Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-25271 State: PUBLISHED Published: 2022-02-16T00:00:00 Last Updated: 2024-08-03T04:36:06.718Z Vendors: Drupal Products: Core Problem Types: CWE-20 Description: Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation. This could allow an attacker to inject disallowed values or overwrite data. Affected forms are uncommon, but in certain cases an attacker could alter critical or sensitive data. Additional Analyst Notes: - CVE Program Container: References: - https://www.drupal.org/sa-core-2022-003 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/
org/sa-core-2022-003 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HVKIOWSXL2RF2ULNAP7PHESYCFSZIJE3/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SGSY236PYSFYIEBRGDERLA7OSY6D7XL4/
CVE ID: CVE-2022-25273 State: PUBLISHED Published: 2023-04-26T00:00:00.000Z Last Updated: 2025-02-03T19:19:17.531Z Vendors: Drupal Products: Core Problem Types: Improper input validation Description: Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation. This could allow an attacker to inject disallowed values or overwrite data. Affected forms are uncommon, but in certain cases an attacker could alter critical or sensitive data. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-core-2022-008
CVE ID: CVE-2022-25274 State: PUBLISHED Published: 2023-04-26T00:00:00.000Z Last Updated: 2025-02-03T18:47:20.068Z Vendors: Drupal Products: Core Problem Types: Access bypass Description: Drupal 9.3 implemented a generic entity access API for entity revisions. However, this API was not completely integrated with existing permissions, resulting in some possible access bypass for users who have access to use revisions of content generally, but who do not have access to individual items of node and media content. This vulnerability only affects sites using Drupal's revision system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.drupal.org/s
stem. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-core-2022-009
CVE ID: CVE-2022-25275 State: PUBLISHED Published: 2023-04-26T00:00:00.000Z Last Updated: 2025-02-03T18:45:50.790Z Vendors: Drupal Products: Core Problem Types: Information Disclosure Description: In some situations, the Image module does not correctly check access to image files not stored in the standard public files directory when generating derivative images using the image styles system. Access to a non-public file is checked only if it is stored in the "private" file system. However, some contributed modules provide additional file systems, or schemes, which may lead to this vulnerability. This vulnerability is mitigated by the fact that it only applies when the site sets (Drupal 9) $c
to this vulnerability. This vulnerability is mitigated by the fact that it only applies when the site sets (Drupal 9) $config['image.settings']['allow_insecure_derivatives'] or (Drupal 7) $conf['image_allow_insecure_derivatives'] to TRUE. The recommended and default setting is FALSE, and Drupal core does not provide a way to change that in the admin UI. Some sites may require configuration changes following this security release. Review the release notes for your Drupal version if you have issues accessing files or image styles after updating. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-core-2022-012
CVE ID: CVE-2022-25276 State: PUBLISHED Published: 2023-04-26T00:00:00.000Z Last Updated: 2025-02-03T18:42:36.339Z Vendors: Drupal Products: Core Problem Types: Multiple vulnerabilities Description: The Media oEmbed iframe route does not properly validate the iframe domain setting, which allows embeds to be displayed in the context of the primary domain. Under certain circumstances, this could lead to cross-site scripting, leaked cookies, or other vulnerabilities. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-core-2022-015
CVE ID: CVE-2022-25277 State: PUBLISHED Published: 2023-04-26T00:00:00.000Z Last Updated: 2025-02-03T18:41:34.551Z Vendors: Drupal Products: Core Problem Types: Arbitrary PHP code execution Description: Drupal core sanitizes filenames with dangerous extensions upon upload (reference: SA-CORE-2020-012) and strips leading and trailing dots from filenames to prevent uploading server configuration files (reference: SA-CORE-2019-010). However, the protections for these two vulnerabilities previously did not work correctly together. As a result, if the site were configured to allow the upload of files with an htaccess extension, these files' filenames would not be properly sanitized. This could al
ow the upload of files with an htaccess extension, these files' filenames would not be properly sanitized. This could allow bypassing the protections provided by Drupal core's default .htaccess files and possible remote code execution on Apache web servers. This issue is mitigated by the fact that it requires a field administrator to explicitly configure a file field to allow htaccess as an extension (a restricted permission), or a contributed module or custom code that overrides allowed file uploads. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-core-2022-014
CVE ID: CVE-2022-25278 State: PUBLISHED Published: 2023-04-26T00:00:00.000Z Last Updated: 2025-02-03T18:40:32.316Z Vendors: Drupal Products: Core Problem Types: Access Bypass Description: Under certain circumstances, the Drupal core form API evaluates form element access incorrectly. This may lead to a user being able to alter data they should not have access to. No forms provided by Drupal core are known to be vulnerable. However, forms added through contributed or custom modules or themes may be affected. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-core-2022-013
CVE ID: CVE-2022-25290 State: PUBLISHED Published: 2022-02-24T04:56:49 Last Updated: 2024-08-03T04:36:06.662Z Vendors: n/a Products: n/a Problem Types: n/a Description: WatchGuard Firebox and XTM appliances allow an authenticated remote attacker with unprivileged credentials to retrieve certificate private keys. This vulnerability impacts Fireware OS before 12.7.2_U2, 12.x before 12.1.3_U8, and 12.2.x through 12.5.x before 12.5.9_U2. Additional Analyst Notes: - CVE Program Container: References: - https://www.watchguard.com/support/release-notes/fireware/12/en-US/EN_ReleaseNotes_Fireware_12_7_2/index.html#Fireware/en-US/resolved_issues.html
CVE ID: CVE-2022-25291 State: PUBLISHED Published: 2022-02-24T04:57:04 Last Updated: 2024-08-03T04:36:06.651Z Vendors: n/a Products: n/a Problem Types: n/a Description: An integer overflow in WatchGuard Firebox and XTM appliances allows an authenticated remote attacker to trigger a heap-based buffer overflow and potentially execute arbitrary code by initiating a firmware update with a malicious upgrade image. This vulnerability impacts Fireware OS before 12.7.2_U2, 12.x before 12.1.3_U8, and 12.2.x through 12.5.x before 12.5.9_U2. Additional Analyst Notes: - CVE Program Container: References: - https://www.watchguard.com/support/release-notes/fireware/12/en-US/EN_ReleaseNotes_Fireware_12_7_2
tainer: References: - https://www.watchguard.com/support/release-notes/fireware/12/en-US/EN_ReleaseNotes_Fireware_12_7_2/index.html#Fireware/en-US/resolved_issues.html
CVE ID: CVE-2022-25292 State: PUBLISHED Published: 2022-02-24T04:55:17 Last Updated: 2024-08-03T04:36:06.768Z Vendors: n/a Products: n/a Problem Types: n/a Description: A wgagent stack-based buffer overflow in WatchGuard Firebox and XTM appliances allows an authenticated remote attacker to potentially execute arbitrary code by initiating a firmware update with a malicious upgrade image. This vulnerability impacts Fireware OS before 12.7.2_U2, 12.x before 12.1.3_U8, and 12.2.x through 12.5.x before 12.5.9_U2. Additional Analyst Notes: - CVE Program Container: References: - https://cwe.mitre.org/data/definitions/121.html - https://www.watchguard.com/support/release-notes/fireware/12/en-US/EN_R
ttps://cwe.mitre.org/data/definitions/121.html - https://www.watchguard.com/support/release-notes/fireware/12/en-US/EN_ReleaseNotes_Fireware_12_7_2/index.html#Fireware/en-US/resolved_issues.html
CVE ID: CVE-2022-25293 State: PUBLISHED Published: 2022-02-24T04:55:47 Last Updated: 2024-08-03T04:36:06.871Z Vendors: n/a Products: n/a Problem Types: n/a Description: A systemd stack-based buffer overflow in WatchGuard Firebox and XTM appliances allows an authenticated remote attacker to potentially execute arbitrary code by initiating a firmware update with a malicious upgrade image. This vulnerability impacts Fireware OS before 12.7.2_U2, 12.x before 12.1.3_U8, and 12.2.x through 12.5.x before 12.5.9_U2. Additional Analyst Notes: - CVE Program Container: References: - https://cwe.mitre.org/data/definitions/121.html - https://www.watchguard.com/support/release-notes/fireware/12/en-US/EN_R
CVE ID: CVE-2022-25294 State: PUBLISHED Published: 2022-03-07T17:54:08 Last Updated: 2024-08-03T04:36:06.653Z Vendors: n/a Products: n/a Problem Types: n/a Description: Proofpoint Insider Threat Management Agent for Windows relies on an inherently dangerous function that could enable an unprivileged local Windows user to run arbitrary code with SYSTEM privileges. All versions prior to 7.12.1 are affected. Agents for MacOS and Linux and Cloud are unaffected. Proofpoint has released fixed software version 7.12.1. The fixed software versions are available through the customer support portal. Additional Analyst Notes: - CVE Program Container: References: - https://www.proofpoint.com/us/security/
support portal. Additional Analyst Notes: - CVE Program Container: References: - https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2022-0001
CVE ID: CVE-2022-25295 State: PUBLISHED Published: 2022-09-11T13:45:20.564802Z Last Updated: 2024-09-16T17:29:06.682Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:U/RC:C) Vendors: n/a Products: github.com/gophish/gophish Problem Types: Open Redirect Description: This affects the package github.com/gophish/gophish before 0.12.0. The Open Redirect vulnerability exists in the next query parameter. The application uses url.Parse(r.FormValue("next")) to extract path and eventually redirect user to a relative URL, but if next parameter starts with multiple backslashes like \\\\\\example.com, browser will redirect user to http://example.com. Additional Analyst Note
h multiple backslashes like \\\\\\example.com, browser will redirect user to http://example.com. Additional Analyst Notes: - CVE Program Container: References: - https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGOPHISHGOPHISH-2404177 - https://github.com/gophish/gophish/pull/2262
CVE ID: CVE-2022-25296 State: PUBLISHED Published: 2022-03-17T11:20:16.628498Z Last Updated: 2024-09-17T01:16:33.514Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C) Vendors: n/a Products: bodymen Problem Types: Prototype Pollution Description: The package bodymen from 0.0.0 are vulnerable to Prototype Pollution via the handler function which could be tricked into adding or modifying properties of Object.prototype using a __proto__ payload. **Note:** This vulnerability derives from an incomplete fix to [CVE-2019-10792](https://security.snyk.io/vuln/SNYK-JS-BODYMEN-548897) Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/v
.snyk.io/vuln/SNYK-JS-BODYMEN-548897) Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-BODYMEN-2342623
CVE ID: CVE-2022-25297 State: PUBLISHED Published: 2022-02-21T08:00:17.382394Z Last Updated: 2024-09-16T17:03:37.145Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: n/a Products: drogonframework/drogon Problem Types: Arbitrary File Write Description: This affects the package drogonframework/drogon before 1.7.5. The unsafe handling of file names during upload using HttpFile::save() method may enable attackers to write files to arbitrary locations outside the designated target folder. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-UNMANAGED-DROGONFRAMEWORKDROGON-2407243 - https://github.com/drogonframework/drogon/comm
es: - https://snyk.io/vuln/SNYK-UNMANAGED-DROGONFRAMEWORKDROGON-2407243 - https://github.com/drogonframework/drogon/commit/3c785326c63a34aa1799a639ae185bc9453cb447 - https://github.com/drogonframework/drogon/pull/1174
CVE ID: CVE-2022-25298 State: PUBLISHED Published: 2022-02-18T12:55:13.899001Z Last Updated: 2024-09-16T20:07:53.008Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:U/RC:C) Vendors: n/a Products: sprinfall/webcc Problem Types: Path Traversal Description: This affects the package sprinfall/webcc before 0.3.0. It is possible to traverse directories to fetch arbitrary files from the server. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-UNMANAGED-SPRINFALLWEBCC-2404182 - https://github.com/sprinfall/webcc/commit/55a45fd5039061d5cc62e9f1b9d1f7e97a15143f
CVE ID: CVE-2022-25299 State: PUBLISHED Published: 2022-02-18T12:55:21.998786Z Last Updated: 2024-09-16T17:52:54.754Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: n/a Products: cesanta/mongoose Problem Types: Arbitrary File Write Description: This affects the package cesanta/mongoose before 7.6. The unsafe handling of file names during upload using mg_http_upload() method may enable attackers to write files to arbitrary locations outside the designated target folder. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-UNMANAGED-CESANTAMONGOOSE-2404180 - https://github.com/cesanta/mongoose/commit/c65c8fdaaa257e0487a
s://snyk.io/vuln/SNYK-UNMANAGED-CESANTAMONGOOSE-2404180 - https://github.com/cesanta/mongoose/commit/c65c8fdaaa257e0487ab0aaae9e8f6b439335945
CVE ID: CVE-2022-25301 State: PUBLISHED Published: 2022-05-01T16:25:12.415704Z Last Updated: 2024-09-17T04:04:16.972Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H/E:P) Vendors: n/a Products: jsgui-lang-essentials Problem Types: Prototype Pollution Description: All versions of package jsgui-lang-essentials are vulnerable to Prototype Pollution due to allowing all Object attributes to be altered, including their magical attributes such as proto, constructor and prototype. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-JSGUILANGESSENTIALS-2316897 - https://github.com/metabench/jsgui-lang-essentials/issues/1
CVE ID: CVE-2022-25302 State: PUBLISHED Published: 2022-08-23T05:00:17.555590Z Last Updated: 2024-09-17T03:53:54.184Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P) Vendors: n/a Products: ASNeG/OpcUaStack Problem Types: Denial of Service (DoS) Description: All versions of package asneg/opcuastack are vulnerable to Denial of Service (DoS) due to a missing handler for failed casting when unvalidated data is forwarded to boost::get function in OpcUaNodeIdBase.h. Exploiting this vulnerability is possible when sending a specifically crafted OPC UA message with a special encoded NodeId. Additional Analyst Notes: - CVE Program Container: References: - https://security.sn
sage with a special encoded NodeId. Additional Analyst Notes: - CVE Program Container: References: - https://security.snyk.io/vuln/SNYK-UNMANAGED-ASNEGOPCUASTACK-2988732
CVE ID: CVE-2022-25303 State: PUBLISHED Published: 2022-07-12T14:20:11.761926Z Last Updated: 2024-09-16T19:14:22.978Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P) Vendors: n/a Products: whoogle-search Problem Types: Cross-site Scripting (XSS) Description: The package whoogle-search before 0.7.2 are vulnerable to Cross-site Scripting (XSS) via the query string parameter q. In the case where it does not contain the http string, it is used to build the error_message that is then rendered in the error.html template, using the [flask.render_template](https://flask.palletsprojects.com/en/2.1.x/api/flask.render_template) function. However, the error_message is render
te](https://flask.palletsprojects.com/en/2.1.x/api/flask.render_template) function. However, the error_message is rendered using the [| safe filter](https://jinja.palletsprojects.com/en/3.1.x/templates/working-with-automatic-escaping), meaning the user input is not escaped. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-PYTHON-WHOOGLESEARCH-2803306 - https://github.com/benbusby/whoogle-search/blob/6d362ca5c7a00d2f691a2512461c5dfbfc01cbb3/app/routes.py%23L448 - https://github.com/benbusby/whoogle-search/commit/abc30d7da3b5c67be7ce84d4699f327442d44606
CVE ID: CVE-2022-25304 State: PUBLISHED Published: 2022-08-23T05:05:11.904697Z Last Updated: 2024-09-17T02:48:11.272Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P) Vendors: n/a Products: opcua, asyncua Problem Types: Denial of Service (DoS) Description: All versions of package opcua; all versions of package asyncua are vulnerable to Denial of Service (DoS) due to a missing limitation on the number of received chunks - per single session or in total for all concurrent sessions. An attacker can exploit this vulnerability by sending an unlimited number of huge chunks (e.g. 2GB each) without sending the Final closing chunk. Additional Analyst Notes: - CVE Program Con
mber of huge chunks (e.g. 2GB each) without sending the Final closing chunk. Additional Analyst Notes: - CVE Program Container: References: - https://security.snyk.io/vuln/SNYK-PYTHON-OPCUA-2988730 - https://security.snyk.io/vuln/SNYK-PYTHON-ASYNCUA-2988731 - https://github.com/FreeOpcUa/python-opcua/issues/1466
CVE ID: CVE-2022-25305 State: PUBLISHED Published: 2022-02-24T18:27:11.000Z Last Updated: 2025-02-07T20:49:45.849Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: WP Statistics Products: WP Statistics Problem Types: CWE-79 Description: The WP Statistics WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the IP parameter found in the ~/includes/class-wp-statistics-ip.php file which allows attackers to inject arbitrary web scripts onto several pages that execute when site administrators view a sites statistics, in versions up to and including 13.1.5. Additional Analyst Notes: - CVE Program Container: - CISA AD
a sites statistics, in versions up to and including 13.1.5. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2679983%40wp-statistics&new=2679983%40wp-statistics&sfp_email=&sfph_mail= - https://gist.github.com/Xib3rR4dAr/af90cef7867583ab2de4cccea2a8c87d - https://www.wordfence.com/vulnerability-advisories/#CVE-2022-25305
CVE ID: CVE-2022-25306 State: PUBLISHED Published: 2022-02-24T18:27:09.000Z Last Updated: 2025-01-31T18:54:56.482Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: WP Statistics Products: WP Statistics Problem Types: CWE-79 Description: The WP Statistics WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the browser parameter found in the ~/includes/class-wp-statistics-visitor.php file which allows attackers to inject arbitrary web scripts onto several pages that execute when site administrators view a sites statistics, in versions up to and including 13.1.5. Additional Analyst Notes: - CVE Program Container:
tors view a sites statistics, in versions up to and including 13.1.5. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gist.github.com/Xib3rR4dAr/89fc87ea1d62348c21c99fc11a3bfd88 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2679983%40wp-statistics&new=2679983%40wp-statistics&sfp_email=&sfph_mail= - https://www.wordfence.com/vulnerability-advisories/#CVE-2022-25306
CVE ID: CVE-2022-25307 State: PUBLISHED Published: 2022-02-24T18:27:12.000Z Last Updated: 2025-02-07T20:49:32.081Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: WP Statistics Products: WP Statistics Problem Types: CWE-79 Description: The WP Statistics WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the platform parameter found in the ~/includes/class-wp-statistics-hits.php file which allows attackers to inject arbitrary web scripts onto several pages that execute when site administrators view a sites statistics, in versions up to and including 13.1.5. Additional Analyst Notes: - CVE Program Container: -
rs view a sites statistics, in versions up to and including 13.1.5. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2679983%40wp-statistics&new=2679983%40wp-statistics&sfp_email=&sfph_mail= - https://gist.github.com/Xib3rR4dAr/8090a6d026d4601083cff80aa80de7eb - https://www.wordfence.com/vulnerability-advisories/#CVE-2022-25307
CVE ID: CVE-2022-25308 State: PUBLISHED Published: 2022-09-06T17:18:52 Last Updated: 2024-08-03T04:36:06.972Z Vendors: n/a Products: fribidi Problem Types: CWE-121 Description: A stack-based buffer overflow flaw was found in the Fribidi package. This flaw allows an attacker to pass a specially crafted file to the Fribidi application, which leads to a possible memory leak or a denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/fribidi/fribidi/issues/181 - https://bugzilla.redhat.com/show_bug.cgi?id=2047890 - https://github.com/fribidi/fribidi/pull/184 - https://access.redhat.com/security/cve/CVE-2022-25308
CVE ID: CVE-2022-25309 State: PUBLISHED Published: 2022-09-06T17:18:52 Last Updated: 2024-08-03T04:36:06.823Z Vendors: n/a Products: fribidi Problem Types: CWE-122 Description: A heap-based buffer overflow flaw was found in the Fribidi package and affects the fribidi_cap_rtl_to_unicode() function of the fribidi-char-sets-cap-rtl.c file. This flaw allows an attacker to pass a specially crafted file to the Fribidi application with the '--caprtl' option, leading to a crash and causing a denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/fribidi/fribidi/issues/182 - https://bugzilla.redhat.com/show_bug.cgi?id=2047896 - https://github.com/fribid
/github.com/fribidi/fribidi/issues/182 - https://bugzilla.redhat.com/show_bug.cgi?id=2047896 - https://github.com/fribidi/fribidi/commit/f22593b82b5d1668d1997dbccd10a9c31ffea3b3 - https://access.redhat.com/security/cve/CVE-2022-25309
CVE ID: CVE-2022-25310 State: PUBLISHED Published: 2022-09-06T17:18:52 Last Updated: 2024-08-03T04:36:06.822Z Vendors: n/a Products: fribidi Problem Types: CWE-119 Description: A segmentation fault (SEGV) flaw was found in the Fribidi package and affects the fribidi_remove_bidi_marks() function of the lib/fribidi.c file. This flaw allows an attacker to pass a specially crafted file to Fribidi, leading to a crash and causing a denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/fribidi/fribidi/issues/183 - https://bugzilla.redhat.com/show_bug.cgi?id=2047923 - https://github.com/fribidi/fribidi/pull/186 - https://access.redhat.com/security/cve
edhat.com/show_bug.cgi?id=2047923 - https://github.com/fribidi/fribidi/pull/186 - https://access.redhat.com/security/cve/CVE-2022-25310