deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-35873
Published: 2022-07-25
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition 8.1.15 (b[PII_REDACTED]). User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of ZIP files. Crafted data in a ZIP file can cause the application to execute arbitrary Python scripts. The user interface fails to provide sufficient indication of the hazard. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-16949.
CVSS Score: 7.8 (HIGH)
CWE: CWE-356
References: https://support.inductiveautomation.com/hc/en-us/articles/[PII_REDACTED]653-Regarding-Pwn2Own-2022-Vulnerabilities; https://www.zerodayinitiative.com/advisories/ZDI-22-1020/; https://support.inductiveautomation.com/hc/en-us/articles/[PII_REDACTED]653-Regarding-Pwn2Own-2022-Vulnerabilities
CVE: CVE-2022-36375
Published: 2022-07-25
Description: Authenticated (high role user) WordPress Options Change vulnerability in Biplob Adhikari's Tabs plugin <= 3.6.0 at WordPress.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: https://patchstack.com/database/vulnerability/vc-tabs/wordpress-tabs-plugin-3-6-0-authenticated-wordpress-options-change-vulnerability; https://plugins.trac.wordpress.org/changeset/2646981; https://patchstack.com/database/vulnerability/vc-tabs/wordpress-tabs-plugin-3-6-0-authenticated-wordpress-options-change-vulnerability
CVE: CVE-2022-34906
Published: 2022-07-25
Description: A hard-coded cryptographic key is used in FileWave before 14.6.3 and 14.7.x before 14.7.2. Exploitation could allow an unauthenticated actor to decrypt sensitive information saved in FileWave, and even send crafted requests.
CVSS Score: 7.5 (HIGH)
CWE: CWE-798
References: https://claroty.com/2022/07/25/blog-research-with-management-comes-risk-finding-flaws-in-filewave-mdm/; https://kb.filewave.com/pages/viewpage.action?pageId=55544244; https://claroty.com/2022/07/25/blog-research-with-management-comes-risk-finding-flaws-in-filewave-mdm/
CVE: CVE-2022-34907
Published: 2022-07-25
Description: An authentication bypass vulnerability exists in FileWave before 14.6.3 and 14.7.x before 14.7.2. Exploitation could allow an unauthenticated actor to gain access to the system with the highest authority possible and gain full control over the FileWave platform.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://claroty.com/2022/07/25/blog-research-with-management-comes-risk-finding-flaws-in-filewave-mdm/; https://kb.filewave.com/pages/viewpage.action?pageId=55544244; https://claroty.com/2022/07/25/blog-research-with-management-comes-risk-finding-flaws-in-filewave-mdm/
CVE: CVE-2022-35131
Published: 2022-07-25
Description: Joplin v2.8.8 allows attackers to execute arbitrary commands via a crafted payload injected into the Node titles.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-79
References: http://joplin.com; https://github.com/laurent22/joplin/releases/tag/v2.9.1; https://github.com/ly1g3/Joplin-CVE-2022-35131
CVE: CVE-2022-34570
Published: 2022-07-25
Description: WAVLINK WN579 X3 M79X3.V5030.191012/M79X3.V5030.191012 contains an information leak which allows attackers to obtain the key information via accessing the messages.txt page.
CVSS Score: 7.5 (HIGH)
CWE: CWE-425, CWE-532
References: https://github.com/pghuanghui/CVE_Request/blob/main/WAVLINK%20WN579%20X3__messages.md; https://www.wavlink.com/en_us/product/WL-WN579X3.html; https://github.com/pghuanghui/CVE_Request/blob/main/WAVLINK%20WN579%20X3__messages.md
CVE: CVE-2022-34571
Published: 2022-07-25
Description: An access control issue in Wavlink WiFi-Repeater RPTA2-77W.M4300.01.GD.2017Sep19 allows attackers to obtain the system key information and execute arbitrary commands via accessing the page syslog.shtml.
CVSS Score: 8.0 (HIGH)
CWE: CWE-425
References: https://github.com/pghuanghui/CVE_Request/blob/main/WiFi-Repeater/WiFi-Repeater_syslog.shtml.assets/WiFi-Repeater_syslog.shtml.md; https://www.wavlink.com/en_us/category/REPEATER.html; https://github.com/pghuanghui/CVE_Request/blob/main/WiFi-Repeater/WiFi-Repeater_syslog.shtml.assets/WiFi-Repeater_syslog.shtml.md
CVE: CVE-2022-34572
Published: 2022-07-25
Description: An access control issue in Wavlink WiFi-Repeater RPTA2-77W.M4300.01.GD.2017Sep19 allows attackers to obtain the telnet password via accessing the page tftp.txt.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-425
References: https://github.com/pghuanghui/CVE_Request/blob/main/WiFi-Repeater/WiFi-Repeater_syslog.shtml.assets/WiFi-Repeater_tftp.md; https://www.wavlink.com/en_us/category/REPEATER.html; https://github.com/pghuanghui/CVE_Request/blob/main/WiFi-Repeater/WiFi-Repeater_syslog.shtml.assets/WiFi-Repeater_tftp.md
CVE: CVE-2022-34573
Published: 2022-07-25
Description: An access control issue in Wavlink WiFi-Repeater RPTA2-77W.M4300.01.GD.2017Sep19 allows attackers to arbitrarily configure device settings via accessing the page mb_wifibasic.shtml.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-425
References: https://github.com/pghuanghui/CVE_Request/blob/main/WiFi-Repeater/WiFi-Repeater_mb_wifibasic.assets/WiFi-Repeater_mb_wifibasic.md; https://www.wavlink.com/en_us/category/REPEATER.html; https://github.com/pghuanghui/CVE_Request/blob/main/WiFi-Repeater/WiFi-Repeater_mb_wifibasic.assets/WiFi-Repeater_mb_wifibasic.md
CVE: CVE-2022-34574
Published: 2022-07-25
Description: An access control issue in Wavlink WiFi-Repeater RPTA2-77W.M4300.01.GD.2017Sep19 allows attackers to obtain the key information of the device via accessing Tftpd32.ini.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-425
References: https://github.com/pghuanghui/CVE_Request/blob/main/WiFi-Repeater/WiFi-Repeater_Tftpd32.assets/WiFi-Repeater_Tftpd32.md; https://www.wavlink.com/en_us/category/REPEATER.html; https://github.com/pghuanghui/CVE_Request/blob/main/WiFi-Repeater/WiFi-Repeater_Tftpd32.assets/WiFi-Repeater_Tftpd32.md
CVE: CVE-2022-34575
Published: 2022-07-25
Description: An access control issue in Wavlink WiFi-Repeater RPTA2-77W.M4300.01.GD.2017Sep19 allows attackers to obtain the key information of the device via accessing fctest.shtml.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-287
References: https://github.com/pghuanghui/CVE_Request/blob/main/WiFi-Repeater/WiFi-Repeater_fctest.assets/WiFi-Repeater_fctest.md; https://www.wavlink.com/en_us/category/REPEATER.html; https://github.com/pghuanghui/CVE_Request/blob/main/WiFi-Repeater/WiFi-Repeater_fctest.assets/WiFi-Repeater_fctest.md
CVE: CVE-2022-34576
Published: 2022-07-25
Description: A vulnerability in /cgi-bin/ExportAllSettings.sh of WAVLINK WN535 G3 M35G3R.V5030.180927 allows attackers to execute arbitrary code via a crafted POST request.
CVSS Score: 7.5 (HIGH)
References: https://github.com/pghuanghui/CVE_Request/blob/main/WAVLINK%20WN535%20G3_Sensitive%20information%20leakage.md; https://github.com/pghuanghui/CVE_Request/blob/main/WAVLINK%20WN535%20G3_Sensitive%20information%20leakage.md
CVE: CVE-2022-34577
Published: 2022-07-25
Description: A vulnerability in adm.cgi of WAVLINK WN535 G3 M35G3R.V5030.180927 allows attackers to execute arbitrary code via a crafted POST request.
CVSS Score: 9.8 (CRITICAL)
References: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-31311; https://github.com/pghuanghui/CVE_Request/blob/main/WAVLINK%20WN535%20G3_Command%20Execution%20Vulnerability.md; https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-31311
CVE: CVE-2022-34749
Published: 2022-07-25
Description: In mistune through 2.0.2, support of inline markup is implemented by using regular expressions that can involve a high amount of backtracking on certain edge cases. This behavior is commonly named catastrophic backtracking.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1333
References: https://github.com/lepture/mistune/commit/a6d43215132fe4f3d93f8d7e90ba83b16a0838b2; https://github.com/lepture/mistune/releases; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TQHXITQ2DSBYOILKHXBSBB7PFBPZHF63/
CVE: CVE-2022-22686
Published: 2022-07-26
Description: Cross-Site Request Forgery (CSRF) vulnerability in webapi component in Synology Calendar before 2.3.4-0631 allows remote authenticated users to hijack the authentication of administrators via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://www.synology.com/security/advisory/Synology_SA_20_07; https://www.synology.com/security/advisory/Synology_SA_20_07
CVE: CVE-2020-36290
Published: 2022-07-26
Description: The Livesearch macro in Confluence Server and Data Center before version 7.4.5, from version 7.5.0 before 7.6.3, and from version 7.7.0 before version 7.7.4 allows remote attackers with permission to edit a page or blog to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the page excerpt functionality.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://jira.atlassian.com/browse/CONFSERVER-60118; https://jira.atlassian.com/browse/CONFSERVER-60118
CVE: CVE-2022-1041
Published: 2022-07-26
Description: In Zephyr bluetooth mesh core stack, an out-of-bound write vulnerability can be triggered during provisioning.
CVSS Score: 8.2 (HIGH)
CWE: CWE-787, CWE-787
References: http://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-p449-9hv9-pj38; http://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-p449-9hv9-pj38
CVE: CVE-2022-1042
Published: 2022-07-26
Description: In Zephyr bluetooth mesh core stack, an out-of-bound write vulnerability can be triggered during provisioning.
CVSS Score: 8.2 (HIGH)
CWE: CWE-787, CWE-787
References: http://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-j7v7-w73r-mm5x; http://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-j7v7-w73r-mm5x
CVE: CVE-2022-30706
Published: 2022-07-26
Description: Open redirect vulnerability in Booked versions prior to 3.3 allows a remote unauthenticated attacker to redirect a user to an arbitrary web site and conduct a phishing attack by having a user to access a specially crafted URL.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://jvn.jp/en/jp/JVN75063798/; https://www.bookedscheduler.com/; https://jvn.jp/en/jp/JVN75063798/
CVE: CVE-2022-31471
Published: 2022-07-26
Description: untangle is a python library to convert XML data to python objects. untangle versions 1.2.0 and earlier improperly restricts XML external entity references. By exploiting this vulnerability, a remote unauthenticated attacker may read the contents of local files.
CVSS Score: 7.5 (HIGH)
CWE: CWE-611
References: https://github.com/stchris/untangle; https://github.com/stchris/untangle/releases/tag/1.2.1; https://jvn.jp/en/jp/JVN30454777/
CVE: CVE-2022-33977
Published: 2022-07-26
Description: untangle is a python library to convert XML data to python objects. untangle versions 1.2.0 and earlier improperly restricts recursive entity references in DTDs. By exploiting this vulnerability, a remote unauthenticated attacker may cause a denial-of-service (DoS) condition on the server where the product is running.
CVSS Score: 7.5 (HIGH)
CWE: CWE-776
References: https://github.com/stchris/untangle; https://github.com/stchris/untangle/releases/tag/1.2.1; https://jvn.jp/en/jp/JVN30454777/
CVE: CVE-2021-43959
Published: 2022-07-26
Description: Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to access the content of internal network resources via a Server-Side Request Forgery (SSRF) vulnerability in the CSV importing feature of JSM Insight. When running in an environment like Amazon EC2, this flaw may be used to access to a metadata resource that provides access credentials and other potentially confidential information. The affected versions are before version 4.13.20, from version 4.14.0 before 4.20.8, and from version 4.21.0 before 4.22.2.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-918
References: https://jira.atlassian.com/browse/JSDSERVER-11898; https://jira.atlassian.com/browse/JSDSERVER-11898
CVE: CVE-2022-2225
Published: 2022-07-26
Description: By using warp-cli subcommands (disable-ethernet, disable-wifi), it was possible for a user without admin privileges to bypass configured Zero Trust security policies (e.g. Secure Web Gateway policies) and features such as 'Lock WARP switch'.
CVSS Score: 8.1 (HIGH)
CWE: CWE-284
References: https://github.com/cloudflare/advisories/security/advisories/GHSA-cg88-vx48-976c; https://github.com/cloudflare/advisories/security/advisories/GHSA-cg88-vx48-976c
CVE: CVE-2021-33437
Published: 2022-07-26
Description: An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There are memory leaks in frozen_cb() in mjs.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://gist.github.com/Clingto/bb632c0c463f4b2c97e4f65f751c5e6d; https://github.com/cesanta/mjs/issues/160; https://gist.github.com/Clingto/bb632c0c463f4b2c97e4f65f751c5e6d
CVE: CVE-2021-33438
Published: 2022-07-26
Description: An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There is stack buffer overflow in json_parse_array() in mjs.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://gist.github.com/Clingto/bb632c0c463f4b2c97e4f65f751c5e6d; https://github.com/cesanta/mjs/issues/158; https://gist.github.com/Clingto/bb632c0c463f4b2c97e4f65f751c5e6d
CVE: CVE-2021-33439
Published: 2022-07-26
Description: An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There is Integer overflow in gc_compact_strings() in mjs.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-190, CWE-476
References: https://gist.github.com/Clingto/bb632c0c463f4b2c97e4f65f751c5e6d; https://github.com/cesanta/mjs/issues/159; https://gist.github.com/Clingto/bb632c0c463f4b2c97e4f65f751c5e6d
CVE: CVE-2021-33440
Published: 2022-07-26
Description: An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There is NULL pointer dereference in mjs_bcode_commit() in mjs.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://gist.github.com/Clingto/bb632c0c463f4b2c97e4f65f751c5e6d; https://github.com/cesanta/mjs/issues/163; https://gist.github.com/Clingto/bb632c0c463f4b2c97e4f65f751c5e6d
CVE: CVE-2021-33441
Published: 2022-07-26
Description: An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There is NULL pointer dereference in exec_expr() in mjs.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://gist.github.com/Clingto/bb632c0c463f4b2c97e4f65f751c5e6d; https://github.com/cesanta/mjs/issues/165; https://gist.github.com/Clingto/bb632c0c463f4b2c97e4f65f751c5e6d
CVE: CVE-2021-33442
Published: 2022-07-26
Description: An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There is NULL pointer dereference in json_printf() in mjs.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://gist.github.com/Clingto/bb632c0c463f4b2c97e4f65f751c5e6d; https://github.com/cesanta/mjs/issues/161; https://gist.github.com/Clingto/bb632c0c463f4b2c97e4f65f751c5e6d
CVE: CVE-2021-33443
Published: 2022-07-26
Description: An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There is stack buffer overflow in mjs_execute() in mjs.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://gist.github.com/Clingto/bb632c0c463f4b2c97e4f65f751c5e6d; https://github.com/cesanta/mjs/issues/167; https://gist.github.com/Clingto/bb632c0c463f4b2c97e4f65f751c5e6d
CVE: CVE-2021-33444
Published: 2022-07-26
Description: An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There is NULL pointer dereference in getprop_builtin_foreign() in mjs.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://gist.github.com/Clingto/bb632c0c463f4b2c97e4f65f751c5e6d; https://github.com/cesanta/mjs/issues/166; https://gist.github.com/Clingto/bb632c0c463f4b2c97e4f65f751c5e6d
CVE: CVE-2021-33445
Published: 2022-07-26
Description: An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There is NULL pointer dereference in mjs_string_char_code_at() in mjs.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://gist.github.com/Clingto/bb632c0c463f4b2c97e4f65f751c5e6d; https://github.com/cesanta/mjs/issues/169; https://gist.github.com/Clingto/bb632c0c463f4b2c97e4f65f751c5e6d
CVE: CVE-2021-33446
Published: 2022-07-26
Description: An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There is NULL pointer dereference in mjs_next() in mjs.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://gist.github.com/Clingto/bb632c0c463f4b2c97e4f65f751c5e6d; https://github.com/cesanta/mjs/issues/168; https://gist.github.com/Clingto/bb632c0c463f4b2c97e4f65f751c5e6d
CVE: CVE-2021-33447
Published: 2022-07-26
Description: An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There is NULL pointer dereference in mjs_print() in mjs.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://gist.github.com/Clingto/bb632c0c463f4b2c97e4f65f751c5e6d; https://github.com/cesanta/mjs/issues/164; https://gist.github.com/Clingto/bb632c0c463f4b2c97e4f65f751c5e6d
CVE: CVE-2021-33448
Published: 2022-07-26
Description: An issue was discovered in mjs(mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There is stack buffer overflow at 0x7fffe9049390.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://gist.github.com/Clingto/bb632c0c463f4b2c97e4f65f751c5e6d; https://github.com/cesanta/mjs/issues/170; https://gist.github.com/Clingto/bb632c0c463f4b2c97e4f65f751c5e6d
CVE: CVE-2021-33449
Published: 2022-07-26
Description: An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There is NULL pointer dereference in mjs_bcode_part_get_by_offset() in mjs.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://gist.github.com/Clingto/bb632c0c463f4b2c97e4f65f751c5e6d; https://github.com/cesanta/mjs/issues/162; https://gist.github.com/Clingto/bb632c0c463f4b2c97e4f65f751c5e6d
CVE: CVE-2021-33450
Published: 2022-07-26
Description: An issue was discovered in NASM version 2.16rc0. There are memory leaks in nasm_calloc() in nasmlib/alloc.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://bugzilla.nasm.us/show_bug.cgi?id=3392758; https://gist.github.com/Clingto/bb632c0c463f4b2c97e4f65f751c5e6d; https://bugzilla.nasm.us/show_bug.cgi?id=3392758
CVE: CVE-2021-33451
Published: 2022-07-26
Description: An issue was discovered in lrzip version 0.641. There are memory leaks in fill_buffer() in stream.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://gist.github.com/Clingto/bb632c0c463f4b2c97e4f65f751c5e6d; https://github.com/ckolivas/lrzip/issues/198; https://gist.github.com/Clingto/bb632c0c463f4b2c97e4f65f751c5e6d
CVE: CVE-2021-33452
Published: 2022-07-26
Description: An issue was discovered in NASM version 2.16rc0. There are memory leaks in nasm_malloc() in nasmlib/alloc.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://bugzilla.nasm.us/show_bug.cgi?id=3392757; https://gist.github.com/Clingto/bb632c0c463f4b2c97e4f65f751c5e6d; https://bugzilla.nasm.us/show_bug.cgi?id=3392757
CVE: CVE-2021-33453
Published: 2022-07-26
Description: An issue was discovered in lrzip version 0.641. There is a use-after-free in ucompthread() in stream.c:1538.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://gist.github.com/Clingto/bb632c0c463f4b2c97e4f65f751c5e6d; https://github.com/ckolivas/lrzip/issues/199; https://gist.github.com/Clingto/bb632c0c463f4b2c97e4f65f751c5e6d
CVE: CVE-2021-33454
Published: 2022-07-26
Description: An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in yasm_expr_get_intnum() in libyasm/expr.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://gist.github.com/Clingto/bb632c0c463f4b2c97e4f65f751c5e6d; https://github.com/yasm/yasm/issues/166; https://gist.github.com/Clingto/bb632c0c463f4b2c97e4f65f751c5e6d
CVE: CVE-2021-33455
Published: 2022-07-26
Description: An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in do_directive() in modules/preprocs/nasm/nasm-pp.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://gist.github.com/Clingto/bb632c0c463f4b2c97e4f65f751c5e6d; https://github.com/yasm/yasm/issues/169; https://gist.github.com/Clingto/bb632c0c463f4b2c97e4f65f751c5e6d
CVE: CVE-2021-33456
Published: 2022-07-26
Description: An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in hash() in modules/preprocs/nasm/nasm-pp.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://gist.github.com/Clingto/bb632c0c463f4b2c97e4f65f751c5e6d; https://github.com/yasm/yasm/issues/175; https://gist.github.com/Clingto/bb632c0c463f4b2c97e4f65f751c5e6d
CVE: CVE-2021-33457
Published: 2022-07-26
Description: An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in expand_mmac_params() in modules/preprocs/nasm/nasm-pp.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://gist.github.com/Clingto/bb632c0c463f4b2c97e4f65f751c5e6d; https://github.com/yasm/yasm/issues/171; https://gist.github.com/Clingto/bb632c0c463f4b2c97e4f65f751c5e6d
CVE: CVE-2021-33458
Published: 2022-07-26
Description: An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in find_cc() in modules/preprocs/nasm/nasm-pp.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://gist.github.com/Clingto/bb632c0c463f4b2c97e4f65f751c5e6d; https://github.com/yasm/yasm/issues/170; https://gist.github.com/Clingto/bb632c0c463f4b2c97e4f65f751c5e6d
CVE: CVE-2021-33459
Published: 2022-07-26
Description: An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in nasm_parser_directive() in modules/parsers/nasm/nasm-parse.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://gist.github.com/Clingto/bb632c0c463f4b2c97e4f65f751c5e6d; https://github.com/yasm/yasm/issues/167; https://gist.github.com/Clingto/bb632c0c463f4b2c97e4f65f751c5e6d
CVE: CVE-2021-33460
Published: 2022-07-26
Description: An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in if_condition() in modules/preprocs/nasm/nasm-pp.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://gist.github.com/Clingto/bb632c0c463f4b2c97e4f65f751c5e6d; https://github.com/yasm/yasm/issues/168; https://gist.github.com/Clingto/bb632c0c463f4b2c97e4f65f751c5e6d
CVE: CVE-2021-33461
Published: 2022-07-26
Description: An issue was discovered in yasm version 1.3.0. There is a use-after-free in yasm_intnum_destroy() in libyasm/intnum.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416
References: https://gist.github.com/Clingto/bb632c0c463f4b2c97e4f65f751c5e6d; https://github.com/yasm/yasm/issues/161; https://gist.github.com/Clingto/bb632c0c463f4b2c97e4f65f751c5e6d
CVE: CVE-2021-33462
Published: 2022-07-26
Description: An issue was discovered in yasm version 1.3.0. There is a use-after-free in expr_traverse_nodes_post() in libyasm/expr.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416
References: https://gist.github.com/Clingto/bb632c0c463f4b2c97e4f65f751c5e6d; https://github.com/yasm/yasm/issues/165; https://gist.github.com/Clingto/bb632c0c463f4b2c97e4f65f751c5e6d
CVE: CVE-2021-33463
Published: 2022-07-26
Description: An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in yasm_expr__copy_except() in libyasm/expr.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://gist.github.com/Clingto/bb632c0c463f4b2c97e4f65f751c5e6d; https://github.com/yasm/yasm/issues/174; https://gist.github.com/Clingto/bb632c0c463f4b2c97e4f65f751c5e6d
CVE: CVE-2021-33464
Published: 2022-07-26
Description: An issue was discovered in yasm version 1.3.0. There is a heap-buffer-overflow in inc_fopen() in modules/preprocs/nasm/nasm-pp.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://gist.github.com/Clingto/bb632c0c463f4b2c97e4f65f751c5e6d; https://github.com/yasm/yasm/issues/164; https://gist.github.com/Clingto/bb632c0c463f4b2c97e4f65f751c5e6d