Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-24021 State: PUBLISHED Published: 2022-08-05T21:16:03.355Z Last Updated: 2025-04-15T18:55:23.384Z Severity: CRITICAL (CVSS 9.6 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: TCL Products: LinkHub Mesh Wifi Problem Types: CWE-120 Description: A buffer overflow vulnerability exists in the GetValue functionality of TCL LinkHub Mesh Wi-Fi MS1G_00_01.00_14. A specially-crafted configuration value can lead to a buffer overflow. An attacker can modify a configuration value to trigger this vulnerability.This vulnerability represents all occurances of the buffer overflow vulnerability within the online_process binary. Additional Analyst Notes: - CVE Program Container: - CISA
ffer overflow vulnerability within the online_process binary. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2022-1463
CVE ID: CVE-2022-24022 State: PUBLISHED Published: 2022-08-05T21:16:14.727Z Last Updated: 2025-04-15T18:55:16.440Z Severity: CRITICAL (CVSS 9.6 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: TCL Products: LinkHub Mesh Wifi Problem Types: CWE-120 Description: A buffer overflow vulnerability exists in the GetValue functionality of TCL LinkHub Mesh Wi-Fi MS1G_00_01.00_14. A specially-crafted configuration value can lead to a buffer overflow. An attacker can modify a configuration value to trigger this vulnerability.This vulnerability represents all occurances of the buffer overflow vulnerability within the pannn binary. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnr
ffer overflow vulnerability within the pannn binary. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2022-1463
CVE ID: CVE-2022-24023 State: PUBLISHED Published: 2022-08-05T21:16:29.957Z Last Updated: 2025-04-15T18:55:09.285Z Severity: CRITICAL (CVSS 9.6 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: TCL Products: LinkHub Mesh Wifi Problem Types: CWE-120 Description: A buffer overflow vulnerability exists in the GetValue functionality of TCL LinkHub Mesh Wi-Fi MS1G_00_01.00_14. A specially-crafted configuration value can lead to a buffer overflow. An attacker can modify a configuration value to trigger this vulnerability.This vulnerability represents all occurances of the buffer overflow vulnerability within the pppd binary. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnri
ffer overflow vulnerability within the pppd binary. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2022-1463
CVE ID: CVE-2022-24024 State: PUBLISHED Published: 2022-08-05T21:16:41.577Z Last Updated: 2025-04-15T18:55:02.273Z Severity: CRITICAL (CVSS 9.6 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: TCL Products: LinkHub Mesh Wifi Problem Types: CWE-120 Description: A buffer overflow vulnerability exists in the GetValue functionality of TCL LinkHub Mesh Wi-Fi MS1G_00_01.00_14. A specially-crafted configuration value can lead to a buffer overflow. An attacker can modify a configuration value to trigger this vulnerability.This vulnerability represents all occurances of the buffer overflow vulnerability within the rtk_ate binary. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vul
ffer overflow vulnerability within the rtk_ate binary. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2022-1463
CVE ID: CVE-2022-24025 State: PUBLISHED Published: 2022-08-05T21:16:48.768Z Last Updated: 2025-04-15T18:54:54.848Z Severity: CRITICAL (CVSS 9.6 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: TCL Products: LinkHub Mesh Wifi Problem Types: CWE-120 Description: A buffer overflow vulnerability exists in the GetValue functionality of TCL LinkHub Mesh Wi-Fi MS1G_00_01.00_14. A specially-crafted configuration value can lead to a buffer overflow. An attacker can modify a configuration value to trigger this vulnerability.This vulnerability represents all occurances of the buffer overflow vulnerability within the sntp binary. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnri
ffer overflow vulnerability within the sntp binary. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2022-1463
CVE ID: CVE-2022-24026 State: PUBLISHED Published: 2022-08-05T21:17:02.988Z Last Updated: 2025-04-15T18:54:48.263Z Severity: CRITICAL (CVSS 9.6 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: TCL Products: LinkHub Mesh Wifi Problem Types: CWE-120 Description: A buffer overflow vulnerability exists in the GetValue functionality of TCL LinkHub Mesh Wi-Fi MS1G_00_01.00_14. A specially-crafted configuration value can lead to a buffer overflow. An attacker can modify a configuration value to trigger this vulnerability.This vulnerability represents all occurances of the buffer overflow vulnerability within the telnet_ate_monitor binary. Additional Analyst Notes: - CVE Program Container: - C
ffer overflow vulnerability within the telnet_ate_monitor binary. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2022-1463
CVE ID: CVE-2022-24027 State: PUBLISHED Published: 2022-08-05T21:17:17.327Z Last Updated: 2025-04-15T18:54:41.751Z Severity: CRITICAL (CVSS 9.6 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: TCL Products: LinkHub Mesh Wifi Problem Types: CWE-120 Description: A buffer overflow vulnerability exists in the GetValue functionality of TCL LinkHub Mesh Wi-Fi MS1G_00_01.00_14. A specially-crafted configuration value can lead to a buffer overflow. An attacker can modify a configuration value to trigger this vulnerability.This vulnerability represents all occurances of the buffer overflow vulnerability within the libcommon.so binary. Additional Analyst Notes: - CVE Program Container: - CISA AD
ffer overflow vulnerability within the libcommon.so binary. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2022-1463
CVE ID: CVE-2022-24028 State: PUBLISHED Published: 2022-08-05T21:17:30.496Z Last Updated: 2025-04-15T18:54:35.789Z Severity: CRITICAL (CVSS 9.6 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: TCL Products: LinkHub Mesh Wifi Problem Types: CWE-120 Description: A buffer overflow vulnerability exists in the GetValue functionality of TCL LinkHub Mesh Wi-Fi MS1G_00_01.00_14. A specially-crafted configuration value can lead to a buffer overflow. An attacker can modify a configuration value to trigger this vulnerability.This vulnerability represents all occurances of the buffer overflow vulnerability within the libcommonprod.so binary. Additional Analyst Notes: - CVE Program Container: - CIS
ffer overflow vulnerability within the libcommonprod.so binary. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2022-1463
CVE ID: CVE-2022-24029 State: PUBLISHED Published: 2022-08-05T21:17:44.631Z Last Updated: 2025-04-15T18:54:28.573Z Severity: CRITICAL (CVSS 9.6 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: TCL Products: LinkHub Mesh Wifi Problem Types: CWE-120 Description: A buffer overflow vulnerability exists in the GetValue functionality of TCL LinkHub Mesh Wi-Fi MS1G_00_01.00_14. A specially-crafted configuration value can lead to a buffer overflow. An attacker can modify a configuration value to trigger this vulnerability.This vulnerability represents all occurances of the buffer overflow vulnerability within the rp-pppoe.so binary. Additional Analyst Notes: - CVE Program Container: - CISA ADP
ffer overflow vulnerability within the rp-pppoe.so binary. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2022-1463
CVE ID: CVE-2022-24030 State: PUBLISHED Published: 2022-02-03T01:16:51.000Z Last Updated: 2025-11-04T19:12:58.761Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in AhciBusDxe in Insyde InsydeH2O with kernel 5.1 through 5.5. An SMM memory corruption vulnerability allows an attacker to write fixed or predictable data to SMRAM. Exploiting this issue could lead to escalating privileges to SMM. Additional Analyst Notes: - CVE Program Container: References: - https://www.insyde.com/security-pledge - https://www.insyde.com/security-pledge/SA-2022011 - https://security.netapp.com/advisory/ntap-20220216-0011/ - https://cert-portal.siemens.com/productcert/pdf/ssa-3
22011 - https://security.netapp.com/advisory/ntap-20220216-0011/ - https://cert-portal.siemens.com/productcert/pdf/ssa-306654.pdf
CVE ID: CVE-2022-24031 State: PUBLISHED Published: 2022-02-03T01:59:49.000Z Last Updated: 2025-11-04T19:12:59.895Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in NvmExpressDxe in Insyde InsydeH2O with kernel 5.1 through 5.5. An SMM memory corruption vulnerability allows an attacker to write fixed or predictable data to SMRAM. Exploiting this issue could lead to escalating privileges to SMM. Additional Analyst Notes: - CVE Program Container: References: - https://www.insyde.com/security-pledge - https://www.insyde.com/security-pledge/SA-2022015 - https://security.netapp.com/advisory/ntap-20220216-0009/ - https://cert-portal.siemens.com/productcert/pdf/ss
-2022015 - https://security.netapp.com/advisory/ntap-20220216-0009/ - https://cert-portal.siemens.com/productcert/pdf/ssa-306654.pdf
CVE ID: CVE-2022-24032 State: PUBLISHED Published: 2022-01-30T00:59:35 Last Updated: 2024-08-03T03:59:23.383Z Vendors: n/a Products: n/a Problem Types: n/a Description: Adenza AxiomSL ControllerView through 10.8.1 is vulnerable to user enumeration. An attacker can identify valid usernames on the platform because a failed login attempt produces a different error message when the username is valid. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jdordonezn/CVE-2022-24032/issues/1
CVE ID: CVE-2022-24035 State: PUBLISHED Published: 2023-04-20T00:00:00.000Z Last Updated: 2025-02-05T15:15:41.658Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in ONOS 2.5.1. The purge-requested intent remains on the list, but it does not respond to changes in topology (e.g., link failure). In combination with other applications, it could lead to a failure of network management. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wiki.onosproject.org/display/ONOS/Intent+Framework - https://www.usenix.org/system/files/sec23fall-prepub-285_kim-jiwon.pdf
CVE ID: CVE-2022-24036 State: PUBLISHED Published: 2022-11-16T12:05:11.824438Z Last Updated: 2024-09-17T03:18:28.221Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L) Vendors: Karmasis Informatics Products: Infraskope SIEM+ Problem Types: CWE-284 Description: Karmasis Informatics Infraskope SIEM+ has an unauthenticated access vulnerability which could allow an unauthenticated attacker to modificate logs. Additional Analyst Notes: - CVE Program Container: References: - https://www.usom.gov.tr/bildirim/tr-22-0691 - https://karmasis.com/urunlerimiz/infraskope-siem/
CVE ID: CVE-2022-24037 State: PUBLISHED Published: 2022-11-18T07:15:16.944457Z Last Updated: 2024-09-16T20:12:19.327Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L) Vendors: Karmasis Informatics Products: Infraskope SIEM+ Problem Types: CWE-20 Description: Karmasis Informatics Infraskope SIEM+ has an unauthenticated access vulnerability which could allow an unauthenticated attacker to obtain critical information. Additional Analyst Notes: - CVE Program Container: References: - https://www.usom.gov.tr/bildirim/tr-22-0691 - https://karmasis.com/urunlerimiz/infraskope-siem/
CVE ID: CVE-2022-24038 State: PUBLISHED Published: 2022-11-18T08:45:17.726624Z Last Updated: 2024-09-17T03:42:55.726Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L) Vendors: Karmasis Informatics Products: Infraskope SIEM+ Problem Types: CWE-284 Description: Karmasis Informatics Infraskope SIEM+ has an unauthenticated access vulnerability which could allow an unauthenticated attacker to damage the page where the agents are listed. Additional Analyst Notes: - CVE Program Container: References: - https://www.usom.gov.tr/bildirim/tr-22-0691 - https://karmasis.com/urunlerimiz/infraskope-siem/
CVE ID: CVE-2022-24039 State: PUBLISHED Published: 2022-05-10T09:46:46 Last Updated: 2024-08-03T03:59:23.647Z Vendors: Siemens Products: Desigo PXC4, Desigo PXC5 Problem Types: CWE-75 Description: A vulnerability has been identified in Desigo PXC4 (All versions < V02.20.142.10-10884), Desigo PXC5 (All versions < V02.20.142.10-10884). The “addCell” JavaScript function fails to properly sanitize user-controllable input before including it into the generated XML body of the XLS report document, such that it is possible to inject arbitrary content (e.g., XML tags) into the generated file. An attacker with restricted privileges, by poisoning any of the content used to generate XLS reports, could
rated file. An attacker with restricted privileges, by poisoning any of the content used to generate XLS reports, could be able to leverage the application to deliver malicious files against higher-privileged users and obtain Remote Code Execution (RCE) against the administrator’s workstation. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-626968.pdf
CVE ID: CVE-2022-24040 State: PUBLISHED Published: 2022-05-10T09:46:48 Last Updated: 2024-08-03T03:59:23.638Z Vendors: Siemens Products: Desigo DXR2, Desigo PXC3, Desigo PXC4, Desigo PXC5 Problem Types: CWE-400 Description: A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.142.5-22), Desigo PXC3 (All versions < V01.21.142.4-18), Desigo PXC4 (All versions < V02.20.142.10-10884), Desigo PXC5 (All versions < V02.20.142.10-10884). The web application fails to enforce an upper bound to the cost factor of the PBKDF2 derived key during the creation or update of an account. An attacker with the user profile access privilege could cause a denial of service (DoS) condition thro
e of an account. An attacker with the user profile access privilege could cause a denial of service (DoS) condition through CPU consumption by setting a PBKDF2 derived key with a remarkably high cost effort and then attempting a login to the so-modified account. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-626968.pdf
CVE ID: CVE-2022-24041 State: PUBLISHED Published: 2022-05-10T09:46:49 Last Updated: 2024-08-03T03:59:23.481Z Vendors: Siemens Products: Desigo DXR2, Desigo PXC3, Desigo PXC4, Desigo PXC5 Problem Types: CWE-916 Description: A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.142.5-22), Desigo PXC3 (All versions < V01.21.142.4-18), Desigo PXC4 (All versions < V02.20.142.10-10884), Desigo PXC5 (All versions < V02.20.142.10-10884). The web application stores the PBKDF2 derived key of users passwords with a low iteration count. An attacker with user profile access privilege can retrieve the stored password hashes of other accounts and then successfully perform an offline cr
e access privilege can retrieve the stored password hashes of other accounts and then successfully perform an offline cracking attack and recover the plaintext passwords of other users. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-626968.pdf
CVE ID: CVE-2022-24042 State: PUBLISHED Published: 2022-05-10T09:46:51 Last Updated: 2024-08-03T03:59:23.392Z Vendors: Siemens Products: Desigo DXR2, Desigo PXC3, Desigo PXC4, Desigo PXC5 Problem Types: CWE-613 Description: A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.142.5-22), Desigo PXC3 (All versions < V01.21.142.4-18), Desigo PXC4 (All versions < V02.20.142.10-10884), Desigo PXC5 (All versions < V02.20.142.10-10884). The web application returns an AuthToken that does not expire at the defined auto logoff delay timeout. An attacker could be able to capture this token and re-use old session credentials or session IDs for authorization. Additional Analyst Notes
able to capture this token and re-use old session credentials or session IDs for authorization. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-626968.pdf
CVE ID: CVE-2022-24043 State: PUBLISHED Published: 2022-05-10T09:46:53 Last Updated: 2024-08-03T03:59:23.653Z Vendors: Siemens Products: Desigo DXR2, Desigo PXC3, Desigo PXC4, Desigo PXC5 Problem Types: CWE-203 Description: A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.142.5-22), Desigo PXC3 (All versions < V01.21.142.4-18), Desigo PXC4 (All versions < V02.20.142.10-10884), Desigo PXC5 (All versions < V02.20.142.10-10884). The login functionality of the application fails to normalize the response times of login attempts performed with wrong usernames with the ones executed with correct usernames. A remote unauthenticated attacker could exploit this side-channel in
ames with the ones executed with correct usernames. A remote unauthenticated attacker could exploit this side-channel information to perform a username enumeration attack and identify valid usernames. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-626968.pdf
CVE ID: CVE-2022-24044 State: PUBLISHED Published: 2022-05-10T09:46:54 Last Updated: 2024-08-03T03:59:23.507Z Vendors: Siemens Products: Desigo DXR2, Desigo PXC3, Desigo PXC4, Desigo PXC5 Problem Types: CWE-307 Description: A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.142.5-22), Desigo PXC3 (All versions < V01.21.142.4-18), Desigo PXC4 (All versions < V02.20.142.10-10884), Desigo PXC5 (All versions < V02.20.142.10-10884). The login functionality of the application does not employ any countermeasures against Password Spraying attacks or Credential Stuffing attacks. An attacker could obtain a list of valid usernames on the device by exploiting the issue and then pe
l Stuffing attacks. An attacker could obtain a list of valid usernames on the device by exploiting the issue and then perform a precise Password Spraying or Credential Stuffing attack in order to obtain access to at least one account. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-626968.pdf
CVE ID: CVE-2022-24045 State: PUBLISHED Published: 2022-05-10T09:46:56 Last Updated: 2024-08-03T03:59:23.659Z Vendors: Siemens Products: Desigo DXR2, Desigo PXC3, Desigo PXC4, Desigo PXC5 Problem Types: CWE-614 Description: A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.142.5-22), Desigo PXC3 (All versions < V01.21.142.4-18), Desigo PXC4 (All versions < V02.20.142.10-10884), Desigo PXC5 (All versions < V02.20.142.10-10884). The application, after a successful login, sets the session cookie on the browser via client-side JavaScript code, without applying any security attributes (such as “Secure”, “HttpOnly”, or “SameSite”). Any attempts to browse the application via
plying any security attributes (such as “Secure”, “HttpOnly”, or “SameSite”). Any attempts to browse the application via unencrypted HTTP protocol would lead to the transmission of all his/her session cookies in plaintext through the network. An attacker could then be able to sniff the network and capture sensitive information. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-626968.pdf
CVE ID: CVE-2022-24046 State: PUBLISHED Published: 2022-02-18T19:51:38 Last Updated: 2024-08-03T03:59:23.515Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Sonos Products: One Speaker Problem Types: CWE-191 Description: This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Sonos One Speaker prior to 3.4.1 (S2 systems) and 11.2.13 build 57923290 (S1 systems). Authentication is not required to exploit this vulnerability. The specific flaw exists within the anacapd daemon. The issue results from the lack of proper validation of user-supplied data, which can result in an integer underflow before writing t
ults from the lack of proper validation of user-supplied data, which can result in an integer underflow before writing to memory. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-15828. Additional Analyst Notes: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-22-260/
CVE ID: CVE-2022-24047 State: PUBLISHED Published: 2022-02-18T19:51:40 Last Updated: 2024-08-03T03:59:23.594Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: BMC Products: Track-It! Problem Types: CWE-288 Description: This vulnerability allows remote attackers to bypass authentication on affected installations of BMC Track-It! 20.21.01.102. Authentication is not required to exploit this vulnerability. The specific flaw exists within the authorization of HTTP requests. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-1461
s to functionality. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-14618. Additional Analyst Notes: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-22-290/ - https://community.bmc.com/s/article/Security-vulnerabilities-patched-in-Track-It
CVE ID: CVE-2022-24048 State: PUBLISHED Published: 2022-02-18T19:51:41 Last Updated: 2024-08-03T03:59:23.650Z Severity: HIGH (CVSS 7 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: MariaDB Products: MariaDB Problem Types: CWE-121 Description: MariaDB CONNECT Storage Engine Stack-based Buffer Overflow Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of MariaDB. Authentication is required to exploit this vulnerability. The specific flaw exists within the processing of SQL queries. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stac
esults from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the service account. Was ZDI-CAN-16191. Additional Analyst Notes: - CVE Program Container: References: - https://mariadb.com/kb/en/security/ - https://www.zerodayinitiative.com/advisories/ZDI-22-363/ - https://security.netapp.com/advisory/ntap-20220318-0004/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NJ4KDAGF3H4D4BDTHRAM6ZEAJJWWMRUO/ - https://lists.fedoraproject.org/archives/list/package-anno
fedoraproject.org/message/NJ4KDAGF3H4D4BDTHRAM6ZEAJJWWMRUO/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DKJRBYJAQCOPHSED43A3HUPNKQLDTFGD/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EZFZVMJL5UDTOZMARLXQIMG3BTG6UNYW/