deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-44504
Published: 2022-04-15
Description: An issue was discovered in FIS GT.M through V7.0-000 (related to the YottaDB code base). Using crafted input, an attacker can cause a size variable, stored as an signed int, to equal an extremely large value, which is interpreted as a negative value during a check. This value is then used in a memcpy call on the stack, causing a memory segmentation fault.
CVSS Score: 7.5 (HIGH)
CWE: CWE-682
References: http://tinco.pair.com/bhaskar/gtm/doc/articles/GTM_V7.0-002_Release_Notes.html; https://gitlab.com/YottaDB/DB/YDB/-/issues/828; https://sourceforge.net/projects/fis-gtm/files/
CVE: CVE-2021-44505
Published: 2022-04-15
Description: An issue was discovered in FIS GT.M through V7.0-000 (related to the YottaDB code base). Using crafted input, an attacker can cause a NULL pointer dereference after calls to ZPrint.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: http://tinco.pair.com/bhaskar/gtm/doc/articles/GTM_V7.0-002_Release_Notes.html; https://gitlab.com/YottaDB/DB/YDB/-/issues/828; https://sourceforge.net/projects/fis-gtm/files/
CVE: CVE-2021-44506
Published: 2022-04-15
Description: An issue was discovered in FIS GT.M through V7.0-000 (related to the YottaDB code base). A lack of input validation in calls to do_verify in sr_unix/do_verify.c allows attackers to attempt to jump to a NULL pointer by corrupting a function pointer.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: http://tinco.pair.com/bhaskar/gtm/doc/articles/GTM_V7.0-002_Release_Notes.html; https://gitlab.com/YottaDB/DB/YDB/-/issues/828; https://sourceforge.net/projects/fis-gtm/files/
CVE: CVE-2021-44507
Published: 2022-04-15
Description: An issue was discovered in FIS GT.M through V7.0-000 (related to the YottaDB code base). A lack of parameter validation in calls to memcpy in str_tok in sr_unix/ztimeoutroutines.c allows attackers to attempt to read from a NULL pointer.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: http://tinco.pair.com/bhaskar/gtm/doc/articles/GTM_V7.0-002_Release_Notes.html; https://gitlab.com/YottaDB/DB/YDB/-/issues/828; https://sourceforge.net/projects/fis-gtm/files/
CVE: CVE-2021-44508
Published: 2022-04-15
Description: An issue was discovered in FIS GT.M through V7.0-000 (related to the YottaDB code base). A lack of NULL checks in calls to ious_open in sr_unix/ious_open.c allows attackers to crash the application by dereferencing a NULL pointer.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: http://tinco.pair.com/bhaskar/gtm/doc/articles/GTM_V7.0-002_Release_Notes.html; https://gitlab.com/YottaDB/DB/YDB/-/issues/828; https://sourceforge.net/projects/fis-gtm/files/
CVE: CVE-2021-44509
Published: 2022-04-15
Description: An issue was discovered in FIS GT.M through V7.0-000 (related to the YottaDB code base). Using crafted input, attackers can cause an integer underflow of the size of calls to memset in op_fnj3 in sr_port/op_fnj3.c in order to cause a segmentation fault and crash the application.
CVSS Score: 7.5 (HIGH)
CWE: CWE-191
References: http://tinco.pair.com/bhaskar/gtm/doc/articles/GTM_V7.0-002_Release_Notes.html; https://gitlab.com/YottaDB/DB/YDB/-/issues/828; https://sourceforge.net/projects/fis-gtm/files/
CVE: CVE-2021-44510
Published: 2022-04-15
Description: An issue was discovered in FIS GT.M through V7.0-000 (related to the YottaDB code base). Using crafted input, attackers can cause a calculation of the size of calls to memset in op_fnj3 in sr_port/op_fnj3.c to result in an extremely large value in order to cause a segmentation fault and crash the application.
CVSS Score: 7.5 (HIGH)
CWE: CWE-131
References: http://tinco.pair.com/bhaskar/gtm/doc/articles/GTM_V7.0-002_Release_Notes.html; https://gitlab.com/YottaDB/DB/YDB/-/issues/828; https://sourceforge.net/projects/fis-gtm/files/
CVE: CVE-2022-27157
Published: 2022-04-15
Description: pearweb < 1.32 is suffers from a Weak Password Recovery Mechanism via include/users/passwordmanage.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-640
References: https://github.com/pear/pearweb/commit/6447c174a6b4bd76d28ecca8543cbd24bf394f99#diff-204452a70c5b0b0084097fcff6aee77c2c38cb77a41c4b2dd0065fda37a7489c; https://github.com/pear/pearweb/commit/6447c174a6b4bd76d28ecca8543cbd24bf394f99#diff-204452a70c5b0b0084097fcff6aee77c2c38cb77a41c4b2dd0065fda37a7489c
CVE: CVE-2022-27158
Published: 2022-04-15
Description: pearweb < 1.32 suffers from Deserialization of Untrusted Data.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://github.com/pear/pearweb/commit/6447c174a6b4bd76d28ecca8543cbd24bf394f99; https://github.com/pear/pearweb/commit/6447c174a6b4bd76d28ecca8543cbd24bf394f99
CVE: CVE-2022-27257
Published: 2022-04-15
Description: A PHP Local File Inclusion vulneraility in the default Redbasic theme for Hubzilla before version 7.2 allows remote attackers to include arbitrary php files via the schema parameter.
CVSS Score: 7.5 (HIGH)
References: https://framagit.org/hubzilla/core/-/commit/0784cd593a39a4fc297e8a82f7e79bc8019a0868#1c497fbb3a46b78edf04cc2a2fa33f67e3ffbe2a; https://hubzilla.org/channel/hubzilla/; https://framagit.org/hubzilla/core/-/commit/0784cd593a39a4fc297e8a82f7e79bc8019a0868#1c497fbb3a46b78edf04cc2a2fa33f67e3ffbe2a
CVE: CVE-2022-27365
Published: 2022-04-15
Description: Cscms Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the component dance_Dance.php_del.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/chshcms/cscms/issues/12#issue[PII_REDACTED]; https://github.com/chshcms/cscms/issues/12#issue[PII_REDACTED]
CVE: CVE-2022-27366
Published: 2022-04-15
Description: Cscms Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the component dance_Dance.php_hy.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/chshcms/cscms/issues/13#issue[PII_REDACTED]; https://github.com/chshcms/cscms/issues/13#issue[PII_REDACTED]
CVE: CVE-2022-27367
Published: 2022-04-15
Description: Cscms Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the component dance_Topic.php_del.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/chshcms/cscms/issues/14#issue[PII_REDACTED]; https://github.com/chshcms/cscms/issues/14#issue[PII_REDACTED]
CVE: CVE-2022-27368
Published: 2022-04-15
Description: Cscms Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the component dance_Lists.php_zhuan.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/chshcms/cscms/issues/15; https://github.com/chshcms/cscms/issues/15
CVE: CVE-2022-27369
Published: 2022-04-15
Description: Cscms Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the component news_News.php_hy.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/chshcms/cscms/issues/16; https://github.com/chshcms/cscms/issues/16
CVE: CVE-2022-21983
Published: 2022-04-15
Description: Win32 Stream Enumeration Remote Code Execution Vulnerability
CVSS Score: 7.5 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21983; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21983
CVE: CVE-2022-22008
Published: 2022-04-15
Description: Windows Hyper-V Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-362
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-22008; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-22008
CVE: CVE-2022-22009
Published: 2022-04-15
Description: Windows Hyper-V Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-22009; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-22009
CVE: CVE-2022-23257
Published: 2022-04-15
Description: Windows Hyper-V Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23257; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23257
CVE: CVE-2022-23259
Published: 2022-04-15
Description: Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23259; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23259
CVE: CVE-2022-23268
Published: 2022-04-15
Description: Windows Hyper-V Denial of Service Vulnerability
CVSS Score: 6.5 (MEDIUM)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23268; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23268
CVE: CVE-2022-23292
Published: 2022-04-15
Description: Microsoft Power BI Spoofing Vulnerability
CVSS Score: 3.7 (LOW)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23292; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23292
CVE: CVE-2022-24472
Published: 2022-04-15
Description: Microsoft SharePoint Server Spoofing Vulnerability
CVSS Score: 8.0 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24472; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24472
CVE: CVE-2022-24473
Published: 2022-04-15
Description: Microsoft Excel Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24473; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24473
CVE: CVE-2022-24474
Published: 2022-04-15
Description: Windows Win32k Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24474; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24474
CVE: CVE-2022-24479
Published: 2022-04-15
Description: Connected User Experiences and Telemetry Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24479; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24479
CVE: CVE-2022-24481
Published: 2022-04-15
Description: Windows Common Log File System Driver Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24481; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24481
CVE: CVE-2022-24482
Published: 2022-04-15
Description: Windows ALPC Elevation of Privilege Vulnerability
CVSS Score: 7.0 (HIGH)
CWE: CWE-362
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24482; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24482
CVE: CVE-2022-24483
Published: 2022-04-15
Description: Windows Kernel Information Disclosure Vulnerability
CVSS Score: 5.5 (MEDIUM)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24483; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24483
CVE: CVE-2022-24484
Published: 2022-04-15
Description: Windows Cluster Shared Volume (CSV) Denial of Service Vulnerability
CVSS Score: 5.5 (MEDIUM)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24484; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24484
CVE: CVE-2022-24485
Published: 2022-04-15
Description: Win32 File Enumeration Remote Code Execution Vulnerability
CVSS Score: 7.5 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24485; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24485
CVE: CVE-2022-24486
Published: 2022-04-15
Description: Windows Kerberos Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24486; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24486
CVE: CVE-2022-24487
Published: 2022-04-15
Description: Windows Local Security Authority Subsystem Service (LSASS) Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24487; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24487
CVE: CVE-2022-24488
Published: 2022-04-15
Description: Windows Desktop Bridge Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24488; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24488
CVE: CVE-2022-24489
Published: 2022-04-15
Description: Cluster Client Failover (CCF) Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24489; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24489
CVE: CVE-2022-24490
Published: 2022-04-15
Description: Windows Hyper-V Shared Virtual Hard Disks Information Disclosure Vulnerability
CVSS Score: 8.1 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24490; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24490
CVE: CVE-2022-24491
Published: 2022-04-15
Description: Windows Network File System Remote Code Execution Vulnerability
CVSS Score: 9.8 (CRITICAL)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24491; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24491
CVE: CVE-2022-24492
Published: 2022-04-15
Description: Remote Procedure Call Runtime Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24492; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24492
CVE: CVE-2022-24493
Published: 2022-04-15
Description: Microsoft Local Security Authority (LSA) Server Information Disclosure Vulnerability
CVSS Score: 5.5 (MEDIUM)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24493; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24493
CVE: CVE-2022-24494
Published: 2022-04-15
Description: Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24494; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24494
CVE: CVE-2022-24495
Published: 2022-04-15
Description: Windows Direct Show Remote Code Execution Vulnerability
CVSS Score: 7.0 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24495; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24495
CVE: CVE-2022-24496
Published: 2022-04-15
Description: Windows Local Security Authority (LSA) Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24496; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24496
CVE: CVE-2022-24497
Published: 2022-04-15
Description: Windows Network File System Remote Code Execution Vulnerability
CVSS Score: 9.8 (CRITICAL)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24497; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24497
CVE: CVE-2022-24498
Published: 2022-04-15
Description: Windows iSCSI Target Service Information Disclosure Vulnerability
CVSS Score: 6.5 (MEDIUM)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24498; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24498
CVE: CVE-2022-24499
Published: 2022-04-15
Description: Windows Installer Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24499; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24499
CVE: CVE-2022-24500
Published: 2022-04-15
Description: Windows SMB Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24500; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24500
CVE: CVE-2022-24513
Published: 2022-04-15
Description: Visual Studio Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24513; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24513
CVE: CVE-2022-24521
Published: 2022-04-15
Description: Windows Common Log File System Driver Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24521; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24521; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-24521
CVE: CVE-2022-24527
Published: 2022-04-15
Description: Microsoft Endpoint Configuration Manager Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24527; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-24527
CVE: CVE-2022-24528
Published: 2022-04-15
Description: Remote Procedure Call Runtime Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24528; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24528
CVE: CVE-2022-24530
Published: 2022-04-15
Description: Windows Installer Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24530; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24530
CVE: CVE-2022-24532
Published: 2022-04-15
Description: HEVC Video Extensions Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24532; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24532
CVE: CVE-2022-24533
Published: 2022-04-15
Description: Remote Desktop Protocol Remote Code Execution Vulnerability
CVSS Score: 8.0 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24533; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24533
CVE: CVE-2022-24534
Published: 2022-04-15
Description: Win32 Stream Enumeration Remote Code Execution Vulnerability
CVSS Score: 7.5 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24534; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24534
CVE: CVE-2022-24536
Published: 2022-04-15
Description: Windows DNS Server Remote Code Execution Vulnerability
CVSS Score: 7.2 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24536; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24536
CVE: CVE-2022-24537
Published: 2022-04-15
Description: Windows Hyper-V Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-362
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24537; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24537
CVE: CVE-2022-24538
Published: 2022-04-15
Description: Windows Cluster Shared Volume (CSV) Denial of Service Vulnerability
CVSS Score: 6.5 (MEDIUM)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24538; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24538
CVE: CVE-2022-24539
Published: 2022-04-15
Description: Windows Hyper-V Shared Virtual Hard Disks Information Disclosure Vulnerability
CVSS Score: 8.1 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24539; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24539
CVE: CVE-2022-24540
Published: 2022-04-15
Description: Windows ALPC Elevation of Privilege Vulnerability
CVSS Score: 7.0 (HIGH)
CWE: CWE-362, CWE-362
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24540; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24540
CVE: CVE-2022-24541
Published: 2022-04-15
Description: Windows Server Service Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24541; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24541
CVE: CVE-2022-24542
Published: 2022-04-15
Description: Windows Win32k Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24542; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24542
CVE: CVE-2022-24543
Published: 2022-04-15
Description: Windows Upgrade Assistant Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24543; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24543
CVE: CVE-2022-24544
Published: 2022-04-15
Description: Windows Kerberos Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24544; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24544
CVE: CVE-2022-24545
Published: 2022-04-15
Description: Windows Kerberos Remote Code Execution Vulnerability
CVSS Score: 8.1 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24545; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24545
CVE: CVE-2022-24546
Published: 2022-04-15
Description: Windows DWM Core Library Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24546; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24546
CVE: CVE-2022-24547
Published: 2022-04-15
Description: Windows Digital Media Receiver Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24547; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24547
CVE: CVE-2022-24548
Published: 2022-04-15
Description: Microsoft Defender Denial of Service Vulnerability
CVSS Score: 5.5 (MEDIUM)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24548; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24548
CVE: CVE-2022-24549
Published: 2022-04-15
Description: Windows AppX Package Manager Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24549; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24549
CVE: CVE-2022-24550
Published: 2022-04-15
Description: Windows Telephony Server Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24550; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24550
CVE: CVE-2022-24851
Published: 2022-04-15
Description: LDAP Account Manager (LAM) is an open source web frontend for managing entries stored in an LDAP directory. The profile editor tool has an edit profile functionality, the parameters on this page are not properly sanitized and hence leads to stored XSS attacks. An authenticated user can store XSS payloads in the profiles, which gets triggered when any other user try to access the edit profile page. The pdf editor tool has an edit pdf profile functionality, the logoFile parameter in it is not properly sanitized and an user can enter relative paths like ../../../../../../../../../../../../../usr/share/icons/hicolor/48x48/apps/gvim.png via tools like burpsuite. Later when a pdf is exported using the edited profile the pdf icon has the image on that path(if image is present). Both issues require an attacker to be able to login to LAM admin interface. The issue is fixed in version 7.9.1.
CVSS Score: 8.1 (HIGH)
CWE: CWE-22, CWE-79, CWE-79
References: https://github.com/LDAPAccountManager/lam/commit/3c6f09a3579e048e224eb5a4c4e3eefaa8bccd49; https://github.com/LDAPAccountManager/lam/issues/170; https://github.com/LDAPAccountManager/lam/security/advisories/GHSA-f2fr-cccr-583v