deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-20426
Published: 2022-11-08
Description: In multiple functions of many files, there is a possible obstruction of the user's ability to select a phone account due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-236263294
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-754, CWE-754
References: https://source.android.com/security/bulletin/2022-11-01; https://source.android.com/security/bulletin/2022-11-01
CVE: CVE-2022-20441
Published: 2022-11-08
Description: In navigateUpTo of Task.java, there is a possible way to launch an unexported intent handler due to a logic error in the code. This could lead to local escalation of privilege if the targeted app has an intent trampoline, with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-238605611
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: https://source.android.com/security/bulletin/2022-11-01; https://source.android.com/security/bulletin/2022-11-01
CVE: CVE-2022-20445
Published: 2022-11-08
Description: In process_service_search_rsp of sdp_discovery.cc, there is a possible out of bounds read due to improper input validation. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-225876506
CVSS Score: 7.5 (HIGH)
CWE: CWE-1284, CWE-1284
References: https://source.android.com/security/bulletin/2022-11-01; https://source.android.com/security/bulletin/2022-11-01
CVE: CVE-2022-20446
Published: 2022-11-08
Description: In AlwaysOnHotwordDetector of AlwaysOnHotwordDetector.java, there is a possible way to access the microphone from the background due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11Android ID: A-229793943
CVSS Score: 3.3 (LOW)
CWE: CWE-862, CWE-862
References: https://source.android.com/security/bulletin/2022-11-01; https://source.android.com/security/bulletin/2022-11-01
CVE: CVE-2022-20447
Published: 2022-11-08
Description: In PAN_WriteBuf of pan_api.cc, there is a possible out of bounds read due to a use after free. This could lead to remote information disclosure over Bluetooth with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-233604485
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-416, CWE-416
References: https://source.android.com/security/bulletin/2022-11-01; https://source.android.com/security/bulletin/2022-11-01
CVE: CVE-2022-20448
Published: 2022-11-08
Description: In buzzBeepBlinkLocked of NotificationManagerService.java, there is a possible way to share data across users due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-237540408
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-276
References: https://source.android.com/security/bulletin/2022-11-01; https://source.android.com/security/bulletin/2022-11-01
CVE: CVE-2022-20450
Published: 2022-11-08
Description: In restorePermissionState of PermissionManagerServiceImpl.java, there is a possible way to bypass user consent due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-210065877
CVSS Score: 7.8 (HIGH)
CWE: CWE-862, CWE-862
References: https://source.android.com/security/bulletin/2022-11-01; https://source.android.com/security/bulletin/2022-11-01
CVE: CVE-2022-20451
Published: 2022-11-08
Description: In onCallRedirectionComplete of CallsManager.java, there is a possible permissions bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-235098883
CVSS Score: 7.8 (HIGH)
CWE: CWE-862, CWE-862
References: https://source.android.com/security/bulletin/2022-11-01; https://source.android.com/security/bulletin/2022-11-01
CVE: CVE-2022-20452
Published: 2022-11-08
Description: In initializeFromParcelLocked of BaseBundle.java, there is a possible method arbitrary code execution due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-240138318
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: https://source.android.com/security/bulletin/2022-11-01; https://source.android.com/security/bulletin/2022-11-01
CVE: CVE-2022-20453
Published: 2022-11-08
Description: In update of MmsProvider.java, there is a possible constriction of directory permissions due to a path traversal error. This could lead to local denial of service of SIM recognition with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-240685104
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://source.android.com/security/bulletin/2022-11-01; https://source.android.com/security/bulletin/2022-11-01
CVE: CVE-2022-20454
Published: 2022-11-08
Description: In fdt_next_tag of fdt.c, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-242096164
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-190, CWE-190
References: https://source.android.com/security/bulletin/2022-11-01; https://source.android.com/security/bulletin/2022-11-01
CVE: CVE-2022-20457
Published: 2022-11-08
Description: In getMountModeInternal of StorageManagerService.java, there is a possible prevention of package installation due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-243924784
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://source.android.com/security/bulletin/2022-11-01; https://source.android.com/security/bulletin/2022-11-01
CVE: CVE-2022-20462
Published: 2022-11-08
Description: In phNxpNciHal_write_unlocked of phNxpNciHal.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-230356196
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://source.android.com/security/bulletin/2022-11-01; https://source.android.com/security/bulletin/2022-11-01
CVE: CVE-2022-20463
Published: 2022-11-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2022-20465
Published: 2022-11-08
Description: In dismiss and related functions of KeyguardHostViewController.java and related files, there is a possible lockscreen bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-218500036
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-276
References: https://source.android.com/security/bulletin/2022-11-01; https://source.android.com/security/bulletin/2022-11-01
CVE: CVE-2022-27510
Published: 2022-11-08
Description: Unauthorized access to Gateway user capabilities 

CVSS Score: 9.8 (CRITICAL)
CWE: CWE-288, CWE-287
References: https://support.citrix.com/article/CTX463706/citrix-gateway-and-citrix-adc-security-bulletin-for-cve202227510-cve202227513-and-cve202227516; https://support.citrix.com/article/CTX463706/citrix-gateway-and-citrix-adc-security-bulletin-for-cve202227510-cve202227513-and-cve202227516
CVE: CVE-2022-27513
Published: 2022-11-08
Description: Remote desktop takeover via phishing  

CVSS Score: 8.3 (HIGH)
CWE: CWE-345, CWE-345
References: https://support.citrix.com/article/CTX463706/citrix-gateway-and-citrix-adc-security-bulletin-for-cve202227510-cve202227513-and-cve202227516; https://support.citrix.com/article/CTX463706/citrix-gateway-and-citrix-adc-security-bulletin-for-cve202227510-cve202227513-and-cve202227516
CVE: CVE-2022-27516
Published: 2022-11-08
Description: User login brute force protection functionality bypass   

CVSS Score: 5.3 (MEDIUM)
CWE: CWE-693, CWE-307
References: https://support.citrix.com/article/CTX463706/citrix-gateway-and-citrix-adc-security-bulletin-for-cve202227510-cve202227513-and-cve202227516; https://support.citrix.com/article/CTX463706/citrix-gateway-and-citrix-adc-security-bulletin-for-cve202227510-cve202227513-and-cve202227516
CVE: CVE-2022-34822
Published: 2022-11-08
Description: Path traversal vulnerability in CLUSTERPRO X 5.0 for Windows and earlier, EXPRESSCLUSTER X 5.0 for Windows and earlier, CLUSTERPRO X 5.0 SingleServerSafe for Windows and earlier, EXPRESSCLUSTER X 5.0 SingleServerSafe for Windows and earlier allows a remote unauthenticated attacker to overwrite existing files on the file system and to potentially execute arbitrary code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22, CWE-22
References: https://jpn.nec.com/security-info/secinfo/nv22-014_en.html; https://jpn.nec.com/security-info/secinfo/nv22-014_en.html
CVE: CVE-2022-34823
Published: 2022-11-08
Description: Buffer overflow vulnerability in CLUSTERPRO X 5.0 for Windows and earlier, EXPRESSCLUSTER X 5.0 for Windows and earlier, CLUSTERPRO X 5.0 SingleServerSafe for Windows and earlier, EXPRESSCLUSTER X 5.0 SingleServerSafe for Windows and earlier allows a remote unauthenticated attacker to overwrite existing files on the file system and to potentially execute arbitrary code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120, CWE-120
References: https://jpn.nec.com/security-info/secinfo/nv22-014_en.html; https://jpn.nec.com/security-info/secinfo/nv22-014_en.html
CVE: CVE-2022-34824
Published: 2022-11-08
Description: Weak File and Folder Permissions vulnerability in CLUSTERPRO X 5.0 for Windows and earlier, EXPRESSCLUSTER X 5.0 for Windows and earlier, CLUSTERPRO X 5.0 SingleServerSafe for Windows and earlier, EXPRESSCLUSTER X 5.0 SingleServerSafe for Windows and earlier allows a remote unauthenticated attacker to overwrite existing files on the file system and to potentially execute arbitrary code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-276, CWE-276
References: https://jpn.nec.com/security-info/secinfo/nv22-014_en.html; https://jpn.nec.com/security-info/secinfo/nv22-014_en.html
CVE: CVE-2022-34825
Published: 2022-11-08
Description: Uncontrolled Search Path Element in CLUSTERPRO X 5.0 for Windows and earlier, EXPRESSCLUSTER X 5.0 for Windows and earlier, CLUSTERPRO X 5.0 SingleServerSafe for Windows and earlier, EXPRESSCLUSTER X 5.0 SingleServerSafe for Windows and earlier allows a remote unauthenticated attacker to overwrite existing files on the file system and to potentially execute arbitrary code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-427, CWE-427
References: https://jpn.nec.com/security-info/secinfo/nv22-014_en.html; https://jpn.nec.com/security-info/secinfo/nv22-014_en.html
CVE: CVE-2022-37015
Published: 2022-11-08
Description: Symantec Endpoint Detection and Response (SEDR) Appliance, prior to 4.7.0, may be susceptible to a privilege escalation vulnerability, which is a type of issue whereby an attacker may attempt to compromise the software application to gain elevated access to resources that are normally protected from an application or user.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-269
References: https://support.broadcom.com/external/content/SecurityAdvisories/0/21005; https://support.broadcom.com/external/content/SecurityAdvisories/0/21005
CVE: CVE-2022-39386
Published: 2022-11-08
Description: @fastify/websocket provides WebSocket support for Fastify. Any application using @fastify/websocket could crash if a specific, malformed packet is sent. All versions of fastify-websocket are also impacted. That module is deprecated, so it will not be patched. This has been patched in version 7.1.1 (fastify v4) and version 5.0.1 (fastify v3). There are currently no known workarounds. However, it should be possible to attach the error handler manually. The recommended path is upgrading to the patched versions.
CVSS Score: 7.5 (HIGH)
CWE: CWE-248
References: https://github.com/fastify/fastify-websocket/security/advisories/GHSA-4pcg-wr6c-h9cq; https://github.com/fastify/fastify-websocket/security/advisories/GHSA-4pcg-wr6c-h9cq
CVE: CVE-2022-3821
Published: 2022-11-08
Description: An off-by-one Error issue was discovered in Systemd in format_timespan() function of time-util.c. An attacker could supply specific values for time and accuracy that leads to buffer overrun in format_timespan(), leading to a Denial of Service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-193
References: https://bugzilla.redhat.com/show_bug.cgi?id=2139327; https://github.com/systemd/systemd/commit/9102c625a673a3246d7e73d8737f3494446bad4e; https://github.com/systemd/systemd/issues/23928
CVE: CVE-2022-41203
Published: 2022-11-08
Description: In some workflow of SAP BusinessObjects BI Platform (Central Management Console and BI LaunchPad), an authenticated attacker with low privileges can intercept a serialized object in the parameters and substitute with another malicious serialized object, which leads to deserialization of untrusted data vulnerability. This could highly compromise the Confidentiality, Integrity, and Availability of the system.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502
References: https://launchpad.support.sap.com/#/notes/3243924; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3243924
CVE: CVE-2022-41205
Published: 2022-11-08
Description: SAP GUI allows an authenticated attacker to execute scripts in the local network. On successful exploitation, the attacker can gain access to registries which can cause a limited impact on confidentiality and high impact on availability of the application.


CVSS Score: 5.5 (MEDIUM)
CWE: CWE-94, CWE-94
References: https://launchpad.support.sap.com/#/notes/3237251; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3237251
CVE: CVE-2022-41207
Published: 2022-11-08
Description: SAP Biller Direct allows an unauthenticated attacker to craft a legitimate looking URL. When clicked by an unsuspecting victim, it will use an unsensitized parameter to redirect the victim to a malicious site of the attacker's choosing which can result in disclosure or modification of the victim's information.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://launchpad.support.sap.com/#/notes/3238042; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3238042
CVE: CVE-2022-41208
Published: 2022-11-08
Description: Due to insufficient input validation, SAP Financial Consolidation - version 1010, allows an authenticated attacker with user privileges to alter current user session. On successful exploitation, the attacker can view or modify information, causing a limited impact on confidentiality and integrity of the application.


CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://launchpad.support.sap.com/#/notes/3260708; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3260708
CVE: CVE-2022-41211
Published: 2022-11-08
Description: Due to lack of proper memory management, when a victim opens manipulated file received from untrusted sources in SAP 3D Visual Enterprise Author and SAP 3D Visual Enterprise Viewer, Arbitrary Code Execution can be triggered when payload forces:Re-use of dangling pointer which refers to overwritten space in memory. The accessed memory must be filled with code to execute the attack. Therefore, repeated success is unlikely.Stack-based buffer overflow. Since the memory overwritten is random, based on access rights of the memory, repeated success is not assured.


CVSS Score: 7.0 (HIGH)
CWE: CWE-119, CWE-787, CWE-119, CWE-787
References: https://launchpad.support.sap.com/#/notes/3263436; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3263436
CVE: CVE-2022-41212
Published: 2022-11-08
Description: Due to insufficient input validation, SAP NetWeaver Application Server ABAP and ABAP Platform allows an attacker with high level privileges to use a remote enabled function to read a file which is otherwise restricted. On successful exploitation an attacker can completely compromise the confidentiality of the application.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-22
References: https://launchpad.support.sap.com/#/notes/3256571; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3256571
CVE: CVE-2022-41214
Published: 2022-11-08
Description: Due to insufficient input validation, SAP NetWeaver Application Server ABAP and ABAP Platform allows an attacker with high level privileges to use a remote enabled function to delete a file which is otherwise restricted. On successful exploitation an attacker can completely compromise the integrity and availability of the application.


CVSS Score: 8.7 (HIGH)
CWE: CWE-20, CWE-20
References: https://launchpad.support.sap.com/#/notes/3256571; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3256571
CVE: CVE-2022-41215
Published: 2022-11-08
Description: SAP NetWeaver ABAP Server and ABAP Platform allows an unauthenticated attacker to redirect users to a malicious site due to insufficient URL validation. This could lead to the user being tricked to disclose personal information.


CVSS Score: 4.7 (MEDIUM)
CWE: CWE-601
References: https://launchpad.support.sap.com/#/notes/3251202; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3251202
CVE: CVE-2022-41258
Published: 2022-11-08
Description: Due to insufficient input validation, SAP Financial Consolidation - version 1010, allows an authenticated attacker to inject malicious script when running a common query in the Web Administration Console. On successful exploitation, an attacker can view or modify information causing a limited impact on confidentiality, integrity and availability of the application.


CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://launchpad.support.sap.com/#/notes/3260708; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3260708
CVE: CVE-2022-41259
Published: 2022-11-08
Description: SAP SQL Anywhere - version 17.0, allows an authenticated attacker to prevent legitimate users from accessing a SQL Anywhere database server by crashing the server with some queries that use an ARRAY constructor.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://launchpad.support.sap.com/#/notes/3229987; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3229987
CVE: CVE-2022-41260
Published: 2022-11-08
Description: SAP Financial Consolidation - version 1010, does not sufficiently encode user-controlled input which may allow an unauthenticated attacker to inject a web script via a GET request. On successful exploitation, an attacker can view or modify information causing a limited impact on confidentiality and integrity of the application.


CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://launchpad.support.sap.com/#/notes/3260708; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3260708
CVE: CVE-2022-30515
Published: 2022-11-08
Description: ZKTeco BioTime 8.5.4 is missing authentication on folders containing employee photos, allowing an attacker to view them through filename enumeration.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-306, CWE-306
References: https://codingkoala.eu/posts/CVE202230515/; https://www.zkteco.me/software-5; https://codingkoala.eu/posts/CVE202230515/
CVE: CVE-2022-39328
Published: 2022-11-08
Description: Grafana is an open-source platform for monitoring and observability. Versions starting with 9.2.0 and less than 9.2.4 contain a race condition in the authentication middlewares logic which may allow an unauthenticated user to query an administration endpoint under heavy load. This issue is patched in 9.2.4. There are no known workarounds.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-362, CWE-362
References: https://github.com/grafana/grafana/security/advisories/GHSA-vqc4-mpj8-jxch; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://github.com/grafana/grafana/security/advisories/GHSA-vqc4-mpj8-jxch
CVE: CVE-2022-43144
Published: 2022-11-08
Description: A cross-site scripting (XSS) vulnerability in Canteen Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/mudassiruddin/CVE-2022-43144-Stored-XSS; https://www.sourcecodester.com/download-code?nid=15688&title=Canteen+Management+System+Project+Source+Code+in+PHP+Free+Download; https://www.sourcecodester.com/php/15688/canteen-management-system-project-source-code-php.html
CVE: CVE-2022-39390
Published: 2022-11-09
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2020-36534. Reason: This candidate is a reservation duplicate of CVE-2020-36534. Notes: All CVE users should reference CVE-2020-36534 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2022-3885
Published: 2022-11-09
Description: Use after free in V8 in Google Chrome prior to 107.0.5304.106 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://chromereleases.googleblog.com/2022/11/stable-channel-update-for-desktop.html; https://crbug.com/1377816; https://www.debian.org/security/2022/dsa-5275
CVE: CVE-2022-3886
Published: 2022-11-09
Description: Use after free in Speech Recognition in Google Chrome prior to 107.0.5304.106 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://chromereleases.googleblog.com/2022/11/stable-channel-update-for-desktop.html; https://crbug.com/1372999; https://www.debian.org/security/2022/dsa-5275