deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-28433
Published: 2022-08-02
Description: This affects all versions of package node-latex-pdf.
CVSS Score: 7.3 (HIGH)
CWE: CWE-77
References: https://security.snyk.io/vuln/SNYK-JS-NODELATEXPDF-1050426; https://security.snyk.io/vuln/SNYK-JS-NODELATEXPDF-1050426
CVE: CVE-2020-28434
Published: 2022-08-02
Description: This affects all versions of package gitblame. The injection point is located in line 15 in lib/gitblame.js.
CVSS Score: 9.4 (CRITICAL)
CWE: CWE-77
References: https://security.snyk.io/vuln/SNYK-JS-GITBLAME-1050430; https://security.snyk.io/vuln/SNYK-JS-GITBLAME-1050430
CVE: CVE-2020-28437
Published: 2022-08-02
Description: This affects all versions of package heroku-env. The injection point is located in lib/get.js which is required by index.js.
CVSS Score: 9.4 (CRITICAL)
CWE: CWE-77
References: https://security.snyk.io/vuln/SNYK-JS-HEROKUENV-1050432; https://security.snyk.io/vuln/SNYK-JS-HEROKUENV-1050432
CVE: CVE-2020-28451
Published: 2022-08-02
Description: This affects the package image-tiler before 2.0.2.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://github.com/MrP/image-tiler/commit/f4a0b13a4bf43655fc4013e04bbceaf77aecbeb8; https://security.snyk.io/vuln/SNYK-JS-IMAGETILER-1051029; https://github.com/MrP/image-tiler/commit/f4a0b13a4bf43655fc4013e04bbceaf77aecbeb8
CVE: CVE-2020-28453
Published: 2022-08-02
Description: This affects all versions of package npos-tesseract. The injection point is located in line 55 in lib/ocr.js.
CVSS Score: 9.4 (CRITICAL)
CWE: CWE-77
References: https://security.snyk.io/vuln/SNYK-JS-NPOSTESSERACT-1051031; https://security.snyk.io/vuln/SNYK-JS-NPOSTESSERACT-1051031
CVE: CVE-2020-7795
Published: 2022-08-02
Description: The package get-npm-package-version before 1.0.7 are vulnerable to Command Injection via main function in index.js.
CVSS Score: 7.3 (HIGH)
CWE: CWE-77
References: https://github.com/hoperyy/get-npm-package-version/blob/338a5882298eb2c2194538db41166cae13c39e03/index.js%23L17; https://github.com/hoperyy/get-npm-package-version/commit/40b1cf31a0607ea66f9e30a0c3af1383b52b2dec; https://security.snyk.io/vuln/SNYK-JS-GETNPMPACKAGEVERSION-1050390
CVE: CVE-2021-23385
Published: 2022-08-02
Description: This affects all versions of package Flask-Security. When using the get_post_logout_redirect and get_post_login_redirect functions, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as \\\evil.com/path. This vulnerability is only exploitable if an alternative WSGI server other than Werkzeug is used, or the default behaviour of Werkzeug is modified using 'autocorrect_location_header=False. **Note:** Flask-Security is not maintained anymore.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-601
References: https://github.com/mattupstate/flask-security; https://lists.debian.org/debian-lts-announce/2023/08/msg00034.html; https://security.snyk.io/vuln/SNYK-PYTHON-FLASKSECURITY-1293234
CVE: CVE-2022-25867
Published: 2022-08-02
Description: The package io.socket:socket.io-client before 2.0.1 are vulnerable to NULL Pointer Dereference when parsing a packet with with invalid payload format.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://github.com/socketio/socket.io-client-java/commit/8664499b6f31154f49783531f778dac5387b766b; https://github.com/socketio/socket.io-client-java/commit/e8ffe9d1383736f6a21090ab959a2f4fa5a41284; https://github.com/socketio/socket.io-client-java/issues/508%23issuecomment[PII_REDACTED]
CVE: CVE-2022-29154
Published: 2022-08-02
Description: An issue was discovered in rsync before 3.2.5 that allows malicious remote servers to write arbitrary files inside the directories of connecting peers. The server chooses which files/directories are sent to the client. However, the rsync client performs insufficient validation of file names. A malicious rsync server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the rsync client target directory and subdirectories (for example, overwrite the .ssh/authorized_keys file).
CVSS Score: 7.4 (HIGH)
CWE: CWE-20
References: http://www.openwall.com/lists/oss-security/2022/08/02/1; https://github.com/WayneD/rsync/tags; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NMBOJ77A7T7PQCARMDUK75TE6LLESZ3O/
CVE: CVE-2022-34613
Published: 2022-08-02
Description: Mealie 1.0.0beta3 contains an arbitrary file upload vulnerability which allows attackers to execute arbitrary code via a crafted file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://cwe.mitre.org/data/definitions/79.html; https://docs.mealie.io/changelog/v0.5.6/; https://gainsec.com/2022/08/02/cve-2022-34613-cve-2022-34618-cve-2022-34619-xss-file-upload-and-more/
CVE: CVE-2022-34618
Published: 2022-08-02
Description: A stored cross-site scripting (XSS) vulnerability in Mealie 1.0.0beta3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the recipe description text field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://cwe.mitre.org/data/definitions/79.html; https://docs.mealie.io/changelog/v0.5.6/; https://gainsec.com/2022/08/02/cve-2022-34613-cve-2022-34618-cve-2022-34619-xss-file-upload-and-more/
CVE: CVE-2022-1293
Published: 2022-08-02
Description: The embedded neutralization of Script-Related HTML Tag, was by-passed in the case of some extra conditions.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-80, CWE-79
References: https://www.ercom.com/security-updates; https://www.ercom.com/security-updates
CVE: CVE-2022-23733
Published: 2022-08-02
Description: A stored XSS vulnerability was identified in GitHub Enterprise Server that allowed the injection of arbitrary attributes. This injection was blocked by Github's Content Security Policy (CSP). This vulnerability affected all versions of GitHub Enterprise Server prior to 3.6 and was fixed in versions 3.3.11, 3.4.6 and 3.5.3. This vulnerability was reported via the GitHub Bug Bounty program.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://docs.github.com/en/enterprise-server%403.3/admin/release-notes#3.3.11; https://docs.github.com/en/enterprise-server%403.4/admin/release-notes#3.4.6; https://docs.github.com/en/enterprise-server%403.5/admin/release-notes#3.5.3
CVE: CVE-2022-34625
Published: 2022-08-02
Description: Mealie1.0.0beta3 was discovered to contain a Server-Side Template Injection vulnerability, which allows attackers to execute arbitrary code via a crafted Jinja2 template.
CVSS Score: 7.2 (HIGH)
CWE: CWE-94
References: https://cwe.mitre.org/data/definitions/1336.html; https://cwe.mitre.org/data/definitions/94.html; https://docs.mealie.io/changelog/v0.5.6/
CVE: CVE-2022-35217
Published: 2022-08-02
Description: The NHI card’s web service component has a stack-based buffer overflow vulnerability due to insufficient validation for network packet header length. A local area network attacker with general user privilege can exploit this vulnerability to execute arbitrary code, manipulate system command or disrupt service.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.twcert.org.tw/tw/cp-132-6353-31470-1.html; https://www.twcert.org.tw/tw/cp-132-6353-31470-1.html
CVE: CVE-2022-35218
Published: 2022-08-02
Description: The NHI card’s web service component has a heap-based buffer overflow vulnerability due to insufficient validation for packet origin parameter length. A LAN attacker with general user privilege can exploit this vulnerability to disrupt service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787, CWE-770
References: https://www.twcert.org.tw/tw/cp-132-6354-1cf61-1.html; https://www.twcert.org.tw/tw/cp-132-6354-1cf61-1.html
CVE: CVE-2022-35219
Published: 2022-08-02
Description: The NHI card’s web service component has a stack-based buffer overflow vulnerability due to insufficient validation for network packet key parameter. A LAN attacker with general user privilege can exploit this vulnerability to disrupt service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787, CWE-770
References: https://www.twcert.org.tw/tw/cp-132-6355-3bdab-1.html; https://www.twcert.org.tw/tw/cp-132-6355-3bdab-1.html
CVE: CVE-2022-35220
Published: 2022-08-02
Description: Teamplus Pro community discussion function has an ‘allocation of resource without limits or throttling’ vulnerability. A remote attacker with general user privilege posting a thread with large content can cause the receiving client device to allocate too much memory, leading to abnormal termination of this client’s Teamplus Pro application.
CVSS Score: 7.7 (HIGH)
CWE: CWE-770, CWE-770
References: https://www.twcert.org.tw/tw/cp-132-6359-f5d1c-1.html; https://www.twcert.org.tw/tw/cp-132-6359-f5d1c-1.html
CVE: CVE-2022-35221
Published: 2022-08-02
Description: Teamplus Pro community discussion has an ‘allocation of resource without limits or throttling’ vulnerability on thread subject field. A remote attacker with general user privilege posting a thread subject with large content can cause the server to allocate too much memory, leading to missing partial post content and disrupt partial service.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-770, CWE-770
References: https://www.twcert.org.tw/tw/cp-132-6360-7bf50-1.html; https://www.twcert.org.tw/tw/cp-132-6360-7bf50-1.html
CVE: CVE-2022-35222
Published: 2022-08-02
Description: HiCOS Citizen verification component has a stack-based buffer overflow vulnerability due to insufficient parameter length validation. An unauthenticated physical attacker can exploit this vulnerability to execute arbitrary code, manipulate system command or disrupt service.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://www.twcert.org.tw/tw/cp-132-6363-f5ec2-1.html; https://www.twcert.org.tw/tw/cp-132-6363-f5ec2-1.html
CVE: CVE-2022-35223
Published: 2022-08-02
Description: EasyUse MailHunter Ultimate’s cookie deserialization function has an inadequate validation vulnerability. Deserializing a cookie containing malicious payload will trigger this insecure deserialization vulnerability, allowing an unauthenticated remote attacker to execute arbitrary code, manipulate system command or interrupt service.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502, CWE-502
References: https://www.chtsecurity.com/news/a381467e-74ff-4a8c-a4d3-fc86720f5400; https://www.twcert.org.tw/tw/cp-132-6365-b056c-1.html; https://www.chtsecurity.com/news/a381467e-74ff-4a8c-a4d3-fc86720f5400
CVE: CVE-2022-2631
Published: 2022-08-02
Description: Improper Access Control in GitHub repository tooljet/tooljet prior to v1.19.0.
CVSS Score: 8.8 (HIGH)
CWE: CWE-284
References: https://github.com/tooljet/tooljet/commit/b9fa229bcae356cbb33300b31483e97e6ea140a7; https://huntr.dev/bounties/86881f9e-ca48-49b5-9782-3c406316930c; https://github.com/tooljet/tooljet/commit/b9fa229bcae356cbb33300b31483e97e6ea140a7
CVE: CVE-2022-30571
Published: 2022-08-02
Description: The iWay Service Manager Console component of TIBCO Software Inc.'s TIBCO iWay Service Manager contains easily exploitable Reflected Cross Site Scripting (XSS) vulnerabilities that allow a low privileged attacker with network access to execute scripts targeting the affected system or the victim's local system. Affected releases are TIBCO Software Inc.'s TIBCO iWay Service Manager: versions 8.0.6 and below.
CVSS Score: 8.1 (HIGH)
CWE: CWE-79
References: https://www.tibco.com/services/support/advisories; https://www.tibco.com/support/advisories/2022/07/tibco-security-advisory-august-2-2022-tibco-iway-sm-cve-2022-30571; https://www.tibco.com/services/support/advisories
CVE: CVE-2022-30572
Published: 2022-08-02
Description: The iWay Service Manager Console component of TIBCO Software Inc.'s TIBCO iWay Service Manager contains an easily exploitable Directory Traversal vulnerability that allows a low privileged attacker with network access to read arbitrary resources on the affected system. Affected releases are TIBCO Software Inc.'s TIBCO iWay Service Manager: versions 8.0.6 and below.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://www.tibco.com/services/support/advisories; https://www.tibco.com/support/advisories/2022/07/tibco-security-advisory-august-2-2022-tibco-iway-sm-cve-2022-30572; https://www.tibco.com/services/support/advisories
CVE: CVE-2022-35924
Published: 2022-08-02
Description: NextAuth.js is a complete open source authentication solution for Next.js applications. `next-auth` users who are using the `EmailProvider` either in versions before `4.10.3` or `3.29.10` are affected. If an attacker could forge a request that sent a comma-separated list of emails (eg.: `attacker@attacker.com,victim@victim.com`) to the sign-in endpoint, NextAuth.js would send emails to both the attacker and the victim's e-mail addresses. The attacker could then login as a newly created user with the email being `attacker@attacker.com,victim@victim.com`. This means that basic authorization like `email.endsWith("@victim.com")` in the `signIn` callback would fail to communicate a threat to the developer and would let the attacker bypass authorization, even with an `@attacker.com` address. This vulnerability has been patched in `v4.10.3` and `v3.29.10` by normalizing the email value that is sent to the sign-in endpoint before accessing it anywhere else. We also added a `normalizeIdentifier` callback on the `EmailProvider` configuration, where you can further tweak your requirements for what your system considers a valid e-mail address. (E.g.: strict RFC2821 compliance). Users are advised to upgrade. There are no known workarounds for this vulnerability. If for some reason you cannot upgrade, you can normalize the incoming request using Advanced Initialization.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-20, CWE-863
References: https://en.wikipedia.org/wiki/Email_address#Local-part; https://github.com/nextauthjs/next-auth/commit/afb1fcdae3cc30445038ef588e491d139b916003; https://github.com/nextauthjs/next-auth/security/advisories/GHSA-xv97-c62v-4587
CVE: CVE-2022-34924
Published: 2022-08-02
Description: Lanling OA Landray Office Automation (OA) internal patch number #133383/#137780 contains an arbitrary file read vulnerability via the component /sys/ui/extend/varkind/custom.jsp.
CVSS Score: 7.5 (HIGH)
CWE: CWE-312
References: https://codeantenna.com/a/DXQfemaZEH; https://developpaper.com/lanling-oa-foreground-arbitrary-file-reading-vulnerability-exploitation/; https://codeantenna.com/a/DXQfemaZEH
CVE: CVE-2022-35923
Published: 2022-08-02
Description: v8n is a javascript validation library. Versions of v8n prior to 1.5.1 were found to have an inefficient regular expression complexity in the `lowercase()` and `uppercase()` regex which could lead to a denial of service attack. In testing of the `lowercase()` function a payload of 'a' + 'a'.repeat(i) + 'A' with 32 leading characters took 29443 ms to execute. The same issue happens with uppercase(). Users are advised to upgrade. There are no known workarounds for this issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-1333
References: https://github.com/imbrn/v8n/commit/[PII_REDACTED]6fad190c05ec3f6e2bc73308dcd2f9; https://github.com/imbrn/v8n/security/advisories/GHSA-xrx9-gj26-5wx9; https://huntr.dev/bounties/2d92f644-593b-43b4-bfd1-c8042ac60609/
CVE: CVE-2022-35925
Published: 2022-08-02
Description: BookWyrm is a social network for tracking reading. Versions prior to 0.4.5 were found to lack rate limiting on authentication views which allows brute-force attacks. This issue has been patched in version 0.4.5. Admins with existing instances will need to update their `nginx.conf` file that was created when the instance was set up. Users are advised advised to upgrade. Users unable to upgrade may update their nginx.conf files with the changes manually.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-287, CWE-307
References: https://github.com/bookwyrm-social/bookwyrm/security/advisories/GHSA-jvp3-mqv8-5rjw; https://huntr.dev/bounties/ebee593d-3fd0-4985-bf5e-7e7927e08bf6/; https://www.github.com/bookwyrm-social/bookwyrm/commit/7bbe42fb30a79a26115524d18b697d895563c92f
CVE: CVE-2022-29807
Published: 2022-08-02
Description: A SQL injection vulnerability exists within Quest KACE Systems Management Appliance (SMA) through 12.0 that can allow for remote code execution via download_agent_installer.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://support.quest.com/kace-systems-management-appliance/kb/338162/quest-response-to-kace-sma-vulnerabilities-cve-2022-29807; https://support.quest.com/kb/338162; https://support.quest.com/kace-systems-management-appliance/kb/338162/quest-response-to-kace-sma-vulnerabilities-cve-2022-29807
CVE: CVE-2022-29808
Published: 2022-08-02
Description: In Quest KACE Systems Management Appliance (SMA) through 12.0, predictable token generation occurs when appliance linking is enabled.
CVSS Score: 7.5 (HIGH)
CWE: CWE-330
References: https://support.quest.com/kace-systems-management-appliance/kb/338163/quest-response-to-kace-sma-vulnerabilities-cve-2022-29808; https://support.quest.com/kb/338163; https://support.quest.com/kace-systems-management-appliance/kb/338163/quest-response-to-kace-sma-vulnerabilities-cve-2022-29808
CVE: CVE-2022-30285
Published: 2022-08-02
Description: In Quest KACE Systems Management Appliance (SMA) through 12.0, a hash collision is possible during authentication. This may allow authentication with invalid credentials.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-326
References: https://support.quest.com/kace-systems-management-appliance/kb/338232/quest-response-to-kace-sma-vulnerabilities-cve-2022-30285; https://www.quest.com/kace/; https://support.quest.com/kace-systems-management-appliance/kb/338232/quest-response-to-kace-sma-vulnerabilities-cve-2022-30285
CVE: CVE-2022-34619
Published: 2022-08-02
Description: A stored cross-site scripting (XSS) vulnerability in Mealie v0.5.5 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Shopping Lists item names text field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://cwe.mitre.org/data/definitions/79.html; https://docs.mealie.io/changelog/v0.5.6/; https://gainsec.com/2022/08/02/cve-2022-34613-cve-2022-34618-cve-2022-34619-xss-file-upload-and-more/
CVE: CVE-2022-36967
Published: 2022-08-02
Description: In Progress WS_FTP Server prior to version 8.7.3, multiple reflected cross-site scripting (XSS) vulnerabilities exist in the administrative web interface. It is possible for a remote attacker to inject arbitrary JavaScript into a WS_FTP administrator's web session. This would allow the attacker to execute code within the context of the victim's browser.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://community.progress.com/s/article/WS-FTP-Server-Critical-Security-Product-Alert-Bulletin-June-2022; https://www.progress.com/ws_ftp; https://community.progress.com/s/article/WS-FTP-Server-Critical-Security-Product-Alert-Bulletin-June-2022
CVE: CVE-2022-36968
Published: 2022-08-02
Description: In Progress WS_FTP Server prior to version 8.7.3, forms within the administrative interface did not include a nonce to mitigate the risk of cross-site request forgery (CSRF) attacks.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://community.progress.com/s/article/WS-FTP-Server-Critical-Security-Product-Alert-Bulletin-June-2022; https://www.progress.com/ws_ftp; https://community.progress.com/s/article/WS-FTP-Server-Critical-Security-Product-Alert-Bulletin-June-2022
CVE: CVE-2022-33917
Published: 2022-08-02
Description: An issue was discovered in the Arm Mali GPU Kernel Driver (Valhall r29p0 through r38p0). A non-privileged user can make improper GPU processing operations to gain access to already freed memory.
CVSS Score: 5.5 (MEDIUM)
References: http://packetstormsecurity.com/files/168147/Arm-Mali-CSF-VMA-Split-Mishandling.html; https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities; http://packetstormsecurity.com/files/168147/Arm-Mali-CSF-VMA-Split-Mishandling.html
CVE: CVE-2022-37035
Published: 2022-08-02
Description: An issue was discovered in bgpd in FRRouting (FRR) 8.3. In bgp_notify_send_with_data() and bgp_process_packet() in bgp_packet.c, there is a possible use-after-free due to a race condition. This could lead to Remote Code Execution or Information Disclosure by sending crafted BGP packets. User interaction is not needed for exploitation.
CVSS Score: 8.1 (HIGH)
CWE: CWE-362
References: https://docs.google.com/document/d/1TqYEcZbFeDTMKe2N4XRFwyAjw_mynIHfvzwbx1fmJj8/edit?usp=sharing; https://github.com/FRRouting/frr/issues/11698; https://lists.debian.org/debian-lts-announce/2024/04/msg00019.html
CVE: CVE-2022-34927
Published: 2022-08-03
Description: MilkyTracker v1.03.00 was discovered to contain a stack overflow via the component LoaderXM::load. This vulnerability is triggered when the program is supplied a crafted XM module file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/milkytracker/MilkyTracker/commit/3a5474f9102cbdc10fbd9e7b1b2c8d3f3f45d91b; https://github.com/milkytracker/MilkyTracker/issues/275; https://github.com/milkytracker/MilkyTracker/commit/3a5474f9102cbdc10fbd9e7b1b2c8d3f3f45d91b
CVE: CVE-2022-34928
Published: 2022-08-03
Description: JFinal CMS v5.1.0 was discovered to contain a SQL injection vulnerability via /system/user.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/jflyfox/jfinal_cms/issues/43; https://github.com/jflyfox/jfinal_cms/issues/43
CVE: CVE-2022-34937
Published: 2022-08-03
Description: Yuba u5cms v8.3.5 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component savepage.php. This vulnerability allows attackers to execute arbitrary code.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/u5cms/u5cms/issues/51; https://github.com/u5cms/u5cms/issues/51
CVE: CVE-2022-36197
Published: 2022-08-03
Description: BigTree CMS 4.4.16 was discovered to contain an arbitrary file upload vulnerability which allows attackers to execute arbitrary code via a crafted PDF file.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/bigtreecms/BigTree-CMS/issues/392; https://github.com/bigtreecms/BigTree-CMS/issues/392
CVE: CVE-2022-27616
Published: 2022-08-03
Description: Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in webapi component in Synology DiskStation Manager (DSM) before 7.0.1-42218-3 allows remote authenticated users to execute arbitrary commands via unspecified vectors.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://www.synology.com/security/advisory/Synology_SA_22_03; https://www.synology.com/security/advisory/Synology_SA_22_03
CVE: CVE-2022-34943
Published: 2022-08-03
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2022-34967
Published: 2022-08-03
Description: The assertion `stmt->Dbc->FirstStmt' failed in MonetDB Database Server v11.43.13.
CVSS Score: 7.5 (HIGH)
CWE: CWE-617
References: https://github.com/MonetDB/MonetDB/issues/7306; https://github.com/MonetDB/MonetDB/issues/7306
CVE: CVE-2022-34968
Published: 2022-08-03
Description: An issue in the fetch_step function in Percona Server for MySQL v8.0.28-19 allows attackers to cause a Denial of Service (DoS) via a SQL query.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://jira.percona.com/browse/PS-8294; https://jira.percona.com/browse/PS-8294
CVE: CVE-2022-34969
Published: 2022-08-03
Description: PingCAP TiDB v6.1.0 was discovered to contain a NULL pointer dereference.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://github.com/pingcap/tidb/issues/35310; https://github.com/pingcap/tidb/issues/35310
CVE: CVE-2022-27617
Published: 2022-08-03
Description: Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology Calendar before 2.3.4-0631 allows remote authenticated users to download arbitrary files via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: https://www.synology.com/security/advisory/Synology_SA_20_07; https://www.synology.com/security/advisory/Synology_SA_20_07