deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-36140
Published: 2022-08-16
Description: SWFMill commit 53d7690 was discovered to contain a segmentation violation via SWF::DeclareFunction2::write(SWF::Writer*, SWF::Context*).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-754
References: https://github.com/djcsdy/swfmill/issues/57; https://github.com/djcsdy/swfmill/issues/57
CVE: CVE-2022-36141
Published: 2022-08-16
Description: SWFMill commit 53d7690 was discovered to contain a segmentation violation via SWF::MethodBody::write(SWF::Writer*, SWF::Context*).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-754
References: https://github.com/djcsdy/swfmill/issues/58; https://github.com/djcsdy/swfmill/issues/58
CVE: CVE-2022-36142
Published: 2022-08-16
Description: SWFMill commit 53d7690 was discovered to contain a heap-buffer overflow via SWF::Reader::getU30().
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/djcsdy/swfmill/issues/61; https://github.com/djcsdy/swfmill/issues/61
CVE: CVE-2022-36143
Published: 2022-08-16
Description: SWFMill commit 53d7690 was discovered to contain a heap-buffer overflow via __interceptor_strlen.part at /sanitizer_common/sanitizer_common_interceptors.inc.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/djcsdy/swfmill/issues/62; https://github.com/djcsdy/swfmill/issues/62
CVE: CVE-2022-36144
Published: 2022-08-16
Description: SWFMill commit 53d7690 was discovered to contain a heap-buffer overflow via base64_encode.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/djcsdy/swfmill/issues/63; https://github.com/djcsdy/swfmill/issues/63
CVE: CVE-2022-36145
Published: 2022-08-16
Description: SWFMill commit 53d7690 was discovered to contain a segmentation violation via SWF::Reader::getWord().
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-754
References: https://github.com/djcsdy/swfmill/issues/64; https://github.com/djcsdy/swfmill/issues/64
CVE: CVE-2022-36146
Published: 2022-08-16
Description: SWFMill commit 53d7690 was discovered to contain a memory allocation issue via operator new[](unsigned long) at asan_new_delete.cpp.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-770
References: https://github.com/djcsdy/swfmill/issues/65; https://github.com/djcsdy/swfmill/issues/65
CVE: CVE-2022-36148
Published: 2022-08-16
Description: fdkaac commit 53fe239 was discovered to contain a floating point exception (FPE) via wav_open at /src/wav_reader.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-697
References: https://github.com/nu774/fdkaac/issues/52; https://github.com/nu774/fdkaac/issues/52
CVE: CVE-2022-36149
Published: 2022-08-16
Description: tifig v0.2.2 was discovered to contain a heap-use-after-free via temInfoEntry().
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416
References: https://github.com/monostream/tifig/issues/70; https://github.com/monostream/tifig/issues/70
CVE: CVE-2022-36150
Published: 2022-08-16
Description: tifig v0.2.2 was discovered to contain a heap-buffer overflow via __asan_memmove at /asan/asan_interceptors_memintrinsics.cpp.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://github.com/monostream/tifig/issues/68; https://github.com/monostream/tifig/issues/68
CVE: CVE-2022-36151
Published: 2022-08-16
Description: tifig v0.2.2 was discovered to contain a segmentation violation via getType() at /common/bbox.cpp.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/monostream/tifig/issues/69; https://github.com/monostream/tifig/issues/69
CVE: CVE-2022-36152
Published: 2022-08-16
Description: tifig v0.2.2 was discovered to contain a memory leak via operator new[](unsigned long) at /asan/asan_new_delete.cpp.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://github.com/monostream/tifig/issues/72; https://github.com/monostream/tifig/issues/72
CVE: CVE-2022-36153
Published: 2022-08-16
Description: tifig v0.2.2 was discovered to contain a segmentation violation via std::vector<unsigned int, std::allocator<unsigned int> >::size() const at /bits/stl_vector.h.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/monostream/tifig/issues/71; https://github.com/monostream/tifig/issues/71
CVE: CVE-2022-36155
Published: 2022-08-16
Description: tifig v0.2.2 was discovered to contain a resource allocation issue via operator new(unsigned long) at asan_new_delete.cpp.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-770
References: https://github.com/monostream/tifig/issues/73; https://github.com/monostream/tifig/issues/73
CVE: CVE-2022-37437
Published: 2022-08-16
Description: When using Ingest Actions to configure a destination that resides on Amazon Simple Storage Service (S3) in Splunk Web, TLS certificate validation is not correctly performed and tested for the destination. The vulnerability only affects connections between Splunk Enterprise and an Ingest Actions Destination through Splunk Web and only applies to environments that have configured TLS certificate validation. It does not apply to Destinations configured directly in the outputs.conf configuration file. The vulnerability affects Splunk Enterprise version 9.0.0 and does not affect versions below 9.0.0, including the 8.1.x and 8.2.x versions.
CVSS Score: 7.4 (HIGH)
CWE: CWE-295, CWE-295
References: https://www.splunk.com/en_us/product-security/announcements/svd-2022-0801.html; https://www.splunk.com/en_us/product-security/announcements/svd-2022-0801.html
CVE: CVE-2022-37438
Published: 2022-08-16
Description: In Splunk Enterprise versions in the following table, an authenticated user can craft a dashboard that could potentially leak information (for example, username, email, and real name) about Splunk users, when visited by another user through the drilldown component. The vulnerability requires user access to create and share dashboards using Splunk Web.
CVSS Score: 2.6 (LOW)
CWE: CWE-200
References: https://research.splunk.com/application/f844c3f6-fd99-43a2-ba24-93e35fe84be6; https://www.splunk.com/en_us/product-security/announcements/svd-2022-0802.html; https://research.splunk.com/application/f844c3f6-fd99-43a2-ba24-93e35fe84be6
CVE: CVE-2022-37439
Published: 2022-08-16
Description: In Splunk Enterprise and Universal Forwarder versions in the following table, indexing a specially crafted ZIP file using the file monitoring input can result in a crash of the application. Attempts to restart the application would result in a crash and would require manually removing the malformed file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-409
References: https://research.splunk.com/application/b237d393-2f57-4531-aad7-ad3c17c8b041; https://www.splunk.com/en_us/product-security/announcements/svd-2022-0803.html; https://research.splunk.com/application/b237d393-2f57-4531-aad7-ad3c17c8b041
CVE: CVE-2022-37781
Published: 2022-08-16
Description: fdkaac v1.0.3 was discovered to contain a heap buffer overflow via __interceptor_memcpy.part.46 at /sanitizer_common/sanitizer_common_interceptors.inc.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/nu774/fdkaac/issues/54; https://github.com/nu774/fdkaac/issues/54
CVE: CVE-2022-38227
Published: 2022-08-16
Description: XPDF commit ffaf11c was discovered to contain a stack overflow via __asan_memcpy at asan_interceptors_memintrinsics.cpp.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/jhcloos/xpdf/issues/4; https://github.com/jhcloos/xpdf/issues/4
CVE: CVE-2022-38228
Published: 2022-08-16
Description: XPDF commit ffaf11c was discovered to contain a heap-buffer overflow via DCTStream::transformDataUnit at /xpdf/Stream.cc.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/jhcloos/xpdf/issues/7; https://github.com/jhcloos/xpdf/issues/7
CVE: CVE-2022-38229
Published: 2022-08-16
Description: XPDF commit ffaf11c was discovered to contain a heap-buffer overflow via DCTStream::readHuffSym(DCTHuffTable*) at /xpdf/Stream.cc.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/jhcloos/xpdf/issues/3; https://github.com/jhcloos/xpdf/issues/3
CVE: CVE-2022-38230
Published: 2022-08-16
Description: XPDF commit ffaf11c was discovered to contain a floating point exception (FPE) via DCTStream::decodeImage() at /xpdf/Stream.cc.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-697
References: https://github.com/jhcloos/xpdf/issues/6; https://github.com/jhcloos/xpdf/issues/6
CVE: CVE-2022-38231
Published: 2022-08-16
Description: XPDF commit ffaf11c was discovered to contain a heap-buffer overflow via DCTStream::getChar() at /xpdf/Stream.cc.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/jhcloos/xpdf/issues/11; https://github.com/jhcloos/xpdf/issues/11
CVE: CVE-2022-38233
Published: 2022-08-16
Description: XPDF commit ffaf11c was discovered to contain a segmentation violation via DCTStream::readMCURow() at /xpdf/Stream.cc.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-754
References: https://github.com/jhcloos/xpdf/issues/9; https://github.com/jhcloos/xpdf/issues/9
CVE: CVE-2022-38234
Published: 2022-08-16
Description: XPDF commit ffaf11c was discovered to contain a segmentation violation via Lexer::getObj(Object*) at /xpdf/Lexer.cc.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-754
References: https://github.com/jhcloos/xpdf/issues/12; https://github.com/jhcloos/xpdf/issues/12
CVE: CVE-2022-38235
Published: 2022-08-16
Description: XPDF commit ffaf11c was discovered to contain a segmentation violation via DCTStream::getChar() at /xpdf/Stream.cc.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-754
References: https://github.com/jhcloos/xpdf/issues/5; https://github.com/jhcloos/xpdf/issues/5
CVE: CVE-2022-38236
Published: 2022-08-16
Description: XPDF commit ffaf11c was discovered to contain a global-buffer overflow via Lexer::getObj(Object*) at /xpdf/Lexer.cc.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://github.com/jhcloos/xpdf/issues/8; https://github.com/jhcloos/xpdf/issues/8
CVE: CVE-2022-38237
Published: 2022-08-16
Description: XPDF commit ffaf11c was discovered to contain a heap-buffer overflow via DCTStream::readScan() at /xpdf/Stream.cc.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/jhcloos/xpdf/issues/14; https://github.com/jhcloos/xpdf/issues/14
CVE: CVE-2022-38238
Published: 2022-08-16
Description: XPDF commit ffaf11c was discovered to contain a heap-buffer overflow via DCTStream::lookChar() at /xpdf/Stream.cc.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/jhcloos/xpdf/issues/15; https://github.com/jhcloos/xpdf/issues/15
CVE: CVE-2022-25799
Published: 2022-08-16
Description: An open redirect vulnerability exists in CERT/CC VINCE software prior to 1.50.0. An attacker could send a link that has a specially crafted URL and convince the user to click the link. When an authenticated user clicks the link, the authenticated user's browser could be redirected to a malicious site that is designed to impersonate a legitimate website. The attacker could trick the user and potentially acquire sensitive information such as the user's credentials.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601, CWE-601
References: https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html; https://github.com/CERTCC/VINCE/issues/45; https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html
CVE: CVE-2021-42052
Published: 2022-08-16
Description: IPESA e-Flow 3.3.6 allows path traversal for reading any file within the web root directory via the lib/js/build/STEResource.res path and the R query parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://nxnjz.net/2022/08/cve-2021-42052-full-disclosure/; https://nxnjz.net/2022/08/cve-2021-42052-full-disclosure/
CVE: CVE-2022-1399
Published: 2022-08-17
Description: An Argument Injection or Modification vulnerability in the "Change Secret" username field as used in the Discovery component of Device42 CMDB allows a local attacker to run arbitrary code on the appliance with root privileges. This issue affects: Device42 CMDB version 18.01.00 and prior versions.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-88, CWE-88
References: https://www.bitdefender.com/blog/labs/a-red-team-perspective-on-the-device42-asset-management-appliance/; https://www.bitdefender.com/blog/labs/a-red-team-perspective-on-the-device42-asset-management-appliance/
CVE: CVE-2022-1400
Published: 2022-08-17
Description: Use of Hard-coded Cryptographic Key vulnerability in the WebReportsApi.dll of Exago Web Reports, as used in the Device42 Asset Management Appliance, allows an attacker to leak session IDs and elevate privileges. This issue affects: Device42 CMDB versions prior to 18.01.00.
CVSS Score: 7.1 (HIGH)
CWE: CWE-321, CWE-798
References: https://www.bitdefender.com/blog/labs/a-red-team-perspective-on-the-device42-asset-management-appliance/; https://www.bitdefender.com/blog/labs/a-red-team-perspective-on-the-device42-asset-management-appliance/
CVE: CVE-2022-1401
Published: 2022-08-17
Description: Improper Access Control vulnerability in the /Exago/WrImageResource.adx route as used in Device42 Asset Management Appliance allows an unauthenticated attacker to read sensitive server files with root permissions. This issue affects: Device42 CMDB versions prior to 18.01.00.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-863, CWE-863
References: https://www.bitdefender.com/blog/labs/a-red-team-perspective-on-the-device42-asset-management-appliance/; https://www.bitdefender.com/blog/labs/a-red-team-perspective-on-the-device42-asset-management-appliance/
CVE: CVE-2022-1410
Published: 2022-08-17
Description: OS Command Injection vulnerability in the db_optimize component of Device42 Asset Management Appliance allows an authenticated attacker to execute remote code on the device. This issue affects: Device42 CMDB version 18.01.00 and prior versions.
CVSS Score: 8.0 (HIGH)
CWE: CWE-78, CWE-78
References: https://www.bitdefender.com/blog/labs/a-red-team-perspective-on-the-device42-asset-management-appliance/; https://www.bitdefender.com/blog/labs/a-red-team-perspective-on-the-device42-asset-management-appliance/
CVE: CVE-2022-2871
Published: 2022-08-17
Description: Cross-site Scripting (XSS) - Stored in GitHub repository notrinos/notrinoserp prior to 0.7.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/notrinos/notrinoserp/commit/0362778f4f678156c22a[PII_REDACTED]23df8a4760; https://huntr.dev/bounties/61126c07-22ac-4961-a198-1aa33060b373; https://github.com/notrinos/notrinoserp/commit/0362778f4f678156c22a[PII_REDACTED]23df8a4760
CVE: CVE-2021-45454
Published: 2022-08-17
Description: Ampere Altra before SRP 1.08b and Altra Max​ before SRP 2.05 allow information disclosure of power telemetry via HWmon.
CVSS Score: 7.5 (HIGH)
References: https://amperecomputing.com/product-security/; https://amperecomputing.com/products/security-bulletins/platypus.html; https://amperecomputing.com/product-security/
CVE: CVE-2022-37459
Published: 2022-08-17
Description: Ampere Altra devices before 1.08g and Ampere Altra Max devices before 2.05a allow attackers to control the predictions for return addresses and potentially hijack code flow to execute arbitrary code via a side-channel attack, aka a "Retbleed" issue.
CVSS Score: 7.8 (HIGH)
CWE: CWE-203
References: https://amperecomputing.com/products/security-bulletins/retbleed.html; https://developer.arm.com/documentation/ka005138/1-0/; https://amperecomputing.com/products/security-bulletins/retbleed.html
CVE: CVE-2022-2845
Published: 2022-08-17
Description: Improper Validation of Specified Quantity in Input in GitHub repository vim/vim prior to 9.0.0218.
CVSS Score: 7.8 (HIGH)
CWE: CWE-1284, CWE-1284
References: https://github.com/vim/vim/commit/e98c88c44c308edaea5994b8ad4363e65030968c; https://huntr.dev/bounties/3e1d31ac-1cfd-4a9f-bc5c-213376b69445; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/C72HDIMR3KTTAO7QGTXWUMPBNFUFIBRD/
CVE: CVE-2022-30262
Published: 2022-08-17
Description: The Emerson ControlWave 'Next Generation' RTUs through 2022-05-02 mishandle firmware integrity. They utilize the BSAP-IP protocol to transmit firmware updates. Firmware updates are supplied as CAB archive files containing a binary firmware image. In all cases, firmware images were found to have no authentication (in the form of firmware signing) and only relied on insecure checksums for regular integrity checks.
CVSS Score: 7.8 (HIGH)
CWE: CWE-345
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-221-02; https://www.forescout.com/blog/; https://www.cisa.gov/uscert/ics/advisories/icsa-22-221-02
CVE: CVE-2022-31262
Published: 2022-08-17
Description: An exploitable local privilege escalation vulnerability exists in GOG Galaxy 2.0.46. Due to insufficient folder permissions, an attacker can hijack the %ProgramData%\GOG.com folder structure and change the GalaxyCommunication service executable to a malicious file, resulting in code execution as SYSTEM.
CVSS Score: 7.8 (HIGH)
CWE: CWE-281
References: https://github.com/secure-77/CVE-2022-31262; https://secure77.de/category/subjects/researches/; https://secure77.de/gog-galaxy-cve-2022-31262/
CVE: CVE-2022-36186
Published: 2022-08-17
Description: A Null Pointer dereference vulnerability exists in GPAC 2.1-DEV-revUNKNOWN-master via the function gf_filter_pid_set_property_full () at filter_core/filter_pid.c:5250,which causes a Denial of Service (DoS). This vulnerability was fixed in commit b43f9d1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://github.com/gpac/gpac/issues/2223; https://github.com/gpac/gpac/issues/2223
CVE: CVE-2022-36190
Published: 2022-08-17
Description: GPAC mp4box 2.1-DEV-revUNKNOWN-master has a use-after-free vulnerability in function gf_isom_dovi_config_get. This vulnerability was fixed in commit fef6242.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: https://github.com/gpac/gpac/issues/2220; https://www.debian.org/security/2023/dsa-5411; https://github.com/gpac/gpac/issues/2220
CVE: CVE-2022-38149
Published: 2022-08-17
Description: HashiCorp Consul Template up to 0.27.2, 0.28.2, and 0.29.1 may expose the contents of Vault secrets in the error returned by the *template.Template.Execute method, when given a template using Vault secret contents incorrectly. Fixed in 0.27.3, 0.28.3, and 0.29.2.
CVSS Score: 7.5 (HIGH)
CWE: CWE-532
References: https://discuss.hashicorp.com; https://discuss.hashicorp.com/t/hsec-2022-16-consul-template-may-expose-vault-secrets-when-processing-invalid-input/43215; https://discuss.hashicorp.com
CVE: CVE-2022-22455
Published: 2022-08-17
Description: IBM Security Verify Governance Identity Manager 10.0 virtual appliance component performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses. IBM X-Force ID: 224989.
CVSS Score: 9.8 (CRITICAL)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/224989; https://www.ibm.com/support/pages/node/6612733; https://exchange.xforce.ibmcloud.com/vulnerabilities/224989
CVE: CVE-2022-36191
Published: 2022-08-17
Description: A heap-buffer-overflow had occurred in function gf_isom_dovi_config_get of isomedia/avc_ext.c:2490, as demonstrated by MP4Box. This vulnerability was fixed in commit fef6242.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://github.com/gpac/gpac/issues/2218; https://www.debian.org/security/2023/dsa-5411; https://github.com/gpac/gpac/issues/2218
CVE: CVE-2022-2849
Published: 2022-08-17
Description: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0220.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122
References: https://github.com/vim/vim/commit/f6d39c31d2177549a986d170e192d8351bd571e2; https://huntr.dev/bounties/389aeccd-deb9-49ae-9b6a-24c12d79b02e; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XWOJOA7PZZAMBI5GFTL6PWHXMWSDLUXL/
CVE: CVE-2022-35117
Published: 2022-08-17
Description: Clinic's Patient Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via update_medicine_details.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Packing text box under the Update Medical Details module.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/zhangzhaoyuela/bug_report/blob/main/vendors/oretnom23/clinics-patient-management-system/xss-1.md; https://github.com/zhangzhaoyuela/bug_report/blob/main/vendors/oretnom23/clinics-patient-management-system/xss-1.md
CVE: CVE-2022-38392
Published: 2022-08-17
Description: Certain 5400 RPM hard drives, for laptops and other PCs in approximately 2005 and later, allow physically proximate attackers to cause a denial of service (device malfunction and system crash) via a resonant-frequency attack with the audio signal from the Rhythm Nation music video. A reported product is Seagate STDT4[PII_REDACTED]49053447.
CVSS Score: 5.3 (MEDIUM)
References: https://devblogs.microsoft.com/oldnewthing/20220816-00/?p=106994; https://www.seagate.com/support/security/; https://www.youtube.com/watch?v=nSvu9IDUjZw&t=416s
CVE: CVE-2022-2870
Published: 2022-08-17
Description: A vulnerability was found in laravel 5.1 and classified as problematic. This issue affects some unknown processing. The manipulation leads to deserialization. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-206501 was assigned to this vulnerability.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-502
References: https://github.com/beicheng-maker/vulns/issues/2; https://vuldb.com/?id.206501; https://github.com/beicheng-maker/vulns/issues/2
CVE: CVE-2022-2862
Published: 2022-08-17
Description: Use After Free in GitHub repository vim/vim prior to 9.0.0221.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://github.com/vim/vim/commit/1889f499a4f248cd84e0e0bf6d0d[PII_REDACTED]94; https://huntr.dev/bounties/71180988-1ab6-4311-bca8-e9a879b06765; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XWOJOA7PZZAMBI5GFTL6PWHXMWSDLUXL/
CVE: CVE-2022-35121
Published: 2022-08-17
Description: Novel-Plus v3.6.1 was discovered to contain a SQL injection vulnerability via the keyword parameter at /service/impl/BookServiceImpl.java.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/201206030/novel-plus/issues/92; https://github.com/201206030/novel-plus/issues/92
CVE: CVE-2022-35516
Published: 2022-08-17
Description: DedeCMS v5.7.93 - v5.7.96 was discovered to contain a remote code execution vulnerability in login.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://github.com/whitehatl/Vulnerability/blob/main/web/dedecms/5.7.93/Login.poc.md; https://github.com/whitehatl/Vulnerability/blob/main/web/dedecms/5.7.93/Login.poc.md
CVE: CVE-2022-36215
Published: 2022-08-17
Description: DedeBIZ v6 was discovered to contain a remote code execution vulnerability in sys_info.php.
CVSS Score: 7.2 (HIGH)
References: https://github.com/whitehatl/Vulnerability/blob/main/web/dedebiz/6.0.0/sys_info.poc.md; https://github.com/whitehatl/Vulnerability/blob/main/web/dedebiz/6.0.0/sys_info.poc.md
CVE: CVE-2022-36216
Published: 2022-08-17
Description: DedeCMS v5.7.94 - v5.7.97 was discovered to contain a remote code execution vulnerability in member_toadmin.php.
CVSS Score: 7.2 (HIGH)
CWE: CWE-94
References: https://github.com/whitehatl/Vulnerability/blob/main/web/dedecms/5.7.94/member_toadmin.poc.md; https://github.com/whitehatl/Vulnerability/blob/main/web/dedecms/5.7.94/member_toadmin.poc.md
CVE: CVE-2020-14394
Published: 2022-08-17
Description: An infinite loop flaw was found in the USB xHCI controller emulation of QEMU while computing the length of the Transfer Request Block (TRB) Ring. This flaw allows a privileged guest user to hang the QEMU process on the host, resulting in a denial of service.
CVSS Score: 3.2 (LOW)
CWE: CWE-835, CWE-835
References: https://bugzilla.redhat.com/show_bug.cgi?id=1908004; https://gitlab.com/qemu-project/qemu/-/issues/646; https://lists.debian.org/debian-lts-announce/2023/03/msg00013.html