Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-23906 State: PUBLISHED Published: 2022-02-28T22:55:14 Last Updated: 2024-08-03T03:59:21.993Z Vendors: n/a Products: n/a Problem Types: n/a Description: CMS Made Simple v2.2.15 was discovered to contain a Remote Command Execution (RCE) vulnerability via the upload avatar function. This vulnerability is exploited via a crafted image file. Additional Analyst Notes: - CVE Program Container: References: - http://dev.cmsmadesimple.org/bug/view/12502
CVE ID: CVE-2022-23907 State: PUBLISHED Published: 2022-02-28T22:55:15 Last Updated: 2024-08-03T03:59:22.489Z Vendors: n/a Products: n/a Problem Types: n/a Description: CMS Made Simple v2.2.15 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the parameter m1_fmmessage. Additional Analyst Notes: - CVE Program Container: References: - http://dev.cmsmadesimple.org/bug/view/12503
CVE ID: CVE-2022-23909 State: PUBLISHED Published: 2022-04-05T05:49:17 Last Updated: 2024-08-03T03:59:22.014Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is an unquoted service path in Sherpa Connector Service (SherpaConnectorService.exe) 2020.2.20328.2050. This might allow a local user to escalate privileges by creating a "C:\Program Files\Sherpa Software\Sherpa.exe" file. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/166574/Sherpa-Connector-Service-2020.2.20328.2050-Unquoted-Service-Path.html - https://github.com/netsectuna/CVE-2022-23909
CVE ID: CVE-2022-23911 State: PUBLISHED Published: 2022-02-28T09:06:57 Last Updated: 2024-08-03T03:59:22.478Z Vendors: Unknown Products: Testimonial WordPress Plugin – AP Custom Testimonial Problem Types: CWE-89 Description: The Testimonial WordPress Plugin WordPress plugin before 1.4.7 does not validate and escape the id parameter before using it in a SQL statement when retrieving a testimonial to edit, leading to a SQL Injection Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/77fd6749-4fb2-48fa-a191-437b442f28e9 - https://plugins.trac.wordpress.org/changeset/2664185
CVE ID: CVE-2022-23912 State: PUBLISHED Published: 2022-02-28T09:06:59 Last Updated: 2024-08-03T03:59:22.638Z Vendors: Unknown Products: Testimonial WordPress Plugin – AP Custom Testimonial Problem Types: CWE-79 Description: The Testimonial WordPress Plugin WordPress plugin before 1.4.7 does not sanitise and escape the id parameter before outputting it back in an attribute, leading to a Reflected cross-Site Scripting Additional Analyst Notes: - CVE Program Container: References: - https://plugins.trac.wordpress.org/changeset/2664185 - https://wpscan.com/vulnerability/09512431-aa33-4514-8b20-1963c5d89f33
CVE ID: CVE-2022-23913 State: PUBLISHED Published: 2022-02-04T22:33:01 Last Updated: 2024-08-03T03:59:22.547Z Vendors: Apache Software Foundation Products: Apache ActiveMQ Artemis Problem Types: CWE-770 Description: In Apache ActiveMQ Artemis prior to 2.20.0 or 2.19.1, an attacker could partially disrupt availability (DoS) through uncontrolled resource consumption of memory. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread/fjynj57rd99s814rdn5hzvmx8lz403q2 - https://security.netapp.com/advisory/ntap-20220303-0003/
CVE ID: CVE-2022-23914 State: REJECTED Published: N/A Last Updated: 2025-05-28T18:19:12.176Z Description: No description available.
CVE ID: CVE-2022-23915 State: PUBLISHED Published: 2022-03-04T20:00:13.383792Z Last Updated: 2024-09-17T00:10:54.741Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: n/a Products: Weblate Problem Types: Remote Code Execution (RCE) Description: The package weblate from 0 and before 4.11.1 are vulnerable to Remote Code Execution (RCE) via argument injection when using git or mercurial repositories. Authenticated users, can change the behavior of the application in an unintended way, leading to command execution. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-PYTHON-WEBLATE-2414088 - https://github.com/WeblateOrg/weblat
Program Container: References: - https://snyk.io/vuln/SNYK-PYTHON-WEBLATE-2414088 - https://github.com/WeblateOrg/weblate/pull/7338 - https://github.com/WeblateOrg/weblate/pull/7337 - https://github.com/WeblateOrg/weblate/releases/tag/weblate-4.11.1
CVE ID: CVE-2022-23916 State: PUBLISHED Published: 2022-02-24T09:50:30 Last Updated: 2024-08-03T03:59:22.651Z Vendors: appleple inc. Products: a-blog cms Problem Types: Cross-site scripting Description: Cross-site scripting vulnerability in a-blog cms Ver.2.8.x series versions prior to Ver.2.8.75, Ver.2.9.x series versions prior to Ver.2.9.40, Ver.2.10.x series versions prior to Ver.2.10.44, Ver.2.11.x series versions prior to Ver.2.11.42, and Ver.3.0.x series versions prior to Ver.3.0.1 allows a remote authenticated attacker to inject an arbitrary script via unspecified vectors. This vulnerability is different from CVE-2022-24374. Additional Analyst Notes: - CVE Program Container: Reference
ctors. This vulnerability is different from CVE-2022-24374. Additional Analyst Notes: - CVE Program Container: References: - https://developer.a-blogcms.jp/blog/news/security-202202.html - https://jvn.jp/en/jp/JVN14706307/index.html
CVE ID: CVE-2022-23917 State: REJECTED Published: N/A Last Updated: 2025-05-28T18:19:13.498Z Description: No description available.
CVE ID: CVE-2022-23918 State: PUBLISHED Published: 2022-08-05T21:12:34.519Z Last Updated: 2025-04-15T18:58:04.859Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: TCL Products: LinkHub Mesh Wifi Problem Types: CWE-121 Description: A stack-based buffer overflow vulnerability exists in the confsrv set_mf_rule functionality of TCL LinkHub Mesh Wifi MS1G_00_01.00_14. A specially-crafted network packet can lead to stack-based buffer overflow. An attacker can send a malicious packet to trigger this vulnerability.This vulnerability leverages the ethAddr field within the protobuf message to cause a buffer overflow. Additional Analyst Notes: - CVE Program Container: -
Addr field within the protobuf message to cause a buffer overflow. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2022-1455
CVE ID: CVE-2022-23919 State: PUBLISHED Published: 2022-08-05T21:12:49.739Z Last Updated: 2025-04-15T18:57:54.778Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: TCL Products: LinkHub Mesh Wifi Problem Types: CWE-121 Description: A stack-based buffer overflow vulnerability exists in the confsrv set_mf_rule functionality of TCL LinkHub Mesh Wifi MS1G_00_01.00_14. A specially-crafted network packet can lead to stack-based buffer overflow. An attacker can send a malicious packet to trigger this vulnerability.This vulnerability leverages the name field within the protobuf message to cause a buffer overflow. Additional Analyst Notes: - CVE Program Container: - CIS
e field within the protobuf message to cause a buffer overflow. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2022-1455
CVE ID: CVE-2022-23921 State: PUBLISHED Published: 2022-02-25T18:10:55.935Z Last Updated: 2025-04-16T18:00:35.453Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: General Electric Products: Proficy CIMPLICITY Problem Types: CWE-269 Description: Exploitation of this vulnerability may result in local privilege escalation and code execution. GE maintains exploitation of this vulnerability is only possible if the attacker has login access to a machine actively running CIMPLICITY, the CIMPLICITY server is not already running a project, and the server is licensed for multiple projects. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Refer
ver is licensed for multiple projects. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-053-01
CVE ID: CVE-2022-23922 State: PUBLISHED Published: 2022-02-24T18:26:58.463Z Last Updated: 2025-04-16T16:44:50.475Z Severity: MEDIUM (CVSS 5.6 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:L) Vendors: WIN-911 Products: WIN-911 Problem Types: CWE-276 Description: WIN-911 2021 R1 and R2 are vulnerable to a permissions misconfiguration that may allow an attacker to locally write files to the Program Announcer directory and elevate permissions whenever the program is executed. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-053-03 - https://supportdesk.win911.com/support/solutions/articles/24000074683-win-91
.gov/uscert/ics/advisories/icsa-22-053-03 - https://supportdesk.win911.com/support/solutions/articles/24000074683-win-911-2021-r1-r2-file-permission-vulnerability
CVE ID: CVE-2022-23923 State: PUBLISHED Published: 2022-05-01T15:25:26.502204Z Last Updated: 2024-09-17T00:45:43.598Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P) Vendors: n/a Products: jailed Problem Types: Sandbox Bypass Description: All versions of package jailed are vulnerable to Sandbox Bypass via an exported alert() method which can access the main application. Exported methods are stored in the application.remote object. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-JAILED-2391490 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-2441254
CVE ID: CVE-2022-23924 State: PUBLISHED Published: 2022-03-11T17:54:12 Last Updated: 2024-08-03T03:59:22.511Z Vendors: n/a Products: HP PC BIOS Problem Types: Escalation of Privilege; Arbitrary Code Execution; Unauthorized Code Execution; Denial of Service; Information Disclosure Description: Potential vulnerabilities have been identified in the system BIOS of certain HP PC products which may allow Escalation of Privilege, Arbitrary Code Execution, Unauthorized Code Execution, Denial of Service, and Information Disclosure. Additional Analyst Notes: - CVE Program Container: References: - https://support.hp.com/us-en/document/ish_5817864-5817896-16
CVE ID: CVE-2022-23925 State: PUBLISHED Published: 2022-03-11T17:54:12 Last Updated: 2024-08-03T03:59:22.794Z Vendors: n/a Products: HP PC BIOS Problem Types: Escalation of Privilege; Arbitrary Code Execution; Unauthorized Code Execution; Denial of Service; Information Disclosure Description: Potential vulnerabilities have been identified in the system BIOS of certain HP PC products which may allow Escalation of Privilege, Arbitrary Code Execution, Unauthorized Code Execution, Denial of Service, and Information Disclosure. Additional Analyst Notes: - CVE Program Container: References: - https://support.hp.com/us-en/document/ish_5817864-5817896-16
CVE ID: CVE-2022-23926 State: PUBLISHED Published: 2022-03-11T17:54:16 Last Updated: 2024-08-03T03:59:22.700Z Vendors: n/a Products: HP PC BIOS Problem Types: Escalation of Privilege; Arbitrary Code Execution; Unauthorized Code Execution; Denial of Service; Information Disclosure Description: Potential vulnerabilities have been identified in the system BIOS of certain HP PC products which may allow Escalation of Privilege, Arbitrary Code Execution, Unauthorized Code Execution, Denial of Service, and Information Disclosure. Additional Analyst Notes: - CVE Program Container: References: - https://support.hp.com/us-en/document/ish_5817864-5817896-16
CVE ID: CVE-2022-23927 State: PUBLISHED Published: 2022-03-11T17:54:16 Last Updated: 2024-08-03T03:59:22.830Z Vendors: n/a Products: HP PC BIOS Problem Types: Escalation of Privilege; Arbitrary Code Execution; Unauthorized Code Execution; Denial of Service; Information Disclosure Description: Potential vulnerabilities have been identified in the system BIOS of certain HP PC products which may allow Escalation of Privilege, Arbitrary Code Execution, Unauthorized Code Execution, Denial of Service, and Information Disclosure. Additional Analyst Notes: - CVE Program Container: References: - https://support.hp.com/us-en/document/ish_5817864-5817896-16
CVE ID: CVE-2022-23928 State: PUBLISHED Published: 2022-03-11T17:54:18 Last Updated: 2024-08-03T03:59:23.401Z Vendors: n/a Products: HP PC BIOS Problem Types: Escalation of Privilege; Arbitrary Code Execution; Unauthorized Code Execution; Denial of Service; Information Disclosure Description: Potential vulnerabilities have been identified in the system BIOS of certain HP PC products which may allow Escalation of Privilege, Arbitrary Code Execution, Unauthorized Code Execution, Denial of Service, and Information Disclosure. Additional Analyst Notes: - CVE Program Container: References: - https://support.hp.com/us-en/document/ish_5817864-5817896-16
CVE ID: CVE-2022-23929 State: PUBLISHED Published: 2022-03-11T17:54:17 Last Updated: 2024-08-03T03:59:23.374Z Vendors: n/a Products: HP PC BIOS Problem Types: Escalation of Privilege; Arbitrary Code Execution; Unauthorized Code Execution; Denial of Service; Information Disclosure Description: Potential vulnerabilities have been identified in the system BIOS of certain HP PC products which may allow Escalation of Privilege, Arbitrary Code Execution, Unauthorized Code Execution, Denial of Service, and Information Disclosure. Additional Analyst Notes: - CVE Program Container: References: - https://support.hp.com/us-en/document/ish_5817864-5817896-16
CVE ID: CVE-2022-23930 State: PUBLISHED Published: 2022-03-11T17:54:13 Last Updated: 2024-08-03T03:59:23.324Z Vendors: n/a Products: HP PC BIOS Problem Types: Escalation of Privilege; Arbitrary Code Execution; Unauthorized Code Execution; Denial of Service; Information Disclosure Description: Potential vulnerabilities have been identified in the system BIOS of certain HP PC products which may allow Escalation of Privilege, Arbitrary Code Execution, Unauthorized Code Execution, Denial of Service, and Information Disclosure. Additional Analyst Notes: - CVE Program Container: References: - https://support.hp.com/us-en/document/ish_5817864-5817896-16
CVE ID: CVE-2022-23931 State: PUBLISHED Published: 2022-03-11T17:54:14 Last Updated: 2024-08-03T03:59:23.306Z Vendors: n/a Products: HP PC BIOS Problem Types: Escalation of Privilege; Arbitrary Code Execution; Unauthorized Code Execution; Denial of Service; Information Disclosure Description: Potential vulnerabilities have been identified in the system BIOS of certain HP PC products which may allow Escalation of Privilege, Arbitrary Code Execution, Unauthorized Code Execution, Denial of Service, and Information Disclosure. Additional Analyst Notes: - CVE Program Container: References: - https://support.hp.com/us-en/document/ish_5817864-5817896-16
CVE ID: CVE-2022-23932 State: PUBLISHED Published: 2022-03-11T17:54:19 Last Updated: 2024-08-03T03:59:23.151Z Vendors: n/a Products: HP PC BIOS Problem Types: Escalation of Privilege; Arbitrary Code Execution; Unauthorized Code Execution; Denial of Service; Information Disclosure Description: Potential vulnerabilities have been identified in the system BIOS of certain HP PC products which may allow Escalation of Privilege, Arbitrary Code Execution, Unauthorized Code Execution, Denial of Service, and Information Disclosure. Additional Analyst Notes: - CVE Program Container: References: - https://support.hp.com/us-en/document/ish_5817864-5817896-16
CVE ID: CVE-2022-23933 State: PUBLISHED Published: 2022-03-11T17:54:20 Last Updated: 2024-08-03T03:59:23.140Z Vendors: n/a Products: HP PC BIOS Problem Types: Escalation of Privilege; Arbitrary Code Execution; Unauthorized Code Execution; Denial of Service; Information Disclosure Description: Potential vulnerabilities have been identified in the system BIOS of certain HP PC products which may allow Escalation of Privilege, Arbitrary Code Execution, Unauthorized Code Execution, Denial of Service, and Information Disclosure. Additional Analyst Notes: - CVE Program Container: References: - https://support.hp.com/us-en/document/ish_5817864-5817896-16
CVE ID: CVE-2022-23934 State: PUBLISHED Published: 2022-03-11T17:54:15 Last Updated: 2024-08-03T03:59:23.079Z Vendors: n/a Products: HP PC BIOS Problem Types: Escalation of Privilege; Arbitrary Code Execution; Unauthorized Code Execution; Denial of Service; Information Disclosure Description: Potential vulnerabilities have been identified in the system BIOS of certain HP PC products which may allow Escalation of Privilege, Arbitrary Code Execution, Unauthorized Code Execution, Denial of Service, and Information Disclosure. Additional Analyst Notes: - CVE Program Container: References: - https://support.hp.com/us-en/document/ish_5817864-5817896-16
CVE ID: CVE-2022-23935 State: PUBLISHED Published: 2022-01-25T05:10:12 Last Updated: 2024-08-03T03:59:23.145Z Vendors: n/a Products: n/a Problem Types: n/a Description: lib/Image/ExifTool.pm in ExifTool before 12.38 mishandles a $file =~ /\|$/ check, leading to command injection. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/exiftool/exiftool/commit/74dbab1d2766d6422bb05b033ac6634bf8d1f582 - https://gist.github.com/ert-plus/1414276e4cb5d56dd431c2f0429e4429
CVE ID: CVE-2022-23937 State: PUBLISHED Published: 2022-03-29T01:21:06 Last Updated: 2024-08-03T03:59:23.097Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AC:L/AV:N/A:L/C:N/I:N/PR:N/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: In Wind River VxWorks 6.9 and 7, a specific crafted packet may lead to an out-of-bounds read during an IKE initial exchange scenario. Additional Analyst Notes: - CVE Program Container: References: - https://support2.windriver.com/index.php?page=security-notices - https://support2.windriver.com/index.php?page=cve&pg=21#list
CVE ID: CVE-2022-23940 State: PUBLISHED Published: 2022-03-07T19:06:35 Last Updated: 2024-08-03T03:59:23.052Z Vendors: n/a Products: n/a Problem Types: n/a Description: SuiteCRM through 7.12.1 and 8.x through 8.0.1 allows Remote Code Execution. Authenticated users with access to the Scheduled Reports module can achieve this by leveraging PHP deserialization in the email_recipients property. By using a crafted request, they can create a malicious report, containing a PHP-deserialization payload in the email_recipients field. Once someone accesses this report, the backend will deserialize the content of the email_recipients field and the payload gets executed. Project dependencies include a nu
l deserialize the content of the email_recipients field and the payload gets executed. Project dependencies include a number of interesting PHP deserialization gadgets (e.g., Monolog/RCE1 from phpggc) that can be used for Code Execution. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/manuelz120 - https://docs.suitecrm.com/8.x/admin/releases/8.0/
CVE ID: CVE-2022-23942 State: PUBLISHED Published: 2022-04-26T16:05:10 Last Updated: 2024-08-03T03:59:23.369Z Vendors: Apache Software Foundation Products: Apache Doris(Incubating) Problem Types: CWE-798 Description: Apache Doris, prior to 1.0.0, used a hardcoded key and IV to initialize the cipher used for ldap password, which may lead to information disclosure. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread/com2dyzp3bn2rdrotry90q2zzord4tvt - http://www.openwall.com/lists/oss-security/2022/04/26/2 - http://www.openwall.com/lists/oss-security/2022/04/26/3
CVE ID: CVE-2022-23943 State: PUBLISHED Published: 2022-03-14T10:15:54 Last Updated: 2024-08-03T03:59:23.156Z Vendors: Apache Software Foundation Products: Apache HTTP Server Problem Types: CWE-787, CWE-190 Description: Out-of-bounds Write vulnerability in mod_sed of Apache HTTP Server allows an attacker to overwrite heap memory with possibly attacker provided data. This issue affects Apache HTTP Server 2.4 version 2.4.52 and prior versions. Additional Analyst Notes: - CVE Program Container: References: - https://httpd.apache.org/security/vulnerabilities_24.html - http://www.openwall.com/lists/oss-security/2022/03/14/1 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.
w.openwall.com/lists/oss-security/2022/03/14/1 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RGWILBORT67SHMSLYSQZG2NMXGCMPUZO/ - https://lists.debian.org/debian-lts-announce/2022/03/msg00033.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z7H26WJ6TPKNWV3QKY4BHKUKQVUTZJTD/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X73C35MMMZGBVPQQCH7LQZUMYZNQA5FO/ - https://www.oracle.com/security-alerts/cpuapr2022.html - https://www.tenable.com/security/tns-2022-08 - https://security.netapp.com/advisory/ntap-20220321-0001/ - https://www.tenable.
//www.tenable.com/security/tns-2022-08 - https://security.netapp.com/advisory/ntap-20220321-0001/ - https://www.tenable.com/security/tns-2022-09 - https://security.gentoo.org/glsa/202208-20
CVE ID: CVE-2022-23944 State: PUBLISHED Published: 2022-01-25T13:00:24 Last Updated: 2024-08-03T03:59:23.263Z Vendors: Apache Software Foundation Products: Apache ShenYu (incubating) Problem Types: CWE-862 Description: User can access /plugin api without authentication. This issue affected Apache ShenYu 2.4.0 and 2.4.1. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread/dbrjnnlrf80dr0f92k5r2ysfvf1kr67y - http://www.openwall.com/lists/oss-security/2022/01/25/5 - http://www.openwall.com/lists/oss-security/2022/01/25/15 - http://www.openwall.com/lists/oss-security/2022/01/26/2
CVE ID: CVE-2022-23945 State: PUBLISHED Published: 2022-01-25T13:00:25 Last Updated: 2024-08-03T03:59:23.281Z Vendors: Apache Software Foundation Products: Apache ShenYu (incubating) Problem Types: CWE-862 Description: Missing authentication on ShenYu Admin when register by HTTP. This issue affected Apache ShenYu 2.4.0 and 2.4.1. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread/q2gg6ny6lpkph7nkrvjzqdvqpm805v8s - http://www.openwall.com/lists/oss-security/2022/01/25/6 - http://www.openwall.com/lists/oss-security/2022/01/26/3
CVE ID: CVE-2022-23946 State: PUBLISHED Published: 2022-02-04T22:28:58.000Z Last Updated: 2025-04-15T19:11:51.871Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: KiCad Problem Types: CWE-121 Description: A stack-based buffer overflow vulnerability exists in the Gerber Viewer gerber and excellon GCodeNumber parsing functionality of KiCad EDA 6.0.1 and master commit de006fc010. A specially-crafted gerber or excellon file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerabil
Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2022-1460 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5EMCGSSP3FIWCSL2KXVXLF35JYZKZE5Q/ - https://lists.debian.org/debian-lts-announce/2022/05/msg00009.html - https://lists.debian.org/debian-lts-announce/2022/08/msg00010.html - https://www.debian.org/security/2022/dsa-5214
CVE ID: CVE-2022-23947 State: PUBLISHED Published: 2022-02-04T22:28:59.000Z Last Updated: 2025-04-15T19:11:45.863Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: KiCad Problem Types: CWE-121 Description: A stack-based buffer overflow vulnerability exists in the Gerber Viewer gerber and excellon DCodeNumber parsing functionality of KiCad EDA 6.0.1 and master commit de006fc010. A specially-crafted gerber or excellon file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerabil