deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-20141
Published: 2022-07-22
Description: A vulnerability classified as critical has been found in Itech Movie Portal Script 7.36. This affects an unknown part of the file /movie.php. The manipulation of the argument f leads to sql injection (Union). It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://vuldb.com/?id.96255; https://www.exploit-db.com/exploits/41155/; https://vuldb.com/?id.96255
CVE: CVE-2017-20142
Published: 2022-07-22
Description: A vulnerability classified as critical was found in Itech Movie Portal Script 7.36. This vulnerability affects unknown code of the file /artist-display.php. The manipulation of the argument act leads to sql injection (Union). The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://vuldb.com/?id.96256; https://www.exploit-db.com/exploits/41155/; https://vuldb.com/?id.96256
CVE: CVE-2017-20143
Published: 2022-07-22
Description: A vulnerability, which was classified as critical, has been found in Itech Movie Portal Script 7.36. This issue affects some unknown processing of the file /film-rating.php. The manipulation of the argument v leads to sql injection (Error). The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://vuldb.com/?id.96257; https://www.exploit-db.com/exploits/41155/; https://vuldb.com/?id.96257
CVE: CVE-2022-0978
Published: 2022-07-22
Description: Use after free in ANGLE in Google Chrome prior to 99.0.4844.74 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_15.html; https://crbug.com/1299264; https://security.gentoo.org/glsa/202208-25
CVE: CVE-2022-0979
Published: 2022-07-22
Description: Use after free in Safe Browsing in Google Chrome on Android prior to 99.0.4844.74 allowed a remote attacker who convinced a user to engage in specific user interaction to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_15.html; https://crbug.com/1302644; https://security.gentoo.org/glsa/202208-25
CVE: CVE-2022-0980
Published: 2022-07-22
Description: Use after free in New Tab Page in Google Chrome prior to 99.0.4844.74 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via specific user interactions.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_15.html; https://crbug.com/1302157; https://security.gentoo.org/glsa/202208-25
CVE: CVE-2022-27235
Published: 2022-07-22
Description: Multiple Broken Access Control vulnerabilities in Social Share Buttons by Supsystic plugin <= 2.2.3 at WordPress.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-264
References: https://patchstack.com/database/vulnerability/social-share-buttons-by-supsystic/wordpress-social-share-buttons-by-supsystic-plugin-2-2-3-multiple-broken-access-control-vulnerabilities; https://wordpress.org/plugins/social-share-buttons-by-supsystic/#developers; https://patchstack.com/database/vulnerability/social-share-buttons-by-supsystic/wordpress-social-share-buttons-by-supsystic-plugin-2-2-3-multiple-broken-access-control-vulnerabilities
CVE: CVE-2022-29495
Published: 2022-07-22
Description: Cross-Site Request Forgery (CSRF) vulnerability in Sygnoos Popup Builder plugin <= 4.1.11 at WordPress allows an attacker to update plugin settings.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/popup-builder/wordpress-popup-builder-plugin-4-1-11-cross-site-request-forgery-csrf-leading-to-plugin-settings-update; https://wordpress.org/plugins/popup-builder/#developers; https://patchstack.com/database/vulnerability/popup-builder/wordpress-popup-builder-plugin-4-1-11-cross-site-request-forgery-csrf-leading-to-plugin-settings-update
CVE: CVE-2022-30998
Published: 2022-07-22
Description: Multiple Authenticated (subscriber or higher user role) SQL Injection (SQLi) vulnerabilities in WooPlugins.co's Homepage Product Organizer for WooCommerce plugin <= 1.1 at WordPress.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-89
References: https://patchstack.com/database/vulnerability/homepage-product-organizer-for-woocommerce/wordpress-homepage-product-organizer-for-woocommerce-plugin-1-1-multiple-authenticated-sql-injection-sqli-vulnerabilities; https://wordpress.org/plugins/homepage-product-organizer-for-woocommerce/#description; https://patchstack.com/database/vulnerability/homepage-product-organizer-for-woocommerce/wordpress-homepage-product-organizer-for-woocommerce-plugin-1-1-multiple-authenticated-sql-injection-sqli-vulnerabilities
CVE: CVE-2022-33191
Published: 2022-07-22
Description: Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in Chinmoy Paul's Testimonials plugin <= 3.0.1 at WordPress.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/testimonials/wordpress-testimonials-plugin-3-0-1-authenticated-stored-cross-site-scripting-xss-vulnerability; https://wordpress.org/plugins/testimonials/#description; https://patchstack.com/database/vulnerability/testimonials/wordpress-testimonials-plugin-3-0-1-authenticated-stored-cross-site-scripting-xss-vulnerability
CVE: CVE-2022-33901
Published: 2022-07-22
Description: Unauthenticated Arbitrary File Read vulnerability in MultiSafepay plugin for WooCommerce plugin <= 4.13.1 at WordPress.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-552
References: https://patchstack.com/database/vulnerability/multisafepay/wordpress-multisafepay-plugin-for-woocommerce-plugin-4-13-1-unauthenticated-arbitrary-file-read-vulnerability; https://wordpress.org/plugins/multisafepay/#developers; https://patchstack.com/database/vulnerability/multisafepay/wordpress-multisafepay-plugin-for-woocommerce-plugin-4-13-1-unauthenticated-arbitrary-file-read-vulnerability
CVE: CVE-2022-33960
Published: 2022-07-22
Description: Multiple Authenticated (subscriber or higher user role) SQL Injection (SQLi) vulnerabilities in Social Share Buttons by Supsystic plugin <= 2.2.3 at WordPress.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/vulnerability/social-share-buttons-by-supsystic/wordpress-social-share-buttons-by-supsystic-plugin-2-2-3-multiple-authenticated-sql-injection-sqli-vulnerabilities; https://wordpress.org/plugins/social-share-buttons-by-supsystic/#developers; https://patchstack.com/database/vulnerability/social-share-buttons-by-supsystic/wordpress-social-share-buttons-by-supsystic-plugin-2-2-3-multiple-authenticated-sql-injection-sqli-vulnerabilities
CVE: CVE-2022-34650
Published: 2022-07-22
Description: Multiple Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerabilities in wpWax Team plugin <= 1.2.6 at WordPress.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/adl-team/wordpress-team-plugin-1-2-6-multiple-stored-cross-site-scripting-xss-vulnerabilities; https://wordpress.org/plugins/adl-team/#description; https://patchstack.com/database/vulnerability/adl-team/wordpress-team-plugin-1-2-6-multiple-stored-cross-site-scripting-xss-vulnerabilities
CVE: CVE-2022-34839
Published: 2022-07-22
Description: Authentication Bypass vulnerability in CodexShaper's WP OAuth2 Server plugin <= 1.0.1 at WordPress.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-287
References: https://patchstack.com/database/vulnerability/oauth2-server/wordpress-wp-oauth2-server-plugin-1-0-1-authentication-bypass-vulnerability; https://wordpress.org/plugins/oauth2-server/#description; https://patchstack.com/database/vulnerability/oauth2-server/wordpress-wp-oauth2-server-plugin-1-0-1-authentication-bypass-vulnerability
CVE: CVE-2022-34853
Published: 2022-07-22
Description: Multiple Authenticated (contributor or higher user role) Persistent Cross-Site Scripting (XSS) vulnerabilities in wpWax Team plugin <= 1.2.6 at WordPress.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/adl-team/wordpress-team-plugin-1-2-6-multiple-authenticated-persistent-cross-site-scripting-xss-vulnerabilities; https://wordpress.org/plugins/adl-team/#description; https://patchstack.com/database/vulnerability/adl-team/wordpress-team-plugin-1-2-6-multiple-authenticated-persistent-cross-site-scripting-xss-vulnerabilities
CVE: CVE-2022-25759
Published: 2022-07-22
Description: The package convert-svg-core before 0.6.2 are vulnerable to Remote Code Injection via sending an SVG file containing the payload.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-94
References: https://github.com/neocotic/convert-svg/commit/7e6031ac7427cf82cf312cb4a25040f2e6efe7a5; https://github.com/neocotic/convert-svg/issues/81; https://github.com/neocotic/convert-svg/pull/82
CVE: CVE-2022-36408
Published: 2022-07-22
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2022-31181. Reason: This candidate is a duplicate of CVE-2022-31181. A typo caused the wrong ID to be used. Notes: All CVE users should reference CVE-2022-31181 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2022-34112
Published: 2022-07-22
Description: An access control issue in the component /api/plugin/uninstall Dataease v1.11.1 allows attackers to arbitrarily uninstall the plugin, a right normally reserved for the administrator.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-732
References: https://github.com/dataease/dataease/issues/2429; https://github.com/dataease/dataease/issues/2429
CVE: CVE-2022-34113
Published: 2022-07-22
Description: An issue in the component /api/plugin/upload of Dataease v1.11.1 allows attackers to execute arbitrary code via a crafted plugin.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/dataease/dataease/issues/2431; https://github.com/dataease/dataease/issues/2431
CVE: CVE-2022-34114
Published: 2022-07-22
Description: Dataease v1.11.1 was discovered to contain a SQL injection vulnerability via the parameter dataSourceId.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/dataease/dataease/issues/2430; https://github.com/dataease/dataease/issues/2430
CVE: CVE-2022-34115
Published: 2022-07-22
Description: DataEase v1.11.1 was discovered to contain a arbitrary file write vulnerability via the parameter dataSourceId.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/dataease/dataease/issues/2428; https://github.com/dataease/dataease/releases/tag/v1.11.2; https://github.com/dataease/dataease/issues/2428
CVE: CVE-2022-1096
Published: 2022-07-23
Description: Type confusion in V8 in Google Chrome prior to 99.0.4844.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-843, CWE-843
References: https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_25.html; https://crbug.com/1309225; https://security.gentoo.org/glsa/202208-25
CVE: CVE-2022-1125
Published: 2022-07-23
Description: Use after free in Portals in Google Chrome prior to 100.0.4896.60 allowed a remote attacker who convinced a user to engage in specific user interaction to potentially exploit heap corruption via user interaction.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_29.html; https://crbug.com/1292261; https://security.gentoo.org/glsa/202208-25
CVE: CVE-2022-1127
Published: 2022-07-23
Description: Use after free in QR Code Generator in Google Chrome prior to 100.0.4896.60 allowed a remote attacker who convinced a user to engage in specific user interaction to potentially exploit heap corruption via user interaction.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_29.html; https://crbug.com/1291891; https://security.gentoo.org/glsa/202208-25
CVE: CVE-2022-1128
Published: 2022-07-23
Description: Inappropriate implementation in Web Share API in Google Chrome on Windows prior to 100.0.4896.60 allowed an attacker on the local network segment to leak cross-origin data via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_29.html; https://crbug.com/1301920; https://security.gentoo.org/glsa/202208-25
CVE: CVE-2022-1129
Published: 2022-07-23
Description: Inappropriate implementation in Full Screen Mode in Google Chrome on Android prior to 100.0.4896.60 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-290
References: https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_29.html; https://crbug.com/1300253; https://security.gentoo.org/glsa/202208-25
CVE: CVE-2022-1130
Published: 2022-07-23
Description: Insufficient validation of trust input in WebOTP in Google Chrome on Android prior to 100.0.4896.60 allowed a remote attacker to send arbitrary intents from any app via a malicious app.
CVSS Score: 8.1 (HIGH)
CWE: CWE-476
References: https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_29.html; https://crbug.com/1142269; https://security.gentoo.org/glsa/202208-25
CVE: CVE-2022-1131
Published: 2022-07-23
Description: Use after free in Cast UI in Google Chrome prior to 100.0.4896.60 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_29.html; https://crbug.com/1297404; https://security.gentoo.org/glsa/202208-25
CVE: CVE-2022-1132
Published: 2022-07-23
Description: Inappropriate implementation in Virtual Keyboard in Google Chrome on Chrome OS prior to 100.0.4896.60 allowed a local attacker to bypass navigation restrictions via physical access to the device.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-863
References: https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_29.html; https://crbug.com/1303410; https://security.gentoo.org/glsa/202208-25
CVE: CVE-2022-1133
Published: 2022-07-23
Description: Use after free in WebRTC Perf in Google Chrome prior to 100.0.4896.60 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_29.html; https://crbug.com/1305776; https://security.gentoo.org/glsa/202208-25
CVE: CVE-2022-1134
Published: 2022-07-23
Description: Type confusion in V8 in Google Chrome prior to 100.0.4896.60 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-843
References: http://packetstormsecurity.com/files/172851/Chrome-Renderer-Type-Confusion-Remote-Code-Execution.html; https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_29.html; https://crbug.com/1308360
CVE: CVE-2022-1135
Published: 2022-07-23
Description: Use after free in Shopping Cart in Google Chrome prior to 100.0.4896.60 allowed a remote attacker to potentially exploit heap corruption via standard feature user interaction.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_29.html; https://crbug.com/1285601; https://security.gentoo.org/glsa/202208-25
CVE: CVE-2022-1136
Published: 2022-07-23
Description: Use after free in Tab Strip in Google Chrome prior to 100.0.4896.60 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via specific set of user gestures.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_29.html; https://crbug.com/1280205; https://security.gentoo.org/glsa/202208-25
CVE: CVE-2022-1137
Published: 2022-07-23
Description: Inappropriate implementation in Extensions in Google Chrome prior to 100.0.4896.60 allowed an attacker who convinced a user to install a malicious extension to leak potentially sensitive information via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-668
References: https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_29.html; https://crbug.com/1289846; https://security.gentoo.org/glsa/202208-25
CVE: CVE-2022-1138
Published: 2022-07-23
Description: Inappropriate implementation in Web Cursor in Google Chrome prior to 100.0.4896.60 allowed a remote attacker who had compromised the renderer process to obscure the contents of the Omnibox (URL bar) via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-1021
References: https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_29.html; https://crbug.com/1246188; https://security.gentoo.org/glsa/202208-25
CVE: CVE-2022-1139
Published: 2022-07-23
Description: Inappropriate implementation in Background Fetch API in Google Chrome prior to 100.0.4896.60 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-203
References: https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_29.html; https://crbug.com/1268541; https://security.gentoo.org/glsa/202208-25
CVE: CVE-2022-1141
Published: 2022-07-23
Description: Use after free in File Manager in Google Chrome prior to 100.0.4896.60 allowed a remote attacker who convinced a user to engage in specific user interaction to potentially exploit heap corruption via specific user gesture.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_29.html; https://crbug.com/1303253; https://security.gentoo.org/glsa/202208-25
CVE: CVE-2022-1142
Published: 2022-07-23
Description: Heap buffer overflow in WebUI in Google Chrome prior to 100.0.4896.60 allowed a remote attacker who convinced a user to engage in specific user interaction to potentially exploit heap corruption via specific input into DevTools.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_29.html; https://crbug.com/1303613; https://security.gentoo.org/glsa/202208-25
CVE: CVE-2022-1143
Published: 2022-07-23
Description: Heap buffer overflow in WebUI in Google Chrome prior to 100.0.4896.60 allowed a remote attacker who convinced a user to engage in specific user interaction to potentially exploit heap corruption via specific input into DevTools.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_29.html; https://crbug.com/1303615; https://security.gentoo.org/glsa/202208-25
CVE: CVE-2022-1144
Published: 2022-07-23
Description: Use after free in WebUI in Google Chrome prior to 100.0.4896.60 allowed a remote attacker who convinced a user to engage in specific user interaction to potentially exploit heap corruption via specific input into DevTools.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_29.html; https://crbug.com/1304145; https://security.gentoo.org/glsa/202208-25
CVE: CVE-2022-1145
Published: 2022-07-23
Description: Use after free in Extensions in Google Chrome prior to 100.0.4896.60 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via specific user interaction and profile destruction.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_29.html; https://crbug.com/1304545; https://security.gentoo.org/glsa/202208-25
CVE: CVE-2022-1146
Published: 2022-07-23
Description: Inappropriate implementation in Resource Timing in Google Chrome prior to 100.0.4896.60 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-203
References: https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_29.html; https://crbug.com/1290150; https://security.gentoo.org/glsa/202208-25
CVE: CVE-2018-25045
Published: 2022-07-23
Description: Django REST framework (aka django-rest-framework) before 3.9.1 allows XSS because the default DRF Browsable API view templates disable autoescaping.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/encode/django-rest-framework/commit/4bb9a3c48427867ef1e46f7dee945a4c25a4f9b8; https://github.com/encode/django-rest-framework/pull/6191; https://github.com/encode/django-rest-framework/pull/6330
CVE: CVE-2022-36414
Published: 2022-07-23
Description: There is an elevation of privilege breakout vulnerability in the Windows EXE installer in Scooter Beyond Compare 4.2.0 through 4.4.2 before 4.4.3. Affected versions allow a logged-in user to run applications with elevated privileges via the Clipboard Compare tray app after installation.
CVSS Score: 6.7 (MEDIUM)
References: https://www.scootersoftware.com/support.php?zz=kb_security_2022-01; https://www.scootersoftware.com/support.php?zz=kb_security_2022-01
CVE: CVE-2022-36415
Published: 2022-07-23
Description: A DLL hijacking vulnerability exists in the uninstaller in Scooter Beyond Compare 1.8a through 4.4.2 before 4.4.3 when installed via the EXE installer. The uninstaller attempts to load DLLs out of a Windows Temp folder. If a standard user places malicious DLLs in the C:\Windows\Temp\ folder, and then the uninstaller is run as SYSTEM, the DLLs will execute with elevated privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://www.scootersoftware.com/support.php?zz=kb_security_2022-02; https://www.scootersoftware.com/support.php?zz=kb_security_2022-02
CVE: CVE-2016-15004
Published: 2022-07-23
Description: A vulnerability was found in InfiniteWP Client Plugin 1.5.1.3/1.6.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality. The manipulation leads to injection. The attack can be launched remotely. Upgrading to version 1.6.1.1 is able to address this issue. It is recommended to upgrade the affected component.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74
References: http://seclists.org/fulldisclosure/2017/Jan/72; https://sumofpwn.nl/advisory/2016/infinitewp_client_wordpress_plugin_unauthenticated_php_object_injection_vulnerability.html; https://vuldb.com/?id.96073
CVE: CVE-2022-24294
Published: 2022-07-24
Description: A regular expression used in Apache MXNet (incubating) is vulnerable to a potential denial-of-service by excessive resource consumption. The bug could be exploited when loading a model in Apache MXNet that has a specially crafted operator name that would cause the regular expression evaluation to use excessive resources to attempt a match. This issue affects Apache MXNet versions prior to 1.9.1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: http://www.openwall.com/lists/oss-security/2022/07/24/2; https://lists.apache.org/thread/b1fbfmvzlr2bbp95lqoh3mtovclfcl3o; http://www.openwall.com/lists/oss-security/2022/07/24/2
CVE: CVE-2021-46829
Published: 2022-07-24
Description: GNOME GdkPixbuf (aka GDK-PixBuf) before 2.42.8 allows a heap-based buffer overflow when compositing or clearing frames in GIF files, as demonstrated by io-gif-animation.c composite_frame. This overflow is controllable and could be abused for code execution, especially on 32-bit systems.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: http://www.openwall.com/lists/oss-security/2022/07/25/1; https://github.com/pedrib/PoC/blob/master/fuzzing/CVE-2021-46829/CVE-2021-46829.md; https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/commit/5398f04d772f7f8baf[PII_REDACTED]ed88db0f0512