Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
rences: - https://gitlab.com/libtiff/libtiff/-/issues/414 - https://gitlab.com/libtiff/libtiff/-/commit/48d6ece8389b01129e7d357f0985c8f938ce3da3 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2953.json - https://security.netapp.com/advisory/ntap-20221014-0008/ - https://www.debian.org/security/2023/dsa-5333
CVE ID: CVE-2022-2956 State: PUBLISHED Published: 2022-08-23T10:40:11.000Z Last Updated: 2025-04-15T13:48:26.978Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: ConsoleTVs Products: Noxen Problem Types: CWE-79 Description: A vulnerability classified as problematic has been found in ConsoleTVs Noxen. Affected is an unknown function of the file /Noxen-master/users.php. The manipulation of the argument create_user_username with the input "><script>alert(/xss/)</script> leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-207000. Additi
The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-207000. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/whiex/Noxen - https://vuldb.com/?id.207000
CVE ID: CVE-2022-2957 State: PUBLISHED Published: 2022-08-25T06:10:11.000Z Last Updated: 2025-04-15T13:48:18.683Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: SourceCodester Products: Simple and Nice Shopping Cart Script Problem Types: CWE-89 Description: A vulnerability classified as critical was found in SourceCodester Simple and Nice Shopping Cart Script. Affected by this vulnerability is an unknown functionality of the file /mkshop/Men/profile.php. The manipulation of the argument mem_id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-207001 was assigned to t
ched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-207001 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://s1.ax1x.com/2022/08/14/vUSruD.png - https://vuldb.com/?id.207001
CVE ID: CVE-2022-2958 State: PUBLISHED Published: 2022-09-19T14:01:05 Last Updated: 2024-08-03T00:52:59.878Z Vendors: Unknown Products: BadgeOS Problem Types: CWE-89 Description: The BadgeOS WordPress plugin before 3.7.1.3 does not sanitise and escape parameters before using them in SQL statements via AJAX actions available to any authenticated users, leading to SQL Injections Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/8743534f-8ebd-496a-99bc-5052a8bac86a
CVE ID: CVE-2022-2959 State: PUBLISHED Published: 2022-08-25T00:00:00 Last Updated: 2024-08-03T00:53:00.487Z Vendors: n/a Products: kernel Problem Types: CWE-667 Description: A race condition was found in the Linux kernel's watch queue due to a missing lock in pipe_resize_ring(). The specific flaw exists within the handling of pipe buffers. The issue results from the lack of proper locking when performing operations on an object. This flaw allows a local user to crash the system or escalate their privileges on the system. Additional Analyst Notes: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-22-1165/ - https://github.com/torvalds/linux/commit/189b0d
eferences: - https://www.zerodayinitiative.com/advisories/ZDI-22-1165/ - https://github.com/torvalds/linux/commit/189b0ddc245139af81198d1a3637cac74f96e13a - https://security.netapp.com/advisory/ntap-20230214-0005/
CVE ID: CVE-2022-2961 State: PUBLISHED Published: 2022-08-29T00:00:00 Last Updated: 2024-08-03T00:53:00.516Z Vendors: n/a Products: Kernel Problem Types: CWE-416 Description: A use-after-free flaw was found in the Linux kernel’s PLP Rose functionality in the way a user triggers a race condition by calling bind while simultaneously triggering the rose_bind() function. This flaw allows a local user to crash or potentially escalate their privileges on the system. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/security/cve/CVE-2022-2961 - https://security.netapp.com/advisory/ntap-20230214-0004/
CVE ID: CVE-2022-2962 State: PUBLISHED Published: 2022-09-13T19:18:14.000Z Last Updated: 2025-04-23T17:11:03.254Z Vendors: n/a Products: QEMU Problem Types: CWE-400 Description: A DMA reentrancy issue was found in the Tulip device emulation in QEMU. When Tulip reads or writes to the rx/tx descriptor or copies the rx/tx frame, it doesn't check whether the destination address is its own MMIO address. This can cause the device to trigger MMIO handlers multiple times, possibly leading to a stack or heap overflow. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vu
n the host, resulting in a denial of service condition. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/qemu-project/qemu/-/issues/1171 - https://gitlab.com/qemu-project/qemu/-/commit/36a894aeb64a2e02871016da1c37d4a4ca109182
CVE ID: CVE-2022-2963 State: PUBLISHED Published: 2022-10-14T00:00:00.000Z Last Updated: 2025-05-15T15:05:49.501Z Vendors: n/a Products: jasper Problem Types: memory leaks Description: A vulnerability found in jasper. This security vulnerability happens because of a memory leak bug in function cmdopts_parse that can cause a crash or segmentation fault. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2022-2963 - https://bugzilla.redhat.com/show_bug.cgi?id=2118587 - https://github.com/jasper-software/jasper/issues/332
CVE ID: CVE-2022-2964 State: PUBLISHED Published: 2022-09-09T00:00:00 Last Updated: 2024-08-03T00:53:00.491Z Vendors: n/a Products: kernel Problem Types: CWE-119 Description: A flaw was found in the Linux kernel’s driver for the ASIX AX88179_178A-based USB 2.0/3.0 Gigabit Ethernet Devices. The vulnerability contains multiple out-of-bounds reads and possible out-of-bounds writes. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2067482 - https://security.netapp.com/advisory/ntap-20230113-0001/
CVE ID: CVE-2022-2965 State: PUBLISHED Published: 2022-08-23T15:40:09 Last Updated: 2024-08-03T00:52:59.886Z Severity: MEDIUM (CVSS 6.4 CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H) Vendors: notrinos Products: notrinos/notrinoserp Problem Types: CWE-1021 Description: Improper Restriction of Rendered UI Layers or Frames in GitHub repository notrinos/notrinoserp prior to 0.7. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/61e3bdf7-3548-45ea-b105-967abc0977f4 - https://github.com/notrinos/notrinoserp/commit/c2ff3d8e85a811003b796ca38f5b3290deeaa3aa
CVE ID: CVE-2022-2966 State: PUBLISHED Published: 2022-12-16T19:51:06.584Z Last Updated: 2025-04-16T16:04:27.203Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: Delta Electronics Products: DOPSoft Problem Types: CWE-125 Description: Out-of-bounds Read vulnerability in Delta Electronics DOPSoft.This issue affects DOPSoft: All Versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-244-01
CVE ID: CVE-2022-2967 State: PUBLISHED Published: 2023-01-03T21:24:21.098Z Last Updated: 2025-01-16T22:03:17.067Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H) Vendors: Prosys OPC Products: UA Simulation Server, UA Modbus Server Problem Types: CWE-522 Description: Prosys OPC UA Simulation Server version prior to v5.3.0-64 and UA Modbus Server versions 1.4.18-5 and prior do not sufficiently protect credentials, which could allow an attacker to obtain user credentials and gain access to system data. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-349-01 - https://www.prosysop
- CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-349-01 - https://www.prosysopc.com/blog/#Security
CVE ID: CVE-2022-2969 State: PUBLISHED Published: 2022-12-01T17:08:19.327Z Last Updated: 2025-04-16T16:05:33.867Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) Vendors: Delta Industrial Automation Products: DIALink Problem Types: CWE-22 Description: Delta Industrial Automation DIALink versions prior to v1.5.0.0 Beta 4 uses an external input to construct a pathname intended to identify a file or directory located underneath a restricted parent directory. However, the software does not properly neutralize special elements within the pathname, which can cause the pathname to resolve to a location outside of the restricted directory. Additional Analyst Notes: - CVE Progr
n cause the pathname to resolve to a location outside of the restricted directory. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-307-03
CVE ID: CVE-2022-2970 State: PUBLISHED Published: 2022-09-23T15:28:55.529Z Last Updated: 2025-04-16T16:09:17.437Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: MZ Automation Products: libIEC61850 Problem Types: CWE-121 Description: MZ Automation's libIEC61850 (versions 1.4 and prior; version 1.5 prior to commit a3b04b7bc4872a5a39e5de3fdc5fbde52c09e10e) does not sanitize input before memcpy is used, which could allow an attacker to crash the device or remotely execute arbitrary code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-251-01
CVE ID: CVE-2022-2971 State: PUBLISHED Published: 2022-09-23T15:28:48.033Z Last Updated: 2025-04-16T16:09:31.939Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) Vendors: MZ Automation Products: libIEC61850 Problem Types: CWE-843 Description: MZ Automation's libIEC61850 (versions 1.4 and prior; version 1.5 prior to commit a3b04b7bc4872a5a39e5de3fdc5fbde52c09e10e) accesses a resource using an incompatible type, which could allow an attacker to crash the server with a malicious payload. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-251-01
CVE ID: CVE-2022-2972 State: PUBLISHED Published: 2022-09-23T15:28:50.991Z Last Updated: 2025-04-16T16:09:24.786Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: MZ Automation Products: libIEC61850 Problem Types: CWE-121 Description: MZ Automation's libIEC61850 (versions 1.4 and prior; version 1.5 prior to commit a3b04b7bc4872a5a39e5de3fdc5fbde52c09e10e) is vulnerable to a stack-based buffer overflow, which could allow an attacker to crash the device or remotely execute arbitrary code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-251-01
CVE ID: CVE-2022-2973 State: PUBLISHED Published: 2022-09-23T15:28:44.503Z Last Updated: 2025-04-16T16:09:39.243Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) Vendors: MZ Automation Products: libIEC61850 Problem Types: CWE-476 Description: MZ Automation's libIEC61850 (versions 1.4 and prior; version 1.5 prior to commit a3b04b7bc4872a5a39e5de3fdc5fbde52c09e10e) uses a NULL pointer in certain situations. which could allow an attacker to crash the server. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-251-01
CVE ID: CVE-2022-2975 State: PUBLISHED Published: 2022-10-06T00:00:00 Last Updated: 2024-08-03T00:52:59.830Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H) Vendors: Avaya Products: Avaya Aura Application Enablement Services Problem Types: CWE-269 Description: A vulnerability related to weak permissions was detected in Avaya Aura Application Enablement Services web application, allowing an administrative user to modify accounts leading to execution of arbitrary code as the root user. This issue affects Application Enablement Services versions 8.0.0.0 through 8.1.3.4 and 10.1.0.0 through 10.1.0.1. Versions prior to 8.0.0.0 are end of manufacturing support and were not e
through 8.1.3.4 and 10.1.0.0 through 10.1.0.1. Versions prior to 8.0.0.0 are end of manufacturing support and were not evaluated. Additional Analyst Notes: - CVE Program Container: References: - https://download.avaya.com/css/public/documents/101083688
CVE ID: CVE-2022-2977 State: PUBLISHED Published: 2022-09-14T00:00:00 Last Updated: 2024-08-03T00:52:59.878Z Vendors: n/a Products: Linux kernel Problem Types: CWE-416 Description: A flaw was found in the Linux kernel implementation of proxied virtualized TPM devices. On a system where virtualized TPM devices are configured (this is not the default) a local attacker can create a use-after-free and create a situation where it may be possible to escalate privileges on the system. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=9d8e7007dc7c4d7c8366739bbcd3f5e51dcd470f - https://security.netapp.com/adv
inux/kernel/git/torvalds/linux.git/commit/?id=9d8e7007dc7c4d7c8366739bbcd3f5e51dcd470f - https://security.netapp.com/advisory/ntap-20230214-0006/
CVE ID: CVE-2022-2978 State: PUBLISHED Published: 2022-08-24T00:00:00 Last Updated: 2024-08-03T00:53:00.619Z Vendors: n/a Products: Kernel Problem Types: CWE-416 Description: A flaw use after free in the Linux kernel NILFS file system was found in the way user triggers function security_inode_alloc to fail with following call to function nilfs_mdt_destroy. A local user could use this flaw to crash the system or potentially escalate their privileges on the system. Additional Analyst Notes: - CVE Program Container: References: - https://lore.kernel.org/linux-fsdevel/20220816040859.659129-1-dzm91%40hust.edu.cn/T/#u - https://lists.debian.org/debian-lts-announce/2022/12/msg00034.html
CVE ID: CVE-2022-2979 State: PUBLISHED Published: 2022-09-12T19:24:03.386Z Last Updated: 2025-04-16T17:47:50.966Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Omron Products: CX-Programmer Problem Types: CWE-416 Description: Opening a specially crafted file could cause the affected product to fail to release its memory reference potentially resulting in arbitrary code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-242-09
CVE ID: CVE-2022-2980 State: PUBLISHED Published: 2022-08-25T00:00:00 Last Updated: 2024-08-03T00:53:00.834Z Severity: MEDIUM (CVSS 6.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: vim Products: vim/vim Problem Types: CWE-476 Description: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0259. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/6e7b12a5-242c-453d-b39e-9625d563b0ea - https://github.com/vim/vim/commit/80525751c5ce9ed82c41d83faf9ef38667bf61b1 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XWOJOA7PZZAMBI5GFTL6PWHXMWSDLUXL/ - https://security.gentoo.org/glsa/2023
CVE ID: CVE-2022-2981 State: PUBLISHED Published: 2022-10-10T00:00:00 Last Updated: 2024-08-03T00:52:59.918Z Vendors: Unknown Products: Download Monitor Problem Types: CWE-552 Description: The Download Monitor WordPress plugin before 4.5.98 does not ensure that files to be downloaded are inside the blog folders, and not sensitive, allowing high privilege users such as admin to download the wp-config.php or /etc/passwd even in an hardened environment or multisite setup. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/30ce32ce-161c-4388-8d22-751350b7b305
CVE ID: CVE-2022-2982 State: PUBLISHED Published: 2022-08-25T00:00:00 Last Updated: 2024-08-03T00:53:00.666Z Severity: HIGH (CVSS 7.6 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L) Vendors: vim Products: vim/vim Problem Types: CWE-416 Description: Use After Free in GitHub repository vim/vim prior to 9.0.0260. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/53f53d9a-ba8a-4985-b7ba-23efbe6833be - https://github.com/vim/vim/commit/d6c67629ed05aae436164eec474832daf8ba7420 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XWOJOA7PZZAMBI5GFTL6PWHXMWSDLUXL/ - https://security.gentoo.org/glsa/202305-16
CVE ID: CVE-2022-2983 State: PUBLISHED Published: 2022-11-28T13:47:14.433Z Last Updated: 2025-04-25T15:16:04.246Z Vendors: Unknown Products: Salat Times Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Salat Times WordPress plugin before 3.2.2 does not sanitize and escapes its settings, allowing high-privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/e2af8c7f-9bd4-4902-8df8-72ffb414fdbf
CVE ID: CVE-2022-2984 State: PUBLISHED Published: 2022-10-14T00:00:00.000Z Last Updated: 2025-05-15T15:03:51.597Z Vendors: Unisoc (Shanghai) Technologies Co., Ltd. Products: SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 Problem Types: CWE-787 Description: In jpg driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service in kernel. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.unisoc.com/en_us/secy/announcementDetail/1575654905820020738
CVE ID: CVE-2022-2985 State: PUBLISHED Published: 2022-10-14T00:00:00.000Z Last Updated: 2025-05-15T15:03:09.737Z Vendors: Unisoc (Shanghai) Technologies Co., Ltd. Products: SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 Problem Types: CWE-862 Description: In music service, there is a missing permission check. This could lead to elevation of privilege in contacts service with no additional execution privileges needed. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.unisoc.com/en_us/secy/announcementDetail/1575654905820020738
CVE ID: CVE-2022-2986 State: PUBLISHED Published: 2022-10-06T00:00:00 Last Updated: 2024-08-03T00:52:59.888Z Vendors: n/a Products: moodle Problem Types: CSRF Description: Enabling and disabling installed H5P libraries did not include the necessary token to prevent a CSRF risk. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2121360 - http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-75326
CVE ID: CVE-2022-2987 State: PUBLISHED Published: 2022-09-26T12:35:36.000Z Last Updated: 2025-05-22T14:24:02.739Z Vendors: Unknown Products: Ldap WP Login / Active Directory Integration Problem Types: CWE-862, CWE-352 Description: The Ldap WP Login / Active Directory Integration WordPress plugin before 3.0.2 does not have any authorisation and CSRF checks when updating it's settings (which are hooked to the init action), allowing unauthenticated attackers to update them. Attackers could set their own LDAP server to be used to authenticated users, therefore bypassing the current authentication Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wp
rent authentication Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/0d9638b9-bf8a-474f-992d-2618884d3f67
CVE ID: CVE-2022-2988 State: PUBLISHED Published: 2023-01-30T00:00:00.000Z Last Updated: 2025-02-05T20:08:49.920Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Schneider Electric Products: SoMachine HVAC, EcoStruxure Machine Expert – HVAC Problem Types: CWE-787 Description: A CWE-787: Out-of-bounds Write vulnerability exists that could cause sensitive information leakage when accessing a malicious web page from the commissioning software. Affected Products: SoMachine HVAC (Versions prior to V2.1.0), EcoStruxure Machine Expert – HVAC (Versions prior to V1.4.0) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://
ions prior to V1.4.0) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-010-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-010-01_EcoStruxure_Machine_Expert_Machine_HVAC_Security_Notification.pdf
CVE ID: CVE-2022-2989 State: PUBLISHED Published: 2022-09-13T13:41:00.000Z Last Updated: 2025-06-05T18:15:28.374Z Vendors: n/a Products: podman Problem Types: CWE-842 Description: An incorrect handling of the supplementary groups in the Podman container engine might lead to the sensitive information disclosure or possible data modification if an attacker has direct access to the affected container where supplementary groups are used to set access permissions and is able to execute a binary code in that container. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2121445 - https://www.benthamsgaze.org/2022/08/
Vulnrichment: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2121445 - https://www.benthamsgaze.org/2022/08/22/vulnerability-in-linux-containers-investigation-and-mitigation/
CVE ID: CVE-2022-2990 State: PUBLISHED Published: 2022-09-13T13:44:21 Last Updated: 2024-08-03T00:53:00.654Z Vendors: n/a Products: buildah Problem Types: CWE-842 Description: An incorrect handling of the supplementary groups in the Buildah container engine might lead to the sensitive information disclosure or possible data modification if an attacker has direct access to the affected container where supplementary groups are used to set access permissions and is able to execute a binary code in that container. Additional Analyst Notes: - CVE Program Container: References: - https://www.benthamsgaze.org/2022/08/22/vulnerability-in-linux-containers-investigation-and-mitigation/ - https://bugzi
https://www.benthamsgaze.org/2022/08/22/vulnerability-in-linux-containers-investigation-and-mitigation/ - https://bugzilla.redhat.com/show_bug.cgi?id=2121453
CVE ID: CVE-2022-2991 State: PUBLISHED Published: 2022-08-25T17:24:41 Last Updated: 2024-08-03T00:53:00.474Z Vendors: n/a Products: kernel Problem Types: CWE-122 Description: A heap-based buffer overflow was found in the Linux kernel's LightNVM subsystem. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. This vulnerability allows a local attacker to escalate privileges and execute arbitrary code in the context of the kernel. The attacker must first obtain the ability to execute high-privileged code on the target system to exploit this vulnerability. Additional Analyst Notes: - CVE Program Containe
igh-privileged code on the target system to exploit this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-22-960/ - https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/drivers/lightnvm/Kconfig?h=v5.10.114&id=549209caabc89f2877ad5f62d11fca5c052e0e8