deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-24777
Published: 2022-03-25
Description: grpc-swift is the Swift language implementation of gRPC, a remote procedure call (RPC) framework. Prior to version 1.7.2, a grpc-swift server is vulnerable to a denial of service attack via a reachable assertion. This is due to incorrect logic when handling GOAWAY frames. The attack is low-effort: it takes very little resources to construct and send the required sequence of frames. The impact on availability is high as the server will crash, dropping all in flight connections and requests. This issue is fixed in version 1.7.2. There are currently no known workarounds.
CVSS Score: 7.5 (HIGH)
CWE: CWE-617
References: https://github.com/grpc/grpc-swift/commit/858f977f2a51fca2292f384cf7a108dc2e73a3bd; https://github.com/grpc/grpc-swift/security/advisories/GHSA-r6ww-5963-7r95; https://github.com/grpc/grpc-swift/commit/858f977f2a51fca2292f384cf7a108dc2e73a3bd
CVE: CVE-2022-25577
Published: 2022-03-25
Description: ALF-BanCO v8.2.5 and below was discovered to use a hardcoded password to encrypt the SQLite database containing the user's data. Attackers who are able to gain remote or local access to the system are able to read and modify the data.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-798
References: https://github.com/ph0nkybit/proof-of-concepts/tree/main/Use_Of_Hardcoded_Password_In_ALF-BanCO_8.2.x; https://github.com/ph0nkybit/proof-of-concepts/tree/main/Use_Of_Hardcoded_Password_In_ALF-BanCO_8.2.x
CVE: CVE-2022-25582
Published: 2022-03-25
Description: A stored cross-site scripting (XSS) vulnerability in the Column module of ClassCMS v2.5 and below allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Add Articles field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/k0xx11/Vulscve/blob/master/classcms2.5-xss.md; https://github.com/k0xx11/Vulscve/blob/master/classcms2.5-xss.md
CVE: CVE-2022-26263
Published: 2022-03-25
Description: Yonyou u8 v13.0 was discovered to contain a DOM-based cross-site scripting (XSS) vulnerability via the component /u8sl/WebHelp.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://yonyou.com; https://github.com/k0xx11/Vulscve/blob/master/yonyouu8-xss.md; https://www.yonyou.com/
CVE: CVE-2021-43636
Published: 2022-03-25
Description: Two Buffer Overflow vulnerabilities exists in T10 V2_Firmware V4.1.8cu.5207_B20210320 in the http_request_parse function when processing host data in the HTTP request process.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://note.youdao.com/s/918vCBNT; https://note.youdao.com/s/918vCBNT
CVE: CVE-2022-24778
Published: 2022-03-25
Description: The imgcrypt library provides API exensions for containerd to support encrypted container images and implements the ctd-decoder command line tool for use by containerd to decrypt encrypted container images. The imgcrypt function `CheckAuthorization` is supposed to check whether the current used is authorized to access an encrypted image and prevent the user from running an image that another user previously decrypted on the same system. In versions prior to 1.1.4, a failure occurs when an image with a ManifestList is used and the architecture of the local host is not the first one in the ManifestList. Only the first architecture in the list was tested, which may not have its layers available locally since it could not be run on the host architecture. Therefore, the verdict on unavailable layers was that the image could be run anticipating that image run failure would occur later due to the layers not being available. However, this verdict to allow the image to run enabled other architectures in the ManifestList to run an image without providing keys if that image had previously been decrypted. A patch has been applied to imgcrypt 1.1.4. Workarounds may include usage of different namespaces for each remote user.
CVSS Score: 7.5 (HIGH)
CWE: CWE-863, CWE-863
References: https://github.com/containerd/imgcrypt/commit/6fdd9818a4d8142107b7ecd767d839c9707700d9; https://github.com/containerd/imgcrypt/issues/69; https://github.com/containerd/imgcrypt/releases/tag/v1.1.4
CVE: CVE-2022-27881
Published: 2022-03-25
Description: engine.c in slaacd in OpenBSD 6.9 and 7.0 before 2022-02-21 has a buffer overflow triggerable by an IPv6 router advertisement with more than seven nameservers. NOTE: privilege separation and pledge can prevent exploitation.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120
References: https://blog.quarkslab.com/heap-overflow-in-openbsds-slaacd-via-router-advertisement.html; https://ftp.openbsd.org/pub/OpenBSD/patches/6.9/common/030_slaacd.patch.sig; https://ftp.openbsd.org/pub/OpenBSD/patches/7.0/common/014_slaacd.patch.sig
CVE: CVE-2022-27882
Published: 2022-03-25
Description: slaacd in OpenBSD 6.9 and 7.0 before 2022-03-22 has an integer signedness error and resultant heap-based buffer overflow triggerable by a crafted IPv6 router advertisement. NOTE: privilege separation and pledge can prevent exploitation.
CVSS Score: 7.5 (HIGH)
CWE: CWE-681
References: https://blog.quarkslab.com/heap-overflow-in-openbsds-slaacd-via-router-advertisement.html; https://ftp.openbsd.org/pub/OpenBSD/patches/6.9/common/033_slaacd.patch.sig; https://ftp.openbsd.org/pub/OpenBSD/patches/7.0/common/017_slaacd.patch.sig
CVE: CVE-2021-20290
Published: 2022-03-25
Description: An improper authorization handling flaw was found in Foreman. The OpenSCAP plugin for the smart-proxy allows foreman clients to execute actions that should be limited to the Foreman Server. This flaw allows an authenticated local attacker to access and delete limited resources and also causes a denial of service on the Foreman server. The highest threat from this vulnerability is to integrity and system availability.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-863, CWE-863
References: https://bugzilla.redhat.com/show_bug.cgi?id=1939701; https://bugzilla.redhat.com/show_bug.cgi?id=1939701
CVE: CVE-2021-20323
Published: 2022-03-25
Description: A POST based reflected Cross Site Scripting vulnerability on has been identified in Keycloak.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://bugzilla.redhat.com/show_bug.cgi?id=2013577; https://bugzilla.redhat.com/show_bug.cgi?id=2013577
CVE: CVE-2021-22100
Published: 2022-03-25
Description: In cloud foundry CAPI versions prior to 1.122, a denial-of-service attack in which a developer can push a service broker that (accidentally or maliciously) causes CC instances to timeout and fail is possible. An attacker can leverage this vulnerability to cause an inability for anyone to push or manage apps.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-400, CWE-400
References: https://www.cloudfoundry.org/blog/cve-2021-22100-cloud-controller-is-vulnerable-to-denial-of-service-due-to-misbehaving-service-brokers/; https://www.cloudfoundry.org/blog/cve-2021-22100-cloud-controller-is-vulnerable-to-denial-of-service-due-to-misbehaving-service-brokers/
CVE: CVE-2021-26620
Published: 2022-03-25
Description: An improper authentication vulnerability leading to information leakage was discovered in iptime NAS2dual. Remote attackers are able to steal important information in the server by exploiting vulnerabilities such as insufficient authentication when accessing the shared folder and changing user’s passwords.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287, CWE-287
References: https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66578; https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66578
CVE: CVE-2021-26621
Published: 2022-03-25
Description: An Buffer Overflow vulnerability leading to remote code execution was discovered in MEX01. Remote attackers can use this vulnerability by using the property that the target program copies parameter values to memory through the strcpy() function.
CVSS Score: 8.1 (HIGH)
CWE: CWE-120, CWE-120
References: https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66579; https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66579
CVE: CVE-2021-26622
Published: 2022-03-25
Description: An remote code execution vulnerability due to SSTI vulnerability and insufficient file name parameter validation was discovered in Genian NAC. Remote attackers are able to execute arbitrary malicious code with SYSTEM privileges on all connected nodes in NAC through this vulnerability.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-20, CWE-94
References: https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66580; https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66580
CVE: CVE-2021-35254
Published: 2022-03-25
Description: SolarWinds received a report of a vulnerability related to an input that was not sanitized in WebHelpDesk. SolarWinds has removed this input field to prevent the misuse of this input in the future.
CVSS Score: 8.2 (HIGH)
CWE: CWE-20
References: https://support.solarwinds.com/SuccessCenter/s/article/Web-Help-Desk-12-7-8-Hotfix-1-Release-Notes?language=en_US; https://www.solarwinds.com/trust-center/security-advisories/CVE-2021-35254; https://support.solarwinds.com/SuccessCenter/s/article/Web-Help-Desk-12-7-8-Hotfix-1-Release-Notes?language=en_US
CVE: CVE-2021-3422
Published: 2022-03-25
Description: The lack of validation of a key-value field in the Splunk-to-Splunk protocol results in a denial-of-service in Splunk Enterprise instances configured to index Universal Forwarder traffic. The vulnerability impacts Splunk Enterprise versions before 7.3.9, 8.0 versions before 8.0.9, and 8.1 versions before 8.1.3. It does not impact Universal Forwarders. When Splunk forwarding is secured using TLS or a Token, the attack requires compromising the certificate or token, or both. Implementation of either or both reduces the severity to Medium.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125, CWE-20
References: https://claroty.com/2022/03/24/blog-research-locking-down-splunk-enterprise-indexers-and-forwarders/; https://www.splunk.com/en_us/product-security/announcements/svd-2022-0301.html; https://claroty.com/2022/03/24/blog-research-locking-down-splunk-enterprise-indexers-and-forwarders/
CVE: CVE-2021-3567
Published: 2022-03-25
Description: A flaw was found in Caribou due to a regression of CVE-2020-25712 fix. An attacker could use this flaw to bypass screen-locking applications that leverage Caribou as an input mechanism. The highest threat from this vulnerability is to system availability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-787
References: https://bugzilla.redhat.com/show_bug.cgi?id=1962836; https://bugzilla.redhat.com/show_bug.cgi?id=1962836
CVE: CVE-2021-3582
Published: 2022-03-25
Description: A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device. The issue occurs while handling a "PVRDMA_CMD_CREATE_MR" command due to improper memory remapping (mremap). This flaw allows a malicious guest to crash the QEMU process on the host. The highest threat from this vulnerability is to system availability.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119, CWE-119
References: https://bugzilla.redhat.com/show_bug.cgi?id=1966266; https://lists.debian.org/debian-lts-announce/2022/09/msg00008.html; https://security.gentoo.org/glsa/202208-27
CVE: CVE-2021-3814
Published: 2022-03-25
Description: It was found that 3scale's APIdocs does not validate the access token, in the case of invalid token, it uses session auth instead. This conceivably bypasses access controls and permits unauthorized information disclosure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-862, CWE-862
References: https://bugzilla.redhat.com/show_bug.cgi?id=2004322; https://bugzilla.redhat.com/show_bug.cgi?id=2004322
CVE: CVE-2021-3933
Published: 2022-03-25
Description: An integer overflow could occur when OpenEXR processes a crafted file on systems where size_t < 64 bits. This could cause an invalid bytesPerLine and maxBytesPerLine value, which could lead to problems with application stability or lead to other attack paths.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-190, CWE-190
References: https://bugzilla.redhat.com/show_bug.cgi?id=2019783; https://lists.debian.org/debian-lts-announce/2022/12/msg00022.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I2JSMJ7HLWFPYYV7IAQZD5ZUUUN7RWBN/
CVE: CVE-2021-3941
Published: 2022-03-25
Description: In ImfChromaticities.cpp routine RGBtoXYZ(), there are some division operations such as `float Z = (1 - chroma.white.x - chroma.white.y) * Y / chroma.white.y;` and `chroma.green.y * (X + Z))) / d;` but the divisor is not checked for a 0 value. A specially crafted file could trigger a divide-by-zero condition which could affect the availability of programs linked with OpenEXR.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-369, CWE-369
References: https://bugzilla.redhat.com/show_bug.cgi?id=2019789; https://lists.debian.org/debian-lts-announce/2022/12/msg00022.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I2JSMJ7HLWFPYYV7IAQZD5ZUUUN7RWBN/
CVE: CVE-2021-44462
Published: 2022-03-25
Description: This vulnerability can be exploited by parsing maliciously crafted project files with Horner Automation Cscape EnvisionRV v4.50.3.1 and prior. The issues result from the lack of proper validation of user-supplied data, which can result in reads and writes past the end of allocated data structures. User interaction is required to exploit this vulnerability as an attacker must trick a valid user to open a malicious HMI project file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20, CWE-20
References: https://www.cisa.gov/uscert/ics/advisories/icsa-21-355-02; https://www.cisa.gov/uscert/ics/advisories/icsa-21-355-02
CVE: CVE-2021-44477
Published: 2022-03-25
Description: GE Gas Power ToolBoxST Version v04.07.05C suffers from an XML external entity (XXE) vulnerability using the DTD parameter entities technique that could result in disclosure and retrieval of arbitrary data on the affected node via an out-of-band (OOB) attack. The vulnerability is triggered when input passed to the XML parser is not sanitized while parsing the XML project/template file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-611, CWE-611
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-025-01; https://www.cisa.gov/uscert/ics/advisories/icsa-22-025-01
CVE: CVE-2021-44768
Published: 2022-03-25
Description: Delta Electronics CNCSoft (Version 1.01.30) and prior) is vulnerable to an out-of-bounds read while processing a specific project file, which may allow an attacker to disclose information.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://www.cisa.gov/uscert/ics/advisories/icsa-21-350-02; https://www.cisa.gov/uscert/ics/advisories/icsa-21-350-02
CVE: CVE-2021-4147
Published: 2022-03-25
Description: A flaw was found in the libvirt libxl driver. A malicious guest could continuously reboot itself and cause libvirtd on the host to deadlock or crash, resulting in a denial of service condition.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-667, CWE-667
References: https://bugzilla.redhat.com/show_bug.cgi?id=2034195; https://lists.debian.org/debian-lts-announce/2024/04/msg00000.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2021-4157
Published: 2022-03-25
Description: An out of memory bounds write flaw (1 or 2 bytes of memory) in the Linux kernel NFS subsystem was found in the way users use mirroring (replication of files with NFS). A user, having access to the NFS mount, could potentially use this flaw to crash the system or escalate privileges on the system.
CVSS Score: 8.0 (HIGH)
CWE: CWE-119, CWE-119
References: https://bugzilla.redhat.com/show_bug.cgi?id=2034342; https://lore.kernel.org/lkml/[PII_REDACTED]0[PII_REDACTED]82%40linuxfoundation.org/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2021-4202
Published: 2022-03-25
Description: A use-after-free flaw was found in nci_request in net/nfc/nci/core.c in NFC Controller Interface (NCI) in the Linux kernel. This flaw could allow a local attacker with user privileges to cause a data race problem while the device is getting removed, leading to a privilege escalation problem.
CVSS Score: 7.0 (HIGH)
CWE: CWE-362, CWE-362, CWE-416
References: http://www.openwall.com/lists/oss-security/2022/06/01/2; http://www.openwall.com/lists/oss-security/2022/06/04/2; http://www.openwall.com/lists/oss-security/2022/06/07/2
CVE: CVE-2021-4203
Published: 2022-03-25
Description: A use-after-free read flaw was found in sock_getsockopt() in net/core/sock.c due to SO_PEERCRED and SO_PEERGROUPS race with listen() (and connect()) in the Linux kernel. In this flaw, an attacker with a user privileges may crash the system or leak internal kernel information.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-362, CWE-362, CWE-416
References: https://bugs.chromium.org/p/project-zero/issues/detail?id=2230&can=7&q=modified-after%3Atoday-30&sort=-modified&colspec=ID%20Type%20Status%20Priority%20Milestone%20Owner%20Summary%20Modified%20Cve&cells=tiles&redir=1; https://bugzilla.redhat.com/show_bug.cgi?id=2036934; https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=35306eb23814
CVE: CVE-2022-0322
Published: 2022-03-25
Description: A flaw was found in the sctp_make_strreset_req function in net/sctp/sm_make_chunk.c in the SCTP network protocol in the Linux kernel with a local user privilege access. In this flaw, an attempt to use more buffer than is allocated triggers a BUG_ON issue, leading to a denial of service (DOS).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-681, CWE-704
References: https://bugzilla.redhat.com/show_bug.cgi?id=2042822; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a2d859e3fc97e79d907761550dbc03ff1b36479c; https://www.oracle.com/security-alerts/cpujul2022.html
CVE: CVE-2022-0330
Published: 2022-03-25
Description: A random memory access flaw was found in the Linux kernel's GPU i915 kernel driver functionality in the way a user may run malicious code on the GPU. This flaw allows a local user to crash the system or escalate their privileges on the system.
CVSS Score: 7.8 (HIGH)
CWE: CWE-281, CWE-281
References: http://www.openwall.com/lists/oss-security/2022/11/30/1; https://bugzilla.redhat.com/show_bug.cgi?id=2042404; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2022-0435
Published: 2022-03-25
Description: A stack overflow flaw was found in the Linux kernel's TIPC protocol functionality in the way a user sends a packet with malicious content where the number of domain member nodes is higher than the 64 allowed. This flaw allows a remote user to crash the system or possibly escalate their privileges if they have access to the TIPC network.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://bugzilla.redhat.com/show_bug.cgi?id=2048738; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.openwall.com/lists/oss-security/2022/02/10/1
CVE: CVE-2022-0494
Published: 2022-03-25
Description: A kernel information leak flaw was identified in the scsi_ioctl function in drivers/scsi/scsi_ioctl.c in the Linux kernel. This flaw allows a local attacker with a special user privilege (CAP_SYS_ADMIN or CAP_SYS_RAWIO) to create issues with confidentiality.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-200, CWE-908
References: https://bugzilla.redhat.com/show_bug.cgi?id=2039448; https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html; https://lore.kernel.org/all/[PII_REDACTED]4038.15635-1-tcs.kernel%40gmail.com/
CVE: CVE-2022-0500
Published: 2022-03-25
Description: A flaw was found in unrestricted eBPF usage by the BPF_BTF_LOAD, leading to a possible out-of-bounds memory write in the Linux kernel’s BPF subsystem due to the way a user loads BTF. This flaw allows a local user to crash or escalate their privileges on the system.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-787
References: https://bugzilla.redhat.com/show_bug.cgi?id=2044578; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=20b2aff4bc15bda809f994761d5719827d66c0b4; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=216e3cd2f28dbbf1fe86848e0e29e6693b9f0a20
CVE: CVE-2022-0759
Published: 2022-03-25
Description: A flaw was found in all versions of kubeclient up to (but not including) v4.9.3, the Ruby client for Kubernetes REST API, in the way it parsed kubeconfig files. When the kubeconfig file does not configure custom CA to verify certs, kubeclient ends up accepting any certificate (it wrongly returns VERIFY_NONE). Ruby applications that leverage kubeclient to parse kubeconfig files are susceptible to Man-in-the-middle attacks (MITM).
CVSS Score: 8.1 (HIGH)
CWE: CWE-295, CWE-295
References: https://github.com/ManageIQ/kubeclient/issues/554; https://github.com/ManageIQ/kubeclient/issues/555; https://github.com/ManageIQ/kubeclient/issues/554
CVE: CVE-2022-0897
Published: 2022-03-25
Description: A flaw was found in the libvirt nwfilter driver. The virNWFilterObjListNumOfNWFilters method failed to acquire the driver->nwfilters mutex before iterating over virNWFilterObj instances. There was no protection to stop another thread from concurrently modifying the driver->nwfilters object. This flaw allows a malicious, unprivileged user to exploit this issue via libvirt's API virConnectNumOfNWFilters to crash the network filter management daemon (libvirtd/virtnwfilterd).
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-667, CWE-667
References: https://bugzilla.redhat.com/show_bug.cgi?id=2063883; https://lists.debian.org/debian-lts-announce/2024/04/msg00000.html; https://security.gentoo.org/glsa/202210-06
CVE: CVE-2022-0983
Published: 2022-03-25
Description: An SQL injection risk was identified in Badges code relating to configuring criteria. Access to the relevant capability was limited to teachers and managers by default.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://bugzilla.redhat.com/show_bug.cgi?id=2064119; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G4GRMWBGHOJMFXMTORECQNULJK7ZJJ6Y/; https://bugzilla.redhat.com/show_bug.cgi?id=2064119
CVE: CVE-2022-0988
Published: 2022-03-25
Description: Delta Electronics DIAEnergie (Version 1.7.5 and prior) is vulnerable to cleartext transmission as the web application runs by default on HTTP. This could allow an attacker to remotely read transmitted information between the client and product.
CVSS Score: 7.1 (HIGH)
CWE: CWE-319, CWE-319
References: https://www.cisa.gov/uscert/ics/advisories/icsa-21-238-03; https://www.cisa.gov/uscert/ics/advisories/icsa-21-238-03
CVE: CVE-2022-0995
Published: 2022-03-25
Description: An out-of-bounds (OOB) memory write flaw was found in the Linux kernel’s watch_queue event notification subsystem. This flaw can overwrite parts of the kernel state, potentially allowing a local user to gain privileged access or cause a denial of service on the system.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: http://packetstormsecurity.com/files/166770/Linux-watch_queue-Filter-Out-Of-Bounds-Write.html; http://packetstormsecurity.com/files/166815/Watch-Queue-Out-Of-Bounds-Write.html; https://bugzilla.redhat.com/show_bug.cgi?id=2063786
CVE: CVE-2022-1049
Published: 2022-03-25
Description: A flaw was found in the Pacemaker configuration tool (pcs). The pcs daemon was allowing expired accounts, and accounts with expired passwords to login when using PAM authentication. Therefore, unprivileged expired accounts that have been denied access could still login.
CVSS Score: 8.8 (HIGH)
CWE: CWE-287, CWE-287
References: https://huntr.dev/bounties/7aa921fc-a568-4fd8-96f4-7cd826246aa5; https://lists.debian.org/debian-lts-announce/2022/09/msg00017.html; https://www.debian.org/security/2022/dsa-5226
CVE: CVE-2022-25590
Published: 2022-03-25
Description: SurveyKing v0.2.0 was discovered to retain users' session cookies after logout, allowing attackers to login to the system and access data using the browser cache when the user exits the application.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-613
References: http://surveyking.com; https://github.com/javahuang/SurveyKing; https://github.com/javahuang/SurveyKing/issues/7