deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-38853
Published: 2022-09-15
Description: Certain The MPlayer Project products are vulnerable to Buffer Overflow via function asf_init_audio_stream() of libmpdemux/asfheader.c. This affects mplayer SVN-r38374-13.0.1 and mencoder SVN-r38374-13.0.1.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://trac.mplayerhq.hu/ticket/2398; https://trac.mplayerhq.hu/ticket/2398
CVE: CVE-2022-38855
Published: 2022-09-15
Description: Certain The MPlayer Project products are vulnerable to Buffer Overflow via function gen_sh_video () of mplayer/libmpdemux/demux_mov.c. This affects mplayer SVN-r38374-13.0.1 and mencoder SVN-r38374-13.0.1.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://lists.debian.org/debian-lts-announce/2022/12/msg00042.html; https://trac.mplayerhq.hu/ticket/2392; https://lists.debian.org/debian-lts-announce/2022/12/msg00042.html
CVE: CVE-2022-38856
Published: 2022-09-15
Description: Certain The MPlayer Project products are vulnerable to Buffer Overflow via function mov_build_index() of libmpdemux/demux_mov.c. This affects mplayer SVN-r38374-13.0.1 and mencoder SVN-r38374-13.0.1.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://trac.mplayerhq.hu/ticket/2395; https://trac.mplayerhq.hu/ticket/2395
CVE: CVE-2022-38858
Published: 2022-09-15
Description: Certain The MPlayer Project products are vulnerable to Buffer Overflow via function mov_build_index() of libmpdemux/demux_mov.c. This affects mplayer SVN-r38374-13.0.1 and mencoder SVN-r38374-13.0.1.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://lists.debian.org/debian-lts-announce/2022/12/msg00042.html; https://trac.mplayerhq.hu/ticket/2396; https://lists.debian.org/debian-lts-announce/2022/12/msg00042.html
CVE: CVE-2022-38860
Published: 2022-09-15
Description: Certain The MPlayer Project products are vulnerable to Divide By Zero via function demux_open_avi() of libmpdemux/demux_avi.c which affects mencoder. This affects mplayer SVN-r38374-13.0.1 and mencoder SVN-r38374-13.0.1.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-369
References: https://lists.debian.org/debian-lts-announce/2022/12/msg00042.html; https://trac.mplayerhq.hu/ticket/2402; https://lists.debian.org/debian-lts-announce/2022/12/msg00042.html
CVE: CVE-2022-38861
Published: 2022-09-15
Description: The MPlayer Project mplayer SVN-r38374-13.0.1 is vulnerable to memory corruption via function free_mp_image() of libmpcodecs/mp_image.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://lists.debian.org/debian-lts-announce/2022/12/msg00042.html; https://trac.mplayerhq.hu/ticket/2407; https://lists.debian.org/debian-lts-announce/2022/12/msg00042.html
CVE: CVE-2022-38862
Published: 2022-09-15
Description: Certain The MPlayer Project products are vulnerable to Buffer Overflow via function play() of libaf/af.c:639. This affects mplayer SVN-r38374-13.0.1 and mencoder SVN-r38374-13.0.1.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://trac.mplayerhq.hu/ticket/2404; https://trac.mplayerhq.hu/ticket/2404
CVE: CVE-2022-38863
Published: 2022-09-15
Description: Certain The MPlayer Project products are vulnerable to Buffer Overflow via function mp_getbits() of libmpdemux/mpeg_hdr.c which affects mencoder and mplayer. This affects mecoder SVN-r38374-13.0.1 and mplayer SVN-r38374-13.0.1.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://lists.debian.org/debian-lts-announce/2022/12/msg00042.html; https://trac.mplayerhq.hu/ticket/2405; https://lists.debian.org/debian-lts-announce/2022/12/msg00042.html
CVE: CVE-2022-38864
Published: 2022-09-15
Description: Certain The MPlayer Project products are vulnerable to Buffer Overflow via the function mp_unescape03() of libmpdemux/mpeg_hdr.c. This affects mencoder SVN-r38374-13.0.1 and mplayer SVN-r38374-13.0.1.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://lists.debian.org/debian-lts-announce/2022/12/msg00042.html; https://trac.mplayerhq.hu/ticket/2406; https://lists.debian.org/debian-lts-announce/2022/12/msg00042.html
CVE: CVE-2022-38865
Published: 2022-09-15
Description: Certain The MPlayer Project products are vulnerable to Divide By Zero via the function demux_avi_read_packet of libmpdemux/demux_avi.c. This affects mplyer SVN-r38374-13.0.1 and mencoder SVN-r38374-13.0.1.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-369
References: https://lists.debian.org/debian-lts-announce/2022/12/msg00042.html; https://trac.mplayerhq.hu/ticket/2401; https://lists.debian.org/debian-lts-announce/2022/12/msg00042.html
CVE: CVE-2022-38866
Published: 2022-09-15
Description: Certain The MPlayer Project products are vulnerable to Buffer Overflow via read_avi_header() of libmpdemux/aviheader.c . This affects mplayer SVN-r38374-13.0.1 and mencoder SVN-r38374-13.0.1.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://lists.debian.org/debian-lts-announce/2022/12/msg00042.html; https://trac.mplayerhq.hu/ticket/2403#comment:2; https://lists.debian.org/debian-lts-announce/2022/12/msg00042.html
CVE: CVE-2022-3001
Published: 2022-09-15
Description: This vulnerability exists in Milesight Video Management Systems (VMS), all firmware versions prior to 40.7.0.79-r1, due to improper input handling at camera’s web-based management interface. A remote attacker could exploit this vulnerability by sending a specially crafted http request on the targeted network camera. Successful exploitation of this vulnerability could allow the attacker to cause a Denial of Service condition on the targeted device.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-20
References: https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2022-0352; https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2022-0352
CVE: CVE-2022-40306
Published: 2022-09-15
Description: The login form /Login in ECi Printanista Hub (formerly FMAudit Printscout) before 5.5.2 (July 2023) performs expensive RSA key-generation operations, which allows attackers to cause a denial of service (DoS) by requesting that form repeatedly.
CVSS Score: 5.9 (MEDIUM)
References: https://releasenotes.printanista.net/PrintanistaHub; https://www.ecisolutions.com/products/printanista-hub/; https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2022-042.txt
CVE: CVE-2022-1798
Published: 2022-09-15
Description: A path traversal vulnerability in KubeVirt versions up to 0.56 (and 0.55.1) on all platforms allows a user able to configure the kubevirt to read arbitrary files on the host filesystem which are publicly readable or which are readable for UID 107 or GID 107. /proc/self/<> is not accessible.
CVSS Score: 8.7 (HIGH)
CWE: CWE-20, CWE-22
References: https://github.com/kubevirt/kubevirt/security/advisories/GHSA-qv98-3369-g364; https://github.com/kubevirt/kubevirt/security/advisories/GHSA-qv98-3369-g364
CVE: CVE-2022-37201
Published: 2022-09-15
Description: JFinal CMS 5.1.0 is vulnerable to SQL Injection.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/AgainstTheLight/CVE-2022-37201/blob/main/README.md; https://github.com/AgainstTheLight/someEXP_of_jfinal_cms/blob/main/jfinal_cms/sql4.md; https://github.com/AgainstTheLight/CVE-2022-37201/blob/main/README.md
CVE: CVE-2022-37262
Published: 2022-09-15
Description: A Regular Expression Denial of Service (ReDoS) flaw was found in stealjs steal 2.2.4 via the source and sourceWithComments variable in main.js.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1333
References: https://github.com/stealjs/steal/blob/c9dd1eb19ed3f97aeb93cf9dcea5d68ad5d0ced9/main.js#L3497; https://github.com/stealjs/steal/blob/c9dd1eb19ed3f97aeb93cf9dcea5d68ad5d0ced9/main.js#L3507; https://github.com/stealjs/steal/issues/1531
CVE: CVE-2022-37264
Published: 2022-09-15
Description: Prototype pollution vulnerability in stealjs steal 2.2.4 via the optionName variable in main.js.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1321
References: https://github.com/stealjs/steal/blob/c9dd1eb19ed3f97aeb93cf9dcea5d68ad5d0ced9/main.js#L2194; https://github.com/stealjs/steal/blob/c9dd1eb19ed3f97aeb93cf9dcea5d68ad5d0ced9/main.js#L647; https://github.com/stealjs/steal/issues/1533
CVE: CVE-2022-37861
Published: 2022-09-15
Description: There is a remote code execution (RCE) vulnerability in Tenhot TWS-100 V4.0[PII_REDACTED]24 router device. It is necessary to know that the device account password is allowed to escape the execution system command through the network tools in the network diagnostic component.
CVSS Score: 9.8 (CRITICAL)
References: http://www.tenhot.net/html/pro/wgzly/111704.html; https://gist.github.com/ox01024/784894c27213c5a765b5c8f8375db256; http://www.tenhot.net/html/pro/wgzly/111704.html
CVE: CVE-2022-38600
Published: 2022-09-15
Description: Mplayer SVN-r38374-13.0.1 is vulnerable to Memory Leak via vf.c and vf_vo.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://trac.mplayerhq.hu/ticket/2390#comment:2; https://trac.mplayerhq.hu/ticket/2390#comment:2
CVE: CVE-2022-38850
Published: 2022-09-15
Description: The MPlayer Project mencoder SVN-r38374-13.0.1 is vulnerable to Divide By Zero via the function config () of llibmpcodecs/vf_scale.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-369
References: https://lists.debian.org/debian-lts-announce/2022/12/msg00042.html; https://trac.mplayerhq.hu/ticket/2399; https://lists.debian.org/debian-lts-announce/2022/12/msg00042.html
CVE: CVE-2022-38851
Published: 2022-09-15
Description: Certain The MPlayer Project products are vulnerable to Out-of-bounds Read via function read_meta_record() of mplayer/libmpdemux/asfheader.c. This affects mplayer SVN-r38374-13.0.1 and mencoder SVN-r38374-13.0.1.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://lists.debian.org/debian-lts-announce/2022/12/msg00042.html; https://trac.mplayerhq.hu/ticket/2393; https://lists.debian.org/debian-lts-announce/2022/12/msg00042.html
CVE: CVE-2022-38890
Published: 2022-09-15
Description: Nginx NJS v0.7.7 was discovered to contain a segmentation violation via njs_utf8_next at src/njs_utf8.h
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://github.com/nginx/njs/issues/569; https://github.com/nginx/njs/issues/569
CVE: CVE-2022-40636
Published: 2022-09-15
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ansys SpaceClaim 2022 R1. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JT files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17044.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://www.zerodayinitiative.com/advisories/ZDI-22-1192/; https://www.zerodayinitiative.com/advisories/ZDI-22-1192/
CVE: CVE-2022-40637
Published: 2022-09-15
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ansys SpaceClaim 2022 R1. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JT files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17045.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://www.zerodayinitiative.com/advisories/ZDI-22-1193/; https://www.zerodayinitiative.com/advisories/ZDI-22-1193/
CVE: CVE-2022-40638
Published: 2022-09-15
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ansys SpaceClaim 2022 R1. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of X_B files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17102.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://www.zerodayinitiative.com/advisories/ZDI-22-1194/; https://www.zerodayinitiative.com/advisories/ZDI-22-1194/
CVE: CVE-2022-40639
Published: 2022-09-15
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ansys SpaceClaim 2022 R1. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of SKP files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17207.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://www.zerodayinitiative.com/advisories/ZDI-22-1195/; https://www.zerodayinitiative.com/advisories/ZDI-22-1195/
CVE: CVE-2022-40640
Published: 2022-09-15
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ansys SpaceClaim 2022 R1. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of X_B files. The issue results from the lack of proper validation of user-supplied data, which can result in a read before the start of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17308.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://www.zerodayinitiative.com/advisories/ZDI-22-1196/; https://www.zerodayinitiative.com/advisories/ZDI-22-1196/
CVE: CVE-2022-40641
Published: 2022-09-15
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ansys SpaceClaim 2022 R1. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of X_B files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17317.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.zerodayinitiative.com/advisories/ZDI-22-1197/; https://www.zerodayinitiative.com/advisories/ZDI-22-1197/
CVE: CVE-2022-40642
Published: 2022-09-15
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ansys SpaceClaim 2022 R1. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of X_B files. The issue results from the lack of proper initialization of a pointer prior to accessing it. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17318.
CVSS Score: 7.8 (HIGH)
CWE: CWE-824
References: https://www.zerodayinitiative.com/advisories/ZDI-22-1198/; https://www.zerodayinitiative.com/advisories/ZDI-22-1198/
CVE: CVE-2022-40643
Published: 2022-09-15
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ansys SpaceClaim 2022 R1. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of X_B files. The issue results from the lack of proper initialization of a pointer prior to accessing it. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17407.
CVSS Score: 7.8 (HIGH)
CWE: CWE-824
References: https://www.zerodayinitiative.com/advisories/ZDI-22-1199/; https://www.zerodayinitiative.com/advisories/ZDI-22-1199/
CVE: CVE-2022-40644
Published: 2022-09-15
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ansys SpaceClaim 2022 R1. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of X_B files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17408.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.zerodayinitiative.com/advisories/ZDI-22-1200/; https://www.zerodayinitiative.com/advisories/ZDI-22-1200/
CVE: CVE-2022-40645
Published: 2022-09-15
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ansys SpaceClaim 2022 R1. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of X_B files. The issue results from the lack of proper initialization of a pointer prior to accessing it. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17540.
CVSS Score: 7.8 (HIGH)
CWE: CWE-824
References: https://www.zerodayinitiative.com/advisories/ZDI-22-1201/; https://www.zerodayinitiative.com/advisories/ZDI-22-1201/
CVE: CVE-2022-40646
Published: 2022-09-15
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ansys SpaceClaim 2022 R1. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of X_B files. The issue results from the lack of proper initialization of a pointer prior to accessing it. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17541.
CVSS Score: 7.8 (HIGH)
CWE: CWE-824
References: https://www.zerodayinitiative.com/advisories/ZDI-22-1202/; https://www.zerodayinitiative.com/advisories/ZDI-22-1202/
CVE: CVE-2022-40647
Published: 2022-09-15
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ansys SpaceClaim 2022 R1. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of X_B files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17558.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://www.zerodayinitiative.com/advisories/ZDI-22-1203/; https://www.zerodayinitiative.com/advisories/ZDI-22-1203/
CVE: CVE-2022-40648
Published: 2022-09-15
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ansys SpaceClaim 2022 R1. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of X_B files. The issue results from the lack of proper validation of user-supplied data, which can result in a write before the start of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17563.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.zerodayinitiative.com/advisories/ZDI-22-1204/; https://www.zerodayinitiative.com/advisories/ZDI-22-1204/
CVE: CVE-2022-40649
Published: 2022-09-15
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ansys SpaceClaim 2022 R1. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of X_B files. The issue results from the lack of proper initialization of a pointer prior to accessing it. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17565.
CVSS Score: 7.8 (HIGH)
CWE: CWE-824, CWE-824
References: https://www.zerodayinitiative.com/advisories/ZDI-22-1205/; https://www.zerodayinitiative.com/advisories/ZDI-22-1205/
CVE: CVE-2022-40650
Published: 2022-09-15
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ansys SpaceClaim 2022 R1. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of X_B files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17838.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.zerodayinitiative.com/advisories/ZDI-22-1206/; https://www.zerodayinitiative.com/advisories/ZDI-22-1206/
CVE: CVE-2022-40651
Published: 2022-09-15
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ansys SpaceClaim 2022 R1. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of X_B files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17844.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.zerodayinitiative.com/advisories/ZDI-22-1207/; https://www.zerodayinitiative.com/advisories/ZDI-22-1207/
CVE: CVE-2022-40652
Published: 2022-09-15
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ansys SpaceClaim 2022 R1. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of X_B files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17846.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.zerodayinitiative.com/advisories/ZDI-22-1208/; https://www.zerodayinitiative.com/advisories/ZDI-22-1208/
CVE: CVE-2022-40653
Published: 2022-09-15
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ansys SpaceClaim 2022 R1. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of X_B files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18349.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.zerodayinitiative.com/advisories/ZDI-22-1209/; https://www.zerodayinitiative.com/advisories/ZDI-22-1209/