Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-23446 State: PUBLISHED Published: 2022-04-06T09:00:17 Last Updated: 2024-10-22T20:59:46.351Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C) Vendors: Fortinet Products: Fortinet FortiEDR Problem Types: Denial of service Description: A improper control of a resource through its lifetime in Fortinet FortiEDR version 5.0.3 and earlier allows attacker to make the whole application unresponsive via changing its root directory access permission. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-22-052
CVE ID: CVE-2022-23447 State: PUBLISHED Published: 2023-07-11T16:52:42.353Z Last Updated: 2024-10-23T14:25:28.182Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:F/RL:U/RC:C) Vendors: Fortinet Products: FortiExtender Problem Types: CWE-22 Description: An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability [CWE-22] in FortiExtender management interface 7.0.0 through 7.0.3, 4.2.0 through 4.2.4, 4.1.1 through 4.1.8, 4.0.0 through 4.0.2, 3.3.0 through 3.3.2, 3.2.1 through 3.2.3, 5.3 all versions may allow an unauthenticated and remote attacker to retrieve arbitrary files from the underlying filesystem via specially crafted web req
thenticated and remote attacker to retrieve arbitrary files from the underlying filesystem via specially crafted web requests. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-22-039
CVE ID: CVE-2022-23448 State: PUBLISHED Published: 2022-04-12T09:07:35 Last Updated: 2024-08-03T03:43:45.944Z Vendors: Siemens Products: SIMATIC Energy Manager Basic, SIMATIC Energy Manager PRO Problem Types: CWE-732 Description: A vulnerability has been identified in SIMATIC Energy Manager Basic (All versions < V7.3 Update 1), SIMATIC Energy Manager PRO (All versions < V7.3 Update 1). Affected applications improperly assign permissions to critical directories and files used by the application processes. This could allow a local unprivileged attacker to achieve code execution with ADMINISTRATOR or even NT AUTHORITY/SYSTEM privileges. Additional Analyst Notes: - CVE Program Container: Referen
on with ADMINISTRATOR or even NT AUTHORITY/SYSTEM privileges. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-655554.pdf
CVE ID: CVE-2022-23449 State: PUBLISHED Published: 2022-04-12T09:07:37 Last Updated: 2024-08-03T03:43:45.997Z Vendors: Siemens Products: SIMATIC Energy Manager Basic, SIMATIC Energy Manager PRO Problem Types: CWE-427 Description: A vulnerability has been identified in SIMATIC Energy Manager Basic (All versions < V7.3 Update 1), SIMATIC Energy Manager PRO (All versions < V7.3 Update 1). A DLL Hijacking vulnerability could allow a local attacker to execute code with elevated privileges by placing a malicious DLL in one of the directories on the DLL search path. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-655554.pdf
CVE ID: CVE-2022-23450 State: PUBLISHED Published: 2022-04-12T09:07:38 Last Updated: 2024-08-03T03:43:45.971Z Vendors: Siemens Products: SIMATIC Energy Manager Basic, SIMATIC Energy Manager PRO Problem Types: CWE-502 Description: A vulnerability has been identified in SIMATIC Energy Manager Basic (All versions < V7.3 Update 1), SIMATIC Energy Manager PRO (All versions < V7.3 Update 1). The affected system allows remote users to send maliciously crafted objects. Due to insecure deserialization of user-supplied content by the affected software, an unauthenticated attacker could exploit this vulnerability by sending a maliciously crafted serialized object. This could allow the attacker to execu
ld exploit this vulnerability by sending a maliciously crafted serialized object. This could allow the attacker to execute arbitrary code on the device with SYSTEM privileges. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-655554.pdf
CVE ID: CVE-2022-23451 State: PUBLISHED Published: 2022-09-06T17:18:52 Last Updated: 2024-08-03T03:43:46.011Z Vendors: n/a Products: openstack/barbican Problem Types: CWE-863 Description: An authorization flaw was found in openstack-barbican. The default policy rules for the secret metadata API allowed any authenticated user to add, modify, or delete metadata from any secret regardless of ownership. This flaw allows an attacker on the network to modify or delete protected data, causing a denial of service by consuming protected resources. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2025089 - https://bugzilla.redhat.com/show_bug
gram Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2025089 - https://bugzilla.redhat.com/show_bug.cgi?id=2022878 - https://storyboard.openstack.org/#%21/story/2009253 - https://review.opendev.org/c/openstack/barbican/+/811236 - https://access.redhat.com/security/cve/CVE-2022-23451
CVE ID: CVE-2022-23452 State: PUBLISHED Published: 2022-09-01T20:57:45 Last Updated: 2024-08-03T03:43:45.996Z Vendors: n/a Products: openstack/barbican Problem Types: CWE-863 Description: An authorization flaw was found in openstack-barbican, where anyone with an admin role could add secrets to a different project container. This flaw allows an attacker on the network to consume protected resources and cause a denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2025090 - https://bugzilla.redhat.com/show_bug.cgi?id=2022908 - https://storyboard.openstack.org/#%21/story/2009297 - https://review.opendev.org/c/openstack/b
show_bug.cgi?id=2022908 - https://storyboard.openstack.org/#%21/story/2009297 - https://review.opendev.org/c/openstack/barbican/+/814200 - https://access.redhat.com/security/cve/CVE-2022-23452
CVE ID: CVE-2022-23453 State: PUBLISHED Published: 2023-01-30T21:34:48.942Z Last Updated: 2025-03-27T15:14:57.184Z Vendors: HP Inc. Products: HP Support Assistant Problem Types: n/a Description: Potential security vulnerabilities have been identified in HP Support Assistant. These vulnerabilities include privilege escalation, compromise of integrity, allowed communication with untrusted clients, and unauthorized modification of files. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.hp.com/us-en/document/ish_5585999-5586023-16/hpsbgn03762
CVE ID: CVE-2022-23454 State: PUBLISHED Published: 2023-01-30T21:35:42.349Z Last Updated: 2025-03-27T15:13:33.753Z Vendors: HP Inc. Products: HP Support Assistant Problem Types: n/a Description: Potential security vulnerabilities have been identified in HP Support Assistant. These vulnerabilities include privilege escalation, compromise of integrity, allowed communication with untrusted clients, and unauthorized modification of files. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.hp.com/us-en/document/ish_5585999-5586023-16/hpsbgn03762
CVE ID: CVE-2022-23455 State: PUBLISHED Published: 2023-01-30T21:36:24.359Z Last Updated: 2025-03-27T18:57:54.443Z Vendors: HP Inc. Products: HP Support Assistant Problem Types: n/a Description: Potential security vulnerabilities have been identified in HP Support Assistant. These vulnerabilities include privilege escalation, compromise of integrity, allowed communication with untrusted clients, and unauthorized modification of files. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.hp.com/us-en/document/ish_5585999-5586023-16/hpsbgn03762
CVE ID: CVE-2022-23456 State: PUBLISHED Published: 2022-01-28T19:09:58 Last Updated: 2024-08-03T03:43:45.941Z Vendors: n/a Products: n/a Problem Types: n/a Description: Potential arbitrary file deletion vulnerability has been identified in HP Support Assistant software. Additional Analyst Notes: - CVE Program Container: References: - https://support.hp.com/us-en/document/ish_5585999-5586023-16
CVE ID: CVE-2022-23457 State: PUBLISHED Published: 2022-04-25T00:00:00.000Z Last Updated: 2025-11-03T19:26:49.494Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: OWASP ESAPI Products: org.owasp.esapi:esapi Problem Types: CWE-22 Description: ESAPI (The OWASP Enterprise Security API) is a free, open source, web application security control library. Prior to version 2.3.0.0, the default implementation of `Validator.getValidDirectoryPath(String, String, File, boolean)` may incorrectly treat the tested input string as a child of the specified parent directory. This potentially could allow control-flow bypass checks to be defeated if an attack can specify the entir
ent directory. This potentially could allow control-flow bypass checks to be defeated if an attack can specify the entire string representing the 'input' path. This vulnerability is patched in release 2.3.0.0 of ESAPI. As a workaround, it is possible to write one's own implementation of the Validator interface. However, maintainers do not recommend this. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://securitylab.github.com/advisories/GHSL-2022-008_The_OWASP_Enterprise_Security_API/ - https://github.com/ESAPI/esapi-java-legacy/security/advisories/GHSA-8m5h-hrqm-pxm2 - https://github.com/ESAPI/esapi-java-legacy/blob/develop/documentation/esapi
cy/security/advisories/GHSA-8m5h-hrqm-pxm2 - https://github.com/ESAPI/esapi-java-legacy/blob/develop/documentation/esapi4java-core-2.3.0.0-release-notes.txt - https://www.oracle.com/security-alerts/cpujul2022.html - https://security.netapp.com/advisory/ntap-20230127-0014/
CVE ID: CVE-2022-23458 State: PUBLISHED Published: 2022-09-22T22:05:09.000Z Last Updated: 2025-04-22T17:21:00.935Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: nhn Products: tui.grid Problem Types: CWE-79 Description: Toast UI Grid is a component to display and edit data. Versions prior to 4.21.3 are vulnerable to cross-site scripting attacks when pasting specially crafted content into editable cells. This issue was fixed in version 4.21.3. There are no known workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://securitylab.github.com/advisories/GHSL-2022-029_nhn_tui_grid/ - https://github.com/nhn/t
richment: References: - https://securitylab.github.com/advisories/GHSL-2022-029_nhn_tui_grid/ - https://github.com/nhn/tui.grid/commit/e9db5968675ae113c07efc091cce210f2b26854f
CVE ID: CVE-2022-23459 State: PUBLISHED Published: 2022-08-19T19:00:16.000Z Last Updated: 2025-04-23T17:48:38.192Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: hjiang Products: Jsonxx Problem Types: CWE-416, CWE-415 Description: Jsonxx or Json++ is a JSON parser, writer and reader written in C++. In affected versions of jsonxx use of the Value class may lead to memory corruption via a double free or via a use after free. The value class has a default assignment operator which may be used with pointer types which may point to alterable data where the pointer itself is not updated. This issue exists on the current commit of the jsonxx project. The project its
where the pointer itself is not updated. This issue exists on the current commit of the jsonxx project. The project itself has been archived and updates are not expected. Users are advised to find a replacement. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://securitylab.github.com/advisories/GHSL-2022-048_Jsonxx
CVE ID: CVE-2022-23460 State: PUBLISHED Published: 2022-08-19T20:10:08.000Z Last Updated: 2025-04-23T17:48:29.948Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: hjiang Products: Jsonxx Problem Types: CWE-121 Description: Jsonxx or Json++ is a JSON parser, writer and reader written in C++. In affected versions of jsonxx json parsing may lead to stack exhaustion in an address sanitized (ASAN) build. This issue may lead to Denial of Service if the program using the jsonxx library crashes. This issue exists on the current commit of the jsonxx project and the project itself has been archived. Updates are not expected. Users are advised to find a replacement. Ad
project and the project itself has been archived. Updates are not expected. Users are advised to find a replacement. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://securitylab.github.com/advisories/GHSL-2022-049_Jsonxx
CVE ID: CVE-2022-23461 State: PUBLISHED Published: 2022-09-24T03:05:08.000Z Last Updated: 2025-04-22T17:20:52.980Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: xdan Products: Jodit Editor Problem Types: CWE-79 Description: Jodit Editor is a WYSIWYG editor written in pure TypeScript without the use of additional libraries. Jodit Editor is vulnerable to XSS attacks when pasting specially constructed input. This issue has not been fully patched. There are no known workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://securitylab.github.com/advisories/GHSL-2022-030_xdan_jodit/
CVE ID: CVE-2022-23462 State: PUBLISHED Published: 2022-10-21T00:00:00.000Z Last Updated: 2025-04-22T17:18:13.607Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Softmotions Products: iowow Problem Types: CWE-120, CWE-121 Description: IOWOW is a C utility library and persistent key/value storage engine. Versions 1.4.15 and prior contain a stack buffer overflow vulnerability that allows for Denial of Service (DOS) when it parses scientific notation numbers present in JSON. A patch for this issue is available at commit a79d31e4cff1d5a08f665574b29fd885897a28fd in the `master` branch of the repository. There are no workarounds other than applying the patch. Add
74b29fd885897a28fd in the `master` branch of the repository. There are no workarounds other than applying the patch. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://securitylab.github.com/advisories/GHSL-2022-066_iowow/ - https://github.com/Softmotions/iowow/commit/a79d31e4cff1d5a08f665574b29fd885897a28fd
CVE ID: CVE-2022-23463 State: PUBLISHED Published: 2022-09-24T04:40:12.000Z Last Updated: 2025-04-22T17:20:33.869Z Severity: CRITICAL (CVSS 9.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L) Vendors: Nepxion Products: Discover Problem Types: CWE-917 Description: Nepxion Discovery is a solution for Spring Cloud. Discover is vulnerable to SpEL Injection in discovery-commons. DiscoveryExpressionResolver’s eval method is evaluating expression with a StandardEvaluationContext, allowing the expression to reach and interact with Java classes such as java.lang.Runtime, leading to Remote Code Execution. There is no patch available for this issue at time of publication. There are no known workarounds.
mote Code Execution. There is no patch available for this issue at time of publication. There are no known workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://securitylab.github.com/advisories/GHSL-2022-033_GHSL-2022-034_Discovery/
CVE ID: CVE-2022-23464 State: PUBLISHED Published: 2022-09-24T04:40:08.000Z Last Updated: 2025-04-22T17:20:45.240Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Nepxion Products: Discovery Problem Types: CWE-918 Description: Nepxion Discovery is a solution for Spring Cloud. Discovery is vulnerable to a potential Server-Side Request Forgery (SSRF). RouterResourceImpl uses RestTemplate’s getForEntity to retrieve the contents of a URL containing user-controlled input, potentially resulting in Information Disclosure. There is no patch available for this issue at time of publication. There are no known workarounds. Additional Analyst Notes: - CVE Program Contai
le for this issue at time of publication. There are no known workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://securitylab.github.com/advisories/GHSL-2022-033_GHSL-2022-034_Discovery/
CVE ID: CVE-2022-23465 State: PUBLISHED Published: 2022-12-02T22:53:45.174Z Last Updated: 2025-04-23T16:32:50.729Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N) Vendors: migueldeicaza Products: SwiftTerm Problem Types: CWE-94 Description: SwiftTerm is a Xterm/VT100 Terminal emulator. Prior to commit a94e6b24d24ce9680ad79884992e1dff8e150a31, an attacker could modify the window title via a certain character escape sequence and then insert it back to the command line in the user's terminal, e.g. when the user views a file containing the malicious sequence, which could allow the attacker to execute arbitrary commands. Version a94e6b24d24ce9680ad79884992e1dff8e150a31 cont
nce, which could allow the attacker to execute arbitrary commands. Version a94e6b24d24ce9680ad79884992e1dff8e150a31 contains a patch for this issue. There are no known workarounds available. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/migueldeicaza/SwiftTerm/security/advisories/GHSA-jq43-q8mx-r7mq - https://github.com/migueldeicaza/SwiftTerm/commit/a94e6b24d24ce9680ad79884992e1dff8e150a31
CVE ID: CVE-2022-23466 State: PUBLISHED Published: 2022-12-06T17:58:52.867Z Last Updated: 2025-04-23T16:32:01.139Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: kitabisa Products: teler Problem Types: CWE-79 Description: teler is an real-time intrusion detection and threat alert dashboard. teler prior to version 2.0.0-rc.4 is vulnerable to DOM-based cross-site scripting (XSS) in the teler dashboard. When teler requests messages from the event stream on the `/events` endpoint, the log data displayed on the dashboard are not sanitized. This only affects authenticated users and can only be exploited based on detected threats if the log contains a DOM scriptin
only affects authenticated users and can only be exploited based on detected threats if the log contains a DOM scripting payload. This vulnerability has been fixed on version `v2.0.0-rc.4`. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/kitabisa/teler/security/advisories/GHSA-xr7p-8q82-878q - https://github.com/kitabisa/teler/commit/20f59eda2420ac64e29f199a61230a0abc875e8e
CVE ID: CVE-2022-23467 State: PUBLISHED Published: 2022-12-05T19:22:30.988Z Last Updated: 2025-11-03T19:26:50.922Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:P/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: openrazer Products: openrazer Problem Types: CWE-125 Description: OpenRazer is an open source driver and user-space daemon to control Razer device lighting and other features on GNU/Linux. Using a modified USB device an attacker can leak stack addresses of the `razer_attr_read_dpi_stages`, potentially bypassing KASLR. To exploit this vulnerability an attacker would need to access to a users keyboard or mouse or would need to convince a user to use a modified device. The issue has been patched in v3
to a users keyboard or mouse or would need to convince a user to use a modified device. The issue has been patched in v3.5.1. Users are advised to upgrade and should be reminded not to plug in unknown USB devices. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/openrazer/openrazer/security/advisories/GHSA-39hg-jvc9-fg7h - https://github.com/openrazer/openrazer/commit/33aa7f07d54ae066f201c6d298cb4a2181cb90e6
CVE ID: CVE-2022-23468 State: PUBLISHED Published: 2022-12-09T17:49:24.766Z Last Updated: 2025-04-23T16:30:14.953Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: neutrinolabs Products: xrdp Problem Types: CWE-120 Description: xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP). xrdp < v0.9.21 contain a buffer over flow in xrdp_login_wnd_create() function. There are no known workarounds for this issue. Users are advised to upgrade. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-8
rogram Container: - CISA ADP Vulnrichment: References: - https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-8c2f-mw8m-qpx6 - https://www.debian.org/security/2023/dsa-5502
CVE ID: CVE-2022-23469 State: PUBLISHED Published: 2022-12-08T21:33:19.114Z Last Updated: 2025-04-22T15:58:19.635Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N) Vendors: traefik Products: traefik Problem Types: CWE-200 Description: Traefik is an open source HTTP reverse proxy and load balancer. Versions prior to 2.9.6 are subject to a potential vulnerability in Traefik displaying the Authorization header in its debug logs. In certain cases, if the log level is set to DEBUG, credentials provided using the Authorization header are displayed in the debug logs. Attackers must have access to a users logging system in order for credentials to be stolen. This issue has been
g logs. Attackers must have access to a users logging system in order for credentials to be stolen. This issue has been addressed in version 2.9.6. Users are advised to upgrade. Users unable to upgrade may set the log level to `INFO`, `WARN`, or `ERROR`. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/traefik/traefik/security/advisories/GHSA-h2ph-vhm7-g4hp - https://github.com/traefik/traefik/pull/9574 - https://github.com/traefik/traefik/releases/tag/v2.9.6
CVE ID: CVE-2022-23470 State: PUBLISHED Published: 2022-12-06T17:37:23.638Z Last Updated: 2025-04-23T16:32:08.764Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: galaxyproject Products: galaxy Problem Types: CWE-22 Description: Galaxy is an open-source platform for data analysis. An arbitrary file read exists in Galaxy 22.01 and Galaxy 22.05 due to the switch to Gunicorn, which can be used to read any file accessible to the operating system user under which Galaxy is running. This vulnerability affects Galaxy 22.01 and higher, after the switch to gunicorn, which serve static contents directly. Additionally, the vulnerability is mitigated when using Nginx or A
ch to gunicorn, which serve static contents directly. Additionally, the vulnerability is mitigated when using Nginx or Apache to serve /static/* contents, instead of Galaxy's internal middleware. This issue has been patched in commit `e5e6bda4f` and will be included in future releases. Users are advised to manually patch their installations. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/galaxyproject/galaxy/security/advisories/GHSA-grjf-2ghx-q77x - https://github.com/galaxyproject/galaxy/commit/e5e6bda4f014f807ca77ee0cf6af777a55918346
CVE ID: CVE-2022-23471 State: PUBLISHED Published: 2022-12-07T22:51:34.193Z Last Updated: 2025-04-23T16:31:30.024Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H) Vendors: containerd Products: containerd Problem Types: CWE-400 Description: containerd is an open source container runtime. A bug was found in containerd's CRI implementation where a user can exhaust memory on the host. In the CRI stream server, a goroutine is launched to handle terminal resize events if a TTY is requested. If the user's process fails to launch due to, for example, a faulty command, the goroutine will be stuck waiting to send without a receiver, resulting in a memory leak. Kubernetes and c