Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-3601 State: PUBLISHED Published: 2022-11-28T13:47:06.275Z Last Updated: 2025-04-28T18:10:46.151Z Vendors: Unknown Products: Image Hover Effects Css3 Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Image Hover Effects Css3 WordPress plugin through 4.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/28b7ee77-5826-4c98-b09a-8f197e1a6d18
CVE ID: CVE-2022-3602 State: PUBLISHED Published: 2022-11-01T00:00:00.000Z Last Updated: 2025-11-04T19:13:04.845Z Vendors: OpenSSL Products: OpenSSL Problem Types: Buffer overflow Description: A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed the malicious certificate or for the application to continue certificate verification despite failure to construct a path to a trusted issuer. An attacker can craft a malicious email address to overflow four attacker-controlled bytes on the stack. This buffer overflow could result in a
malicious email address to overflow four attacker-controlled bytes on the stack. This buffer overflow could result in a crash (causing a denial of service) or potentially remote code execution. Many platforms implement stack overflow protections which would mitigate against the risk of remote code execution. The risk may be further mitigated based on stack layout for any given platform/compiler. Pre-announcements of CVE-2022-3602 described this issue as CRITICAL. Further analysis based on some of the mitigating factors described above have led this to be downgraded to HIGH. Users are still encouraged to upgrade to a new version as soon as possible. In a TLS client, this can be triggered by c
Users are still encouraged to upgrade to a new version as soon as possible. In a TLS client, this can be triggered by connecting to a malicious server. In a TLS server, this can be triggered if the server requests client authentication and a malicious client connects. Fixed in OpenSSL 3.0.7 (Affected 3.0.0,3.0.1,3.0.2,3.0.3,3.0.4,3.0.5,3.0.6). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.openssl.org/news/secadv/20221101.txt - https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=fe3b639dc19b325846f4f6801f2f4604f56e3de3 - http://www.openwall.com/lists/oss-security/2022/11/01/15 - http://www.openwall.com/lists/oss-security/20
f4604f56e3de3 - http://www.openwall.com/lists/oss-security/2022/11/01/15 - http://www.openwall.com/lists/oss-security/2022/11/01/16 - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-openssl-W9sdCc2a - http://www.openwall.com/lists/oss-security/2022/11/01/21 - http://www.openwall.com/lists/oss-security/2022/11/01/19 - http://www.openwall.com/lists/oss-security/2022/11/01/18 - http://www.openwall.com/lists/oss-security/2022/11/01/20 - http://www.openwall.com/lists/oss-security/2022/11/01/24 - http://www.openwall.com/lists/oss-security/2022/11/01/17 - https://security.gentoo.org/glsa/202211-01 - https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0023 - htt
/17 - https://security.gentoo.org/glsa/202211-01 - https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0023 - https://www.kb.cert.org/vuls/id/794340 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DWP23EZYOBDJQP7HP4YU7W2ABU2YDITS/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/63YRPWPUSX3MBHNPIEJZDKQT6YA7UF6S/ - http://www.openwall.com/lists/oss-security/2022/11/02/2 - http://www.openwall.com/lists/oss-security/2022/11/02/6 - http://www.openwall.com/lists/oss-security/2022/11/02/5 - http://www.openwall.com/lists/oss-security/2022/11/02/1 - http://www.openwall.com/lists/oss-security/2
ty/2022/11/02/5 - http://www.openwall.com/lists/oss-security/2022/11/02/1 - http://www.openwall.com/lists/oss-security/2022/11/02/3 - http://www.openwall.com/lists/oss-security/2022/11/02/7 - http://www.openwall.com/lists/oss-security/2022/11/02/10 - http://www.openwall.com/lists/oss-security/2022/11/02/9 - http://packetstormsecurity.com/files/169687/OpenSSL-Security-Advisory-20221101.html - http://www.openwall.com/lists/oss-security/2022/11/02/12 - http://www.openwall.com/lists/oss-security/2022/11/02/11 - http://www.openwall.com/lists/oss-security/2022/11/02/15 - http://www.openwall.com/lists/oss-security/2022/11/02/14 - http://www.openwall.com/lists/oss-security/2022/11/02/13 - https://se
ww.openwall.com/lists/oss-security/2022/11/02/14 - http://www.openwall.com/lists/oss-security/2022/11/02/13 - https://security.netapp.com/advisory/ntap-20221102-0001/ - http://www.openwall.com/lists/oss-security/2022/11/03/1 - http://www.openwall.com/lists/oss-security/2022/11/03/2 - http://www.openwall.com/lists/oss-security/2022/11/03/3 - http://www.openwall.com/lists/oss-security/2022/11/03/5 - http://www.openwall.com/lists/oss-security/2022/11/03/7 - http://www.openwall.com/lists/oss-security/2022/11/03/6 - http://www.openwall.com/lists/oss-security/2022/11/03/9 - http://www.openwall.com/lists/oss-security/2022/11/03/10 - http://www.openwall.com/lists/oss-security/2022/11/03/11
CVE ID: CVE-2022-3603 State: PUBLISHED Published: 2022-11-28T13:47:22.384Z Last Updated: 2025-04-25T19:57:21.447Z Vendors: Unknown Products: Export customers list csv for WooCommerce, WordPress users csv, export Guest customer list Problem Types: CWE-1236 Improper Neutralization of Formula Elements in a CSV File Description: The Export customers list csv for WooCommerce, WordPress users csv, export Guest customer list WordPress plugin before 2.0.69 does not validate data when outputting it back in a CSV file, which could lead to CSV injection. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/376e2bc7-2eb9-4e0a-809c-158
E Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/376e2bc7-2eb9-4e0a-809c-1582940ebdc7
CVE ID: CVE-2022-3604 State: PUBLISHED Published: 2024-01-16T15:52:59.244Z Last Updated: 2025-06-11T17:12:46.580Z Vendors: Unknown Products: Contact Form Entries Problem Types: CWE-1236 Improper Neutralization of Formula Elements in a CSV File Description: The Contact Form Entries WordPress plugin before 1.3.0 does not validate data when its output in a CSV file, which could lead to CSV injection. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/300ebfcd-c500-464e-b919-acfeb72593de/
CVE ID: CVE-2022-3605 State: PUBLISHED Published: 2022-12-12T17:54:46.747Z Last Updated: 2025-04-22T14:54:28.508Z Vendors: Unknown Products: WP CSV Exporter Problem Types: CWE-1236 Improper Neutralization of Formula Elements in a CSV File Description: The WP CSV Exporter WordPress plugin before 1.3.7 does not properly escape the fields when exporting data as CSV, leading to a CSV injection vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/28ecdf61-e478-42c3-87c0-80a9912eadb2
CVE ID: CVE-2022-3606 State: PUBLISHED Published: 2022-10-19T00:00:00.000Z Last Updated: 2025-11-03T19:27:12.037Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: Linux Products: Kernel Problem Types: CWE-404 Description: A vulnerability was found in Linux Kernel. It has been classified as problematic. This affects the function find_prog_by_sec_insn of the file tools/lib/bpf/libbpf.c of the component BPF. The manipulation leads to null pointer dereference. It is recommended to apply a patch to fix this issue. The identifier VDB-211749 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - htt
ned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git/commit/?id=d0d382f95a9270dcf803539d6781d6bd67e3f5b2 - https://vuldb.com/?id.211749
CVE ID: CVE-2022-3607 State: PUBLISHED Published: 2022-10-19T00:00:00.000Z Last Updated: 2025-05-09T14:47:37.533Z Severity: MEDIUM (CVSS 6 CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N) Vendors: octoprint Products: octoprint/octoprint Problem Types: CWE-75 Description: Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in GitHub repository octoprint/octoprint prior to 1.8.3. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/2d1db3c9-93e8-4902-a55b-5ea53c22aa11 - https://github.com/octoprint/octoprint/commit/3cca3a43f3d085e9bbe5a5840c8255bb1b5d052e
CVE ID: CVE-2022-3608 State: PUBLISHED Published: 2022-10-19T00:00:00.000Z Last Updated: 2025-05-08T19:14:06.975Z Severity: HIGH (CVSS 7.2 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: thorsten Products: thorsten/phpmyfaq Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.2.0-alpha. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/8f0f3635-9d81-4c55-9826-2ba955c3a850 - https://github.com/thorsten/phpmyfaq/commit/37123edd50f854bd141e6fbe65221af2d5cf2677
CVE ID: CVE-2022-3609 State: PUBLISHED Published: 2022-12-12T17:54:48.616Z Last Updated: 2025-04-22T14:50:56.222Z Vendors: Unknown Products: GetYourGuide Ticketing Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The GetYourGuide Ticketing WordPress plugin before 1.0.4 does not sanitise and escape some parameters, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/b893cac2-6511-4e2a-9eff-baf0f3cc9d7e
CVE ID: CVE-2022-3610 State: PUBLISHED Published: 2022-11-28T13:47:12.872Z Last Updated: 2025-04-25T15:17:13.732Z Vendors: Unknown Products: Jeeng Push Notifications Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Jeeng Push Notifications WordPress plugin before 2.0.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/33b52dd7-613f-46e4-b8ee-beddd31689eb
CVE ID: CVE-2022-3611 State: PUBLISHED Published: 2023-10-27T19:05:01.038Z Last Updated: 2024-09-09T19:46:50.723Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L) Vendors: Lenovo Products: App Store Problem Types: CWE-200 Description: An information disclosure vulnerability has been identified in the Lenovo App Store which may allow some applications to gain unauthorized access to sensitive user data used by other unrelated applications. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://iknow.lenovo.com.cn/detail/205280.html
CVE ID: CVE-2022-3613 State: PUBLISHED Published: 2023-01-12T00:00:00.000Z Last Updated: 2025-04-08T15:06:58.671Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L) Vendors: GitLab Products: GitLab Problem Types: Uncontrolled resource consumption in GitLab Description: An issue has been discovered in GitLab CE/EE affecting all versions before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. A crafted Prometheus Server query can cause high resource consumption and may lead to Denial of Service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab
onal Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/378456 - https://hackerone.com/reports/1723106 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3613.json
CVE ID: CVE-2022-3614 State: PUBLISHED Published: 2023-01-03T00:00:00.000Z Last Updated: 2025-04-10T14:45:59.345Z Vendors: Octopus Deploy Products: Octopus Server Problem Types: Authentication Bypass Using an Alternate Path or Channel Description: In affected versions of Octopus Deploy users of certain browsers using AD to sign-in to Octopus Server were able to bypass authentication checks and be redirected to the configured redirect url without any validation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://advisories.octopus.com/post/2022/sa2022-26/
CVE ID: CVE-2022-3616 State: PUBLISHED Published: 2022-10-28T06:24:44.189Z Last Updated: 2025-05-05T19:19:50.911Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:H) Vendors: Cloudflare Products: OctoRPKI Problem Types: CWE-754, CWE-834 Description: Attackers can create long chains of CAs that would lead to OctoRPKI exceeding its max iterations parameter. In consequence it would cause the program to crash, preventing it from finishing the validation and leading to a denial of service. Credits to Donika Mirdita and Haya Shulman - Fraunhofer SIT, ATHENE, who discovered and reported this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichme
who discovered and reported this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/cloudflare/cfrpki/security/advisories/GHSA-pmw9-567p-68pc
CVE ID: CVE-2022-3618 State: PUBLISHED Published: 2022-11-21T00:00:00.000Z Last Updated: 2025-04-29T16:27:54.453Z Vendors: Unknown Products: Spacer Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Spacer WordPress plugin before 3.0.7 does not sanitize and escapes some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example, in multisite setup). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/2011dc7b-8e8c-4190-ab34-de288e14685b
CVE ID: CVE-2022-3619 State: PUBLISHED Published: 2022-10-20T00:00:00.000Z Last Updated: 2025-04-15T13:26:06.308Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: Linux Products: Kernel Problem Types: CWE-404 Description: A vulnerability has been found in Linux Kernel and classified as problematic. This vulnerability affects the function l2cap_recv_acldata of the file net/bluetooth/l2cap_core.c of the component Bluetooth. The manipulation leads to memory leak. It is recommended to apply a patch to fix this issue. VDB-211918 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: -
signed to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next.git/commit/?id=97097c85c088e11651146da32a4e1cdb9dfa6193 - https://vuldb.com/?id.211918
CVE ID: CVE-2022-3620 State: PUBLISHED Published: 2022-10-20T00:00:00.000Z Last Updated: 2025-04-15T13:25:57.357Z Severity: MEDIUM (CVSS 5.6 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: unspecified Products: Exim Problem Types: CWE-119 Description: A vulnerability was found in Exim and classified as problematic. This issue affects the function dmarc_dns_lookup of the file dmarc.c of the component DMARC Handler. The manipulation leads to use after free. The attack may be initiated remotely. The name of the patch is 12fb3842f81bcbd4a4519d5728f2d7e0e3ca1445. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-211919. Additional
commended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-211919. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.exim.org/exim.git/commit/12fb3842f81bcbd4a4519d5728f2d7e0e3ca1445 - https://vuldb.com/?id.211919 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XV2K2AWF62FSJ64B5CUZPFT4COK7P5PM/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/667V3ADXQ2MHUJMSXA3VZZEWLVSCIBEU/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EIH4W5R7SHTUEQFWWKB4TUO5YFZ
s://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EIH4W5R7SHTUEQFWWKB4TUO5YFZX64KV/
CVE ID: CVE-2022-3621 State: PUBLISHED Published: 2022-10-20T00:00:00.000Z Last Updated: 2025-04-15T13:25:48.504Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: Linux Products: Kernel Problem Types: CWE-404 Description: A vulnerability was found in Linux Kernel. It has been classified as problematic. Affected is the function nilfs_bmap_lookup_at_level of the file fs/nilfs2/inode.c of the component nilfs2. The manipulation leads to null pointer dereference. It is possible to launch the attack remotely. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-211920. Additional Analyst Notes: - CVE Program Container: -
fix this issue. The identifier of this vulnerability is VDB-211920. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git/commit/?id=21a87d88c2253350e115029f14fe2a10a7e6c856 - https://vuldb.com/?id.211920 - https://lists.debian.org/debian-lts-announce/2022/11/msg00001.html - https://lists.debian.org/debian-lts-announce/2022/12/msg00034.html
CVE ID: CVE-2022-3622 State: PUBLISHED Published: 2023-10-20T07:29:40.331Z Last Updated: 2024-09-11T15:54:05.817Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N) Vendors: pr-gateway Products: Blog2Social: Social Media Auto Post & Scheduler Problem Types: CWE-862 Missing Authorization Description: The Blog2Social plugin for WordPress is vulnerable to authorization bypass due to missing capability checks in versions up to, and including, 6.9.11. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to change some plugin settings intended to be modifiable by admins only. Additional Analyst Notes: - CVE Program Container: - CISA
some plugin settings intended to be modifiable by admins only. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f5b8d39c-d307-42c9-a972-29b5521a82a4?source=cve - https://plugins.trac.wordpress.org/browser/blog2social/tags/6.9.10/includes/B2S/Settings/Item.php#L116 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2795052%40blog2social&new=2795052%40blog2social&sfp_email=&sfph_mail= - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2796598%40blog2social&new=2796598%40blog2social&sfp_email=&sfph_mail=
CVE ID: CVE-2022-3623 State: PUBLISHED Published: 2022-10-20T00:00:00.000Z Last Updated: 2025-04-15T13:25:41.743Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Linux Products: Kernel Problem Types: CWE-362 Description: A vulnerability was found in Linux Kernel. It has been declared as problematic. Affected by this vulnerability is the function follow_page_pte of the file mm/gup.c of the component BPF. The manipulation leads to race condition. The attack can be launched remotely. It is recommended to apply a patch to fix this issue. The identifier VDB-211921 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vuln
tifier VDB-211921 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git/commit/?id=fac35ba763ed07ba93154c95ffc0c4a55023707f - https://vuldb.com/?id.211921 - https://www.debian.org/security/2023/dsa-5324 - https://lists.debian.org/debian-lts-announce/2023/03/msg00000.html
CVE ID: CVE-2022-3624 State: PUBLISHED Published: 2022-10-21T00:00:00.000Z Last Updated: 2025-04-15T13:25:35.576Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: Linux Products: Kernel Problem Types: CWE-404 Description: A vulnerability was found in Linux Kernel and classified as problematic. Affected by this issue is the function rlb_arp_xmit of the file drivers/net/bonding/bond_alb.c of the component IPsec. The manipulation leads to memory leak. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-211928. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.or
-211928. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next.git/commit/?id=4f5d33f4f798b1c6d92b613f0087f639d9836971 - https://vuldb.com/?id.211928
CVE ID: CVE-2022-3625 State: PUBLISHED Published: 2022-10-21T00:00:00 Last Updated: 2024-08-03T01:14:02.495Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Linux Products: Kernel Problem Types: CWE-119 Description: A vulnerability was found in Linux Kernel. It has been classified as critical. This affects the function devlink_param_set/devlink_param_get of the file net/core/devlink.c of the component IPsec. The manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The identifier VDB-211929 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/pub/scm/
to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next.git/commit/?id=6b4db2e528f650c7fb712961aac36455468d5902 - https://vuldb.com/?id.211929 - https://lists.debian.org/debian-lts-announce/2022/11/msg00001.html
CVE ID: CVE-2022-3626 State: PUBLISHED Published: 2022-10-21T00:00:00.000Z Last Updated: 2025-05-07T15:07:46.052Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) Vendors: libtiff Products: libtiff Problem Types: Out-of-bounds write in libtiff Description: LibTIFF 4.4.0 has an out-of-bounds write in _TIFFmemset in libtiff/tif_unix.c:340 when called from processCropSelections, tools/tiffcrop.c:7619, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 236b7191. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/libt
b7191. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/libtiff/libtiff/-/issues/426 - https://gitlab.com/libtiff/libtiff/-/commit/236b7191f04c60d09ee836ae13b50f812c841047 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3626.json - https://security.netapp.com/advisory/ntap-20230110-0001/ - https://lists.debian.org/debian-lts-announce/2023/01/msg00018.html