one error may lead to data tampering or information disclosure.
CVE-2022-34685 (severity: MEDIUM, weakness: NVD-CWE-Other)
Azure RTOS GUIX Studio Information Disclosure Vulnerability
CVE-2022-34686 (severity: MEDIUM, weakness: NVD-CWE-Other)
Azure RTOS GUIX Studio Information Disclosure Vulnerability
CVE-2022-34687 (severity: HIGH, weakness: NVD-CWE-Other)
Azure RTOS GUIX Studio Remote Code Execution Vulnerability
CVE-2022-34689 (severity: HIGH, weakness: CWE-290)
Windows CryptoAPI Spoofing Vulnerability
CVE-2022-3469 (severity: MEDIUM, weakness: CWE-79)
The WP Attachments WordPress plugin before 5.0.5 does not sanitize and escapes some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example, in multisite setup).
CVE-2022-34690 (severity: HIGH, weakness: NVD-CWE-Other)
Windows Fax Service Elevation of Privilege Vulnerability
CVE-2022-34691 (severity: HIGH, weakness: NVD-CWE-Other)
Active Directory Domain Services Elevation of Privilege Vulnerability
CVE-2022-34692 (severity: MEDIUM, weakness: NVD-CWE-Other)
Microsoft Exchange Server Information Disclosure Vulnerability
CVE-2022-34696 (severity: HIGH, weakness: CWE-362)
Windows Hyper-V Remote Code Execution Vulnerability
CVE-2022-34699 (severity: HIGH, weakness: NVD-CWE-Other)
Windows Win32k Elevation of Privilege Vulnerability
CVE-2022-3470 (severity: MEDIUM, weakness: CWE-707)
A vulnerability was found in SourceCodester Human Resource Management System. It has been classified as critical. Affected is an unknown function of the file getstatecity.php. The manipulation of the argument sc leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-210714 is the identifier assigned to this vulnerability.
CVE-2022-34700 (severity: HIGH, weakness: CWE-89)
Microsoft Dynamics CRM (on-premises) Remote Code Execution Vulnerability
CVE-2022-34701 (severity: HIGH, weakness: NVD-CWE-Other)
Windows Secure Socket Tunneling Protocol (SSTP) Denial of Service Vulnerability
CVE-2022-34702 (severity: HIGH, weakness: CWE-362)
Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability
CVE-2022-34703 (severity: HIGH, weakness: NVD-CWE-Other)
Windows Partition Management Driver Elevation of Privilege Vulnerability
CVE-2022-34704 (severity: MEDIUM, weakness: CWE-203)
Windows Defender Credential Guard Information Disclosure Vulnerability
CVE-2022-34705 (severity: HIGH, weakness: CWE-416)
Windows Defender Credential Guard Elevation of Privilege Vulnerability
CVE-2022-34706 (severity: HIGH, weakness: NVD-CWE-Other)
Windows Local Security Authority (LSA) Elevation of Privilege Vulnerability
CVE-2022-34707 (severity: HIGH, weakness: CWE-416)
Windows Kernel Elevation of Privilege Vulnerability
CVE-2022-34708 (severity: MEDIUM, weakness: CWE-200)
Windows Kernel Information Disclosure Vulnerability
CVE-2022-34709 (severity: MEDIUM, weakness: CWE-843)
Windows Defender Credential Guard Security Feature Bypass Vulnerability
CVE-2022-3471 (severity: MEDIUM, weakness: CWE-707)
A vulnerability was found in SourceCodester Human Resource Management System. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file city.php. The manipulation of the argument searccity leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-210715.
CVE-2022-34710 (severity: MEDIUM, weakness: CWE-200)
Windows Defender Credential Guard Information Disclosure Vulnerability
CVE-2022-34711 (severity: HIGH, weakness: NVD-CWE-Other)
Windows Defender Credential Guard Elevation of Privilege Vulnerability
CVE-2022-34712 (severity: MEDIUM, weakness: CWE-200)
Windows Defender Credential Guard Information Disclosure Vulnerability
CVE-2022-34713 (severity: HIGH, weakness: NVD-CWE-Other)
Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability
CVE-2022-34714 (severity: HIGH, weakness: CWE-94)
Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability
CVE-2022-34715 (severity: CRITICAL, weakness: CWE-94)
Windows Network File System Remote Code Execution Vulnerability
CVE-2022-34716 (severity: MEDIUM, weakness: CWE-290)
.NET Spoofing Vulnerability
CVE-2022-34717 (severity: HIGH, weakness: NVD-CWE-Other)
Microsoft Office Remote Code Execution Vulnerability
CVE-2022-34718 (severity: CRITICAL, weakness: NVD-CWE-Other)
Windows TCP/IP Remote Code Execution Vulnerability
CVE-2022-34719 (severity: HIGH, weakness: NVD-CWE-Other)
Windows Distributed File System (DFS) Elevation of Privilege Vulnerability
CVE-2022-3472 (severity: MEDIUM, weakness: CWE-707)
A vulnerability was found in SourceCodester Human Resource Management System. It has been rated as critical. Affected by this issue is some unknown functionality of the file city.php. The manipulation of the argument cityedit leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-210716.
CVE-2022-34720 (severity: HIGH, weakness: NVD-CWE-Other)
Windows Internet Key Exchange (IKE) Extension Denial of Service Vulnerability
CVE-2022-34721 (severity: CRITICAL, weakness: NVD-CWE-Other)
Windows Internet Key Exchange (IKE) Protocol Extensions Remote Code Execution Vulnerability
CVE-2022-34722 (severity: CRITICAL, weakness: NVD-CWE-Other)
Windows Internet Key Exchange (IKE) Protocol Extensions Remote Code Execution Vulnerability
CVE-2022-34723 (severity: MEDIUM, weakness: NVD-CWE-Other)
Windows DPAPI (Data Protection Application Programming Interface) Information Disclosure Vulnerability
CVE-2022-34724 (severity: HIGH, weakness: NVD-CWE-Other)
Windows DNS Server Denial of Service Vulnerability
CVE-2022-34725 (severity: HIGH, weakness: CWE-362)
Windows ALPC Elevation of Privilege Vulnerability
CVE-2022-34726 (severity: HIGH, weakness: NVD-CWE-Other)
Microsoft ODBC Driver Remote Code Execution Vulnerability
CVE-2022-34727 (severity: HIGH, weakness: NVD-CWE-Other)
Microsoft ODBC Driver Remote Code Execution Vulnerability
CVE-2022-34728 (severity: MEDIUM, weakness: NVD-CWE-Other)
Windows Graphics Component Information Disclosure Vulnerability
CVE-2022-34729 (severity: HIGH, weakness: NVD-CWE-Other)
Windows GDI Elevation of Privilege Vulnerability
CVE-2022-3473 (severity: MEDIUM, weakness: CWE-707)
A vulnerability classified as critical has been found in SourceCodester Human Resource Management System. This affects an unknown part of the file getstatecity.php. The manipulation of the argument ci leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-210717 was assigned to this vulnerability.
CVE-2022-34730 (severity: HIGH, weakness: NVD-CWE-Other)
Microsoft ODBC Driver Remote Code Execution Vulnerability
CVE-2022-34731 (severity: HIGH, weakness: NVD-CWE-Other)
Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
CVE-2022-34732 (severity: HIGH, weakness: NVD-CWE-Other)
Microsoft ODBC Driver Remote Code Execution Vulnerability
CVE-2022-34733 (severity: HIGH, weakness: NVD-CWE-Other)
Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
CVE-2022-34734 (severity: HIGH, weakness: NVD-CWE-Other)
Microsoft ODBC Driver Remote Code Execution Vulnerability
CVE-2022-34735 (severity: HIGH, weakness: CWE-476)
The frame scheduling module has a null pointer dereference vulnerability. Successful exploitation of this vulnerability will affect the kernel availability.
CVE-2022-34736 (severity: HIGH, weakness: CWE-476)
The frame scheduling module has a null pointer dereference vulnerability. Successful exploitation of this vulnerability will affect the kernel availability.
CVE-2022-34737 (severity: CRITICAL, weakness: CWE-276)
The application security module has a vulnerability in permission assignment. Successful exploitation of this vulnerability may affect data integrity and confidentiality.
CVE-2022-34738 (severity: HIGH, weakness: NVD-CWE-Other)
The SystemUI module has a vulnerability in permission control. If this vulnerability is successfully exploited, users are unaware of the service running in the background.
CVE-2022-34739 (severity: HIGH, weakness: NVD-CWE-Other)
The fingerprint module has a vulnerability of overflow in arithmetic addition. Successful exploitation of this vulnerability may result in the acquisition of data from unknown addresses in address mappings.
CVE-2022-3474 (severity: MEDIUM, weakness: CWE-522)
A bad credential handling in the remote assets API for Bazel versions prior to 5.3.2 and 4.2.3 sends all user-provided credentials instead of only the required ones for the requests. We recommend upgrading to versions later than or equal to 5.3.2 or 4.2.3.
CVE-2022-34740 (severity: MEDIUM, weakness: CWE-120)
The NFC module has a buffer overflow vulnerability. Successful exploitation of this vulnerability may cause exceptions in NFC card registration, deletion, and activation.
CVE-2022-34741 (severity: MEDIUM, weakness: CWE-120)
The NFC module has a buffer overflow vulnerability. Successful exploitation of this vulnerability may cause exceptions in NFC card registration, deletion, and activation.
CVE-2022-34742 (severity: HIGH, weakness: CWE-125)
The system module has a read/write vulnerability. Successful exploitation of this vulnerability may affect data confidentiality.
CVE-2022-34743 (severity: HIGH, weakness: CWE-125)
The AT commands of the USB port have an out-of-bounds read vulnerability. Successful exploitation of this vulnerability may affect system availability.
CVE-2022-34746 (severity: MEDIUM, weakness: CWE-331)
An insufficient entropy vulnerability caused by the improper use of randomness sources with low entropy for RSA key pair generation was found in Zyxel GS1900 series firmware versions prior to V2.70. This vulnerability could allow an unauthenticated attacker to retrieve a private key by factoring the RSA modulus N in the certificate of the web administration interface.
CVE-2022-34747 (severity: CRITICAL, weakness: CWE-134)
A format string vulnerability in Zyxel NAS326 firmware versions prior to V5.21(AAZF.12)C0 could allow an attacker to achieve unauthorized remote code execution via a crafted UDP packet.
CVE-2022-34748 (severity: HIGH, weakness: CWE-787)
A vulnerability has been identified in Simcenter Femap (All versions < V2022.2). The affected application contains an out of bounds write past the end of an allocated structure while parsing specially crafted X_T files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-17293)
CVE-2022-34749 (severity: HIGH, weakness: CWE-1333)
In mistune through 2.0.2, support of inline markup is implemented by using regular expressions that can involve a high amount of backtracking on certain edge cases. This behavior is commonly named catastrophic backtracking.
CVE-2022-34750 (severity: HIGH, weakness: CWE-770)
An issue was discovered in MediaWiki through 1.38.1. The lemma length of a Wikibase lexeme is currently capped at a thousand characters. Unfortunately, this length is not validated, allowing much larger lexemes to be created, which introduces various denial-of-service attack vectors within the Wikibase and WikibaseLexeme extensions. This is related to Special:NewLexeme and Special:NewProperty.
CVE-2022-34753 (severity: HIGH, weakness: CWE-78)
A CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause remote root exploit when the command is compromised. Affected Products: SpaceLogic C-Bus Home Controller (5200WHC2), formerly known as C-Bus Wiser Homer Controller MK2 (V1.31.460 and prior)
CVE-2022-34754 (severity: MEDIUM, weakness: CWE-269)
A CWE-269: Improper Privilege Management vulnerability exists that could allow elevated functionality when guessing credentials. Affected Products: Acti9 PowerTag Link C (A9XELC10-A) (V1.7.5 and prior), Acti9 PowerTag Link C (A9XELC10-B) (V2.12.0 and prior)
CVE-2022-34755 (severity: MEDIUM, weakness: CWE-427)
A CWE-427 - Uncontrolled Search Path Element vulnerability exists that could allow an attacker with a local privileged account to place a specially crafted file on the target machine, which may give the attacker the ability to execute arbitrary code during the installation process initiated by a valid user. Affected Products: Easergy Builder Installer (1.7.23 and prior)