DuyTa/cve-kgrag-db huggingface dataset:
CVE-2022-49352
In the Linux kernel, the following vulnerability has been resolved:

ext4: fix warning in ext4_handle_inode_extension

We got issue as follows:
EXT4-fs error (device loop0) in ext4_reserve_inode_write:5741: Out of memory
EXT4-fs error (device loop0): ext4_setattr:5462: inode #13: comm syz-executor.0: mark_inode_dirty error
EXT4-fs error (device loop0) in ext4_setattr:5519: Out of memory
EXT4-fs error (device loop0): ext4_ind_map_blocks:595: inode #13: comm syz-executor.0: Can't allocate blocks for non-extent mapped inodes with bigalloc
------------[ cut here ]------------
WARNING: CPU: 1 PID: 4361 at fs/ext4/file.c:301 ext4_file_write_iter+0x11c9/0x1220
Modules linked in:
CPU: 1 PID: 4361 Comm: syz-executor.0 Not tainted 5.10.0+ #1
RIP: 0010:ext4_file_write_iter+0x11c9/0x1220
RSP: 0018:ffff924d80b27c00 EFLAGS: 00010282
RAX: ffffffff815a3379 RBX: 0000000000000000 RCX: 000000003b000000
RDX: ffff924d81601000 RSI: 00000000000009cc RDI: 00000000000009cd
RBP: 000000000000000d R08: ffffffffbc5a2c6b R09: 0000902e0e52a96f
R10: ffff902e2b7c1b40 R11: ffff902e2b7c1b40 R12: 000000000000000a
R13: 0000000000000001 R14: ffff902e0e52aa10 R15: ffffffffffffff8b
FS:  00007f81a7f65700(0000) GS:ffff902e3bc80000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffff600400 CR3: 000000012db88001 CR4: 00000000003706e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 do_iter_readv_writev+0x2e5/0x360
 do_iter_write+0x112/0x4c0
 do_pwritev+0x1e5/0x390
 __x64_sys_pwritev2+0x7e/0xa0
 do_syscall_64+0x37/0x50
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

Above issue may happen as follows:
Assume
inode.i_size=4096
EXT4_I(inode)->i_disksize=4096

step 1: set inode->i_isize = 8192
ext4_setattr
  if (attr->ia_size != inode->i_size)
    EXT4_I(inode)->i_disksize = attr->ia_size;
    rc = ext4_mark_inode_dirty
       ext4_reserve_inode_write
          ext4_get_inode_loc
            __ext4_get_inode_loc
              sb_getblk --> return -ENOMEM
   ...
   if (!error)  ->will not update i_size
     i_size_write(inode, attr->ia_size);
Now:
inode.i_size=4096
EXT4_I(inode)->i_disksize=8192

step 2: Direct write 4096 bytes
ext4_file_write_iter
 ext4_dio_write_iter
   iomap_dio_rw ->return error
 if (extend)
   ext4_handle_inode_extension
     WARN_ON_ONCE(i_size_read(inode) < EXT4_I(inode)->i_disksize);
->Then trigger warning.

To solve above issue, if mark inode dirty failed in ext4_setattr just
set 'EXT4_I(inode)->i_disksize' with old value.
CVSS v3.1 Score: 5.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected Products: linux_kernel
References: https://git.kernel.org/stable/c/1bcce88da60eccc946c0f4ed942b0f08cd565778, https://git.kernel.org/stable/c/adf490083ca52ebfb0b2fe64ff1ead00c0452dd7, https://git.kernel.org/stable/c/b81d2ff6885e38fc745eeaf9565775055778fc0b
CVE-2022-23486
libp2p-rust is the official rust language Implementation of the libp2p networking stack. In versions prior to 0.45.1 an attacker node can cause a victim node to allocate a large number of small memory chunks, which can ultimately lead to the victim’s process running out of memory and thus getting killed by its operating system. When executed continuously, this can lead to a denial of service attack, especially relevant on a larger scale when run against more than one node of a libp2p based network. Users are advised to upgrade to `libp2p` `v0.45.1` or above. Users unable to upgrade should reference the DoS Mitigation page for more information on how to incorporate mitigation strategies, monitor their application, and respond to attacks: https://docs.libp2p.io/reference/dos-mitigation/.
CVSS v3.1 Score: 7.5 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products: libp2p
Related CWEs: CWE-400, CWE-770
Related CAPECs: CAPEC-493, CAPEC-488, CAPEC-489
MITRE ATT&CK Techniques: T1498.002, T1499, T1498.001
MITRE ATT&CK Tactics: T1498, T1499
References: https://github.com/libp2p/rust-libp2p/security/advisories/GHSA-jvgw-gccv-q5p8, https://github.com/libp2p/rust-libp2p/security/advisories/GHSA-jvgw-gccv-q5p8
CWE: CWE-400, CWE-770
MITRE ATT&CK techniques: T1498.002, T1499, T1498.001, T1499.001, T1499.002, T1499.003
MITRE ATT&CK tactics: T1498, T1499
CVE-2022-49707
In the Linux kernel, the following vulnerability has been resolved:

ext4: add reserved GDT blocks check

We capture a NULL pointer issue when resizing a corrupt ext4 image which
is freshly clear resize_inode feature (not run e2fsck). It could be
simply reproduced by following steps. The problem is because of the
resize_inode feature was cleared, and it will convert the filesystem to
meta_bg mode in ext4_resize_fs(), but the es->s_reserved_gdt_blocks was
not reduced to zero, so could we mistakenly call reserve_backup_gdb()
and passing an uninitialized resize_inode to it when adding new group
descriptors.

 mkfs.ext4 /dev/sda 3G
 tune2fs -O ^resize_inode /dev/sda #forget to run requested e2fsck
 mount /dev/sda /mnt
 resize2fs /dev/sda 8G

 ========
 BUG: kernel NULL pointer dereference, address: 0000000000000028
 CPU: 19 PID: 3243 Comm: resize2fs Not tainted 5.18.0-rc7-00001-gfde086c5ebfd #748
 ...
 RIP: 0010:ext4_flex_group_add+0xe08/0x2570
 ...
 Call Trace:
  <TASK>
  ext4_resize_fs+0xbec/0x1660
  __ext4_ioctl+0x1749/0x24e0
  ext4_ioctl+0x12/0x20
  __x64_sys_ioctl+0xa6/0x110
  do_syscall_64+0x3b/0x90
  entry_SYSCALL_64_after_hwframe+0x44/0xae
 RIP: 0033:0x7f2dd739617b
 ========

The fix is simple, add a check in ext4_resize_begin() to make sure that
the es->s_reserved_gdt_blocks is zero when the resize_inode feature is
disabled.
CVSS v3.1 Score: 5.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected Products: linux_kernel
Related CWEs: CWE-476
References: https://git.kernel.org/stable/c/0dc2fca8e4f9ac4a40e8424a10163369cca0cc06, https://git.kernel.org/stable/c/33b1bba31f4c784d33d2c2517964bdccdc9204cd, https://git.kernel.org/stable/c/7c921328ac760bba780bdace41f4cd045f7f1405
CWE: CWE-476
CVE-2022-50308
In the Linux kernel, the following vulnerability has been resolved:

ASoC: qcom: Add checks for devm_kcalloc

As the devm_kcalloc may return NULL, the return value needs to be checked
to avoid NULL poineter dereference.
CVSS v3.1 Score: 5.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected Products: linux_kernel
Related CWEs: CWE-476
References: https://git.kernel.org/stable/c/1bf5ee979076ceb121ee51c95197d890b1cee7f4, https://git.kernel.org/stable/c/4518d7cc38b7d1a7ce5a7878ca601c91e19fe47d, https://git.kernel.org/stable/c/7830e2289eb4b74970b6cd1b6cc68dcd021c2281
CWE: CWE-476
CVE-2022-26332
Cipi 3.1.15 allows Add Server stored XSS via the /api/servers name field.
CVSS v3.1 Score: 5.4 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS v2.0 Score: 3.5 (LOW)
CVSS v2.0 Vector: AV:N/AC:M/Au:S/C:N/I:P/A:N
Affected Products: cipi
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://github.com/andreapollastri/cipi/releases, https://www.exploit-db.com/exploits/50788, https://github.com/andreapollastri/cipi/releases
CWE: CWE-79
CVE-2022-50518
In the Linux kernel, the following vulnerability has been resolved:

parisc: Fix locking in pdc_iodc_print() firmware call

Utilize pdc_lock spinlock to protect parallel modifications of the
iodc_dbuf[] buffer, check length to prevent buffer overflow of
iodc_dbuf[], drop the iodc_retbuf[] buffer and fix some wrong
indentings.
CVSS v3.1 Score: 7.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Products: linux_kernel
Related CWEs: CWE-667
Related CAPECs: CAPEC-25, CAPEC-27, CAPEC-26
MITRE ATT&CK Techniques: T1499.004
MITRE ATT&CK Tactics: T1499
References: https://git.kernel.org/stable/c/04a603058e70b8b881bb7860b8bd649f931f2591, https://git.kernel.org/stable/c/553bc5890ed96a8d006224c3a4673c47fee0d12a, https://git.kernel.org/stable/c/7236aae5f81f3efbd93d0601e74fc05994bc2580
CWE: CWE-667
MITRE ATT&CK techniques: T1499.004
MITRE ATT&CK tactics: T1499
CVE-2022-30517
Mogu blog 5.2 is vulnerable to Cross Site Scripting (XSS).
CVSS v3.1 Score: 6.1 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: mogublog
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://github.com/moxi624/mogu_blog_v2/issues/65, https://github.com/moxi624/mogu_blog_v2/issues/65
CWE: CWE-79
CVE-2022-44608
Uncontrolled resource consumption vulnerability in Cybozu Remote Service 4.0.0 to 4.0.3 allows a remote authenticated attacker to consume huge storage space, which may result in a denial-of-service (DoS) condition.
CVSS v3.1 Score: 7.5 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products: cybozu_remote_service
Related CWEs: CWE-400
Related CAPECs: CAPEC-147, CAPEC-492, CAPEC-227
MITRE ATT&CK Techniques: T1499
References: https://cs.cybozu.co.jp/2022/007754.html, https://jvn.jp/en/jp/JVN87895771/index.html, https://cs.cybozu.co.jp/2022/007754.html
CWE: CWE-400
MITRE ATT&CK techniques: T1499
CVE-2022-46835
IdentityIQ 8.3 and all 8.3 patch levels prior to 8.3p2, IdentityIQ 8.2 and all 8.2 patch levels prior to 8.2p5, IdentityIQ 8.1 and all 8.1 patch levels prior to 8.1p7, IdentityIQ 8.0 and all 8.0 patch levels prior to 8.0p6 allow access to arbitrary files in the application server filesystem due to a path traversal vulnerability in JavaServer Faces (JSF) 2.2.20 documented in CVE-2020-6950.
CVSS v3.1 Score: 8.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Products: identityiq
Related CWEs: CWE-22
Related CAPECs: CAPEC-78, CAPEC-126, CAPEC-76
References: https://www.sailpoint.com/security-advisories/sailpoint-identityiq-file-traversal-vulnerability-cve-2022-46835/, https://www.sailpoint.com/security-advisories/sailpoint-identityiq-file-traversal-vulnerability-cve-2022-46835/
CWE: CWE-22
CVE-2022-26244
A stored cross-site scripting (XSS) vulnerability in Hospital Patient Record Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the "special" field.
CVSS v3.1 Score: 5.4 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS v2.0 Score: 3.5 (LOW)
CVSS v2.0 Vector: AV:N/AC:M/Au:S/C:N/I:P/A:N
Affected Products: hospital\'s_patient_records_management_system
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: http://hospital.com, https://github.com/kishan0725/Hospital-Management-System/issues/23, http://hospital.com
CWE: CWE-79
CVE-2022-20209
In hme_add_new_node_to_a_sorted_array of hme_utils.c, there is a possible out of bounds read due to a heap buffer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12LAndroid ID: A-207502397
CVSS v3.1 Score: 7.5 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: android
Related CWEs: CWE-787
References: https://source.android.com/security/bulletin/pixel/2022-06-01, https://source.android.com/security/bulletin/pixel/2022-06-01
CWE: CWE-787
CVE-2022-4674
The Ibtana WordPress plugin before 1.1.8.8 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack
CVSS v3.1 Score: 5.4 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected Products: ibtana
References: https://wpscan.com/vulnerability/eda64678-81ae-4be3-941e-a1e26e54029b, https://wpscan.com/vulnerability/eda64678-81ae-4be3-941e-a1e26e54029b
CVE-2022-33654
Azure Site Recovery Elevation of Privilege Vulnerability
CVSS v3.1 Score: 4.9 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
CVSS v2.0 Score: 4.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:S/C:P/I:N/A:N
Affected Products: azure_site_recovery_vmware_to_azure
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-33654, https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-33654
CVE-2022-0919
The Salon booking system Free and pro WordPress plugins before 7.6.3 do not have proper authorisation when searching bookings, allowing any unauthenticated users to search other's booking, as well as retrieve sensitive information about the bookings, such as the full name, email and phone number of the person who booked it.
CVSS v3.1 Score: 5.3 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: salon_booking_system
Related CWEs: CWE-862
Related CAPECs: CAPEC-665
MITRE ATT&CK Techniques: T1211, T1556, T1542.002
MITRE ATT&CK Tactics: T1542
References: https://wpscan.com/vulnerability/e8f32e0b-4a89-460b-bb78-7c83ef5e16b4, https://wpscan.com/vulnerability/e8f32e0b-4a89-460b-bb78-7c83ef5e16b4
CWE: CWE-862
MITRE ATT&CK techniques: T1211, T1556, T1542.002
MITRE ATT&CK tactics: T1542
CVE-2022-30330
In the KeepKey firmware before 7.3.2,Flaws in the supervisor interface can be exploited to bypass important security restrictions on firmware operations. Using these flaws, malicious firmware code can elevate privileges, permanently make the device inoperable or overwrite the trusted bootloader code to compromise the hardware wallet across reboots or storage wipes.
CVSS v3.1 Score: 6.6 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 6.9 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:M/Au:N/C:C/I:C/A:C
Affected Products: keepkey_firmware, keepkey
Related CWEs: CWE-20
Related CAPECs: CAPEC-31, CAPEC-53, CAPEC-261
MITRE ATT&CK Techniques: T1574.006, T1553.002, T1574.007
MITRE ATT&CK Tactics: T1562, T1574, T1553
References: https://blog.inhq.net/posts/keepkey-CVE-2022-30330/, https://github.com/keepkey/keepkey-firmware/commit/447c1f038a31378ab9589965c098467d9ea6cccc, https://github.com/keepkey/keepkey-firmware/releases/tag/v7.3.2
CWE: CWE-20
MITRE ATT&CK techniques: T1574.006, T1553.002, T1574.007, T1539, T1036.001, T1562.003, T1027
MITRE ATT&CK tactics: T1562, T1574, T1553, T1036
CVE-2022-41382
The d8s-json package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-file-system package. The affected version is 0.1.0.
CVSS v3.1 Score: 9.8 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products: d8s-json
Related CWEs: CWE-434
Related CAPECs: CAPEC-1
MITRE ATT&CK Techniques: T1574.010
MITRE ATT&CK Tactics: T1574
References: https://github.com/democritus-project/d8s-json/issues/10, https://pypi.org/project/d8s-json/, https://pypi.org/project/democritus-file-system/
CWE: CWE-434
MITRE ATT&CK techniques: T1574.010
MITRE ATT&CK tactics: T1574
CVE-2022-36516
H3C GR-1200W MiniGRW1A0V100R006 was discovered to contain a stack overflow via the function ap_version_check.
CVSS v3.1 Score: 9.8 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products: gr-1200w_firmware, gr-1200w
Related CWEs: CWE-787
References: https://github.com/Darry-lang1/vuln/tree/main/H3C/GR-1200W/3, https://github.com/Darry-lang1/vuln/tree/main/H3C/GR-1200W/3
CWE: CWE-787
CVE-2022-43384
IBM Aspera Console 3.4.0 through 3.4.2 PL5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.  IBM X-Force ID:  238645.
CVSS v3.1 Score: 4.6 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Affected Products: aspera_console
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/238645, https://www.ibm.com/support/pages/node/7155215, https://exchange.xforce.ibmcloud.com/vulnerabilities/238645
CWE: CWE-79
CVE-2022-39116
In sprd_sysdump driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service in kernel.
CVSS v3.1 Score: 5.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected Products: t612, sc9863a, t820, sc7731e, t760
Related CWEs: CWE-121, CWE-787
References: https://www.unisoc.com/en_us/secy/announcementDetail/1610118225591336001, https://www.unisoc.com/en_us/secy/announcementDetail/1610118225591336001
CWE: CWE-121, CWE-787
CVE-2022-50168
In the Linux kernel, the following vulnerability has been resolved:

bpf, x86: fix freeing of not-finalized bpf_prog_pack

syzbot reported a few issues with bpf_prog_pack [1], [2]. This only happens
with multiple subprogs. In jit_subprogs(), we first call bpf_int_jit_compile()
on each sub program. And then, we call it on each sub program again. jit_data
is not freed in the first call of bpf_int_jit_compile(). Similarly we don't
call bpf_jit_binary_pack_finalize() in the first call of bpf_int_jit_compile().

If bpf_int_jit_compile() failed for one sub program, we will call
bpf_jit_binary_pack_finalize() for this sub program. However, we don't have a
chance to call it for other sub programs. Then we will hit "goto out_free" in
jit_subprogs(), and call bpf_jit_free on some subprograms that haven't got
bpf_jit_binary_pack_finalize() yet.

At this point, bpf_jit_binary_pack_free() is called and the whole 2MB page is
freed erroneously.

Fix this with a custom bpf_jit_free() for x86_64, which calls
bpf_jit_binary_pack_finalize() if necessary. Also, with custom
bpf_jit_free(), bpf_prog_aux->use_bpf_prog_pack is not needed any more,
remove it.

[1] https://syzkaller.appspot.com/bug?extid=2f649ec6d2eea1495a8f
[2] https://syzkaller.appspot.com/bug?extid=87f65c75f4a72db05445
CVSS v3.1 Score: 7.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Products: linux_kernel
References: https://git.kernel.org/stable/c/1d5f82d9dd477d5c66e0214a68c3e4f308eadd6d, https://git.kernel.org/stable/c/60e66074812dde9cde3d99cdd3caa9e40f1a4516, https://git.kernel.org/stable/c/f91ce608a79c0db3e72bd63c23e011a9ebc31505
CVE-2022-33060
Online Railway Reservation System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f=delete_schedule.
CVSS v3.1 Score: 7.2 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 6.5 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P
Affected Products: online_railway_reservation_system
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/online-railway-reservation-system/SQLi-8.md, https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/online-railway-reservation-system/SQLi-8.md
CWE: CWE-89
CVE-2022-22327
IBM UrbanCode Deploy (UCD) 7.0.5, 7.1.0, 7.1.1, and 7.1.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 218859.
CVSS v3.1 Score: 7.5 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: urbancode_deploy
Related CWEs: CWE-327
Related CAPECs: CAPEC-614, CAPEC-97, CAPEC-459
MITRE ATT&CK Techniques: T1553.002, T1036.001
MITRE ATT&CK Tactics: T1553, T1036
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/218859, https://www.ibm.com/support/pages/node/6568551, https://exchange.xforce.ibmcloud.com/vulnerabilities/218859
CWE: CWE-327
MITRE ATT&CK techniques: T1553.002, T1036.001
MITRE ATT&CK tactics: T1553, T1036
CVE-2022-25737
Information disclosure in modem due to missing NULL check  while reading packets received from local network
CVSS v3.1 Score: 7.5 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected Products: wcd9306_firmware, qca4004, qts110, wcd9330, snapdragon_wear_1200
Related CWEs: CWE-457, CWE-908
References: https://www.qualcomm.com/company/product-security/bulletins/april-2023-bulletin, https://www.qualcomm.com/company/product-security/bulletins/april-2023-bulletin
CWE: CWE-457, CWE-908
CVE-2022-25653
Information disclosure in video due to buffer over-read while processing avi file in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables
CVSS v3.1 Score: 6.8 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L
Affected Products: sm7325p, sw5100, wsa8832, sm7450_firmware, wcn6750_firmware
Related CWEs: CWE-125
Related CAPECs: CAPEC-540
References: https://www.qualcomm.com/company/product-security/bulletins/september-2022-bulletin, https://www.qualcomm.com/company/product-security/bulletins/september-2022-bulletin
CWE: CWE-125
CVE-2022-47162
Cross-Site Request Forgery (CSRF) vulnerability in Dannie Herdyawan DH – Anti AdBlocker plugin <= 36 versions.
CVSS v3.1 Score: 4.3 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Affected Products: dh_-_anti_adblocker
Related CWEs: CWE-352
Related CAPECs: CAPEC-467, CAPEC-111, CAPEC-462
References: https://patchstack.com/database/vulnerability/dh-anti-adblocker/wordpress-dh-anti-adblocker-plugin-36-cross-site-request-forgery-csrf?_s_id=cve, https://patchstack.com/database/vulnerability/dh-anti-adblocker/wordpress-dh-anti-adblocker-plugin-36-cross-site-request-forgery-csrf?_s_id=cve
CWE: CWE-352
CVE-2022-28937
FISCO-BCOS release-3.0.0-rc2 was discovered to contain an issue where a malicious node, via an invalid proposal with an invalid header, will cause normal nodes to stop producing new blocks and processing new clients' requests.
CVSS v3.1 Score: 7.5 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Affected Products: fisco-bcos
Related CWEs: CWE-190
Related CAPECs: CAPEC-92
References: https://github.com/FISCO-BCOS/FISCO-BCOS/issues/2312, https://github.com/FISCO-BCOS/FISCO-BCOS/issues/2312
CWE: CWE-190
CVE-2022-4305
The Login as User or Customer WordPress plugin before 3.3 lacks authorization checks to ensure that users are allowed to log in as another one, which could allow unauthenticated attackers to obtain a valid admin session.
CVSS v3.1 Score: 9.8 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products: login_as_user_or_customer_\(user_switching\)
References: https://wpscan.com/vulnerability/286d972d-7bda-455c-a226-fd9ce5f925bd, https://wpscan.com/vulnerability/286d972d-7bda-455c-a226-fd9ce5f925bd
CVE-2022-28560
There is a stack overflow vulnerability in the goform/fast_setting_wifi_set function in the httpd service of Tenda ac9 15.03.2.21_cn router. An attacker can obtain a stable shell through a carefully constructed payload
CVSS v3.1 Score: 9.8 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: ac9_firmware, ac9
Related CWEs: CWE-787
References: https://github.com/iot-firmeware/-Router-vulnerability/tree/main/Tenda%20AC9, https://github.com/iot-firmeware/-Router-vulnerability/tree/main/Tenda%20AC9
CWE: CWE-787
CVE-2022-4156
The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the user_id POST parameter before concatenating it to an SQL query in ajax-functions-backend.php. This may allow malicious users with at least author privilege to leak sensitive information from the site's database.
CVSS v3.1 Score: 7.5 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected Products: contest_gallery
References: https://bulletin.iese.de/post/contest-gallery_19-1-4-1_1, https://wpscan.com/vulnerability/254f6e8b-5fa9-4d6d-8e0e-1a4cae18aee0, https://bulletin.iese.de/post/contest-gallery_19-1-4-1_1
CVE-2022-34730
Microsoft ODBC Driver Remote Code Execution Vulnerability
CVSS v3.1 Score: 8.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected Products: windows_server_2012, windows_10, windows_server_2016, windows_7, windows_11
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-34730, https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-34730
CVE-2022-3101
A flaw was found in tripleo-ansible. Due to an insecure default configuration, the permissions of a sensitive file are not sufficiently restricted. This flaw allows a local attacker to use brute force to explore the relevant directory and discover the file, leading to information disclosure of important configuration details from the OpenStack deployment.
CVSS v3.1 Score: 5.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected Products: tripleo_ansible, openstack, openstack_for_ibm_power
Related CWEs: CWE-276, CWE-22, CWE-732
Related CAPECs: CAPEC-78, CAPEC-17, CAPEC-206
MITRE ATT&CK Techniques: T1553.002, T1083, T1505.005
MITRE ATT&CK Tactics: T1134, T1505, T1553
References: https://access.redhat.com/security/cve/CVE-2022-3101, https://access.redhat.com/security/cve/CVE-2022-3101
CWE: CWE-276, CWE-22, CWE-732
MITRE ATT&CK techniques: T1553.002, T1083, T1505.005, T1550.004, T1134.001, T1574.010, T1548, T1554, T1574.005
MITRE ATT&CK tactics: T1134, T1505, T1553, T1550, T1574
CVE-2022-26296
BOOM: The Berkeley Out-of-Order RISC-V Processor commit d77c2c3 was discovered to allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis.
CVSS v3.1 Score: 5.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v2.0 Score: 2.1 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:N/A:N
Affected Products: risvc-boom
References: https://github.com/riscv-boom/riscv-boom/issues/577, https://github.com/riscv-boom/riscv-boom/issues/577
CVE-2022-50162
In the Linux kernel, the following vulnerability has been resolved:

wifi: libertas: Fix possible refcount leak in if_usb_probe()

usb_get_dev will be called before lbs_get_firmware_async which means that
usb_put_dev need to be called when lbs_get_firmware_async fails.
CVSS v3.1 Score: 5.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected Products: linux_kernel
References: https://git.kernel.org/stable/c/00d0c4e59c0f8ad1f86874bb64b220394e687028, https://git.kernel.org/stable/c/4c8e2f9ce1428e44cb103035eeced7aeb6b80980, https://git.kernel.org/stable/c/5b92f406a5199b6b01dc664b9226d824ae2835f0
CVE-2022-47378
Multiple CODESYS products in multiple versions are prone to a improper input validation vulnerability. An authenticated remote attacker may craft specific requests that use the vulnerability leading to a denial-of-service condition.
CVSS v3.1 Score: 6.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected Products: control_for_wago_touch_panels_600_sl, control_for_pfc200_sl, control_for_iot2000_sl, control_for_pfc100_sl, control_for_linux_sl
Related CWEs: CWE-20
Related CAPECs: CAPEC-31, CAPEC-53, CAPEC-261
MITRE ATT&CK Techniques: T1574.006, T1553.002, T1574.007
MITRE ATT&CK Tactics: T1562, T1574, T1553
References: https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=17554&token=5444f53b4c90fe37043671a100dffa75305d1825&download=, https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=17554&token=5444f53b4c90fe37043671a100dffa75305d1825&download=
CWE: CWE-20
MITRE ATT&CK techniques: T1574.006, T1553.002, T1574.007, T1539, T1036.001, T1562.003, T1027
MITRE ATT&CK tactics: T1562, T1574, T1553, T1036
CVE-2022-23570
Tensorflow is an Open Source Machine Learning Framework. When decoding a tensor from protobuf, TensorFlow might do a null-dereference if attributes of some mutable arguments to some operations are missing from the proto. This is guarded by a `DCHECK`. However, `DCHECK` is a no-op in production builds and an assertion failure in debug builds. In the first case execution proceeds to the dereferencing of the null pointer, whereas in the second case it results in a crash due to the assertion failure. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, and TensorFlow 2.6.3, as these are also affected and still in supported range.
CVSS v3.1 Score: 6.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v2.0 Score: 4.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:S/C:N/I:N/A:P
Affected Products: tensorflow
Related CWEs: CWE-476, CWE-617
References: https://github.com/tensorflow/tensorflow/blob/a1320ec1eac186da1d03f033109191f715b2b130/tensorflow/core/framework/full_type_util.cc#L104-L106, https://github.com/tensorflow/tensorflow/commit/8a513cec4bec15961fbfdedcaa5376522980455c, https://github.com/tensorflow/tensorflow/security/advisories/GHSA-9p77-mmrw-69c7
CWE: CWE-476, CWE-617
CVE-2022-4443
The BruteBank WordPress plugin before 1.9 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged-in admin change them via a CSRF attack.
CVSS v3.1 Score: 6.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Affected Products: brutebank
References: https://wpscan.com/vulnerability/1e621d62-13c7-4b2f-96ca-3617a796d037, https://wpscan.com/vulnerability/1e621d62-13c7-4b2f-96ca-3617a796d037
CVE-2022-25151
Within the Service Desk module of the ITarian platform (SAAS and on-premise), a remote attacker can obtain sensitive information, caused by the failure to set the HTTP Only flag. A remote attacker could exploit this vulnerability to gain access to the management interface by using this vulnerability in combination with a successful Cross-Site Scripting attack on a user.
CVSS v3.1 Score: 7.5 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: saas_service_desk, on-premise
Related CWEs: CWE-614, CWE-732
Related CAPECs: CAPEC-17, CAPEC-206, CAPEC-234
MITRE ATT&CK Techniques: T1553.002, T1083, T1505.005
MITRE ATT&CK Tactics: T1134, T1505, T1553
References: https://csirt.divd.nl/CVE-2022-25151, https://csirt.divd.nl/DIVD-2021-00037, https://csirt.divd.nl/CVE-2022-25151
CWE: CWE-614, CWE-732
MITRE ATT&CK techniques: T1553.002, T1083, T1505.005, T1550.004, T1134.001, T1574.010, T1548, T1554, T1574.005
MITRE ATT&CK tactics: T1134, T1505, T1553, T1550, T1574
CVE-2022-46678



Wyse Management Suite 

3.8 and below contain an improper access control vulnerability. A authenticated malicious admin user can edit general client policy for which the user is not authorized.






CVSS v3.1 Score: 4.9 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Affected Products: wyse_management_suite
Related CWEs: CWE-284
Related CAPECs: CAPEC-563, CAPEC-536, CAPEC-478
MITRE ATT&CK Techniques: T1014, T1562.001, T1543.003
MITRE ATT&CK Tactics: T1556, T1546, T1547
References: https://www.dell.com/support/kbdoc/en-us/000206134/dsa-2022-329-dell-wyse-management-suite-security-update-for-multiple-vulnerabilities, https://www.dell.com/support/kbdoc/en-us/000206134/dsa-2022-329-dell-wyse-management-suite-security-update-for-multiple-vulnerabilities
CWE: CWE-284
MITRE ATT&CK techniques: T1014, T1562.001, T1543.003, T1546.008, T1037, T1562.007, T1027.009, T1543.001, T1547, T1543.004, T1562.002, T1553.004, T1546.016, T1080, T1574.011, T1556.006, T1543, T1546.004, T1547.006, T1546.001, T1562.004, T1542.003, T1505.005, T1562.008, T1562.009
MITRE ATT&CK tactics: T1556, T1546, T1547, T1542, T1505, T1553, T1562, T1574, T1543, T1027
CVE-2022-50754
In the Linux kernel, the following vulnerability has been resolved:

apparmor: fix a memleak in multi_transaction_new()

In multi_transaction_new(), the variable t is not freed or passed out
on the failure of copy_from_user(t->data, buf, size), which could lead
to a memleak.

Fix this bug by adding a put_multi_transaction(t) in the error path.
References: https://git.kernel.org/stable/c/11d5fe7da67c3334cefc981297fd5defb78df15c, https://git.kernel.org/stable/c/3d27a436e294ac5d7a51bd5348ca63a42a468b35, https://git.kernel.org/stable/c/775a37ffa9f4681c4ad84c8634a7eec8af7098d4
CVE-2022-43893

IBM Security Verify Privilege On-Premises 11.5 could allow a privileged user to cause by using a malicious payload.  IBM X-Force ID:  240634.


CVSS v3.1 Score: 2.7 (LOW)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L
Affected Products: windows, security_verify_privilege_on-premises, macos
Related CWEs: CWE-400
Related CAPECs: CAPEC-147, CAPEC-492, CAPEC-227
MITRE ATT&CK Techniques: T1499
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/240534, https://www.ibm.com/support/pages/node/7047202, https://exchange.xforce.ibmcloud.com/vulnerabilities/240534
CWE: CWE-400
MITRE ATT&CK techniques: T1499
CVE-2022-32140
Multiple CODESYS products are affected to a buffer overflow.A low privileged remote attacker may craft a request, which can cause a buffer copy without checking the size of the service, resulting in a denial-of-service condition. User Interaction is not required.
CVSS v3.1 Score: 6.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v2.0 Score: 4.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:S/C:N/I:N/A:P
Affected Products: runtime_toolkit, plcwinnt
Related CWEs: CWE-120
Related CAPECs: CAPEC-14, CAPEC-92, CAPEC-45
References: https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=17139&token=ec67d15a433b61c77154166c20c78036540cacb0&download=, https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=17139&token=ec67d15a433b61c77154166c20c78036540cacb0&download=
CWE: CWE-120
CVE-2022-20179
Product: AndroidVersions: Android kernelAndroid ID: A-211683760References: N/A
CVSS v3.1 Score: 7.5 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: android
References: https://source.android.com/security/bulletin/pixel/2022-06-01, https://source.android.com/security/bulletin/pixel/2022-06-01
CVE-2022-49371
In the Linux kernel, the following vulnerability has been resolved:

driver core: fix deadlock in __device_attach

In __device_attach function, The lock holding logic is as follows:
...
__device_attach
device_lock(dev)      // get lock dev
  async_schedule_dev(__device_attach_async_helper, dev); // func
    async_schedule_node
      async_schedule_node_domain(func)
        entry = kzalloc(sizeof(struct async_entry), GFP_ATOMIC);
	/* when fail or work limit, sync to execute func, but
	   __device_attach_async_helper will get lock dev as
	   well, which will lead to A-A deadlock.  */
	if (!entry || atomic_read(&entry_count) > MAX_WORK) {
	  func;
	else
	  queue_work_node(node, system_unbound_wq, &entry->work)
  device_unlock(dev)

As shown above, when it is allowed to do async probes, because of
out of memory or work limit, async work is not allowed, to do
sync execute instead. it will lead to A-A deadlock because of
__device_attach_async_helper getting lock dev.

To fix the deadlock, move the async_schedule_dev outside device_lock,
as we can see, in async_schedule_node_domain, the parameter of
queue_work_node is system_unbound_wq, so it can accept concurrent
operations. which will also not change the code logic, and will
not lead to deadlock.
CVSS v3.1 Score: 5.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected Products: linux_kernel
Related CWEs: CWE-667
Related CAPECs: CAPEC-25, CAPEC-27, CAPEC-26
MITRE ATT&CK Techniques: T1499.004
MITRE ATT&CK Tactics: T1499
References: https://git.kernel.org/stable/c/34fdd9b7def9d2fcb71bb7b0bc4848dd7313767e, https://git.kernel.org/stable/c/36ee9ffca8ef56c302f2855c4a5fccf61c0c1ada, https://git.kernel.org/stable/c/593b595332bd2d65e1a5c1ae7897996c157f5468
CWE: CWE-667
MITRE ATT&CK techniques: T1499.004
MITRE ATT&CK tactics: T1499
CVE-2022-2187
The Contact Form 7 Captcha WordPress plugin before 0.1.2 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers
CVSS v3.1 Score: 6.1 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: contact_form_7_captcha
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://wpscan.com/vulnerability/4fd2f1ef-39c6-4425-8b4d-1a332dabac8d, https://wpscan.com/vulnerability/4fd2f1ef-39c6-4425-8b4d-1a332dabac8d
CWE: CWE-79
CVE-2022-25074
TP-Link TL-WR902AC(US)_V3_191209 routers were discovered to contain a stack overflow in the function DM_ Fillobjbystr(). This vulnerability allows unauthenticated attackers to execute arbitrary code.
CVSS v3.1 Score: 9.8 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 10.0 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected Products: tl-wr902ac, tl-wr902ac_firmware
Related CWEs: CWE-787
References: https://github.com/EPhaha/IOT_vuln/tree/main/TP-Link/TL-WR902AC, https://github.com/EPhaha/IOT_vuln/tree/main/TP-Link/TL-WR902AC
CWE: CWE-787
CVE-2022-44957
webtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /clients/listclients.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.
CVSS v3.1 Score: 5.4 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected Products: webtareas
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: http://webtareas.com, https://github.com/anhdq201/webtareas/issues/11, http://webtareas.com
CWE: CWE-79
CVE-2022-24711
CodeIgniter4 is the 4.x branch of CodeIgniter, a PHP full-stack web framework. Prior to version 4.1.9, an improper input validation vulnerability allows attackers to execute CLI routes via HTTP request. Version 4.1.9 contains a patch. There are currently no known workarounds for this vulnerability.
CVSS v3.1 Score: 9.4 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: codeigniter
Related CWEs: CWE-20
Related CAPECs: CAPEC-31, CAPEC-53, CAPEC-261
MITRE ATT&CK Techniques: T1574.006, T1553.002, T1574.007
MITRE ATT&CK Tactics: T1562, T1574, T1553
References: https://github.com/codeigniter4/CodeIgniter4/commit/202f41ad522ba1d414b9d9c35aba1cb0c156b781, https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-xjp4-6w75-qrj7, https://github.com/codeigniter4/CodeIgniter4/commit/202f41ad522ba1d414b9d9c35aba1cb0c156b781
CWE: CWE-20
MITRE ATT&CK techniques: T1574.006, T1553.002, T1574.007, T1539, T1036.001, T1562.003, T1027
MITRE ATT&CK tactics: T1562, T1574, T1553, T1036
CVE-2022-42743
deep-parse-json version 1.0.2 allows an external attacker to edit or add new properties to an object. This is possible because the application does not correctly validate the incoming JSON keys, thus allowing the '__proto__' property to be edited.
CVSS v3.1 Score: 5.3 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected Products: deep-parse-json
Related CWEs: CWE-1321
Related CAPECs: CAPEC-180, CAPEC-1, CAPEC-77
MITRE ATT&CK Techniques: T1574.010
MITRE ATT&CK Tactics: T1574
References: https://fluidattacks.com/advisories/buuren/, https://github.com/sibu-github/deep-parse-json, https://fluidattacks.com/advisories/buuren/
CWE: CWE-1321
MITRE ATT&CK techniques: T1574.010
MITRE ATT&CK tactics: T1574
CVE-2022-42271
NVIDIA BMC contains a vulnerability in IPMI handler, where an authorized attacker can cause a buffer overflow and cause a denial of service or gain code execution
CVSS v3.1 Score: 8.4 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products: dgx_a100_firmware, dgx_a100
Related CWEs: CWE-120
Related CAPECs: CAPEC-14, CAPEC-92, CAPEC-45
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5435, https://nvidia.custhelp.com/app/answers/detail/a_id/5435
CWE: CWE-120
CVE-2022-24814
Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 9.7.0, unauthorized JavaScript (JS) can be executed by inserting an iframe into the rich text html interface that links to a file uploaded HTML file that loads another uploaded JS file in its script tag. This satisfies the regular content security policy header, which in turn allows the file to run any arbitrary JS. This issue was resolved in version 9.7.0. As a workaround, disable the live embed in the what-you-see-is-what-you-get by adding `{ "media_live_embeds": false }` to the _Options Overrides_ option of the Rich Text HTML interface.
CVSS v3.1 Score: 8.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: directus
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://github.com/directus/directus/pull/12020, https://github.com/directus/directus/releases/tag/v9.7.0, https://github.com/directus/directus/security/advisories/GHSA-xmjj-3c76-5w84
CWE: CWE-79
CVE-2022-50428
In the Linux kernel, the following vulnerability has been resolved:

ext4: fix off-by-one errors in fast-commit block filling

Due to several different off-by-one errors, or perhaps due to a late
change in design that wasn't fully reflected in the code that was
actually merged, there are several very strange constraints on how
fast-commit blocks are filled with tlv entries:

- tlvs must start at least 10 bytes before the end of the block, even
  though the minimum tlv length is 8.  Otherwise, the replay code will
  ignore them.  (BUG: ext4_fc_reserve_space() could violate this
  requirement if called with a len of blocksize - 9 or blocksize - 8.
  Fortunately, this doesn't seem to happen currently.)

- tlvs must end at least 1 byte before the end of the block.  Otherwise
  the replay code will consider them to be invalid.  This quirk
  contributed to a bug (fixed by an earlier commit) where uninitialized
  memory was being leaked to disk in the last byte of blocks.

Also, strangely these constraints don't apply to the replay code in
e2fsprogs, which will accept any tlvs in the blocks (with no bounds
checks at all, but that is a separate issue...).

Given that this all seems to be a bug, let's fix it by just filling
blocks with tlv entries in the natural way.

Note that old kernels will be unable to replay fast-commit journals
created by kernels that have this commit.
CVSS v3.1 Score: 5.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected Products: linux_kernel
Related CWEs: CWE-193
References: https://git.kernel.org/stable/c/18f28f13301d1afb8cea9c4ddcecdbff14488ec6, https://git.kernel.org/stable/c/48a6a66db82b8043d298a630f22c62d43550cae5, https://git.kernel.org/stable/c/5439ad45c0d0c8db41eb6f4dce6f778f15a5ee16
CWE: CWE-193
CVE-2022-50324
In the Linux kernel, the following vulnerability has been resolved:

mtd: maps: pxa2xx-flash: fix memory leak in probe

Free 'info' upon remapping error to avoid a memory leak.

[<miquel.raynal@bootlin.com>: Reword the commit log]
CVSS v3.1 Score: 5.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected Products: linux_kernel
Related CWEs: CWE-401
References: https://git.kernel.org/stable/c/1d0c2b762dad2b8dd166e17c0e90b88b86a3284f, https://git.kernel.org/stable/c/2399401feee27c639addc5b7e6ba519d3ca341bf, https://git.kernel.org/stable/c/6fa9550ef3e13d7e9b2d4db6dd57292ccd072a90
CWE: CWE-401
CVE-2022-0889
The Ninja Forms - File Uploads Extension WordPress plugin is vulnerable to reflected cross-site scripting due to missing sanitization of the files filename parameter found in the ~/includes/ajax/controllers/uploads.php file which can be used by unauthenticated attackers to add malicious web scripts to vulnerable WordPress sites, in versions up to and including 3.3.12.
CVSS v3.1 Score: 7.2 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: ninja_forms_file_uploads
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://ninjaforms.com/extensions/file-uploads/?changelog=1/#:~:text=3.3.13%20(30%20November%202021), https://www.wordfence.com/threat-intel/vulnerabilities/id/8c5642fa-d001-47c4-8acd-94ae944e5129?source=cve, https://ninjaforms.com/extensions/file-uploads/?changelog=1/#:~:text=3.3.13%20(30%20November%202021)
CWE: CWE-79
CVE-2022-42449
Unsafe default file type filter policy in HCL Domino Volt allows upload of .html file and execution of unsafe JavaScript in deployed applications
CVSS v3.1 Score: 4.6 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Affected Products: domino_leap
Related CWEs: CWE-434
Related CAPECs: CAPEC-1
MITRE ATT&CK Techniques: T1574.010
MITRE ATT&CK Tactics: T1574
References: https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0120722
CWE: CWE-434
MITRE ATT&CK techniques: T1574.010
MITRE ATT&CK tactics: T1574
CVE-2022-25837
Bluetooth® Pairing in Bluetooth Core Specification v1.0B through v5.3 may permit an unauthenticated MITM to acquire credentials with two pairing devices via adjacent access when at least one device supports BR/EDR Secure Connections pairing and the other BR/EDR Legacy PIN code pairing if the MITM negotiates BR/EDR Secure Simple Pairing in Secure Connections mode using the Passkey association model with the pairing Initiator and BR/EDR Legacy PIN code pairing with the pairing Responder and brute forces the Passkey entered by the user into the Responder as a 6-digit PIN code. The MITM attacker can use the identified PIN code value as the Passkey value to complete authentication with the Initiator via Bluetooth pairing method confusion.
CVSS v3.1 Score: 7.5 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N
Affected Products: bluetooth_core_specification
Related CWEs: CWE-294
Related CAPECs: CAPEC-644, CAPEC-701, CAPEC-561
MITRE ATT&CK Techniques: T1550.003, T1550.004, T1021.002
MITRE ATT&CK Tactics: T1134, T1114, T1550
References: https://www.bluetooth.com/learn-about-bluetooth/key-attributes/bluetooth-security/reporting-security/, https://www.bluetooth.com/learn-about-bluetooth/key-attributes/bluetooth-security/reporting-security/
CWE: CWE-294
MITRE ATT&CK techniques: T1550.003, T1550.004, T1021.002, T1557, T1133, T1134.001, T1114.002, T1558.003, T1558, T1021, T1550.002
MITRE ATT&CK tactics: T1134, T1114, T1550, T1558, T1021
CVE-2022-2997
Session Fixation in GitHub repository snipe/snipe-it prior to 6.0.10.
CVSS v3.1 Score: 8.0 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Affected Products: snipe-it
Related CWEs: CWE-384
Related CAPECs: CAPEC-31, CAPEC-21, CAPEC-59
MITRE ATT&CK Techniques: T1134, T1539, T1550.004
MITRE ATT&CK Tactics: T1134, T1550
References: https://github.com/snipe/snipe-it/commit/6fde72a69335c80079363b7d26aa94e7f67400e1, https://huntr.dev/bounties/c09bf21b-50d2-49f0-8c92-49f6b3c358d8, https://github.com/snipe/snipe-it/commit/6fde72a69335c80079363b7d26aa94e7f67400e1
CWE: CWE-384
MITRE ATT&CK techniques: T1134, T1539, T1550.004, T1134.003, T1134.001, T1134.002, T1606, T1528
MITRE ATT&CK tactics: T1134, T1550
CVE-2022-41032
NuGet Client Elevation of Privilege Vulnerability
CVSS v3.1 Score: 7.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Products: fedora, visual_studio_2019, .net_core, visual_studio_2022, .net
Related CWEs: CWE-269
Related CAPECs: CAPEC-122, CAPEC-233, CAPEC-58
MITRE ATT&CK Techniques: T1548
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41032, https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FOG35Z5RL5W5RGLLYLN46CI4D2UPDSWM/, https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HDPT2MJC3HD7HYZGASOOX6MTDR4ASBL5/
CWE: CWE-269
MITRE ATT&CK techniques: T1548