deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-22965
Published: 2022-04-01
Description: A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94, CWE-94
References: http://packetstormsecurity.com/files/166713/Spring4Shell-Code-Execution.html; http://packetstormsecurity.com/files/167011/Spring4Shell-Spring-Framework-Class-Property-Remote-Code-Execution.html; https://cert-portal.siemens.com/productcert/pdf/ssa-254054.pdf
CVE: CVE-2022-25155
Published: 2022-04-01
Description: Use of Password Hash Instead of Password for Authentication vulnerability in Mitsubishi Electric MELSEC iQ-F series FX5U(C) CPU all versions, Mitsubishi Electric MELSEC iQ-F series FX5UJ CPU all versions, Mitsubishi Electric MELSEC iQ-R series R00/01/02CPU all versions, Mitsubishi Electric MELSEC iQ-R series R04/08/16/32/120(EN)CPU all versions, Mitsubishi Electric MELSEC iQ-R series R08/16/32/120SFCPU all versions, Mitsubishi Electric MELSEC iQ-R series R08/16/32/120PCPU all versions, Mitsubishi Electric MELSEC iQ-R series R08/16/32/120PSFCPU all versions, Mitsubishi Electric MELSEC iQ-R series RJ71GN11-T2 all versions, Mitsubishi Electric MELSEC iQ-R series RJ71GN11-EIP all versions, Mitsubishi Electric MELSEC iQ-R series RJ71C24(-R2/R4) all versions, Mitsubishi Electric MELSEC iQ-R series RJ71EN71 all versions, Mitsubishi Electric MELSEC iQ-R series RJ72GF15-T2 all versions, Mitsubishi Electric MELSEC Q series Q03UDECPU all versions, Mitsubishi Electric MELSEC Q series Q04/06/10/13/20/26/50/100UDEHCPU all versions, Mitsubishi Electric MELSEC Q series Q03/04/06/13/26UDVCPU all versions, Mitsubishi Electric MELSEC Q series Q04/06/13/26UDPVCPU all versions, Mitsubishi Electric MELSEC Q series QJ71C24N(-R2/R4) all versions, Mitsubishi Electric MELSEC Q series QJ71E71-100 all versions, Mitsubishi Electric MELSEC Q series QJ72BR15 all versions, Mitsubishi Electric MELSEC Q series QJ72LP25(-25/G/GE) all versions, Mitsubishi Electric MELSEC L series L02/06/26CPU(-P) all versions, Mitsubishi Electric MELSEC L series L26CPU-(P)BT all versions, Mitsubishi Electric MELSEC L series LJ71C24(-R2) all versions, Mitsubishi Electric MELSEC L series LJ71E71-100 all versions and Mitsubishi Electric MELSEC L series LJ72GF15-T2 all versions allows a remote unauthenticated attacker to login to the product by replaying an eavesdropped password hash.
CVSS Score: 8.1 (HIGH)
CWE: CWE-287
References: https://jvn.jp/vu/JVNVU96577897/index.html; https://www.cisa.gov/uscert/ics/advisories/icsa-22-090-04; https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-031_en.pdf
CVE: CVE-2022-25156
Published: 2022-04-01
Description: Use of Weak Hash vulnerability in Mitsubishi Electric MELSEC iQ-F series FX5U(C) CPU all versions, Mitsubishi Electric MELSEC iQ-F series FX5UJ CPU all versions, Mitsubishi Electric MELSEC iQ-R series R00/01/02CPU all versions, Mitsubishi Electric MELSEC iQ-R series R04/08/16/32/120(EN)CPU all versions, Mitsubishi Electric MELSEC iQ-R series R08/16/32/120SFCPU all versions, Mitsubishi Electric MELSEC iQ-R series R08/16/32/120PCPU all versions, Mitsubishi Electric MELSEC iQ-R series R08/16/32/120PSFCPU all versions, Mitsubishi Electric MELSEC iQ-R series RJ71C24(-R2/R4) all versions, Mitsubishi Electric MELSEC iQ-R series RJ71EN71 all versions, Mitsubishi Electric MELSEC iQ-R series RJ72GF15-T2 all versions, Mitsubishi Electric MELSEC Q series Q03UDECPU all versions, Mitsubishi Electric MELSEC Q series Q04/06/10/13/20/26/50/100UDEHCPU all versions, Mitsubishi Electric MELSEC Q series Q03/04/06/13/26UDVCPU all versions, Mitsubishi Electric MELSEC Q series Q04/06/13/26UDPVCPU all versions, Mitsubishi Electric MELSEC Q series QJ71C24N(-R2/R4) all versions, Mitsubishi Electric MELSEC Q series QJ71E71-100 all versions, Mitsubishi Electric MELSEC Q series QJ72BR15 all versions, Mitsubishi Electric MELSEC Q series QJ72LP25(-25/G/GE) all versions, Mitsubishi Electric MELSEC L series L02/06/26CPU(-P) all versions, Mitsubishi Electric MELSEC L series L26CPU-(P)BT all versions, Mitsubishi Electric MELSEC L series LJ71C24(-R2) all versions, Mitsubishi Electric MELSEC L series LJ71E71-100 all versions and Mitsubishi Electric MELSEC L series LJ72GF15-T2 all versions allows a remote unauthenticated attacker to login to the product by using a password reversed from a previously eavesdropped password hash.
CVSS Score: 8.1 (HIGH)
CWE: CWE-326
References: https://jvn.jp/vu/JVNVU96577897/index.html; https://www.cisa.gov/uscert/ics/advisories/icsa-22-090-04; https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-031_en.pdf
CVE: CVE-2022-25157
Published: 2022-04-01
Description: Use of Password Hash Instead of Password for Authentication vulnerability in Mitsubishi Electric MELSEC iQ-F series FX5U(C) CPU all versions, Mitsubishi Electric MELSEC iQ-F series FX5UJ CPU all versions, Mitsubishi Electric MELSEC iQ-R series R00/01/02CPU all versions, Mitsubishi Electric MELSEC iQ-R series R04/08/16/32/120(EN)CPU all versions, Mitsubishi Electric MELSEC iQ-R series R08/16/32/120SFCPU all versions, Mitsubishi Electric MELSEC iQ-R series R08/16/32/120PCPU all versions, Mitsubishi Electric MELSEC iQ-R series R08/16/32/120PSFCPU all versions, Mitsubishi Electric MELSEC iQ-R series R16/32/64MTCPU all versions, Mitsubishi Electric MELSEC iQ-R series RJ71C24(-R2/R4) all versions, Mitsubishi Electric MELSEC iQ-R series RJ71EN71 all versions, Mitsubishi Electric MELSEC iQ-R series RJ71GF11-T2 all versions, Mitsubishi Electric MELSEC iQ-R series RJ71GP21(S)-SX all versions, Mitsubishi Electric MELSEC iQ-R series RJ72GF15-T2 all versions, Mitsubishi Electric MELSEC Q series Q03UDECPU all versions, Mitsubishi Electric MELSEC Q series Q04/06/10/13/20/26/50/100UDEHCPU all versions, Mitsubishi Electric MELSEC Q series Q03/04/06/13/26UDVCPU all versions, Mitsubishi Electric MELSEC Q series Q04/06/13/26UDPVCPU all versions, Mitsubishi Electric MELSEC Q series QJ71C24N(-R2/R4) all versions, Mitsubishi Electric MELSEC Q series QJ71E71-100 all versions, Mitsubishi Electric MELSEC L series L02/06/26CPU(-P) all versions, Mitsubishi Electric MELSEC L series L26CPU-(P)BT all versions, Mitsubishi Electric MELSEC L series LJ71C24(-R2) all versions, Mitsubishi Electric MELSEC L series LJ71E71-100 all versions and Mitsubishi Electric MELSEC L series LJ72GF15-T2 all versions allows a remote unauthenticated attacker to disclose or tamper with the information in the product by using an eavesdropped password hash.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-287
References: https://jvn.jp/vu/JVNVU96577897/index.html; https://www.cisa.gov/uscert/ics/advisories/icsa-22-090-04; https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-031_en.pdf
CVE: CVE-2022-25158
Published: 2022-04-01
Description: Cleartext Storage of Sensitive Information vulnerability in Mitsubishi Electric MELSEC iQ-F series FX5U(C) CPU all versions, Mitsubishi Electric MELSEC iQ-F series FX5UJ CPU all versions, Mitsubishi Electric MELSEC iQ-R series R00/01/02CPU all versions, Mitsubishi Electric MELSEC iQ-R series R04/08/16/32/120(EN)CPU all versions, Mitsubishi Electric MELSEC iQ-R series R08/16/32/120SFCPU all versions, Mitsubishi Electric MELSEC iQ-R series R08/16/32/120PCPU all versions, Mitsubishi Electric MELSEC iQ-R series R08/16/32/120PSFCPU all versions, Mitsubishi Electric MELSEC iQ-R series RJ71C24(-R2/R4) all versions, Mitsubishi Electric MELSEC iQ-R series RJ71EN71 all versions, Mitsubishi Electric MELSEC iQ-R series RJ71GF11-T2 all versions, Mitsubishi Electric MELSEC iQ-R series RJ71GP21(S)-SX all versions, Mitsubishi Electric MELSEC iQ-R series RJ72GF15-T2 all versions, Mitsubishi Electric MELSEC Q series Q03UDECPU all versions, Mitsubishi Electric MELSEC Q series Q04/06/10/13/20/26/50/100UDEHCPU all versions, Mitsubishi Electric MELSEC Q series Q03/04/06/13/26UDVCPU all versions, Mitsubishi Electric MELSEC Q series Q04/06/13/26UDPVCPU all versions, Mitsubishi Electric MELSEC Q series QJ71C24N(-R2/R4) all versions, Mitsubishi Electric MELSEC Q series QJ71E71-100 all versions, Mitsubishi Electric MELSEC L series L02/06/26CPU(-P) all versions, Mitsubishi Electric MELSEC L series L26CPU-(P)BT all versions, Mitsubishi Electric MELSEC L series LJ71C24(-R2) all versions, Mitsubishi Electric MELSEC L series LJ71E71-100 all versions and Mitsubishi Electric MELSEC L series LJ72GF15-T2 all versions allows a remote attacker to disclose or tamper with a file in which password hash is saved in cleartext.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-312
References: https://jvn.jp/vu/JVNVU96577897/index.html; https://www.cisa.gov/uscert/ics/advisories/icsa-22-090-04; https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-031_en.pdf
CVE: CVE-2022-25159
Published: 2022-04-01
Description: Authentication Bypass by Capture-replay vulnerability in Mitsubishi Electric MELSEC iQ-F series FX5U(C) CPU all versions, Mitsubishi Electric MELSEC iQ-F series FX5UJ CPU all versions, Mitsubishi Electric MELSEC iQ-R series R00/01/02CPU all versions, Mitsubishi Electric MELSEC iQ-R series R04/08/16/32/120(EN)CPU all versions, Mitsubishi Electric MELSEC iQ-R series R08/16/32/120SFCPU all versions, Mitsubishi Electric MELSEC iQ-R series R08/16/32/120PCPU all versions, Mitsubishi Electric MELSEC iQ-R series R08/16/32/120PSFCPU all versions, Mitsubishi Electric MELSEC iQ-R series R16/32/64MTCPU all versions, Mitsubishi Electric MELSEC iQ-R series RJ71C24(-R2/R4) all versions, Mitsubishi Electric MELSEC iQ-R series RJ71EN71 all versions, Mitsubishi Electric MELSEC iQ-R series RJ72GF15-T2 all versions, Mitsubishi Electric MELSEC Q series Q03/04/06/13/26UDVCPU all versions, Mitsubishi Electric MELSEC Q series Q04/06/13/26UDPVCPU all versions, Mitsubishi Electric MELSEC Q series QJ71C24N(-R2/R4) all versions and Mitsubishi Electric MELSEC Q series QJ71E71-100 all versions allows a remote unauthenticated attacker to login to the product by replay attack.
CVSS Score: 8.1 (HIGH)
CWE: CWE-294
References: https://jvn.jp/vu/JVNVU96577897/index.html; https://www.cisa.gov/uscert/ics/advisories/icsa-22-090-04; https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-031_en.pdf
CVE: CVE-2022-25160
Published: 2022-04-01
Description: Cleartext Storage of Sensitive Information vulnerability in Mitsubishi Electric MELSEC iQ-F series FX5U(C) CPU all versions, Mitsubishi Electric MELSEC iQ-F series FX5UJ CPU all versions, Mitsubishi Electric MELSEC iQ-R series R00/01/02CPU all versions, Mitsubishi Electric MELSEC iQ-R series R04/08/16/32/120(EN)CPU all versions, Mitsubishi Electric MELSEC iQ-R series R08/16/32/120SFCPU all versions, Mitsubishi Electric MELSEC iQ-R series R08/16/32/120PCPU all versions, Mitsubishi Electric MELSEC iQ-R series R08/16/32/120PSFCPU all versions, Mitsubishi Electric MELSEC iQ-R series R16/32/64MTCPU all versions, Mitsubishi Electric MELSEC iQ-R series RJ71C24(-R2/R4) all versions, Mitsubishi Electric MELSEC iQ-R series RJ71EN71 all versions, Mitsubishi Electric MELSEC iQ-R series RJ72GF15-T2 all versions, Mitsubishi Electric MELSEC Q series Q03/04/06/13/26UDVCPU all versions, Mitsubishi Electric MELSEC Q series Q04/06/13/26UDPVCPU all versions, Mitsubishi Electric MELSEC Q series QJ71C24N(-R2/R4) all versions and Mitsubishi Electric MELSEC Q series QJ71E71-100 all versions allows a remote unauthenticated attacker to disclose a file in a legitimate user's product by using previously eavesdropped cleartext information and to counterfeit a legitimate user’s system.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-312
References: https://jvn.jp/vu/JVNVU96577897/index.html; https://www.cisa.gov/uscert/ics/advisories/icsa-22-090-04; https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-031_en.pdf
CVE: CVE-2022-25959
Published: 2022-04-01
Description: Omron CX-Position (versions 2.5.3 and prior) is vulnerable to memory corruption while processing a specific project file, which may allow an attacker to execute arbitrary code.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-787
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-088-02; https://www.zerodayinitiative.com/advisories/ZDI-22-577/; https://www.cisa.gov/uscert/ics/advisories/icsa-22-088-02
CVE: CVE-2022-26022
Published: 2022-04-01
Description: Omron CX-Position (versions 2.5.3 and prior) is vulnerable to an out-of-bounds write while processing a specific project file, which may allow an attacker to execute arbitrary code.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-088-02; https://www.zerodayinitiative.com/advisories/ZDI-22-581/; https://www.cisa.gov/uscert/ics/advisories/icsa-22-088-02
CVE: CVE-2022-26417
Published: 2022-04-01
Description: Omron CX-Position (versions 2.5.3 and prior) is vulnerable to a use after free memory condition while processing a specific project file, which may allow an attacker to execute arbitrary code.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-088-02; https://www.zerodayinitiative.com/advisories/ZDI-22-578/; https://www.cisa.gov/uscert/ics/advisories/icsa-22-088-02
CVE: CVE-2022-26419
Published: 2022-04-01
Description: Omron CX-Position (versions 2.5.3 and prior) is vulnerable to multiple stack-based buffer overflow conditions while parsing a specific project file, which may allow an attacker to locally execute arbitrary code.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-088-02; https://www.zerodayinitiative.com/advisories/ZDI-22-575/; https://www.zerodayinitiative.com/advisories/ZDI-22-576/
CVE: CVE-2022-27177
Published: 2022-04-01
Description: A Python format string issue leading to information disclosure and potentially remote code execution in ConsoleMe for all versions prior to 1.2.2
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-134
References: https://github.com/Netflix/security-bulletins/blob/master/advisories/nflx-2022-001.md; https://github.com/Netflix/security-bulletins/blob/master/advisories/nflx-2022-001.md
CVE: CVE-2022-27534
Published: 2022-04-01
Description: Kaspersky Anti-Virus products for home and Kaspersky Endpoint Security with antivirus databases released before 12 March 2022 had a bug in a data parsing module that potentially allowed an attacker to execute arbitrary code. The fix was delivered automatically. Credits: Georgy Zaytsev (Positive Technologies).
CVSS Score: 9.8 (CRITICAL)
References: https://support.kaspersky.com/general/vulnerability.aspx?el=12430#310322_2; https://support.kaspersky.com/general/vulnerability.aspx?el=12430#310322_2
CVE: CVE-2022-1201
Published: 2022-04-02
Description: NULL Pointer Dereference in mrb_vm_exec with super in GitHub repository mruby/mruby prior to 3.2. This vulnerability is capable of making the mruby interpreter crash, thus affecting the availability of the system.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/mruby/mruby/commit/00acae117da1b45b318dc36531a7b0021b8097ae; https://huntr.dev/bounties/6f930add-c9d8-4870-ae56-d4bd8354703b; https://github.com/mruby/mruby/commit/00acae117da1b45b318dc36531a7b0021b8097ae
CVE: CVE-2022-28352
Published: 2022-04-02
Description: WeeChat (aka Wee Enhanced Environment for Chat) 3.2 to 3.4 before 3.4.1 does not properly verify the TLS certificate of the server, after certain GnuTLS options are changed, which allows man-in-the-middle attackers to spoof a TLS chat server via an arbitrary certificate. NOTE: this only affects situations where weechat.network.gnutls_ca_system or weechat.network.gnutls_ca_user is changed without a WeeChat restart.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-295
References: https://github.com/weechat/weechat/issues/1763; https://weechat.org/doc/security/WSA-2022-1/; https://github.com/weechat/weechat/issues/1763
CVE: CVE-2022-28355
Published: 2022-04-02
Description: randomUUID in Scala.js before 1.10.0 generates predictable values.
CVSS Score: 7.5 (HIGH)
CWE: CWE-330
References: https://github.com/scala-js/scala-js/issues/4657; https://github.com/scala-js/scala-js/releases; https://github.com/scala-js/scala-js/security/advisories/GHSA-j2f9-w8wh-9ww4
CVE: CVE-2022-28356
Published: 2022-04-02
Description: In the Linux kernel before 5.17.1, a refcount leak bug was found in net/llc/af_llc.c.
CVSS Score: 5.5 (MEDIUM)
References: http://www.openwall.com/lists/oss-security/2022/04/06/1; https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.17.1; https://github.com/torvalds/linux/commit/764f4eb6846f5475f1244767d24d25dd86528a4a
CVE: CVE-2022-28368
Published: 2022-04-03
Description: Dompdf 1.2.1 allows remote code execution via a .php file in the src:url field of an @font-face Cascading Style Sheets (CSS) statement (within an HTML input file).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-79
References: http://packetstormsecurity.com/files/171738/Dompdf-1.2.1-Remote-Code-Execution.html; https://github.com/dompdf/dompdf/commit/4c70e1025bcd9b7694b95dd552499bd83cd6141d; https://github.com/dompdf/dompdf/issues/2598
CVE: CVE-2022-28376
Published: 2022-04-03
Description: Verizon 5G Home LVSKIHP outside devices through 2022-02-15 allow anyone (knowing the device's serial number) to access a CPE admin website, e.g., at the 10.0.0.1 IP address. The password (for the verizon username) is calculated by concatenating the serial number and the model (i.e., the LVSKIHP string), running the sha256sum program, and extracting the first seven characters concatenated with the last seven characters of that SHA-256 value.
CVSS Score: 8.1 (HIGH)
CWE: CWE-287
References: https://github.com/JousterL/SecWriteups/blob/main/Verizon%20LVSKIHP%205G%20Modem/readme.md; https://www.reddit.com/r/verizon/comments/sstq4c/5g_home_internet_dropping_out/hx3ir0s/; https://github.com/JousterL/SecWriteups/blob/main/Verizon%20LVSKIHP%205G%20Modem/readme.md
CVE: CVE-2022-0088
Published: 2022-04-03
Description: Cross-Site Request Forgery (CSRF) in GitHub repository yourls/yourls prior to 1.8.3.
CVSS Score: 7.4 (HIGH)
CWE: CWE-352
References: https://github.com/yourls/yourls/commit/1de256d8694b0ec7d4df2ac1d5976d4055e09d59; https://huntr.dev/bounties/d01f0726-1a0f-4575-ae17-4b5319b11c29; https://github.com/MarkLee131/awesome-web-pocs/blob/main/CVE-2022-0088.md
CVE: CVE-2022-1210
Published: 2022-04-03
Description: A vulnerability classified as problematic was found in LibTIFF 4.3.0. Affected by this vulnerability is the TIFF File Handler of tiff2ps. Opening a malicious file leads to a denial of service. The attack can be launched remotely but requires user interaction. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-400, CWE-404
References: https://gitlab.com/libtiff/libtiff/-/issues/402; https://gitlab.com/libtiff/libtiff/uploads/c3da94e53cf1e1e8e6d4d3780dc8c42f/example.tiff; https://security.gentoo.org/glsa/202210-10
CVE: CVE-2022-1211
Published: 2022-04-03
Description: A vulnerability classified as critical has been found in tildearrow Furnace dev73. This affects the FUR to VGM converter in console mode which causes stack-based overflows and crashes. It is possible to initiate the attack remotely but it requires user-interaction. A POC has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-121, CWE-787
References: https://drive.google.com/file/d/1h111beVcWG8F99jRffO7_HKYEhm7Qgvb/view?usp=sharing; https://github.com/tildearrow/furnace/issues/325; https://vuldb.com/?id.196371
CVE: CVE-2022-28378
Published: 2022-04-03
Description: Craft CMS before 3.7.29 allows XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#3729---2022-01-18; https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#3729---2022-01-18
CVE: CVE-2022-28379
Published: 2022-04-03
Description: jc21.com Nginx Proxy Manager before 2.9.17 allows XSS during item deletion.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/NginxProxyManager/nginx-proxy-manager/issues/1950; https://github.com/NginxProxyManager/nginx-proxy-manager/releases/tag/v2.9.17; https://github.com/NginxProxyManager/nginx-proxy-manager/issues/1950
CVE: CVE-2022-28380
Published: 2022-04-03
Description: The rc-httpd component through 2022-03-31 for 9front (Plan 9 fork) allows ..%2f directory traversal if serve-static is used.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://desuarchive.org/g/thread/86286230; https://git.9front.org/plan9front/plan9front/241667b933ff5bacb9a3974f6877fb8aad78bed3/commit.html; https://desuarchive.org/g/thread/86286230
CVE: CVE-2022-0405
Published: 2022-04-03
Description: Improper Access Control in GitHub repository janeczku/calibre-web prior to 0.6.16.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284
References: https://github.com/janeczku/calibre-web/commit/3b216bfa07ec7992eff03e55d61732af6df9bb92; https://huntr.dev/bounties/370538f6-5312-4c15-9fc0-b4c36ac236fe; https://github.com/janeczku/calibre-web/commit/3b216bfa07ec7992eff03e55d61732af6df9bb92
CVE: CVE-2022-0406
Published: 2022-04-03
Description: Improper Authorization in GitHub repository janeczku/calibre-web prior to 0.6.16.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-285, CWE-863
References: https://github.com/janeczku/calibre-web/commit/e0e[PII_REDACTED]0575179a8f924543449c6de0706; https://huntr.dev/bounties/d7[PII_REDACTED]-4751-b5e2-b669e729d5db; https://github.com/janeczku/calibre-web/commit/e0e[PII_REDACTED]0575179a8f924543449c6de0706
CVE: CVE-2022-28381
Published: 2022-04-03
Description: Mediaserver.exe in ALLMediaServer 1.6 has a stack-based buffer overflow that allows remote attackers to execute arbitrary code via a long string to TCP port 888, a related issue to CVE-2017-17932.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: http://packetstormsecurity.com/files/166573/ALLMediaServer-1.6-Buffer-Overflow.html; https://github.com/Matrix07ksa/ALLMediaServer-1.6-Buffer-Overflow; http://packetstormsecurity.com/files/166573/ALLMediaServer-1.6-Buffer-Overflow.html
CVE: CVE-2022-28388
Published: 2022-04-03
Description: usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c in the Linux kernel through 5.17.1 has a double free.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-415, CWE-415
References: https://github.com/torvalds/linux/commit/3d3925ff6433f98992685a9679613a2cc97f3ce2; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6IHHC455LMSJNG4CSZ5CEAHYWY2DE5YW/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LAWC35TO642FOP3UCA3C6IF7NAUFOVZ6/
CVE: CVE-2022-28389
Published: 2022-04-03
Description: mcba_usb_start_xmit in drivers/net/can/usb/mcba_usb.c in the Linux kernel through 5.17.1 has a double free.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-415
References: https://github.com/torvalds/linux/commit/04c9b00ba83594a29813d6b1fb8fdc93a3915174; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6IHHC455LMSJNG4CSZ5CEAHYWY2DE5YW/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LAWC35TO642FOP3UCA3C6IF7NAUFOVZ6/
CVE: CVE-2022-28390
Published: 2022-04-03
Description: ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c in the Linux kernel through 5.17.1 has a double free.
CVSS Score: 7.8 (HIGH)
CWE: CWE-415
References: https://github.com/torvalds/linux/commit/c[PII_REDACTED]8a62135cee3409dccefd494a24646; https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6IHHC455LMSJNG4CSZ5CEAHYWY2DE5YW/