Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-2753 State: PUBLISHED Published: 2022-09-19T14:01:01 Last Updated: 2024-08-03T00:46:04.516Z Vendors: Unknown Products: Ketchup Restaurant Reservations Problem Types: CWE-79 Description: The Ketchup Restaurant Reservations WordPress plugin through 1.0.0 does not sanitise and escape some of the reservation user inputs, allowing unauthenticated attackers to perform Cross-Site Scripting attacks logged in admin viewing the malicious reservation made Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/3c6cc46e-e18a-4f34-ac09-f30ca74a1182
CVE ID: CVE-2022-2754 State: PUBLISHED Published: 2022-09-19T14:01:03 Last Updated: 2024-08-03T00:46:04.319Z Vendors: Unknown Products: Ketchup Restaurant Reservations Problem Types: CWE-89 Description: The Ketchup Restaurant Reservations WordPress plugin through 1.0.0 does not validate and escape some reservation parameters before using them in SQL statements, which could allow unauthenticated attackers to perform SQL Injection attacks Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/e3c6d137-ff6e-432a-a21a-b36dc81f73c5
CVE ID: CVE-2022-2756 State: PUBLISHED Published: 2022-08-10T15:15:15 Last Updated: 2024-08-03T00:46:04.503Z Severity: HIGH (CVSS 7.1 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) Vendors: kareadita Products: kareadita/kavita Problem Types: CWE-918 Description: Server-Side Request Forgery (SSRF) in GitHub repository kareadita/kavita prior to 0.5.4.1. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/95e7c181-9d80-4428-aebf-687ac55a9216 - https://github.com/kareadita/kavita/commit/9c31f7e7c81b919923cb2e3857439ec0d16243e4
CVE ID: CVE-2022-2757 State: PUBLISHED Published: 2022-12-13T21:18:23.930Z Last Updated: 2025-04-16T16:04:45.957Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Kingspan Products: TMS300 CS Problem Types: CWE-287 Description: Due to the lack of adequately implemented access-control rules, all versions Kingspan TMS300 CS are vulnerable to an attacker viewing and modifying the application settings without authenticating by accessing a specific uniform resource locator (URL) on the webserver. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-256-04
CVE ID: CVE-2022-2758 State: PUBLISHED Published: 2022-08-31T15:33:03.944Z Last Updated: 2025-04-16T16:11:29.230Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: LS Industrial Systems (LSIS) Co. Ltd LS Electric Products: XG5000, PLC: XGB-XECH, PLC: XGB-XBCH, PLC: XGB-XBMS, PLC: XGR-CPUH, PLC: XGI-CPUU/UD/H/S/E, PLC: XGK-CPUU/H/A/S/E Problem Types: CWE-326 Description: Passwords are not adequately encrypted during the communication process between all versions of LS Industrial Systems (LSIS) Co. Ltd LS Electric XG5000 software prior to V4.0 and LS Electric PLCs: all versions of XGK-CPUU/H/A/S/E prior to V3.50, all versions of XGI-CPUU/UD/H/S/E prior to V3.20,
and LS Electric PLCs: all versions of XGK-CPUU/H/A/S/E prior to V3.50, all versions of XGI-CPUU/UD/H/S/E prior to V3.20, all versions of XGR-CPUH prior to V1.80, all versions of XGB-XBMS prior to V3.00, all versions of XGB-XBCH prior to V1.90, and all versions of XGB-XECH prior to V1.30. This would allow an attacker to identify and decrypt the password of the affected PLCs by sniffing the PLC’s communication traffic. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-228-02
CVE ID: CVE-2022-2759 State: PUBLISHED Published: 2022-08-31T15:33:04.187Z Last Updated: 2025-04-16T16:11:22.433Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: Delta Electronics Products: Delta Robot Automation Studio (DRAS) Problem Types: CWE-611 Description: Delta Electronics Delta Robot Automation Studio (DRAS) versions prior to 1.13.20 are affected by improper restrictions where the software processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output. This may allow an attacker to view sensitive documents and infor
e product to embed incorrect documents into its output. This may allow an attacker to view sensitive documents and information on the affected host. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-228-03
CVE ID: CVE-2022-2760 State: PUBLISHED Published: 2022-09-28T00:00:00.000Z Last Updated: 2025-05-21T14:58:00.453Z Vendors: Octopus Deploy Products: Octopus Server Problem Types: Information exposure Description: In affected versions of Octopus Deploy it is possible to reveal the Space ID of spaces that the user does not have access to view in an error message when a resource is part of another Space. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://advisories.octopus.com/post/2022/sa2022-14/
CVE ID: CVE-2022-2761 State: PUBLISHED Published: 2022-11-09T00:00:00.000Z Last Updated: 2025-05-01T19:35:56.179Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: Information exposure in GitLab Description: An information disclosure issue in GitLab CE/EE affecting all versions from 14.4 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allows an attacker to use GitLab Flavored Markdown (GFM) references in a Jira issue to disclose the names of resources they don't have access to. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/i
Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/370458 - https://hackerone.com/reports/1653149 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2761.json
CVE ID: CVE-2022-2762 State: PUBLISHED Published: 2022-10-25T00:00:00.000Z Last Updated: 2025-05-08T14:06:04.737Z Vendors: Unknown Products: AdminPad Problem Types: CWE-352 Description: The AdminPad WordPress plugin before 2.2 does not have CSRF check when updating admin's note, allowing attackers to make a logged in admin update their notes via a CSRF attack Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/cf0b3893-3283-46d6-a497-f3110a35d42a
CVE ID: CVE-2022-2763 State: PUBLISHED Published: 2022-10-03T13:45:23 Last Updated: 2024-08-03T00:46:04.506Z Vendors: Unknown Products: WP Socializer – Simple & Easy Social Media Share Icons Problem Types: CWE-79 Description: The WP Socializer WordPress plugin before 7.3 does not sanitise and escape some of its Icons settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/36a7b872-31fa-4375-9be7-8f787e616ed5
CVE ID: CVE-2022-2764 State: PUBLISHED Published: 2022-09-01T00:00:00 Last Updated: 2024-08-03T00:46:04.429Z Vendors: n/a Products: undertow Problem Types: CWE-400 Description: A flaw was found in Undertow. Denial of service can be achieved as Undertow server waits for the LAST_CHUNK forever for EJB invocations. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2117506 - https://security.netapp.com/advisory/ntap-20221014-0006/
CVE ID: CVE-2022-2765 State: PUBLISHED Published: 2022-08-11T09:30:18.000Z Last Updated: 2025-04-15T13:52:44.593Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: SourceCodester Products: Company Website CMS Problem Types: CWE-287 Description: A vulnerability was found in SourceCodester Company Website CMS 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /dashboard/settings. The manipulation leads to improper authentication. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-206161 was assigned to this vulnerability. Additional Analy
disclosed to the public and may be used. The identifier VDB-206161 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ch0ing/vul/blob/main/WebRay.com.cn/Company%20Website%20CMS--.md - https://vuldb.com/?id.206161
CVE ID: CVE-2022-2766 State: PUBLISHED Published: 2022-08-11T09:30:29.000Z Last Updated: 2025-04-14T15:59:39.781Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: SourceCodester Products: Loan Management System Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester Loan Management System. It has been rated as critical. Affected by this issue is some unknown functionality of the file /index.php. The manipulation of the argument password leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-206162 is the identifier assigned to this vulnerability. Additional Analyst No
closed to the public and may be used. VDB-206162 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Drun1baby/CVE_Pentest/blob/main/Loan%20Management%20System%20CMS/images/sql01.png - https://vuldb.com/?id.206162
CVE ID: CVE-2022-2767 State: PUBLISHED Published: 2022-08-11T09:30:38.000Z Last Updated: 2025-04-15T13:52:37.756Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: SourceCodester Products: Online Admission System Problem Types: CWE-79 Description: A vulnerability classified as problematic has been found in SourceCodester Online Admission System. This affects an unknown part of the file /index.php. The manipulation of the argument student_add leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-206163. Additional Analyst No
osed to the public and may be used. The associated identifier of this vulnerability is VDB-206163. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Drun1baby/CVE_Pentest/blob/main/Online%20Admission%20System%20CMS/images/alert.png - https://vuldb.com/?id.206163
CVE ID: CVE-2022-2768 State: PUBLISHED Published: 2022-08-11T11:50:22.000Z Last Updated: 2025-04-15T13:52:30.065Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: SourceCodester Products: Library Management System Problem Types: CWE-79 Description: A vulnerability classified as problematic was found in SourceCodester Library Management System. This vulnerability affects unknown code of the file /qr/I/. The manipulation of the argument error leads to cross site scripting. The attack can be initiated remotely. The identifier of this vulnerability is VDB-206164. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.
is VDB-206164. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.206164
CVE ID: CVE-2022-2769 State: PUBLISHED Published: 2022-08-11T11:50:34.000Z Last Updated: 2025-04-15T13:52:23.338Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: SourceCodester Products: Company Website CMS Problem Types: CWE-79 Description: A vulnerability, which was classified as problematic, has been found in SourceCodester Company Website CMS. This issue affects some unknown processing of the file /dashboard/contact. The manipulation of the argument phone leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-206165 was assigned to this vulnerability. Additional A
been disclosed to the public and may be used. The identifier VDB-206165 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ch0ing/vul/blob/main/WebRay.com.cn/Company%20Website%20CMS%28XSS%29.md - https://vuldb.com/?id.206165
CVE ID: CVE-2022-2770 State: PUBLISHED Published: 2022-08-11T11:50:48.000Z Last Updated: 2025-04-15T13:52:12.313Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: SourceCodester Products: Simple Online Book Store System Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, was found in SourceCodester Simple Online Book Store System. Affected is an unknown function of the file /obs/book.php. The manipulation of the argument bookisbn leads to sql injection. It is possible to launch the attack remotely. VDB-206166 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnri
6 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.206166
CVE ID: CVE-2022-2771 State: PUBLISHED Published: 2022-08-11T11:51:02.000Z Last Updated: 2025-04-15T13:52:03.736Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: SourceCodester Products: Simple Online Book Store System Problem Types: CWE-89 Description: A vulnerability has been found in SourceCodester Simple Online Book Store System and classified as critical. Affected by this vulnerability is an unknown functionality of the file /obs/bookPerPub.php. The manipulation of the argument bookisbn leads to sql injection. The attack can be launched remotely. The associated identifier of this vulnerability is VDB-206167. Additional Analyst Notes: - CVE Program Conta
d remotely. The associated identifier of this vulnerability is VDB-206167. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.206167
CVE ID: CVE-2022-2772 State: PUBLISHED Published: 2022-08-11T11:51:16.000Z Last Updated: 2025-04-15T13:51:56.219Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: SourceCodester Products: Apartment Visitor Management System Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester Apartment Visitor Management System and classified as critical. Affected by this issue is some unknown functionality of the file action-visitor.php. The manipulation of the argument editid/remark leads to sql injection. The attack may be launched remotely. The identifier of this vulnerability is VDB-206168. Additional Analyst Notes: - CVE Program Container: - CI
ed remotely. The identifier of this vulnerability is VDB-206168. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.206168
CVE ID: CVE-2022-2773 State: PUBLISHED Published: 2022-08-11T11:51:30.000Z Last Updated: 2025-04-15T13:51:47.550Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: SourceCodester Products: Apartment Visitor Management System Problem Types: CWE-79 Description: A vulnerability was found in SourceCodester Apartment Visitor Management System. It has been classified as problematic. This affects an unknown part of the file profile.php. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The identifier VDB-206169 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Ref
6169 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.206169
CVE ID: CVE-2022-2774 State: PUBLISHED Published: 2022-08-11T11:51:43.000Z Last Updated: 2025-04-15T13:51:40.694Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: SourceCodester Products: Library Management System Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester Library Management System. It has been declared as critical. This vulnerability affects unknown code of the file librarian/student.php. The manipulation of the argument title leads to sql injection. The attack can be initiated remotely. VDB-206170 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment:
identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.206170
CVE ID: CVE-2022-2775 State: PUBLISHED Published: 2022-09-05T12:35:23 Last Updated: 2024-08-03T00:46:04.434Z Vendors: Unknown Products: Fast Flow Problem Types: CWE-79 Description: The Fast Flow WordPress plugin before 1.2.13 does not sanitise and escape some of its Widget settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/7101ce04-670e-4ce0-9f60-e00494ff379d
CVE ID: CVE-2022-2776 State: PUBLISHED Published: 2022-08-11T11:51:57.000Z Last Updated: 2025-04-15T13:51:32.737Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: SourceCodester Products: Gym Management System Problem Types: CWE-404 Description: A vulnerability classified as problematic has been found in SourceCodester Gym Management System. Affected is an unknown function of the file delete_user.php. The manipulation of the argument delete_user leads to denial of service. It is possible to launch the attack remotely. The identifier of this vulnerability is VDB-206172. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - h
vulnerability is VDB-206172. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.206172
CVE ID: CVE-2022-2777 State: PUBLISHED Published: 2022-08-11T10:45:13 Last Updated: 2024-08-03T00:46:04.459Z Severity: MEDIUM (CVSS 6.6 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H) Vendors: microweber Products: microweber/microweber Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.3.1. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/13dd2f4d-0c7f-483e-a771-e1ed2ff1c36f - https://github.com/microweber/microweber/commit/60eef7494211d1c458228c321e986edeaa401a58
CVE ID: CVE-2022-2778 State: PUBLISHED Published: 2022-09-30T00:00:00.000Z Last Updated: 2025-05-20T20:16:56.443Z Vendors: Octopus Deploy Products: Octopus Server Problem Types: Rate Limit Bypass Description: In affected versions of Octopus Deploy it is possible to bypass rate limiting on login using null bytes. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://advisories.octopus.com/post/2022/sa2022-15/
CVE ID: CVE-2022-2779 State: PUBLISHED Published: 2022-08-12T09:25:09.000Z Last Updated: 2025-04-15T13:51:24.550Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: SourceCodester Products: Gas Agency Management System Problem Types: CWE-434 Description: A vulnerability classified as critical was found in SourceCodester Gas Agency Management System. Affected by this vulnerability is an unknown functionality of the file /gasmark/assets/myimages/oneWord.php. The manipulation of the argument shell leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-206173 was assigned t
aunched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-206173 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Drun1baby/CVE_Pentest/blob/main/Gas%20Agency%20Management%20System%20CMS/images/oneWorld.png - https://vuldb.com/?id.206173
CVE ID: CVE-2022-2780 State: PUBLISHED Published: 2022-10-14T00:00:00.000Z Last Updated: 2025-05-15T15:09:13.386Z Vendors: Octopus Deploy Products: Octopus Server Problem Types: Authentication Bypass by Capture-Replay Description: In affected versions of Octopus Server it is possible to use the Git Connectivity test function on the VCS project to initiate an SMB request resulting in the potential for an NTLM relay attack. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://advisories.octopus.com/post/2022/sa2022-20/
CVE ID: CVE-2022-2781 State: PUBLISHED Published: 2022-10-06T00:00:00 Last Updated: 2024-08-03T00:46:04.515Z Vendors: Octopus Deploy Products: Octopus Server Problem Types: Encryption Description: In affected versions of Octopus Server it was identified that the same encryption process was used for both encrypting session cookies and variables. Additional Analyst Notes: - CVE Program Container: References: - https://advisories.octopus.com/post/2022/sa2022-16/
CVE ID: CVE-2022-2782 State: PUBLISHED Published: 2022-10-26T00:00:00.000Z Last Updated: 2025-05-07T18:54:06.675Z Vendors: Octopus Deploy Products: Octopus Server Problem Types: Insufficient Session Expiration Description: In affected versions of Octopus Server it is possible for a session token to be valid indefinitely due to improper validation of the session token parameters. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://advisories.octopus.com/post/2022/sa2022-21/
CVE ID: CVE-2022-2783 State: PUBLISHED Published: 2022-10-06T00:00:00 Last Updated: 2024-08-03T00:46:04.456Z Vendors: Octopus Deploy Products: Octopus Server Problem Types: CSRF Description: In affected versions of Octopus Server it was identified that a session cookie could be used as the CSRF token Additional Analyst Notes: - CVE Program Container: References: - https://advisories.octopus.com/post/2022/sa2022-17/
CVE ID: CVE-2022-2785 State: PUBLISHED Published: 2022-09-23T11:10:08.764Z Last Updated: 2025-04-21T13:49:09.750Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Linux Kernel Products: Kernel Problem Types: CWE-125 Description: There exists an arbitrary memory read within the Linux Kernel BPF - Constants provided to fill pointers in structs passed in to bpf_sys_bpf are not verified and can point anywhere, including memory not owned by BPF. An attacker with CAP_BPF can arbitrarily read memory from anywhere on the system. We recommend upgrading past commit 86f44fcec22c Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - ht
ng past commit 86f44fcec22c Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/bpf/bpf/c/86f44fcec22c - https://lore.kernel.org/bpf/20220816205517.682470-1-zhuyifei%40google.com/T/#t
CVE ID: CVE-2022-2787 State: PUBLISHED Published: 2022-08-27T11:30:20.934090Z Last Updated: 2024-09-16T19:51:44.215Z Vendors: Debian Products: schroot Problem Types: insufficient sanitiztion of chroot and session names Description: Schroot before 1.6.13 had too permissive rules on chroot or session names, allowing a denial of service on the schroot service for all users that may start a schroot session. Additional Analyst Notes: - CVE Program Container: References: - https://codeberg.org/shelter/reschroot/commit/6f7166a285e1e97aea390be633591f9791b29a6d - https://lists.debian.org/debian-security-announce/2022/msg00182.html - https://lists.debian.org/debian-lts-announce/2022/08/msg00007.html -