deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-30245
Published: 2022-07-15
Description: Honeywell Alerton Compass Software 1.6.5 allows unauthenticated configuration changes from remote users. This enables configuration data to be stored on the controller and then implemented. A user with malicious intent can send a crafted packet to change the controller configuration without the knowledge of other users, altering the controller's function capabilities. The changed configuration is not updated in the User Interface, which creates an inconsistency between the configuration display and the actual configuration on the controller. After the configuration change, remediation requires reverting to the correct configuration, requiring either physical or remote access depending on the configuration that was altered.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-610
References: https://blog.scadafence.com; https://github.com/scadafence/Honeywell-Alerton-Vulnerabilities; https://www.honeywell.com/us/en/product-security
CVE: CVE-2022-31097
Published: 2022-07-15
Description: Grafana is an open-source platform for monitoring and observability. Versions on the 8.x and 9.x branch prior to 9.0.3, 8.5.9, 8.4.10, and 8.3.10 are vulnerable to stored cross-site scripting via the Unified Alerting feature of Grafana. An attacker can exploit this vulnerability to escalate privilege from editor to admin by tricking an authenticated admin to click on a link. Versions 9.0.3, 8.5.9, 8.4.10, and 8.3.10 contain a patch. As a workaround, it is possible to disable alerting or use legacy alerting.
CVSS Score: 7.3 (HIGH)
CWE: CWE-79, CWE-79
References: https://github.com/grafana/grafana/security/advisories/GHSA-vw7q-p2qg-4m5f; https://grafana.com/docs/grafana/latest/release-notes/release-notes-8-5-9/; https://grafana.com/docs/grafana/latest/release-notes/release-notes-9-0-3/
CVE: CVE-2022-32118
Published: 2022-07-15
Description: Arox School ERP Pro v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the dispatchcategory parameter in backoffice.inc.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/JC175/CVE-2022-32118; https://www.arox.in; https://github.com/JC175/CVE-2022-32118
CVE: CVE-2022-32119
Published: 2022-07-15
Description: Arox School ERP Pro v1.0 was discovered to contain multiple arbitrary file upload vulnerabilities via the Add Photo function at photogalleries.inc.php and the import staff excel function at 1finance_master.inc.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: http://arox.com; http://school.com; https://github.com/JC175/CVE-2022-32119
CVE: CVE-2022-34826
Published: 2022-07-15
Description: In Couchbase Server 7.1.x before 7.1.1, an encrypted Private Key passphrase may be leaked in the logs.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-532
References: https://www.couchbase.com/alerts; https://www.couchbase.com/alerts
CVE: CVE-2022-31107
Published: 2022-07-15
Description: Grafana is an open-source platform for monitoring and observability. In versions 5.3 until 9.0.3, 8.5.9, 8.4.10, and 8.3.10, it is possible for a malicious user who has authorization to log into a Grafana instance via a configured OAuth IdP which provides a login name to take over the account of another user in that Grafana instance. This can occur when the malicious user is authorized to log in to Grafana via OAuth, the malicious user's external user id is not already associated with an account in Grafana, the malicious user's email address is not already associated with an account in Grafana, and the malicious user knows the Grafana username of the target user. If these conditions are met, the malicious user can set their username in the OAuth provider to that of the target user, then go through the OAuth flow to log in to Grafana. Due to the way that external and internal user accounts are linked together during login, if the conditions above are all met then the malicious user will be able to log in to the target user's Grafana account. Versions 9.0.3, 8.5.9, 8.4.10, and 8.3.10 contain a patch for this issue. As a workaround, concerned users can disable OAuth login to their Grafana instance, or ensure that all users authorized to log in via OAuth have a corresponding user account in Grafana linked to their email address.
CVSS Score: 7.1 (HIGH)
CWE: CWE-863, CWE-863
References: https://github.com/grafana/grafana/security/advisories/GHSA-mx47-6497-3fv2; https://grafana.com/docs/grafana/next/release-notes/release-notes-8-4-10/; https://grafana.com/docs/grafana/next/release-notes/release-notes-8-5-9/
CVE: CVE-2020-35305
Published: 2022-07-15
Description: Cross site scripting (XSS) in gollum 5.0 to 5.1.2 via the filename parameter to the 'New Page' dialog.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://gollum.com; https://github.com/Szarny/; https://github.com/gollum/
CVE: CVE-2022-35409
Published: 2022-07-15
Description: An issue was discovered in Mbed TLS before 2.28.1 and 3.x before 3.2.0. In some configurations, an unauthenticated attacker can send an invalid ClientHello message to a DTLS server that causes a heap-based buffer over-read of up to 255 bytes. This can cause a server crash or possibly information disclosure based on error responses. Affected configurations have MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE enabled and MBEDTLS_SSL_IN_CONTENT_LEN less than a threshold that depends on the configuration: 258 bytes if using mbedtls_ssl_cookie_check, and possibly up to 571 bytes with a custom cookie check function.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-125
References: https://github.com/Mbed-TLS/mbedtls/releases; https://lists.debian.org/debian-lts-announce/2022/12/msg00036.html; https://mbed-tls.readthedocs.io/en/latest/security-advisories/advisories/mbedtls-security-advisory-2022-07.html
CVE: CVE-2022-23141
Published: 2022-07-15
Description: ZXMP M721 has an information leak vulnerability. Since the serial port authentication on the ZBOOT interface is not effective although it is enabled, an attacker could use this vulnerability to log in to the device to obtain sensitive information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-532
References: https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1025264; https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1025264
CVE: CVE-2022-23201
Published: 2022-07-15
Description: Adobe RoboHelp versions 2020.0.7 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/robohelp/apsb22-10.html; https://helpx.adobe.com/security/products/robohelp/apsb22-10.html
CVE: CVE-2022-34215
Published: 2022-07-15
Description: Adobe Acrobat Reader versions 22.001.20142 (and earlier), 20.005.30334 (and earlier) and 17.012.30229 (and earlier) are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-125
References: https://helpx.adobe.com/security/products/acrobat/apsb22-32.html; https://helpx.adobe.com/security/products/acrobat/apsb22-32.html
CVE: CVE-2022-34216
Published: 2022-07-15
Description: Adobe Acrobat Reader versions 22.001.20142 (and earlier), 20.005.30334 (and earlier) and 17.012.30229 (and earlier) are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://helpx.adobe.com/security/products/acrobat/apsb22-32.html; https://helpx.adobe.com/security/products/acrobat/apsb22-32.html
CVE: CVE-2022-34217
Published: 2022-07-15
Description: Adobe Acrobat Reader versions 22.001.20142 (and earlier), 20.005.30334 (and earlier) and 17.012.30229 (and earlier) are affected by an Out-Of-Bounds Write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/acrobat/apsb22-32.html; https://helpx.adobe.com/security/products/acrobat/apsb22-32.html
CVE: CVE-2022-34219
Published: 2022-07-15
Description: Adobe Acrobat Reader versions 22.001.20142 (and earlier), 20.005.30334 (and earlier) and 17.012.30229 (and earlier) are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://helpx.adobe.com/security/products/acrobat/apsb22-32.html; https://helpx.adobe.com/security/products/acrobat/apsb22-32.html
CVE: CVE-2022-34220
Published: 2022-07-15
Description: Adobe Acrobat Reader versions 22.001.20142 (and earlier), 20.005.30334 (and earlier) and 17.012.30229 (and earlier) are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://helpx.adobe.com/security/products/acrobat/apsb22-32.html; https://helpx.adobe.com/security/products/acrobat/apsb22-32.html
CVE: CVE-2022-34221
Published: 2022-07-15
Description: Adobe Acrobat Reader versions 22.001.20142 (and earlier), 20.005.30334 (and earlier) and 17.012.30229 (and earlier) are affected by an Access of Resource Using Incompatible Type ('Type Confusion') vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-843
References: https://helpx.adobe.com/security/products/acrobat/apsb22-32.html; https://helpx.adobe.com/security/products/acrobat/apsb22-32.html
CVE: CVE-2022-34222
Published: 2022-07-15
Description: Adobe Acrobat Reader versions 22.001.20142 (and earlier), 20.005.30334 (and earlier) and 17.012.30229 (and earlier) are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/acrobat/apsb22-32.html; https://helpx.adobe.com/security/products/acrobat/apsb22-32.html
CVE: CVE-2022-34223
Published: 2022-07-15
Description: Adobe Acrobat Reader versions 22.001.20142 (and earlier), 20.005.30334 (and earlier) and 17.012.30229 (and earlier) are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://helpx.adobe.com/security/products/acrobat/apsb22-32.html; https://helpx.adobe.com/security/products/acrobat/apsb22-32.html
CVE: CVE-2022-34225
Published: 2022-07-15
Description: Adobe Acrobat Reader versions 22.001.20142 (and earlier), 20.005.30334 (and earlier) and 17.012.30229 (and earlier) are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://helpx.adobe.com/security/products/acrobat/apsb22-32.html; https://helpx.adobe.com/security/products/acrobat/apsb22-32.html
CVE: CVE-2022-34226
Published: 2022-07-15
Description: Adobe Acrobat Reader versions 22.001.20142 (and earlier), 20.005.30334 (and earlier) and 17.012.30229 (and earlier) are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/acrobat/apsb22-32.html; https://helpx.adobe.com/security/products/acrobat/apsb22-32.html
CVE: CVE-2022-34228
Published: 2022-07-15
Description: Adobe Acrobat Reader versions 22.001.20142 (and earlier), 20.005.30334 (and earlier) and 17.012.30229 (and earlier) are affected by an Access of Uninitialized Pointer vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-824
References: https://helpx.adobe.com/security/products/acrobat/apsb22-32.html; https://helpx.adobe.com/security/products/acrobat/apsb22-32.html
CVE: CVE-2022-34229
Published: 2022-07-15
Description: Adobe Acrobat Reader versions 22.001.20142 (and earlier), 20.005.30334 (and earlier) and 17.012.30229 (and earlier) are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://helpx.adobe.com/security/products/acrobat/apsb22-32.html; https://helpx.adobe.com/security/products/acrobat/apsb22-32.html
CVE: CVE-2022-34230
Published: 2022-07-15
Description: Adobe Acrobat Reader versions 22.001.20142 (and earlier), 20.005.30334 (and earlier) and 17.012.30229 (and earlier) are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://helpx.adobe.com/security/products/acrobat/apsb22-32.html; https://helpx.adobe.com/security/products/acrobat/apsb22-32.html
CVE: CVE-2022-34232
Published: 2022-07-15
Description: Adobe Acrobat Reader versions 22.001.20142 (and earlier), 20.005.30334 (and earlier) and 17.012.30229 (and earlier) are affected by a Use After Free vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416
References: https://helpx.adobe.com/security/products/acrobat/apsb22-32.html; https://helpx.adobe.com/security/products/acrobat/apsb22-32.html
CVE: CVE-2022-34233
Published: 2022-07-15
Description: Adobe Acrobat Reader versions 22.001.20142 (and earlier), 20.005.30334 (and earlier) and 17.012.30229 (and earlier) are affected by a Use After Free vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416
References: https://helpx.adobe.com/security/products/acrobat/apsb22-32.html; https://helpx.adobe.com/security/products/acrobat/apsb22-32.html
CVE: CVE-2022-34234
Published: 2022-07-15
Description: Adobe Acrobat Reader versions 22.001.20142 (and earlier), 20.005.30334 (and earlier) and 17.012.30229 (and earlier) are affected by a Use After Free vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416
References: https://helpx.adobe.com/security/products/acrobat/apsb22-32.html; https://helpx.adobe.com/security/products/acrobat/apsb22-32.html
CVE: CVE-2022-34236
Published: 2022-07-15
Description: Adobe Acrobat Reader versions 22.001.20142 (and earlier), 20.005.30334 (and earlier) and 17.012.30229 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/acrobat/apsb22-32.html; https://helpx.adobe.com/security/products/acrobat/apsb22-32.html
CVE: CVE-2022-34237
Published: 2022-07-15
Description: Adobe Acrobat Reader versions 22.001.20142 (and earlier), 20.005.30334 (and earlier) and 17.012.30229 (and earlier) are affected by a Use After Free vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file..
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416
References: https://helpx.adobe.com/security/products/acrobat/apsb22-32.html; https://helpx.adobe.com/security/products/acrobat/apsb22-32.html
CVE: CVE-2022-34239
Published: 2022-07-15
Description: Adobe Acrobat Reader versions 22.001.20142 (and earlier), 20.005.30334 (and earlier) and 17.012.30229 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/acrobat/apsb22-32.html; https://helpx.adobe.com/security/products/acrobat/apsb22-32.html
CVE: CVE-2022-34241
Published: 2022-07-15
Description: Adobe Character Animator version 4.4.7 (and earlier) and 22.4 (and earlier) are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122
References: https://helpx.adobe.com/security/products/character_animator/apsb22-34.html; https://helpx.adobe.com/security/products/character_animator/apsb22-34.html
CVE: CVE-2022-34242
Published: 2022-07-15
Description: Adobe Character Animator version 4.4.7 (and earlier) and 22.4 (and earlier) are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/character_animator/apsb22-34.html; https://helpx.adobe.com/security/products/character_animator/apsb22-34.html
CVE: CVE-2022-34243
Published: 2022-07-15
Description: Adobe Photoshop versions 22.5.7 (and earlier) and 23.3.2 (and earlier) are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://helpx.adobe.com/security/products/photoshop/apsb22-35.html; https://helpx.adobe.com/security/products/photoshop/apsb22-35.html
CVE: CVE-2022-34244
Published: 2022-07-15
Description: Adobe Photoshop versions 22.5.7 (and earlier) and 23.3.2 (and earlier) are affected by an Access of Uninitialized Pointer vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-824
References: https://helpx.adobe.com/security/products/photoshop/apsb22-35.html; https://helpx.adobe.com/security/products/photoshop/apsb22-35.html
CVE: CVE-2022-34245
Published: 2022-07-15
Description: Adobe InDesign versions 17.2.1 (and earlier) and 16.4.1 (and earlier) are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://helpx.adobe.com/security/products/indesign/apsb22-30.html; https://helpx.adobe.com/security/products/indesign/apsb22-30.html
CVE: CVE-2022-34246
Published: 2022-07-15
Description: Adobe InDesign versions 17.2.1 (and earlier) and 16.4.1 (and earlier) are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122
References: https://helpx.adobe.com/security/products/indesign/apsb22-30.html; https://helpx.adobe.com/security/products/indesign/apsb22-30.html
CVE: CVE-2022-34247
Published: 2022-07-15
Description: Adobe InDesign versions 17.2.1 (and earlier) and 16.4.1 (and earlier) are affected by an Out-Of-Bounds Write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/indesign/apsb22-30.html; https://helpx.adobe.com/security/products/indesign/apsb22-30.html
CVE: CVE-2022-34248
Published: 2022-07-15
Description: Adobe InDesign versions 17.2.1 (and earlier) and 16.4.1 (and earlier) are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/indesign/apsb22-30.html; https://helpx.adobe.com/security/products/indesign/apsb22-30.html
CVE: CVE-2022-34249
Published: 2022-07-15
Description: Adobe InCopy versions 17.2 (and earlier) and 16.4.1 (and earlier) are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122
References: https://helpx.adobe.com/security/products/incopy/apsb22-29.html; https://helpx.adobe.com/security/products/incopy/apsb22-29.html
CVE: CVE-2022-34250
Published: 2022-07-15
Description: Adobe InCopy versions 17.2 (and earlier) and 16.4.1 (and earlier) are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122
References: https://helpx.adobe.com/security/products/incopy/apsb22-29.html; https://helpx.adobe.com/security/products/incopy/apsb22-29.html