Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-0534 State: PUBLISHED Published: 2022-02-09T22:03:41 Last Updated: 2024-08-02T23:32:46.162Z Vendors: n/a Products: htmldoc Problem Types: CWE-125 Description: A vulnerability was found in htmldoc version 1.9.15 where the stack out-of-bounds read takes place in gif_get_code() and occurs when opening a malicious GIF file, which can result in a crash (segmentation fault). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/michaelrsweet/htmldoc/issues/463 - https://github.com/michaelrsweet/htmldoc/commit/312f0f9c12f26fbe015cd0e6cefa40e4b99017d9 - https://lists.debian.org/debian-lts-announce/2022/02/msg00022.html
CVE ID: CVE-2022-0535 State: PUBLISHED Published: 2022-03-07T08:16:51 Last Updated: 2024-08-02T23:32:45.984Z Vendors: Unknown Products: E2Pdf – Export To Pdf Tool for WordPress Problem Types: CWE-79 Description: The E2Pdf WordPress plugin before 1.16.45 does not sanitise and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/a4162e96-a3c5-4f38-a60b-aa3ed9508985 - https://plugins.trac.wordpress.org/changeset/2675049/e2pdf
CVE ID: CVE-2022-0536 State: PUBLISHED Published: 2022-02-09T10:45:10 Last Updated: 2024-08-02T23:32:46.161Z Severity: LOW (CVSS 2.6 CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: follow-redirects Products: follow-redirects/follow-redirects Problem Types: CWE-212 Description: Improper Removal of Sensitive Information Before Storage or Transfer in NPM follow-redirects prior to 1.14.8. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/7cf2bf90-52da-4d59-8028-a73b132de0db - https://github.com/follow-redirects/follow-redirects/commit/62e546a99c07c3ee5e4e0718c84a6ca127c5c445
CVE ID: CVE-2022-0537 State: PUBLISHED Published: 2022-04-04T15:35:46 Last Updated: 2024-08-02T23:32:46.208Z Vendors: Unknown Products: MapPress Maps for WordPress Problem Types: CWE-434 Description: The MapPress Maps for WordPress plugin before 2.73.13 allows a high privileged user to bypass the DISALLOW_FILE_EDIT and DISALLOW_FILE_MODS settings and upload arbitrary files to the site through the "ajax_save" function. The file is written relative to the current 's stylesheet directory, and a .php file extension is added. No validation is performed on the content of the file, triggering an RCE vulnerability by uploading a web shell. Further the name parameter is not sanitized, allowing the pa
, triggering an RCE vulnerability by uploading a web shell. Further the name parameter is not sanitized, allowing the payload to be uploaded to any directory to which the server has write access. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/abfbba70-5158-4990-98e5-f302361db367
CVE ID: CVE-2022-0538 State: PUBLISHED Published: 2022-02-09T13:30:15 Last Updated: 2024-08-02T23:32:46.169Z Vendors: Jenkins project Products: Jenkins Description: Jenkins 2.333 and earlier, LTS 2.319.2 and earlier defines custom XStream converters that have not been updated to apply the protections for the vulnerability CVE-2021-43859 and allow unconstrained resource usage. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-02-09/#SECURITY-2602 - http://www.openwall.com/lists/oss-security/2022/02/09/1
CVE ID: CVE-2022-0539 State: PUBLISHED Published: 2022-02-09T14:05:11 Last Updated: 2024-08-02T23:32:46.335Z Severity: MEDIUM (CVSS 6.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: ptrofimov Products: ptrofimov/beanstalk_console Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in Packagist ptrofimov/beanstalk_console prior to 1.7.14. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/5f41b182-dda2-4c6f-9668-2a9afaed53af - https://github.com/ptrofimov/beanstalk_console/commit/5aea5f912f6e6d19dedb1fdfc25a29a2e1fc1694
CVE ID: CVE-2022-0540 State: PUBLISHED Published: 2022-04-20T18:30:17.641544Z Last Updated: 2024-10-24T16:54:19.795Z Vendors: Atlassian Products: Jira Core Server, Jira Software Server, Jira Software Data Center, Jira Service Management Server, Jira Service Management Data Center Problem Types: Improper Authentication Description: A vulnerability in Jira Seraph allows a remote, unauthenticated attacker to bypass authentication by sending a specially crafted HTTP request. This affects Atlassian Jira Server and Data Center versions before 8.13.18, versions 8.14.0 and later before 8.20.6, and versions 8.21.0 and later before 8.22.0. This also affects Atlassian Jira Service Management Server and
fore 8.20.6, and versions 8.21.0 and later before 8.22.0. This also affects Atlassian Jira Service Management Server and Data Center versions before 4.13.18, versions 4.14.0 and later before 4.20.6, and versions 4.21.0 and later before 4.22.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://confluence.atlassian.com/display/JIRA/Jira+Security+Advisory+2022-04-20 - https://jira.atlassian.com/browse/JRASERVER-73650 - https://jira.atlassian.com/browse/JSDSERVER-11224
CVE ID: CVE-2022-0541 State: PUBLISHED Published: 2022-04-25T15:50:59 Last Updated: 2024-08-02T23:32:46.170Z Vendors: Unknown Products: flo-launch Problem Types: CWE-284 Description: The flo-launch WordPress plugin before 2.4.1 injects code into wp-config.php when creating a cloned site, allowing any attacker to initiate a new site install by setting the flo_custom_table_prefix cookie to an arbitrary value. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/822cac2c-decd-4aa4-9e8e-1ba2d0c080ce
CVE ID: CVE-2022-0542 State: PUBLISHED Published: 2022-08-19T17:55:09 Last Updated: 2024-08-02T23:32:46.113Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: chatwoot Products: chatwoot/chatwoot Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - DOM in GitHub repository chatwoot/chatwoot prior to 2.7.0. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/e6469ba6-03a2-4b17-8b4e-8932ecd0f7ac - https://github.com/chatwoot/chatwoot/commit/dd1fe4f93a6fbafa1d1eed87ac7d4143e701ec08
CVE ID: CVE-2022-0543 State: PUBLISHED Published: 2022-02-18T19:25:16.932Z Last Updated: 2025-10-21T23:15:45.813Z Vendors: Debian Products: redis Problem Types: Lua sandbox escape Description: It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific) Lua sandbox escape, which could result in remote code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugs.debian.org/1005787 - https://www.ubercomp.com/posts/2022-01-20_redis_on_debian_rce - https://lists.debian.org/debian-security-announce/2022/msg00048.html - https://www.debian.org/security/2022/dsa-5081 - https://secur
s.debian.org/debian-security-announce/2022/msg00048.html - https://www.debian.org/security/2022/dsa-5081 - https://security.netapp.com/advisory/ntap-20220331-0004/ - http://packetstormsecurity.com/files/166885/Redis-Lua-Sandbox-Escape.html
CVE ID: CVE-2022-0544 State: PUBLISHED Published: 2022-02-24T18:27:15 Last Updated: 2024-08-02T23:32:46.106Z Vendors: n/a Products: Blender Problem Types: CWE-191 Description: An integer underflow in the DDS loader of Blender leads to an out-of-bounds read, possibly allowing an attacker to read sensitive data using a crafted DDS image file. This flaw affects Blender versions prior to 2.83.19, 2.93.8 and 3.1. Additional Analyst Notes: - CVE Program Container: References: - https://developer.blender.org/T94661 - https://lists.debian.org/debian-lts-announce/2022/06/msg00021.html - https://www.debian.org/security/2022/dsa-5176
CVE ID: CVE-2022-0545 State: PUBLISHED Published: 2022-02-24T18:27:16 Last Updated: 2024-08-02T23:32:46.403Z Vendors: n/a Products: Blender Problem Types: CWE-190 Description: An integer overflow in the processing of loaded 2D images leads to a write-what-where vulnerability and an out-of-bounds read vulnerability, allowing an attacker to leak sensitive information or achieve code execution in the context of the Blender process when a specially crafted image file is loaded. This flaw affects Blender versions prior to 2.83.19, 2.93.8 and 3.1. Additional Analyst Notes: - CVE Program Container: References: - https://developer.blender.org/T94629 - https://lists.debian.org/debian-lts-announce/202
Program Container: References: - https://developer.blender.org/T94629 - https://lists.debian.org/debian-lts-announce/2022/06/msg00021.html - https://www.debian.org/security/2022/dsa-5176
CVE ID: CVE-2022-0546 State: PUBLISHED Published: 2022-02-24T18:27:17 Last Updated: 2024-08-02T23:32:45.994Z Vendors: n/a Products: Blender Problem Types: CWE-190 Description: A missing bounds check in the image loader used in Blender 3.x and 2.93.8 leads to out-of-bounds heap access, allowing an attacker to cause denial of service, memory corruption or potentially code execution. Additional Analyst Notes: - CVE Program Container: References: - https://developer.blender.org/T94572 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GIZADV3AHTWZ2YKEFTVLNK3K4F4KTYLM/ - https://lists.debian.org/debian-lts-announce/2022/06/msg00021.html - https://ww
sage/GIZADV3AHTWZ2YKEFTVLNK3K4F4KTYLM/ - https://lists.debian.org/debian-lts-announce/2022/06/msg00021.html - https://www.debian.org/security/2022/dsa-5176
CVE ID: CVE-2022-0547 State: PUBLISHED Published: 2022-03-18T18:00:20.000Z Last Updated: 2025-11-03T20:34:30.191Z Vendors: n/a Products: OpenVPN Problem Types: CWE-305 Description: OpenVPN 2.1 until v2.4.12 and v2.5.6 may enable authentication bypass in external authentication plug-ins when more than one of them makes use of deferred authentication replies, which allows an external user to be granted access with only partially correct credentials. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://community.openvpn.net/openvpn/wiki/SecurityAnnouncements - https://community.openvpn.net/openvpn/wiki/CVE-2022-0547 - https://openvpn.net/community-do
wiki/SecurityAnnouncements - https://community.openvpn.net/openvpn/wiki/CVE-2022-0547 - https://openvpn.net/community-downloads/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R36OYC5SJ6FLPVAYJYYT4MOJ2I7MGYFF/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GFXJ35WKPME4HYNQCQNAJHLCZOJL2SAE/ - https://lists.debian.org/debian-lts-announce/2022/05/msg00002.html
CVE ID: CVE-2022-0549 State: PUBLISHED Published: 2022-03-28T18:53:00 Last Updated: 2024-08-02T23:32:46.433Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: GitLab Products: GitLab Problem Types: Improper access control in GitLab Description: An issue has been discovered in GitLab CE/EE affecting all versions before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. Under certain conditions, GitLab REST API may allow unprivileged users to add other users to groups even if that is not possible to do through the Web UI. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-
le to do through the Web UI. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/342448 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0549.json
CVE ID: CVE-2022-0550 State: PUBLISHED Published: 2022-03-24T14:15:20 Last Updated: 2024-09-20T10:26:05.832Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Nozomi Networks Products: Guardian, CMC Problem Types: CWE-20 Description: Improper Input Validation vulnerability in custom report logo upload in Nozomi Networks Guardian, and CMC allows an authenticated attacker with admin or report manager roles to execute unattended commands on the appliance using web server user privileges. This issue affects: Nozomi Networks Guardian versions prior to 22.0.0. Nozomi Networks CMC versions prior to 22.0.0. Additional Analyst Notes: - CVE Program Container: References:
to 22.0.0. Nozomi Networks CMC versions prior to 22.0.0. Additional Analyst Notes: - CVE Program Container: References: - https://security.nozominetworks.com/NN-2022:2-01
CVE ID: CVE-2022-0551 State: PUBLISHED Published: 2022-03-24T14:15:22 Last Updated: 2024-09-20T10:34:31.686Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Nozomi Networks Products: Guardian, CMC Problem Types: CWE-20 Description: Improper Input Validation vulnerability in project file upload in Nozomi Networks Guardian and CMC allows an authenticated attacker with admin or import manager roles to execute unattended commands on the appliance using web server user privileges. This issue affects: Nozomi Networks Guardian versions prior to 22.0.0. Nozomi Networks CMC versions prior to 22.0.0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Conta
.0. Nozomi Networks CMC versions prior to 22.0.0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://security.nozominetworks.com/NN-2022:2-02
CVE ID: CVE-2022-0552 State: PUBLISHED Published: 2022-04-11T19:38:32 Last Updated: 2024-08-02T23:32:46.206Z Vendors: n/a Products: origin-aggregated-logging/elasticsearch Problem Types: CWE-444 Description: A flaw was found in the original fix for the netty-codec-http CVE-2021-21409, where the OpenShift Logging openshift-logging/elasticsearch6-rhel8 container was incomplete. The vulnerable netty-codec-http maven package was not removed from the image content. This flaw affects origin-aggregated-logging versions 3.11. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2052539 - https://access.redhat.com/security/cve/CVE-2021-21409 - h
ences: - https://bugzilla.redhat.com/show_bug.cgi?id=2052539 - https://access.redhat.com/security/cve/CVE-2021-21409 - https://github.com/openshift/origin-aggregated-logging/commit/d6b72d6c32e7c06b65324294d10406546734004d
CVE ID: CVE-2022-0553 State: PUBLISHED Published: 2023-01-11T00:00:00.000Z Last Updated: 2025-04-09T13:52:59.802Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: zephyrproject-rtos Products: zephyr Problem Types: CWE-200 Description: There is no check to see if slot 0 is being uploaded from the device to the host. When using encrypted images this means the unencrypted firmware can be retrieved easily. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-wrj2-9vj9-rrcp
CVE ID: CVE-2022-0554 State: PUBLISHED Published: 2022-02-10T00:00:00 Last Updated: 2024-08-02T23:32:46.316Z Severity: HIGH (CVSS 8.4 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: vim Products: vim/vim Problem Types: CWE-823 Description: Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/7e8f6cd0-b5ee-48a2-8255-6a86f4c46c71 - https://github.com/vim/vim/commit/e3537aec2f8d6470010547af28dcbd83d41461b8 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7ZLEHVP4LNAGER4ZDGUDS5V5YVQD6INF/ - https://lists.debian.org/debian-lt
ackage-announce%40lists.fedoraproject.org/message/7ZLEHVP4LNAGER4ZDGUDS5V5YVQD6INF/ - https://lists.debian.org/debian-lts-announce/2022/03/msg00018.html - https://security.gentoo.org/glsa/202208-32 - https://support.apple.com/kb/HT213488 - http://seclists.org/fulldisclosure/2022/Oct/41 - http://seclists.org/fulldisclosure/2022/Oct/28 - https://lists.debian.org/debian-lts-announce/2022/11/msg00009.html
CVE ID: CVE-2022-0555 State: PUBLISHED Published: 2024-06-03T18:17:35.956Z Last Updated: 2024-08-02T23:32:46.539Z Vendors: Canonical Ltd. Products: subiquity Description: Subiquity Shows Guided Storage Passphrase in Plaintext with Read-all Permissions Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugs.launchpad.net/subiquity/+bug/1960162 - https://www.cve.org/CVERecord?id=CVE-2022-0555 - https://github.com/canonical/subiquity/pull/1181 - https://github.com/canonical/subiquity/pull/1182
CVE ID: CVE-2022-0556 State: PUBLISHED Published: 2022-04-11T11:50:16 Last Updated: 2024-08-02T23:32:46.472Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Zyxel Products: Zyxel AP Configurator (ZAC) Problem Types: CWE-269 Description: A local privilege escalation vulnerability caused by incorrect permission assignment in some directories of the Zyxel AP Configurator (ZAC) version 1.1.4, which could allow an attacker to execute arbitrary code as a local administrator. Additional Analyst Notes: - CVE Program Container: References: - https://www.zyxel.com/support/Zyxel-security-advisory-for-local-privilege-escalation-vulnerability-of-AP-Configurator.shtml
CVE ID: CVE-2022-0557 State: PUBLISHED Published: 2022-02-11T08:45:10 Last Updated: 2024-08-02T23:32:46.256Z Severity: HIGH (CVSS 8.1 CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N) Vendors: microweber Products: microweber/microweber Problem Types: CWE-78 Description: OS Command Injection in Packagist microweber/microweber prior to 1.2.11. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/660c89af-2de5-41bc-aada-9e4e78142db8 - https://github.com/microweber/microweber/commit/0a7e5f1d81de884861ca677ee1aaac31f188d632 - http://packetstormsecurity.com/files/166077/Microweber-1.2.11-Shell-Upload.html - https://www.exploit-db.com/exploits/50768
CVE ID: CVE-2022-0558 State: PUBLISHED Published: 2022-02-10T09:40:10 Last Updated: 2024-08-02T23:32:46.187Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: microweber Products: microweber/microweber Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in Packagist microweber/microweber prior to 1.2.11. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/8fffc95f-14ae-457b-aecc-be4716a8b91c - https://github.com/microweber/microweber/commit/14a1bb971bcb8b5456c2bf0020c3018907a2704d
CVE ID: CVE-2022-0559 State: PUBLISHED Published: 2022-02-16T10:15:11 Last Updated: 2024-08-02T23:32:46.446Z Severity: HIGH (CVSS 8.4 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: radareorg Products: radareorg/radare2 Problem Types: CWE-416 Description: Use After Free in GitHub repository radareorg/radare2 prior to 5.6.2. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/aa80adb7-e900-44a5-ad05-91f3ccdfc81e - https://github.com/radareorg/radare2/commit/b5cb90b28ec71fda3504da04e3cc94a362807f5e - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E6YBRQ3UCFWJVSOYIKPVUDASZ544TFND/ - https://lists.fe
CVE ID: CVE-2022-0560 State: PUBLISHED Published: 2022-02-11T12:55:11 Last Updated: 2024-08-02T23:32:46.349Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Vendors: microweber Products: microweber/microweber Problem Types: CWE-601 Description: Open Redirect in Packagist microweber/microweber prior to 1.2.11. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/c9d586e7-0fa1-47ab-a2b3-b890e8dc9b25 - https://github.com/microweber/microweber/commit/72d4b12cc487f56a859a8570ada4efb77b4b8c63
CVE ID: CVE-2022-0561 State: PUBLISHED Published: 2022-02-11T00:00:00 Last Updated: 2024-08-02T23:32:46.253Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: libtiff Products: libtiff Problem Types: Incorrect calculation of buffer size in libtiff Description: Null source pointer passed as an argument to memcpy() function within TIFFFetchStripThing() in tif_dirread.c in libtiff versions from 3.9.0 to 4.3.0 could lead to Denial of Service via crafted TIFF file. For users that compile libtiff from sources, the fix is available with commit eecb0712. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/libtiff/libtiff/-/issues/362 -
712. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/libtiff/libtiff/-/issues/362 - https://gitlab.com/freedesktop-sdk/mirrors/gitlab/libtiff/libtiff/-/commit/eecb0712f4c3a5b449f70c57988260a667ddbdef - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0561.json - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DZEHZ35XVO2VBZ4HHCMM6J6TQIDSBQOM/ - https://lists.debian.org/debian-lts-announce/2022/03/msg00001.html - https://security.netapp.com/advisory/ntap-20220318-0001/ - https://www.debian.org/security/2022/dsa-5108 - https://security.gentoo.org/glsa/202210-10
CVE ID: CVE-2022-0562 State: PUBLISHED Published: 2022-02-11T00:00:00 Last Updated: 2024-08-02T23:32:46.296Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: libtiff Products: libtiff Problem Types: Null pointer dereference in libtiff Description: Null source pointer passed as an argument to memcpy() function within TIFFReadDirectory() in tif_dirread.c in libtiff versions from 4.0 to 4.3.0 could lead to Denial of Service via crafted TIFF file. For users that compile libtiff from sources, a fix is available with commit 561599c. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/libtiff/libtiff/-/issues/362 - https://gitlab.com/
lyst Notes: - CVE Program Container: References: - https://gitlab.com/libtiff/libtiff/-/issues/362 - https://gitlab.com/gitlab-org/build/omnibus-mirror/libtiff/-/commit/561599c99f987dc32ae110370cfdd7df7975586b - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0562.json - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DZEHZ35XVO2VBZ4HHCMM6J6TQIDSBQOM/ - https://lists.debian.org/debian-lts-announce/2022/03/msg00001.html - https://security.netapp.com/advisory/ntap-20220318-0001/ - https://www.debian.org/security/2022/dsa-5108 - https://security.gentoo.org/glsa/202210-10
CVE ID: CVE-2022-0563 State: PUBLISHED Published: 2022-02-21T00:00:00.000Z Last Updated: 2025-06-09T15:39:20.619Z Vendors: n/a Products: util-linux Problem Types: CWE-209 Description: A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4. Additional Analyst Notes: - CVE Program Contai
vilege escalation. This flaw affects util-linux versions prior to 2.37.4. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w%40ws.net.home/T/#u - https://security.netapp.com/advisory/ntap-20220331-0002/ - https://security.gentoo.org/glsa/202401-08