Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-22713 State: PUBLISHED Published: 2022-05-10T20:33:31 Last Updated: 2025-01-02T18:57:47.505Z Severity: MEDIUM (CVSS 5.6 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H/E:P/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 21H1, Windows Server version 20H2, Windows 10 Version 21H2 Problem Types: Denial of Service Description: Windows Hyper-V Denial of Service Vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-22713
CVE ID: CVE-2022-22715 State: PUBLISHED Published: 2022-02-09T16:37:05 Last Updated: 2025-01-02T18:28:12.805Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows 10 Version 1909, Windows 10 Version 21H1, Windows Server 2022, Windows 10 Version 20H2, Windows Server version 20H2, Windows 11 version 21H2, Windows 10 Version 21H2 Problem Types: Elevation of Privilege Description: Named Pipe File System Elevation of Privilege Vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://msrc.microsoft.com/updat
rivilege Vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-22715
CVE ID: CVE-2022-22716 State: PUBLISHED Published: 2022-02-09T16:37:06 Last Updated: 2025-01-02T18:28:13.375Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft SharePoint Enterprise Server 2013 Service Pack 1, Microsoft Office 2019, Microsoft Office 2019 for Mac, Microsoft Office Online Server, Microsoft 365 Apps for Enterprise, Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC 2021, Microsoft Excel 2016, Microsoft Excel 2013 Service Pack 1, Microsoft Office Web Apps Server 2013 Service Pack 1 Problem Types: Information Disclosure Description: Microsoft Excel Information Disclosure Vulnerability Additional An
1 Problem Types: Information Disclosure Description: Microsoft Excel Information Disclosure Vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-22716
CVE ID: CVE-2022-22717 State: PUBLISHED Published: 2022-02-09T16:37:07 Last Updated: 2025-01-02T18:28:13.956Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows 10 Version 1909, Windows 10 Version 21H1, Windows Server 2022, Windows 10 Version 20H2, Windows Server version 20H2, Windows 11 version 21H2, Windows 10 Version 21H2, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows 7, Windows 7 Service Pack 1, Windows 8.1, Windows Server 2008 Service Pack 2, Wind
6 (Server Core installation), Windows 7, Windows 7 Service Pack 1, Windows 8.1, Windows Server 2008 Service Pack 2, Windows Server 2008 Service Pack 2 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 R2 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) Problem Types: Elevation of Privilege Description: Windows Print Spooler Elevation of Privilege Vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022
nal Analyst Notes: - CVE Program Container: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-22717
CVE ID: CVE-2022-22718 State: PUBLISHED Published: 2022-02-09T16:37:09.000Z Last Updated: 2025-10-21T23:15:47.793Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows 10 Version 1909, Windows 10 Version 21H1, Windows Server 2022, Windows 10 Version 20H2, Windows Server version 20H2, Windows 11 version 21H2, Windows 10 Version 21H2, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows 7, Windows 7 Service Pack 1, Windows 8.1, Windows Server 2008 Service Pack
Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-22718
CVE ID: CVE-2022-22719 State: PUBLISHED Published: 2022-03-14T10:15:16 Last Updated: 2024-08-03T03:21:49.091Z Vendors: Apache Software Foundation Products: Apache HTTP Server Problem Types: CWE-665 Description: A carefully crafted request body can cause a read to a random memory area which could cause the process to crash. This issue affects Apache HTTP Server 2.4.52 and earlier. Additional Analyst Notes: - CVE Program Container: References: - https://httpd.apache.org/security/vulnerabilities_24.html - http://www.openwall.com/lists/oss-security/2022/03/14/4 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RGWILBORT67SHMSLYSQZG2NMXGCMPUZO/ - h
fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RGWILBORT67SHMSLYSQZG2NMXGCMPUZO/ - https://lists.debian.org/debian-lts-announce/2022/03/msg00033.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z7H26WJ6TPKNWV3QKY4BHKUKQVUTZJTD/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X73C35MMMZGBVPQQCH7LQZUMYZNQA5FO/ - https://www.oracle.com/security-alerts/cpuapr2022.html - https://security.netapp.com/advisory/ntap-20220321-0001/ - https://support.apple.com/kb/HT213257 - https://support.apple.com/kb/HT213256 - https://support.apple.com/kb/HT213255 - http://sec
pport.apple.com/kb/HT213257 - https://support.apple.com/kb/HT213256 - https://support.apple.com/kb/HT213255 - http://seclists.org/fulldisclosure/2022/May/33 - http://seclists.org/fulldisclosure/2022/May/35 - http://seclists.org/fulldisclosure/2022/May/38 - https://security.gentoo.org/glsa/202208-20
CVE ID: CVE-2022-22720 State: PUBLISHED Published: 2022-03-14T10:15:29 Last Updated: 2024-08-03T03:21:48.980Z Vendors: Apache Software Foundation Products: Apache HTTP Server Problem Types: CWE-444 Description: Apache HTTP Server 2.4.52 and earlier fails to close inbound connection when errors are encountered discarding the request body, exposing the server to HTTP Request Smuggling Additional Analyst Notes: - CVE Program Container: References: - https://httpd.apache.org/security/vulnerabilities_24.html - http://www.openwall.com/lists/oss-security/2022/03/14/3 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RGWILBORT67SHMSLYSQZG2NMXGCMPUZO/
ts.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RGWILBORT67SHMSLYSQZG2NMXGCMPUZO/ - https://lists.debian.org/debian-lts-announce/2022/03/msg00033.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z7H26WJ6TPKNWV3QKY4BHKUKQVUTZJTD/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X73C35MMMZGBVPQQCH7LQZUMYZNQA5FO/ - https://www.oracle.com/security-alerts/cpuapr2022.html - https://security.netapp.com/advisory/ntap-20220321-0001/ - http://seclists.org/fulldisclosure/2022/May/33 - http://seclists.org/fulldisclosure/2022/May/35 - http://seclists.org/fulldiscl
seclists.org/fulldisclosure/2022/May/33 - http://seclists.org/fulldisclosure/2022/May/35 - http://seclists.org/fulldisclosure/2022/May/38 - https://www.oracle.com/security-alerts/cpujul2022.html - https://support.apple.com/kb/HT213257 - https://support.apple.com/kb/HT213256 - https://support.apple.com/kb/HT213255 - https://security.gentoo.org/glsa/202208-20
CVE ID: CVE-2022-22721 State: PUBLISHED Published: 2022-03-14T10:15:40 Last Updated: 2024-08-03T03:21:48.950Z Vendors: Apache Software Foundation Products: Apache HTTP Server Problem Types: CWE-190 Description: If LimitXMLRequestBody is set to allow request bodies larger than 350MB (defaults to 1M) on 32 bit systems an integer overflow happens which later causes out of bounds writes. This issue affects Apache HTTP Server 2.4.52 and earlier. Additional Analyst Notes: - CVE Program Container: References: - https://httpd.apache.org/security/vulnerabilities_24.html - http://www.openwall.com/lists/oss-security/2022/03/14/2 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.f
.openwall.com/lists/oss-security/2022/03/14/2 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RGWILBORT67SHMSLYSQZG2NMXGCMPUZO/ - https://lists.debian.org/debian-lts-announce/2022/03/msg00033.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z7H26WJ6TPKNWV3QKY4BHKUKQVUTZJTD/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X73C35MMMZGBVPQQCH7LQZUMYZNQA5FO/ - https://www.oracle.com/security-alerts/cpuapr2022.html - https://security.netapp.com/advisory/ntap-20220321-0001/ - http://seclists.org/fulldisclosure/2022/May/33 - http://seclists.org
/security.netapp.com/advisory/ntap-20220321-0001/ - http://seclists.org/fulldisclosure/2022/May/33 - http://seclists.org/fulldisclosure/2022/May/35 - http://seclists.org/fulldisclosure/2022/May/38 - https://www.oracle.com/security-alerts/cpujul2022.html - https://support.apple.com/kb/HT213257 - https://support.apple.com/kb/HT213256 - https://support.apple.com/kb/HT213255 - https://security.gentoo.org/glsa/202208-20
CVE ID: CVE-2022-22722 State: PUBLISHED Published: 2022-02-04T22:29:34 Last Updated: 2024-08-03T03:21:49.126Z Vendors: Schneider Electric Products: Easergy P5 Problem Types: CWE-798 Description: A CWE-798: Use of Hard-coded Credentials vulnerability exists that could result in information disclosure. If an attacker were to obtain the SSH cryptographic key for the device and take active control of the local operational network connected to the product they could potentially observe and manipulate traffic associated with product configuration. Affected Product: Easergy P5 (All firmware versions prior to V01.401.101) Additional Analyst Notes: - CVE Program Container: References: - https://downl
l firmware versions prior to V01.401.101) Additional Analyst Notes: - CVE Program Container: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-011-03
CVE ID: CVE-2022-22723 State: PUBLISHED Published: 2022-02-04T22:29:35 Last Updated: 2024-08-03T03:21:49.023Z Vendors: n/a Products: Easergy P5 (All firmware versions prior to V01.401.101) Problem Types: CWE-120 Description: A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could lead to a buffer overflow causing program crashes and arbitrary code execution when specially crafted packets are sent to the device over the network. Protection functions and tripping function via GOOSE can be impacted. Affected Product: Easergy P5 (All firmware versions prior to V01.401.101) Additional Analyst Notes: - CVE Program Container: References: - https://download.schneider-el
ons prior to V01.401.101) Additional Analyst Notes: - CVE Program Container: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-011-03
CVE ID: CVE-2022-22724 State: PUBLISHED Published: 2022-02-04T22:29:36 Last Updated: 2024-08-03T03:21:49.119Z Vendors: n/a Products: Modicon M340 CPUs: BMXP34 (All Versions) Problem Types: CWE-400 Description: A CWE-400: Uncontrolled Resource Consumption vulnerability exists that could cause a denial of service on ports 80 (HTTP) and 502 (Modbus), when sending a large number of TCP RST or FIN packets to any open TCP port of the PLC. Affected Product: Modicon M340 CPUs: BMXP34 (All Versions) Additional Analyst Notes: - CVE Program Container: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-011-01
CVE ID: CVE-2022-22725 State: PUBLISHED Published: 2022-02-04T22:29:37 Last Updated: 2024-08-03T03:21:49.097Z Vendors: n/a Products: Easergy P3 (All versions prior to V30.205) Problem Types: CWE-120 Description: A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could lead to a buffer overflow causing program crashes and arbitrary code execution when specially crafted packets are sent to the device over the network. Protection functions and tripping function via GOOSE can be impacted. Affected Product: Easergy P3 (All versions prior to V30.205) Additional Analyst Notes: - CVE Program Container: References: - https://download.schneider-electric.com/files?p_Doc_Ref
Additional Analyst Notes: - CVE Program Container: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-011-04
CVE ID: CVE-2022-22726 State: PUBLISHED Published: 2022-02-04T22:29:38 Last Updated: 2024-08-03T03:21:49.053Z Vendors: n/a Products: EcoStruxure Power Monitoring Expert (Versions 2020 and prior) Problem Types: CWE-20 Description: A CWE-20: Improper Input Validation vulnerability exists that could allow arbitrary files on the server to be read by authenticated users through a limited operating system service account. Affected Product: EcoStruxure Power Monitoring Expert (Versions 2020 and prior) Additional Analyst Notes: - CVE Program Container: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-011-07
CVE ID: CVE-2022-22727 State: PUBLISHED Published: 2022-02-04T22:29:38 Last Updated: 2024-08-03T03:21:48.895Z Vendors: n/a Products: EcoStruxure Power Monitoring Expert (Versions 2020 and prior) Problem Types: CWE-20 Description: A CWE-20: Improper Input Validation vulnerability exists that could allow an unauthenticated attacker to view data, change settings, impact availability of the software, or potentially impact a user�s local machine when the user clicks a specially crafted link. Affected Product: EcoStruxure Power Monitoring Expert (Versions 2020 and prior) Additional Analyst Notes: - CVE Program Container: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-20
al Analyst Notes: - CVE Program Container: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-011-07
CVE ID: CVE-2022-22728 State: PUBLISHED Published: 2022-08-25T00:00:00 Last Updated: 2024-08-03T03:21:49.039Z Vendors: Apache Software Foundation Products: libapreq2 Problem Types: CWE-120 Description: A flaw in Apache libapreq2 versions 2.16 and earlier could cause a buffer overflow while processing multipart form uploads. A remote attacker could send a request causing a process crash which could lead to a denial of service attack. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread/2fsjoor96d47vtkpf76x4yo06nccvy1y - http://www.openwall.com/lists/oss-security/2022/08/25/4 - http://www.openwall.com/lists/oss-security/2022/08/25/3 - http://www.open
openwall.com/lists/oss-security/2022/08/25/4 - http://www.openwall.com/lists/oss-security/2022/08/25/3 - http://www.openwall.com/lists/oss-security/2022/08/26/4 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2PUUS3JL44UUSLJTSXE46HVKZIW7E7PE/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BE5MEHGIQUEIISBCVHM43IN2NBDXBFOJ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3HZZKVHYYWACPWONPEFRNPIRE3HYLV4T/ - http://www.openwall.com/lists/oss-security/2022/12/29/1 - http://www.openwall.com/lists/oss-security/2022/12/30/4 - http://www.openwall.co
l.com/lists/oss-security/2022/12/29/1 - http://www.openwall.com/lists/oss-security/2022/12/30/4 - http://www.openwall.com/lists/oss-security/2022/12/31/1 - http://www.openwall.com/lists/oss-security/2022/12/31/5 - http://www.openwall.com/lists/oss-security/2023/01/02/1 - http://www.openwall.com/lists/oss-security/2023/01/02/2 - http://www.openwall.com/lists/oss-security/2023/01/03/2 - https://lists.debian.org/debian-lts-announce/2023/01/msg00009.html - https://security.gentoo.org/glsa/202305-20
CVE ID: CVE-2022-22729 State: PUBLISHED Published: 2022-03-11T09:10:50 Last Updated: 2024-08-03T03:21:49.121Z Vendors: Yokogawa Electric Corporation Products: CENTUM CS 3000, CENTUM VP, Exaopc Problem Types: CWE-302 Description: CAMS for HIS Server contained in the following Yokogawa Electric products improperly authenticate the receiving packets. The authentication may be bypassed via some crafted packets: CENTUM CS 3000 versions from R3.08.10 to R3.09.00, CENTUM VP versions from R4.01.00 to R4.03.00, from R5.01.00 to R5.04.20, and from R6.01.00 to R6.08.00, and Exaopc versions from R3.72.00 to R3.79.00. Additional Analyst Notes: - CVE Program Container: References: - https://web-material3.
sions from R3.72.00 to R3.79.00. Additional Analyst Notes: - CVE Program Container: References: - https://web-material3.yokogawa.com/1/32094/files/YSAR-22-0001-E.pdf
CVE ID: CVE-2022-22730 State: PUBLISHED Published: 2022-08-18T19:44:53.000Z Last Updated: 2025-05-05T16:29:50.904Z Vendors: n/a Products: Intel(R) Edge Insights for Industrial software Problem Types: escalation of privilege Description: Improper authentication in the Intel(R) Edge Insights for Industrial software before version 2.6.1 may allow an unauthenticated user to potentially enable escalation of privilege via network access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00653.html
CVE ID: CVE-2022-22731 State: PUBLISHED Published: 2023-01-30T00:00:00.000Z Last Updated: 2025-02-05T20:09:04.898Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: Schneider Electric Products: EcoStruxure Power Commission Problem Types: CWE-22 Description: A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in a function that could allow an attacker to create or overwrite critical files that are used to execute code, such as programs or libraries and cause path traversal attacks. Affected Products: EcoStruxure Power Commission (Versions prior to V2.22) Additional Analyst Notes: - CVE Program Container:
cted Products: EcoStruxure Power Commission (Versions prior to V2.22) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2022-165-05_EcoStruxure_Power_Commission_Security_Notification.pdf
CVE ID: CVE-2022-22732 State: PUBLISHED Published: 2023-01-30T00:00:00.000Z Last Updated: 2025-02-05T20:08:57.280Z Severity: LOW (CVSS 3.9 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: Schneider Electric Products: EcoStruxure Power Commission Problem Types: CWE-668 Description: A CWE-668: Exposure of Resource to Wrong Sphere vulnerability exists that could cause all remote domains to access the resources (data) supplied by the server when an attacker sends a fetch request from third-party site or malicious site. Affected Products: EcoStruxure Power Commission (Versions prior to V2.22) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://d
ions prior to V2.22) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2022-165-05_EcoStruxure_Power_Commission_Security_Notification.pdf
CVE ID: CVE-2022-22733 State: PUBLISHED Published: 2022-01-20T10:25:12 Last Updated: 2024-08-03T03:21:49.071Z Vendors: Apache Software Foundation Products: Apache ShardingSphere ElasticJob-UI Problem Types: CWE-200 Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache ShardingSphere ElasticJob-UI allows an attacker who has guest account to do privilege escalation. This issue affects Apache ShardingSphere ElasticJob-UI Apache ShardingSphere ElasticJob-UI 3.x version 3.0.0 and prior versions. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread/qpdsm936n9bhksb0rzn6bq1h7ord2nm6 - http://www.openwall.com/lists/
ntainer: References: - https://lists.apache.org/thread/qpdsm936n9bhksb0rzn6bq1h7ord2nm6 - http://www.openwall.com/lists/oss-security/2022/01/20/2
CVE ID: CVE-2022-22734 State: PUBLISHED Published: 2022-03-14T14:41:53 Last Updated: 2024-08-03T03:21:48.945Z Vendors: Unknown Products: Simple Quotation Problem Types: CWE-116 Improper Encoding or Escaping of Output Description: The Simple Quotation WordPress plugin through 1.3.2 does not have CSRF check when creating or editing a quote and does not sanitise and escape Quotes. As a result, attacker could make a logged in admin create or edit arbitrary quote, and put Cross-Site Scripting payloads in them Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/f6e15a23-8f8c-47c2-8227-e277856d8251
CVE ID: CVE-2022-22735 State: PUBLISHED Published: 2022-03-14T14:41:54 Last Updated: 2024-08-03T03:21:48.905Z Vendors: Unknown Products: Simple Quotation Problem Types: CWE-89 Description: The Simple Quotation WordPress plugin through 1.3.2 does not have authorisation (and CSRF) checks in various of its AJAX actions and is lacking escaping of user data when using it in SQL statements, allowing any authenticated users, such as subscriber to perform SQL injection attacks Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/6940a97e-5a75-405c-be74-bedcc3a8ee00
CVE ID: CVE-2022-22736 State: PUBLISHED Published: 2022-12-22T00:00:00.000Z Last Updated: 2025-04-16T15:12:48.112Z Vendors: Mozilla Products: Firefox Problem Types: Potential local privilege escalation when loading modules from the install directory. Description: If Firefox was installed to a world-writable directory, a local privilege escalation could occur when Firefox searched the current directory for system libraries. However the install directory is not world-writable by default.<br>*This bug only affects Firefox for Windows in a non-default installation. Other operating systems are unaffected.*. This vulnerability affects Firefox < 96. Additional Analyst Notes: - CVE Program Container
ing systems are unaffected.*. This vulnerability affects Firefox < 96. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2022-01/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1742692
CVE ID: CVE-2022-22737 State: PUBLISHED Published: 2022-12-22T00:00:00.000Z Last Updated: 2025-04-16T15:08:29.311Z Vendors: Mozilla Products: Firefox ESR, Firefox, Thunderbird Problem Types: Race condition when playing audio files Description: Constructing audio sinks could have lead to a race condition when playing audio files and closing windows. This could have lead to a use-after-free causing a potentially exploitable crash. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2022-01/ - https://www.mozilla.org/security/
Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2022-01/ - https://www.mozilla.org/security/advisories/mfsa2022-02/ - https://www.mozilla.org/security/advisories/mfsa2022-03/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1745874