Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-43645 State: PUBLISHED Published: 2023-03-29T00:00:00.000Z Last Updated: 2025-02-14T15:49:04.490Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: D-Link Products: DIR-825 Problem Types: CWE-78 Description: This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-825 1.0.9/EE routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the IVI plugin for the xupnpd service, which listens on TCP port 4044. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can le
rom the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the admin user. Was ZDI-CAN-19462. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10319 - https://www.zerodayinitiative.com/advisories/ZDI-22-1704/
CVE ID: CVE-2022-43646 State: PUBLISHED Published: 2023-03-29T00:00:00.000Z Last Updated: 2025-02-14T15:47:31.559Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: D-Link Products: DIR-825 Problem Types: CWE-78 Description: This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-825 1.0.9/EE routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Vimeo plugin for the xupnpd service, which listens on TCP port 4044. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can
from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the admin user. Was ZDI-CAN-19463. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10319 - https://www.zerodayinitiative.com/advisories/ZDI-22-1705/
CVE ID: CVE-2022-43647 State: PUBLISHED Published: 2023-03-29T00:00:00.000Z Last Updated: 2025-02-14T16:15:07.043Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: D-Link Products: DIR-825 Problem Types: CWE-78 Description: This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-825 1.0.9/EE routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the xupnpd service, which listens on TCP port 4044. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnera
per validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the admin user. Was ZDI-CAN-19464. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10319 - https://www.zerodayinitiative.com/advisories/ZDI-22-1706/
CVE ID: CVE-2022-43648 State: PUBLISHED Published: 2023-03-29T00:00:00.000Z Last Updated: 2025-02-12T16:59:05.029Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: D-Link Products: DIR-3040 Problem Types: CWE-122 Description: This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-3040 1.20B03 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the MiniDLNA service. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execut
of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the MiniDLNA service. Was ZDI-CAN-19910. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-23-052/ - https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10322
CVE ID: CVE-2022-43649 State: PUBLISHED Published: 2023-03-29T00:00:00.000Z Last Updated: 2025-02-12T16:58:47.047Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Foxit Products: PDF Reader Problem Types: CWE-416 Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 12.0.2.12465. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of Annotation objects. The issue results from the lack of validating the existence of an object prior to performing operations on the ob
jects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-19478. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.foxit.com/support/security-bulletins.html - https://www.zerodayinitiative.com/advisories/ZDI-23-091/
CVE ID: CVE-2022-43650 State: PUBLISHED Published: 2023-03-29T00:00:00.000Z Last Updated: 2025-02-12T16:57:11.609Z Severity: LOW (CVSS 2.5 CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: RARLAB Products: WinRAR Problem Types: CWE-125 Description: This vulnerability allows remote attackers to disclose sensitive information on affected installations of RARLAB WinRAR 6.11.0.0. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of ZIP files. Crafted data in a ZIP file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunctio
d data in a ZIP file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-19232. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-23-092/ - https://www.win-rar.com/singlenewsview.html?&L=0&tx_ttnews%5Btt_news%5D=216&cHash=983dfbcc83fb1b64a5f792891a281709
CVE ID: CVE-2022-43651 State: PUBLISHED Published: 2024-05-07T22:54:56.217Z Last Updated: 2024-08-03T13:40:05.691Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Bentley Products: View Problem Types: CWE-416 Description: Bentley View SKP File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of SKP files. The issue results from the lack of validating the existence of
The specific flaw exists within the parsing of SKP files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18960. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-23-346/
CVE ID: CVE-2022-43652 State: PUBLISHED Published: 2024-05-07T22:54:57.232Z Last Updated: 2024-08-03T13:40:06.413Z Severity: LOW (CVSS 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: Bentley Products: View Problem Types: CWE-416 Description: Bentley View SKP File Parsing Use-After-Free Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley View. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of SKP files. The issue results from the lack of validating the exis
s file. The specific flaw exists within the parsing of SKP files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18981. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-23-347/
CVE ID: CVE-2022-43653 State: PUBLISHED Published: 2024-05-07T22:54:58.166Z Last Updated: 2024-08-03T13:40:06.143Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Bentley Products: View Problem Types: CWE-787 Description: Bentley View SKP File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of SKP files. Crafted data in an SKP file can trigger a write past the
ile. The specific flaw exists within the parsing of SKP files. Crafted data in an SKP file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-19084. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-23-348/
CVE ID: CVE-2022-43654 State: PUBLISHED Published: 2024-05-07T22:54:59.091Z Last Updated: 2024-08-03T13:40:06.575Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: NETGEAR Products: CAX30S Problem Types: CWE-78 Description: NETGEAR CAX30S SSO Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR CAX30S routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the token parameter provided to the sso.php endpoint. The issue results from the lack of proper validation of a user-supplied str
parameter provided to the sso.php endpoint. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-18227. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-23-214/ - https://kb.netgear.com/000065527/Security-Advisory-for-Pre-Authentication-Command-Injection-on-Some-Cable-Modem-Routers-PSV-2022-0208
CVE ID: CVE-2022-43655 State: PUBLISHED Published: 2024-05-07T22:55:00.105Z Last Updated: 2024-08-03T13:40:06.024Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Bentley Products: View Problem Types: CWE-122 Description: Bentley View FBX File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of FBX files. The issue results from the lack of proper validati
cious file. The specific flaw exists within the parsing of FBX files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18491. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-23-344/
CVE ID: CVE-2022-43656 State: PUBLISHED Published: 2024-05-07T22:55:01.082Z Last Updated: 2024-08-03T13:40:05.639Z Severity: LOW (CVSS 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: Bentley Products: View Problem Types: CWE-125 Description: Bentley View FBX File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley View. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of FBX files. Crafted data in an FBX file can trigger a read pas
cious file. The specific flaw exists within the parsing of FBX files. Crafted data in an FBX file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18492. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-23-345/
CVE ID: CVE-2022-43659 State: REJECTED Published: N/A Last Updated: 2025-05-28T18:21:15.117Z Description: No description available.
CVE ID: CVE-2022-43660 State: PUBLISHED Published: 2022-12-07T00:00:00.000Z Last Updated: 2025-04-23T14:10:58.447Z Vendors: Six Apart Ltd. Products: Movable Type Problem Types: Improper Neutralization of Server-Side Includes (SSI) Within a Web Page Description: Improper neutralization of Server-Side Includes (SSW) within a web page in Movable Type series allows a remote authenticated attacker with Privilege of 'Manage of Content Types' may execute an arbitrary Perl script and/or an arbitrary OS command. Affected products/versions are as follows: Movable Type 7 r.5301 and earlier (Movable Type 7 Series), Movable Type Advanced 7 r.5301 and earlier (Movable Type Advanced 7 Series), Movable Type
rlier (Movable Type 7 Series), Movable Type Advanced 7 r.5301 and earlier (Movable Type Advanced 7 Series), Movable Type Premium 1.53 and earlier, and Movable Type Premium Advanced 1.53 and earlier. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://movabletype.org/news/2022/11/mt-796-688-released.html - https://jvn.jp/en/jp/JVN37014768/index.html
CVE ID: CVE-2022-43661 State: REJECTED Published: N/A Last Updated: 2025-05-28T18:21:16.523Z Description: No description available.
CVE ID: CVE-2022-43662 State: PUBLISHED Published: 2023-01-09T02:23:02.577Z Last Updated: 2025-04-09T14:11:21.934Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: OpenHarmony Products: OpenHarmony Problem Types: CWE-120 Description: Kernel subsystem within OpenHarmony-v3.1.4 and prior versions in kernel_liteos_a has a kernel stack overflow vulnerability when call SysTimerGettime. 4 bytes padding data from kernel stack are copied to user space incorrectly and leaked. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitee.com/openharmony/security/blob/master/en/security-disclosure/2022/2022-12.md
CVE ID: CVE-2022-43663 State: PUBLISHED Published: 2023-03-20T20:16:02.048Z Last Updated: 2024-08-03T13:40:06.410Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: WellinTech Products: KingHistorian Problem Types: CWE-195 Description: An integer conversion vulnerability exists in the SORBAx64.dll RecvPacket functionality of WellinTech KingHistorian 35.01.00.05. A specially crafted network packet can lead to a buffer overflow. An attacker can send a malicious packet to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2022-1674
CVE ID: CVE-2022-43664 State: PUBLISHED Published: 2023-04-05T15:18:03.855Z Last Updated: 2025-02-10T18:03:48.922Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Ichitaro Products: Ichitaro Problem Types: CWE-416 Description: A use-after-free vulnerability exists within the way Ichitaro Word Processor 2022, version 1.0.1.57600, processes protected documents. A specially crafted document can trigger reuse of freed memory, which can lead to further memory corruption and potentially result in arbitrary code execution. An attacker can provide a malicious document to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrich
malicious document to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2022-1673 - https://jvn.jp/en/jp/JVN79149117/
CVE ID: CVE-2022-43665 State: PUBLISHED Published: 2023-02-02T09:59:18.627Z Last Updated: 2025-03-26T14:20:44.932Z Severity: MEDIUM (CVSS 5 CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H) Vendors: ESTsoft Products: Alyac Problem Types: CWE-823 Description: A denial of service vulnerability exists in the malware scan functionality of ESTsoft Alyac 2.5.8.645. A specially-crafted PE file can lead to killing target process. An attacker can provide a malicious file to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2022-1682
CVE ID: CVE-2022-43666 State: PUBLISHED Published: 2023-11-14T19:04:33.917Z Last Updated: 2024-08-30T16:07:53.246Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: n/a Products: Intel Unison software Problem Types: information disclosure, CWE-1258 Description: Exposure of sensitive system information due to uncleared debug information for some Intel Unison software may allow an authenticated user to potentially enable information disclosure via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00963.html
CVE ID: CVE-2022-43667 State: PUBLISHED Published: 2022-12-07T00:00:00.000Z Last Updated: 2025-04-23T14:09:01.756Z Vendors: OMRON Corporation Products: CX-Programmer Problem Types: Stack-based Buffer Overflow Description: Stack-based buffer overflow vulnerability exists in CX-Programmer v.9.77 and earlier, which may lead to information disclosure and/or arbitrary code execution by having a user to open a specially crafted CXP file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jvn.jp/en/vu/JVNVU92877622/index.html - https://jvn.jp/vu/JVNVU92877622/index.html
CVE ID: CVE-2022-43668 State: PUBLISHED Published: 2022-12-07T00:00:00.000Z Last Updated: 2025-04-23T14:07:07.655Z Vendors: Typora Products: Typora Problem Types: Improper Encoding or Escaping of Output Description: Typora versions prior to 1.4.4 fails to properly neutralize JavaScript code, which may result in executing JavaScript code contained in the file when opening a file with the affected product. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://typora.io/releases/all - https://jvn.jp/en/jp/JVN26044739/index.html
CVE ID: CVE-2022-43669 State: REJECTED Published: N/A Last Updated: 2025-05-28T18:21:17.936Z Description: No description available.
CVE ID: CVE-2022-43670 State: PUBLISHED Published: 2022-11-02T00:00:00.000Z Last Updated: 2025-05-02T20:28:50.391Z Vendors: Apache Software Foundation Products: Apache Sling App CMS Problem Types: CWE-79 Description: An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability in Sling App CMS version 1.1.0 and prior may allow an authenticated remote attacker to perform a reflected cross site scripting (XSS) attack in the taxonomy management feature. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/o68l3l3crfxz107fr9dm74y8vg8kj2cs - http://www.openwall.com/lists/oss-secu
References: - https://lists.apache.org/thread/o68l3l3crfxz107fr9dm74y8vg8kj2cs - http://www.openwall.com/lists/oss-security/2022/11/02/8
CVE ID: CVE-2022-43671 State: PUBLISHED Published: 2022-11-12T00:00:00.000Z Last Updated: 2025-05-01T13:39:28.162Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine Password Manager Pro before 12122, PAM360 before 5711, and Access Manager Plus before 4306 allow SQL Injection. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.manageengine.com/products/passwordmanagerpro/advisory/cve-2022-43671.html
CVE ID: CVE-2022-43672 State: PUBLISHED Published: 2022-11-12T00:00:00.000Z Last Updated: 2025-05-01T13:37:55.079Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine Password Manager Pro before 12122, PAM360 before 5711, and Access Manager Plus before 4306 allow SQL Injection (in a different software component relative to CVE-2022-43671. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.manageengine.com/products/passwordmanagerpro/advisory/cve-2022-43672.html
CVE ID: CVE-2022-43673 State: PUBLISHED Published: 2022-11-18T00:00:00.000Z Last Updated: 2025-04-30T13:54:07.784Z Vendors: n/a Products: n/a Problem Types: n/a Description: Wire through 3.22.3993 on Windows advertises deletion of sent messages; nonetheless, all messages can be retrieved (for a limited period of time) from the AppData\Roaming\Wire\IndexedDB\https_app.wire.com_0.indexeddb.leveldb database. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wire.com/ - https://www.secuvera.de/advisories/secuvera-SA-2022-01.txt
CVE ID: CVE-2022-43675 State: PUBLISHED Published: 2023-12-25T00:00:00 Last Updated: 2024-11-26T14:59:00.276Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in NOKIA NFM-T R19.9. Reflected XSS in the Network Element Manager exists via /oms1350/pages/otn/cpbLogDisplay via the filename parameter, under /oms1350/pages/otn/connection/E2ERoutingDisplayWithOverLay via the id parameter, and under /oms1350/pages/otn/mainOtn via all parameters. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.gruppotim.it/redteam
CVE ID: CVE-2022-43677 State: PUBLISHED Published: 2022-10-24T00:00:00 Last Updated: 2024-08-03T13:40:05.778Z Vendors: n/a Products: n/a Problem Types: n/a Description: In free5GC 3.2.1, a malformed NGAP message can crash the AMF and NGAP decoders via an index-out-of-range panic in aper.GetBitString. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/free5gc/free5gc/issues/402 - https://www.trendmicro.com/en_us/research/23/j/asn1-vulnerabilities-in-5g-cores.html
CVE ID: CVE-2022-43679 State: PUBLISHED Published: 2022-11-10T00:00:00.000Z Last Updated: 2025-05-01T13:47:17.738Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AC:H/AV:N/A:N/C:L/I:L/PR:N/S:U/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: The Docker image of ownCloud Server through 10.11 contains a misconfiguration that renders the trusted_domains config useless. This could be abused to spoof the URL in password-reset e-mail messages. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://owncloud.com