Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-42901 State: PUBLISHED Published: 2022-10-13T00:00:00.000Z Last Updated: 2025-05-15T17:40:28.433Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AC:L/AV:L/A:H/C:H/I:H/PR:N/S:U/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: Bentley MicroStation and MicroStation-based applications may be affected by out-of-bounds and stack overflow issues when opening crafted XMT files. Exploiting these issues could lead to information disclosure and code execution. The fixed versions are 10.17.01.58* for MicroStation and 10.17.01.19* for Bentley View. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.bentley.com/legal/common-vulnerabili
Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.bentley.com/legal/common-vulnerability-exposure-be-2022-0018/
CVE ID: CVE-2022-42902 State: PUBLISHED Published: 2022-10-13T00:00:00.000Z Last Updated: 2025-05-15T16:20:39.096Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Linaro Automated Validation Architecture (LAVA) before 2022.10, there is dynamic code execution in lava_server/lavatable.py. Due to improper input sanitization, an anonymous user can force the lava-server-gunicorn service to execute user-provided code on the server. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.lavasoftware.org/lava/lava/-/merge_requests/1834 - https://git.lavasoftware.org/lava/lava/-/commit/e66b74cd6c175ff8826b8f3431740963be228b52?merge_request_
_requests/1834 - https://git.lavasoftware.org/lava/lava/-/commit/e66b74cd6c175ff8826b8f3431740963be228b52?merge_request_iid=1834 - https://www.debian.org/security/2022/dsa-5260 - https://lists.debian.org/debian-lts-announce/2022/11/msg00019.html
CVE ID: CVE-2022-42903 State: PUBLISHED Published: 2022-11-17T00:00:00.000Z Last Updated: 2025-04-30T14:25:08.176Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine SupportCenter Plus through 11024 allows low-privileged users to view the organization users list. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.manageengine.com/products/support-center/cve-2022-42903.html
CVE ID: CVE-2022-42904 State: PUBLISHED Published: 2022-11-18T00:00:00.000Z Last Updated: 2025-04-30T13:58:03.828Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine ADManager Plus through 7151 allows authenticated admin users to execute the commands in proxy settings. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.manageengine.com/products/ad-manager/admanager-kb/cve-2022-42904.html
CVE ID: CVE-2022-42905 State: PUBLISHED Published: 2022-11-06T00:00:00.000Z Last Updated: 2025-05-02T18:39:54.570Z Vendors: n/a Products: n/a Problem Types: n/a Description: In wolfSSL before 5.5.2, if callback functions are enabled (via the WOLFSSL_CALLBACKS flag), then a malicious TLS 1.3 client or network attacker can trigger a buffer over-read on the heap of 5 bytes. (WOLFSSL_CALLBACKS is only intended for debugging.) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wolfssl.com/docs/security-vulnerabilities/ - https://github.com/wolfSSL/wolfssl/releases - https://github.com/wolfSSL/wolfssl/releases/tag/v5.5.2-stable - http://seclists.o
/github.com/wolfSSL/wolfssl/releases - https://github.com/wolfSSL/wolfssl/releases/tag/v5.5.2-stable - http://seclists.org/fulldisclosure/2023/Jan/11 - http://packetstormsecurity.com/files/170610/wolfSSL-WOLFSSL_CALLBACKS-Heap-Buffer-Over-Read.html - https://blog.trailofbits.com/2023/01/12/wolfssl-vulnerabilities-tlspuffin-fuzzing-ssh/
CVE ID: CVE-2022-42906 State: PUBLISHED Published: 2022-10-13T00:00:00.000Z Last Updated: 2025-05-15T16:14:22.051Z Vendors: n/a Products: n/a Problem Types: n/a Description: powerline-gitstatus (aka Powerline Gitstatus) before 1.3.2 allows arbitrary code execution. git repositories can contain per-repository configuration that changes the behavior of git, including running arbitrary commands. When using powerline-gitstatus, changing to a directory automatically runs git commands in order to display information about the current repository in the prompt. If an attacker can convince a user to change their current directory to one controlled by the attacker, such as in a shared filesystem or ex
onvince a user to change their current directory to one controlled by the attacker, such as in a shared filesystem or extracted archive, powerline-gitstatus will run arbitrary commands under the attacker's control. NOTE: this is similar to CVE-2022-20001. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/jaspernbrouwer/powerline-gitstatus/issues/45 - https://github.com/jaspernbrouwer/powerline-gitstatus/releases/tag/v1.3.2 - https://lists.debian.org/debian-lts-announce/2023/01/msg00017.html
CVE ID: CVE-2022-42908 State: PUBLISHED Published: 2023-02-03T00:00:00.000Z Last Updated: 2025-03-26T15:55:55.790Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N) Vendors: WEPA Products: Wepa Print Away Problem Types: CWE-79 Description: WEPA Print Away is vulnerable to a stored XSS. It does not properly sanitize uploaded filenames, allowing an attacker to deceive a user into uploading a document with a malicious filename, which will be included in subsequent HTTP responses, allowing a stored XSS to occur. This attack is persistent across victim sessions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe-cert
sions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe-cert.es/en/early-warning/security-advisories/multiple-vulnerabilities-wepa-print-away - https://enrique.wtf/CVE-2022-42908
CVE ID: CVE-2022-42909 State: PUBLISHED Published: 2023-02-03T00:00:00.000Z Last Updated: 2025-03-26T15:56:26.827Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: WEPA Products: Wepa Print Away Problem Types: CWE-79 Description: WEPA Print Away does not verify that a user has authorization to access documents before generating print orders and associated release codes. This could allow an attacker to generate print orders and release codes for documents they don´t own and print hem without authorization. In order to exploit this vulnerability, the user must have an account with wepanow.com or any of the institutions they serve, and be logged in. Additional A
ty, the user must have an account with wepanow.com or any of the institutions they serve, and be logged in. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe-cert.es/en/early-warning/security-advisories/multiple-vulnerabilities-wepa-print-away - https://enrique.wtf/CVE-2022-42909
CVE ID: CVE-2022-42915 State: PUBLISHED Published: 2022-10-29T00:00:00.000Z Last Updated: 2025-05-07T13:59:25.363Z Vendors: n/a Products: n/a Problem Types: n/a Description: curl before 7.86.0 has a double free. If curl is told to use an HTTP proxy for a transfer with a non-HTTP(S) URL, it sets up the connection to the remote server by issuing a CONNECT request to the proxy, and then tunnels the rest of the protocol through. An HTTP proxy might refuse this request (HTTP proxies often only allow outgoing connections to specific port numbers, like 443 for HTTPS) and instead return a non-200 status code to the client. Due to flaws in the error/cleanup handling, this could trigger a double free
eturn a non-200 status code to the client. Due to flaws in the error/cleanup handling, this could trigger a double free in curl if one of the following schemes were used in the URL for the transfer: dict, gopher, gophers, ldap, ldaps, rtmp, rtmps, or telnet. The earliest affected version is 7.77.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://curl.se/docs/CVE-2022-42915.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HVU3IMZCKR4VE6KJ4GCWRL2ILLC6OV76/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q27V5YYMXUVI6PRZQVECON32XPVWTKDK/ - h
fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q27V5YYMXUVI6PRZQVECON32XPVWTKDK/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/37YEVVC6NAF6H7UHH6YAUY5QEVY6LIH2/ - https://security.netapp.com/advisory/ntap-20221209-0010/ - https://security.gentoo.org/glsa/202212-01 - https://support.apple.com/kb/HT213604 - https://support.apple.com/kb/HT213605 - http://seclists.org/fulldisclosure/2023/Jan/20 - http://seclists.org/fulldisclosure/2023/Jan/19
CVE ID: CVE-2022-42916 State: PUBLISHED Published: 2022-10-29T00:00:00 Last Updated: 2024-08-03T13:19:05.420Z Vendors: n/a Products: n/a Problem Types: n/a Description: In curl before 7.86.0, the HSTS check could be bypassed to trick it into staying with HTTP. Using its HSTS support, curl can be instructed to use HTTPS directly (instead of using an insecure cleartext HTTP step) even when HTTP is provided in the URL. This mechanism could be bypassed if the host name in the given URL uses IDN characters that get replaced with ASCII counterparts as part of the IDN conversion, e.g., using the character UTF-8 U+3002 (IDEOGRAPHIC FULL STOP) instead of the common ASCII full stop of U+002E (.). The
e.g., using the character UTF-8 U+3002 (IDEOGRAPHIC FULL STOP) instead of the common ASCII full stop of U+002E (.). The earliest affected version is 7.77.0 2021-05-26. Additional Analyst Notes: - CVE Program Container: References: - https://curl.se/docs/CVE-2022-42916.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HVU3IMZCKR4VE6KJ4GCWRL2ILLC6OV76/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q27V5YYMXUVI6PRZQVECON32XPVWTKDK/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/37YEVVC6NAF6H7UHH6YAUY5QEVY6LIH2/ - https://security.netapp.c
es/list/package-announce%40lists.fedoraproject.org/message/37YEVVC6NAF6H7UHH6YAUY5QEVY6LIH2/ - https://security.netapp.com/advisory/ntap-20221209-0010/ - https://security.gentoo.org/glsa/202212-01 - http://www.openwall.com/lists/oss-security/2022/12/21/1 - https://support.apple.com/kb/HT213604 - https://support.apple.com/kb/HT213605 - http://seclists.org/fulldisclosure/2023/Jan/20 - http://seclists.org/fulldisclosure/2023/Jan/19
CVE ID: CVE-2022-42919 State: PUBLISHED Published: 2022-11-06T00:00:00.000Z Last Updated: 2025-11-03T21:46:36.550Z Vendors: n/a Products: n/a Problem Types: n/a Description: Python 3.9.x before 3.9.16 and 3.10.x before 3.10.9 on Linux allows local privilege escalation in a non-default configuration. The Python multiprocessing library, when used with the forkserver start method on Linux, allows pickles to be deserialized from any user in the same machine local network namespace, which in many system configurations means any user on the same machine. Pickles can execute arbitrary code. Thus, this allows for local user privilege escalation to the user that any forkserver process is running as.
rary code. Thus, this allows for local user privilege escalation to the user that any forkserver process is running as. Setting multiprocessing.util.abstract_sockets_supported to False is a workaround. The forkserver start method for multiprocessing is not the default start method. This issue is Linux specific because only Linux supports abstract namespace sockets. CPython before 3.9 does not make use of Linux abstract namespace sockets by default. Support for users manually specifying an abstract namespace socket was added as a bugfix in 3.7.8 and 3.8.3, but users would need to make specific uncommon API calls in order to do that in CPython before 3.9. Additional Analyst Notes: - CVE Progra
ed to make specific uncommon API calls in order to do that in CPython before 3.9. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/python/cpython/issues/97514 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PI5DYIED6U26BGX5IRZWNCP6TY4M2ZGZ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VCRKBB5Y5EWTJUNC7LK665WO64DDXSTN/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FKGCQPIVHEAIJ77R3RSNSQWYBUDVWDKU/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
age/FKGCQPIVHEAIJ77R3RSNSQWYBUDVWDKU/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/P2LHWWEI5OBQ6RELULMVU6KMDYG4WZXH/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XX6LLAXGZVZ327REY6MDZRMMP47LJ53P/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R6KGIRHSENZ4QAB234Z36HVIDTRJ3MFI/ - https://security.netapp.com/advisory/ntap-20221209-0006/ - https://github.com/python/cpython/issues/97514#issuecomment-1310277840 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QLUGZSEAO3MBWGKCUSMKQIRYJZKJCIOB
ists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QLUGZSEAO3MBWGKCUSMKQIRYJZKJCIOB/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RDK3ZZBRYFO47ET3N4BNTKVXN47U6ICY/ - https://github.com/python/cpython/compare/v3.10.8...v3.10.9 - https://github.com/python/cpython/compare/v3.9.15...v3.9.16 - https://security.gentoo.org/glsa/202305-02
CVE ID: CVE-2022-42920 State: PUBLISHED Published: 2022-11-07T00:00:00 Last Updated: 2024-08-03T13:19:05.457Z Vendors: Apache Software Foundation Products: Apache Commons BCEL Problem Types: CWE-787 Description: Apache Commons BCEL has a number of APIs that would normally only allow changing specific class characteristics. However, due to an out-of-bounds writing issue, these APIs can be used to produce arbitrary bytecode. This could be abused in applications that pass attacker-controllable data to those APIs, giving the attacker more control over the resulting bytecode than otherwise expected. Update to Apache Commons BCEL 6.6.0. Additional Analyst Notes: - CVE Program Container: References
n otherwise expected. Update to Apache Commons BCEL 6.6.0. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread/lfxk7q8qmnh5bt9jm6nmjlv5hsxjhrz4 - http://www.openwall.com/lists/oss-security/2022/11/07/2 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LX3HEB4TV2BVCGDTK5BCLSYOZNQTOBN4/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QMVX6COVXZVS5GPWDODIRW6Z2GE7RPAQ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QAMRHAKGIKZNHRBB4VLYTOIOIMMXCUCD/ - https://security.gentoo.org/glsa/202401-25
CVE ID: CVE-2022-42923 State: PUBLISHED Published: 2022-10-31T19:58:22.373Z Last Updated: 2025-05-06T19:29:09.034Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L) Vendors: Forma Products: Forma LMS Problem Types: CWE-89 Description: Forma LMS on its 3.1.0 version and earlier is vulnerable to a SQL injection vulnerability. The exploitation of this vulnerability could allow an authenticated attacker (with the role of student) to perform a SQL injection on the 'id' parameter in the 'appCore/index.php?r=adm/mediagallery/delete' function in order to dump the entire database or delete all contents from the 'core_user_file' table. Additional Analyst Notes: - CVE Program Conta
he entire database or delete all contents from the 'core_user_file' table. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe-cert.es/en/early-warning/security-advisories/multiple-vulnerabilities-forma-lms
CVE ID: CVE-2022-42924 State: PUBLISHED Published: 2022-10-31T19:59:33.604Z Last Updated: 2025-05-05T14:03:19.048Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L) Vendors: Forma Products: Forma LMS Problem Types: CWE-89 Description: Forma LMS on its 3.1.0 version and earlier is vulnerable to a SQL injection vulnerability. The exploitation of this vulnerability could allow an authenticated attacker (with the role of student) to perform a SQL injection on the 'dyn_filter' parameter in the 'appLms/ajax.adm_server.php?r=widget/userselector/getusertabledata' function in order to dump the entire database. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrich
a' function in order to dump the entire database. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe-cert.es/en/early-warning/security-advisories/multiple-vulnerabilities-forma-lms
CVE ID: CVE-2022-42925 State: PUBLISHED Published: 2022-10-31T19:58:45.089Z Last Updated: 2025-05-06T19:44:17.503Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Forma Products: Forma LMS Problem Types: CWE-434 Description: There is a vulnerability on Forma LMS version 3.1.0 and earlier that could allow an authenticated attacker (with the role of student) to privilege escalate in order to upload a Zip file through the plugin upload component. The exploitation of this vulnerability could lead to a remote code injection. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe-cert.es/en/early-warning/secu
CVE ID: CVE-2022-42927 State: PUBLISHED Published: 2022-12-22T00:00:00.000Z Last Updated: 2025-04-15T15:46:11.306Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: Same-origin policy violation could have leaked cross-origin URLs Description: A same-origin policy violation could have allowed the theft of cross-origin URL entries, leaking the result of a redirect, via `performance.getEntries()`. This vulnerability affects Firefox < 106, Firefox ESR < 102.4, and Thunderbird < 102.4. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1789128 - https://www.mozilla.org/security/advisories
chment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1789128 - https://www.mozilla.org/security/advisories/mfsa2022-44/ - https://www.mozilla.org/security/advisories/mfsa2022-45/ - https://www.mozilla.org/security/advisories/mfsa2022-46/
CVE ID: CVE-2022-42928 State: PUBLISHED Published: 2022-12-22T00:00:00.000Z Last Updated: 2025-04-15T15:44:46.254Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: Memory Corruption in JS Engine Description: Certain types of allocations were missing annotations that, if the Garbage Collector was in a specific state, could have lead to memory corruption and a potentially exploitable crash. This vulnerability affects Firefox < 106, Firefox ESR < 102.4, and Thunderbird < 102.4. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1791520 - https://www.mozilla.org/security/advisories/mfsa
t: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1791520 - https://www.mozilla.org/security/advisories/mfsa2022-44/ - https://www.mozilla.org/security/advisories/mfsa2022-45/ - https://www.mozilla.org/security/advisories/mfsa2022-46/
CVE ID: CVE-2022-42929 State: PUBLISHED Published: 2022-12-22T00:00:00.000Z Last Updated: 2025-04-15T15:32:55.455Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: Denial of Service via window.print Description: If a website called `window.print()` in a particular way, it could cause a denial of service of the browser, which may persist beyond browser restart depending on the user's session restore settings. This vulnerability affects Firefox < 106, Firefox ESR < 102.4, and Thunderbird < 102.4. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1789439 - https://www.mozilla.org/secu
CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1789439 - https://www.mozilla.org/security/advisories/mfsa2022-44/ - https://www.mozilla.org/security/advisories/mfsa2022-45/ - https://www.mozilla.org/security/advisories/mfsa2022-46/
CVE ID: CVE-2022-42930 State: PUBLISHED Published: 2022-12-22T00:00:00.000Z Last Updated: 2025-04-15T15:26:01.971Z Vendors: Mozilla Products: Firefox Problem Types: Race condition in DOM Workers Description: If two Workers were simultaneously initializing their CacheStorage, a data race could have occurred in the `ThirdPartyUtil` component. This vulnerability affects Firefox < 106. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1789503 - https://www.mozilla.org/security/advisories/mfsa2022-44/
CVE ID: CVE-2022-42931 State: PUBLISHED Published: 2022-12-22T00:00:00.000Z Last Updated: 2025-04-15T15:23:46.302Z Vendors: Mozilla Products: Firefox Problem Types: Username saved to a plaintext file on disk Description: Logins saved by Firefox should be managed by the Password Manager component which uses encryption to save files on-disk. Instead, the username (not password) was saved by the Form Manager to an unencrypted file on disk. This vulnerability affects Firefox < 106. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1780571 - https://www.mozilla.org/security/advisories/mfsa2022-44/
CVE ID: CVE-2022-42932 State: PUBLISHED Published: 2022-12-22T00:00:00.000Z Last Updated: 2025-04-15T15:21:13.229Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: Memory safety bugs fixed in Firefox 106 and Firefox ESR 102.4 Description: Mozilla developers Ashley Hale and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 105 and Firefox ESR 102.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 106, Firefox ESR < 102.4, and Thunderbird < 102.4. Additional Analyst Notes: - CVE Program Container: - C
ects Firefox < 106, Firefox ESR < 102.4, and Thunderbird < 102.4. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/buglist.cgi?bug_id=1789729%2C1791363%2C1792041 - https://www.mozilla.org/security/advisories/mfsa2022-44/ - https://www.mozilla.org/security/advisories/mfsa2022-45/ - https://www.mozilla.org/security/advisories/mfsa2022-46/
CVE ID: CVE-2022-42933 State: PUBLISHED Published: 2022-10-21T00:00:00.000Z Last Updated: 2025-05-07T19:41:17.561Z Vendors: n/a Products: Autodesk Design Review Problem Types: Memory corruption Read Description: A malicious crafted .dwf or .pct file when consumed through DesignReview.exe application could lead to memory corruption vulnerability by write access violation. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0004