deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-35056
Published: 2022-10-14
Description: OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6b0478.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://drive.google.com/file/d/1OgmLjZ9VnEbzFh8tqyhPlVGJtdrhgfWz/view?usp=sharing; https://github.com/Cvjark/Poc/blob/main/otfcc/CVE-2022-35056.md; https://drive.google.com/file/d/1OgmLjZ9VnEbzFh8tqyhPlVGJtdrhgfWz/view?usp=sharing
CVE: CVE-2022-35058
Published: 2022-10-14
Description: OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6b05ce.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://drive.google.com/file/d/1nqWScJjiK05VUxhBxrtJbrc3WK2iA_WI/view?usp=sharing; https://github.com/Cvjark/Poc/blob/main/otfcc/CVE-2022-35058.md; https://drive.google.com/file/d/1nqWScJjiK05VUxhBxrtJbrc3WK2iA_WI/view?usp=sharing
CVE: CVE-2022-35059
Published: 2022-10-14
Description: OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6c0414.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://drive.google.com/file/d/1W9KM7OGlkMu1_7Y1mT_-eEbQJlRDfAJO/view?usp=sharing; https://github.com/Cvjark/Poc/blob/main/otfcc/CVE-2022-35059.md; https://drive.google.com/file/d/1W9KM7OGlkMu1_7Y1mT_-eEbQJlRDfAJO/view?usp=sharing
CVE: CVE-2022-3439
Published: 2022-10-14
Description: Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-770
References: https://github.com/ikus060/rdiffweb/commit/b78ec09f4582e363f6f449df6f987127e126c311; https://huntr.dev/bounties/37b86c45-b240-4626-bd53-b6f02d10e0d7; https://github.com/ikus060/rdiffweb/commit/b78ec09f4582e363f6f449df6f987127e126c311
CVE: CVE-2022-3504
Published: 2022-10-14
Description: A vulnerability was found in SourceCodester Sanitization Management System and classified as critical. This issue affects some unknown processing of the file /php-sms/?p=services/view_service. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-210839.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-707, CWE-89
References: https://github.com/Drun1baby/CVE_Pentest/blob/main/Sanitization%20Management%20System%20Project%20CMS/images/sqli.png; https://vuldb.com/?id.210839; https://github.com/Drun1baby/CVE_Pentest/blob/main/Sanitization%20Management%20System%20Project%20CMS/images/sqli.png
CVE: CVE-2022-3505
Published: 2022-10-14
Description: A vulnerability was found in SourceCodester Sanitization Management System. It has been classified as problematic. Affected is an unknown function of the file /php-sms/admin/. The manipulation of the argument page leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-210840.
CVSS Score: 3.5 (LOW)
CWE: CWE-707, CWE-79
References: https://github.com/Drun1baby/CVE_Pentest/blob/main/Sanitization%20Management%20System%20Project%20CMS/images/reflectedXSS.png; https://vuldb.com/?id.210840; https://github.com/Drun1baby/CVE_Pentest/blob/main/Sanitization%20Management%20System%20Project%20CMS/images/reflectedXSS.png
CVE: CVE-2022-3506
Published: 2022-10-14
Description: Cross-site Scripting (XSS) - Stored in GitHub repository barrykooij/related-posts-for-wp prior to 2.1.3.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/barrykooij/related-posts-for-wp/commit/37733398dd88863fc0bdb3d6d378598429fd0b81; https://huntr.dev/bounties/08251542-88f6-4264-9074-a[PII_REDACTED]8; https://github.com/barrykooij/related-posts-for-wp/commit/37733398dd88863fc0bdb3d6d378598429fd0b81
CVE: CVE-2022-28759
Published: 2022-10-14
Description: Zoom On-Premise Meeting Connector MMR before version 4.8.20220815.130 contains an improper access control vulnerability. As a result, a malicious actor could obtain the audio and video feed of a meeting they were not authorized to join and cause other meeting disruptions.
CVSS Score: 8.2 (HIGH)
CWE: CWE-284
References: https://explore.zoom.us/en/trust/security/security-bulletin/; https://explore.zoom.us/en/trust/security/security-bulletin/
CVE: CVE-2022-28760
Published: 2022-10-14
Description: Zoom On-Premise Meeting Connector MMR before version 4.8.20220815.130 contains an improper access control vulnerability. As a result, a malicious actor could obtain the audio and video feed of a meeting they were not authorized to join and cause other meeting disruptions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: https://explore.zoom.us/en/trust/security/security-bulletin/; https://explore.zoom.us/en/trust/security/security-bulletin/
CVE: CVE-2022-28761
Published: 2022-10-14
Description: Zoom On-Premise Meeting Connector MMR before version 4.8.20220916.131 contains an improper access control vulnerability. As a result, a malicious actor in a meeting or webinar they are authorized to join could prevent participants from receiving audio and video causing meeting disruptions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: https://explore.zoom.us/en/trust/security/security-bulletin/; https://explore.zoom.us/en/trust/security/security-bulletin/
CVE: CVE-2022-28762
Published: 2022-10-14
Description: Zoom Client for Meetings for macOS (Standard and for IT Admin) starting with 5.10.6 and prior to 5.12.0 contains a debugging port misconfiguration. When camera mode rendering context is enabled as part of the Zoom App Layers API by running certain Zoom Apps, a local debugging port is opened by the Zoom client. A local malicious user could use this debugging port to connect to and control the Zoom Apps running in the Zoom client.
CVSS Score: 7.3 (HIGH)
CWE: CWE-16
References: https://explore.zoom.us/en/trust/security/security-bulletin/; https://explore.zoom.us/en/trust/security/security-bulletin/
CVE: CVE-2022-2879
Published: 2022-10-14
Description: Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to allocate unbounded amounts of memory, potentially causing resource exhaustion or panics. After fix, Reader.Read limits the maximum size of header blocks to 1 MiB.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://go.dev/cl/439355; https://go.dev/issue/54853; https://groups.google.com/g/golang-announce/c/xtuG5faxtaU
CVE: CVE-2022-2880
Published: 2022-10-14
Description: Requests forwarded by ReverseProxy include the raw query parameters from the inbound request, including unparsable parameters rejected by net/http. This could permit query parameter smuggling when a Go proxy forwards a parameter with an unparsable value. After fix, ReverseProxy sanitizes the query parameters in the forwarded query when the outbound request's Form field is set after the ReverseProxy. Director function returns, indicating that the proxy has parsed the query parameters. Proxies which do not parse query parameters continue to forward the original query parameters unchanged.
CVSS Score: 7.5 (HIGH)
CWE: CWE-444
References: https://go.dev/cl/432976; https://go.dev/issue/54663; https://groups.google.com/g/golang-announce/c/xtuG5faxtaU
CVE: CVE-2022-32149
Published: 2022-10-14
Description: An attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to parse.
CVSS Score: 7.5 (HIGH)
CWE: CWE-772
References: https://go.dev/cl/442235; https://go.dev/issue/56152; https://groups.google.com/g/golang-announce/c/-hjNw559_tE/m/KlGTfid5CAAJ
CVE: CVE-2022-41686
Published: 2022-10-14
Description: OpenHarmony-v3.1.2 and prior versions, 3.0.6 and prior versions have an Out-of-bound memory read and write vulnerability in /dev/mmz_userdev device driver. The impact depends on the privileges of the attacker. The unprivileged process run on the device could read out-of-bound memory leading sensitive to information disclosure. The processes with system user UID run on the device would be able to write out-of-bound memory which could lead to unspecified memory corruption.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-787, CWE-125, CWE-787
References: https://gitee.com/openharmony/security/blob/master/en/security-disclosure/2022/2022-10.md; https://gitee.com/openharmony/security/blob/master/en/security-disclosure/2022/2022-10.md
CVE: CVE-2022-41715
Published: 2022-10-14
Description: Programs which compile regular expressions from untrusted sources may be vulnerable to memory exhaustion or denial of service. The parsed regexp representation is linear in the size of the input, but in some cases the constant factor can be as high as 40,000, making relatively small regexps consume much larger amounts of memory. After fix, each regexp being parsed is limited to a 256 MB memory footprint. Regular expressions whose representation would use more space than that are rejected. Normal use of regular expressions is unaffected.
CVSS Score: 7.5 (HIGH)
References: https://go.dev/cl/439356; https://go.dev/issue/55949; https://groups.google.com/g/golang-announce/c/xtuG5faxtaU
CVE: CVE-2022-42064
Published: 2022-10-14
Description: Online Diagnostic Lab Management System version 1.0 remote exploit that bypasses login with SQL injection and then uploads a shell.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://packetstormsecurity.com/files/168498/Online-Diagnostic-Lab-Management-System-1.0-SQL-Injection-Shell-Upload.html; https://packetstormsecurity.com/files/168498/Online-Diagnostic-Lab-Management-System-1.0-SQL-Injection-Shell-Upload.html
CVE: CVE-2022-42066
Published: 2022-10-14
Description: Online Examination System version 1.0 suffers from a cross site scripting vulnerability via index.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://packetstormsecurity.com/files/168549/Online-Examination-System-1.0-Cross-Site-Scripting.html; https://projectworlds.in/free-projects/php-projects/online-examination/; https://packetstormsecurity.com/files/168549/Online-Examination-System-1.0-Cross-Site-Scripting.html
CVE: CVE-2022-42069
Published: 2022-10-14
Description: Online Birth Certificate Management System version 1.0 suffers from a persistent Cross Site Scripting (XSS) vulnerability.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://packetstormsecurity.com/files/168529/Online-Birth-Certificate-Management-System-1.0-Cross-Site-Scripting.html; https://www.sourcecodester.com/php/15683/online-birth-certificate-management-system-php-free-download.html; https://packetstormsecurity.com/files/168529/Online-Birth-Certificate-Management-System-1.0-Cross-Site-Scripting.html
CVE: CVE-2022-42070
Published: 2022-10-14
Description: Online Birth Certificate Management System version 1.0 is vulnerable to Cross Site Request Forgery (CSRF).
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://packetstormsecurity.com/files/168522/Online-Birth-Certificate-Management-System-1.0-Cross-Site-Request-Forgery.html; https://www.sourcecodester.com/php/15683/online-birth-certificate-management-system-php-free-download.html; https://packetstormsecurity.com/files/168522/Online-Birth-Certificate-Management-System-1.0-Cross-Site-Request-Forgery.html
CVE: CVE-2022-42071
Published: 2022-10-14
Description: Online Birth Certificate Management System version 1.0 suffers from a Cross Site Scripting (XSS) Vulnerability.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://packetstormsecurity.com/files/168533/Online-Birth-Certificate-Management-System-1.0-Cross-Site-Scripting.html; https://www.sourcecodester.com/php/15683/online-birth-certificate-management-system-php-free-download.html; https://packetstormsecurity.com/files/168533/Online-Birth-Certificate-Management-System-1.0-Cross-Site-Scripting.html
CVE: CVE-2022-42463
Published: 2022-10-14
Description: OpenHarmony-v3.1.2 and prior versions have an authenication bypass vulnerability in a callback handler function of Softbus_server in communication subsystem. Attackers can launch attacks on distributed networks by sending Bluetooth rfcomm packets to any remote device and executing arbitrary commands.
CVSS Score: 8.3 (HIGH)
CWE: CWE-287, CWE-287
References: https://gitee.com/openharmony/security/blob/master/en/security-disclosure/2022/2022-10.md; https://gitee.com/openharmony/security/blob/master/en/security-disclosure/2022/2022-10.md
CVE: CVE-2022-42464
Published: 2022-10-14
Description: OpenHarmony-v3.1.2 and prior versions, 3.0.6 and prior versions have a Kernel memory pool override vulnerability in /dev/mmz_userdev device driver. The impact depends on the privileges of the attacker. The unprivileged process run on the device could disclose sensitive information including kernel pointer, which could be used in further attacks. The processes with system user UID run on the device would be able to mmap memory pools used by kernel and override them which could be used to gain kernel code execution on the device, gain root privileges, or cause device reboot.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-276, CWE-276
References: https://gitee.com/openharmony/security/blob/master/en/security-disclosure/2022/2022-10.md; https://gitee.com/openharmony/security/blob/master/en/security-disclosure/2022/2022-10.md
CVE: CVE-2022-42488
Published: 2022-10-14
Description: OpenHarmony-v3.1.2 and prior versions have a Missing permission validation vulnerability in param service of startup subsystem. An malicious application installed on the device could elevate its privileges to the root user, disable security features, or cause DoS by disabling particular services.
CVSS Score: 8.4 (HIGH)
CWE: CWE-287, CWE-862
References: https://gitee.com/openharmony/security/blob/master/en/security-disclosure/2022/2022-10.md; https://gitee.com/openharmony/security/blob/master/en/security-disclosure/2022/2022-10.md
CVE: CVE-2021-46839
Published: 2022-10-14
Description: The HW_KEYMASTER module has a vulnerability of missing bounds check on length.Successful exploitation of this vulnerability may cause malicious construction of data, which results in out-of-bounds access.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-125, CWE-125
References: https://consumer.huawei.com/en/support/bulletin/2022/10/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202210-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2022/10/
CVE: CVE-2021-46840
Published: 2022-10-14
Description: The HW_KEYMASTER module has an out-of-bounds access vulnerability in parameter set verification.Successful exploitation of this vulnerability may cause malicious construction of data, which results in out-of-bounds access.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-125, CWE-125
References: https://consumer.huawei.com/en/support/bulletin/2022/10/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202210-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2022/10/
CVE: CVE-2022-37603
Published: 2022-10-14
Description: A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.0 via the url variable in interpolateName.js.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1333, CWE-1333
References: https://github.com/webpack/loader-utils/blob/d9f4e23cf411d8556f8bac2d3bf05a6e0103b568/lib/interpolateName.js#L107; https://github.com/webpack/loader-utils/blob/d9f4e23cf411d8556f8bac2d3bf05a6e0103b568/lib/interpolateName.js#L38; https://github.com/webpack/loader-utils/issues/213
CVE: CVE-2022-38977
Published: 2022-10-14
Description: The HwAirlink module has a heap overflow vulnerability.Successful exploitation of this vulnerability may cause out-of-bounds writes, resulting in modification of sensitive data.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-787
References: https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202210-[PII_REDACTED]; https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202210-[PII_REDACTED]
CVE: CVE-2022-38980
Published: 2022-10-14
Description: The HwAirlink module has a heap overflow vulnerability in processing data packets of the proprietary protocol.Successful exploitation of this vulnerability may allow attackers to obtain process control permissions.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202210-[PII_REDACTED]; https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202210-[PII_REDACTED]
CVE: CVE-2022-38981
Published: 2022-10-14
Description: The HwAirlink module has an out-of-bounds read vulnerability.Successful exploitation of this vulnerability may cause information leakage.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125, CWE-125
References: https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202210-[PII_REDACTED]; https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202210-[PII_REDACTED]
CVE: CVE-2022-38982
Published: 2022-10-14
Description: The fingerprint module has service logic errors.Successful exploitation of this vulnerability will cause the phone lock to be cracked.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202210-[PII_REDACTED]; https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202210-[PII_REDACTED]
CVE: CVE-2022-38983
Published: 2022-10-14
Description: The BT Hfp Client module has a Use-After-Free (UAF) vulnerability.Successful exploitation of this vulnerability may result in arbitrary code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416, CWE-416
References: https://consumer.huawei.com/en/support/bulletin/2022/10/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202210-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2022/10/
CVE: CVE-2022-38984
Published: 2022-10-14
Description: The HIPP module has a vulnerability of not verifying the data transferred in the kernel space.Successful exploitation of this vulnerability will cause out-of-bounds read, which affects data confidentiality.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125, CWE-125
References: https://consumer.huawei.com/en/support/bulletin/2022/10/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202210-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2022/10/
CVE: CVE-2022-38985
Published: 2022-10-14
Description: The facial recognition module has a vulnerability in input validation.Successful exploitation of this vulnerability may affect data confidentiality.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-20
References: https://consumer.huawei.com/en/support/bulletin/2022/10/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202210-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2022/10/
CVE: CVE-2022-38986
Published: 2022-10-14
Description: The HIPP module has a vulnerability of bypassing the check of the data transferred in the kernel space.Successful exploitation of this vulnerability may cause out-of-bounds access to the HIPP module and page table tampering, affecting device confidentiality and availability.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-787
References: https://consumer.huawei.com/en/support/bulletin/2022/10/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202210-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2022/10/
CVE: CVE-2022-38998
Published: 2022-10-14
Description: The HISP module has a vulnerability of not verifying the data transferred in the kernel space.Successful exploitation of this vulnerability will cause out-of-bounds read, which affects data confidentiality.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125, CWE-125
References: https://consumer.huawei.com/en/support/bulletin/2022/10/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202210-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2022/10/
CVE: CVE-2022-39011
Published: 2022-10-14
Description: The HISP module has a vulnerability of bypassing the check of the data transferred in the kernel space.Successful exploitation of this vulnerability may cause unauthorized access to the HISP module.
CVSS Score: 7.5 (HIGH)
CWE: CWE-693
References: https://consumer.huawei.com/en/support/bulletin/2022/10/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202210-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2022/10/
CVE: CVE-2022-39064
Published: 2022-10-14
Description: An attacker sending a single malformed IEEE 802.15.4 (Zigbee) frame makes the TRÅDFRI bulb blink, and if they replay (i.e. resend) the same frame multiple times, the bulb performs a factory reset. This causes the bulb to lose configuration information about the Zigbee network and current brightness level. After this attack, all lights are on with full brightness, and a user cannot control the bulbs with either the IKEA Home Smart app or the TRÅDFRI remote control. The malformed Zigbee frame is an unauthenticated broadcast message, which means all vulnerable devices within radio range are affected. CVSS 3.1 Base Score 7.1 vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
CVSS Score: 8.1 (HIGH)
CWE: CWE-241
References: https://www.synopsys.com/blogs/software-security/cyrc-advisory-ikea-tradfri-smart-lighting/; https://www.synopsys.com/blogs/software-security/cyrc-advisory-ikea-tradfri-smart-lighting/
CVE: CVE-2022-39065
Published: 2022-10-14
Description: A single malformed IEEE 802.15.4 (Zigbee) frame makes the TRÅDFRI gateway unresponsive, such that connected lighting cannot be controlled with the IKEA Home Smart app and TRÅDFRI remote control. The malformed Zigbee frame is an unauthenticated broadcast message, which means all vulnerable devices within radio range are affected. CVSS 3.1 Base Score: 6.5 Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-241
References: https://www.synopsys.com/blogs/software-security/cyrc-advisory-ikea-tradfri-smart-lighting-gateway/; https://www.synopsys.com/blogs/software-security/cyrc-advisory-ikea-tradfri-smart-lighting-gateway/
CVE: CVE-2022-41576
Published: 2022-10-14
Description: The rphone module has a script that can be maliciously modified.Successful exploitation of this vulnerability may cause irreversible programs to be implanted on user devices.
CVSS Score: 7.8 (HIGH)
CWE: CWE-94
References: https://consumer.huawei.com/en/support/bulletin/2022/10/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202210-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2022/10/
CVE: CVE-2022-41577
Published: 2022-10-14
Description: The kernel server has a vulnerability of not verifying the length of the data transferred in the user space.Successful exploitation of this vulnerability may cause out-of-bounds read in the kernel, which affects the device confidentiality and availability.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125, CWE-125
References: https://consumer.huawei.com/en/support/bulletin/2022/10/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202210-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2022/10/
CVE: CVE-2022-41578
Published: 2022-10-14
Description: The MPTCP module has an out-of-bounds write vulnerability.Successful exploitation of this vulnerability may cause root privilege escalation attacks implemented by modifying program information.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://consumer.huawei.com/en/support/bulletin/2022/10/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202210-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2022/10/