Vulnerabilites related to ni - flexlogger
Vulnerability from fkie_nvd
Published
2022-04-21 05:15
Modified
2024-11-21 06:55
Severity ?
Summary
There is a cross-site scripting (XSS) vulnerability in an NI Web Server component installed with several NI products. Depending on the product(s) in use, remediation guidance includes: install SystemLink version 2021 R3 or later, install FlexLogger 2022 Q2 or later, install LabVIEW 2021 SP1, install G Web Development 2022 R1 or later, or install Static Test Software Suite version 1.2 or later.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://www.ni.com/en-us/support/documentation/supplemental/22/cross-site-scripting-vulnerability--in-ni-web-server-component.html | Mitigation, Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.ni.com/en-us/support/documentation/supplemental/22/cross-site-scripting-vulnerability--in-ni-web-server-component.html | Mitigation, Patch, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ni | flexlogger | 2021 | |
| ni | flexlogger | 2021 | |
| ni | flexlogger | 2021 | |
| ni | g_web_development_software | 2021 | |
| ni | g_web_development_software | 2021 | |
| ni | labview | 2021 | |
| ni | labview | 2021 | |
| ni | static_test_software_suite | * | |
| ni | systemlink | 2020 | |
| ni | systemlink | 2022 | |
| ni | systemlink | 2022 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ni:flexlogger:2021:r2:*:*:*:*:*:*",
"matchCriteriaId": "CE96AE31-D36F-446A-96A5-46C762818A96",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ni:flexlogger:2021:r3:*:*:*:*:*:*",
"matchCriteriaId": "336F1E07-92EE-4BF5-AA14-981BFB67965C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ni:flexlogger:2021:r4:*:*:*:*:*:*",
"matchCriteriaId": "7D3A4BF7-5BF0-4EE5-BF7C-8C514D6238B5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ni:g_web_development_software:2021:*:*:*:-:*:*:*",
"matchCriteriaId": "135688EB-A45C-4837-8ADC-CE0E0393457D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ni:g_web_development_software:2021:*:*:*:community:*:*:*",
"matchCriteriaId": "EF01F242-0C8B-457E-8116-6B144AEB94C2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ni:labview:2021:-:*:*:-:*:*:*",
"matchCriteriaId": "F46539B2-9084-45E3-B9D6-447C9E002C0C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ni:labview:2021:-:*:*:community:*:*:*",
"matchCriteriaId": "BF15292D-3504-4386-BD9B-99A65FE22A2D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ni:static_test_software_suite:*:*:*:*:*:*:*:*",
"matchCriteriaId": "738E76CB-643A-424E-85B0-65B6CFEB24B0",
"versionEndExcluding": "1.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ni:systemlink:2020:r4:*:*:*:*:*:*",
"matchCriteriaId": "3C507CEF-2AB1-4CF7-A66F-D3EAABA1D626",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ni:systemlink:2022:r1:*:*:*:*:*:*",
"matchCriteriaId": "10ED5155-30C4-4278-82EF-DDEC2C12E9D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ni:systemlink:2022:r2:*:*:*:*:*:*",
"matchCriteriaId": "670B26C0-2ECE-4AC9-A3C2-3340D8F02040",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "There is a cross-site scripting (XSS) vulnerability in an NI Web Server component installed with several NI products. Depending on the product(s) in use, remediation guidance includes: install SystemLink version 2021 R3 or later, install FlexLogger 2022 Q2 or later, install LabVIEW 2021 SP1, install G Web Development 2022 R1 or later, or install Static Test Software Suite version 1.2 or later."
},
{
"lang": "es",
"value": "Se presenta una vulnerabilidad de tipo cross-site scripting (XSS) en un componente de NI Web Server instalado con varios productos de NI. Dependiendo del producto(s) en uso, la gu\u00eda de remediaci\u00f3n incluye: instalar SystemLink versi\u00f3n 2021 R3 o posterior, instalar FlexLogger 2022 Q2 o posterior, instalar LabVIEW 2021 SP1, instalar G Web Development 2022 R1 o posterior, o instalar Static Test Software Suite versi\u00f3n 1.2 o posterior"
}
],
"id": "CVE-2022-27237",
"lastModified": "2024-11-21T06:55:28.160",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2022-04-21T05:15:06.800",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Mitigation",
"Patch",
"Vendor Advisory"
],
"url": "https://www.ni.com/en-us/support/documentation/supplemental/22/cross-site-scripting-vulnerability--in-ni-web-server-component.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mitigation",
"Patch",
"Vendor Advisory"
],
"url": "https://www.ni.com/en-us/support/documentation/supplemental/22/cross-site-scripting-vulnerability--in-ni-web-server-component.html"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2023-11-08 16:15
Modified
2024-11-21 08:41
Severity ?
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Summary
An incorrect permission assignment in the TopoGrafix DataPlugin for GPX could result in information disclosure. An attacker could exploit this vulnerability by getting a user to open a specially crafted data file.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ni:topografix_data_plugin:2023:-:*:*:*:gpx:*:*",
"matchCriteriaId": "15732407-23EA-4542-96A2-5C878FB8481F",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ni:diadem:2014:*:*:*:*:*:*:*",
"matchCriteriaId": "1D2B3E07-5832-4ABE-B7F8-EDFFC91940E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ni:diadem:2015:-:*:*:*:*:*:*",
"matchCriteriaId": "B3D7F82A-8406-4B50-A9BA-CCB34A974F87",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ni:diadem:2015:sp2:*:*:*:*:*:*",
"matchCriteriaId": "5CA88F99-AE0F-4B98-B86A-4B5289520DA0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ni:diadem:2017:-:*:*:*:*:*:*",
"matchCriteriaId": "7A59840A-5F72-4FB9-8B67-A91439E7DA1E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ni:diadem:2017:sp1:*:*:*:*:*:*",
"matchCriteriaId": "2DBC89AC-5BA4-432B-96D8-57A5E9B6A338",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ni:diadem:2018:-:*:*:*:*:*:*",
"matchCriteriaId": "C853AE58-D3C8-4627-A0D8-542382650932",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ni:diadem:2018:sp1:*:*:*:*:*:*",
"matchCriteriaId": "87C3A752-E66D-4F4C-B6FB-F572EAF092B0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ni:diadem:2019:-:*:*:*:*:*:*",
"matchCriteriaId": "3F41FF00-1098-43B3-822A-8AC92B991F20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ni:diadem:2019:sp1:*:*:*:*:*:*",
"matchCriteriaId": "3525F92B-30ED-4798-BF89-14D8EFCD7CC3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ni:diadem:2020:-:*:*:*:*:*:*",
"matchCriteriaId": "7D3458A8-E460-4297-A69F-C4DDE1D232F3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ni:diadem:2020:sp1:*:*:*:*:*:*",
"matchCriteriaId": "49A24A9A-8601-49DA-8E7D-798D2E399273",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ni:diadem:2021:-:*:*:*:*:*:*",
"matchCriteriaId": "4101C29B-BB75-47B6-9D2D-BC5491969EEB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ni:diadem:2021:sp1:*:*:*:*:*:*",
"matchCriteriaId": "10D8EBAC-D4CF-4841-AE65-5F8A1121788C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ni:diadem:2022:q2:*:*:*:*:*:*",
"matchCriteriaId": "7C10702F-B2C2-46FF-88FF-2A314B502ED4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ni:diadem:2022:q4:*:*:*:*:*:*",
"matchCriteriaId": "8C05E9A6-7B7D-4928-A60E-24942D4D51F5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ni:diadem:2023:q2:*:*:*:*:*:*",
"matchCriteriaId": "9044BC02-8801-4DBD-8529-49DB7F0D3452",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ni:veristand:2013:sp1:*:*:*:*:*:*",
"matchCriteriaId": "F499514A-19DE-469D-9EF6-F7EC1E6810BC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ni:veristand:2014:*:*:*:*:*:*:*",
"matchCriteriaId": "D68D0C2C-C42D-4B8C-A3D6-93A136E5DD21",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ni:veristand:2015:-:*:*:*:*:*:*",
"matchCriteriaId": "29FA2254-FF6C-4FCA-8363-B36E4C38C6BC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ni:veristand:2015:sp1:*:*:*:*:*:*",
"matchCriteriaId": "18577799-88E6-44C1-9477-3261EA98ED4F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ni:veristand:2016:*:*:*:*:*:*:*",
"matchCriteriaId": "CA705301-337E-4162-8810-BF20B23CB9E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ni:veristand:2017:*:*:*:*:*:*:*",
"matchCriteriaId": "B5F1303A-A8D9-4E60-BB96-3B00AAAAD8A2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ni:veristand:2018:-:*:*:*:*:*:*",
"matchCriteriaId": "4FAF54A5-268E-4A76-9C31-F3E2FE465464",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ni:veristand:2018:sp1:*:*:*:*:*:*",
"matchCriteriaId": "E98B7755-005F-4036-AF81-002F113DBCD6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ni:veristand:2019:-:*:*:*:*:*:*",
"matchCriteriaId": "55743F60-FA68-494E-87B9-8E22787EEF4C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ni:veristand:2019:r2:*:*:*:*:*:*",
"matchCriteriaId": "2CA4257E-5E97-46D6-BE97-205F6FC18CA3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ni:veristand:2019:r3:*:*:*:*:*:*",
"matchCriteriaId": "541008B0-5703-4937-9304-C09645454085",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ni:veristand:2019:r3f1:*:*:*:*:*:*",
"matchCriteriaId": "5970C421-B8B1-459F-85DB-E74A0B31EDCB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ni:veristand:2020:-:*:*:*:*:*:*",
"matchCriteriaId": "55ADD725-44EE-4F28-B9A3-923094352C4C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ni:veristand:2020:r2:*:*:*:*:*:*",
"matchCriteriaId": "58D19502-B3F2-4D43-A4D2-CF6CD2E41E48",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ni:veristand:2020:r3:*:*:*:*:*:*",
"matchCriteriaId": "AAF6DE83-A202-4A90-8B05-735D686FDB8E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ni:veristand:2020:r4:*:*:*:*:*:*",
"matchCriteriaId": "C90473FA-81CB-4984-8B4C-2EE907ED9DC0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ni:veristand:2020:r5:*:*:*:*:*:*",
"matchCriteriaId": "B09E4798-97D8-41B7-9E3C-A5D45F8C8CB5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ni:veristand:2020:r6:*:*:*:*:*:*",
"matchCriteriaId": "03D1BFD1-E75E-4816-9D3B-380DACB50EFC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ni:veristand:2021:-:*:*:*:*:*:*",
"matchCriteriaId": "C0BC96D8-AB88-47BF-B956-818BF9C8E91E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ni:veristand:2021:r2:*:*:*:*:*:*",
"matchCriteriaId": "CD0B65DD-E62E-4D7F-90C4-EE8EACE23F8B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ni:veristand:2021:r3:*:*:*:*:*:*",
"matchCriteriaId": "006E30B2-90DC-475D-835B-030A5801332F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ni:veristand:2023:q1:*:*:*:*:*:*",
"matchCriteriaId": "326C3FE1-6CE7-4FD4-9E8A-C14E1A0BE743",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ni:veristand:2023:q2:*:*:*:*:*:*",
"matchCriteriaId": "406FE5DA-02BE-4981-8F0E-C77840C5CB5F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ni:veristand:2023:q3:*:*:*:*:*:*",
"matchCriteriaId": "2B89A08C-C66E-400A-A224-DF6ED111D565",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ni:veristand:2023:q4:*:*:*:*:*:*",
"matchCriteriaId": "2A151AB1-BD09-4DF0-B7DD-4D8E1E7E026C",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ni:flexlogger:2018:r1:*:*:*:*:*:*",
"matchCriteriaId": "9C2C31C3-9D4C-4FEE-8457-31E9F66CD043",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ni:flexlogger:2018:r2:*:*:*:*:*:*",
"matchCriteriaId": "F16894B6-5151-41DE-A1AC-7FB3C23DC05F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ni:flexlogger:2018:r3:*:*:*:*:*:*",
"matchCriteriaId": "4BE623D6-DE16-40ED-82CF-3CCD975B5C92",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ni:flexlogger:2018:r4:*:*:*:*:*:*",
"matchCriteriaId": "0375EAF9-35F8-43AB-A26D-79B1C74E6055",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ni:flexlogger:2019:r1:*:*:*:*:*:*",
"matchCriteriaId": "1E8E8A79-BCBA-42D0-A4D5-4134327FDB07",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ni:flexlogger:2019:r2:*:*:*:*:*:*",
"matchCriteriaId": "91A2082B-47F5-4DFD-A9CE-115DB223B4A0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ni:flexlogger:2019:r3:*:*:*:*:*:*",
"matchCriteriaId": "758C8631-05F4-415B-861A-FF47896756BB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ni:flexlogger:2019:r4:*:*:*:*:*:*",
"matchCriteriaId": "CA0E5A70-2CE4-485F-97BC-CEF8FC2C6C62",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ni:flexlogger:2020:r1:*:*:*:*:*:*",
"matchCriteriaId": "852AC7E1-DE18-4EAD-9079-7E3DF5EAD9A2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ni:flexlogger:2020:r2:*:*:*:*:*:*",
"matchCriteriaId": "055A3E53-09AC-4CD4-8724-21E3F591550E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ni:flexlogger:2020:r3:*:*:*:*:*:*",
"matchCriteriaId": "BEE4C627-4298-469E-91BA-08C711F7EE14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ni:flexlogger:2020:r4:*:*:*:*:*:*",
"matchCriteriaId": "A7BB6592-DBC5-4D4C-96AD-CDE24E1F576A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ni:flexlogger:2021:r1:*:*:*:*:*:*",
"matchCriteriaId": "008505B6-6295-46CE-A923-27958172F026",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ni:flexlogger:2021:r2:*:*:*:*:*:*",
"matchCriteriaId": "CE96AE31-D36F-446A-96A5-46C762818A96",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ni:flexlogger:2021:r3:*:*:*:*:*:*",
"matchCriteriaId": "336F1E07-92EE-4BF5-AA14-981BFB67965C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ni:flexlogger:2021:r4:*:*:*:*:*:*",
"matchCriteriaId": "7D3A4BF7-5BF0-4EE5-BF7C-8C514D6238B5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ni:flexlogger:2022:q2:*:*:*:*:*:*",
"matchCriteriaId": "0213180D-04BD-4979-88BE-B21F385469CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ni:flexlogger:2022:q4:*:*:*:*:*:*",
"matchCriteriaId": "A336AAE6-FA87-4900-AECD-12997D064A64",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ni:flexlogger:2023:q1:*:*:*:*:*:*",
"matchCriteriaId": "CBFBD9F4-9FFF-44B2-8E95-2DEAC4476A88",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ni:flexlogger:2023:q2:*:*:*:*:*:*",
"matchCriteriaId": "FA33AE39-F976-4C56-9A4B-8932BC6855C9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ni:flexlogger:2023:q3:*:*:*:*:*:*",
"matchCriteriaId": "21C2A279-F66F-49D3-A4A8-1D56FEF22B6B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ni:flexlogger:2023:q4:*:*:*:*:*:*",
"matchCriteriaId": "08133BDF-895D-4D2A-8DAB-C02766DE86B1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An incorrect permission assignment in the TopoGrafix DataPlugin for GPX could result in information disclosure. An attacker could exploit this vulnerability by getting a user to open a specially crafted data file."
},
{
"lang": "es",
"value": "Una asignaci\u00f3n de permiso incorrecta en TopoGrafix DataPlugin para GPX podr\u00eda resultar en la divulgaci\u00f3n de informaci\u00f3n. Un atacante podr\u00eda aprovechar esta vulnerabilidad haciendo que un usuario abra un archivo de datos especialmente manipulado."
}
],
"id": "CVE-2023-5136",
"lastModified": "2024-11-21T08:41:08.100",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 3.6,
"source": "security@ni.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2023-11-08T16:15:11.067",
"references": [
{
"source": "security@ni.com",
"tags": [
"Vendor Advisory"
],
"url": "https://www.ni.com/en/support/documentation/supplemental/23/incorrect-permission-assignment-in-the-topografix-dataplug-for-gpx.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.ni.com/en/support/documentation/supplemental/23/incorrect-permission-assignment-in-the-topografix-dataplug-for-gpx.html"
}
],
"sourceIdentifier": "security@ni.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-611"
}
],
"source": "security@ni.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-732"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2024-07-22 20:15
Modified
2024-11-21 09:49
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
An out-of-date version of Redis shipped with NI SystemLink Server is susceptible to multiple vulnerabilities, including CVE-2022-24834. This affects NI SystemLink Server 2024 Q1 and prior versions. It also affects NI FlexLogger 2023 Q2 and prior versions which installed this shared service.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ni | flexlogger | * | |
| ni | flexlogger | 2023 | |
| ni | systemlink | * | |
| ni | systemlink | 2024 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ni:flexlogger:*:*:*:*:*:*:*:*",
"matchCriteriaId": "8D4CB33D-BB7C-4EBD-9E78-A9EDF952A7A6",
"versionEndIncluding": "2023",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ni:flexlogger:2023:q2:*:*:*:*:*:*",
"matchCriteriaId": "FA33AE39-F976-4C56-9A4B-8932BC6855C9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ni:systemlink:*:*:*:*:*:*:*:*",
"matchCriteriaId": "61E2B822-C1E9-4ED5-A6D1-FF569A414330",
"versionEndIncluding": "2024",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ni:systemlink:2024:q1:*:*:*:*:*:*",
"matchCriteriaId": "FA70DCDA-FE97-42A2-B45E-33154D29B840",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An out-of-date version of Redis shipped with NI SystemLink Server is susceptible to multiple vulnerabilities, including CVE-2022-24834. This affects NI SystemLink Server 2024 Q1 and prior versions. It also affects NI FlexLogger 2023 Q2 and prior versions which installed this shared service."
},
{
"lang": "es",
"value": " Una versi\u00f3n desactualizada de Redis enviada con NI SystemLink Server es susceptible a m\u00faltiples vulnerabilidades, incluida CVE-2022-24834. Esto afecta a NI SystemLink Server 2024 Q1 y versiones anteriores. Tambi\u00e9n afecta a NI FlexLogger 2023 Q2 y versiones anteriores que instalaron este servicio compartido."
}
],
"id": "CVE-2024-6121",
"lastModified": "2024-11-21T09:49:00.370",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9,
"source": "security@ni.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2024-07-22T20:15:04.267",
"references": [
{
"source": "security@ni.com",
"tags": [
"Vendor Advisory"
],
"url": "https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/ni-systemlink-server-ships-out-of-date-redis-version.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/ni-systemlink-server-ships-out-of-date-redis-version.html"
}
],
"sourceIdentifier": "security@ni.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2024-07-22 20:15
Modified
2024-11-21 09:49
Severity ?
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Summary
An incorrect permission in the installation directory for the shared NI SystemLink Server KeyValueDatabase service may result in information disclosure via local access. This affects NI SystemLink Server 2024 Q1 and prior versions. It also affects NI FlexLogger 2023 Q2 and prior versions which installed this shared service.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ni | systemlink | * | |
| ni | systemlink | 2024 | |
| ni | flexlogger | * | |
| ni | flexlogger | 2023 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ni:systemlink:*:*:*:*:*:*:*:*",
"matchCriteriaId": "61E2B822-C1E9-4ED5-A6D1-FF569A414330",
"versionEndIncluding": "2024",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ni:systemlink:2024:q1:*:*:*:*:*:*",
"matchCriteriaId": "FA70DCDA-FE97-42A2-B45E-33154D29B840",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ni:flexlogger:*:*:*:*:*:*:*:*",
"matchCriteriaId": "8D4CB33D-BB7C-4EBD-9E78-A9EDF952A7A6",
"versionEndIncluding": "2023",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ni:flexlogger:2023:q2:*:*:*:*:*:*",
"matchCriteriaId": "FA33AE39-F976-4C56-9A4B-8932BC6855C9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An incorrect permission in the installation directory for the shared NI SystemLink Server KeyValueDatabase service may result in information disclosure via local access. This affects NI SystemLink Server 2024 Q1 and prior versions. It also affects NI FlexLogger 2023 Q2 and prior versions which installed this shared service."
},
{
"lang": "es",
"value": " Un permiso incorrecto en el directorio de instalaci\u00f3n para el servicio compartido NI SystemLink Server KeyValueDatabase puede resultar en la divulgaci\u00f3n de informaci\u00f3n a trav\u00e9s del acceso local. Esto afecta a NI SystemLink Server 2024 Q1 y versiones anteriores. Tambi\u00e9n afecta a NI FlexLogger 2023 Q2 y versiones anteriores que instalaron este servicio compartido."
}
],
"id": "CVE-2024-6122",
"lastModified": "2024-11-21T09:49:00.507",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 3.6,
"source": "security@ni.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2024-07-22T20:15:04.470",
"references": [
{
"source": "security@ni.com",
"tags": [
"Mitigation",
"Vendor Advisory"
],
"url": "https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/incorrect-default-directory-permissions-for-ni-systemlink-redis-service.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mitigation",
"Vendor Advisory"
],
"url": "https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/incorrect-default-directory-permissions-for-ni-systemlink-redis-service.html"
}
],
"sourceIdentifier": "security@ni.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-276"
}
],
"source": "security@ni.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-276"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2025-03-18 14:15
Modified
2025-08-18 13:56
Severity ?
Summary
NI FlexLogger usiReg URI File Parsing Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to create arbitrary files on affected installations of NI FlexLogger. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the parsing of URI files by the usiReg component. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-21805.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| zdi-disclosures@trendmicro.com | https://www.zerodayinitiative.com/advisories/ZDI-25-146/ | Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ni | flexlogger | 2024 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ni:flexlogger:2024:q1:*:*:*:*:*:*",
"matchCriteriaId": "51A28944-C7A3-4750-908A-67FCF24B510B",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "NI FlexLogger usiReg URI File Parsing Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to create arbitrary files on affected installations of NI FlexLogger. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of URI files by the usiReg component. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-21805."
},
{
"lang": "es",
"value": "Vulnerabilidad de ejecuci\u00f3n remota de c\u00f3digo mediante an\u00e1lisis de archivos URI en NI FlexLogger usiReg. Esta vulnerabilidad permite a atacantes remotos crear archivos arbitrarios en las instalaciones afectadas de NI FlexLogger. Para explotar esta vulnerabilidad, se requiere la interacci\u00f3n del usuario, ya que el objetivo debe visitar una p\u00e1gina maliciosa o abrir un archivo malicioso. La falla espec\u00edfica se encuentra en el an\u00e1lisis de archivos URI por parte del componente usiReg. El problema se debe a la falta de validaci\u00f3n adecuada de una ruta proporcionada por el usuario antes de usarla en operaciones con archivos. Un atacante puede aprovechar esta vulnerabilidad para ejecutar c\u00f3digo en el contexto del usuario actual. Era ZDI-CAN-21805."
}
],
"id": "CVE-2025-2449",
"lastModified": "2025-08-18T13:56:42.483",
"metrics": {
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9,
"source": "zdi-disclosures@trendmicro.com",
"type": "Secondary"
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2025-03-18T14:15:45.670",
"references": [
{
"source": "zdi-disclosures@trendmicro.com",
"tags": [
"Third Party Advisory"
],
"url": "https://www.zerodayinitiative.com/advisories/ZDI-25-146/"
}
],
"sourceIdentifier": "zdi-disclosures@trendmicro.com",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-22"
}
],
"source": "zdi-disclosures@trendmicro.com",
"type": "Primary"
}
]
}
CVE-2024-4044 (GCVE-0-2024-4044)
Vulnerability from cvelistv5
Published
2024-05-10 14:59
Modified
2024-08-01 20:26
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-502 - Deserialization of Untrusted Data
Summary
A deserialization of untrusted data vulnerability exists in common code used by FlexLogger and InstrumentStudio that may result in remote code execution. Successful exploitation requires an attacker to get a user to open a specially crafted project file. This vulnerability affects NI FlexLogger 2024 Q1 and prior versions as well as NI InstrumentStudio 2024 Q1 and prior versions.
References
| ► | URL | Tags |
|---|---|---|
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| ► | NI | FlexLogger |
Version: 0 < |
||||||
|
|||||||||
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:ni:flexlogger:2024:q1:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "flexlogger",
"vendor": "ni",
"versions": [
{
"lessThanOrEqual": "24.1",
"status": "affected",
"version": "2024",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:ni:instrumentstudio:2024:q1:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "instrumentstudio",
"vendor": "ni",
"versions": [
{
"lessThanOrEqual": "24.1",
"status": "affected",
"version": "2024",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-4044",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-05-11T17:25:10.120453Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-07-23T14:40:44.446Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T20:26:57.269Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://ni.com/r/CVE-2024-4044"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "FlexLogger",
"vendor": "NI",
"versions": [
{
"lessThanOrEqual": "24.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "InstrumentStudio",
"vendor": "NI",
"versions": [
{
"lessThanOrEqual": "24.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"user": "00000000-0000-4000-9000-000000000000",
"value": "kimiya working with Trend Micro Zero Day Initiative"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eA deserialization of untrusted data vulnerability exists in common code used by FlexLogger and InstrumentStudio that may result in remote code execution. Successful exploitation requires an attacker to get a user to open a specially crafted project file. This vulnerability affects NI FlexLogger 2024 Q1 and prior versions as well as NI InstrumentStudio 2024 Q1 and prior versions.\u003c/span\u003e\u003cbr\u003e"
}
],
"value": "A deserialization of untrusted data vulnerability exists in common code used by FlexLogger and InstrumentStudio that may result in remote code execution. Successful exploitation requires an attacker to get a user to open a specially crafted project file. This vulnerability affects NI FlexLogger 2024 Q1 and prior versions as well as NI InstrumentStudio 2024 Q1 and prior versions.\n"
}
],
"impacts": [
{
"capecId": "CAPEC-586",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-586 Object Injection"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "CWE-502 Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-05-10T14:59:10.943Z",
"orgId": "bca5b2e8-03a4-4781-b4ca-c6a078c0bfd4",
"shortName": "NI"
},
"references": [
{
"url": "https://ni.com/r/CVE-2024-4044"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Deserialization of Untrusted Data Vulnerability in FlexLogger and InstrumentStudio",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "bca5b2e8-03a4-4781-b4ca-c6a078c0bfd4",
"assignerShortName": "NI",
"cveId": "CVE-2024-4044",
"datePublished": "2024-05-10T14:59:10.943Z",
"dateReserved": "2024-04-22T21:05:40.301Z",
"dateUpdated": "2024-08-01T20:26:57.269Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-6122 (GCVE-0-2024-6122)
Vulnerability from cvelistv5
Published
2024-07-22 19:27
Modified
2024-08-01 21:33
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-276 - Incorrect Default Permissions
Summary
An incorrect permission in the installation directory for the shared NI SystemLink Server KeyValueDatabase service may result in information disclosure via local access. This affects NI SystemLink Server 2024 Q1 and prior versions. It also affects NI FlexLogger 2023 Q2 and prior versions which installed this shared service.
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| ► | NI | SystemLink Server |
Version: 0 ≤ 24.1 |
||||||
|
|||||||||
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:ni:systemlink:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "systemlink",
"vendor": "ni",
"versions": [
{
"lessThanOrEqual": "2024q1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:ni:flexlogger:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "flexlogger",
"vendor": "ni",
"versions": [
{
"lessThanOrEqual": "2023q2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-6122",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-07-23T14:14:23.092610Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-07-23T14:37:33.238Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T21:33:04.403Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/incorrect-default-directory-permissions-for-ni-systemlink-redis-service.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "SystemLink Server",
"vendor": "NI",
"versions": [
{
"lessThanOrEqual": "24.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "FlexLogger",
"vendor": "NI",
"versions": [
{
"lessThanOrEqual": "23.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "06fe5fd2bc53027c4a3b7e395af0b850e7b8a044 working with Trend Micro Zero Day Initiative"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eAn incorrect permission in the installation directory for the shared NI SystemLink Server KeyValueDatabase service may result in information disclosure via local access. This affects NI SystemLink Server 2024 Q1 and prior versions. It also affects NI FlexLogger 2023 Q2 and prior versions which installed this shared service.\u003c/span\u003e\u003cbr\u003e"
}
],
"value": "An incorrect permission in the installation directory for the shared NI SystemLink Server KeyValueDatabase service may result in information disclosure via local access. This affects NI SystemLink Server 2024 Q1 and prior versions. It also affects NI FlexLogger 2023 Q2 and prior versions which installed this shared service."
}
],
"impacts": [
{
"capecId": "CAPEC-1",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-276",
"description": "CWE-276 Incorrect Default Permissions",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-07-22T19:27:10.034Z",
"orgId": "bca5b2e8-03a4-4781-b4ca-c6a078c0bfd4",
"shortName": "NI"
},
"references": [
{
"url": "https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/incorrect-default-directory-permissions-for-ni-systemlink-redis-service.html"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Incorrect Default Directory Permissions for NI SystemLink Redis Service",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "bca5b2e8-03a4-4781-b4ca-c6a078c0bfd4",
"assignerShortName": "NI",
"cveId": "CVE-2024-6122",
"datePublished": "2024-07-22T19:27:10.034Z",
"dateReserved": "2024-06-18T11:42:00.421Z",
"dateUpdated": "2024-08-01T21:33:04.403Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-5136 (GCVE-0-2023-5136)
Vulnerability from cvelistv5
Published
2023-11-08 15:24
Modified
2025-06-11 14:34
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-611 - Improper Restriction of XML External Entity Reference
Summary
An incorrect permission assignment in the TopoGrafix DataPlugin for GPX could result in information disclosure. An attacker could exploit this vulnerability by getting a user to open a specially crafted data file.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| ► | NI | TopoGrafix DataPlugin for GPX |
Version: 0 < 2023 Q4 |
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T07:52:07.459Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.ni.com/en/support/documentation/supplemental/23/incorrect-permission-assignment-in-the-topografix-dataplug-for-gpx.html"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-5136",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-04T14:20:44.035737Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-11T14:34:24.037Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "TopoGrafix DataPlugin for GPX",
"vendor": "NI",
"versions": [
{
"lessThan": "2023 Q4",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "DIAdem",
"vendor": "NI",
"versions": [
{
"lessThan": "2023 Q2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "VeriStand",
"vendor": "NI",
"versions": [
{
"lessThanOrEqual": "2023 Q4",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "FlexLogger",
"vendor": "NI",
"versions": [
{
"lessThanOrEqual": "2023 Q4",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eAn incorrect permission assignment in the TopoGrafix DataPlugin for GPX could result in information disclosure. An attacker could exploit this vulnerability by getting a user to open a specially crafted data file.\u003c/span\u003e\u003cbr\u003e"
}
],
"value": "An incorrect permission assignment in the TopoGrafix DataPlugin for GPX could result in information disclosure. An attacker could exploit this vulnerability by getting a user to open a specially crafted data file."
}
],
"impacts": [
{
"capecId": "CAPEC-180",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-180 Exploiting Incorrectly Configured Access Control Security Levels"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-611",
"description": "CWE-611 Improper Restriction of XML External Entity Reference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-10T20:27:28.145Z",
"orgId": "bca5b2e8-03a4-4781-b4ca-c6a078c0bfd4",
"shortName": "NI"
},
"references": [
{
"url": "https://www.ni.com/en/support/documentation/supplemental/23/incorrect-permission-assignment-in-the-topografix-dataplug-for-gpx.html"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Incorrect Permission Assignment in the TopoGrafix DataPlugin for GPX",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "bca5b2e8-03a4-4781-b4ca-c6a078c0bfd4",
"assignerShortName": "NI",
"cveId": "CVE-2023-5136",
"datePublished": "2023-11-08T15:24:10.867Z",
"dateReserved": "2023-09-22T19:29:47.084Z",
"dateUpdated": "2025-06-11T14:34:24.037Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-2449 (GCVE-0-2025-2449)
Vulnerability from cvelistv5
Published
2025-03-18 13:18
Modified
2025-03-18 13:52
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Summary
NI FlexLogger usiReg URI File Parsing Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to create arbitrary files on affected installations of NI FlexLogger. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the parsing of URI files by the usiReg component. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-21805.
References
| ► | URL | Tags | |||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| NI | FlexLogger |
Version: 2024 Q1 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-2449",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-03-18T13:51:40.419470Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-03-18T13:52:36.096Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "FlexLogger",
"vendor": "NI",
"versions": [
{
"status": "affected",
"version": "2024 Q1"
}
]
}
],
"dateAssigned": "2025-03-17T16:49:41.312Z",
"datePublic": "2025-03-17T20:34:22.262Z",
"descriptions": [
{
"lang": "en",
"value": "NI FlexLogger usiReg URI File Parsing Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to create arbitrary files on affected installations of NI FlexLogger. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of URI files by the usiReg component. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-21805."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-03-18T13:18:32.984Z",
"orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"shortName": "zdi"
},
"references": [
{
"name": "ZDI-25-146",
"tags": [
"x_research-advisory"
],
"url": "https://www.zerodayinitiative.com/advisories/ZDI-25-146/"
}
],
"source": {
"lang": "en",
"value": "06fe5fd2bc53027c4a3b7e395af0b850e7b8a044"
},
"title": "NI FlexLogger usiReg URI File Parsing Directory Traversal Remote Code Execution Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"assignerShortName": "zdi",
"cveId": "CVE-2025-2449",
"datePublished": "2025-03-18T13:18:32.984Z",
"dateReserved": "2025-03-17T16:49:41.233Z",
"dateUpdated": "2025-03-18T13:52:36.096Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-6121 (GCVE-0-2024-6121)
Vulnerability from cvelistv5
Published
2024-07-22 19:46
Modified
2024-08-01 21:33
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-1395 - Dependency on Vulnerable Third-Party Component
Summary
An out-of-date version of Redis shipped with NI SystemLink Server is susceptible to multiple vulnerabilities, including CVE-2022-24834. This affects NI SystemLink Server 2024 Q1 and prior versions. It also affects NI FlexLogger 2023 Q2 and prior versions which installed this shared service.
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| ► | NI | SystemLink Server |
Version: 0 ≤ 24.1 |
||||||
|
|||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-6121",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-07-29T16:55:03.521839Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-07-29T16:55:16.740Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T21:33:05.149Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/ni-systemlink-server-ships-out-of-date-redis-version.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "SystemLink Server",
"vendor": "NI",
"versions": [
{
"lessThanOrEqual": "24.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "FlexLogger",
"vendor": "NI",
"versions": [
{
"lessThanOrEqual": "23.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "06fe5fd2bc53027c4a3b7e395af0b850e7b8a044 working with Trend Micro Zero Day Initiative"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eAn out-of-date version of Redis shipped with NI SystemLink Server is susceptible to multiple vulnerabilities, including CVE-2022-24834. This affects NI SystemLink Server 2024 Q1 and prior versions. It also affects NI FlexLogger 2023 Q2 and prior versions which installed this shared service. \u003c/span\u003e\u003cbr\u003e"
}
],
"value": "An out-of-date version of Redis shipped with NI SystemLink Server is susceptible to multiple vulnerabilities, including CVE-2022-24834. This affects NI SystemLink Server 2024 Q1 and prior versions. It also affects NI FlexLogger 2023 Q2 and prior versions which installed this shared service."
}
],
"impacts": [
{
"capecId": "CAPEC-233",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-233 Privilege Escalation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1395",
"description": "CWE-1395 Dependency on Vulnerable Third-Party Component",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-07-22T19:46:11.685Z",
"orgId": "bca5b2e8-03a4-4781-b4ca-c6a078c0bfd4",
"shortName": "NI"
},
"references": [
{
"url": "https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/ni-systemlink-server-ships-out-of-date-redis-version.html"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "NI SystemLink Server Ships Out of Date Redis Version",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "bca5b2e8-03a4-4781-b4ca-c6a078c0bfd4",
"assignerShortName": "NI",
"cveId": "CVE-2024-6121",
"datePublished": "2024-07-22T19:46:11.685Z",
"dateReserved": "2024-06-18T11:41:52.912Z",
"dateUpdated": "2024-08-01T21:33:05.149Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-27237 (GCVE-0-2022-27237)
Vulnerability from cvelistv5
Published
2022-04-21 04:32
Modified
2024-08-03 05:25
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
There is a cross-site scripting (XSS) vulnerability in an NI Web Server component installed with several NI products. Depending on the product(s) in use, remediation guidance includes: install SystemLink version 2021 R3 or later, install FlexLogger 2022 Q2 or later, install LabVIEW 2021 SP1, install G Web Development 2022 R1 or later, or install Static Test Software Suite version 1.2 or later.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T05:25:32.493Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.ni.com/en-us/support/documentation/supplemental/22/cross-site-scripting-vulnerability--in-ni-web-server-component.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "There is a cross-site scripting (XSS) vulnerability in an NI Web Server component installed with several NI products. Depending on the product(s) in use, remediation guidance includes: install SystemLink version 2021 R3 or later, install FlexLogger 2022 Q2 or later, install LabVIEW 2021 SP1, install G Web Development 2022 R1 or later, or install Static Test Software Suite version 1.2 or later."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-04-21T04:32:44",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.ni.com/en-us/support/documentation/supplemental/22/cross-site-scripting-vulnerability--in-ni-web-server-component.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2022-27237",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "There is a cross-site scripting (XSS) vulnerability in an NI Web Server component installed with several NI products. Depending on the product(s) in use, remediation guidance includes: install SystemLink version 2021 R3 or later, install FlexLogger 2022 Q2 or later, install LabVIEW 2021 SP1, install G Web Development 2022 R1 or later, or install Static Test Software Suite version 1.2 or later."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.ni.com/en-us/support/documentation/supplemental/22/cross-site-scripting-vulnerability--in-ni-web-server-component.html",
"refsource": "CONFIRM",
"url": "https://www.ni.com/en-us/support/documentation/supplemental/22/cross-site-scripting-vulnerability--in-ni-web-server-component.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2022-27237",
"datePublished": "2022-04-21T04:32:44",
"dateReserved": "2022-03-18T00:00:00",
"dateUpdated": "2024-08-03T05:25:32.493Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-1155 (GCVE-0-2024-1155)
Vulnerability from cvelistv5
Published
2024-02-20 14:34
Modified
2024-08-01 18:26
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-276 - Incorrect Default Permissions
Summary
Incorrect permissions in the installation directories for shared SystemLink Elixir based services may allow an authenticated user to potentially enable escalation of privilege via local access.
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| ► | NI | SystemLink Server |
Version: 0 < |
||||||
|
|||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-1155",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-02-20T18:08:51.196119Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-07-05T17:20:58.903Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T18:26:30.614Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/incorrect-permissions-for-shared-systemlink-elixir-based-service.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "SystemLink Server",
"vendor": "NI",
"versions": [
{
"lessThanOrEqual": "2023 Q3",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "FlexLogger",
"vendor": "NI",
"versions": [
{
"lessThanOrEqual": "2022 Q3",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Incorrect permissions in the installation directories for shared SystemLink Elixir based services may allow an authenticated user to potentially enable escalation of privilege via local access. \u003cbr\u003e"
}
],
"value": "Incorrect permissions in the installation directories for shared SystemLink Elixir based services may allow an authenticated user to potentially enable escalation of privilege via local access. \n"
}
],
"impacts": [
{
"capecId": "CAPEC-233",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-233 Privilege Escalation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-276",
"description": "CWE-276 Incorrect Default Permissions",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-02-20T14:34:08.556Z",
"orgId": "bca5b2e8-03a4-4781-b4ca-c6a078c0bfd4",
"shortName": "NI"
},
"references": [
{
"url": "https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/incorrect-permissions-for-shared-systemlink-elixir-based-service.html"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Incorrect permissions for shared NI SystemLink Elixir based services",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "bca5b2e8-03a4-4781-b4ca-c6a078c0bfd4",
"assignerShortName": "NI",
"cveId": "CVE-2024-1155",
"datePublished": "2024-02-20T14:34:08.556Z",
"dateReserved": "2024-02-01T14:25:54.006Z",
"dateUpdated": "2024-08-01T18:26:30.614Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-1156 (GCVE-0-2024-1156)
Vulnerability from cvelistv5
Published
2024-02-20 14:37
Modified
2024-08-26 16:53
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-276 - Incorrect Default Permissions
Summary
Incorrect directory permissions for the shared NI RabbitMQ service may allow a local authenticated user to read RabbitMQ configuration information and potentially enable escalation of privileges.
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| ► | NI | SystemLink Server |
Version: 0 < |
||||||
|
|||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-01T18:33:24.161Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/incorrect-permissions-for-shared-systemlink-elixir-based-service.html"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:a:ni:flexlogger:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "flexlogger",
"vendor": "ni",
"versions": [
{
"lessThanOrEqual": "2022_q3",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:ni:systemlink:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "systemlink",
"vendor": "ni",
"versions": [
{
"lessThanOrEqual": "2023_q3",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-1156",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-02-20T16:33:13.523683Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-26T16:53:40.189Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "SystemLink Server",
"vendor": "NI",
"versions": [
{
"lessThanOrEqual": "2023 Q3",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "FlexLogger",
"vendor": "NI",
"versions": [
{
"lessThanOrEqual": "2022 Q3",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Incorrect directory permissions for the shared NI RabbitMQ service may allow a local authenticated user to read RabbitMQ configuration information and potentially enable escalation of privileges."
}
],
"value": "Incorrect directory permissions for the shared NI RabbitMQ service may allow a local authenticated user to read RabbitMQ configuration information and potentially enable escalation of privileges."
}
],
"impacts": [
{
"capecId": "CAPEC-233",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-233 Privilege Escalation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-276",
"description": "CWE-276 Incorrect Default Permissions",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-02-20T14:37:07.095Z",
"orgId": "bca5b2e8-03a4-4781-b4ca-c6a078c0bfd4",
"shortName": "NI"
},
"references": [
{
"url": "https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/incorrect-permissions-for-shared-systemlink-elixir-based-service.html"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "bca5b2e8-03a4-4781-b4ca-c6a078c0bfd4",
"assignerShortName": "NI",
"cveId": "CVE-2024-1156",
"datePublished": "2024-02-20T14:37:07.095Z",
"dateReserved": "2024-02-01T14:26:04.700Z",
"dateUpdated": "2024-08-26T16:53:40.189Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}