Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
38ade939ec5d/setuptools/package_index.py#L200 - https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages/ - https://github.com/pypa/setuptools/commit/43a9c9bfa6aa626ec2a22540bea28d2ca77964be - https://pyup.io/vulnerabilities/CVE-2022-40897/52495/ - https://github.com/pypa/setuptools/compare/v65.5.0...v65.5.1 - https://security.netapp.com/advisory/ntap-20230214-0001/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YNA2BAH2ACBZ4TVJZKFLCR7L23BG5C3H/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ADES3NLOE5QJKBLGNZNI2RGVOSQXA37R/ - https://security.netapp.com/advisory/n
ge-announce%40lists.fedoraproject.org/message/ADES3NLOE5QJKBLGNZNI2RGVOSQXA37R/ - https://security.netapp.com/advisory/ntap-20240621-0006/
CVE ID: CVE-2022-40898 State: PUBLISHED Published: 2022-12-22T00:00:00.000Z Last Updated: 2025-04-15T15:53:50.771Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlier allows remote attackers to cause a denial of service via attacker controlled input to wheel cli. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://pypi.org/project/wheel/ - https://github.com/pypa/wheel/blob/main/src/wheel/wheelfile.py#L18 - https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages/
CVE ID: CVE-2022-40899 State: PUBLISHED Published: 2022-12-22T00:00:00.000Z Last Updated: 2025-04-15T15:52:06.467Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue discovered in Python Charmers Future 0.18.2 and earlier allows remote attackers to cause a denial of service via crafted Set-Cookie header from malicious web server. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://pypi.org/project/future/ - https://github.com/PythonCharmers/python-future/blob/master/src/future/backports/http/cookiejar.py#L215 - https://github.com/python/cpython/pull/17157 - https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-
https://github.com/python/cpython/pull/17157 - https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages/ - https://github.com/PythonCharmers/python-future/pull/610
CVE ID: CVE-2022-40903 State: PUBLISHED Published: 2022-11-14T00:00:00.000Z Last Updated: 2025-04-30T19:07:38.410Z Vendors: n/a Products: n/a Problem Types: n/a Description: Aiphone GT-DMB-N 3-in-1 Video Entrance Station with NFC Reader 1.0.3 does not mitigate against repeated failed access attempts, which allows an attacker to gain administrative privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jvn.jp/en/jp/JVN75437943/index.html - https://www.aiphone.net/
CVE ID: CVE-2022-40912 State: PUBLISHED Published: 2022-09-28T13:50:27.000Z Last Updated: 2025-05-20T20:20:26.356Z Vendors: n/a Products: n/a Problem Types: n/a Description: ETAP Lighting International NV ETAP Safety Manager 1.0.0.32 is vulnerable to Cross Site Scripting (XSS). Input passed to the GET parameter 'action' is not properly sanitized before being returned to the user. This can be exploited to execute arbitrary HTML/JS code in a user's browser session in context of an affected site. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5711.php
CVE ID: CVE-2022-40916 State: PUBLISHED Published: 2025-02-06T00:00:00.000Z Last Updated: 2025-02-07T18:51:41.687Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tiny File Manager v2.4.7 and below is vulnerable to session fixation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/prasathmani/tinyfilemanager - https://github.com/whitej3rry/CVE-2022-40916/blob/main/PoC.md
CVE ID: CVE-2022-40918 State: PUBLISHED Published: 2022-12-05T00:00:00.000Z Last Updated: 2025-04-24T14:33:38.815Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in firmware lewei_cam binary version 2.0.10 in Force 1 Discovery Wifi U818A HD+ FPV Drone allows attacker to gain remote code execution as root user via a specially crafted UDP packet. Please update the Reference section to these links > http://thiscomputer.com/ > https://www.bostoncyber.org/ > https://medium.com/@meekworth/exploiting-the-lw9621-drone-camera-module-773f00081368 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://medium.com/%40meekworth/exploit
l Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://medium.com/%40meekworth/exploiting-the-lw9621-drone-camera-module-773f00081368 - https://1af95112-6fd8-4c8f-8bd6-c47f8ef7b77a.filesusr.com/ugd/c1f861_51eb0d33d5764efc93e9d5f19c306950.pdf
CVE ID: CVE-2022-40921 State: PUBLISHED Published: 2022-10-11T00:00:00 Last Updated: 2024-08-03T12:28:42.888Z Vendors: n/a Products: n/a Problem Types: n/a Description: DedeCMS V5.7.99 was discovered to contain an arbitrary file upload vulnerability via the component /dede/file_manage_control.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/T4nGg/DedeCMS-V5.7.99-File-Upload/
CVE ID: CVE-2022-40922 State: PUBLISHED Published: 2022-10-03T12:45:20 Last Updated: 2024-08-03T12:28:42.957Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability in the LIEF::MachO::BinaryParser::init_and_parse function of LIEF v0.12.1 allows attackers to cause a denial of service (DOS) through a segmentation fault via a crafted MachO file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/lief-project/LIEF/issues/781
CVE ID: CVE-2022-40923 State: PUBLISHED Published: 2022-09-30T18:36:33.000Z Last Updated: 2025-05-20T15:49:09.574Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability in the LIEF::MachO::SegmentCommand::virtual_address function of LIEF v0.12.1 allows attackers to cause a denial of service (DOS) through a segmentation fault via a crafted MachO file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/lief-project/LIEF/issues/784
CVE ID: CVE-2022-40924 State: PUBLISHED Published: 2022-09-26T12:03:15.000Z Last Updated: 2025-05-21T17:46:16.094Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoo Management System v1.0 has an arbitrary file upload vulnerability in the picture upload point of the "save_animal" file of the "Animals" module in the background management system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/admin77888/Bug_report/blob/main/vendors/pushpam02/zoo-management-system/RCE-1.md
CVE ID: CVE-2022-40925 State: PUBLISHED Published: 2022-09-26T12:04:33.000Z Last Updated: 2025-05-21T17:45:07.640Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoo Management System v1.0 has an arbitrary file upload vulnerability in the picture upload point of the "save_event" file of the "Events" module in the background management system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/admin77888/Bug_report/blob/main/vendors/pushpam02/zoo-management-system/RCE-2.md
CVE ID: CVE-2022-40926 State: PUBLISHED Published: 2022-09-26T12:25:53.000Z Last Updated: 2025-05-21T18:47:10.937Z Vendors: n/a Products: n/a Problem Types: n/a Description: Online Leave Management System v1.0 is vulnerable to SQL Injection via /leave_system/classes/Master.php?f=delete_leave_type. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/admin77888/Bug_report/blob/main/vendors/oretnom23/online-leave-management-system/SQLi-2.md
CVE ID: CVE-2022-40927 State: PUBLISHED Published: 2022-09-26T12:29:18.000Z Last Updated: 2025-05-21T18:46:29.136Z Vendors: n/a Products: n/a Problem Types: n/a Description: Online Leave Management System v1.0 is vulnerable to SQL Injection via /leave_system/classes/Master.php?f=delete_designation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/admin77888/Bug_report/blob/main/vendors/oretnom23/online-leave-management-system/SQLi-1.md
CVE ID: CVE-2022-40928 State: PUBLISHED Published: 2022-09-26T12:09:53.000Z Last Updated: 2025-05-21T17:42:17.971Z Vendors: n/a Products: n/a Problem Types: n/a Description: Online Leave Management System v1.0 is vulnerable to SQL Injection via /leave_system/classes/Master.php?f=delete_application. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/admin77888/Bug_report/blob/main/vendors/oretnom23/online-leave-management-system/SQLi-3.md
CVE ID: CVE-2022-40929 State: PUBLISHED Published: 2022-09-28T00:00:00.000Z Last Updated: 2025-05-21T14:55:07.801Z Vendors: n/a Products: n/a Problem Types: n/a Description: XXL-JOB 2.2.0 has a Command execution vulnerability in background tasks. NOTE: this is disputed because the issues/4929 report is about an intended and supported use case (running arbitrary Bash scripts on behalf of users). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/xuxueli/xxl-job/issues/2979
CVE ID: CVE-2022-40931 State: PUBLISHED Published: 2022-09-29T15:31:45.000Z Last Updated: 2025-05-20T17:48:24.410Z Vendors: n/a Products: n/a Problem Types: n/a Description: dutchcoders Transfer.sh 1.4.0 is vulnerable to Cross Site Scripting (XSS). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/dutchcoders/transfer.sh/issues/500 - https://github.com/dutchcoders/transfer.sh/pull/501
CVE ID: CVE-2022-40932 State: PUBLISHED Published: 2022-09-22T15:59:43.000Z Last Updated: 2025-05-27T15:49:35.921Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Zoo Management System v1.0, there is an arbitrary file upload vulnerability in the picture upload point of the "gallery" file of the "Gallery" module in the background management system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/lime-10010/Bug_report/blob/main/vendors/pushpam02/zoo-management-system/RCE-1.md
CVE ID: CVE-2022-40933 State: PUBLISHED Published: 2022-09-22T16:03:23.000Z Last Updated: 2025-05-27T15:47:18.158Z Vendors: n/a Products: n/a Problem Types: n/a Description: Online Pet Shop We App v1.0 by oretnom23 is vulnerable to SQL injection via /pet_shop/classes/Master.php?f=delete_order,id. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/lime-10010/Bug_report/blob/main/vendors/oretnom23/online-pet-shop-we-app/SQLi-1.md
CVE ID: CVE-2022-40934 State: PUBLISHED Published: 2022-09-22T16:05:38.000Z Last Updated: 2025-05-27T15:41:58.615Z Vendors: n/a Products: n/a Problem Types: n/a Description: Online Pet Shop We App v1.0 is vulnerable to SQL injection via /pet_shop/classes/Master.php?f=delete_sub_category,id Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/lime-10010/Bug_report/blob/main/vendors/oretnom23/online-pet-shop-we-app/SQLi-3.md
CVE ID: CVE-2022-40935 State: PUBLISHED Published: 2022-09-22T16:07:07.000Z Last Updated: 2025-05-27T15:39:57.626Z Vendors: n/a Products: n/a Problem Types: n/a Description: Online Pet Shop We App v1.0 is vulnerable to SQL Injection via /pet_shop/classes/Master.php?f=delete_category,id. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/lime-10010/Bug_report/blob/main/vendors/oretnom23/online-pet-shop-we-app/SQLi-2.md
CVE ID: CVE-2022-40939 State: PUBLISHED Published: 2022-12-08T00:00:00.000Z Last Updated: 2025-04-22T20:28:12.850Z Vendors: n/a Products: n/a Problem Types: n/a Description: In certain Secustation products the administrator account password can be read. This affects V2.5.5.3116-S50-SMA-B20171107A, V2.3.4.1301-M20-TSA-B20150617A, V2.5.5.3116-S50-RXA-B20180502A, V2.5.5.3116-S50-SMA-B20190723A, V2.5.5.3116-S50-SMB-B20161012A, V2.3.4.2103-S50-NTD-B20170508B, V2.5.5.3116-S50-SMB-B20160601A, V2.5.5.2601-S50-TSA-B20151229A, and V2.5.5.3116-S50-SMA-B20170217. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cdsbz.gitbook.io/untitled/secustion-camera-v
es: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cdsbz.gitbook.io/untitled/secustion-camera-vulnerability-recurrence
CVE ID: CVE-2022-40942 State: PUBLISHED Published: 2022-09-28T14:16:55.000Z Last Updated: 2025-05-21T14:27:17.787Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda TX3 US_TX3V1.0br_V16.03.13.11 is vulnerable to stack overflow via compare_parentcontrol_time. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Rumble0x0/vulnerability/blob/main/tenda/TX3/stack%20overflow%20via%20compare_parentcontrol_time.pdf
CVE ID: CVE-2022-40943 State: PUBLISHED Published: 2022-09-30T18:29:38.000Z Last Updated: 2025-05-20T15:53:25.452Z Vendors: n/a Products: n/a Problem Types: n/a Description: Dairy Farm Shop Management System 1.0 is vulnerable to SQL Injection via bwdate-report-ds.php file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://phpgurukul.com/dairy-farm-shop-management-system-using-php-and-mysql/ - https://github.com/Qrayyy/CVE/blob/main/Dairy%20Farm%20Shop%20Management%20System/bwdate-report-ds-sql%28CVE-2022-40943%29.md
CVE ID: CVE-2022-40944 State: PUBLISHED Published: 2022-09-30T17:11:04.000Z Last Updated: 2025-05-20T16:12:19.405Z Vendors: n/a Products: n/a Problem Types: n/a Description: Dairy Farm Shop Management System 1.0 is vulnerable to SQL Injection via sales-report-ds.php file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://phpgurukul.com/dairy-farm-shop-management-system-using-php-and-mysql/ - https://caicaizi.top/archives/9/ - https://github.com/Qrayyy/CVE/blob/main/Dairy%20Farm%20Shop%20Management%20System/sales-report-ds-sql%28CVE-2022-40944%29.md
CVE ID: CVE-2022-40946 State: PUBLISHED Published: 2023-04-16T00:00:00.000Z Last Updated: 2025-02-06T17:06:58.720Z Vendors: n/a Products: n/a Problem Types: n/a Description: On D-Link DIR-819 Firmware Version 1.06 Hardware Version A1 devices, it is possible to trigger a Denial of Service via the sys_token parameter in a cgi-bin/webproc?getpage=html/index.html request. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.dlink.com/en/security-bulletin/ - https://github.com/whokilleddb/dlink-dir-819-dos - http://packetstormsecurity.com/files/171484/D-Link-DIR-819-A1-Denial-Of-Service.html
CVE ID: CVE-2022-40954 State: PUBLISHED Published: 2022-11-22T00:00:00.000Z Last Updated: 2025-04-29T13:50:28.084Z Vendors: Apache Software Foundation Products: Apache Airflow Spark Provider, Apache Airflow Problem Types: CWE-78 Description: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airflow Spark Provider, Apache Airflow allows an attacker to read arbtrary files in the task execution context, without write access to DAG files. This issue affects Spark Provider versions prior to 4.0.0. It also impacts any Apache Airflow versions prior to 2.3.0 in case Spark Provider is installed (Spark Provider 4.0.0 can only be installe
ny Apache Airflow versions prior to 2.3.0 in case Spark Provider is installed (Spark Provider 4.0.0 can only be installed for Airflow 2.3.0+). Note that you need to manually install the Spark Provider version 4.0.0 in order to get rid of the vulnerability on top of Airflow 2.3.0+ version that has lower version of the Spark Provider installed). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/apache/airflow/pull/27646 - https://lists.apache.org/thread/0tmdlnmjs5t4gsx5fy73tb6zd3jztq45
CVE ID: CVE-2022-40955 State: PUBLISHED Published: 2022-09-20T13:50:08.000Z Last Updated: 2025-05-29T13:55:00.126Z Vendors: Apache Software Foundation Products: Apache InLong Problem Types: CWE-502 Description: In versions of Apache InLong prior to 1.3.0, an attacker with sufficient privileges to specify MySQL JDBC connection URL parameters and to write arbitrary data to the MySQL database, could cause this data to be deserialized by Apache InLong, potentially leading to Remote Code Execution on the Apache InLong server. Users are advised to upgrade to Apache InLong 1.3.0 or newer. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.
r newer. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/r1r34y7bchrpmp9jhfdoohzdmk7pj1q1 - http://www.openwall.com/lists/oss-security/2022/09/22/5
CVE ID: CVE-2022-40956 State: PUBLISHED Published: 2022-12-22T00:00:00.000Z Last Updated: 2025-04-15T16:11:04.593Z Vendors: Mozilla Products: Firefox ESR, Thunderbird, Firefox Problem Types: Content-Security-Policy base-uri bypass Description: When injecting an HTML base element, some requests would ignore the CSP's base-uri settings and accept the injected element's base instead. This vulnerability affects Firefox ESR < 102.3, Thunderbird < 102.3, and Firefox < 105. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2022-40/ - https://www.mozilla.org/security/advisories/mfsa2022-41/ - https://www.mozilla.
a.org/security/advisories/mfsa2022-40/ - https://www.mozilla.org/security/advisories/mfsa2022-41/ - https://www.mozilla.org/security/advisories/mfsa2022-42/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1770094
CVE ID: CVE-2022-40957 State: PUBLISHED Published: 2022-12-22T00:00:00.000Z Last Updated: 2025-04-15T16:09:16.762Z Vendors: Mozilla Products: Firefox ESR, Thunderbird, Firefox Problem Types: Incoherent instruction cache when building WASM on ARM64 Description: Inconsistent data in instruction and data cache when creating wasm code could lead to a potentially exploitable crash.<br>*This bug only affects Firefox on ARM64 platforms.*. This vulnerability affects Firefox ESR < 102.3, Thunderbird < 102.3, and Firefox < 105. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2022-40/ - https://www.mozilla.org/sec
A ADP Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2022-40/ - https://www.mozilla.org/security/advisories/mfsa2022-41/ - https://www.mozilla.org/security/advisories/mfsa2022-42/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1777604
CVE ID: CVE-2022-40958 State: PUBLISHED Published: 2022-12-22T00:00:00.000Z Last Updated: 2025-04-15T14:55:52.463Z Vendors: Mozilla Products: Firefox ESR, Thunderbird, Firefox Problem Types: Bypassing Secure Context restriction for cookies with __Host and __Secure prefix Description: By injecting a cookie with certain special characters, an attacker on a shared subdomain which is not a secure context could set and thus overwrite cookies from a secure context, leading to session fixation and other attacks. This vulnerability affects Firefox ESR < 102.3, Thunderbird < 102.3, and Firefox < 105. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www
and Firefox < 105. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2022-40/ - https://www.mozilla.org/security/advisories/mfsa2022-41/ - https://www.mozilla.org/security/advisories/mfsa2022-42/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1779993
CVE ID: CVE-2022-40959 State: PUBLISHED Published: 2022-12-22T00:00:00.000Z Last Updated: 2025-04-15T14:54:12.419Z Vendors: Mozilla Products: Firefox ESR, Thunderbird, Firefox Problem Types: Bypassing FeaturePolicy restrictions on transient pages Description: During iframe navigation, certain pages did not have their FeaturePolicy fully initialized leading to a bypass that leaked device permissions into untrusted subdocuments. This vulnerability affects Firefox ESR < 102.3, Thunderbird < 102.3, and Firefox < 105. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2022-40/ - https://www.mozilla.org/security
Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2022-40/ - https://www.mozilla.org/security/advisories/mfsa2022-41/ - https://www.mozilla.org/security/advisories/mfsa2022-42/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1782211
CVE ID: CVE-2022-40960 State: PUBLISHED Published: 2022-12-22T00:00:00.000Z Last Updated: 2025-04-15T14:52:13.211Z Vendors: Mozilla Products: Firefox ESR, Thunderbird, Firefox Problem Types: Data-race when parsing non-UTF-8 URLs in threads Description: Concurrent use of the URL parser with non-UTF-8 data was not thread-safe. This could lead to a use-after-free causing a potentially exploitable crash. This vulnerability affects Firefox ESR < 102.3, Thunderbird < 102.3, and Firefox < 105. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2022-40/ - https://www.mozilla.org/security/advisories/mfsa2022-41/ -
- https://www.mozilla.org/security/advisories/mfsa2022-40/ - https://www.mozilla.org/security/advisories/mfsa2022-41/ - https://www.mozilla.org/security/advisories/mfsa2022-42/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1787633
CVE ID: CVE-2022-40961 State: PUBLISHED Published: 2022-12-22T00:00:00.000Z Last Updated: 2025-04-15T14:50:36.525Z Vendors: Mozilla Products: Firefox Problem Types: Stack-buffer overflow when initializing Graphics Description: During startup, a graphics driver with an unexpected name could lead to a stack-buffer overflow causing a potentially exploitable crash.<br>*This issue only affects Firefox for Android. Other operating systems are not affected.*. This vulnerability affects Firefox < 105. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2022-40/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1784588
CVE ID: CVE-2022-40962 State: PUBLISHED Published: 2022-12-22T00:00:00.000Z Last Updated: 2025-04-15T14:49:00.131Z Vendors: Mozilla Products: Firefox ESR, Thunderbird, Firefox Problem Types: Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3 Description: Mozilla developers Nika Layzell, Timothy Nikkel, Sebastian Hengst, Andreas Pehrson, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 104 and Firefox ESR 102.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 102.3, Thunderbird < 102.3, and Firefox < 105. A
ploited to run arbitrary code. This vulnerability affects Firefox ESR < 102.3, Thunderbird < 102.3, and Firefox < 105. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2022-40/ - https://www.mozilla.org/security/advisories/mfsa2022-41/ - https://www.mozilla.org/security/advisories/mfsa2022-42/ - https://bugzilla.mozilla.org/buglist.cgi?bug_id=1776655%2C1777574%2C1784835%2C1785109%2C1786502%2C1789440