DuyTa/cve-kgrag-db huggingface dataset:
CVE-2022-24926
Improper input validation vulnerability in SmartTagPlugin prior to version 1.2.15-6 allows privileged attackers to trigger a XSS on a victim's devices.
CVSS v3.1 Score: 5.7 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v2.0 Score: 3.5 (LOW)
CVSS v2.0 Vector: AV:N/AC:M/Au:S/C:N/I:P/A:N
Affected Products: smarttagplugin
Related CWEs: CWE-20, CWE-79
Related CAPECs: CAPEC-31, CAPEC-53, CAPEC-261
MITRE ATT&CK Techniques: T1574.006, T1553.002, T1574.007
MITRE ATT&CK Tactics: T1562, T1574, T1553
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=2, https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=2
CWE: CWE-20, CWE-79
MITRE ATT&CK techniques: T1574.006, T1553.002, T1574.007, T1539, T1036.001, T1562.003, T1027
MITRE ATT&CK tactics: T1562, T1574, T1553, T1036
CVE-2022-34260
Adobe Illustrator versions 26.3.1 (and earlier) and 25.4.6 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS v3.1 Score: 7.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected Products: windows, illustrator, macos
Related CWEs: CWE-787
References: https://helpx.adobe.com/security/products/illustrator/apsb22-41.html, https://helpx.adobe.com/security/products/illustrator/apsb22-41.html
CWE: CWE-787
CVE-2022-3822
The Donations via PayPal WordPress plugin before 1.9.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS v3.1 Score: 4.8 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Affected Products: donations_via_paypal
References: https://wpscan.com/vulnerability/48ec2e4a-0190-4f36-afd1-d5799ba28c13, https://wpscan.com/vulnerability/48ec2e4a-0190-4f36-afd1-d5799ba28c13
CVE-2022-34175
Jenkins 2.335 through 2.355 (both inclusive) allows attackers in some cases to bypass a protection mechanism, thereby directly accessing some view fragments containing sensitive information, bypassing any permission checks in the corresponding view.
CVSS v3.1 Score: 7.5 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: jenkins
References: https://www.jenkins.io/security/advisory/2022-06-22/#SECURITY-2777, https://www.jenkins.io/security/advisory/2022-06-22/#SECURITY-2777
CVE-2022-4931
The BackupWordPress plugin for WordPress is vulnerable to information disclosure in versions up to, and including 3.12. This is due to missing authorization on the heartbeat_received() function that triggers on WordPress heartbeat. This makes it possible for authenticated attackers, with subscriber-level permissions and above to retrieve back-up paths that can subsequently be used to download the back-up.
CVSS v3.1 Score: 4.3 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected Products: backupwordpress
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2683799%40backupwordpress&new=2683799%40backupwordpress&sfp_email=&sfph_mail=, https://www.wordfence.com/threat-intel/vulnerabilities/id/747c86f4-118b-4a9c-899c-e9067d2c7a02, https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2683799%40backupwordpress&new=2683799%40backupwordpress&sfp_email=&sfph_mail=
CVE-2022-23940
SuiteCRM through 7.12.1 and 8.x through 8.0.1 allows Remote Code Execution. Authenticated users with access to the Scheduled Reports module can achieve this by leveraging PHP deserialization in the email_recipients property. By using a crafted request, they can create a malicious report, containing a PHP-deserialization payload in the email_recipients field. Once someone accesses this report, the backend will deserialize the content of the email_recipients field and the payload gets executed. Project dependencies include a number of interesting PHP deserialization gadgets (e.g., Monolog/RCE1 from phpggc) that can be used for Code Execution.
CVSS v3.1 Score: 8.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 6.5 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P
Affected Products: suitecrm
Related CWEs: CWE-502
Related CAPECs: CAPEC-586
References: https://docs.suitecrm.com/8.x/admin/releases/8.0/, https://github.com/manuelz120, https://docs.suitecrm.com/8.x/admin/releases/8.0/
CWE: CWE-502
CVE-2022-50350
In the Linux kernel, the following vulnerability has been resolved:

scsi: target: iscsi: Fix a race condition between login_work and the login thread

In case a malicious initiator sends some random data immediately after a
login PDU; the iscsi_target_sk_data_ready() callback will schedule the
login_work and, at the same time, the negotiation may end without clearing
the LOGIN_FLAGS_INITIAL_PDU flag (because no additional PDU exchanges are
required to complete the login).

The login has been completed but the login_work function will find the
LOGIN_FLAGS_INITIAL_PDU flag set and will never stop from rescheduling
itself; at this point, if the initiator drops the connection, the
iscsit_conn structure will be freed, login_work will dereference a released
socket structure and the kernel crashes.

BUG: kernel NULL pointer dereference, address: 0000000000000230
PF: supervisor write access in kernel mode
PF: error_code(0x0002) - not-present page
Workqueue: events iscsi_target_do_login_rx [iscsi_target_mod]
RIP: 0010:_raw_read_lock_bh+0x15/0x30
Call trace:
 iscsi_target_do_login_rx+0x75/0x3f0 [iscsi_target_mod]
 process_one_work+0x1e8/0x3c0

Fix this bug by forcing login_work to stop after the login has been
completed and the socket callbacks have been restored.

Add a comment to clearify the return values of iscsi_target_do_login()
CVSS v3.1 Score: 4.7 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected Products: linux_kernel
Related CWEs: CWE-362
Related CAPECs: CAPEC-29, CAPEC-26
References: https://git.kernel.org/stable/c/1533b8b3058db618409f41554ebe768c2e3acfae, https://git.kernel.org/stable/c/3ecdca49ca49d4770639d81503c873b6d25887c4, https://git.kernel.org/stable/c/fec1b2fa62c162d03f5dcd7b03e3c89d3116d49f
CWE: CWE-362
CVE-2022-49962
In the Linux kernel, the following vulnerability has been resolved:

xhci: Fix null pointer dereference in remove if xHC has only one roothub

The remove path in xhci platform driver tries to remove and put both main
and shared hcds even if only a main hcd exists (one roothub)

This causes a null pointer dereference in reboot for those controllers.

Check that the shared_hcd exists before trying to remove it.
CVSS v3.1 Score: 5.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected Products: linux_kernel
Related CWEs: CWE-476
References: https://git.kernel.org/stable/c/4a593a62a9e3a25ab4bc37f612e4edec144f7f43, https://git.kernel.org/stable/c/7081b2f34ff291ada012bd6abacaf7d51c4cf73f
CWE: CWE-476
CVE-2022-50628
In the Linux kernel, the following vulnerability has been resolved:

drm/gud: Fix UBSAN warning

UBSAN complains about invalid value for bool:

[  101.165172] [drm] Initialized gud 1.0.0 20200422 for 2-3.2:1.0 on minor 1
[  101.213360] gud 2-3.2:1.0: [drm] fb1: guddrmfb frame buffer device
[  101.213426] usbcore: registered new interface driver gud
[  101.989431] ================================================================================
[  101.989441] UBSAN: invalid-load in linux/include/linux/iosys-map.h:253:9
[  101.989447] load of value 121 is not a valid value for type '_Bool'
[  101.989451] CPU: 1 PID: 455 Comm: kworker/1:6 Not tainted 5.18.0-rc5-gud-5.18-rc5 #3
[  101.989456] Hardware name: Hewlett-Packard HP EliteBook 820 G1/1991, BIOS L71 Ver. 01.44 04/12/2018
[  101.989459] Workqueue: events_long gud_flush_work [gud]
[  101.989471] Call Trace:
[  101.989474]  <TASK>
[  101.989479]  dump_stack_lvl+0x49/0x5f
[  101.989488]  dump_stack+0x10/0x12
[  101.989493]  ubsan_epilogue+0x9/0x3b
[  101.989498]  __ubsan_handle_load_invalid_value.cold+0x44/0x49
[  101.989504]  dma_buf_vmap.cold+0x38/0x3d
[  101.989511]  ? find_busiest_group+0x48/0x300
[  101.989520]  drm_gem_shmem_vmap+0x76/0x1b0 [drm_shmem_helper]
[  101.989528]  drm_gem_shmem_object_vmap+0x9/0xb [drm_shmem_helper]
[  101.989535]  drm_gem_vmap+0x26/0x60 [drm]
[  101.989594]  drm_gem_fb_vmap+0x47/0x150 [drm_kms_helper]
[  101.989630]  gud_prep_flush+0xc1/0x710 [gud]
[  101.989639]  ? _raw_spin_lock+0x17/0x40
[  101.989648]  gud_flush_work+0x1e0/0x430 [gud]
[  101.989653]  ? __switch_to+0x11d/0x470
[  101.989664]  process_one_work+0x21f/0x3f0
[  101.989673]  worker_thread+0x200/0x3e0
[  101.989679]  ? rescuer_thread+0x390/0x390
[  101.989684]  kthread+0xfd/0x130
[  101.989690]  ? kthread_complete_and_exit+0x20/0x20
[  101.989696]  ret_from_fork+0x22/0x30
[  101.989706]  </TASK>
[  101.989708] ================================================================================

The source of this warning is in iosys_map_clear() called from
dma_buf_vmap(). It conditionally sets values based on map->is_iomem. The
iosys_map variables are allocated uninitialized on the stack leading to
->is_iomem having all kinds of values and not only 0/1.

Fix this by zeroing the iosys_map variables.
References: https://git.kernel.org/stable/c/832f861a46039d50536dcfda0a9fb334b48d0f8b, https://git.kernel.org/stable/c/951df98024f7272f85df5044eca7374f5b5b24ef, https://git.kernel.org/stable/c/e1078b270d218f8d58efb4d78ea25a4d16ba3490
CVE-2022-28026
Student Grading System v1.0 was discovered to contain a SQL injection vulnerability via /student-grading-system/rms.php?page=student_p&id=.
CVSS v3.1 Score: 9.8 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: student_grading_system
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/Student-Grading-System/SQLi-3.md, https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/Student-Grading-System/SQLi-3.md
CWE: CWE-89
CVE-2022-49200
In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: btmtksdio: Fix kernel oops in btmtksdio_interrupt

Fix the following kernel oops in btmtksdio_interrrupt

[   14.339134]  btmtksdio_interrupt+0x28/0x54
[   14.339139]  process_sdio_pending_irqs+0x68/0x1a0
[   14.339144]  sdio_irq_work+0x40/0x70
[   14.339154]  process_one_work+0x184/0x39c
[   14.339160]  worker_thread+0x228/0x3e8
[   14.339168]  kthread+0x148/0x3ac
[   14.339176]  ret_from_fork+0x10/0x30

That happened because hdev->power_on is already called before
sdio_set_drvdata which btmtksdio_interrupt handler relies on is not
properly set up.

The details are shown as the below: hci_register_dev would run
queue_work(hdev->req_workqueue, &hdev->power_on) as WQ_HIGHPRI
workqueue_struct to complete the power-on sequeunce and thus hci_power_on
may run before sdio_set_drvdata is done in btmtksdio_probe.

The hci_dev_do_open in hci_power_on would initialize the device and enable
the interrupt and thus it is possible that btmtksdio_interrupt is being
called right before sdio_set_drvdata is filled out.

When btmtksdio_interrupt is being called and sdio_set_drvdata is not filled
, the kernel oops is going to happen because btmtksdio_interrupt access an
uninitialized pointer.
CVSS v3.1 Score: 5.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected Products: linux_kernel
Related CWEs: CWE-908
References: https://git.kernel.org/stable/c/4d3d1f2c35a19988d3c5f0ee86038b525e830840, https://git.kernel.org/stable/c/6d7be5afbb41c918d2f12f857f8c7efa50500be2, https://git.kernel.org/stable/c/70a6cf749d9ff9f463490248322e5343199bc267
CWE: CWE-908
CVE-2022-24949
A privilege escalation to root exists in Eternal Terminal prior to version 6.2.0. This is due to the combination of a race condition, buffer overflow, and logic bug all in PipeSocketHandler::listen().
CVSS v3.1 Score: 7.5 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Products: eternal_terminal
Related CWEs: CWE-362, CWE-120
Related CAPECs: CAPEC-14, CAPEC-92, CAPEC-45
References: https://github.com/MisterTea/EternalTerminal/commit/900348bb8bc96e1c7ba4888ac8480f643c43d3c3, https://github.com/metaredteam/external-disclosures/security/advisories/GHSA-hxg8-4r3q-p9rv, https://github.com/MisterTea/EternalTerminal/commit/900348bb8bc96e1c7ba4888ac8480f643c43d3c3
CWE: CWE-362, CWE-120
CVE-2022-31153
OpenZeppelin Contracts for Cairo is a library for contract development written in Cairo for StarkNet, a decentralized ZK Rollup. Version 0.2.0 is vulnerable to an error that renders account contracts unusable on live networks. This issue affects all accounts (vanilla and ethereum flavors) in the v0.2.0 release of OpenZeppelin Contracts for Cairo, which are not whitelisted on StarkNet mainnet. Only goerli deployments of v0.2.0 accounts are affected. This faulty behavior is not observed in StarkNet's testing framework. This bug has been patched in v0.2.1.
CVSS v3.1 Score: 6.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected Products: contracts
Related CWEs: CWE-664, CWE-863
Related CAPECs: CAPEC-21, CAPEC-61, CAPEC-60
MITRE ATT&CK Techniques: T1134, T1539, T1550.004
MITRE ATT&CK Tactics: T1134, T1550
References: https://github.com/OpenZeppelin/cairo-contracts/blob/release-0.2.0/src/openzeppelin/account/library.cairo#L203, https://github.com/OpenZeppelin/cairo-contracts/commit/2cd60279c3332285d47edf9ee3888b71257acdc9, https://github.com/OpenZeppelin/cairo-contracts/issues/386
CWE: CWE-664, CWE-863
MITRE ATT&CK techniques: T1134, T1539, T1550.004, T1134.003, T1134.001, T1134.002, T1606, T1528
MITRE ATT&CK tactics: T1134, T1550
CVE-2022-34687
Azure RTOS GUIX Studio Remote Code Execution Vulnerability
CVSS v3.1 Score: 7.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected Products: azure_real_time_operating_system_guix_studio
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-34687, https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-34687
CVE-2022-40942
Tenda TX3 US_TX3V1.0br_V16.03.13.11 is vulnerable to stack overflow via compare_parentcontrol_time.
CVSS v3.1 Score: 9.8 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products: tx3, tx3_firmware
Related CWEs: CWE-787
References: https://github.com/Rumble0x0/vulnerability/blob/main/tenda/TX3/stack%20overflow%20via%20compare_parentcontrol_time.pdf, https://github.com/Rumble0x0/vulnerability/blob/main/tenda/TX3/stack%20overflow%20via%20compare_parentcontrol_time.pdf
CWE: CWE-787
CVE-2022-48252
The jokob-sk/Pi.Alert fork (before 22.12.20) of Pi.Alert allows Remote Code Execution via nmap_scan.php (scan parameter) OS Command Injection.
CVSS v3.1 Score: 9.8 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products: pi.alert
Related CWEs: CWE-78
Related CAPECs: CAPEC-43, CAPEC-6, CAPEC-88
References: https://github.com/jokob-sk/Pi.Alert/security/advisories/GHSA-vhg3-f6gv-j89r, https://github.com/jokob-sk/Pi.Alert/security/advisories/GHSA-vhg3-f6gv-j89r
CWE: CWE-78
CVE-2022-50898
NanoCMS 0.4 contains an authenticated file upload vulnerability that allows remote code execution through unvalidated page content creation. Authenticated attackers can upload PHP files with arbitrary code to the server's pages directory by exploiting the page creation mechanism without proper input sanitization.
CVSS v3.1 Score: 8.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Products: nanocms
Related CWEs: CWE-434
Related CAPECs: CAPEC-1
MITRE ATT&CK Techniques: T1574.010
MITRE ATT&CK Tactics: T1574
References: https://github.com/ishell/Exploits-Archives/blob/master/2009-exploits/0904-exploits/nanocms-multi.txt, https://github.com/kalyan02/NanoCMS, https://www.exploit-db.com/exploits/50997
CWE: CWE-434
MITRE ATT&CK techniques: T1574.010
MITRE ATT&CK tactics: T1574
CVE-2022-45089
Improper Input Validation vulnerability in Group Arge Energy and Control Systems Smartpower Web allows SQL Injection.This issue affects Smartpower Web: before 23.01.01.


CVSS v3.1 Score: 8.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Products: smartpower_web
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: https://www.usom.gov.tr/bildirim/tr-23-0066, https://www.usom.gov.tr/bildirim/tr-23-0066
CWE: CWE-89
CVE-2022-36720
Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/modify1.php.
CVSS v3.1 Score: 8.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Products: library_management_system
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: https://github.com/k0xx11/bug_report/blob/main/vendors/kingbhob02/library-management-system/SQLi-13.md, https://github.com/k0xx11/bug_report/blob/main/vendors/kingbhob02/library-management-system/SQLi-13.md
CWE: CWE-89
CVE-2022-37398
A stack-based buffer overflow vulnerability was found inside ADM when using WebDAV due to the lack of data size validation. An attacker can exploit this vulnerability to run arbitrary code. Affected ADM versions include: 3.5.9.RUE3 and below, 4.0.5.RVI1 and below as well as 4.1.0.RJD1 and below.
CVSS v3.1 Score: 7.1 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H
Affected Products: adm
Related CWEs: CWE-121, CWE-787
References: https://www.asustor.com/security/security_advisory_detail?id=12, https://www.asustor.com/security/security_advisory_detail?id=12
CWE: CWE-121, CWE-787
CVE-2022-4223
The pgAdmin server includes an HTTP API that is intended to be used to validate the path a user selects to external PostgreSQL utilities such as pg_dump and pg_restore. The utility is executed by the server to determine what PostgreSQL version it is from. Versions of pgAdmin prior to 6.17 failed to properly secure this API, which could allow an unauthenticated user to call it with a path of their choosing, such as a UNC path to a server they control on a Windows machine. This would cause an appropriately named executable in the target path to be executed by the pgAdmin server.
CVSS v3.1 Score: 8.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected Products: pgadmin_4, fedora
Related CWEs: CWE-94, CWE-862
Related CAPECs: CAPEC-242, CAPEC-665, CAPEC-77
MITRE ATT&CK Techniques: T1556, T1027.006, T1564.009
MITRE ATT&CK Tactics: T1564, T1027, T1542
References: https://github.com/pgadmin-org/pgadmin4/issues/5593, https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R5EYTPKHVFSDCETBJI7LBZE4EYHBPN2Q/, https://github.com/pgadmin-org/pgadmin4/issues/5593
CWE: CWE-94, CWE-862
MITRE ATT&CK techniques: T1556, T1027.006, T1564.009, T1211, T1542.002, T1027.009
MITRE ATT&CK tactics: T1564, T1027, T1542
CVE-2022-22481
IBM Navigator for i 7.2, 7.3, and 7.4 (heritage version) could allow a remote attacker to obtain access to the web interface without valid credentials. By modifying the sign on request, an attacker can gain visibility to the fully qualified domain name of the target system and the navigator tasks page, however they do not gain the ability to perform those tasks on the system or see any specific system data. IBM X-Force ID: 225899.
CVSS v3.1 Score: 5.3 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: i
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/225899, https://www.ibm.com/support/pages/node/6583553, https://exchange.xforce.ibmcloud.com/vulnerabilities/225899
CVE-2022-20119
In private_handle_t of mali_gralloc_buffer.h, there is a possible information disclosure due to uninitialized data. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-213170715References: N/A
CVSS v3.1 Score: 5.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v2.0 Score: 2.1 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:P/I:N/A:N
Affected Products: android
Related CWEs: CWE-908
References: https://source.android.com/security/bulletin/pixel/2022-05-01, https://source.android.com/security/bulletin/pixel/2022-05-01
CWE: CWE-908
CVE-2022-4453
The 3D FlipBook WordPress plugin through 1.13.2 does not validate or escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks against high privilege users like administrators.
CVSS v3.1 Score: 5.4 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected Products: 3d_flipbook
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://wpscan.com/vulnerability/120bdcb3-4288-4101-b738-cc84d02da171, https://wpscan.com/vulnerability/120bdcb3-4288-4101-b738-cc84d02da171
CWE: CWE-79
CVE-2022-23880
An arbitrary file upload vulnerability in the File Management function module of taoCMS v3.0.2 allows attackers to execute arbitrary code via a crafted PHP file.
CVSS v3.1 Score: 9.8 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: taocms
Related CWEs: CWE-434
Related CAPECs: CAPEC-1
MITRE ATT&CK Techniques: T1574.010
MITRE ATT&CK Tactics: T1574
References: https://github.com/taogogo/taocms/issues/25, https://github.com/taogogo/taocms/issues/25
CWE: CWE-434
MITRE ATT&CK techniques: T1574.010
MITRE ATT&CK tactics: T1574
CVE-2022-4837
The CPO Companion WordPress plugin before 1.1.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
CVSS v3.1 Score: 5.4 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected Products: cpo_companion
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://wpscan.com/vulnerability/41abeacb-ef3e-4621-89bb-df0f2eb617da, https://wpscan.com/vulnerability/41abeacb-ef3e-4621-89bb-df0f2eb617da
CWE: CWE-79
CVE-2022-48904
In the Linux kernel, the following vulnerability has been resolved:

iommu/amd: Fix I/O page table memory leak

The current logic updates the I/O page table mode for the domain
before calling the logic to free memory used for the page table.
This results in IOMMU page table memory leak, and can be observed
when launching VM w/ pass-through devices.

Fix by freeing the memory used for page table before updating the mode.
CVSS v3.1 Score: 5.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected Products: linux_kernel
Related CWEs: CWE-401
References: https://git.kernel.org/stable/c/378e2fe1eb58d5c2ed55c8fe5e11f9db5033cdd6, https://git.kernel.org/stable/c/6b0b2d9a6a308bcd9300c2d83000a82812c56cea, https://git.kernel.org/stable/c/c78627f757e37c2cf386b59c700c4e1574988597
CWE: CWE-401
CVE-2022-20482
In createNotificationChannel of NotificationManager.java, there is a possible way to make the device unusable and require factory reset due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12 Android-12L Android-13Android ID: A-240422263
CVSS v3.1 Score: 5.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected Products: android
Related CWEs: CWE-400
Related CAPECs: CAPEC-147, CAPEC-492, CAPEC-227
MITRE ATT&CK Techniques: T1499
References: https://source.android.com/security/bulletin/2022-12-01, https://source.android.com/security/bulletin/2022-12-01
CWE: CWE-400
MITRE ATT&CK techniques: T1499
CVE-2022-23667
A authenticated remote command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8.9-HF2 and below, 6.7.x and below. Aruba has released updates to ClearPass Policy Manager that address this security vulnerability.
CVSS v3.1 Score: 7.2 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 6.5 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P
Affected Products: clearpass_policy_manager
Related CWEs: CWE-78
Related CAPECs: CAPEC-43, CAPEC-6, CAPEC-88
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-007.txt, https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-007.txt
CWE: CWE-78
CVE-2022-21244
Vulnerability in the Primavera Portfolio Management product of Oracle Construction and Engineering (component: Web Access). Supported versions that are affected are 18.0.0.0-18.0.3.0, 19.0.0.0-19.0.1.2, 20.0.0.0 and 20.0.0.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera Portfolio Management. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Primavera Portfolio Management accessible data. CVSS 3.1 Base Score 4.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N).
CVSS v3.1 Score: 4.3 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: primavera_portfolio_management
References: https://www.oracle.com/security-alerts/cpujan2022.html, https://www.oracle.com/security-alerts/cpujan2022.html
CVE-2022-23032
In all versions before 7.2.1.4, when proxy settings are configured in the network access resource of a BIG-IP APM system, connecting BIG-IP Edge Client on Mac and Windows is vulnerable to a DNS rebinding attack. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS v3.1 Score: 5.3 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: big-ip_access_policy_manager_client, big-ip_access_policy_manager
Related CWEs: CWE-346
Related CAPECs: CAPEC-388, CAPEC-142, CAPEC-160
MITRE ATT&CK Techniques: T1134, T1539, T1550.004
MITRE ATT&CK Tactics: T1134, T1584, T1550
References: https://support.f5.com/csp/article/K30525503, https://support.f5.com/csp/article/K30525503
CWE: CWE-346
MITRE ATT&CK techniques: T1134, T1539, T1550.004, T1557.002, T1134.001, T1584.002, T1528
MITRE ATT&CK tactics: T1134, T1584, T1550, T1557
CVE-2022-36842
A heap-based overflow vulnerability in prepareRecogLibrary function in libSDKRecognitionText.spensdk.samsung.so library prior to SMR Sep-2022 Release 1 allows attacker to cause memory access fault.
CVSS v3.1 Score: 4.4 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Affected Products: android
Related CWEs: CWE-787, CWE-122
Related CAPECs: CAPEC-92
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=09, https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=09
CWE: CWE-787, CWE-122
CVE-2022-25200
A cross-site request forgery (CSRF) vulnerability in Jenkins Checkmarx Plugin 2022.1.2 and earlier allows attackers to connect to an attacker-specified webserver using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
CVSS v3.1 Score: 8.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 6.8 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Affected Products: checkmarx
Related CWEs: CWE-352
Related CAPECs: CAPEC-467, CAPEC-111, CAPEC-462
References: http://www.openwall.com/lists/oss-security/2022/02/15/2, https://www.jenkins.io/security/advisory/2022-02-15/#SECURITY-1017, http://www.openwall.com/lists/oss-security/2022/02/15/2
CWE: CWE-352
CVE-2022-2304
Stack-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.
CVSS v3.1 Score: 7.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 6.8 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Affected Products: fedora, debian_linux, vim
Related CWEs: CWE-121, CWE-787
References: https://github.com/vim/vim/commit/54e5fed6d27b747ff152cdb6edfb72ff60e70939, https://huntr.dev/bounties/eb7402f3-025a-402f-97a7-c38700d9548a, https://lists.debian.org/debian-lts-announce/2022/11/msg00009.html
CWE: CWE-121, CWE-787
CVE-2022-37347
Trend Micro Security 2021 and 2022 (Consumer) is vulnerable to an Out-Of-Bounds Read Information Disclosure Vulnerability that could allow an attacker to read sensitive information from other memory locations and cause a crash on an affected machine. This vulnerability is similar to, but not the same as CVE-2022-35234.
CVSS v3.1 Score: 5.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected Products: windows, security
Related CWEs: CWE-125
Related CAPECs: CAPEC-540
References: https://helpcenter.trendmicro.com/en-us/article/tmka-11058, https://www.zerodayinitiative.com/advisories/ZDI-22-1176/, https://helpcenter.trendmicro.com/en-us/article/tmka-11058
CWE: CWE-125
CVE-2022-20315
In ActivityManager, there is a possible disclosure of installed packages due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-191058227
CVSS v3.1 Score: 3.3 (LOW)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected Products: android
Related CWEs: CWE-862
Related CAPECs: CAPEC-665
MITRE ATT&CK Techniques: T1211, T1556, T1542.002
MITRE ATT&CK Tactics: T1542
References: https://source.android.com/security/bulletin/android-13, https://source.android.com/security/bulletin/android-13
CWE: CWE-862
MITRE ATT&CK techniques: T1211, T1556, T1542.002
MITRE ATT&CK tactics: T1542
CVE-2022-26198
Notable v1.8.4 does not filter text editing, allowing attackers to execute arbitrary code via a crafted payload injected into the Title text field.
CVSS v3.1 Score: 9.8 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 7.5 (HIGH)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products: notable
References: https://github.com/notable/notable/issues/1595, https://github.com/notable/notable/issues/1595
CVE-2022-33711
Improper validation of integrity check vulnerability in Samsung USB Driver Windows Installer for Mobile Phones prior to version 1.7.56.0 allows local attackers to delete arbitrary directory using directory junction.
CVSS v3.1 Score: 5.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CVSS v2.0 Score: 2.1 (LOW)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:N/I:P/A:N
Affected Products: android_usb_driver
Related CWEs: CWE-354
Related CAPECs: CAPEC-75, CAPEC-145, CAPEC-463
References: https://security.samsungmobile.com/serviceWeb.smsb?year==2022&month=07, https://security.samsungmobile.com/serviceWeb.smsb?year==2022&month=07
CWE: CWE-354
CVE-2022-50526
In the Linux kernel, the following vulnerability has been resolved:

drm/msm/dp: fix memory corruption with too many bridges

Add the missing sanity check on the bridge counter to avoid corrupting
data beyond the fixed-sized bridge array in case there are ever more
than eight bridges.

Patchwork: https://patchwork.freedesktop.org/patch/502664/
CVSS v3.1 Score: 7.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Products: linux_kernel
Related CWEs: CWE-787
References: https://git.kernel.org/stable/c/74466e46e7543c7f74f1502181e9ba93f7521374, https://git.kernel.org/stable/c/b312fcab461bd9484c61409007a6fe059f9c2074
CWE: CWE-787
CVE-2022-30775
xpdf 4.04 allocates excessive memory when presented with crafted input. This can be triggered by (for example) sending a crafted PDF document to the pdftoppm binary. It is most easily reproduced with the DCMAKE_CXX_COMPILER=afl-clang-fast++ option.
CVSS v3.1 Score: 5.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P
Affected Products: xpdf
Related CWEs: CWE-770
Related CAPECs: CAPEC-493, CAPEC-488, CAPEC-489
MITRE ATT&CK Techniques: T1498.002, T1499, T1498.001
MITRE ATT&CK Tactics: T1498, T1499
References: https://forum.xpdfreader.com/viewtopic.php?f=3&t=42264, https://forum.xpdfreader.com/viewtopic.php?f=3&t=42264
CWE: CWE-770
MITRE ATT&CK techniques: T1498.002, T1499, T1498.001, T1499.001, T1499.002, T1499.003
MITRE ATT&CK tactics: T1498, T1499
CVE-2022-29138
Windows Clustered Shared Volume Elevation of Privilege Vulnerability
CVSS v3.1 Score: 7.0 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 6.9 (MEDIUM)
CVSS v2.0 Vector: AV:L/AC:M/Au:N/C:C/I:C/A:C
Affected Products: windows_server, windows_server_2012, windows_server_2019, windows_server_2022, windows_server_2016
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-29138, https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-29138
CVE-2022-40826
B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php or_having() function. Note: Multiple third parties have disputed this as not a valid vulnerability.
CVSS v3.1 Score: 9.8 (CRITICAL)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products: codeigniter
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: https://github.com/726232111/CodeIgniter3.1.13-SQL-Inject/blob/main/README.md, https://github.com/bcit-ci/CodeIgniter/issues/6161, https://github.com/726232111/CodeIgniter3.1.13-SQL-Inject/blob/main/README.md
CWE: CWE-89
CVE-2022-3961
The Directorist WordPress plugin before 7.4.4 does not prevent users with low privileges (like subscribers) from accessing sensitive system information.
CVSS v3.1 Score: 6.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected Products: directorist
Related CWEs: CWE-862
Related CAPECs: CAPEC-665
MITRE ATT&CK Techniques: T1211, T1556, T1542.002
MITRE ATT&CK Tactics: T1542
References: https://wpscan.com/vulnerability/6aad6454-de1b-4304-9c14-05e28d08b253, https://wpscan.com/vulnerability/6aad6454-de1b-4304-9c14-05e28d08b253
CWE: CWE-862
MITRE ATT&CK techniques: T1211, T1556, T1542.002
MITRE ATT&CK tactics: T1542
CVE-2022-20518
In query of MmsSmsProvider.java, there is a possible access to restricted tables due to SQL injection. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-224770203
CVSS v3.1 Score: 5.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected Products: android
Related CWEs: CWE-89
Related CAPECs: CAPEC-7, CAPEC-470, CAPEC-108
References: https://source.android.com/security/bulletin/pixel/2022-12-01, https://source.android.com/security/bulletin/pixel/2022-12-01
CWE: CWE-89
CVE-2022-29618
Due to insufficient input validation, SAP NetWeaver Development Infrastructure (Design Time Repository) - versions 7.30, 7.31, 7.40, 7.50, allows an unauthenticated attacker to inject script into the URL and execute code in the user’s browser. On successful exploitation, an attacker can view or modify information causing a limited impact on confidentiality and integrity of the application.
CVSS v3.1 Score: 6.1 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: netweaver_development_infrastructure
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://launchpad.support.sap.com/#/notes/3197927, https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html, https://launchpad.support.sap.com/#/notes/3197927
CWE: CWE-79
CVE-2022-0898
The IgniteUp WordPress plugin through 3.4.1 does not sanitise and escape some fields when high privilege users don't have the unfiltered_html capability, which could lead to Stored Cross-Site Scripting issues
CVSS v3.1 Score: 5.4 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS v2.0 Score: 3.5 (LOW)
CVSS v2.0 Vector: AV:N/AC:M/Au:S/C:N/I:P/A:N
Affected Products: igniteup
Related CWEs: CWE-79
Related CAPECs: CAPEC-209, CAPEC-591, CAPEC-592
References: https://wpscan.com/vulnerability/f51d8345-3927-4be2-8145-e201371c8c43, https://wpscan.com/vulnerability/f51d8345-3927-4be2-8145-e201371c8c43
CWE: CWE-79
CVE-2022-25104
HorizontCMS v1.0.0-beta.2 was discovered to contain an arbitrary file download vulnerability via the component /admin/file-manager/.
CVSS v3.1 Score: 7.5 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v2.0 Score: 5.0 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected Products: horizontcms
Related CWEs: CWE-552
Related CAPECs: CAPEC-150, CAPEC-639
MITRE ATT&CK Techniques: T1552.006, T1602, T1555
MITRE ATT&CK Tactics: T1552
References: https://github.com/ttimot24/HorizontCMS/issues/43, https://github.com/ttimot24/HorizontCMS/issues/43
CWE: CWE-552
MITRE ATT&CK techniques: T1552.006, T1602, T1555, T1213, T1039, T1119, T1552.001, T1003, T1530, T1552.004, T1552.003
MITRE ATT&CK tactics: T1552
CVE-2022-21882
Win32k Elevation of Privilege Vulnerability
CVSS v3.1 Score: 7.0 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: windows_10_1809, windows_11_21h2, windows_10_1909, windows_10_21h1, windows_10_20h2
Related CWEs: CWE-787
WARNING: This vulnerability is in CISA's Known Exploited Vulnerabilities (KEV) catalog
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21882, http://packetstormsecurity.com/files/166169/Win32k-ConsoleControl-Offset-Confusion-Privilege-Escalation.html, https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21882
CWE: CWE-787
CVE-2022-37144
The PlexTrac platform prior to API version 1.17.0 does not restrict excessive MFA TOTP submission attempts. An unauthenticated remote attacker in possession of a valid username and password can bruteforce their way past MFA protections to login as the targeted user.
CVSS v3.1 Score: 8.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Products: plextrac
Related CWEs: CWE-307
Related CAPECs: CAPEC-560, CAPEC-653, CAPEC-600
MITRE ATT&CK Techniques: T1110.004, T1110.001, T1558
MITRE ATT&CK Tactics: T1110
References: http://plextrac.com, https://www.controlgap.com/blog/a-plextrac-story, http://plextrac.com
CWE: CWE-307
MITRE ATT&CK techniques: T1110.004, T1110.001, T1558, T1110.003, T1078
MITRE ATT&CK tactics: T1110
CVE-2022-32766
Improper input validation for some Intel(R) BIOS firmware may allow a privileged user to potentially enable escalation of privilege via local access.
CVSS v3.1 Score: 7.2 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N
Affected Products: compute_stick_stk2mv64cc_firmware, compute_stick_stk2mv64cc
Related CWEs: CWE-20
Related CAPECs: CAPEC-31, CAPEC-53, CAPEC-261
MITRE ATT&CK Techniques: T1574.006, T1553.002, T1574.007
MITRE ATT&CK Tactics: T1562, T1574, T1553
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00777.html, https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00777.html
CWE: CWE-20
MITRE ATT&CK techniques: T1574.006, T1553.002, T1574.007, T1539, T1036.001, T1562.003, T1027
MITRE ATT&CK tactics: T1562, T1574, T1553, T1036
CVE-2022-20481
In multiple files, there is a possible way to preserve WiFi settings due to residual data after a reset. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-241927115
CVSS v3.1 Score: 5.5 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected Products: android
References: https://source.android.com/security/bulletin/2023-02-01, https://source.android.com/security/bulletin/2023-02-01
CVE-2022-1434
The OpenSSL 3.0 implementation of the RC4-MD5 ciphersuite incorrectly uses the AAD data as the MAC key. This makes the MAC key trivially predictable. An attacker could exploit this issue by performing a man-in-the-middle attack to modify data being sent from one endpoint to an OpenSSL 3.0 recipient such that the modified data would still pass the MAC integrity check. Note that data sent from an OpenSSL 3.0 endpoint to a non-OpenSSL 3.0 endpoint will always be rejected by the recipient and the connection will fail at that point. Many application protocols require data to be sent from the client to the server first. Therefore, in such a case, only an OpenSSL 3.0 server would be impacted when talking to a non-OpenSSL 3.0 client. If both endpoints are OpenSSL 3.0 then the attacker could modify data being sent in both directions. In this case both clients and servers could be affected, regardless of the application protocol. Note that in the absence of an attacker this bug means that an OpenSSL 3.0 endpoint communicating with a non-OpenSSL 3.0 endpoint will fail to complete the handshake when using this ciphersuite. The confidentiality of data is not impacted by this issue, i.e. an attacker cannot decrypt data that has been encrypted using this ciphersuite - they can only modify it. In order for this attack to work both endpoints must legitimately negotiate the RC4-MD5 ciphersuite. This ciphersuite is not compiled by default in OpenSSL 3.0, and is not available within the default provider or the default ciphersuite list. This ciphersuite will never be used if TLSv1.3 has been negotiated. In order for an OpenSSL 3.0 endpoint to use this ciphersuite the following must have occurred: 1) OpenSSL must have been compiled with the (non-default) compile time option enable-weak-ssl-ciphers 2) OpenSSL must have had the legacy provider explicitly loaded (either through application code or via configuration) 3) The ciphersuite must have been explicitly added to the ciphersuite list 4) The libssl security level must have been set to 0 (default is 1) 5) A version of SSL/TLS below TLSv1.3 must have been negotiated 6) Both endpoints must negotiate the RC4-MD5 ciphersuite in preference to any others that both endpoints have in common Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2).
CVSS v3.1 Score: 5.9 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS v2.0 Score: 4.3 (MEDIUM)
CVSS v2.0 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Affected Products: aff_a400, openssl, h500e_firmware, fabric-attached_storage_a400, fabric-attached_storage_a400_firmware
Related CWEs: CWE-327
Related CAPECs: CAPEC-614, CAPEC-97, CAPEC-459
MITRE ATT&CK Techniques: T1553.002, T1036.001
MITRE ATT&CK Tactics: T1553, T1036
References: https://cert-portal.siemens.com/productcert/pdf/ssa-953464.pdf, https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=7d56a74a96828985db7354a55227a511615f732b, https://security.netapp.com/advisory/ntap-20220602-0009/
CWE: CWE-327
MITRE ATT&CK techniques: T1553.002, T1036.001
MITRE ATT&CK tactics: T1553, T1036
CVE-2022-26845
Improper authentication in firmware for Intel(R) AMT before versions 11.8.93, 11.22.93, 11.12.93, 12.0.92, 14.1.67, 15.0.42, 16.1.25 may allow an unauthenticated user to potentially enable escalation of privilege via network access.
CVSS v3.1 Score: 8.7 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
Affected Products: active_management_technology_firmware
Related CWEs: CWE-287
Related CAPECs: CAPEC-151, CAPEC-94, CAPEC-593
MITRE ATT&CK Techniques: T1134, T1550.001, T1557
MITRE ATT&CK Tactics: T1550, T1505
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00610.html, https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00610.html
CWE: CWE-287
MITRE ATT&CK techniques: T1134, T1550.001, T1557, T1185, T1505.003, T1548, T1563, T1040
MITRE ATT&CK tactics: T1550, T1505
CVE-2022-44789
A logical issue in O_getOwnPropertyDescriptor() in Artifex MuJS 1.0.0 through 1.3.x before 1.3.2 allows an attacker to achieve Remote Code Execution through memory corruption, via the loading of a crafted JavaScript file.
CVSS v3.1 Score: 8.8 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected Products: debian_linux, mujs, fedora
Related CWEs: CWE-787
References: https://github.com/alalng/CVE-2022-44789/blob/main/PublicReferenceURL.txt, https://github.com/ccxvii/mujs/commit/edb50ad66f7601ca9a3544a0e9045e8a8c60561f, https://github.com/ccxvii/mujs/releases/tag/1.3.2
CWE: CWE-787
CVE-2022-27836
Improper access control and path traversal vulnerability in Storage Manager and Storage Manager Service prior to SMR Apr-2022 Release 1 allow local attackers to access arbitrary system files without a proper permission. The patch adds proper validation logic to prevent arbitrary files access.
CVSS v3.1 Score: 8.4 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0 Score: 7.2 (HIGH)
CVSS v2.0 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Affected Products: android
Related CWEs: CWE-284, CWE-863, CWE-22
Related CAPECs: CAPEC-536, CAPEC-578, CAPEC-126
MITRE ATT&CK Techniques: T1014, T1562.001, T1543.003
MITRE ATT&CK Tactics: T1556, T1546, T1547
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=4, https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=4
CWE: CWE-284, CWE-863, CWE-22
MITRE ATT&CK techniques: T1014, T1562.001, T1543.003, T1546.008, T1037, T1562.007, T1027.009, T1543.001, T1547, T1543.004, T1562.002, T1553.004, T1546.016, T1080, T1574.011, T1556.006, T1543, T1546.004, T1547.006, T1546.001, T1562.004, T1542.003, T1505.005, T1562.008, T1562.009
MITRE ATT&CK tactics: T1556, T1546, T1547, T1542, T1505, T1553, T1562, T1574, T1543, T1027
CVE-2022-32875
A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.7, macOS Ventura 13, iOS 16, watchOS 9, macOS Monterey 12.6. An app may be able to read sensitive location information.
CVSS v3.1 Score: 5.0 (MEDIUM)
CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Affected Products: iphone_os, macos, watchos
Related CWEs: CWE-200
Related CAPECs: CAPEC-497, CAPEC-285, CAPEC-59
MITRE ATT&CK Techniques: T1036.005, T1574.007, T1217
MITRE ATT&CK Tactics: T1134, T1036, T1550
References: https://support.apple.com/en-us/HT213443, https://support.apple.com/en-us/HT213444, https://support.apple.com/en-us/HT213446
CWE: CWE-200
MITRE ATT&CK techniques: T1036.005, T1574.007, T1217, T1590, T1135, T1069, T1057, T1124, T1595, T1134.001, T1087, T1033, T1574.006, T1111, T1120, T1592, T1016, T1046, T1082, T1049, T1083, T1550.004, T1615, T1007, T1562.003, T1018
MITRE ATT&CK tactics: T1134, T1036, T1550, T1562, T1574
CVE-2022-38178
By spoofing the target resolver with responses that have a malformed EdDSA signature, an attacker can trigger a small memory leak. It is possible to gradually erode available memory to the point where named crashes for lack of resources.
CVSS v3.1 Score: 7.5 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products: bind, debian_linux, active_iq_unified_manager, fedora
Related CWEs: CWE-401
References: http://www.openwall.com/lists/oss-security/2022/09/21/3, https://kb.isc.org/docs/cve-2022-38178, https://lists.debian.org/debian-lts-announce/2022/10/msg00007.html
CWE: CWE-401
CVE-2022-41078
Microsoft Exchange Server Spoofing Vulnerability
CVSS v3.1 Score: 8.0 (HIGH)
CVSS v3.1 Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Products: exchange_server
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41078, https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41078