deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-25746
Published: 2023-01-09
Description: Memory corruption in kernel due to missing checks when updating the access rights of a memextent mapping.
CVSS Score: 8.1 (HIGH)
CWE: CWE-120, CWE-120
References: https://www.qualcomm.com/company/product-security/bulletins/january-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/january-2023-bulletin
CVE: CVE-2022-33218
Published: 2023-01-09
Description: Memory corruption in Automotive due to improper input validation.
CVSS Score: 8.2 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.qualcomm.com/company/product-security/bulletins/january-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/january-2023-bulletin
CVE: CVE-2022-33219
Published: 2023-01-09
Description: Memory corruption in Automotive due to integer overflow to buffer overflow while registering a new listener with shared buffer.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-190, CWE-190
References: https://www.qualcomm.com/company/product-security/bulletins/january-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/january-2023-bulletin
CVE: CVE-2022-33252
Published: 2023-01-09
Description: Information disclosure due to buffer over-read in WLAN while handling IBSS beacons frame.
CVSS Score: 8.2 (HIGH)
CWE: CWE-125, CWE-125
References: https://www.qualcomm.com/company/product-security/bulletins/january-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/january-2023-bulletin
CVE: CVE-2022-33253
Published: 2023-01-09
Description: Transient DOS due to buffer over-read in WLAN while parsing corrupted NAN frames.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125, CWE-125
References: https://www.qualcomm.com/company/product-security/bulletins/january-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/january-2023-bulletin
CVE: CVE-2022-33255
Published: 2023-01-09
Description: Information disclosure due to buffer over-read in Bluetooth HOST while processing GetFolderItems and GetItemAttribute Cmds from peer device.
CVSS Score: 8.2 (HIGH)
CWE: CWE-125, CWE-787
References: https://www.qualcomm.com/company/product-security/bulletins/january-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/january-2023-bulletin
CVE: CVE-2022-33265
Published: 2023-01-09
Description: Memory corruption due to information exposure in Powerline Communication Firmware while sending different MMEs from a single, unassociated device.
CVSS Score: 7.3 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.qualcomm.com/company/product-security/bulletins/january-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/january-2023-bulletin
CVE: CVE-2022-33266
Published: 2023-01-09
Description: Memory corruption in Audio due to integer overflow to buffer overflow while music playback of clips like amr,evrc,qcelp with modified content.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-190, CWE-190
References: https://www.qualcomm.com/company/product-security/bulletins/january-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/january-2023-bulletin
CVE: CVE-2022-33274
Published: 2023-01-09
Description: Memory corruption in android core due to improper validation of array index while returning feature ids after license authentication.
CVSS Score: 8.4 (HIGH)
CWE: CWE-129, CWE-129
References: https://www.qualcomm.com/company/product-security/bulletins/january-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/january-2023-bulletin
CVE: CVE-2022-33276
Published: 2023-01-09
Description: Memory corruption due to buffer copy without checking size of input in modem while receiving WMI_REQUEST_STATS_CMDID command.
CVSS Score: 8.4 (HIGH)
CWE: CWE-120, CWE-120
References: https://www.qualcomm.com/company/product-security/bulletins/january-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/january-2023-bulletin
CVE: CVE-2022-33283
Published: 2023-01-09
Description: Information disclosure due to buffer over-read in WLAN while WLAN frame parsing due to missing frame length check.
CVSS Score: 8.2 (HIGH)
CWE: CWE-125, CWE-787
References: https://www.qualcomm.com/company/product-security/bulletins/january-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/january-2023-bulletin
CVE: CVE-2022-33284
Published: 2023-01-09
Description: Information disclosure due to buffer over-read in WLAN while parsing BTM action frame.
CVSS Score: 8.2 (HIGH)
CWE: CWE-125, CWE-787
References: https://www.qualcomm.com/company/product-security/bulletins/january-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/january-2023-bulletin
CVE: CVE-2022-33285
Published: 2023-01-09
Description: Transient DOS due to buffer over-read in WLAN while parsing WLAN CSA action frames.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125, CWE-787
References: https://www.qualcomm.com/company/product-security/bulletins/january-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/january-2023-bulletin
CVE: CVE-2022-33286
Published: 2023-01-09
Description: Transient DOS due to buffer over-read in WLAN while processing 802.11 management frames.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125, CWE-787
References: https://www.qualcomm.com/company/product-security/bulletins/january-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/january-2023-bulletin
CVE: CVE-2022-33290
Published: 2023-01-09
Description: Transient DOS in Bluetooth HOST due to null pointer dereference when a mismatched argument is passed.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476, CWE-476
References: https://www.qualcomm.com/company/product-security/bulletins/january-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/january-2023-bulletin
CVE: CVE-2022-33299
Published: 2023-01-09
Description: Transient DOS due to null pointer dereference in Bluetooth HOST while receiving an attribute protocol PDU with zero length data.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476, CWE-476
References: https://www.qualcomm.com/company/product-security/bulletins/january-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/january-2023-bulletin
CVE: CVE-2022-33300
Published: 2023-01-09
Description: Memory corruption in Automotive Android OS due to improper input validation.
CVSS Score: 8.4 (HIGH)
CWE: CWE-787, CWE-20
References: https://www.qualcomm.com/company/product-security/bulletins/january-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/january-2023-bulletin
CVE: CVE-2022-35281
Published: 2023-01-09
Description: IBM Maximo Asset Management 7.6.1.1, 7.6.1.2, 7.6.1.3 and the IBM Maximo Manage 8.3, 8.4 application in IBM Maximo Application Suite are vulnerable to CSV injection.  IBM X-Force ID:  2306335.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-1236
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/230635; https://www.ibm.com/support/pages/node/6852669; https://exchange.xforce.ibmcloud.com/vulnerabilities/230635
CVE: CVE-2022-40516
Published: 2023-01-09
Description: Memory corruption in Core due to stack-based buffer overflow.
CVSS Score: 8.4 (HIGH)
CWE: CWE-787, CWE-121
References: https://www.qualcomm.com/company/product-security/bulletins/january-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/january-2023-bulletin
CVE: CVE-2022-40517
Published: 2023-01-09
Description: Memory corruption in core due to stack-based buffer overflow
CVSS Score: 8.4 (HIGH)
CWE: CWE-787, CWE-121
References: https://www.qualcomm.com/company/product-security/bulletins/january-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/january-2023-bulletin
CVE: CVE-2022-40518
Published: 2023-01-09
Description: Information disclosure due to buffer overread in Core
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://www.qualcomm.com/company/product-security/bulletins/january-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/january-2023-bulletin
CVE: CVE-2022-40519
Published: 2023-01-09
Description: Information disclosure due to buffer overread in Core
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://www.qualcomm.com/company/product-security/bulletins/january-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/january-2023-bulletin
CVE: CVE-2022-40520
Published: 2023-01-09
Description: Memory corruption due to stack-based buffer overflow in Core
CVSS Score: 8.4 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.qualcomm.com/company/product-security/bulletins/january-2023-bulletin; https://www.qualcomm.com/company/product-security/bulletins/january-2023-bulletin
CVE: CVE-2022-45883
Published: 2023-01-09
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none.
CVE: CVE-2015-10032
Published: 2023-01-09
Description: A vulnerability was found in HealthMateWeb. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file createaccount.php. The manipulation of the argument username/password/first_name/last_name/company/phone leads to cross site scripting. The attack can be launched remotely. The patch is named 472776c25b1046ecaf962c46fed7c713c72c28e3. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217663.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-79
References: https://github.com/StevenElberger/HealthMateWeb/commit/472776c25b1046ecaf962c46fed7c713c72c28e3; https://vuldb.com/?ctiid.217663; https://vuldb.com/?id.217663
CVE: CVE-2021-4310
Published: 2023-01-09
Description: A vulnerability was found in 01-Scripts 01-Artikelsystem. It has been classified as problematic. Affected is an unknown function of the file 01article.php. The manipulation of the argument $_SERVER['PHP_SELF'] leads to cross site scripting. It is possible to launch the attack remotely. The patch is identified as ae849b347a58c2cb1be38d04bbe56fc883d5d84a. It is recommended to apply a patch to fix this issue. VDB-217662 is the identifier assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-79
References: https://github.com/01-Scripts/01-Artikelsystem/commit/ae849b347a58c2cb1be38d04bbe56fc883d5d84a; https://vuldb.com/?ctiid.217662; https://vuldb.com/?id.217662
CVE: CVE-2022-43974
Published: 2023-01-09
Description: MatrixSSL 4.0.4 through 4.5.1 has an integer overflow in matrixSslDecodeTls13. A remote attacker might be able to send a crafted TLS Message to cause a buffer overflow and achieve remote code execution. This is fixed in 4.6.0.
CVSS Score: 8.1 (HIGH)
CWE: CWE-190, CWE-190
References: https://github.com/matrixssl/matrixssl/blob/4-6-0-open/doc/CHANGES_v4.x.md; https://github.com/matrixssl/matrixssl/security/advisories/GHSA-fmwc-gwc5-2g29; https://www.telekom.com/en/company/data-privacy-and-security/news/advisories-504842
CVE: CVE-2022-4882
Published: 2023-01-09
Description: A vulnerability was found in kaltura mwEmbed up to 2.91. It has been rated as problematic. Affected by this issue is some unknown functionality of the file modules/KalturaSupport/components/share/share.js of the component Share Plugin. The manipulation of the argument res leads to cross site scripting. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 2.92.rc1 is able to address this issue. The name of the patch is 4f11b6f6610acd6d89de5f8be47cf7c610643845. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-217664.
CVSS Score: 2.6 (LOW)
CWE: CWE-79, CWE-79
References: https://github.com/kaltura/mwEmbed/commit/4f11b6f6610acd6d89de5f8be47cf7c610643845; https://github.com/kaltura/mwEmbed/pull/4255; https://github.com/kaltura/mwEmbed/releases/tag/v2.92.rc1
CVE: CVE-2017-20165
Published: 2023-01-09
Description: A vulnerability classified as problematic has been found in debug-js debug up to 3.0.x. This affects the function useColors of the file src/node.js. The manipulation of the argument str leads to inefficient regular expression complexity. Upgrading to version 3.1.0 is able to address this issue. The identifier of the patch is c38a0166c266a679c8de012d4eaccec3f944e685. It is recommended to upgrade the affected component. The identifier VDB-217665 was assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-1333, CWE-1333
References: https://github.com/debug-js/debug/commit/c38a0166c266a679c8de012d4eaccec3f944e685; https://github.com/debug-js/debug/pull/504; https://github.com/debug-js/debug/releases/tag/3.1.0
CVE: CVE-2022-2196
Published: 2023-01-09
Description: A regression exists in the Linux Kernel within KVM: nVMX that allowed for speculative execution attacks. L2 can carry out Spectre v2 attacks on L1 due to L1 thinking it doesn't need retpolines or IBPB after running L2 due to KVM (L0) advertising eIBRS support to L1. An attacker at L2 with code execution can execute code on an indirect branch on the host machine. We recommend upgrading to Kernel 6.2 or past commit 2e7eab81425a
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-1188, CWE-1188
References: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=2e7eab81425ad6c875f2ed47c0ce01e78afc38a5; https://kernel.dance/#2e7eab81425a; https://lists.debian.org/debian-lts-announce/2023/05/msg00005.html
CVE: CVE-2022-46769
Published: 2023-01-09
Description: An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability in Sling App CMS version 1.1.2 and prior may allow an authenticated remote attacker to perform a reflected cross-site scripting (XSS) attack in the site group feature.

Upgrade to Apache Sling App CMS >= 1.1.4 

CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://sling.apache.org/news.html; https://sling.apache.org/news.html
CVE: CVE-2021-4311
Published: 2023-01-09
Description: A vulnerability classified as problematic was found in Talend Open Studio for MDM. This vulnerability affects unknown code of the component XML Handler. The manipulation leads to xml external entity reference. The patch is identified as 31d442b9fb1d518128fd18f6e4d54e06c3d67793. It is recommended to apply a patch to fix this issue. VDB-217666 is the identifier assigned to this vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-611, CWE-611
References: https://github.com/Talend/tmdm-server-se/commit/31d442b9fb1d518128fd18f6e4d54e06c3d67793; https://github.com/Talend/tmdm-server-se/pull/1420; https://vuldb.com/?ctiid.217666
CVE: CVE-2022-23508
Published: 2023-01-09
Description: Weave GitOps is a simple open source developer platform for people who want cloud native applications, without needing Kubernetes expertise.  A vulnerability in GitOps run could allow a local user or process to alter a Kubernetes cluster's resources. GitOps run has a local S3 bucket which it uses for synchronizing files that are later applied against a Kubernetes cluster. Its endpoint had no security controls to block unauthorized access, therefore allowing local users (and processes) on the same machine to see and alter the bucket content. By leveraging this vulnerability, an attacker could pick a workload of their choosing and inject it into the S3 bucket, which resulted in the successful deployment in the target cluster, without the need to provide any credentials to either the S3 bucket nor the target Kubernetes cluster. There are no known workarounds for this issue, please upgrade. This vulnerability has been fixed by commits 75268c4 and 966823b. Users should upgrade to Weave GitOps version >= v0.12.0 released on 08/12/2022.

### Workarounds
There is no workaround for this vulnerability.

### References
Disclosed by Paulo Gomes, Senior Software Engineer, Weaveworks.

### For more information
If you have any questions or comments about this advisory:

- Open an issue in [Weave GitOps repository](https://github.com/weaveworks/weave-gitops)
- Email us at [support@weave.works](mailto:support@weave.works)

CVSS Score: 8.8 (HIGH)
CWE: CWE-284, CWE-538, CWE-552, CWE-552
References: https://github.com/weaveworks/weave-gitops/pull/3102/commits/966823bbda8c539a4661e2a4f8607c9307ba6225; https://github.com/weaveworks/weave-gitops/pull/3114/commits/75268c4d2c8f7e4db22c63d76b451ba6545d117f; https://github.com/weaveworks/weave-gitops/security/advisories/GHSA-wr3c-g326-486c
CVE: CVE-2022-23509
Published: 2023-01-09
Description: Weave GitOps is a simple open source developer platform for people who want cloud native applications, without needing Kubernetes expertise. GitOps run has a local S3 bucket which it uses for synchronizing files that are later applied against a Kubernetes cluster. The communication between GitOps Run and the local S3 bucket is not encrypted. This allows privileged users or process to tap the local traffic to gain information permitting access to the s3 bucket. From that point, it would be possible to alter the bucket content, resulting in changes in the Kubernetes cluster's resources. There are no known workaround(s) for this vulnerability. This vulnerability has been fixed by commits ce2bbff and babd915. Users should upgrade to Weave GitOps version >= v0.12.0 released on 08/12/2022.

CVSS Score: 7.3 (HIGH)
CWE: CWE-200, CWE-319
References: https://github.com/weaveworks/weave-gitops/pull/3098/commits/babd91574b99b310b84aeec9f8f895bd18acb967; https://github.com/weaveworks/weave-gitops/pull/3106/commits/ce2bbff0a3609c33396050ed544a5a21f8d0797f; https://github.com/weaveworks/weave-gitops/security/advisories/GHSA-89qm-wcmw-3mgg
CVE: CVE-2023-22472
Published: 2023-01-09
Description: Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. It is possible to make a user send any POST request with an arbitrary body given they click on a malicious deep link on a Windows computer. (e.g. in an email, chat link, etc). There are currently no known workarounds. It is recommended that the Nextcloud Desktop client is upgraded to 3.6.2.

CVSS Score: 5.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://github.com/nextcloud/desktop/pull/5106; https://github.com/nextcloud/security-advisories/security/advisories/GHSA-4gfv-xqpx-42qj; https://github.com/nextcloud/desktop/pull/5106
CVE: CVE-2023-22473
Published: 2023-01-09
Description: Talk-Android enables users to have video & audio calls through Nextcloud on Android. Due to passcode bypass, an attacker is able to access the user's Nextcloud files and view conversations. To exploit this the attacker needs to have physical access to the target's device. There are currently no known workarounds available. It is recommended that the Nextcloud Talk Android app is upgraded to 15.0.2. 

CVSS Score: 2.1 (LOW)
CWE: CWE-284
References: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-wvr4-gc4c-6vmx; https://github.com/nextcloud/talk-android/pull/2598; https://hackerone.com/reports/1784645
CVE: CVE-2023-22477
Published: 2023-01-09
Description: Mercurius is a GraphQL adapter for Fastify. Any users of Mercurius until version 10.5.0 are subjected to a denial of service attack by sending a malformed packet over WebSocket to `/graphql`. This issue was patched in #940. As a workaround, users can disable subscriptions.


CVSS Score: 5.3 (MEDIUM)
CWE: CWE-248
References: https://github.com/mercurius-js/mercurius/issues/939; https://github.com/mercurius-js/mercurius/pull/940; https://github.com/mercurius-js/mercurius/security/advisories/GHSA-cm8h-q92v-xcfc
CVE: CVE-2022-46258
Published: 2023-01-09
Description: An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed a repository-scoped token with read/write access to modify Action Workflow files without a Workflow scope. The Create or Update file contents API should enforce workflow scope. This vulnerability affected all versions of GitHub Enterprise Server prior to version 3.7 and was fixed in versions 3.3.16, 3.4.11, 3.5.8, and 3.6.4. This vulnerability was reported via the GitHub Bug Bounty program.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-863, CWE-863
References: https://docs.github.com/en/enterprise-server%403.3/admin/release-notes#3.3.16; https://docs.github.com/en/enterprise-server%403.4/admin/release-notes#3.4.11; https://docs.github.com/en/enterprise-server%403.5/admin/release-notes#3.5.8
CVE: CVE-2022-47790
Published: 2023-01-09
Description: Sourcecodester Dynamic Transaction Queuing System v1.0 is vulnerable to SQL Injection via /queuing/index.php?page=display&id=.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/xtxxueyan/bug_report/blob/main/vendors/onetnom23/dynamic-transaction-queuing-system/SQLi-1.md; https://github.com/xtxxueyan/bug_report/blob/main/vendors/onetnom23/dynamic-transaction-queuing-system/SQLi-1.md
CVE: CVE-2022-4884
Published: 2023-01-09
Description: Path-Traversal in MKP storing in Tribe29 Checkmk <=2.0.0p32 and <= 2.1.0p18 allows an administrator to write mkp files to arbitrary locations via a malicious mkp file.
CVSS Score: 3.5 (LOW)
CWE: CWE-22, CWE-22
References: https://checkmk.com/werk/15065; https://checkmk.com/werk/15065
CVE: CVE-2022-36925
Published: 2023-01-09
Description: Zoom Rooms for macOS clients before version 5.11.4 contain an insecure key generation mechanism. The encryption key used for IPC between the Zoom Rooms daemon service and the Zoom Rooms client was generated using parameters that could be obtained by a local low-privileged application. That key can then be used to interact with the daemon service to execute privileged functions and cause a local denial of service.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-321, CWE-798
References: https://explore.zoom.us/en/trust/security/security-bulletin/; https://explore.zoom.us/en/trust/security/security-bulletin/
CVE: CVE-2022-36926
Published: 2023-01-09
Description: Zoom Rooms for macOS clients before version 5.11.3 contain a local privilege escalation vulnerability. A local low-privileged user could exploit this vulnerability to escalate their privileges to root.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://explore.zoom.us/en/trust/security/security-bulletin/; https://explore.zoom.us/en/trust/security/security-bulletin/
CVE: CVE-2022-36927
Published: 2023-01-09
Description: Zoom Rooms for macOS clients before version 5.11.3 contain a local privilege escalation vulnerability. A local low-privileged user could exploit this vulnerability to escalate their privileges to root.
CVSS Score: 8.8 (HIGH)
CWE: CWE-367
References: https://explore.zoom.us/en/trust/security/security-bulletin/; https://explore.zoom.us/en/trust/security/security-bulletin/
CVE: CVE-2022-36928
Published: 2023-01-09
Description: Zoom for Android clients before version 5.13.0 contain a path traversal vulnerability. A third party app could exploit this vulnerability to read and write to the Zoom application data directory.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-35, CWE-22
References: https://explore.zoom.us/en/trust/security/security-bulletin/; https://explore.zoom.us/en/trust/security/security-bulletin/
CVE: CVE-2022-36929
Published: 2023-01-09
Description: The Zoom Rooms Installer for Windows prior to 5.12.6 contains a local privilege escalation vulnerability. A local low-privileged user could exploit this vulnerability during the install process to escalate their privileges to the SYSTEM user.
CVSS Score: 7.8 (HIGH)
CWE: CWE-367
References: https://explore.zoom.us/en/trust/security/security-bulletin/; https://explore.zoom.us/en/trust/security/security-bulletin/
CVE: CVE-2022-36930
Published: 2023-01-09
Description: Zoom Rooms for Windows installers before version 5.13.0 contain a local privilege escalation vulnerability. A local low-privileged user could exploit this vulnerability in an attack chain to escalate their privileges to the SYSTEM user.
CVSS Score: 8.8 (HIGH)
CWE: CWE-427
References: https://explore.zoom.us/en/trust/security/security-bulletin/; https://explore.zoom.us/en/trust/security/security-bulletin/