deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-44571
Published: 2022-02-21
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-3200 Reason: This candidate is a duplicate of CVE-2021-3200. Notes: All CVE users should reference CVE-2021-3200 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2021-44573
Published: 2022-02-21
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-3200 Reason: This candidate is a duplicate of CVE-2021-3200. Notes: All CVE users should reference CVE-2021-3200 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2021-44574
Published: 2022-02-21
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-3200 Reason: This candidate is a duplicate of CVE-2021-3200. Notes: All CVE users should reference CVE-2021-3200 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2021-44575
Published: 2022-02-21
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-3200 Reason: This candidate is a duplicate of CVE-2021-3200. Notes: All CVE users should reference CVE-2021-3200 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2021-44576
Published: 2022-02-21
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-3200 Reason: This candidate is a duplicate of CVE-2021-3200. Notes: All CVE users should reference CVE-2021-3200 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2021-44577
Published: 2022-02-21
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-3200 Reason: This candidate is a duplicate of CVE-2021-3200. Notes: All CVE users should reference CVE-2021-3200 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2022-0696
Published: 2022-02-21
Description: NULL Pointer Dereference in GitHub repository vim/vim prior to 8.2.4428.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: http://seclists.org/fulldisclosure/2022/Oct/28; http://seclists.org/fulldisclosure/2022/Oct/41; https://github.com/vim/vim/commit/0f6e28f686dbb59ab3b562408ab9b2234797b9b1
CVE: CVE-2021-4115
Published: 2022-02-21
Description: There is a flaw in polkit which can allow an unprivileged user to cause polkit to crash, due to process file descriptor exhaustion. The highest threat from this vulnerability is to availability. NOTE: Polkit process outage duration is tied to the failing process being reaped and a new one being spawned
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-400
References: http://packetstormsecurity.com/files/172849/polkit-File-Descriptor-Exhaustion.html; https://access.redhat.com/security/cve/cve-2021-4115; https://gitlab.com/redhat/centos-stream/rpms/polkit/-/merge_requests/6/diffs?commit_id=bf900df04dc390d389e59aa10942b0f2b15c531e
CVE: CVE-2022-24564
Published: 2022-02-21
Description: Checkmk <=2.0.0p19 contains a Cross Site Scripting (XSS) vulnerability. While creating or editing a user attribute, the Help Text is subject to HTML injection, which can be triggered for editing a user.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://checkmk.com/werk/13199; https://checkmk.com/werk/13199
CVE: CVE-2022-0676
Published: 2022-02-22
Description: Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.6.4.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://github.com/radareorg/radare2/commit/c84b7232626badd075caf3ae29661b609164bac6; https://huntr.dev/bounties/5ad814a1-5dd3-43f4-869b-33b8dab78485; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BZTIMAS53YT66FUS4QHQAFRJOBMUFG6D/
CVE: CVE-2022-0665
Published: 2022-02-22
Description: Path Traversal in GitHub repository pimcore/pimcore prior to 10.3.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://github.com/pimcore/pimcore/commit/28945649a6234ccaa8c94c6cd83d1954603baf3e; https://huntr.dev/bounties/423df64d-c591-4ad9-bf1c-411bcbc06ba3; https://github.com/pimcore/pimcore/commit/28945649a6234ccaa8c94c6cd83d1954603baf3e
CVE: CVE-2021-46162
Published: 2022-02-22
Description: A vulnerability has been identified in Simcenter Femap (All versions < V2022.1.1). Affected application contains an out of bounds write past the end of an allocated structure while parsing specially crafted NEU files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-15048)
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://cert-portal.siemens.com/productcert/pdf/ssa-949188.pdf; https://www.zerodayinitiative.com/advisories/ZDI-22-511/; https://cert-portal.siemens.com/productcert/pdf/ssa-949188.pdf
CVE: CVE-2021-46699
Published: 2022-02-22
Description: A vulnerability has been identified in Simcenter Femap (All versions < V2022.1.1). Affected application contains a stack based buffer overflow vulnerability while parsing specially crafted BDF files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-15061)
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://cert-portal.siemens.com/productcert/pdf/ssa-949188.pdf; https://www.zerodayinitiative.com/advisories/ZDI-22-509/; https://cert-portal.siemens.com/productcert/pdf/ssa-949188.pdf
CVE: CVE-2022-0712
Published: 2022-02-22
Description: NULL Pointer Dereference in GitHub repository radareorg/radare2 prior to 5.6.4.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://github.com/radareorg/radare2/commit/515e592b9bea0612bc63d8e93239ff35bcf645c7; https://huntr.dev/bounties/1e572820-e502-49d1-af0e-81833e2eb466; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BZTIMAS53YT66FUS4QHQAFRJOBMUFG6D/
CVE: CVE-2022-0713
Published: 2022-02-22
Description: Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.6.4.
CVSS Score: 7.1 (HIGH)
CWE: CWE-122, CWE-787
References: https://github.com/radareorg/radare2/commit/a35f89f86ed12161af09330e92e5a213014e46a1; https://huntr.dev/bounties/d35b3dff-768d-4a09-a742-c18ca8f56d3c; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BZTIMAS53YT66FUS4QHQAFRJOBMUFG6D/
CVE: CVE-2022-0714
Published: 2022-02-22
Description: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.4436.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-122, CWE-787
References: http://seclists.org/fulldisclosure/2022/Oct/28; http://seclists.org/fulldisclosure/2022/Oct/41; https://github.com/vim/vim/commit/4e889f98e95ac05d7c8bd3ee933ab4d47820fdfa
CVE: CVE-2022-23608
Published: 2022-02-22
Description: PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In versions up to and including 2.11.1 when in a dialog set (or forking) scenario, a hash key shared by multiple UAC dialogs can potentially be prematurely freed when one of the dialogs is destroyed . The issue may cause a dialog set to be registered in the hash table multiple times (with different hash keys) leading to undefined behavior such as dialog list collision which eventually leading to endless loop. A patch is available in commit db3235953baa56d2fb0e276ca510fefca751643f which will be included in the next release. There are no known workarounds for this issue.
CVSS Score: 8.1 (HIGH)
CWE: CWE-416, CWE-416
References: http://packetstormsecurity.com/files/166226/Asterisk-Project-Security-Advisory-AST-2022-005.html; http://seclists.org/fulldisclosure/2022/Mar/1; https://github.com/pjsip/pjproject/commit/db3235953baa56d2fb0e276ca510fefca751643f
CVE: CVE-2022-23652
Published: 2022-02-22
Description: capsule-proxy is a reverse proxy for Capsule Operator which provides multi-tenancy in Kubernetes. In versions prior to 0.2.1 an attacker with a proper authentication mechanism may use a malicious `Connection` header to start a privilege escalation attack towards the Kubernetes API Server. This vulnerability allows for an exploit of the `cluster-admin` Role bound to `capsule-proxy`. There are no known workarounds for this issue.
CVSS Score: 8.8 (HIGH)
CWE: CWE-287
References: https://github.com/clastix/capsule-proxy/commit/efe91f68ebf8a9e3d21491dc57da7b8a746415d8; https://github.com/clastix/capsule-proxy/issues/188; https://github.com/clastix/capsule-proxy/security/advisories/GHSA-9cwv-cppx-mqjm
CVE: CVE-2022-23654
Published: 2022-02-22
Description: Wiki.js is a wiki app built on Node.js. In affected versions an authenticated user with write access on a restricted set of paths can update a page outside the allowed paths by specifying a different target page ID while keeping the path intact. The access control incorrectly check the path access against the user-provided values instead of the actual path associated to the page ID. Commit https://github.com/Requarks/wiki/commit/411802ec2f654bb5ed1126c307575b81e2361c6b fixes this vulnerability by checking access control on the path associated with the page ID instead of the user-provided value. When the path is different than the current value, a second access control check is then performed on the user-provided path before the move operation.
CVSS Score: 8.1 (HIGH)
CWE: CWE-287
References: https://github.com/Requarks/wiki/commit/411802ec2f654bb5ed1126c307575b81e2361c6b; https://github.com/Requarks/wiki/security/advisories/GHSA-3cv9-795v-6j7j; https://github.com/Requarks/wiki/commit/411802ec2f654bb5ed1126c307575b81e2361c6b
CVE: CVE-2022-23635
Published: 2022-02-22
Description: Istio is an open platform to connect, manage, and secure microservices. In affected versions the Istio control plane, `istiod`, is vulnerable to a request processing error, allowing a malicious attacker that sends a specially crafted message which results in the control plane crashing. This endpoint is served over TLS port 15012, but does not require any authentication from the attacker. For simple installations, Istiod is typically only reachable from within the cluster, limiting the blast radius. However, for some deployments, especially [multicluster](https://istio.io/latest/docs/setup/install/multicluster/primary-remote/) topologies, this port is exposed over the public internet. There are no effective workarounds, beyond upgrading. Limiting network access to Istiod to the minimal set of clients can help lessen the scope of the vulnerability to some extent.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287, CWE-1284
References: https://github.com/istio/istio/commit/5f3b5ed958ae75156f8656fe7b3794f78e94db84; https://github.com/istio/istio/security/advisories/GHSA-856q-xv3c-7f2f; https://istio.io/latest/news/security/istio-security-2022-003
CVE: CVE-2021-43824
Published: 2022-02-22
Description: Envoy is an open source edge and service proxy, designed for cloud-native applications. In affected versions a crafted request crashes Envoy when a CONNECT request is sent to JWT filter configured with regex match. This provides a denial of service attack vector. The only workaround is to not use regex in the JWT filter. Users are advised to upgrade.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://github.com/envoyproxy/envoy/commit/[PII_REDACTED]b1a6e1be2eccf4868771e11af6253a; https://github.com/envoyproxy/envoy/security/advisories/GHSA-vj5m-rch8-5r2p; https://github.com/envoyproxy/envoy/commit/[PII_REDACTED]b1a6e1be2eccf4868771e11af6253a
CVE: CVE-2021-43825
Published: 2022-02-22
Description: Envoy is an open source edge and service proxy, designed for cloud-native applications. Sending a locally generated response must stop further processing of request or response data. Envoy tracks the amount of buffered request and response data and aborts the request if the amount of buffered data is over the limit by sending 413 or 500 responses. However when the buffer overflows while response is processed by the filter chain the operation may not be aborted correctly and result in accessing a freed memory block. If this happens Envoy will crash resulting in a denial of service.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-416
References: https://github.com/envoyproxy/envoy/commit/148de954ed3585d8b4298b424aa24916d0de6136; https://github.com/envoyproxy/envoy/security/advisories/GHSA-h69p-g6xg-mhhh; https://github.com/envoyproxy/envoy/commit/148de954ed3585d8b4298b424aa24916d0de6136
CVE: CVE-2021-43826
Published: 2022-02-22
Description: Envoy is an open source edge and service proxy, designed for cloud-native applications. In affected versions of Envoy a crash occurs when configured for :ref:`upstream tunneling <envoy_v3_api_field_extensions.filters.network.tcp_proxy.v3.TcpProxy.tunneling_config>` and the downstream connection disconnects while the the upstream connection or http/2 stream is still being established. There are no workarounds for this issue. Users are advised to upgrade.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416
References: https://github.com/envoyproxy/envoy/commit/ce0ae309057a216aba031aff81c445c90c6ef145; https://github.com/envoyproxy/envoy/security/advisories/GHSA-cmx3-fvgf-83mf; https://github.com/envoyproxy/envoy/commit/ce0ae309057a216aba031aff81c445c90c6ef145
CVE: CVE-2022-21654
Published: 2022-02-22
Description: Envoy is an open source edge and service proxy, designed for cloud-native applications. Envoy's tls allows re-use when some cert validation settings have changed from their default configuration. The only workaround for this issue is to ensure that default tls settings are used. Users are advised to upgrade.
CVSS Score: 7.4 (HIGH)
CWE: CWE-295
References: https://github.com/envoyproxy/envoy/commit/e9f936d85dc1edc34fabd0a1725ec180f2316353; https://github.com/envoyproxy/envoy/security/advisories/GHSA-5j4x-g36v-m283; https://github.com/envoyproxy/envoy/commit/e9f936d85dc1edc34fabd0a1725ec180f2316353
CVE: CVE-2022-21655
Published: 2022-02-22
Description: Envoy is an open source edge and service proxy, designed for cloud-native applications. The envoy common router will segfault if an internal redirect selects a route configured with direct response or redirect actions. This will result in a denial of service. As a workaround turn off internal redirects if direct response entries are configured on the same listener.
CVSS Score: 7.5 (HIGH)
CWE: CWE-670
References: https://github.com/envoyproxy/envoy/commit/177d608155ba8b11598b9bbf8240e90d8c350682; https://github.com/envoyproxy/envoy/security/advisories/GHSA-7r5p-7fmh-jxpg; https://github.com/envoyproxy/envoy/commit/177d608155ba8b11598b9bbf8240e90d8c350682
CVE: CVE-2022-21656
Published: 2022-02-22
Description: Envoy is an open source edge and service proxy, designed for cloud-native applications. The default_validator.cc implementation used to implement the default certificate validation routines has a "type confusion" bug when processing subjectAltNames. This processing allows, for example, an rfc822Name or uniformResourceIndicator to be authenticated as a domain name. This confusion allows for the bypassing of nameConstraints, as processed by the underlying OpenSSL/BoringSSL implementation, exposing the possibility of impersonation of arbitrary servers. As a result Envoy will trust upstream certificates that should not be trusted.
CVSS Score: 7.4 (HIGH)
CWE: CWE-295, CWE-843
References: https://github.com/envoyproxy/envoy/commit/bb95af848c939cfe5b5ee33c5b[PII_REDACTED]e64e; https://github.com/envoyproxy/envoy/security/advisories/GHSA-c9g7-xwcv-pjx2; https://github.com/envoyproxy/envoy/commit/bb95af848c939cfe5b5ee33c5b[PII_REDACTED]e64e
CVE: CVE-2022-21657
Published: 2022-02-22
Description: Envoy is an open source edge and service proxy, designed for cloud-native applications. In affected versions Envoy does not restrict the set of certificates it accepts from the peer, either as a TLS client or a TLS server, to only those certificates that contain the necessary extendedKeyUsage (id-kp-serverAuth and id-kp-clientAuth, respectively). This means that a peer may present an e-mail certificate (e.g. id-kp-emailProtection), either as a leaf certificate or as a CA in the chain, and it will be accepted for TLS. This is particularly bad when combined with the issue described in pull request #630, in that it allows a Web PKI CA that is intended only for use with S/MIME, and thus exempted from audit or supervision, to issue TLS certificates that will be accepted by Envoy. As a result Envoy will trust upstream certificates that should not be trusted. There are no known workarounds to this issue. Users are advised to upgrade.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-295
References: https://github.com/envoyproxy/envoy/pull/630; https://github.com/envoyproxy/envoy/security/advisories/GHSA-837m-wjrv-vm5g; https://github.com/envoyproxy/envoy/pull/630
CVE: CVE-2022-23606
Published: 2022-02-22
Description: Envoy is an open source edge and service proxy, designed for cloud-native applications. When a cluster is deleted via Cluster Discovery Service (CDS) all idle connections established to endpoints in that cluster are disconnected. A recursion was introduced in the procedure of disconnecting idle connections that can lead to stack exhaustion and abnormal process termination when a cluster has a large number of idle connections. This infinite recursion causes Envoy to crash. Users are advised to upgrade.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-674
References: https://github.com/envoyproxy/envoy/commit/4b6dd3b53cd5c6d4d4df378a2fc62c1707522b31; https://github.com/envoyproxy/envoy/security/advisories/GHSA-9vp2-4cp7-vvxf; https://github.com/envoyproxy/envoy/commit/4b6dd3b53cd5c6d4d4df378a2fc62c1707522b31
CVE: CVE-2022-23612
Published: 2022-02-22
Description: OpenMRS is a patient-based medical record system focusing on giving providers a free customizable electronic medical record system. Affected versions are subject to arbitrary file exfiltration due to failure to sanitize request when satisfying GET requests for `/images` & `/initfilter/scripts`. This can allow an attacker to access any file on a system running OpenMRS that is accessible to the user id OpenMRS is running under. Affected implementations should update to the latest patch version of OpenMRS Core for the minor version they use. These are: 2.1.5, 2.2.1, 2.3.5, 2.4.5 and 2.5.3. As a general rule, this vulnerability is already mitigated by Tomcat's URL normalization in Tomcat 7.0.28+. Users on older versions of Tomcat should consider upgrading their Tomcat instance as well as their OpenMRS instance.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://github.com/openmrs/openmrs-core/blob/ee3373a7a775bfdfa263e2e912c72e64342fb4f0/web/src/main/java/org/openmrs/web/filter/StartupFilter.java#L123; https://github.com/openmrs/openmrs-core/commit/db8454bf19a092a78d53ee4dba2af628b730a6e7#diff-7c64d9f61d4d4e2ddba92920d7cf63ec96091b308d43904956b3846bc0c26d80R128; https://github.com/openmrs/openmrs-core/security/advisories/GHSA-8rgr-ww69-jv65
CVE: CVE-2022-0654
Published: 2022-02-23
Description: Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository fgribreau/node-request-retry prior to 7.0.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://github.com/fgribreau/node-request-retry/commit/0979c6001d9d57c2aac3157c11b[PII_REDACTED]22a; https://huntr.dev/bounties/a779faf5-c2cc-48be-a31d-4ddfac357afc; https://github.com/fgribreau/node-request-retry/commit/0979c6001d9d57c2aac3157c11b[PII_REDACTED]22a
CVE: CVE-2022-0717
Published: 2022-02-23
Description: Out-of-bounds Read in GitHub repository mruby/mruby prior to 3.2.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-125, CWE-125
References: https://github.com/mruby/mruby/commit/f72315575f78a9a773adbce0ee7d3ec33434cb76; https://huntr.dev/bounties/27a851a5-7ebf-409b-854f-b2614771e8f9; https://github.com/mruby/mruby/commit/f72315575f78a9a773adbce0ee7d3ec33434cb76
CVE: CVE-2022-0736
Published: 2022-02-23
Description: Insecure Temporary File in GitHub repository mlflow/mlflow prior to 1.23.1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-377
References: https://github.com/mlflow/mlflow/commit/61984e6843d2e59235d82a580c529920cd8f3711; https://huntr.dev/bounties/e5384764-c583-4dec-a1d8-4697f4e12f75; https://github.com/mlflow/mlflow/commit/61984e6843d2e59235d82a580c529920cd8f3711
CVE: CVE-2022-0719
Published: 2022-02-23
Description: Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 1.3.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/microweber/microweber/commit/a5925f74d39775771d4c37c8d4c1acbb762fda0a; https://huntr.dev/bounties/bcdce15b-7f40-4971-a061-c25c6053c312; https://github.com/microweber/microweber/commit/a5925f74d39775771d4c37c8d4c1acbb762fda0a
CVE: CVE-2022-0721
Published: 2022-02-23
Description: Insertion of Sensitive Information Into Debugging Code in GitHub repository microweber/microweber prior to 1.3.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-215
References: https://github.com/microweber/microweber/commit/b12e1a490c79460bff019f34b2e17112249b16ec; https://huntr.dev/bounties/ae267d39-9750-4c69-be8b-4f915da089fb; https://github.com/microweber/microweber/commit/b12e1a490c79460bff019f34b2e17112249b16ec
CVE: CVE-2022-0724
Published: 2022-02-23
Description: Insecure Storage of Sensitive Information in GitHub repository microweber/microweber prior to 1.3.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-922, CWE-922
References: https://github.com/microweber/microweber/commit/b592c86d2b927c0cae5b73b87fb541f25e777aa3; https://huntr.dev/bounties/0cdc4a29-dada-4264-b326-8b65b4f11062; https://github.com/microweber/microweber/commit/b592c86d2b927c0cae5b73b87fb541f25e777aa3
CVE: CVE-2022-0726
Published: 2022-02-23
Description: Missing Authorization in GitHub repository chocobozzz/peertube prior to 4.1.0.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://github.com/chocobozzz/peertube/commit/6ea9295b8f5dd7cc254202a79aad61c666cc4259; https://huntr.dev/bounties/8928ab08-7fcb-475e-8da7-18e8412c1ac3; https://github.com/chocobozzz/peertube/commit/6ea9295b8f5dd7cc254202a79aad61c666cc4259
CVE: CVE-2022-0727
Published: 2022-02-23
Description: Improper Access Control in GitHub repository chocobozzz/peertube prior to 4.1.0.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-284, CWE-863
References: https://github.com/chocobozzz/peertube/commit/6ea9295b8f5dd7cc254202a79aad61c666cc4259; https://huntr.dev/bounties/d1faa10f-0640-480c-bb52-089adb351e6e; https://github.com/chocobozzz/peertube/commit/6ea9295b8f5dd7cc254202a79aad61c666cc4259
CVE: CVE-2022-0729
Published: 2022-02-23
Description: Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4440.
CVSS Score: 8.8 (HIGH)
CWE: CWE-823, CWE-119
References: http://seclists.org/fulldisclosure/2022/Oct/28; http://seclists.org/fulldisclosure/2022/Oct/41; https://github.com/vim/vim/commit/6456fae9ba8e72c74b2c0c499eaf09974604ff30
CVE: CVE-2022-0476
Published: 2022-02-23
Description: Denial of Service in GitHub repository radareorg/radare2 prior to 5.6.4.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-400, CWE-400
References: https://github.com/radareorg/radare2/commit/27fe8031782d3a06c3998eaa[PII_REDACTED]4f9f1b; https://huntr.dev/bounties/81ddfbda-6c9f-4b69-83ff-85b15141e35d; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BZTIMAS53YT66FUS4QHQAFRJOBMUFG6D/