deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-36525
Published: 2022-08-15
Description: D-Link Go-RT-AC750 GORTAC750_revA_v101b03 & GO-RT-AC750_revB_FWv200b02 is vulnerable to Buffer Overflow via authenticationcgi_main.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://drive.google.com/file/d/1IGtqvX2y-8GIwBsK6yi04AGfIzAXXvzW/view?usp=sharing; https://www.dlink.com/en/security-bulletin/; https://drive.google.com/file/d/1IGtqvX2y-8GIwBsK6yi04AGfIzAXXvzW/view?usp=sharing
CVE: CVE-2022-36526
Published: 2022-08-15
Description: D-Link GO-RT-AC750 GORTAC750_revA_v101b03 & GO-RT-AC750_revB_FWv200b02 is vulnerable to Authentication Bypass via function phpcgi_main in cgibin.
CVSS Score: 7.5 (HIGH)
References: http://d-link.com; https://drive.google.com/file/d/1ji5Ph6c-qgp0lBvbY8BZJjeqbju3VeK8/view?usp=sharing; https://www.dlink.com/en/security-bulletin/
CVE: CVE-2022-24654
Published: 2022-08-15
Description: Authenticated stored cross-site scripting (XSS) vulnerability in "Field Server Address" field in INTELBRAS ATA 200 Firmware 74.19.10.21 allows attackers to inject JavaScript code through a crafted payload.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://intelbras.com; https://github.com/leonardobg/CVE-2022-24654; https://packetstormsecurity.com/files/168064/Intelbras-ATA-200-Cross-Site-Scripting.html
CVE: CVE-2022-35978
Published: 2022-08-15
Description: Minetest is a free open-source voxel game engine with easy modding and game creation. In **single player**, a mod can set a global setting that controls the Lua script loaded to display the main menu. The script is then loaded as soon as the game session is exited. The Lua environment the menu runs in is not sandboxed and can directly interfere with the user's system. There are currently no known workarounds.
CVSS Score: 7.7 (HIGH)
CWE: CWE-693
References: https://dev.minetest.net/Changelog#5.5.0_.E2.86.92_5.6.0; https://github.com/minetest/minetest/commit/da71e86633d0b27cd02d7aac9fdac625d141ca13; https://github.com/minetest/minetest/security/advisories/GHSA-663q-pcjw-27cc
CVE: CVE-2022-36010
Published: 2022-08-15
Description: This library allows strings to be parsed as functions and stored as a specialized component, [`JsonFunctionValue`](https://github.com/oxyno-zeta/react-editable-json-tree/blob/09a0ca97835b0834ad054563e2fddc6f22bc5d8c/src/components/JsonFunctionValue.js). To do this, Javascript's [`eval`](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval) function is used to execute strings that begin with "function" as Javascript. This unfortunately could allow arbitrary code to be executed if it exists as a value within the JSON structure being displayed. Given that this component may often be used to display data from arbitrary, untrusted sources, this is extremely dangerous. One important note is that users who have defined a custom [`onSubmitValueParser`](https://github.com/oxyno-zeta/react-editable-json-tree/tree/09a0ca97835b0834ad054563e2fddc6f22bc5d8c#onsubmitvalueparser) callback prop on the [`JsonTree`](https://github.com/oxyno-zeta/react-editable-json-tree/blob/09a0ca97835b0834ad054563e2fddc6f22bc5d8c/src/JsonTree.js) component should be ***unaffected***. This vulnerability exists in the default `onSubmitValueParser` prop which calls [`parse`](https://github.com/oxyno-zeta/react-editable-json-tree/blob/master/src/utils/parse.js#L30). Prop is added to `JsonTree` called `allowFunctionEvaluation`. This prop will be set to `true` in v2.2.2, which allows upgrade without losing backwards-compatibility. In v2.2.2, we switched from using `eval` to using [`Function`](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Function) to construct anonymous functions. This is better than `eval` for the following reasons: - Arbitrary code should not be able to execute immediately, since the `Function` constructor explicitly *only creates* anonymous functions - Functions are created without local closures, so they only have access to the global scope If you use: - **Version `<2.2.2`**, you must upgrade as soon as possible. - **Version `^2.2.2`**, you must explicitly set `JsonTree`'s `allowFunctionEvaluation` prop to `false` to fully mitigate this vulnerability. - **Version `>=3.0.0`**, `allowFunctionEvaluation` is already set to `false` by default, so no further steps are necessary.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-95
References: https://github.com/oxyno-zeta/react-editable-json-tree/releases/tag/2.2.2; https://github.com/oxyno-zeta/react-editable-json-tree/security/advisories/GHSA-j3rv-w43q-f9x2; https://github.com/oxyno-zeta/react-editable-json-tree/releases/tag/2.2.2
CVE: CVE-2020-21365
Published: 2022-08-15
Description: Directory traversal vulnerability in wkhtmltopdf through 0.12.5 allows remote attackers to read local files and disclose sensitive information via a crafted html file running with the default configurations.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://github.com/wkhtmltopdf/wkhtmltopdf/issues/4536; https://lists.debian.org/debian-lts-announce/2022/10/msg00027.html; https://github.com/wkhtmltopdf/wkhtmltopdf/issues/4536
CVE: CVE-2020-21641
Published: 2022-08-15
Description: Out-of-Band XML External Entity (OOB-XXE) vulnerability in Zoho ManageEngine Analytics Plus before 4.3.5 allows remote attackers to read arbitrary files, enumerate folders and scan internal ports via crafted XML license file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-611
References: https://www.manageengine.com/analytics-plus/release-notes.html; https://www.manageengine.com/analytics-plus/release-notes.html
CVE: CVE-2020-21642
Published: 2022-08-15
Description: Directory Traversal vulnerability ZDBQAREFSUBDIR parameter in /zropusermgmt API in Zoho ManageEngine Analytics Plus before 4350 allows remote attackers to run arbitrary code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://www.manageengine.com/analytics-plus/release-notes.html; https://www.manageengine.com/analytics-plus/release-notes.html
CVE: CVE-2020-23622
Published: 2022-08-15
Description: An issue in the UPnP protocol in 4thline cling 2.0.0 through 2.1.2 allows remote attackers to cause a denial of service via an unchecked CALLBACK parameter in the request header
CVSS Score: 7.5 (HIGH)
CWE: CWE-918
References: https://github.com/4thline/cling/issues/253; https://zh-cn.tenable.com/blog/cve-2020-12695-callstranger-vulnerability-in-universal-plug-and-play-upnp-puts-billions-of?tns_redirect=true; https://github.com/4thline/cling/issues/253
CVE: CVE-2021-33235
Published: 2022-08-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2022-34035. Reason: This candidate is a duplicate of CVE-2022-34035. Notes: All CVE users should reference CVE-2022-34035 instead of this candidate.
CVE: CVE-2021-33236
Published: 2022-08-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2022-34033. Reason: This candidate is a duplicate of CVE-2022-34033. Notes: All CVE users should reference CVE-2022-34033 instead of this candidate.
CVE: CVE-2022-37440
Published: 2022-08-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none
CVE: CVE-2022-37441
Published: 2022-08-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none
CVE: CVE-2022-37442
Published: 2022-08-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none
CVE: CVE-2022-37443
Published: 2022-08-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none
CVE: CVE-2022-37444
Published: 2022-08-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none
CVE: CVE-2022-37445
Published: 2022-08-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none
CVE: CVE-2022-37446
Published: 2022-08-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none
CVE: CVE-2022-37447
Published: 2022-08-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none
CVE: CVE-2022-37448
Published: 2022-08-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none
CVE: CVE-2022-37449
Published: 2022-08-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none
CVE: CVE-2022-34711
Published: 2022-08-15
Description: Windows Defender Credential Guard Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-34711; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-34711
CVE: CVE-2022-35822
Published: 2022-08-15
Description: Windows Defender Credential Guard Security Feature Bypass Vulnerability
CVSS Score: 7.1 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-35822; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-35822
CVE: CVE-2022-38186
Published: 2022-08-15
Description: There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.8.1 and below which may allow a remote attacker able to convince a user to click on a crafted link which could potentially execute arbitrary JavaScript code in the victim’s browser.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/portal-for-arcgis-security-2022-update-1-patch/; https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/portal-for-arcgis-security-2022-update-1-patch/
CVE: CVE-2022-38187
Published: 2022-08-15
Description: Prior to version 10.9.0, the sharing/rest/content/features/analyze endpoint is always accessible to anonymous users, which could allow an unauthenticated attacker to induce Esri Portal for ArcGIS to read arbitrary URLs.
CVSS Score: 7.5 (HIGH)
CWE: CWE-918
References: https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/portal-for-arcgis-security-2022-update-1-patch/; https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/portal-for-arcgis-security-2022-update-1-patch/
CVE: CVE-2022-38188
Published: 2022-08-15
Description: There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.9.1 which may allow a remote attacker able to convince a user to click on a crafted link which could potentially execute arbitrary JavaScript code in the victim’s browser.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/portal-for-arcgis-security-2022-update-1-patch/; https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/portal-for-arcgis-security-2022-update-1-patch/
CVE: CVE-2022-38190
Published: 2022-08-15
Description: A stored Cross Site Scripting (XSS) vulnerability in Esri Portal for ArcGIS configurable apps may allow a remote, unauthenticated attacker to pass and store malicious strings via crafted queries which when accessed could potentially execute arbitrary JavaScript code in the user’s browser
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/portal-for-arcgis-security-2022-update-1-patch/; https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/portal-for-arcgis-security-2022-update-1-patch/
CVE: CVE-2022-38191
Published: 2022-08-15
Description: There is an HTML injection issue in Esri Portal for ArcGIS versions 10.9.0 and below which may allow a remote, authenticated attacker to inject HTML into some locations in the home application.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-74, CWE-79
References: https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/portal-for-arcgis-security-2022-update-1-patch/; https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/portal-for-arcgis-security-2022-update-1-patch/
CVE: CVE-2022-2816
Published: 2022-08-15
Description: Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.0212.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://github.com/vim/vim/commit/dbdd16b62560413abcc3c8e893cc3010ccf31666; https://huntr.dev/bounties/e2a83037-fcf9-4218-b2b9-b7507dacde58; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CHFAR6OY6G77M6GXCJT75A4KITLNR6GO/
CVE: CVE-2022-38368
Published: 2022-08-15
Description: An issue was discovered in Aviatrix Gateway before 6.6.5712 and 6.7.x before 6.7.1376. Because Gateway API functions mishandle authentication, an authenticated VPN user can inject arbitrary commands.
CVSS Score: 8.8 (HIGH)
CWE: CWE-287
References: https://docs.aviatrix.com/HowTos/PSIRT_Advisories.html#aviatrix-controller-and-gateways-unauthorized-access; https://docs.aviatrix.com/HowTos/PSIRT_Advisories.html#aviatrix-controller-and-gateways-unauthorized-access
CVE: CVE-2022-28756
Published: 2022-08-15
Description: The Zoom Client for Meetings for macOS (Standard and for IT Admin) starting with version 5.7.3 and before 5.11.5 contains a vulnerability in the auto update process. A local low-privileged user could exploit this vulnerability to escalate their privileges to root.
CVSS Score: 8.8 (HIGH)
CWE: CWE-347
References: https://explore.zoom.us/en/trust/security/security-bulletin/; https://explore.zoom.us/en/trust/security/security-bulletin/
CVE: CVE-2022-2817
Published: 2022-08-15
Description: Use After Free in GitHub repository vim/vim prior to 9.0.0213.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://github.com/vim/vim/commit/249e1b903a9c0460d618f6dcc59aeb8c03b24b20; https://huntr.dev/bounties/a7b7d242-3d88-4bde-a681-6c986aff886f; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CHFAR6OY6G77M6GXCJT75A4KITLNR6GO/
CVE: CVE-2022-38357
Published: 2022-08-15
Description: Improper neutralization of special elements leaves the Eyes of Network Web application vulnerable to an iFrame injection attack, via the url parameter of /module/module_frame/index.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-74
References: https://www.tenable.com/security/research/tra-2022-29; https://www.tenable.com/security/research/tra-2022-29
CVE: CVE-2022-38358
Published: 2022-08-15
Description: Improper neutralization of input during web page generation leaves the Eyes of Network web application vulnerable to cross-site scripting attacks at /module/admin_notifiers/rules.php and /module/report_event/indext.php via the parameters rule_notification, rule_name, and rule_name_old, and at /module/admin_user/add_modify_user.php via the parameters user_name and user_email.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.tenable.com/security/research/tra-2022-29; https://www.tenable.com/security/research/tra-2022-29
CVE: CVE-2022-38359
Published: 2022-08-15
Description: Cross-site request forgery attacks can be carried out against the Eyes of Network web application, due to an absence of adequate protections. An attacker can, for instance, delete the admin user by directing an authenticated user to the URL https://<target-address>/module/admin_user/index.php?DataTables_Table_0_length=10&user_selected%5B%5D=1&user_mgt_list=delete_user&action=submit by means of a crafted link.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://www.tenable.com/security/research/tra-2022-29; https://www.tenable.com/security/research/tra-2022-29
CVE: CVE-2022-24949
Published: 2022-08-16
Description: A privilege escalation to root exists in Eternal Terminal prior to version 6.2.0. This is due to the combination of a race condition, buffer overflow, and logic bug all in PipeSocketHandler::listen().
CVSS Score: 7.5 (HIGH)
CWE: CWE-362, CWE-120, CWE-362
References: https://github.com/MisterTea/EternalTerminal/commit/900348bb8bc96e1c7ba4888ac8480f643c43d3c3; https://github.com/metaredteam/external-disclosures/security/advisories/GHSA-hxg8-4r3q-p9rv; https://github.com/MisterTea/EternalTerminal/commit/900348bb8bc96e1c7ba4888ac8480f643c43d3c3
CVE: CVE-2022-24950
Published: 2022-08-16
Description: A race condition exists in Eternal Terminal prior to version 6.2.0 that allows an authenticated attacker to hijack other users' SSH authorization socket, enabling the attacker to login to other systems as the targeted users. The bug is in UserTerminalRouter::getInfoForId().
CVSS Score: 7.5 (HIGH)
CWE: CWE-362, CWE-362
References: http://www.openwall.com/lists/oss-security/2023/02/16/1; https://github.com/MisterTea/EternalTerminal/commit/900348bb8bc96e1c7ba4888ac8480f643c43d3c3; https://github.com/metaredteam/external-disclosures/security/advisories/GHSA-85gw-pchc-4rf3
CVE: CVE-2022-24951
Published: 2022-08-16
Description: A race condition exists in Eternal Terminal prior to version 6.2.0 which allows a local attacker to hijack Eternal Terminal's IPC socket, enabling access to Eternal Terminal clients which attempt to connect in the future.
CVSS Score: 7.0 (HIGH)
CWE: CWE-362, CWE-362
References: http://www.openwall.com/lists/oss-security/2023/02/16/1; https://github.com/MisterTea/EternalTerminal/releases/tag/et-v6.2.0; https://github.com/metaredteam/external-disclosures/security/advisories/GHSA-546v-59j5-g95q
CVE: CVE-2022-24952
Published: 2022-08-16
Description: Several denial of service vulnerabilities exist in Eternal Terminal prior to version 6.2.0, including a DoS triggered remotely by an invalid sequence number and a local bug triggered by invalid input sent directly to the IPC socket.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20, CWE-20
References: http://www.openwall.com/lists/oss-security/2023/02/16/1; https://github.com/MisterTea/EternalTerminal/releases/tag/et-v6.2.0; https://github.com/metaredteam/external-disclosures/security/advisories/GHSA-8cw3-6r98-g7cw
CVE: CVE-2022-36306
Published: 2022-08-16
Description: An authenticated attacker can enumerate and download sensitive files, including the eNodeB's web management UI's TLS private key, the web server binary, and the web server configuration file. These vulnerabilities were found in AirVelocity 1500 running software version 9.3.0.01249, were still present in 15.18.00.2511, and may affect other AirVelocity and AirSpeed models.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-219, CWE-552
References: https://github.com/metaredteam/external-disclosures/security/advisories/GHSA-9v93-3qpc-hxj9; https://helpdesk.airspan.com/browse/TRN3-1691; https://github.com/metaredteam/external-disclosures/security/advisories/GHSA-9v93-3qpc-hxj9
CVE: CVE-2022-36307
Published: 2022-08-16
Description: The AirVelocity 1500 prints SNMP credentials on its physically accessible serial port during boot. This was fixed in AirVelocity 1500 software version 15.18.00.2511 and may affect other AirVelocity and AirSpeed models.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-522, CWE-522
References: https://github.com/metaredteam/external-disclosures/security/advisories/GHSA-8j75-qh6c-wpc5; https://helpdesk.airspan.com/browse/TRN3-1693; https://github.com/metaredteam/external-disclosures/security/advisories/GHSA-8j75-qh6c-wpc5
CVE: CVE-2022-36308
Published: 2022-08-16
Description: Airspan AirVelocity 1500 web management UI displays SNMP credentials in plaintext on software versions older than 15.18.00.2511, and stores SNMPv3 credentials unhashed on the filesystem, enabling anyone with web access to use these credentials to manipulate the eNodeB over SNMP. This issue may affect other AirVelocity and AirSpeed models.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-256, CWE-522
References: https://github.com/metaredteam/external-disclosures/security/advisories/GHSA-qjgc-rx8m-q58x; https://helpdesk.airspan.com/browse/TRN3-1692; https://github.com/metaredteam/external-disclosures/security/advisories/GHSA-qjgc-rx8m-q58x
CVE: CVE-2022-36309
Published: 2022-08-16
Description: Airspan AirVelocity 1500 software versions prior to 15.18.00.2511 have a root command injection vulnerability in the ActiveBank parameter of the recoverySubmit.cgi script running on the eNodeB's web management UI. This issue may affect other AirVelocity and AirSpeed models.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://github.com/metaredteam/external-disclosures/security/advisories/GHSA-p295-2jh6-g6g4; https://helpdesk.airspan.com/browse/TRN3-1690; https://github.com/metaredteam/external-disclosures/security/advisories/GHSA-p295-2jh6-g6g4
CVE: CVE-2022-36310
Published: 2022-08-16
Description: Airspan AirVelocity 1500 software prior to version 15.18.00.2511 had NET-SNMP-EXTEND-MIB enabled on its snmpd service, enabling an attacker with SNMP write abilities to execute commands as root on the eNodeB. This issue may affect other AirVelocity and AirSpeed models.
CVSS Score: 8.8 (HIGH)
CWE: CWE-242
References: https://github.com/metaredteam/external-disclosures/security/advisories/GHSA-whc6-2989-42xm; https://helpdesk.airspan.com/browse/TRN3-1689; https://github.com/metaredteam/external-disclosures/security/advisories/GHSA-whc6-2989-42xm
CVE: CVE-2022-36311
Published: 2022-08-16
Description: Airspan AirVelocity 1500 prior to software version 15.18.00.2511 is vulnerable to injection leading to XSS in the SNMP community field in the eNodeB's web management UI. This issue may affect other AirVelocity and AirSpeed models.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://helpdesk.airspan.com/browse/TRN3-1694; https://helpdesk.airspan.com/browse/TRN3-1694
CVE: CVE-2022-36312
Published: 2022-08-16
Description: Airspan AirVelocity 1500 software version 15.18.00.2511 lacks CSRF protections in the eNodeB's web management UI. This issue may affect other AirVelocity and AirSpeed models.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://helpdesk.airspan.com/browse/TRN3-1695; https://helpdesk.airspan.com/browse/TRN3-1695
CVE: CVE-2022-38216
Published: 2022-08-16
Description: An integer overflow exists in Mapbox's closed source gl-native library prior to version 10.6.1, which is bundled with multiple Mapbox products including open source libraries. The overflow is caused by large image height and width values when creating a new Image and allows for out of bounds writes, potentially crashing the Mapbox process.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190, CWE-190
References: https://github.com/mapbox/mapbox-maps-android/releases/tag/android-v10.6.1; https://github.com/mapbox/mapbox-maps-android/releases/tag/android-v10.6.1
CVE: CVE-2022-33939
Published: 2022-08-16
Description: CENTUM VP / CS 3000 controller FCS (CP31, CP33, CP345, CP401, and CP451) contains an issue in processing communication packets, which may lead to resource consumption. If this vulnerability is exploited, an attacker may cause a denial of service (DoS) condition in ADL communication by sending a specially crafted packet to the affected product.
CVSS Score: 7.5 (HIGH)
References: https://jvn.jp/vu/JVNVU94343729/index.html; https://web-material3.yokogawa.com/1/33029/files/YSAR-22-0008-E.pdf; https://web-material3.yokogawa.com/19/33029/files/YSAR-22-0008-J.pdf
CVE: CVE-2022-34156
Published: 2022-08-16
Description: 'Hulu / フールー' App for iOS versions prior to 3.0.81 improperly verifies server certificates, which may allow an attacker to eavesdrop on an encrypted communication via a man-in-the-middle attack.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-295
References: https://jvn.jp/en/jp/JVN81563390/index.html; https://jvn.jp/en/jp/JVN81563390/index.html