# CVSS v3.0: High Privileges Required CVEs whose attacker needs high privileges (CVSS v3.0). Source: https://docs.deepinfo.com/reference/vulnerability/search/examples/metrics-cvss-metric-v30-cvss-data-privileges-required/ Last updated: 2026-09-26 --- `POST https://api.deepinfo.com/v1/discovery/vulnerability-search?page_size=25` CVEs whose attacker needs high privileges (CVSS v3.0). Example 7 of 16 in **Filters › CVSS v3.0** · [Vulnerability Search Examples](/reference/vulnerability/search/examples/) · endpoint: [Search](/reference/vulnerability/search/) Tags: `field` `metrics.cvss_metric_v30.cvss_data.privileges_required` · `operator` `eq` `metrics.cvss_metric_v30.cvss_data.privileges_required` is the privileges the attacker needs (`NONE`, `LOW` or `HIGH`), in the CVSS v3.0 metric (`metrics.cvss_metric_v30`, one entry per scoring source). `eq` matches the exact value `HIGH`. In the response, look at `results[].metrics.cvss_metric_v30[].cvss_data.privileges_required`. ## Request | Parameter | In | Value | |---|---|---| | `page_size` | query | `25` | | `filters.must[0].name` | body | `metrics.cvss_metric_v30.cvss_data.privileges_required` | | `filters.must[0].type` | body | `eq` | | `filters.must[0].value` | body | `HIGH` | ```bash curl -X POST 'https://api.deepinfo.com/v1/discovery/vulnerability-search?page_size=25' \ -H 'apikey: YOUR_API_KEY' \ -H 'Accept: application/json' \ -H 'Content-Type: application/json' \ -d '{ "filters": { "must": [ { "name": "metrics.cvss_metric_v30.cvss_data.privileges_required", "type": "eq", "value": "HIGH" } ] } }' ``` ## Response ### 200 · OK > Shortened for this page: results: 3 of 25 shown; results[].configurations: first 10 items; results[].enrichment.cpe: first 10 items `Content-Type: application/json` · `ratelimit-limit: 1` · `ratelimit-remaining: 0` · `ratelimit-reset: 1` · `x-ratelimit-limit-second: 1` · `x-ratelimit-remaining-second: 0` · `deepinfo-request-id: 5f0c6a8e-1b2d-4c3e-9f4a-7b8c9d0e1f2a` ```json { "page": 1, "page_size": 25, "result_count": 3641, "results": [ { "id": "CVE-2025-2828", "source_identifier": "user@huntr.dev", "published": "2025-06-23T21:15:25Z", "last_modified": "2026-06-17T09:07:41Z", "status": "Analyzed", "evaluator_comment": null, "evaluator_solution": null, "evaluator_impact": null, "cisa_exploit_add": null, "cisa_action_due": null, "cisa_required_action": null, "cisa_vulnerability_name": null, "descriptions": [ { "lang": "en", "value": "A Server-Side Request Forgery (SSRF) vulnerability exists in the RequestsToolkit component of the langchain-community package (specifically, langchain_community.agent_toolkits.openapi.toolkit.RequestsToolkit) in langchain-ai/langchain version 0.0.27. This vulnerability occurs because the toolkit does not enforce restrictions on requests to remote internet addresses, allowing it to also access local addresses. As a result, an attacker could exploit this flaw to perform port scans, access local services, retrieve instance metadata from cloud environments (e.g., Azure, AWS), and interact with servers on the local network. This issue has been fixed in version 0.0.28." }, { "lang": "es", "value": "Existe una vulnerabilidad de Server-Side Request Forgery (SSRF) en el componente RequestsToolkit del paquete langchain-community (en concreto, langchain_community.agent_toolkits.openapi.toolkit.RequestsToolkit) en la versión 0.0.27 de langchain-ai/langchain. Esta vulnerabilidad se debe a que el kit de herramientas no impone restricciones a las solicitudes a direcciones de internet remotas, lo que le permite acceder también a direcciones locales. Por lo tanto, un atacante podría explotar esta vulnerabilidad para realizar escaneos de puertos, acceder a servicios locales, recuperar metadatos de instancias de entornos en la nube (p. ej., Azure, AWS) e interactuar con servidores de la red local. Este problema se ha corregido en la versión 0.0.28." } ], "references": [ { "url": "https://github.com/langchain-ai/langchain/commit/e188d4ecb085d4561a0be3c583d26aa9c2c3283f", "source": "user@huntr.dev", "tags": [ "Patch" ] }, { "url": "https://huntr.com/bounties/8f771040-7f34-420a-b96b-5b93d4a99afc", "source": "user@huntr.dev", "tags": [ "Exploit", "Third Party Advisory" ] }, { "url": "https://huntr.com/bounties/8f771040-7f34-420a-b96b-5b93d4a99afc", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": [ "Exploit", "Third Party Advisory" ] } ], "metrics": { "cvss_metric_v40": null, "cvss_metric_v31": [ { "source": "user@nist.gov", "type": "Primary", "cvss_data": { "version": "3.1", "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "attack_vector": "NETWORK", "attack_complexity": "LOW", "privileges_required": "NONE", "user_interaction": "NONE", "scope": "CHANGED", "confidentiality_impact": "HIGH", "integrity_impact": "HIGH", "availability_impact": "HIGH", "base_score": 10.0, "base_severity": "CRITICAL", "exploit_code_maturity": null, "remediation_level": null, "report_confidence": null, "temporal_score": null, "temporal_severity": null, "confidentiality_requirement": null, "integrity_requirement": null, "availability_requirement": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_scope": null, "modified_confidentiality_impact": null, "modified_integrity_impact": null, "modified_availability_impact": null, "environmental_score": null, "environmental_severity": null }, "exploitability_score": 3.9, "impact_score": 6.0 } ], "cvss_metric_v30": [ { "source": "user@huntr.dev", "type": "Secondary", "cvss_data": { "version": "3.0", "vector_string": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H", "attack_vector": "NETWORK", "attack_complexity": "LOW", "privileges_required": "HIGH", "user_interaction": "REQUIRED", "scope": "CHANGED", "confidentiality_impact": "HIGH", "integrity_impact": "HIGH", "availability_impact": "HIGH", "base_score": 8.4, "base_severity": "HIGH", "exploit_code_maturity": null, "remediation_level": null, "report_confidence": null, "temporal_score": null, "temporal_severity": null, "confidentiality_requirement": null, "integrity_requirement": null, "availability_requirement": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_scope": null, "modified_confidentiality_impact": null, "modified_integrity_impact": null, "modified_availability_impact": null, "environmental_score": null, "environmental_severity": null }, "exploitability_score": 1.7, "impact_score": 6.0 } ], "cvss_metric_v2": null }, "weaknesses": [ { "source": "user@huntr.dev", "type": "Secondary", "description": [ { "lang": "en", "value": "CWE-918" } ] } ], "configurations": [ { "operator": null, "negate": null, "nodes": [ { "operator": "OR", "negate": false, "cpe_match": [ { "vulnerable": true, "criteria": "cpe:2.3:a:langchain:langchain:*:*:*:*:community:*:*:*", "match_criteria_id": "70F7E7BB-6417-4B87-997A-F2028B53849F", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "0.0.28" } ] } ] } ], "vendor_comments": null, "enrichment": { "cpe": [ { "criteria": "cpe:2.3:a:langchain:langchain:*:*:*:*:community:*:*:*", "vendor": "langchain", "product": "langchain", "product_type": "a", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "0.0.28", "affected_versions_first": null, "affected_versions_last": null } ], "cwe": [ { "id": 918, "owasptop10_2021": "A10 Server-Side Request Forgery (SSRF)", "name": "Server-Side Request Forgery (SSRF)", "description": "The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.", "capec_id": [ 664 ], "scope": [ "Access Control", "Confidentiality", "Integrity" ], "impact": [ "Bypass Protection Mechanism", "Execute Unauthorized Code or Commands", "Read Application Data" ], "detection_method": [ "Automated Static Analysis" ] } ], "epss_score": { "epss": 0.18472, "percentile": 0.97118, "date": "2026-09-23" }, "cisa_kev": null, "vdeep_metric": { "available_versions": [ "3.1", "3.0" ], "source": "user@nist.gov", "type": "Primary", "cvss_data": { "version": "3.1", "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "attack_vector": "NETWORK", "attack_complexity": "LOW", "attack_requirements": null, "privileges_required": "NONE", "user_interaction": "NONE", "vulnerable_system_confidentiality": "HIGH", "vulnerable_system_integrity": "HIGH", "vulnerable_system_availability": "HIGH", "subsequent_system_confidentiality": null, "subsequent_system_integrity": null, "subsequent_system_availability": null, "exploit_maturity": null, "confidentiality_requirements": null, "integrity_requirements": null, "availability_requirements": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_attack_requirements": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_vulnerable_system_confidentiality": null, "modified_vulnerable_system_integrity": null, "modified_vulnerable_system_availability": null, "modified_subsequent_system_confidentiality": null, "modified_subsequent_system_integrity": null, "modified_subsequent_system_availability": null, "safety": null, "automatable": null, "recovery": null, "value_density": null, "vulnerability_response_effort": null, "provider_urgency": null, "base_score": 10.0, "base_severity": "CRITICAL" } } } }, { "id": "CVE-2018-3938", "source_identifier": "user@cisco.com", "published": "2018-08-14T19:29:01Z", "last_modified": "2026-06-17T01:58:04Z", "status": "Modified", "evaluator_comment": null, "evaluator_solution": null, "evaluator_impact": null, "cisa_exploit_add": null, "cisa_action_due": null, "cisa_required_action": null, "cisa_vulnerability_name": null, "descriptions": [ { "lang": "en", "value": "An exploitable stack-based buffer overflow vulnerability exists in the 802dot1xclientcert.cgi functionality of Sony IPELA E Series Camera G5 firmware 1.87.00. A specially crafted POST can cause a stack-based buffer overflow, resulting in remote code execution. An attacker can send a malicious POST request to trigger this vulnerability." }, { "lang": "es", "value": "Existe una vulnerabilidad de desbordamiento de búfer basado en pila explotable en la funcionalidad 802dot1xclientcert.cgi de Sony IPELA E Series Camera G5 con la versión 1.87.00 de firmware. Una petición POST especialmente manipulada puede provocar un desbordamiento de búfer basado en pila que daría lugar a la ejecución remota de código. Un atacante puede enviar una petición POST maliciosa para provocar esta vulnerabilidad." } ], "references": [ { "url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0605", "source": "user@cisco.com", "tags": [ "Third Party Advisory" ] }, { "url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0605", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Third Party Advisory" ] } ], "metrics": { "cvss_metric_v40": null, "cvss_metric_v31": null, "cvss_metric_v30": [ { "source": "user@cisco.com", "type": "Secondary", "cvss_data": { "version": "3.0", "vector_string": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "attack_vector": "NETWORK", "attack_complexity": "LOW", "privileges_required": "HIGH", "user_interaction": "NONE", "scope": "CHANGED", "confidentiality_impact": "HIGH", "integrity_impact": "HIGH", "availability_impact": "HIGH", "base_score": 9.1, "base_severity": "CRITICAL", "exploit_code_maturity": null, "remediation_level": null, "report_confidence": null, "temporal_score": null, "temporal_severity": null, "confidentiality_requirement": null, "integrity_requirement": null, "availability_requirement": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_scope": null, "modified_confidentiality_impact": null, "modified_integrity_impact": null, "modified_availability_impact": null, "environmental_score": null, "environmental_severity": null }, "exploitability_score": 2.3, "impact_score": 6.0 }, { "source": "user@nist.gov", "type": "Primary", "cvss_data": { "version": "3.0", "vector_string": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "attack_vector": "NETWORK", "attack_complexity": "LOW", "privileges_required": "NONE", "user_interaction": "NONE", "scope": "CHANGED", "confidentiality_impact": "HIGH", "integrity_impact": "HIGH", "availability_impact": "HIGH", "base_score": 10.0, "base_severity": "CRITICAL", "exploit_code_maturity": null, "remediation_level": null, "report_confidence": null, "temporal_score": null, "temporal_severity": null, "confidentiality_requirement": null, "integrity_requirement": null, "availability_requirement": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_scope": null, "modified_confidentiality_impact": null, "modified_integrity_impact": null, "modified_availability_impact": null, "environmental_score": null, "environmental_severity": null }, "exploitability_score": 3.9, "impact_score": 6.0 } ], "cvss_metric_v2": [ { "source": "user@nist.gov", "type": "Primary", "cvss_data": { "version": "2.0", "vector_string": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "access_vector": "NETWORK", "access_complexity": "LOW", "authentication": "NONE", "confidentiality_impact": "PARTIAL", "integrity_impact": "PARTIAL", "availability_impact": "PARTIAL", "base_score": 7.5, "exploitability": null, "remediation_level": null, "report_confidence": null, "temporal_score": null, "collateral_damage_potential": null, "target_distribution": null, "confidentiality_requirement": null, "integrity_requirement": null, "availability_requirement": null, "environmental_score": null }, "base_severity": "HIGH", "exploitability_score": 10.0, "impact_score": 6.4, "ac_insuf_info": false, "obtain_all_privilege": false, "obtain_user_privilege": false, "obtain_other_privilege": false, "user_interaction_required": false } ] }, "weaknesses": [ { "source": "user@nist.gov", "type": "Primary", "description": [ { "lang": "en", "value": "CWE-787" } ] } ], "configurations": [ { "operator": "AND", "negate": null, "nodes": [ { "operator": "OR", "negate": false, "cpe_match": [ { "vulnerable": true, "criteria": "cpe:2.3:o:sony:snc-eb600_firmware:1.87.00:*:*:*:*:*:*:*", "match_criteria_id": "FD3FBC43-3AE3-4634-9331-B95B24F07E6B", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null } ] }, { "operator": "OR", "negate": false, "cpe_match": [ { "vulnerable": false, "criteria": "cpe:2.3:h:sony:snc-eb600:-:*:*:*:*:*:*:*", "match_criteria_id": "1D084C71-003D-4624-A467-9B0A6ADD22C4", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null } ] } ] }, { "operator": "AND", "negate": null, "nodes": [ { "operator": "OR", "negate": false, "cpe_match": [ { "vulnerable": true, "criteria": "cpe:2.3:o:sony:snc-eb630_firmware:1.87.00:*:*:*:*:*:*:*", "match_criteria_id": "26359BD9-71D6-4129-A5DF-E4CA26A1DA5A", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null } ] }, { "operator": "OR", "negate": false, "cpe_match": [ { "vulnerable": false, "criteria": "cpe:2.3:h:sony:snc-eb630:-:*:*:*:*:*:*:*", "match_criteria_id": "D00D6B81-4C5A-4D3A-BDCC-520A45AE3725", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null } ] } ] }, { "operator": "AND", "negate": null, "nodes": [ { "operator": "OR", "negate": false, "cpe_match": [ { "vulnerable": true, "criteria": "cpe:2.3:o:sony:snc-eb600b_firmware:1.87.00:*:*:*:*:*:*:*", "match_criteria_id": "74D2B3EF-6B55-41D8-90BB-CEC33032A083", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null } ] }, { "operator": "OR", "negate": false, "cpe_match": [ { "vulnerable": false, "criteria": "cpe:2.3:h:sony:snc-eb600b:-:*:*:*:*:*:*:*", "match_criteria_id": "0D0ACBA0-AF10-4810-B91D-EA56EF8CB1D4", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null } ] } ] }, { "operator": "AND", "negate": null, "nodes": [ { "operator": "OR", "negate": false, "cpe_match": [ { "vulnerable": true, "criteria": "cpe:2.3:o:sony:snc-eb630b_firmware:1.87.00:*:*:*:*:*:*:*", "match_criteria_id": "A59426BB-7B2B-423B-9F0B-E127B81D36DA", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null } ] }, { "operator": "OR", "negate": false, "cpe_match": [ { "vulnerable": false, "criteria": "cpe:2.3:h:sony:snc-eb630b:-:*:*:*:*:*:*:*", "match_criteria_id": "DC0126D7-0A43-4601-A971-0CEED39381CC", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null } ] } ] }, { "operator": "AND", "negate": null, "nodes": [ { "operator": "OR", "negate": false, "cpe_match": [ { "vulnerable": true, "criteria": "cpe:2.3:o:sony:snc-eb602r_firmware:1.87.00:*:*:*:*:*:*:*", "match_criteria_id": "55C71563-027B-4431-8109-12A8D7AF57D2", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null } ] }, { "operator": "OR", "negate": false, "cpe_match": [ { "vulnerable": false, "criteria": "cpe:2.3:h:sony:snc-eb602r:-:*:*:*:*:*:*:*", "match_criteria_id": "A0C515B9-6B61-4626-9B80-F00CA796B586", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null } ] } ] }, { "operator": "AND", "negate": null, "nodes": [ { "operator": "OR", "negate": false, "cpe_match": [ { "vulnerable": true, "criteria": "cpe:2.3:o:sony:snc-eb632r_firmware:1.87.00:*:*:*:*:*:*:*", "match_criteria_id": "197602C4-4CF6-4DB9-89C7-02411544C001", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null } ] }, { "operator": "OR", "negate": false, "cpe_match": [ { "vulnerable": false, "criteria": "cpe:2.3:h:sony:snc-eb632r:-:*:*:*:*:*:*:*", "match_criteria_id": "72CFFBBB-4973-4B4F-A064-C9CF2AAF1BEC", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null } ] } ] }, { "operator": "AND", "negate": null, "nodes": [ { "operator": "OR", "negate": false, "cpe_match": [ { "vulnerable": true, "criteria": "cpe:2.3:o:sony:snc-em600_firmware:1.87.00:*:*:*:*:*:*:*", "match_criteria_id": "11AFF2B2-5E89-41D0-9961-D41BBC0E9D23", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null } ] }, { "operator": "OR", "negate": false, "cpe_match": [ { "vulnerable": false, "criteria": "cpe:2.3:h:sony:snc-em600:-:*:*:*:*:*:*:*", "match_criteria_id": "5500F130-10D5-404B-946C-B59DC20DB0B5", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null } ] } ] }, { "operator": "AND", "negate": null, "nodes": [ { "operator": "OR", "negate": false, "cpe_match": [ { "vulnerable": true, "criteria": "cpe:2.3:o:sony:snc-em601_firmware:1.87.00:*:*:*:*:*:*:*", "match_criteria_id": "7DAD3F4C-2600-4974-8DCD-6AD3B59051CB", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null } ] }, { "operator": "OR", "negate": false, "cpe_match": [ { "vulnerable": false, "criteria": "cpe:2.3:h:sony:snc-em601:-:*:*:*:*:*:*:*", "match_criteria_id": "5FE5E4F2-6E1D-4BB1-8A32-BABF62E169C9", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null } ] } ] }, { "operator": "AND", "negate": null, "nodes": [ { "operator": "OR", "negate": false, "cpe_match": [ { "vulnerable": true, "criteria": "cpe:2.3:o:sony:snc-em630_firmware:1.87.00:*:*:*:*:*:*:*", "match_criteria_id": "561FC337-6CD9-4B68-B3C1-1FADC8C1BBDE", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null } ] }, { "operator": "OR", "negate": false, "cpe_match": [ { "vulnerable": false, "criteria": "cpe:2.3:h:sony:snc-em630:-:*:*:*:*:*:*:*", "match_criteria_id": "6FF72A9F-632F-4C3F-8945-C0B5F2B17D59", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null } ] } ] }, { "operator": "AND", "negate": null, "nodes": [ { "operator": "OR", "negate": false, "cpe_match": [ { "vulnerable": true, "criteria": "cpe:2.3:o:sony:snc-em631_firmware:1.87.00:*:*:*:*:*:*:*", "match_criteria_id": "C3236C1C-71FC-4E19-AA10-B5F6B55C36BD", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null } ] }, { "operator": "OR", "negate": false, "cpe_match": [ { "vulnerable": false, "criteria": "cpe:2.3:h:sony:snc-em631:-:*:*:*:*:*:*:*", "match_criteria_id": "9057CFCD-225F-433C-A3D4-AA18B5D01526", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null } ] } ] } ], "vendor_comments": null, "enrichment": { "cpe": [ { "criteria": "cpe:2.3:o:sony:snc-eb600_firmware:1.87.00:*:*:*:*:*:*:*", "vendor": "sony", "product": "snc-eb600_firmware", "product_type": "o", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": "1.87.00", "affected_versions_last": "1.87.00" }, { "criteria": "cpe:2.3:h:sony:snc-eb600:-:*:*:*:*:*:*:*", "vendor": "sony", "product": "snc-eb600", "product_type": "h", "vulnerable": false, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": null, "affected_versions_last": null }, { "criteria": "cpe:2.3:o:sony:snc-eb630_firmware:1.87.00:*:*:*:*:*:*:*", "vendor": "sony", "product": "snc-eb630_firmware", "product_type": "o", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": "1.87.00", "affected_versions_last": "1.87.00" }, { "criteria": "cpe:2.3:h:sony:snc-eb630:-:*:*:*:*:*:*:*", "vendor": "sony", "product": "snc-eb630", "product_type": "h", "vulnerable": false, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": null, "affected_versions_last": null }, { "criteria": "cpe:2.3:o:sony:snc-eb600b_firmware:1.87.00:*:*:*:*:*:*:*", "vendor": "sony", "product": "snc-eb600b_firmware", "product_type": "o", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": "1.87.00", "affected_versions_last": "1.87.00" }, { "criteria": "cpe:2.3:h:sony:snc-eb600b:-:*:*:*:*:*:*:*", "vendor": "sony", "product": "snc-eb600b", "product_type": "h", "vulnerable": false, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": null, "affected_versions_last": null }, { "criteria": "cpe:2.3:o:sony:snc-eb630b_firmware:1.87.00:*:*:*:*:*:*:*", "vendor": "sony", "product": "snc-eb630b_firmware", "product_type": "o", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": "1.87.00", "affected_versions_last": "1.87.00" }, { "criteria": "cpe:2.3:h:sony:snc-eb630b:-:*:*:*:*:*:*:*", "vendor": "sony", "product": "snc-eb630b", "product_type": "h", "vulnerable": false, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": null, "affected_versions_last": null }, { "criteria": "cpe:2.3:o:sony:snc-eb602r_firmware:1.87.00:*:*:*:*:*:*:*", "vendor": "sony", "product": "snc-eb602r_firmware", "product_type": "o", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": "1.87.00", "affected_versions_last": "1.87.00" }, { "criteria": "cpe:2.3:h:sony:snc-eb602r:-:*:*:*:*:*:*:*", "vendor": "sony", "product": "snc-eb602r", "product_type": "h", "vulnerable": false, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": null, "affected_versions_last": null } ], "cwe": [ { "id": 787, "owasptop10_2021": null, "name": "Out-of-bounds Write", "description": "The product writes data past the end, or before the beginning, of the intended buffer.", "capec_id": null, "scope": [ "Availability", "Integrity", "Other" ], "impact": [ "DoS: Crash, Exit, or Restart", "Execute Unauthorized Code or Commands", "Modify Memory", "Unexpected State" ], "detection_method": [ "Automated Dynamic Analysis", "Automated Static Analysis" ] } ], "epss_score": { "epss": 0.03299, "percentile": 0.8799, "date": "2026-09-23" }, "cisa_kev": null, "vdeep_metric": { "available_versions": [ "3.0", "2.0" ], "source": "user@nist.gov", "type": "Primary", "cvss_data": { "version": "3.0", "vector_string": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "attack_vector": "NETWORK", "attack_complexity": "LOW", "attack_requirements": null, "privileges_required": "NONE", "user_interaction": "NONE", "vulnerable_system_confidentiality": "HIGH", "vulnerable_system_integrity": "HIGH", "vulnerable_system_availability": "HIGH", "subsequent_system_confidentiality": null, "subsequent_system_integrity": null, "subsequent_system_availability": null, "exploit_maturity": null, "confidentiality_requirements": null, "integrity_requirements": null, "availability_requirements": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_attack_requirements": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_vulnerable_system_confidentiality": null, "modified_vulnerable_system_integrity": null, "modified_vulnerable_system_availability": null, "modified_subsequent_system_confidentiality": null, "modified_subsequent_system_integrity": null, "modified_subsequent_system_availability": null, "safety": null, "automatable": null, "recovery": null, "value_density": null, "vulnerability_response_effort": null, "provider_urgency": null, "base_score": 10.0, "base_severity": "CRITICAL" } } } }, { "id": "CVE-2022-0939", "source_identifier": "user@huntr.dev", "published": "2022-04-04T10:15:08Z", "last_modified": "2026-06-17T04:21:30Z", "status": "Modified", "evaluator_comment": null, "evaluator_solution": null, "evaluator_impact": null, "cisa_exploit_add": null, "cisa_action_due": null, "cisa_required_action": null, "cisa_vulnerability_name": null, "descriptions": [ { "lang": "en", "value": "Server-Side Request Forgery (SSRF) in GitHub repository janeczku/calibre-web prior to 0.6.18." }, { "lang": "es", "value": "Una vulnerabilidad de tipo Server-Side Request Forgery (SSRF) en el repositorio de GitHub janeczku/calibre-web versiones anteriores a 0.6.18" } ], "references": [ { "url": "https://github.com/janeczku/calibre-web/commit/4545f4a20d9ff90b99bbd4e3e34b6de4441d6367", "source": "user@huntr.dev", "tags": [ "Patch", "Third Party Advisory" ] }, { "url": "https://huntr.dev/bounties/768fd7e2-a767-4d8d-a517-e9dda849c6e4", "source": "user@huntr.dev", "tags": [ "Exploit", "Issue Tracking", "Patch", "Third Party Advisory" ] }, { "url": "https://github.com/janeczku/calibre-web/commit/4545f4a20d9ff90b99bbd4e3e34b6de4441d6367", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Patch", "Third Party Advisory" ] }, { "url": "https://huntr.dev/bounties/768fd7e2-a767-4d8d-a517-e9dda849c6e4", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Exploit", "Issue Tracking", "Patch", "Third Party Advisory" ] } ], "metrics": { "cvss_metric_v40": null, "cvss_metric_v31": [ { "source": "user@nist.gov", "type": "Primary", "cvss_data": { "version": "3.1", "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H", "attack_vector": "NETWORK", "attack_complexity": "LOW", "privileges_required": "NONE", "user_interaction": "NONE", "scope": "CHANGED", "confidentiality_impact": "LOW", "integrity_impact": "LOW", "availability_impact": "HIGH", "base_score": 9.9, "base_severity": "CRITICAL", "exploit_code_maturity": null, "remediation_level": null, "report_confidence": null, "temporal_score": null, "temporal_severity": null, "confidentiality_requirement": null, "integrity_requirement": null, "availability_requirement": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_scope": null, "modified_confidentiality_impact": null, "modified_integrity_impact": null, "modified_availability_impact": null, "environmental_score": null, "environmental_severity": null }, "exploitability_score": 3.9, "impact_score": 5.3 } ], "cvss_metric_v30": [ { "source": "user@huntr.dev", "type": "Secondary", "cvss_data": { "version": "3.0", "vector_string": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H", "attack_vector": "NETWORK", "attack_complexity": "LOW", "privileges_required": "HIGH", "user_interaction": "NONE", "scope": "CHANGED", "confidentiality_impact": "LOW", "integrity_impact": "HIGH", "availability_impact": "HIGH", "base_score": 9.0, "base_severity": "CRITICAL", "exploit_code_maturity": null, "remediation_level": null, "report_confidence": null, "temporal_score": null, "temporal_severity": null, "confidentiality_requirement": null, "integrity_requirement": null, "availability_requirement": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_scope": null, "modified_confidentiality_impact": null, "modified_integrity_impact": null, "modified_availability_impact": null, "environmental_score": null, "environmental_severity": null }, "exploitability_score": 2.3, "impact_score": 6.0 } ], "cvss_metric_v2": [ { "source": "user@nist.gov", "type": "Primary", "cvss_data": { "version": "2.0", "vector_string": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "access_vector": "NETWORK", "access_complexity": "LOW", "authentication": "NONE", "confidentiality_impact": "PARTIAL", "integrity_impact": "PARTIAL", "availability_impact": "PARTIAL", "base_score": 7.5, "exploitability": null, "remediation_level": null, "report_confidence": null, "temporal_score": null, "collateral_damage_potential": null, "target_distribution": null, "confidentiality_requirement": null, "integrity_requirement": null, "availability_requirement": null, "environmental_score": null }, "base_severity": "HIGH", "exploitability_score": 10.0, "impact_score": 6.4, "ac_insuf_info": false, "obtain_all_privilege": false, "obtain_user_privilege": false, "obtain_other_privilege": false, "user_interaction_required": false } ] }, "weaknesses": [ { "source": "user@huntr.dev", "type": "Secondary", "description": [ { "lang": "en", "value": "CWE-918" } ] } ], "configurations": [ { "operator": null, "negate": null, "nodes": [ { "operator": "OR", "negate": false, "cpe_match": [ { "vulnerable": true, "criteria": "cpe:2.3:a:janeczku:calibre-web:*:*:*:*:*:*:*:*", "match_criteria_id": "6AC00DC5-E71A-41B8-9728-374A14EE4458", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "0.6.18" } ] } ] } ], "vendor_comments": null, "enrichment": { "cpe": [ { "criteria": "cpe:2.3:a:janeczku:calibre-web:*:*:*:*:*:*:*:*", "vendor": "janeczku", "product": "calibre-web", "product_type": "a", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "0.6.18", "affected_versions_first": "0.6.0", "affected_versions_last": "0.6.17" } ], "cwe": [ { "id": 918, "owasptop10_2021": "A10 Server-Side Request Forgery (SSRF)", "name": "Server-Side Request Forgery (SSRF)", "description": "The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.", "capec_id": [ 664 ], "scope": [ "Access Control", "Confidentiality", "Integrity" ], "impact": [ "Bypass Protection Mechanism", "Execute Unauthorized Code or Commands", "Read Application Data" ], "detection_method": [ "Automated Static Analysis" ] } ], "epss_score": { "epss": 0.01059, "percentile": 0.63088, "date": "2026-09-23" }, "cisa_kev": null, "vdeep_metric": { "available_versions": [ "3.1", "3.0", "2.0" ], "source": "user@nist.gov", "type": "Primary", "cvss_data": { "version": "3.1", "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H", "attack_vector": "NETWORK", "attack_complexity": "LOW", "attack_requirements": null, "privileges_required": "NONE", "user_interaction": "NONE", "vulnerable_system_confidentiality": "LOW", "vulnerable_system_integrity": "LOW", "vulnerable_system_availability": "HIGH", "subsequent_system_confidentiality": null, "subsequent_system_integrity": null, "subsequent_system_availability": null, "exploit_maturity": null, "confidentiality_requirements": null, "integrity_requirements": null, "availability_requirements": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_attack_requirements": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_vulnerable_system_confidentiality": null, "modified_vulnerable_system_integrity": null, "modified_vulnerable_system_availability": null, "modified_subsequent_system_confidentiality": null, "modified_subsequent_system_integrity": null, "modified_subsequent_system_availability": null, "safety": null, "automatable": null, "recovery": null, "value_density": null, "vulnerability_response_effort": null, "provider_urgency": null, "base_score": 9.9, "base_severity": "CRITICAL" } } } } ] } ``` ## Related Examples - [CVSS v3.0: High Attack Complexity](/reference/vulnerability/search/examples/metrics-cvss-metric-v30-cvss-data-attack-complexity/) - [CVSS v3.0: User Interaction Required](/reference/vulnerability/search/examples/metrics-cvss-metric-v30-cvss-data-user-interaction/) - [CVSS v3.0: Local Attack Vector](/reference/vulnerability/search/examples/metrics-cvss-metric-v30-cvss-data-attack-vector/) - [CVSS v3.0: Changed Scope](/reference/vulnerability/search/examples/metrics-cvss-metric-v30-cvss-data-scope/) - [CVSS v3.0: Low Confidentiality Impact](/reference/vulnerability/search/examples/metrics-cvss-metric-v30-cvss-data-confidentiality-impact/) - [CVSS v3.0: Any Score](/reference/vulnerability/search/examples/metrics-cvss-metric-v30-cvss-data-version/)