deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-33643
Published: 2022-08-10
Description: An attacker who submits a crafted tar file with size in header struct being 0 may be able to trigger an calling of malloc(0) for a variable gnu_longlink, causing an out-of-bounds read.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-125, CWE-125
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4S4PJRCJLEAWN2EKXGLSOBTL7O57V7NC/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5YSHZY753R7XW6CIKJVAWI373WW3YRRJ/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7Q26QDNOJDOFYWMJWEIK5XR62M2FF6IJ/
CVE: CVE-2021-33644
Published: 2022-08-10
Description: An attacker who submits a crafted tar file with size in header struct being 0 may be able to trigger an calling of malloc(0) for a variable gnu_longname, causing an out-of-bounds read.
CVSS Score: 8.1 (HIGH)
CWE: CWE-125, CWE-125
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4S4PJRCJLEAWN2EKXGLSOBTL7O57V7NC/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5YSHZY753R7XW6CIKJVAWI373WW3YRRJ/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7Q26QDNOJDOFYWMJWEIK5XR62M2FF6IJ/
CVE: CVE-2021-33645
Published: 2022-08-10
Description: The th_read() function doesn’t free a variable t->th_buf.gnu_longlink after allocating memory, which may cause a memory leak.
CVSS Score: 7.5 (HIGH)
CWE: CWE-401, CWE-401
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4S4PJRCJLEAWN2EKXGLSOBTL7O57V7NC/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5YSHZY753R7XW6CIKJVAWI373WW3YRRJ/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7Q26QDNOJDOFYWMJWEIK5XR62M2FF6IJ/
CVE: CVE-2021-33646
Published: 2022-08-10
Description: The th_read() function doesn’t free a variable t->th_buf.gnu_longname after allocating memory, which may cause a memory leak.
CVSS Score: 7.5 (HIGH)
CWE: CWE-401, CWE-401
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4S4PJRCJLEAWN2EKXGLSOBTL7O57V7NC/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5YSHZY753R7XW6CIKJVAWI373WW3YRRJ/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7Q26QDNOJDOFYWMJWEIK5XR62M2FF6IJ/
CVE: CVE-2021-39696
Published: 2022-08-10
Description: In Task.java, there is a possible escalation of privilege due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12Android ID: A-185810717
CVSS Score: 7.8 (HIGH)
References: https://source.android.com/security/bulletin/2022-08-01; https://source.android.com/security/bulletin/2022-08-01
CVE: CVE-2021-40030
Published: 2022-08-10
Description: The My HUAWEI app has a defect in the design. Successful exploitation of this vulnerability may affect data confidentiality.
CVSS Score: 7.5 (HIGH)
References: https://consumer.huawei.com/en/support/bulletin/2022/8/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202208-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2022/8/
CVE: CVE-2021-40034
Published: 2022-08-10
Description: The video framework has the memory overwriting vulnerability caused by addition overflow. Successful exploitation of this vulnerability may affect the availability.
CVSS Score: 7.5 (HIGH)
References: https://consumer.huawei.com/en/support/bulletin/2022/8/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202208-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2022/8/
CVE: CVE-2021-40040
Published: 2022-08-10
Description: Vulnerability of writing data to an arbitrary address in the HW_KEYMASTER module. Successful exploitation of this vulnerability may affect confidentiality.
CVSS Score: 7.5 (HIGH)
References: https://consumer.huawei.com/en/support/bulletin/2022/8/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202209-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2022/8/
CVE: CVE-2021-46778
Published: 2022-08-10
Description: Execution unit scheduler contention may lead to a side channel vulnerability found on AMD CPU microarchitectures codenamed “Zen 1”, “Zen 2” and “Zen 3” that use simultaneous multithreading (SMT). By measuring the contention level on scheduler queues an attacker may potentially leak sensitive information.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-203
References: https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1039; https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1039
CVE: CVE-2022-1705
Published: 2022-08-10
Description: Acceptance of some invalid Transfer-Encoding headers in the HTTP/1 client in net/http before Go 1.17.12 and Go 1.18.4 allows HTTP request smuggling if combined with an intermediate server that also improperly fails to reject the header as invalid.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-444
References: https://go.dev/cl/409874; https://go.dev/cl/410714; https://go.dev/issue/53188
CVE: CVE-2022-1962
Published: 2022-08-10
Description: Uncontrolled recursion in the Parse functions in go/parser before Go 1.17.12 and Go 1.18.4 allow an attacker to cause a panic due to stack exhaustion via deeply nested types or declarations.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-674
References: https://go.dev/cl/417063; https://go.dev/issue/53616; https://go.googlesource.com/go/+/695be961d57508da5a82217f7415200a11845879
CVE: CVE-2022-20239
Published: 2022-08-10
Description: remap_pfn_range' here may map out of size kernel memory (for example, may map the kernel area), and because the 'vma->vm_page_prot' can also be controlled by userspace, so userspace may map the kernel area to be writable, which is easy to be exploitedProduct: AndroidVersions: Android SoCAndroid ID: A-233972091
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-610, CWE-269
References: https://source.android.com/security/bulletin/2022-08-01; https://source.android.com/security/bulletin/2022-08-01
CVE: CVE-2022-20344
Published: 2022-08-10
Description: In stealReceiveChannel of EventThread.cpp, there is a possible way to interfere with process communication due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12LAndroid ID: A-232541124
CVSS Score: 7.0 (HIGH)
CWE: CWE-362
References: https://source.android.com/security/bulletin/2022-08-01; https://source.android.com/security/bulletin/2022-08-01
CVE: CVE-2022-20345
Published: 2022-08-10
Description: In l2cble_process_sig_cmd of l2c_ble.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution over Bluetooth with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12 Android-12LAndroid ID: A-230494481
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-77
References: https://source.android.com/security/bulletin/2022-08-01; https://source.android.com/security/bulletin/2022-08-01
CVE: CVE-2022-20346
Published: 2022-08-10
Description: In updateAudioTrackInfoFromESDS_MPEG4Audio of MPEG4Extractor.cpp, there is a possible out of bounds read due to an incorrect bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12LAndroid ID: A-230493653
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://source.android.com/security/bulletin/2022-08-01; https://source.android.com/security/bulletin/2022-08-01
CVE: CVE-2022-20347
Published: 2022-08-10
Description: In onAttach of ConnectedDeviceDashboardFragment.java, there is a possible permission bypass due to a confused deputy. This could lead to remote escalation of privilege in Bluetooth settings with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12LAndroid ID: A-228450811
CVSS Score: 8.8 (HIGH)
CWE: CWE-269
References: https://source.android.com/security/bulletin/2022-08-01; https://source.android.com/security/bulletin/2022-08-01
CVE: CVE-2022-20348
Published: 2022-08-10
Description: In updateState of LocationServicesWifiScanningPreferenceController.java, there is a possible admin restriction bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12LAndroid ID: A-228315529
CVSS Score: 7.8 (HIGH)
CWE: CWE-862
References: https://source.android.com/security/bulletin/2022-08-01; https://source.android.com/security/bulletin/2022-08-01
CVE: CVE-2022-20349
Published: 2022-08-10
Description: In WifiScanningPreferenceController and BluetoothScanningPreferenceController, there is a possible admin restriction bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12LAndroid ID: A-228315522
CVSS Score: 7.8 (HIGH)
CWE: CWE-862
References: https://source.android.com/security/bulletin/2022-08-01; https://source.android.com/security/bulletin/2022-08-01
CVE: CVE-2022-20350
Published: 2022-08-10
Description: In onCreate of NotificationAccessConfirmationActivity.java, there is a possible way to trick the victim to grant notification access to the wrong app due to improper input validation. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12LAndroid ID: A-228178437
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20, CWE-125
References: https://source.android.com/security/bulletin/2022-08-01; https://source.android.com/security/bulletin/2022-08-01
CVE: CVE-2022-20352
Published: 2022-08-10
Description: In addProviderRequestListener of LocationManagerService.java, there is a possible way to learn which packages request location information due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12 Android-12LAndroid ID: A-222473855
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-862
References: https://source.android.com/security/bulletin/2022-08-01; https://source.android.com/security/bulletin/2022-08-01
CVE: CVE-2022-20353
Published: 2022-08-10
Description: In onSaveRingtone of DefaultRingtonePreference.java, there is a possible inappropriate file read due to improper input validation. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12LAndroid ID: A-221041256
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: https://source.android.com/security/bulletin/2022-08-01; https://source.android.com/security/bulletin/2022-08-01
CVE: CVE-2022-20354
Published: 2022-08-10
Description: In onDefaultNetworkChanged of Vpn.java, there is a possible way to disable VPN due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12LAndroid ID: A-219546241
CVSS Score: 7.8 (HIGH)
References: https://source.android.com/security/bulletin/2022-08-01; https://source.android.com/security/bulletin/2022-08-01
CVE: CVE-2022-20355
Published: 2022-08-10
Description: In get of PacProxyService.java, there is a possible system service crash due to improper input validation. This could lead to local denial of service with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12LAndroid ID: A-219498290
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: https://source.android.com/security/bulletin/2022-08-01; https://source.android.com/security/bulletin/2022-08-01
CVE: CVE-2022-20356
Published: 2022-08-10
Description: In shouldAllowFgsWhileInUsePermissionLocked of ActiveServices.java, there is a possible way to start foreground service from background due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12LAndroid ID: A-215003903
CVSS Score: 7.8 (HIGH)
CWE: CWE-20, CWE-269
References: https://source.android.com/security/bulletin/2022-08-01; https://source.android.com/security/bulletin/2022-08-01
CVE: CVE-2022-20357
Published: 2022-08-10
Description: In writeToParcel of SurfaceControl.cpp, there is a possible information disclosure due to uninitialized data. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12 Android-12LAndroid ID: A-214999987
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-908
References: https://source.android.com/security/bulletin/2022-08-01; https://source.android.com/security/bulletin/2022-08-01
CVE: CVE-2022-20358
Published: 2022-08-10
Description: In startSync of AbstractThreadedSyncAdapter.java, there is a possible way to access protected content of content providers due to a missing permission check. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12LAndroid ID: A-203229608
CVSS Score: 3.3 (LOW)
CWE: CWE-862, CWE-284
References: https://source.android.com/security/bulletin/2022-08-01; https://source.android.com/security/bulletin/2022-08-01
CVE: CVE-2022-20359
Published: 2022-08-10
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2022-20360
Published: 2022-08-10
Description: In setChecked of SecureNfcPreferenceController.java, there is a missing permission check. This could lead to local escalation of privilege from the guest user with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12LAndroid ID: A-228314987
CVSS Score: 7.8 (HIGH)
CWE: CWE-862, CWE-269
References: https://source.android.com/security/bulletin/2022-08-01; https://source.android.com/security/bulletin/2022-08-01
CVE: CVE-2022-20361
Published: 2022-08-10
Description: In btif_dm_auth_cmpl_evt of btif_dm.cc, there is a possible vulnerability in Cross-Transport Key Derivation due to Weakness in Bluetooth Standard. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12LAndroid ID: A-231161832
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-269
References: https://source.android.com/security/bulletin/2022-08-01; https://source.android.com/security/bulletin/2022-08-01
CVE: CVE-2022-22983
Published: 2022-08-10
Description: VMware Workstation (16.x prior to 16.2.4) contains an unprotected storage of credentials vulnerability. A malicious actor with local user privileges to the victim machine may exploit this vulnerability leading to the disclosure of user passwords of the remote server connected through VMware Workstation.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-522
References: https://www.vmware.com/security/advisories/VMSA-2022-0023.html; https://www.vmware.com/security/advisories/VMSA-2022-0023.html
CVE: CVE-2022-23238
Published: 2022-08-10
Description: Linux deployments of StorageGRID (formerly StorageGRID Webscale) versions 11.6.0 through 11.6.0.2 deployed with a Linux kernel version less than 4.7.0 are susceptible to a vulnerability which could allow a remote unauthenticated attacker to view limited metrics information and modify alert email recipients and content.
CVSS Score: 6.5 (MEDIUM)
References: https://security.netapp.com/advisory/NTAP-20[PII_REDACTED]/; https://security.netapp.com/advisory/NTAP-20[PII_REDACTED]/
CVE: CVE-2022-25793
Published: 2022-08-10
Description: A Stack-based Buffer Overflow Vulnerability in Autodesk 3ds Max 2022, 2021, and 2020 may lead to code execution through the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer when parsing ActionScript Byte Code files. This vulnerability may allow arbitrary code execution on affected installations of Autodesk 3ds Max.
CVSS Score: 7.8 (HIGH)
CWE: CWE-1284
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0006; https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0006
CVE: CVE-2022-28131
Published: 2022-08-10
Description: Uncontrolled recursion in Decoder.Skip in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a deeply nested XML document.
CVSS Score: 7.5 (HIGH)
CWE: CWE-674
References: https://go.dev/cl/417062; https://go.dev/issue/53614; https://go.googlesource.com/go/+/08c46ed43d80bbb67cb904944ea3417989be4af3
CVE: CVE-2022-28881
Published: 2022-08-10
Description: A Denial-of-Service (DoS) vulnerability was discovered in F-Secure Atlant whereby the aerdl.dll component used in certain WithSecure products unpacker function crashes which leads to scanning engine crash. The exploit can be triggered remotely by an attacker.
CVSS Score: 4.3 (MEDIUM)
References: https://www.f-secure.com/en/business/support-and-downloads/security-advisories; https://www.withsecure.com/en/support/security-advisories; https://www.f-secure.com/en/business/support-and-downloads/security-advisories
CVE: CVE-2022-29804
Published: 2022-08-10
Description: Incorrect conversion of certain invalid paths to valid, absolute paths in Clean in path/filepath before Go 1.17.11 and Go 1.18.3 on Windows allows potential directory traversal attack.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://go.dev/cl/401595; https://go.dev/issue/52476; https://go.googlesource.com/go/+/9cd1818a7d019c02fa4898b3e45a323e35033290
CVE: CVE-2022-2457
Published: 2022-08-10
Description: A flaw was found in Red Hat Process Automation Manager 7 where an attacker can benefit from a brute force attack against Administration Console as the application does not limit the number of unsuccessful login attempts.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-307, CWE-307
References: https://bugzilla.redhat.com/show_bug.cgi?id=2107990#c0; https://bugzilla.redhat.com/show_bug.cgi?id=2107990#c0
CVE: CVE-2022-2458
Published: 2022-08-10
Description: XML external entity injection(XXE) is a vulnerability that allows an attacker to interfere with an application's processing of XML data. This attack occurs when XML input containing a reference to an external entity is processed by a weakly configured XML parser. The software processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output. Here, XML external entity injection lead to External Service interaction & Internal file read in Business Central and also Kie-Server APIs.
CVSS Score: 8.2 (HIGH)
CWE: CWE-91, CWE-611
References: https://bugzilla.redhat.com/show_bug.cgi?id=2107994#c0; https://bugzilla.redhat.com/show_bug.cgi?id=2107994#c0
CVE: CVE-2022-2634
Published: 2022-08-10
Description: An attacker may be able to execute malicious actions due to the lack of device access protections and device permissions when using the web application. This could lead to uploading python files which can be later executed.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-250
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-216-01; https://www.cisa.gov/uscert/ics/advisories/icsa-22-216-01
CVE: CVE-2022-2719
Published: 2022-08-10
Description: In ImageMagick, a crafted file could trigger an assertion failure when a call to WriteImages was made in MagickWand/operation.c, due to a NULL image list. This could potentially cause a denial of service. This was fixed in upstream ImageMagick version 7.1.0-30.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-617, CWE-617
References: https://bugzilla.redhat.com/show_bug.cgi?id=2116537; https://bugzilla.redhat.com/show_bug.cgi?id=2116537
CVE: CVE-2022-30580
Published: 2022-08-10
Description: Code injection in Cmd.Start in os/exec before Go 1.17.11 and Go 1.18.3 allows execution of any binaries in the working directory named either "..com" or "..exe" by calling Cmd.Run, Cmd.Start, Cmd.Output, or Cmd.CombinedOutput when Cmd.Path is unset.
CVSS Score: 7.8 (HIGH)
CWE: CWE-94, CWE-94
References: https://go.dev/cl/403759; https://go.dev/issue/52574; https://go.googlesource.com/go/+/960ffa98ce73ef2c2060c84c7ac28d37a83f345e
CVE: CVE-2022-30629
Published: 2022-08-10
Description: Non-random values for ticket_age_add in session tickets in crypto/tls before Go 1.17.11 and Go 1.18.3 allow an attacker that can observe TLS handshakes to correlate successive connections by comparing ticket ages during session resumption.
CVSS Score: 3.1 (LOW)
CWE: CWE-330
References: https://go.dev/cl/405994; https://go.dev/issue/52814; https://go.googlesource.com/go/+/fe4de36198794c447fbd9d7cc2d7199a506c76a5
CVE: CVE-2022-30630
Published: 2022-08-10
Description: Uncontrolled recursion in Glob in io/fs before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a path which contains a large number of path separators.
CVSS Score: 7.5 (HIGH)
CWE: CWE-674
References: https://go.dev/cl/417065; https://go.dev/issue/53415; https://go.googlesource.com/go/+/fa2d41d0ca736f3ad6b200b2a4e134364e9acc59
CVE: CVE-2022-30631
Published: 2022-08-10
Description: Uncontrolled recursion in Reader.Read in compress/gzip before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via an archive containing a large number of concatenated 0-length compressed files.
CVSS Score: 7.5 (HIGH)
CWE: CWE-674
References: https://go.dev/cl/417067; https://go.dev/issue/53168; https://go.googlesource.com/go/+/b2b8872c876201eac2d0707276c6999ff3eb185e
CVE: CVE-2022-30632
Published: 2022-08-10
Description: Uncontrolled recursion in Glob in path/filepath before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a path containing a large number of path separators.
CVSS Score: 7.5 (HIGH)
CWE: CWE-674
References: https://go.dev/cl/417066; https://go.dev/issue/53416; https://go.googlesource.com/go/+/ac68c6c683409f98250d34ad282b9e1b0c9095ef
CVE: CVE-2022-30633
Published: 2022-08-10
Description: Uncontrolled recursion in Unmarshal in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via unmarshalling an XML document into a Go struct which has a nested field that uses the 'any' field tag.
CVSS Score: 7.5 (HIGH)
CWE: CWE-674, CWE-674
References: https://go.dev/cl/417061; https://go.dev/issue/53611; https://go.googlesource.com/go/+/c4c1993fd2a5b26fe45c09592af6d3388a3b2e08