deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-4710
Published: 2023-01-10
Description: The Royal Elementor Addons plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 1.3.59, due to due to insufficient input sanitization and output escaping of the 'wpr_ajax_search_link_target' parameter in the 'data_fetch' function. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This is occurring because 'sanitize_text_field' is insufficient to prevent attribute-based Cross-Site Scripting
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/royal-elementor-addons/trunk/classes/wpr-ajax-search.php?rev=2809656; https://www.wordfence.com/blog/2023/01/eleven-vulnerabilities-patched-in-royal-elementor-addons/; https://www.wordfence.com/threat-intel/vulnerabilities/id/ac6c6ce4-9944-4c8e-89aa-6a2e870ef205?source=cve
CVE: CVE-2022-4711
Published: 2023-01-10
Description: The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_save_mega_menu_settings' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscriber-level permissions, to enable and modify Mega Menu settings for any menu item.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284
References: https://plugins.trac.wordpress.org/browser/royal-elementor-addons/trunk/admin/mega-menu.php?rev=2809656; https://www.wordfence.com/blog/2023/01/eleven-vulnerabilities-patched-in-royal-elementor-addons/; https://www.wordfence.com/threat-intel/vulnerabilities/id/c23e9810-40ea-43e2-9292-f05f300a7ddf?source=cve
CVE: CVE-2023-0162
Published: 2023-01-10
Description: The CPO Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several of its content type settings parameters in versions up to, and including, 1.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2844012%40cpo-companion%2Ftrunk&old=2574013%40cpo-companion%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/9195ac7e-2995-44d0-b5c6-8ffb47395f24?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2844012%40cpo-companion%2Ftrunk&old=2574013%40cpo-companion%2Ftrunk&sfp_email=&sfph_mail=
CVE: CVE-2022-45614
Published: 2023-01-10
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2022-4228. Reason: This candidate is a reservation duplicate of CVE-2022-4228. Notes: All CVE users should reference CVE-2022-4228 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2022-4636
Published: 2023-01-10
Description: Black Box KVM Firmware version 3.4.31307 on models ACR1000A-R-R2, ACR1000A-T-R2, ACR1002A-T, ACR1002A-R, and ACR1020A-T is vulnerable to path traversal, which may allow an attacker to steal user credentials and other sensitive information through local file inclusion.


CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://www.cisa.gov/uscert/ics/advisories/icsa-23-010-01; https://www.cisa.gov/uscert/ics/advisories/icsa-23-010-01
CVE: CVE-2023-0128
Published: 2023-01-10
Description: Use after free in Overview Mode in Google Chrome on Chrome OS prior to 109.0.5414.74 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://chromereleases.googleblog.com/2023/01/stable-channel-update-for-desktop.html; https://crbug.com/1353208; https://security.gentoo.org/glsa/202305-10
CVE: CVE-2023-0129
Published: 2023-01-10
Description: Heap buffer overflow in Network Service in Google Chrome prior to 109.0.5414.74 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page and specific interactions. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://chromereleases.googleblog.com/2023/01/stable-channel-update-for-desktop.html; https://crbug.com/1382033; https://security.gentoo.org/glsa/202305-10
CVE: CVE-2023-0130
Published: 2023-01-10
Description: Inappropriate implementation in in Fullscreen API in Google Chrome on Android prior to 109.0.5414.74 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-451
References: https://chromereleases.googleblog.com/2023/01/stable-channel-update-for-desktop.html; https://crbug.com/1370028; https://security.gentoo.org/glsa/202305-10
CVE: CVE-2023-0131
Published: 2023-01-10
Description: Inappropriate implementation in in iframe Sandbox in Google Chrome prior to 109.0.5414.74 allowed a remote attacker to bypass file download restrictions via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-693
References: https://chromereleases.googleblog.com/2023/01/stable-channel-update-for-desktop.html; https://crbug.com/1357366; https://security.gentoo.org/glsa/202305-10
CVE: CVE-2023-0132
Published: 2023-01-10
Description: Inappropriate implementation in in Permission prompts in Google Chrome on Windows prior to 109.0.5414.74 allowed a remote attacker to force acceptance of a permission prompt via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-346
References: https://chromereleases.googleblog.com/2023/01/stable-channel-update-for-desktop.html; https://crbug.com/1371215; https://security.gentoo.org/glsa/202305-10
CVE: CVE-2023-0133
Published: 2023-01-10
Description: Inappropriate implementation in in Permission prompts in Google Chrome on Android prior to 109.0.5414.74 allowed a remote attacker to bypass main origin permission delegation via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-863
References: https://chromereleases.googleblog.com/2023/01/stable-channel-update-for-desktop.html; https://crbug.com/1375132; https://security.gentoo.org/glsa/202305-10
CVE: CVE-2023-0134
Published: 2023-01-10
Description: Use after free in Cart in Google Chrome prior to 109.0.5414.74 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via database corruption and a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://chromereleases.googleblog.com/2023/01/stable-channel-update-for-desktop.html; https://crbug.com/1385709; https://security.gentoo.org/glsa/202305-10
CVE: CVE-2023-0135
Published: 2023-01-10
Description: Use after free in Cart in Google Chrome prior to 109.0.5414.74 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via database corruption and a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://chromereleases.googleblog.com/2023/01/stable-channel-update-for-desktop.html; https://crbug.com/1385831; https://security.gentoo.org/glsa/202305-10
CVE: CVE-2023-0136
Published: 2023-01-10
Description: Inappropriate implementation in in Fullscreen API in Google Chrome on Android prior to 109.0.5414.74 allowed a remote attacker to execute incorrect security UI via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 8.8 (HIGH)
References: https://chromereleases.googleblog.com/2023/01/stable-channel-update-for-desktop.html; https://crbug.com/1356987; https://security.gentoo.org/glsa/202305-10
CVE: CVE-2023-0137
Published: 2023-01-10
Description: Heap buffer overflow in Platform Apps in Google Chrome on Chrome OS prior to 109.0.5414.74 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://chromereleases.googleblog.com/2023/01/stable-channel-update-for-desktop.html; https://crbug.com/1399904; https://security.gentoo.org/glsa/202305-10
CVE: CVE-2023-0138
Published: 2023-01-10
Description: Heap buffer overflow in libphonenumber in Google Chrome prior to 109.0.5414.74 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Low)
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://chromereleases.googleblog.com/2023/01/stable-channel-update-for-desktop.html; https://crbug.com/1346675; https://security.gentoo.org/glsa/202305-10
CVE: CVE-2023-0139
Published: 2023-01-10
Description: Insufficient validation of untrusted input in Downloads in Google Chrome on Windows prior to 109.0.5414.74 allowed a remote attacker to bypass download restrictions via a crafted HTML page. (Chromium security severity: Low)
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://chromereleases.googleblog.com/2023/01/stable-channel-update-for-desktop.html; https://crbug.com/1367632; https://security.gentoo.org/glsa/202305-10
CVE: CVE-2023-0140
Published: 2023-01-10
Description: Inappropriate implementation in in File System API in Google Chrome on Windows prior to 109.0.5414.74 allowed a remote attacker to bypass file system restrictions via a crafted HTML page. (Chromium security severity: Low)
CVSS Score: 6.5 (MEDIUM)
References: https://chromereleases.googleblog.com/2023/01/stable-channel-update-for-desktop.html; https://crbug.com/1326788; https://security.gentoo.org/glsa/202305-10
CVE: CVE-2023-0141
Published: 2023-01-10
Description: Insufficient policy enforcement in CORS in Google Chrome prior to 109.0.5414.74 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-693
References: https://chromereleases.googleblog.com/2023/01/stable-channel-update-for-desktop.html; https://crbug.com/1362331; https://security.gentoo.org/glsa/202305-10
CVE: CVE-2022-30332
Published: 2023-01-10
Description: In Talend Administration Center 7.3.1.20200219 before TAC-15950, the Forgot Password feature provides different error messages for invalid reset attempts depending on whether the email address is associated with any account. This allows remote attackers to enumerate accounts via a series of requests.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-203, CWE-203
References: https://cds.thalesgroup.com/en/tcs-cert/CVE-2022-30332; https://cwe.mitre.org/data/definitions/204.html; https://excellium-services.com/cert-xlm-advisory/CVE-2022-30332
CVE: CVE-2022-35401
Published: 2023-01-10
Description: An authentication bypass vulnerability exists in the get_IFTTTTtoken.cgi functionality of Asus RT-AX82U 3.0.0.4.386_49674-ge182230. A specially-crafted HTTP request can lead to full administrative access to the device. An attacker would need to send a series of HTTP requests to exploit this vulnerability.
CVSS Score: 8.1 (HIGH)
CWE: CWE-324, CWE-287
References: https://talosintelligence.com/vulnerability_reports/TALOS-2022-1586; https://talosintelligence.com/vulnerability_reports/TALOS-2022-1586; https://www.talosintelligence.com/vulnerability_reports/TALOS-2022-1586
CVE: CVE-2022-36441
Published: 2023-01-10
Description: An issue was discovered in Zebra Enterprise Home Screen 4.1.19. The Gboard used by different applications can be used to launch and use several other applications that are restricted by the admin.
CVSS Score: 7.1 (HIGH)
CWE: CWE-284
References: https://cds.thalesgroup.com/en/tcs-cert/CVE-2022-36441; https://excellium-services.com/cert-xlm-advisory/CVE-2022-36441; https://www.zebra.com/fr/fr/products/software/mobile-computers/mobile-app-utilities/enterprise-home-screen.html
CVE: CVE-2022-36442
Published: 2023-01-10
Description: An issue was discovered in Zebra Enterprise Home Screen 4.1.19. By using the embedded Google Chrome application, it is possible to install an unauthorized application via a downloaded APK.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-284
References: https://cds.thalesgroup.com/en/tcs-cert/CVE-2022-36442; https://excellium-services.com/cert-xlm-advisory/CVE-2022-36442; https://www.zebra.com/us/en/products/software/mobile-computers/mobile-app-utilities/enterprise-home-screen.html
CVE: CVE-2022-36443
Published: 2023-01-10
Description: An issue was discovered in Zebra Enterprise Home Screen 4.1.19. The device allows the administrator to lock some communication channels (wireless and SD card) but it is still possible to use a physical connection (Ethernet cable) without restriction.
CVSS Score: 7.8 (HIGH)
CWE: CWE-284
References: https://cds.thalesgroup.com/en/tcs-cert/CVE-2022-36443; https://excellium-services.com/cert-xlm-advisory/CVE-2022-36443; https://www.zebra.com/us/en/products/software/mobile-computers/mobile-app-utilities/enterprise-home-screen.html
CVE: CVE-2022-38105
Published: 2023-01-10
Description: An information disclosure vulnerability exists in the cm_processREQ_NC opcode of Asus RT-AX82U 3.0.0.4.386_49674-ge182230 router's configuration service. A specially-crafted network packets can lead to a disclosure of sensitive information. An attacker can send a network request to trigger this vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: https://talosintelligence.com/vulnerability_reports/TALOS-2022-1590; https://talosintelligence.com/vulnerability_reports/TALOS-2022-1590; https://www.talosintelligence.com/vulnerability_reports/TALOS-2022-1590
CVE: CVE-2022-38393
Published: 2023-01-10
Description: A denial of service vulnerability exists in the cfg_server cm_processConnDiagPktList opcode of Asus RT-AX82U 3.0.0.4.386_49674-ge182230 router's configuration service. A specially-crafted network packet can lead to denial of service. An attacker can send a malicious packet to trigger this vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://talosintelligence.com/vulnerability_reports/TALOS-2022-1592; https://talosintelligence.com/vulnerability_reports/TALOS-2022-1592; https://www.talosintelligence.com/vulnerability_reports/TALOS-2022-1592
CVE: CVE-2022-38481
Published: 2023-01-10
Description: An issue was discovered in Mega HOPEX 15.2.0.6110 before V5CP2. The application is prone to reflected Cross-site Scripting (XSS) in several features.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://cds.thalesgroup.com/en/tcs-cert/CVE-2022-38481; https://excellium-services.com/cert-xlm-advisory/CVE-2022-38481; https://www.mega.com/en/hopex-platform
CVE: CVE-2022-38482
Published: 2023-01-10
Description: A link-manipulation issue was discovered in Mega HOPEX 15.2.0.6110 before V5CP4.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-59, CWE-59
References: https://cds.thalesgroup.com/en/tcs-cert/CVE-2022-38482; https://excellium-services.com/cert-xlm-advisory/CVE-2022-38482; https://www.mega.com/en/hopex-platform
CVE: CVE-2022-38489
Published: 2023-01-10
Description: An issue was discovered in EasyVista 2020.2.125.3 and 2022.1.109.0.03 It is prone to stored Cross-site Scripting (XSS). Version 2022.1.110.1.02 fixes the vulnerably.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://excellium-services.com/cert-xlm-advisory/CVE-2022-38489; https://excellium-services.com/cert-xlm-advisory/CVE-2022-38489
CVE: CVE-2022-38490
Published: 2023-01-10
Description: An issue was discovered in EasyVista 2020.2.125.3 and 2022.1.109.0.03. Some parameters allow SQL injection. Version 2022.1.110.1.02 corrects this issue.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://excellium-services.com/cert-xlm-advisory/CVE-2022-38490; https://excellium-services.com/cert-xlm-advisory/CVE-2022-38490
CVE: CVE-2022-38491
Published: 2023-01-10
Description: An issue was discovered in EasyVista 2020.2.125.3 and 2022.1.109.0.03. Part of the application does not implement protection against brute-force attacks. Version 2022.1.133.0 corrects this issue.
CVSS Score: 8.2 (HIGH)
CWE: CWE-307, CWE-307
References: https://excellium-services.com/cert-xlm-advisory/CVE-2022-38491; https://excellium-services.com/cert-xlm-advisory/CVE-2022-38491
CVE: CVE-2022-38492
Published: 2023-01-10
Description: An issue was discovered in EasyVista 2020.2.125.3 and 2022.1.109.0.03. One parameter allows SQL injection. Version 2022.1.110.1.02 fixes the vulnerability.
CVSS Score: 7.7 (HIGH)
CWE: CWE-89, CWE-89
References: https://excellium-services.com/cert-xlm-advisory/CVE-2022-38492; https://excellium-services.com/cert-xlm-advisory/CVE-2022-38492
CVE: CVE-2022-45164
Published: 2023-01-10
Description: An issue was discovered in Archibus Web Central 2022.03.01.107. A service exposed by the application allows a basic user to cancel (delete) a booking, created by someone else - even if this basic user is not a member of the booking
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284
References: https://cds.thalesgroup.com/en/tcs-cert/CVE-2022-45164; https://excellium-services.com/cert-xlm-advisory/CVE-2022-45164/; https://excellium-services.com/cert-xlm-advisory/CVE-2022-45164/
CVE: CVE-2022-45165
Published: 2023-01-10
Description: An issue was discovered in Archibus Web Central 2022.03.01.107. A service exposed by the application accepts a user-controlled parameter that is used to create an SQL query. It causes this service to be prone to SQL injection.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://cds.thalesgroup.com/en/tcs-cert/CVE-2022-45165; https://excellium-services.com/cert-xlm-advisory/CVE-2022-45165/; https://excellium-services.com/cert-xlm-advisory/CVE-2022-45165/
CVE: CVE-2022-45166
Published: 2023-01-10
Description: An issue was discovered in Archibus Web Central 2022.03.01.107. A service exposed by the application accepts a set of user-controlled parameters that are used to act on the data returned to the user. It allows a basic user to access data unrelated to their role.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: https://cds.thalesgroup.com/en/tcs-cert/CVE-2022-45166; https://excellium-services.com/cert-xlm-advisory/CVE-2022-45166/; https://excellium-services.com/cert-xlm-advisory/CVE-2022-45166/
CVE: CVE-2022-45167
Published: 2023-01-10
Description: An issue was discovered in Archibus Web Central 2022.03.01.107. A service exposed by the application allows a basic user to access the profile information of all connected users.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://cds.thalesgroup.com/en/tcs-cert/CVE-2022-45167; https://excellium-services.com/cert-xlm-advisory/CVE-2022-45167/; https://excellium-services.com/cert-xlm-advisory/CVE-2022-45167/
CVE: CVE-2022-46163
Published: 2023-01-10
Description: Travel support program is a rails app to support the travel support program of openSUSE (TSP). Sensitive user data (bank account details, password Hash) can be extracted via Ransack query injection. Every deployment of travel-support-program below the patched version is affected. The travel-support-program uses the Ransack library to implement search functionality. In its default configuration, Ransack will allow for query conditions based on properties of associated database objects [1]. The `*_start`, `*_end` or `*_cont` search matchers [2] can then be abused to exfiltrate sensitive string values of associated database objects via character-by-character brute-force (A match is indicated by the returned JSON not being empty). A single bank account number can be extracted with <200 requests, a password hash can be extracted with ~1200 requests, all within a few minutes. The problem has been patched in commit d22916275c51500b4004933ff1b0a69bc807b2b7. In order to work around this issue, you can also cherry pick that patch, however it will not work without the Rails 5.0 migration that was done in #150, which in turn had quite a few pull requests it depended on.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200, CWE-89
References: https://github.com/openSUSE/travel-support-program/commit/d22916275c51500b4004933ff1b0a69bc807b2b7; https://github.com/openSUSE/travel-support-program/pull/158; https://github.com/openSUSE/travel-support-program/security/advisories/GHSA-2wwv-c6xh-cf68
CVE: CVE-2023-22469
Published: 2023-01-10
Description: Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. When getting the reference preview for Deck cards the user has no access to, unauthorized user could eventually get the cached data of a user that has access. There are currently no known workarounds. It is recommended that the Nextcloud app Deck is upgraded to 1.8.2.

CVSS Score: 5.8 (MEDIUM)
CWE: CWE-922
References: https://github.com/nextcloud/deck/pull/4196; https://github.com/nextcloud/security-advisories/security/advisories/GHSA-8fjp-w9gp-j5hq; https://github.com/nextcloud/deck/pull/4196
CVE: CVE-2023-22479
Published: 2023-01-10
Description: KubePi is a modern Kubernetes panel. A session fixation attack allows an attacker to hijack a legitimate user session, versions 1.6.3 and below are susceptible. A patch will be released in version 1.6.4.
CVSS Score: 7.5 (HIGH)
CWE: CWE-384
References: https://github.com/KubeOperator/KubePi/security/advisories/GHSA-v4w5-r2xc-7f8h; https://github.com/KubeOperator/KubePi/security/advisories/GHSA-v4w5-r2xc-7f8h
CVE: CVE-2022-46449
Published: 2023-01-10
Description: An issue in MPD (Music Player Daemon) v0.23.10 allows attackers to cause a Denial of Service (DoS) via a crafted input.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-787
References: https://github.com/MusicPlayerDaemon/MPD/issues/1676; https://github.com/MusicPlayerDaemon/MPD/issues/1676
CVE: CVE-2022-4337
Published: 2023-01-10
Description: An out-of-bounds read in Organization Specific TLV was found in various versions of OpenvSwitch.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125
References: https://github.com/openvswitch/ovs/pull/405; https://mail.openvswitch.org/pipermail/ovs-dev/2022-December/400596.html; https://security.gentoo.org/glsa/202311-16
CVE: CVE-2022-4338
Published: 2023-01-10
Description: An integer underflow in Organization Specific TLV was found in various versions of OpenvSwitch.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125, CWE-191
References: https://github.com/openvswitch/ovs/pull/405; https://mail.openvswitch.org/pipermail/ovs-dev/2022-December/400596.html; https://security.gentoo.org/glsa/202311-16
CVE: CVE-2022-4379
Published: 2023-01-10
Description: A use-after-free vulnerability was found in __nfs42_ssc_open() in fs/nfs/nfs4file.c in the Linux kernel. This flaw allows an attacker to conduct a remote denial
CVSS Score: 7.5 (HIGH)
CWE: CWE-416, CWE-416
References: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=75333d48f92256a0dec91dbf07835e804fc411c0; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=aeba12b26c79fc35e07e511f692a8907037d95da; https://lists.debian.org/debian-lts-announce/2023/05/msg00005.html
CVE: CVE-2022-4382
Published: 2023-01-10
Description: A use-after-free flaw caused by a race among the superblock operations in the gadgetfs Linux driver was found. It could be triggered by yanking out a device that is running the gadgetfs side.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-416
References: https://www.openwall.com/lists/oss-security/2022/12/14/5; https://www.openwall.com/lists/oss-security/2022/12/14/5
CVE: CVE-2023-21524
Published: 2023-01-10
Description: Windows Local Security Authority (LSA) Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-798
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21524; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21524