Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-43567 State: PUBLISHED Published: 2022-11-04T22:21:50.819Z Last Updated: 2025-05-05T20:34:05.121Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Splunk Products: Splunk Enterprise Problem Types: CWE-502 Description: In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can run arbitrary operating system commands remotely through the use of specially crafted requests to the mobile alerts feature in the Splunk Secure Gateway app. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.splunk.com/en_us/product-security/announcements/svd-2022-1107.html - https://research.
chment: References: - https://www.splunk.com/en_us/product-security/announcements/svd-2022-1107.html - https://research.splunk.com/application/baa41f09-df48-4375-8991-520beea161be/
CVE ID: CVE-2022-43568 State: PUBLISHED Published: 2022-11-04T22:22:13.266Z Last Updated: 2025-05-01T19:39:17.951Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Splunk Products: Splunk Enterprise Problem Types: CWE-79 Description: In Splunk Enterprise versions below 8.1.12, 8.2.9, and 9.0.2, a View allows for a Reflected Cross Site Scripting via JavaScript Object Notation (JSON) in a query parameter when output_mode=radio. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.splunk.com/en_us/product-security/announcements/svd-2022-1108.html - https://research.splunk.com/application/d532d105-c63f-4049-a8c4-e249
product-security/announcements/svd-2022-1108.html - https://research.splunk.com/application/d532d105-c63f-4049-a8c4-e249127ca425/
CVE ID: CVE-2022-43569 State: PUBLISHED Published: 2022-11-04T22:22:31.895Z Last Updated: 2025-04-30T20:02:18.090Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Splunk Products: Splunk Enterprise Problem Types: CWE-79 Description: In Splunk Enterprise versions below 8.1.12, 8.2.9, and 9.0.2, an authenticated user can inject and store arbitrary scripts that can lead to persistent cross-site scripting (XSS) in the object name of a Data Model. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.splunk.com/en_us/product-security/announcements/svd-2022-1109.html - https://research.splunk.com/application/062bff76-5f9
plunk.com/en_us/product-security/announcements/svd-2022-1109.html - https://research.splunk.com/application/062bff76-5f9c-496e-a386-cb1adcf69871/
CVE ID: CVE-2022-43570 State: PUBLISHED Published: 2022-11-04T22:22:50.526Z Last Updated: 2025-05-05T20:30:12.036Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Splunk Products: Splunk Enterprise Problem Types: CWE-611 Description: In Splunk Enterprise versions below 8.1.12, 8.2.9, and 9.0.2, an authenticated user can perform an extensible markup language (XML) external entity (XXE) injection via a custom View. The XXE injection causes Splunk Web to embed incorrect documents into an error. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.splunk.com/en_us/product-security/announcements/svd-2022-1110.html
CVE ID: CVE-2022-43571 State: PUBLISHED Published: 2022-11-03T22:56:44.862Z Last Updated: 2025-05-02T18:24:40.047Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Splunk Products: Splunk Enterprise Problem Types: CWE-94 Description: In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can execute arbitrary code through the dashboard PDF generation component. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.splunk.com/en_us/product-security/announcements/svd-2022-1111.html - https://research.splunk.com/application/b06b41d7-9570-4985-8137-0784f582a1b3/
CVE ID: CVE-2022-43572 State: PUBLISHED Published: 2022-11-04T22:23:39.383Z Last Updated: 2025-05-01T19:57:01.357Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Splunk Products: Splunk Enterprise Problem Types: CWE-400 Description: In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, sending a malformed file through the Splunk-to-Splunk (S2S) or HTTP Event Collector (HEC) protocols to an indexer results in a blockage or denial-of-service preventing further indexing. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.splunk.com/en_us/product-security/announcements/svd-2022-1111.html
CVE ID: CVE-2022-43573 State: PUBLISHED Published: 2023-01-05T17:39:23.656Z Last Updated: 2025-04-09T14:20:33.764Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: IBM Products: Robotic Process Automation Problem Types: CWE-200 Description: IBM Robotic Process Automation 20.12 through 21.0.6 is vulnerable to exposure of the name and email for the creator/modifier of platform level objects. IBM X-Force ID: 238678. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6852655 - https://exchange.xforce.ibmcloud.com/vulnerabilities/238678
CVE ID: CVE-2022-43574 State: PUBLISHED Published: 2022-11-03T00:00:00.000Z Last Updated: 2025-05-02T19:14:16.447Z Vendors: n/a Products: IBM Robotic Process Automation Problem Types: Gain Access Description: "IBM Robotic Process Automation 21.0.1, 21.0.2, 21.0.3, 21.0.4, and 21.0.5 is vulnerable to incorrect permission assignment which could allow access to application configurations. IBM X-Force ID: 238679." Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6831645
CVE ID: CVE-2022-43575 State: PUBLISHED Published: 2024-05-30T11:38:06.556Z Last Updated: 2024-08-03T13:32:59.804Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: IBM Products: Aspera Console Problem Types: CWE-79 Description: IBM Aspera Console 3.4.0 through 3.4.2 PL5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 238645. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7155215 -
Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7155215 - https://exchange.xforce.ibmcloud.com/vulnerabilities/238680
CVE ID: CVE-2022-43578 State: PUBLISHED Published: 2023-02-22T17:39:20.878Z Last Updated: 2024-08-03T13:32:59.676Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: IBM Products: Sterling B2B Integrator Standard Edition Problem Types: CWE-79 Description: IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.7 and 6.1.0.0 through 6.1.2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 238683. Additional Analyst Notes: - CVE Program Container: Referenc
disclosure within a trusted session. IBM X-Force ID: 238683. Additional Analyst Notes: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/6957156 - https://exchange.xforce.ibmcloud.com/vulnerabilities/238683
CVE ID: CVE-2022-43579 State: PUBLISHED Published: 2023-02-17T18:15:16.142Z Last Updated: 2025-03-12T20:00:22.942Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: IBM Products: Sterling B2B Integrator Standard Edition Problem Types: CWE-79 Description: IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.7 and 6.1.0.0 through 6.1.2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 238684. Additional Analyst Notes: - CVE Program Container: - CISA A
disclosure within a trusted session. IBM X-Force ID: 238684. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6954765 - https://exchange.xforce.ibmcloud.com/vulnerabilities/238684
CVE ID: CVE-2022-43581 State: PUBLISHED Published: 2022-12-07T17:07:51.028Z Last Updated: 2025-04-22T19:53:08.017Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: IBM Products: Content Navigator Problem Types: CWE-119 Description: IBM Content Navigator 3.0.0, 3.0.1, 3.0.2, 3.0.3, 3.0.4, 3.0.5, 3.0.6, 3.0.7, 3.0.8, 3.0.9, 3.0.10, 3.0.11, and 3.0.12 is vulnerable to missing authorization and could allow an authenticated user to load external plugins and execute code. IBM X-Force ID: 238805. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6844453 - https://exchange.xforce.ibmcloud.co
ISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6844453 - https://exchange.xforce.ibmcloud.com/vulnerabilities/238805
CVE ID: CVE-2022-43583 State: REJECTED Published: N/A Last Updated: 2023-07-02T21:50:47.594264Z Description: No description available.
CVE ID: CVE-2022-43584 State: REJECTED Published: N/A Last Updated: 2023-07-02T21:50:48.144591Z Description: No description available.
CVE ID: CVE-2022-43585 State: REJECTED Published: N/A Last Updated: 2023-07-02T21:50:48.890814Z Description: No description available.
CVE ID: CVE-2022-43586 State: REJECTED Published: N/A Last Updated: 2023-07-02T21:50:49.562031Z Description: No description available.
CVE ID: CVE-2022-43587 State: REJECTED Published: N/A Last Updated: 2023-07-02T21:50:50.205184Z Description: No description available.
CVE ID: CVE-2022-43588 State: PUBLISHED Published: 2022-11-28T10:20:13.200Z Last Updated: 2025-04-15T18:39:42.640Z Severity: MEDIUM (CVSS 6.2 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Callback technologies Products: CBFS Filter Problem Types: CWE-476 Description: A null pointer dereference vulnerability exists in the handle_ioctl_83150 functionality of Callback technologies CBFS Filter 20.0.8317. A specially crafted I/O request packet (IRP) can lead to denial of service. An attacker can issue an ioctl to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2
VE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2022-1647
CVE ID: CVE-2022-43589 State: PUBLISHED Published: 2022-11-28T10:20:14.208Z Last Updated: 2025-04-15T18:39:32.363Z Severity: MEDIUM (CVSS 6.2 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Callback technologies Products: CBFS Filter Problem Types: CWE-476 Description: A null pointer dereference vulnerability exists in the handle_ioctl_8314C functionality of Callback technologies CBFS Filter 20.0.8317. A specially crafted I/O request packet (IRP) can lead to denial of service. An attacker can issue an ioctl to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2
VE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2022-1648
CVE ID: CVE-2022-43590 State: PUBLISHED Published: 2022-11-28T10:20:15.265Z Last Updated: 2025-04-15T18:39:21.612Z Severity: MEDIUM (CVSS 6.2 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Callback technologies Products: CBFS Filter Problem Types: CWE-476 Description: A null pointer dereference vulnerability exists in the handle_ioctl_0x830a0_systembuffer functionality of Callback technologies CBFS Filter 20.0.8317. A specially crafted I/O request packet (IRP) can lead to denial of service. An attacker can issue an ioctl to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_
lyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2022-1649
CVE ID: CVE-2022-43591 State: PUBLISHED Published: 2023-01-12T16:44:10.325Z Last Updated: 2025-04-07T15:00:48.601Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Qt Project Products: Qt Problem Types: CWE-122 Description: A buffer overflow vulnerability exists in the QML QtScript Reflect API of Qt Project Qt 6.3.2. A specially-crafted javascript code can trigger an out-of-bounds memory access, which can lead to arbitrary code execution. Target application would need to access a malicious web page to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_
lyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2022-1650
CVE ID: CVE-2022-43592 State: PUBLISHED Published: 2022-12-23T23:03:51.372Z Last Updated: 2025-04-14T19:00:36.751Z Severity: MEDIUM (CVSS 5.9 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: OpenImageIO Project Products: OpenImageIO Problem Types: CWE-125 Description: An information disclosure vulnerability exists in the DPXOutput::close() functionality of OpenImageIO Project OpenImageIO v2.4.4.2. A specially crafted ImageOutput Object can lead to leaked heap data. An attacker can provide malicious input to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2022-
rogram Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2022-1651 - https://www.debian.org/security/2023/dsa-5384 - https://security.gentoo.org/glsa/202305-33
CVE ID: CVE-2022-43593 State: PUBLISHED Published: 2022-12-23T23:03:51.372Z Last Updated: 2025-04-14T18:34:46.657Z Severity: MEDIUM (CVSS 5.9 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: OpenImageIO Project Products: OpenImageIO Problem Types: CWE-476 Description: A denial of service vulnerability exists in the DPXOutput::close() functionality of OpenImageIO Project OpenImageIO v2.4.4.2. A specially crafted ImageOutput Object can lead to null pointer dereference. An attacker can provide malicious input to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-202
Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2022-1652 - https://www.debian.org/security/2023/dsa-5384 - https://security.gentoo.org/glsa/202305-33
CVE ID: CVE-2022-43594 State: PUBLISHED Published: 2022-12-23T23:03:51.372Z Last Updated: 2025-02-13T16:33:30.505Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: OpenImageIO Project Products: OpenImageIO Problem Types: CWE-476 Description: Multiple denial of service vulnerabilities exist in the image output closing functionality of OpenImageIO Project OpenImageIO v2.4.4.2. Specially crafted ImageOutput Objects can lead to multiple null pointer dereferences. An attacker can provide malicious multiple inputs to trigger these vulnerabilities.This vulnerability applies to writing .bmp files. Additional Analyst Notes: - CVE Program Container: References: - https
This vulnerability applies to writing .bmp files. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2022-1653 - https://www.debian.org/security/2023/dsa-5384 - https://security.gentoo.org/glsa/202305-33
CVE ID: CVE-2022-43595 State: PUBLISHED Published: 2022-12-23T23:03:51.372Z Last Updated: 2025-04-14T18:32:49.451Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: OpenImageIO Project Products: OpenImageIO Problem Types: CWE-476 Description: Multiple denial of service vulnerabilities exist in the image output closing functionality of OpenImageIO Project OpenImageIO v2.4.4.2. Specially crafted ImageOutput Objects can lead to multiple null pointer dereferences. An attacker can provide malicious multiple inputs to trigger these vulnerabilities.This vulnerability applies to writing .fits files. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnric
This vulnerability applies to writing .fits files. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2022-1653 - https://www.debian.org/security/2023/dsa-5384 - https://security.gentoo.org/glsa/202305-33
CVE ID: CVE-2022-43596 State: PUBLISHED Published: 2022-12-23T23:03:51.372Z Last Updated: 2025-04-15T13:26:01.281Z Severity: MEDIUM (CVSS 5.9 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: OpenImageIO Project Products: OpenImageIO Problem Types: CWE-125 Description: An information disclosure vulnerability exists in the IFFOutput channel interleaving functionality of OpenImageIO Project OpenImageIO v2.4.4.2. A specially crafted ImageOutput Object can lead to leaked heap data. An attacker can provide malicious input to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports
tes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2022-1654 - https://www.debian.org/security/2023/dsa-5384 - https://security.gentoo.org/glsa/202305-33
CVE ID: CVE-2022-43597 State: PUBLISHED Published: 2022-12-23T23:03:51.372Z Last Updated: 2025-04-15T13:25:21.251Z Severity: HIGH (CVSS 8.1 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: OpenImageIO Project Products: OpenImageIO Problem Types: CWE-122 Description: Multiple memory corruption vulnerabilities exist in the IFFOutput alignment padding functionality of OpenImageIO Project OpenImageIO v2.4.4.2. A specially crafted ImageOutput Object can lead to arbitrary code execution. An attacker can provide malicious input to trigger these vulnerabilities.This vulnerability arises when the `m_spec.format` is `TypeDesc::UINT8`. Additional Analyst Notes: - CVE Program Container: - CISA ADP
lity arises when the `m_spec.format` is `TypeDesc::UINT8`. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2022-1655 - https://www.debian.org/security/2023/dsa-5384 - https://security.gentoo.org/glsa/202305-33
CVE ID: CVE-2022-43598 State: PUBLISHED Published: 2022-12-23T23:03:51.372Z Last Updated: 2025-04-14T20:43:43.327Z Severity: HIGH (CVSS 8.1 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: OpenImageIO Project Products: OpenImageIO Problem Types: CWE-122 Description: Multiple memory corruption vulnerabilities exist in the IFFOutput alignment padding functionality of OpenImageIO Project OpenImageIO v2.4.4.2. A specially crafted ImageOutput Object can lead to arbitrary code execution. An attacker can provide malicious input to trigger these vulnerabilities.This vulnerability arises when the `m_spec.format` is `TypeDesc::UINT16`. Additional Analyst Notes: - CVE Program Container: - CISA AD
lity arises when the `m_spec.format` is `TypeDesc::UINT16`. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2022-1655 - https://www.debian.org/security/2023/dsa-5384 - https://security.gentoo.org/glsa/202305-33
CVE ID: CVE-2022-43599 State: PUBLISHED Published: 2022-12-23T23:03:51.372Z Last Updated: 2025-04-14T18:54:30.177Z Severity: HIGH (CVSS 8.1 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: OpenImageIO Project Products: OpenImageIO Problem Types: CWE-122 Description: Multiple code execution vulnerabilities exist in the IFFOutput::close() functionality of OpenImageIO Project OpenImageIO v2.4.4.2. A specially crafted ImageOutput Object can lead to a heap buffer overflow. An attacker can provide malicious input to trigger these vulnerabilities.This vulnerability arises when the `xmax` variable is set to 0xFFFF and `m_spec.format` is `TypeDesc::UINT8` Additional Analyst Notes: - CVE Program
en the `xmax` variable is set to 0xFFFF and `m_spec.format` is `TypeDesc::UINT8` Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2022-1656 - https://www.debian.org/security/2023/dsa-5384 - https://security.gentoo.org/glsa/202305-33
CVE ID: CVE-2022-43600 State: PUBLISHED Published: 2022-12-23T23:03:51.372Z Last Updated: 2025-04-14T18:53:55.950Z Severity: HIGH (CVSS 8.1 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: OpenImageIO Project Products: OpenImageIO Problem Types: CWE-122 Description: Multiple code execution vulnerabilities exist in the IFFOutput::close() functionality of OpenImageIO Project OpenImageIO v2.4.4.2. A specially crafted ImageOutput Object can lead to a heap buffer overflow. An attacker can provide malicious input to trigger these vulnerabilities.This vulnerability arises when the `xmax` variable is set to 0xFFFF and `m_spec.format` is `TypeDesc::UINT16` Additional Analyst Notes: - CVE Progra
en the `xmax` variable is set to 0xFFFF and `m_spec.format` is `TypeDesc::UINT16` Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2022-1656 - https://www.debian.org/security/2023/dsa-5384 - https://security.gentoo.org/glsa/202305-33
CVE ID: CVE-2022-43601 State: PUBLISHED Published: 2022-12-23T23:03:51.372Z Last Updated: 2025-04-14T18:53:19.816Z Severity: HIGH (CVSS 8.1 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: OpenImageIO Project Products: OpenImageIO Problem Types: CWE-122 Description: Multiple code execution vulnerabilities exist in the IFFOutput::close() functionality of OpenImageIO Project OpenImageIO v2.4.4.2. A specially crafted ImageOutput Object can lead to a heap buffer overflow. An attacker can provide malicious input to trigger these vulnerabilities.This vulnerability arises when the `ymax` variable is set to 0xFFFF and `m_spec.format` is `TypeDesc::UINT16` Additional Analyst Notes: - CVE Progra
en the `ymax` variable is set to 0xFFFF and `m_spec.format` is `TypeDesc::UINT16` Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2022-1656 - https://www.debian.org/security/2023/dsa-5384 - https://security.gentoo.org/glsa/202305-33
CVE ID: CVE-2022-43602 State: PUBLISHED Published: 2022-12-23T23:03:51.372Z Last Updated: 2025-04-14T18:10:48.179Z Severity: HIGH (CVSS 8.1 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: OpenImageIO Project Products: OpenImageIO Problem Types: CWE-122 Description: Multiple code execution vulnerabilities exist in the IFFOutput::close() functionality of OpenImageIO Project OpenImageIO v2.4.4.2. A specially crafted ImageOutput Object can lead to a heap buffer overflow. An attacker can provide malicious input to trigger these vulnerabilities.This vulnerability arises when the `ymax` variable is set to 0xFFFF and `m_spec.format` is `TypeDesc::UINT8` Additional Analyst Notes: - CVE Program
en the `ymax` variable is set to 0xFFFF and `m_spec.format` is `TypeDesc::UINT8` Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2022-1656 - https://www.debian.org/security/2023/dsa-5384 - https://security.gentoo.org/glsa/202305-33