deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-4029
Published: 2022-11-29
Description: The Simple:Press plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'sforum_[md5 hash of the WordPress URL]' cookie value in versions up to, and including, 6.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This would be highly complex to exploit as it would require the attacker to set the cookie a cookie for the targeted user.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2804020%40simplepress&new=2804020%40simplepress&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/55a57b5f-2f87-4060-b1c2-77086f695dda?source=cve; https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-4029
CVE: CVE-2022-4030
Published: 2022-11-29
Description: The Simple:Press plugin for WordPress is vulnerable to Path Traversal in versions up to, and including, 6.8 via the 'file' parameter which can be manipulated during user avatar deletion. This makes it possible with attackers, with minimal permissions such as a subscriber, to supply paths to arbitrary files on the server that will subsequently be deleted. This can be used to delete the wp-config.php file that can allow an attacker to configure the site and achieve remote code execution.
CVSS Score: 8.1 (HIGH)
CWE: CWE-22, CWE-22
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2804020%40simplepress&new=2804020%40simplepress&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/43bcf3ab-4201-4a61-82c5-2dc60b684989?source=cve; https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-4030
CVE: CVE-2022-4031
Published: 2022-11-29
Description: The Simple:Press plugin for WordPress is vulnerable to arbitrary file modifications in versions up to, and including, 6.8 via the 'file' parameter which does not properly restrict files to be edited in the context of the plugin. This makes it possible with attackers, with high-level permissions such as an administrator, to supply paths to arbitrary files on the server that can be modified outside of the intended scope of the plugin.
CVSS Score: 3.8 (LOW)
CWE: CWE-22, CWE-22
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2804020%40simplepress&new=2804020%40simplepress&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/1ead1a18-9429-472e-9e88-e792eaa23ae9?source=cve; https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-4031
CVE: CVE-2022-4032
Published: 2022-11-29
Description: The Quiz and Survey Master plugin for WordPress is vulnerable to iFrame Injection via the 'question[id]' parameter in versions up to, and including, 8.0.4 due to insufficient input sanitization and output escaping that allowed iframe tags to be injected. This makes it possible for unauthenticated attackers to inject iFrames in pages that will execute whenever a user accesses an injected page.
CVSS Score: 7.2 (HIGH)
CWE: CWE-20, CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2801761%40quiz-master-next&new=2801761%40quiz-master-next&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/b901b3f8-8bbd-42ef-8e0c-de6d09c4950f?source=cve; https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-4032
CVE: CVE-2022-4033
Published: 2022-11-29
Description: The Quiz and Survey Master plugin for WordPress is vulnerable to input validation bypass via the 'question[id]' parameter in versions up to, and including, 8.0.4 due to insufficient input validation that allows attackers to inject content other than the specified value (i.e. a number, file path, etc..). This makes it possible attackers to submit values other than the intended input type.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2801761%40quiz-master-next&new=2801761%40quiz-master-next&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/9f5cc779-c7de-42e6-a812-5c0539067b8c?source=cve; https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-4033
CVE: CVE-2022-4034
Published: 2022-11-29
Description: The Appointment Hour Booking Plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 1.3.72. This makes it possible for unauthenticated attackers to embed untrusted input into content during booking creation that may be exported as a CSV file when a site's administrator exports booking details. This can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-1236, CWE-1236
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2803896%40appointment-hour-booking&new=2803896%40appointment-hour-booking&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/b3a77b7a-65ad-4334-99c9-92cc79e60bee?source=cve; https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-4034
CVE: CVE-2022-4035
Published: 2022-11-29
Description: The Appointment Hour Booking plugin for WordPress is vulnerable to iFrame Injection via the ‘email’ or general field parameters in versions up to, and including, 1.3.72 due to insufficient input sanitization and output escaping that makes injecting iFrame tags possible. This makes it possible for unauthenticated attackers to inject iFrames when submitting a booking that will execute whenever a user accesses the injected booking details page.
CVSS Score: 7.2 (HIGH)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2803896%40appointment-hour-booking&new=2803896%40appointment-hour-booking&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/870ae326-a7c9-4201-bf0d-0fbda663a694?source=cve; https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-4035
CVE: CVE-2022-4036
Published: 2022-11-29
Description: The Appointment Hour Booking plugin for WordPress is vulnerable to CAPTCHA bypass in versions up to, and including, 1.3.72. This is due to the use of insufficiently strong hashing algorithm on the CAPTCHA secret that is also displayed to the user via a cookie.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-804, CWE-326
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2803896%40appointment-hour-booking&new=2803896%40appointment-hour-booking&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/f62d28bd-fa33-4f0b-a116-5aacc05bfa3a?source=cve; https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-4036
CVE: CVE-2022-46155
Published: 2022-11-29
Description: Airtable.js is the JavaScript client for Airtable. Prior to version 0.11.6, Airtable.js had a misconfigured build script in its source package. When the build script is run, it would bundle environment variables into the build target of a transpiled bundle. Specifically, the AIRTABLE_API_KEY and AIRTABLE_ENDPOINT_URL environment variables are inserted during Browserify builds due to being referenced in Airtable.js code. This only affects copies of Airtable.js built from its source, not those installed via npm or yarn. Airtable API keys set in users’ environments via the AIRTABLE_API_KEY environment variable may be bundled into local copies of Airtable.js source code if all of the following conditions are met: 1) the user has cloned the Airtable.js source onto their machine, 2) the user runs the `npm prepare` script, and 3) the user' has the AIRTABLE_API_KEY environment variable set. If these conditions are met, a user’s local build of Airtable.js would be modified to include the value of the AIRTABLE_API_KEY environment variable, which could then be accidentally shipped in the bundled code. Users who do not meet all three of these conditions are not impacted by this issue. Users should upgrade to Airtable.js version 0.11.6 or higher; or, as a workaround unset the AIRTABLE_API_KEY environment variable in their shell and/or remove it from your .bashrc, .zshrc, or other shell configuration files. Users should also regenerate any Airtable API keys they use, as the keysy may be present in bundled code.
CVSS Score: 7.6 (HIGH)
CWE: CWE-522, CWE-312
References: https://github.com/Airtable/airtable.js/pull/330/commits/b468d8fe48d75e3d5fe46d0ea7770f4658951ed0; https://github.com/Airtable/airtable.js/releases/tag/v0.11.6; https://github.com/Airtable/airtable.js/security/advisories/GHSA-vqm5-9546-x25v
CVE: CVE-2022-4174
Published: 2022-11-30
Description: Type confusion in V8 in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-843
References: https://chromereleases.googleblog.com/2022/11/stable-channel-update-for-desktop_29.html; https://crbug.com/1379054; https://security.gentoo.org/glsa/202305-10
CVE: CVE-2022-4175
Published: 2022-11-30
Description: Use after free in Camera Capture in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2022/11/stable-channel-update-for-desktop_29.html; https://crbug.com/1381401; https://security.gentoo.org/glsa/202305-10
CVE: CVE-2022-4176
Published: 2022-11-30
Description: Out of bounds write in Lacros Graphics in Google Chrome on Chrome OS and Lacros prior to 108.0.5359.71 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via UI interactions. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://chromereleases.googleblog.com/2022/11/stable-channel-update-for-desktop_29.html; https://crbug.com/1361066; https://security.gentoo.org/glsa/202305-10
CVE: CVE-2022-4177
Published: 2022-11-30
Description: Use after free in Extensions in Google Chrome prior to 108.0.5359.71 allowed an attacker who convinced a user to install an extension to potentially exploit heap corruption via a crafted Chrome Extension and UI interaction. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2022/11/stable-channel-update-for-desktop_29.html; https://crbug.com/1379242; https://security.gentoo.org/glsa/202305-10
CVE: CVE-2022-4178
Published: 2022-11-30
Description: Use after free in Mojo in Google Chrome prior to 108.0.5359.71 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2022/11/stable-channel-update-for-desktop_29.html; https://crbug.com/1376099; https://security.gentoo.org/glsa/202305-10
CVE: CVE-2022-4179
Published: 2022-11-30
Description: Use after free in Audio in Google Chrome prior to 108.0.5359.71 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2022/11/stable-channel-update-for-desktop_29.html; https://crbug.com/1377783; https://security.gentoo.org/glsa/202305-10
CVE: CVE-2022-4180
Published: 2022-11-30
Description: Use after free in Mojo in Google Chrome prior to 108.0.5359.71 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2022/11/stable-channel-update-for-desktop_29.html; https://crbug.com/1378564; https://security.gentoo.org/glsa/202305-10
CVE: CVE-2022-4181
Published: 2022-11-30
Description: Use after free in Forms in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2022/11/stable-channel-update-for-desktop_29.html; https://crbug.com/1382581; https://security.gentoo.org/glsa/202305-10
CVE: CVE-2022-4182
Published: 2022-11-30
Description: Inappropriate implementation in Fenced Frames in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to bypass fenced frame restrictions via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 4.3 (MEDIUM)
References: https://chromereleases.googleblog.com/2022/11/stable-channel-update-for-desktop_29.html; https://crbug.com/1368739; https://security.gentoo.org/glsa/202305-10
CVE: CVE-2022-4183
Published: 2022-11-30
Description: Insufficient policy enforcement in Popup Blocker in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 4.3 (MEDIUM)
References: https://chromereleases.googleblog.com/2022/11/stable-channel-update-for-desktop_29.html; https://crbug.com/1251790; https://security.gentoo.org/glsa/202305-10
CVE: CVE-2022-4184
Published: 2022-11-30
Description: Insufficient policy enforcement in Autofill in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to bypass autofill restrictions via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 4.3 (MEDIUM)
References: https://chromereleases.googleblog.com/2022/11/stable-channel-update-for-desktop_29.html; https://crbug.com/1358647; https://security.gentoo.org/glsa/202305-10
CVE: CVE-2022-4185
Published: 2022-11-30
Description: Inappropriate implementation in Navigation in Google Chrome on iOS prior to 108.0.5359.71 allowed a remote attacker to spoof the contents of the modal dialogue via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 4.3 (MEDIUM)
References: https://chromereleases.googleblog.com/2022/11/stable-channel-update-for-desktop_29.html; https://crbug.com/1373025; https://security.gentoo.org/glsa/202305-10
CVE: CVE-2022-4186
Published: 2022-11-30
Description: Insufficient validation of untrusted input in Downloads in Google Chrome prior to 108.0.5359.71 allowed an attacker who convinced a user to install a malicious extension to bypass Downloads restrictions via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: https://chromereleases.googleblog.com/2022/11/stable-channel-update-for-desktop_29.html; https://crbug.com/1377165; https://security.gentoo.org/glsa/202305-10
CVE: CVE-2022-4187
Published: 2022-11-30
Description: Insufficient policy enforcement in DevTools in Google Chrome on Windows prior to 108.0.5359.71 allowed a remote attacker to bypass filesystem restrictions via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 6.5 (MEDIUM)
References: https://chromereleases.googleblog.com/2022/11/stable-channel-update-for-desktop_29.html; https://crbug.com/1381217; https://security.gentoo.org/glsa/202305-10
CVE: CVE-2022-4188
Published: 2022-11-30
Description: Insufficient validation of untrusted input in CORS in Google Chrome on Android prior to 108.0.5359.71 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-74
References: https://chromereleases.googleblog.com/2022/11/stable-channel-update-for-desktop_29.html; https://crbug.com/1340879; https://security.gentoo.org/glsa/202305-10
CVE: CVE-2022-4189
Published: 2022-11-30
Description: Insufficient policy enforcement in DevTools in Google Chrome prior to 108.0.5359.71 allowed an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a crafted Chrome Extension. (Chromium security severity: Medium)
CVSS Score: 4.3 (MEDIUM)
References: https://chromereleases.googleblog.com/2022/11/stable-channel-update-for-desktop_29.html; https://crbug.com/1344647; https://security.gentoo.org/glsa/202305-10
CVE: CVE-2022-4190
Published: 2022-11-30
Description: Insufficient data validation in Directory in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to bypass file system restrictions via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 8.8 (HIGH)
References: https://chromereleases.googleblog.com/2022/11/stable-channel-update-for-desktop_29.html; https://crbug.com/1378997; https://security.gentoo.org/glsa/202305-10
CVE: CVE-2022-4191
Published: 2022-11-30
Description: Use after free in Sign-In in Google Chrome prior to 108.0.5359.71 allowed a remote attacker who convinced a user to engage in specific UI interaction to potentially exploit heap corruption via profile destruction. (Chromium security severity: Medium)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2022/11/stable-channel-update-for-desktop_29.html; https://crbug.com/1373941; https://security.gentoo.org/glsa/202305-10
CVE: CVE-2022-4192
Published: 2022-11-30
Description: Use after free in Live Caption in Google Chrome prior to 108.0.5359.71 allowed a remote attacker who convinced a user to engage in specific UI interaction to potentially exploit heap corruption via UI interaction. (Chromium security severity: Medium)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2022/11/stable-channel-update-for-desktop_29.html; https://crbug.com/1344514; https://security.gentoo.org/glsa/202305-10
CVE: CVE-2022-4193
Published: 2022-11-30
Description: Insufficient policy enforcement in File System API in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to bypass file system restrictions via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 8.8 (HIGH)
References: https://chromereleases.googleblog.com/2022/11/stable-channel-update-for-desktop_29.html; https://crbug.com/1354518; https://security.gentoo.org/glsa/202305-10
CVE: CVE-2022-4194
Published: 2022-11-30
Description: Use after free in Accessibility in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2022/11/stable-channel-update-for-desktop_29.html; https://crbug.com/1370562; https://security.gentoo.org/glsa/202305-10
CVE: CVE-2022-4195
Published: 2022-11-30
Description: Insufficient policy enforcement in Safe Browsing in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to bypass Safe Browsing warnings via a malicious file. (Chromium security severity: Medium)
CVSS Score: 4.3 (MEDIUM)
References: https://chromereleases.googleblog.com/2022/11/stable-channel-update-for-desktop_29.html; https://crbug.com/1371926; https://security.gentoo.org/glsa/202305-10
CVE: CVE-2022-40265
Published: 2022-11-30
Description: Improper Input Validation vulnerability in Mitsubishi Electric Corporation MELSEC iQ-R Series RJ71EN71 Firmware version "65" and prior and Mitsubishi Electric Corporation MELSEC iQ-R Series R04/08/16/32/120ENCPU Network Part Firmware version "65" and prior allows a remote unauthenticated attacker to cause a Denial of Service condition by sending specially crafted packets. A system reset is required for recovery.
CVSS Score: 8.6 (HIGH)
CWE: CWE-20, CWE-20
References: https://jvn.jp/vu/JVNVU94702422; https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-017_en.pdf; https://jvn.jp/vu/JVNVU94702422
CVE: CVE-2022-45328
Published: 2022-11-30
Description: Church Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/edit_members.php.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/zhangzhaoyuela/bug_report/blob/main/vendors/Godfrey%20De%20Blessed/church-management-system/SQLi-1.md; https://github.com/zhangzhaoyuela/bug_report/blob/main/vendors/Godfrey%20De%20Blessed/church-management-system/SQLi-1.md
CVE: CVE-2022-45332
Published: 2022-11-30
Description: LibreDWG v0.12.4.4643 was discovered to contain a heap buffer overflow via the function decode_preR13_section_hdr at decode_r11.c.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://github.com/LibreDWG/libredwg/issues/524; https://github.com/LibreDWG/libredwg/issues/524
CVE: CVE-2022-45337
Published: 2022-11-30
Description: Tenda TX9 Pro v22.03.02.10 was discovered to contain a stack overflow via the list parameter at /goform/SetIpMacBind.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-787
References: https://github.com/no1rr/Vulnerability/tree/master/Tenda/TX9Pro/1; https://github.com/no1rr/Vulnerability/tree/master/Tenda/TX9Pro/1
CVE: CVE-2022-41412
Published: 2022-11-30
Description: An issue in the graphData.cgi component of perfSONAR v4.4.5 and prior allows attackers to access sensitive data and execute Server-Side Request Forgery (SSRF) attacks.
CVSS Score: 8.6 (HIGH)
CWE: CWE-918, CWE-918
References: http://packetstormsecurity.com/files/170069/perfSONAR-4.4.4-Open-Proxy-Relay.html; https://github.com/renmizo/CVE-2022-41412; http://packetstormsecurity.com/files/170069/perfSONAR-4.4.4-Open-Proxy-Relay.html
CVE: CVE-2022-41413
Published: 2022-11-30
Description: perfSONAR v4.x <= v4.4.5 was discovered to contain a Cross-Site Request Forgery (CSRF) which is triggered when an attacker injects crafted input into the Search function.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: http://packetstormsecurity.com/files/170070/perfSONAR-4.4.5-Cross-Site-Request-Forgery.html; http://packetstormsecurity.com/files/171629/perfSONAR-4.4.5-Cross-Site-Request-Forgery.html; https://github.com/renmizo/CVE-2022-41413
CVE: CVE-2022-44096
Published: 2022-11-30
Description: Sanitization Management System v1.0 was discovered to contain hardcoded credentials which allows attackers to escalate privileges and access the admin panel.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798, CWE-798
References: https://github.com/upasvi/CVE-/issues/1; https://github.com/upasvi/CVE-/issues/1
CVE: CVE-2022-44097
Published: 2022-11-30
Description: Book Store Management System v1.0 was discovered to contain hardcoded credentials which allows attackers to escalate privileges and access the admin panel.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798, CWE-798
References: https://github.com/upasvi/CVE-/issues/2; https://github.com/upasvi/CVE-/issues/2
CVE: CVE-2022-45869
Published: 2022-11-30
Description: A race condition in the x86 KVM subsystem in the Linux kernel through 6.1-rc6 allows guest OS users to cause a denial of service (host OS crash or host OS memory corruption) when nested virtualisation and the TDP MMU are enabled.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-362, CWE-362
References: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=47b0c2e4c220f2251fd8dcfbb44479819c715e15; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=47b0c2e4c220f2251fd8dcfbb44479819c715e15
CVE: CVE-2022-46338
Published: 2022-11-30
Description: g810-led 0.4.2, a LED configuration tool for Logitech Gx10 keyboards, contained a udev rule to make supported device nodes world-readable and writable, allowing any process on the system to read traffic from keyboards, including sensitive data.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-732, CWE-732
References: https://bugs.debian.org/1024998; https://github.com/MatMoul/g810-led/pull/297; https://lists.debian.org/debian-lts-announce/2022/12/msg00002.html