deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-3887
Published: 2022-11-09
Description: Use after free in Web Workers in Google Chrome prior to 107.0.5304.106 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://chromereleases.googleblog.com/2022/11/stable-channel-update-for-desktop.html; https://crbug.com/1372695; https://www.debian.org/security/2022/dsa-5275
CVE: CVE-2022-3888
Published: 2022-11-09
Description: Use after free in WebCodecs in Google Chrome prior to 107.0.5304.106 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://chromereleases.googleblog.com/2022/11/stable-channel-update-for-desktop.html; https://crbug.com/1375059; https://www.debian.org/security/2022/dsa-5275
CVE: CVE-2022-3889
Published: 2022-11-09
Description: Type confusion in V8 in Google Chrome prior to 107.0.5304.106 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-843, CWE-843
References: https://chromereleases.googleblog.com/2022/11/stable-channel-update-for-desktop.html; https://crbug.com/1380063; https://www.debian.org/security/2022/dsa-5275
CVE: CVE-2022-3890
Published: 2022-11-09
Description: Heap buffer overflow in Crashpad in Google Chrome on Android prior to 107.0.5304.106 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://chromereleases.googleblog.com/2022/11/stable-channel-update-for-desktop.html; https://crbug.com/1380083; https://www.debian.org/security/2022/dsa-5275
CVE: CVE-2022-45059
Published: 2022-11-09
Description: An issue was discovered in Varnish Cache 7.x before 7.1.2 and 7.2.x before 7.2.1. A request smuggling attack can be performed on Varnish Cache servers by requesting that certain headers are made hop-by-hop, preventing the Varnish Cache servers from forwarding critical headers to the backend.
CVSS Score: 7.5 (HIGH)
CWE: CWE-444, CWE-444
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G6ZMOZVBLZXHEV5VRW4I4SOWLQEK5OF5/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M4KVVCIQVINQQ2D7ORNARSYALMJUMP3I/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XGF6LFTHXCSYMYUX5HLMVXQH3WHCSFLU/
CVE: CVE-2022-45060
Published: 2022-11-09
Description: An HTTP Request Forgery issue was discovered in Varnish Cache 5.x and 6.x before 6.0.11, 7.x before 7.1.2, and 7.2.x before 7.2.1. An attacker may introduce characters through HTTP/2 pseudo-headers that are invalid in the context of an HTTP/1 request line, causing the Varnish server to produce invalid HTTP/1 requests to the backend. This could, in turn, be used to exploit vulnerabilities in a server behind the Varnish server. Note: the 6.0.x LTS series (before 6.0.11) is affected.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://docs.varnish-software.com/security/VSV00011; https://lists.debian.org/debian-lts-announce/2022/11/msg00036.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G6ZMOZVBLZXHEV5VRW4I4SOWLQEK5OF5/
CVE: CVE-2022-40797
Published: 2022-11-09
Description: Roxy Fileman 1.4.6 allows Remote Code Execution via a .phar upload, because the default FORBIDDEN_UPLOADS value in conf.json only blocks .php, .php4, and .php5 files. (Visiting any .phar file invokes the PHP interpreter in some realistic web-server configurations.)
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434, CWE-434
References: http://packetstormsecurity.com/files/169964/Roxy-Fileman-1.4.6-Remote-Shell-Upload.html; https://gist.github.com/Hadi999/1f66fe7c5a217ca261ebfec36c630d18; https://salsa.debian.org/php-team/php/-/blob/dc253886b5b2e9bc8d9e36db787abb083a667fd8/debian/php-cgi.conf#L5-6
CVE: CVE-2022-45061
Published: 2022-11-09
Description: An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing some inputs to the IDNA (RFC 3490) decoder, such that a crafted, unreasonably long name being presented to the decoder could lead to a CPU denial of service. Hostnames are often supplied by remote servers that could be controlled by a malicious actor; in such a scenario, they could trigger excessive CPU consumption on the client attempting to make use of an attacker-supplied supposed hostname. For example, the attack payload could be placed in the Location header of an HTTP response with status code 302. A fix is planned in 3.11.1, 3.10.9, 3.9.16, 3.8.16, and 3.7.16.
CVSS Score: 7.5 (HIGH)
CWE: CWE-407, CWE-407
References: https://github.com/python/cpython/issues/98433; https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html; https://lists.debian.org/debian-lts-announce/2023/06/msg00039.html
CVE: CVE-2022-45062
Published: 2022-11-09
Description: In Xfce xfce4-settings before 4.16.4 and 4.17.x before 4.17.1, there is an argument injection vulnerability in xfce4-mime-helper.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-88, CWE-88
References: https://gitlab.xfce.org/xfce/xfce4-settings/-/commit/55e3c5fb667e96ad1412cf249879262b369d28d7; https://gitlab.xfce.org/xfce/xfce4-settings/-/commit/f34a92a84f96268ad24a7a13fd5edc9f1d526110; https://gitlab.xfce.org/xfce/xfce4-settings/-/issues/390
CVE: CVE-2022-31253
Published: 2022-11-09
Description: A Untrusted Search Path vulnerability in openldap2 of openSUSE Factory allows local attackers with control of the ldap user or group to change ownership of arbitrary directory entries to this user/group, leading to escalation to root. This issue affects: openSUSE Factory openldap2 versions prior to 2.6.3-404.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-426
References: https://bugzilla.suse.com/show_bug.cgi?id=1202931; https://bugzilla.suse.com/show_bug.cgi?id=1202931
CVE: CVE-2022-43320
Published: 2022-11-09
Description: FeehiCMS v2.1.1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the id parameter at /web/admin/index.php?r=log%2Fview-layer.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/liufee/feehicms/issues/4; https://github.com/liufee/feehicms/issues/4
CVE: CVE-2022-43321
Published: 2022-11-09
Description: Shopwind v3.4.3 was discovered to contain a reflected cross-site scripting (XSS) vulnerability in the component /common/library/Page.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://yii-shopwind.com; https://github.com/shopwind/yii-shopwind/issues/1; http://yii-shopwind.com
CVE: CVE-2022-43290
Published: 2022-11-09
Description: Canteen Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /youthappam/editcategory.php.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/songyangqi/bug_report/blob/main/vendors/mayuri_k/canteen-management-system/SQLi-1.md; https://github.com/songyangqi/bug_report/blob/main/vendors/mayuri_k/canteen-management-system/SQLi-1.md
CVE: CVE-2022-43291
Published: 2022-11-09
Description: Canteen Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /youthappam/editclient.php.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/songyangqi/bug_report/blob/main/vendors/mayuri_k/canteen-management-system/SQLi-2.md; https://github.com/songyangqi/bug_report/blob/main/vendors/mayuri_k/canteen-management-system/SQLi-2.md
CVE: CVE-2022-43292
Published: 2022-11-09
Description: Canteen Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /youthappam/editfood.php.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/songyangqi/bug_report/blob/main/vendors/mayuri_k/canteen-management-system/SQLi-3.md; https://github.com/songyangqi/bug_report/blob/main/vendors/mayuri_k/canteen-management-system/SQLi-3.md
CVE: CVE-2021-34566
Published: 2022-11-09
Description: In WAGO I/O-Check Service in multiple products an unauthenticated remote attacker can send a specially crafted packet containing OS commands to crash the iocheck process and write memory resulting in loss of integrity and DoS.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-120
References: https://cert.vde.com/en/advisories/VDE-2020-036/; https://cert.vde.com/en/advisories/VDE-2020-036/
CVE: CVE-2021-34567
Published: 2022-11-09
Description: In WAGO I/O-Check Service in multiple products an unauthenticated remote attacker can send a specially crafted packet containing OS commands to provoke a denial of service and an limited out-of-bounds read.
CVSS Score: 8.2 (HIGH)
CWE: CWE-125
References: https://cert.vde.com/en/advisories/VDE-2020-036/; https://cert.vde.com/en/advisories/VDE-2020-036/
CVE: CVE-2021-34568
Published: 2022-11-09
Description: In WAGO I/O-Check Service in multiple products an unauthenticated remote attacker can send a specially crafted packet containing OS commands to provoke a denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://cert.vde.com/en/advisories/VDE-2020-036/; https://cert.vde.com/en/advisories/VDE-2020-036/
CVE: CVE-2021-34569
Published: 2022-11-09
Description: In WAGO I/O-Check Service in multiple products an attacker can send a specially crafted packet containing OS commands to crash the diagnostic tool and write memory.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://cert.vde.com/en/advisories/VDE-2020-036/; https://cert.vde.com/en/advisories/VDE-2020-036/
CVE: CVE-2022-41978
Published: 2022-11-09
Description: Auth. (subscriber+) Arbitrary Options Update vulnerability in Zoho CRM Lead Magnet plugin <= 1.7.5.8 on WordPress.
CVSS Score: 8.8 (HIGH)
CWE: CWE-264
References: https://patchstack.com/database/vulnerability/zoho-crm-forms/wordpress-zoho-crm-lead-magnet-plugin-1-7-5-6-auth-arbitrary-options-update-vulnerability?_s_id=cve; https://wordpress.org/plugins/zoho-crm-forms/#developers; https://patchstack.com/database/vulnerability/zoho-crm-forms/wordpress-zoho-crm-lead-magnet-plugin-1-7-5-6-auth-arbitrary-options-update-vulnerability?_s_id=cve
CVE: CVE-2022-43118
Published: 2022-11-09
Description: A cross-site scripting (XSS) vulnerability in flatCore-CMS v2.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Username text field.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/flatCore/flatCore-CMS/issues/86; https://github.com/flatCore/flatCore-CMS/issues/86
CVE: CVE-2022-43119
Published: 2022-11-09
Description: A cross-site scripting (XSS) vulnerability in Clansphere CMS v2011.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Username parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/sinemsahn/POC/blob/main/Create%20Clansphere%202011.4%20%22username%22%20xss.md; https://github.com/sinemsahn/POC/blob/main/Create%20Clansphere%202011.4%20%22username%22%20xss.md
CVE: CVE-2022-43120
Published: 2022-11-09
Description: A cross-site scripting (XSS) vulnerability in the /panel/fields/add component of Intelliants Subrion CMS v4.2.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Field default value text field.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/intelliants/subrion/issues/894; https://github.com/intelliants/subrion/issues/894
CVE: CVE-2022-43121
Published: 2022-11-09
Description: A cross-site scripting (XSS) vulnerability in the CMS Field Add page of Intelliants Subrion CMS v4.2.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the tooltip text field.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/intelliants/subrion/issues/895; https://github.com/intelliants/subrion/issues/895
CVE: CVE-2022-43277
Published: 2022-11-09
Description: Canteen Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via ip/youthappam/php_action/editFile.php. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434, CWE-434
References: https://github.com/HuahuaDaren/bug_report/blob/main/vendors/mayuri_k/canteen-management-system/RCE-1.md; https://github.com/HuahuaDaren/bug_report/blob/main/vendors/mayuri_k/canteen-management-system/RCE-1.md
CVE: CVE-2022-43278
Published: 2022-11-09
Description: Canteen Management System v1.0 was discovered to contain a SQL injection vulnerability via the categoriesId parameter at /php_action/fetchSelectedCategories.php.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/HuahuaDaren/bug_report/blob/main/vendors/mayuri_k/canteen-management-system/SQLi-1.md; https://github.com/HuahuaDaren/bug_report/blob/main/vendors/mayuri_k/canteen-management-system/SQLi-1.md
CVE: CVE-2022-43488
Published: 2022-11-09
Description: Cross-Site Request Forgery (CSRF) vulnerability in Advanced Dynamic Pricing for WooCommerce plugin <= 4.1.5 on WordPress leading to rule type migration.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://patchstack.com/database/vulnerability/advanced-dynamic-pricing-for-woocommerce/wordpress-advanced-dynamic-pricing-for-woocommerce-plugin-4-1-5-cross-site-request-forgery-csrf-vulnerability-2?_s_id=cve; https://wordpress.org/plugins/advanced-dynamic-pricing-for-woocommerce/; https://patchstack.com/database/vulnerability/advanced-dynamic-pricing-for-woocommerce/wordpress-advanced-dynamic-pricing-for-woocommerce-plugin-4-1-5-cross-site-request-forgery-csrf-vulnerability-2?_s_id=cve
CVE: CVE-2021-34577
Published: 2022-11-09
Description: In the Kaden PICOFLUX AiR water meter an adversary can read the values through wireless M-Bus mode 5 with a hardcoded shared key while being adjacent to the device.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-798
References: https://www.fit.vutbr.cz/~polcak/CVE-2021-34577; https://www.fit.vutbr.cz/~polcak/CVE-2021-34577
CVE: CVE-2021-34579
Published: 2022-11-09
Description: In Phoenix Contact: FL MGUARD DM version 1.12.0 and 1.13.0 access to the Apache web server being installed as part of the FL MGUARD DM on Microsoft Windows does not require login credentials even if configured during installation.Attackers with network access to the Apache web server can download and therefore read mGuard configuration profiles (“ATV profiles”). Such configuration profiles may contain sensitive information, e.g. private keys associated with IPsec VPN connections.
CVSS Score: 7.5 (HIGH)
CWE: CWE-269
References: https://cert.vde.com/en/advisories/VDE-2021-035/; https://cert.vde.com/en/advisories/VDE-2021-035/
CVE: CVE-2022-0031
Published: 2022-11-09
Description: A local privilege escalation (PE) vulnerability in the Palo Alto Networks Cortex XSOAR engine software running on a Linux operating system allows a local attacker with shell access to the engine to execute programs with elevated privileges.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-345, CWE-345
References: https://security.paloaltonetworks.com/CVE-2022-0031; https://security.paloaltonetworks.com/CVE-2022-0031
CVE: CVE-2022-25932
Published: 2022-11-09
Description: The firmware of InHand Networks InRouter302 V3.5.45 introduces fixes for TALOS-2022-1472 and TALOS-2022-1474. The fixes are incomplete. An attacker can still perform, respectively, a privilege escalation and an information disclosure vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: https://inhandnetworks.com/upload/attachment/202210/25/InHand-PSA-2022-02.pdf; https://talosintelligence.com/vulnerability_reports/TALOS-2022-1523; https://inhandnetworks.com/upload/attachment/202210/25/InHand-PSA-2022-02.pdf
CVE: CVE-2022-26023
Published: 2022-11-09
Description: A leftover debug code vulnerability exists in the console verify functionality of InHand Networks InRouter302 V3.5.45. A specially-crafted series of network requests can lead to disabling security features. An attacker can send a sequence of requests to trigger this vulnerability.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-489
References: https://inhandnetworks.com/upload/attachment/202210/25/InHand-PSA-2022-02.pdf; https://talosintelligence.com/vulnerability_reports/TALOS-2022-1520; https://inhandnetworks.com/upload/attachment/202210/25/InHand-PSA-2022-02.pdf
CVE: CVE-2022-28689
Published: 2022-11-09
Description: A leftover debug code vulnerability exists in the console support functionality of InHand Networks InRouter302 V3.5.45. A specially-crafted network request can lead to arbitrary command execution. An attacker can send a sequence of requests to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-489
References: https://inhandnetworks.com/upload/attachment/202210/25/InHand-PSA-2022-02.pdf; https://talosintelligence.com/vulnerability_reports/TALOS-2022-1521; https://inhandnetworks.com/upload/attachment/202210/25/InHand-PSA-2022-02.pdf
CVE: CVE-2022-29481
Published: 2022-11-09
Description: A leftover debug code vulnerability exists in the console nvram functionality of InHand Networks InRouter302 V3.5.45. A specially-crafted series of network requests can lead to disabling security features. An attacker can send a sequence of requests to trigger this vulnerability.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-489
References: https://inhandnetworks.com/upload/attachment/202210/25/InHand-PSA-2022-02.pdf; https://talosintelligence.com/vulnerability_reports/TALOS-2022-1518; https://inhandnetworks.com/upload/attachment/202210/25/InHand-PSA-2022-02.pdf
CVE: CVE-2022-29888
Published: 2022-11-09
Description: A leftover debug code vulnerability exists in the httpd port 4444 upload.cgi functionality of InHand Networks InRouter302 V3.5.45. A specially-crafted HTTP request can lead to arbitrary file deletion. An attacker can send an HTTP request to trigger this vulnerability.
CVSS Score: 8.1 (HIGH)
CWE: CWE-489
References: https://inhandnetworks.com/upload/attachment/202210/25/InHand-PSA-2022-02.pdf; https://talosintelligence.com/vulnerability_reports/TALOS-2022-1522; https://inhandnetworks.com/upload/attachment/202210/25/InHand-PSA-2022-02.pdf
CVE: CVE-2022-30543
Published: 2022-11-09
Description: A leftover debug code vulnerability exists in the console infct functionality of InHand Networks InRouter302 V3.5.45. A specially-crafted series of network requests can lead to execution of privileged operations. An attacker can send a sequence of requests to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-489
References: https://inhandnetworks.com/upload/attachment/202210/25/InHand-PSA-2022-02.pdf; https://talosintelligence.com/vulnerability_reports/TALOS-2022-1519; https://inhandnetworks.com/upload/attachment/202210/25/InHand-PSA-2022-02.pdf
CVE: CVE-2022-32588
Published: 2022-11-09
Description: An out-of-bounds write vulnerability exists in the PICT parsing pctwread_14841 functionality of Accusoft ImageGear 20.0. A specially-crafted malformed file can lead to memory corruption. An attacker can provide a malicious file to trigger this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2022-1544; https://talosintelligence.com/vulnerability_reports/TALOS-2022-1544
CVE: CVE-2022-3445
Published: 2022-11-09
Description: Use after free in Skia in Google Chrome prior to 106.0.5249.119 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2022/10/stable-channel-update-for-desktop_11.html; https://crbug.com/1364604; https://security.gentoo.org/glsa/202305-10
CVE: CVE-2022-3446
Published: 2022-11-09
Description: Heap buffer overflow in WebSQL in Google Chrome prior to 106.0.5249.119 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://chromereleases.googleblog.com/2022/10/stable-channel-update-for-desktop_11.html; https://crbug.com/1368076; https://security.gentoo.org/glsa/202305-10
CVE: CVE-2022-3447
Published: 2022-11-09
Description: Inappropriate implementation in Custom Tabs in Google Chrome on Android prior to 106.0.5249.119 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-125
References: https://chromereleases.googleblog.com/2022/10/stable-channel-update-for-desktop_11.html; https://crbug.com/1366582; https://security.gentoo.org/glsa/202305-10
CVE: CVE-2022-3448
Published: 2022-11-09
Description: Use after free in Permissions API in Google Chrome prior to 106.0.5249.119 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://chromereleases.googleblog.com/2022/10/stable-channel-update-for-desktop_11.html; https://crbug.com/1363040; https://security.gentoo.org/glsa/202305-10
CVE: CVE-2022-3449
Published: 2022-11-09
Description: Use after free in Safe Browsing in Google Chrome prior to 106.0.5249.119 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://chromereleases.googleblog.com/2022/10/stable-channel-update-for-desktop_11.html; https://crbug.com/1364662; https://security.gentoo.org/glsa/202305-10
CVE: CVE-2022-3450
Published: 2022-11-09
Description: Use after free in Peer Connection in Google Chrome prior to 106.0.5249.119 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://chromereleases.googleblog.com/2022/10/stable-channel-update-for-desktop_11.html; https://crbug.com/1369882; https://security.gentoo.org/glsa/202305-10
CVE: CVE-2022-42964
Published: 2022-11-09
Description: An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the pymatgen PyPI package, when an attacker is able to supply arbitrary input to the GaussianInput.from_string method
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-1333, CWE-1333
References: https://research.jfrog.com/vulnerabilities/pymatgen-redos-xray-257184/; https://research.jfrog.com/vulnerabilities/pymatgen-redos-xray-257184/
CVE: CVE-2022-42965
Published: 2022-11-09
Description: An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the snowflake-connector-python PyPI package, when an attacker is able to supply arbitrary input to the undocumented get_file_transfer_type method
CVSS Score: 3.7 (LOW)
CWE: CWE-1333, CWE-1333
References: https://research.jfrog.com/vulnerabilities/snowflake-connector-python-redos-xray-257185/; https://research.jfrog.com/vulnerabilities/snowflake-connector-python-redos-xray-257185/
CVE: CVE-2022-42966
Published: 2022-11-09
Description: An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the cleo PyPI package, when an attacker is able to supply arbitrary input to the Table.set_rows method
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-1333, CWE-1333
References: https://research.jfrog.com/vulnerabilities/cleo-redos-xray-257186/; https://research.jfrog.com/vulnerabilities/cleo-redos-xray-257186/