deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-27505
Published: 2022-04-13
Description: Reflected cross site scripting (XSS)
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://support.citrix.com/article/CTX370550; https://support.citrix.com/article/CTX370550
CVE: CVE-2022-27506
Published: 2022-04-13
Description: Hard-coded credentials allow administrators to access the shell via the SD-WAN CLI
CVSS Score: 2.7 (LOW)
CWE: CWE-798, CWE-798
References: https://support.citrix.com/article/CTX370550; https://support.citrix.com/article/CTX370550
CVE: CVE-2022-27523
Published: 2022-04-13
Description: A buffer over-read can be exploited in Autodesk TrueView 2022 may lead to an exposure of sensitive information or a crash through using a maliciously crafted DWG file as an Input. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0007; https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0007
CVE: CVE-2022-27524
Published: 2022-04-13
Description: An out-of-bounds read can be exploited in Autodesk TrueView 2022 may lead to an exposure of sensitive information or a crash through using a maliciously crafted DWG file as an Input. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0007; https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0007
CVE: CVE-2022-27846
Published: 2022-04-13
Description: Cross-Site Request Forgery (CSRF) vulnerability in Yooslider Yoo Slider <= 2.0.0 on WordPress allows attackers to create or modify slider.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://patchstack.com/database/vulnerability/yoo-slider/wordpress-yoo-slider-plugin-2-0-0-cross-site-request-forgery-csrf-vulnerability-leading-to-slider-creation-modification; https://wordpress.org/plugins/yoo-slider/#developers; https://patchstack.com/database/vulnerability/yoo-slider/wordpress-yoo-slider-plugin-2-0-0-cross-site-request-forgery-csrf-vulnerability-leading-to-slider-creation-modification
CVE: CVE-2022-27847
Published: 2022-04-13
Description: Cross-Site Request Forgery (CSRF) vulnerability in Yooslider Yoo Slider <= 2.0.0 on WordPress allows attackers to import templates.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://patchstack.com/database/vulnerability/yoo-slider/wordpress-yoo-slider-plugin-2-0-0-cross-site-request-forgery-csrf-vulnerability-leading-to-template-import; https://wordpress.org/plugins/yoo-slider/#developers; https://patchstack.com/database/vulnerability/yoo-slider/wordpress-yoo-slider-plugin-2-0-0-cross-site-request-forgery-csrf-vulnerability-leading-to-template-import
CVE: CVE-2021-41119
Published: 2022-04-13
Description: Wire-server is the system server for the wire back-end services. Releases prior to v2022-03-01 are subject to a denial of service attack via a crafted object causing a hash collision. This collision causes the server to spend at least quadratic time parsing it which can lead to a denial of service for a heavily used server. The issue has been fixed in wire-server 2022-03-01 and is already deployed on all Wire managed services. On premise instances of wire-server need to be updated to 2022-03-01, so that their backends are no longer affected. There are no known workarounds for this issue.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-400, CWE-400
References: https://cs-syd.eu/posts/2021-09-11-json-vulnerability; https://github.com/wireapp/wire-server/security/advisories/GHSA-phxv-pffh-fq2r; https://cs-syd.eu/posts/2021-09-11-json-vulnerability
CVE: CVE-2022-0023
Published: 2022-04-13
Description: An improper handling of exceptional conditions vulnerability exists in the DNS proxy feature of Palo Alto Networks PAN-OS software that enables a meddler-in-the-middle (MITM) to send specifically crafted traffic to the firewall that causes the service to restart unexpectedly. Repeated attempts to send this request result in denial-of-service to all PAN-OS services by restarting the device in maintenance mode. This issue does not impact Panorama appliances and Prisma Access customers. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.22; PAN-OS 9.0 versions earlier than PAN-OS 9.0.16; PAN-OS 9.1 versions earlier than PAN-OS 9.1.13; PAN-OS 10.0 versions earlier than PAN-OS 10.0.10; PAN-OS 10.1 versions earlier than PAN-OS 10.1.5. This issue does not impact PAN-OS 10.2.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-755, CWE-755
References: https://security.paloaltonetworks.com/CVE-2022-0023; https://security.paloaltonetworks.com/CVE-2022-0023
CVE: CVE-2022-1345
Published: 2022-04-13
Description: Stored XSS viva .svg file upload in GitHub repository causefx/organizr prior to 2.1.1810. This allows attackers to execute malicious scripts in the user's browser and it can lead to session hijacking, sensitive data exposure, and worse.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-434
References: https://github.com/causefx/organizr/commit/a09d834d995599756b62016af7026d2408ecf43a; https://huntr.dev/bounties/781b5c2a-bc98-41a0-a276-ea12399e5a25; https://github.com/causefx/organizr/commit/a09d834d995599756b62016af7026d2408ecf43a
CVE: CVE-2022-1347
Published: 2022-04-13
Description: Stored XSS in the "Username" & "Email" input fields leads to account takeover of Admin & Co-admin users in GitHub repository causefx/organizr prior to 2.1.1810. Account takeover and privilege escalation
CVSS Score: 8.4 (HIGH)
CWE: CWE-79, CWE-79
References: https://github.com/causefx/organizr/commit/a09d834d995599756b62016af7026d2408ecf43a; https://huntr.dev/bounties/6059501f-05d2-4e76-ae03-5eb64835e6bf; https://github.com/causefx/organizr/commit/a09d834d995599756b62016af7026d2408ecf43a
CVE: CVE-2022-24788
Published: 2022-04-13
Description: Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. Versions of vyper prior to 0.3.2 suffer from a potential buffer overrun. Importing a function from a JSON interface which returns `bytes` generates bytecode which does not clamp bytes length, potentially resulting in a buffer overrun. Users are advised to upgrade. There are no known workarounds for this issue.
CVSS Score: 7.1 (HIGH)
CWE: CWE-120, CWE-119
References: https://github.com/vyperlang/vyper/commit/049dbdc647b2ce838fae7c188e6bb09cf16e470b; https://github.com/vyperlang/vyper/security/advisories/GHSA-4mrx-6fxm-8jpg; https://github.com/vyperlang/vyper/commit/049dbdc647b2ce838fae7c188e6bb09cf16e470b
CVE: CVE-2022-27479
Published: 2022-04-13
Description: Apache Superset before 1.4.2 is vulnerable to SQL injection in chart data requests. Users should update to 1.4.2 or higher which addresses this issue.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: http://www.openwall.com/lists/oss-security/2022/04/13/3; https://lists.apache.org/thread/94th50j5d0y2fw7ysx0g7w3t6jk3z7q6; https://lists.apache.org/thread/ztb9b6jd9rngoxwvq8r4fhpp401o613y
CVE: CVE-2022-24816
Published: 2022-04-13
Description: JAI-EXT is an open-source project which aims to extend the Java Advanced Imaging (JAI) API. Programs allowing Jiffle script to be provided via network request can lead to a Remote Code Execution as the Jiffle script is compiled into Java code via Janino, and executed. In particular, this affects the downstream GeoServer project. Version 1.2.22 will contain a patch that disables the ability to inject malicious code into the resulting script. Users unable to upgrade may negate the ability to compile Jiffle scripts from the final application, by removing janino-x.y.z.jar from the classpath.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-94, CWE-94
References: https://github.com/geosolutions-it/jai-ext/commit/cb1d6565d38954676b0a366da4f965fef38da1cb; https://github.com/geosolutions-it/jai-ext/security/advisories/GHSA-v92f-jx6p-73rx; https://github.com/geosolutions-it/jai-ext/commit/cb1d6565d38954676b0a366da4f965fef38da1cb
CVE: CVE-2022-24818
Published: 2022-04-13
Description: GeoTools is an open source Java library that provides tools for geospatial data. The GeoTools library has a number of data sources that can perform unchecked JNDI lookups, which in turn can be used to perform class deserialization and result in arbitrary code execution. Similar to the Log4J case, the vulnerability can be triggered if the JNDI names are user-provided, but requires admin-level login to be triggered. The lookups are now restricted in GeoTools 26.4, GeoTools 25.6, and GeoTools 24.6. Users unable to upgrade should ensure that any downstream application should not allow usage of remotely provided JNDI strings.
CVSS Score: 8.2 (HIGH)
CWE: CWE-20, CWE-917
References: https://github.com/geotools/geotools/commit/4f70fa3234391dd0cda883a20ab0ec75688cba49; https://github.com/geotools/geotools/security/advisories/GHSA-jvh2-668r-g75x; https://github.com/geotools/geotools/commit/4f70fa3234391dd0cda883a20ab0ec75688cba49
CVE: CVE-2022-24828
Published: 2022-04-13
Description: Composer is a dependency manager for the PHP programming language. Integrators using Composer code to call `VcsDriver::getFileContent` can have a code injection vulnerability if the user can control the `$file` or `$identifier` argument. This leads to a vulnerability on packagist.org for example where the composer.json's `readme` field can be used as a vector for injecting parameters into hg/Mercurial via the `$file` argument, or git via the `$identifier` argument if you allow arbitrary data there (Packagist does not, but maybe other integrators do). Composer itself should not be affected by the vulnerability as it does not call `getFileContent` with arbitrary data into `$file`/`$identifier`. To the best of our knowledge this was not abused, and the vulnerability has been patched on packagist.org and Private Packagist within a day of the vulnerability report.
CVSS Score: 8.3 (HIGH)
CWE: CWE-20, CWE-88
References: https://github.com/composer/composer/commit/2c40c53637c5c7e43fff7c09d3d324d632734709; https://github.com/composer/composer/security/advisories/GHSA-x7cr-6qr6-2hh6; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/625MT3IKWKFVIWLSYZFSXHVUA2LES7YQ/
CVE: CVE-2022-24844
Published: 2022-04-13
Description: Gin-vue-admin is a backstage management system based on vue and gin, which separates the front and rear of the full stack. The problem occurs in the following code in server/service/system/sys_auto_code_pgsql.go, which means that PostgreSQL must be used as the database for this vulnerability to occur. Users must: Require JWT login） and be using PostgreSQL to be affected. This issue has been resolved in version 2.5.1. There are no known workarounds.
CVSS Score: 8.1 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/flipped-aurora/gin-vue-admin/pull/1024; https://github.com/flipped-aurora/gin-vue-admin/security/advisories/GHSA-5g92-6hpp-w425; https://github.com/flipped-aurora/gin-vue-admin/pull/1024
CVE: CVE-2022-24843
Published: 2022-04-13
Description: Gin-vue-admin is a backstage management system based on vue and gin, which separates the front and rear of the full stack. Gin-vue-admin 2.50 has arbitrary file read vulnerability due to a lack of parameter validation. This has been resolved in version 2.5.1. There are no known workarounds for this issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/flipped-aurora/gin-vue-admin/issues/1002; https://github.com/flipped-aurora/gin-vue-admin/pull/1024; https://github.com/flipped-aurora/gin-vue-admin/security/advisories/GHSA-32gq-gj42-mw43
CVE: CVE-2022-24845
Published: 2022-04-13
Description: Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. In affected versions, the return of `<iface>.returns_int128()` is not validated to fall within the bounds of `int128`. This issue can result in a misinterpretation of the integer value and lead to incorrect behavior. As of v0.3.0, `<iface>.returns_int128()` is validated in simple expressions, but not complex expressions. Users are advised to upgrade. There is no known workaround for this issue.
CVSS Score: 8.8 (HIGH)
CWE: CWE-190, CWE-190
References: https://github.com/vyperlang/vyper/commit/049dbdc647b2ce838fae7c188e6bb09cf16e470b; https://github.com/vyperlang/vyper/security/advisories/GHSA-j2x6-9323-fp7h; https://github.com/vyperlang/vyper/commit/049dbdc647b2ce838fae7c188e6bb09cf16e470b
CVE: CVE-2022-24847
Published: 2022-04-13
Description: GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. The GeoServer security mechanism can perform an unchecked JNDI lookup, which in turn can be used to perform class deserialization and result in arbitrary code execution. The same can happen while configuring data stores with data sources located in JNDI, or while setting up the disk quota mechanism. In order to perform any of the above changes, the attack needs to have obtained admin rights and use either the GeoServer GUI, or its REST API. The lookups are going to be restricted in GeoServer 2.21.0, 2.20.4, 1.19.6. Users unable to upgrade should restrict access to the `geoserver/web` and `geoserver/rest` via a firewall and ensure that the GeoWebCache is not remotely accessible.
CVSS Score: 7.2 (HIGH)
CWE: CWE-20, CWE-917
References: https://github.com/geoserver/geoserver/security/advisories/GHSA-4pm3-f52j-8ggh; https://github.com/geoserver/geoserver/security/advisories/GHSA-4pm3-f52j-8ggh
CVE: CVE-2021-43154
Published: 2022-04-13
Description: Cross Site Scripting (XSS) vulnerability exists in CMS Made Simple 2.2.15 via the Name field in an Add Category action in moduleinterface.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://elprofesor.me/2021/10/24/stored-cross-site-scripting-via-m1-name-authenticated; https://elprofesor.me/2021/10/24/stored-cross-site-scripting-via-m1-name-authenticated
CVE: CVE-2022-1350
Published: 2022-04-14
Description: A vulnerability classified as problematic was found in GhostPCL 9.55.0. This vulnerability affects the function chunk_free_object of the file gsmchunk.c. The manipulation with a malicious file leads to a memory corruption. The attack can be initiated remotely but requires user interaction. The exploit has been disclosed to the public as a POC and may be used. It is recommended to apply the patches to fix this issue.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119, CWE-787
References: https://bugs.ghostscript.com/attachment.cgi?id=22323; https://bugs.ghostscript.com/show_bug.cgi?id=705156; https://vuldb.com/?id.197290
CVE: CVE-2022-1279
Published: 2022-04-14
Description: A vulnerability in the encryption implementation of EBICS messages in the open source librairy ebics-java/ebics-java-client allows an attacker sniffing network traffic to decrypt EBICS payloads. This issue affects: ebics-java/ebics-java-client versions prior to 1.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-325
References: https://github.com/ebics-java/ebics-java-client/releases/tag/1.2; https://github.com/ebics-java/ebics-java-client/releases/tag/1.2
CVE: CVE-2022-1351
Published: 2022-04-14
Description: Stored XSS in Tooltip in GitHub repository pimcore/pimcore prior to 10.4.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/pimcore/pimcore/commit/8c39a8b8f14dce078b31f61c4da599ca6f8fc7ac; https://huntr.dev/bounties/c23ae6c2-2e53-4bf5-85b0-e[PII_REDACTED]5; https://github.com/pimcore/pimcore/commit/8c39a8b8f14dce078b31f61c4da599ca6f8fc7ac
CVE: CVE-2021-43287
Published: 2022-04-14
Description: An issue was discovered in ThoughtWorks GoCD before 21.3.0. The business continuity add-on, which is enabled by default, leaks all secrets known to the GoCD server to unauthenticated attackers.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://blog.sonarsource.com/gocd-pre-auth-pipeline-takeover; https://github.com/gocd/gocd/commit/41abc210ac4e8cfa184483c9ff1c0cc04fb3511c; https://www.gocd.org/releases/#21-3-0
CVE: CVE-2021-43286
Published: 2022-04-14
Description: An issue was discovered in ThoughtWorks GoCD before 21.3.0. An attacker with privileges to create a new pipeline on a GoCD server can abuse a command-line injection in the Git URL "Test Connection" feature to execute arbitrary code.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: https://blog.sonarsource.com/gocd-vulnerability-chain; https://github.com/gocd/gocd/commit/2b77b533abcbb79c8fc758dec9984305dc1ade42; https://github.com/gocd/gocd/commit/6fa9fb7a7c91e760f1adc2593acdd50f2d78676b
CVE: CVE-2021-43288
Published: 2022-04-14
Description: An issue was discovered in ThoughtWorks GoCD before 21.3.0. An attacker in control of a GoCD Agent can plant malicious JavaScript into a failed Job Report.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://blog.sonarsource.com/gocd-vulnerability-chain; https://github.com/gocd/gocd/commit/f5c1d2aa9ab302a97898a6e4b16218e64fe8e9e4; https://www.gocd.org/releases/#21-3-0
CVE: CVE-2021-43289
Published: 2022-04-14
Description: An issue was discovered in ThoughtWorks GoCD before 21.3.0. An attacker who has compromised a GoCD agent can upload a malicious file into an arbitrary directory of a GoCD server, but does not control the filename.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://blog.sonarsource.com/gocd-vulnerability-chain; https://github.com/gocd/gocd/commit/4c4bb4780eb0d3fc4cacfc4cfcc0b07e2eaf0595; https://github.com/gocd/gocd/commit/c22e0428164af25d3e91baabd3f538a41cadc82f
CVE: CVE-2021-43290
Published: 2022-04-14
Description: An issue was discovered in ThoughtWorks GoCD before 21.3.0. An attacker who has compromised a GoCD agent can upload a malicious file into a directory of a GoCD server. They can control the filename but the directory is placed inside of a directory that they can't control.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://blog.sonarsource.com/gocd-vulnerability-chain; https://github.com/gocd/gocd/commit/4c4bb4780eb0d3fc4cacfc4cfcc0b07e2eaf0595; https://github.com/gocd/gocd/commit/c22e0428164af25d3e91baabd3f538a41cadc82f
CVE: CVE-2021-43633
Published: 2022-04-14
Description: Sourcecodester Messaging Web Application 1.0 is vulnerable to stored XSS. If a sender inserts valid scripts into the chat, the script will be executed on the receiver chat.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://medium.com/%40shaunwhorton/how-i-found-two-different-xss-vulnerabilities-a491144e8494; https://www.sourcecodester.com/php/14996/messaging-web-application-phpoop-free-source-code.html; https://medium.com/%40shaunwhorton/how-i-found-two-different-xss-vulnerabilities-a491144e8494
CVE: CVE-2022-26507
Published: 2022-04-14
Description: A heap-based buffer overflow exists in XML Decompression DecodeTreeBlock in AT&T Labs Xmill 0.7. A crafted input file can lead to remote code execution. This is not the same as any of: CVE-2021-21810, CVE-2021-21811, CVE-2021-21812, CVE-2021-21815, CVE-2021-21825, CVE-2021-21826, CVE-2021-21828, CVE-2021-21829, or CVE-2021-21830. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://Claroty.com; https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-222-02; https://Claroty.com
CVE: CVE-2022-27444
Published: 2022-04-14
Description: MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/item_subselect.cc.
CVSS Score: 7.5 (HIGH)
References: https://jira.mariadb.org/browse/MDEV-28080; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://jira.mariadb.org/browse/MDEV-28080
CVE: CVE-2022-27445
Published: 2022-04-14
Description: MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/sql_window.cc.
CVSS Score: 7.5 (HIGH)
References: https://jira.mariadb.org/browse/MDEV-28081; https://lists.debian.org/debian-lts-announce/2022/09/msg00023.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2022-27446
Published: 2022-04-14
Description: MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/item_cmpfunc.h.
CVSS Score: 7.5 (HIGH)
References: https://jira.mariadb.org/browse/MDEV-28082; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://jira.mariadb.org/browse/MDEV-28082
CVE: CVE-2022-27447
Published: 2022-04-14
Description: MariaDB Server v10.9 and below was discovered to contain a use-after-free via the component Binary_string::free_buffer() at /sql/sql_string.h.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416
References: https://jira.mariadb.org/browse/MDEV-28099; https://lists.debian.org/debian-lts-announce/2022/09/msg00023.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2022-27448
Published: 2022-04-14
Description: There is an Assertion failure in MariaDB Server v10.9 and below via 'node->pcur->rel_pos == BTR_PCUR_ON' at /row/row0mysql.cc.
CVSS Score: 7.5 (HIGH)
CWE: CWE-617
References: https://jira.mariadb.org/browse/MDEV-28095; https://lists.debian.org/debian-lts-announce/2022/09/msg00023.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2022-27449
Published: 2022-04-14
Description: MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/item_func.cc:148.
CVSS Score: 7.5 (HIGH)
References: https://jira.mariadb.org/browse/MDEV-28089; https://lists.debian.org/debian-lts-announce/2022/09/msg00023.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2022-27451
Published: 2022-04-14
Description: MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/field_conv.cc.
CVSS Score: 7.5 (HIGH)
References: https://jira.mariadb.org/browse/MDEV-28094; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://jira.mariadb.org/browse/MDEV-28094
CVE: CVE-2022-27452
Published: 2022-04-14
Description: MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/item_cmpfunc.cc.
CVSS Score: 7.5 (HIGH)
References: https://jira.mariadb.org/browse/MDEV-28090; https://lists.debian.org/debian-lts-announce/2022/09/msg00023.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2022-27455
Published: 2022-04-14
Description: MariaDB Server v10.6.3 and below was discovered to contain an use-after-free in the component my_wildcmp_8bit_impl at /strings/ctype-simple.c.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416
References: https://jira.mariadb.org/browse/MDEV-28097; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://jira.mariadb.org/browse/MDEV-28097
CVE: CVE-2022-27456
Published: 2022-04-14
Description: MariaDB Server v10.6.3 and below was discovered to contain an use-after-free in the component VDec::VDec at /sql/sql_type.cc.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416
References: https://jira.mariadb.org/browse/MDEV-28093; https://lists.debian.org/debian-lts-announce/2022/09/msg00023.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2022-27457
Published: 2022-04-14
Description: MariaDB Server v10.6.3 and below was discovered to contain an use-after-free in the component my_mb_wc_latin1 at /strings/ctype-latin1.c.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416
References: https://jira.mariadb.org/browse/MDEV-28098; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://jira.mariadb.org/browse/MDEV-28098
CVE: CVE-2022-27458
Published: 2022-04-14
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2022-27447. Reason: This candidate is a reservation duplicate of CVE-2022-27447. Notes: All CVE users should reference CVE-2022-27447 instead of this candidate.