deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-40262
Published: 2022-09-20
Description: A potential attacker can execute an arbitrary code at the time of the PEI phase and influence the subsequent boot stages. This can lead to the mitigations bypassing, physical memory contents disclosure, discovery of any secrets from any Virtual Machines (VMs) and bypassing memory isolation and confidential computing boundaries. Additionally, an attacker can build a payload which can be injected into the SMRAM memory. This issue affects: Module name: S3Resume2Pei SHA256: 7bb29f05534a8a1e[PII_REDACTED]51425098faebd45948a4642db969b19d0253fc Module GUID: 89E549B0-7CFE-449D-9BA3-10D8B2312D71
CVSS Score: 8.2 (HIGH)
CWE: CWE-123, CWE-787
References: https://www.ami.com/security-center/; https://www.binarly.io/advisories/BRLY-2022-009; https://www.ami.com/security-center/
CVE: CVE-2022-41138
Published: 2022-09-20
Description: In Zutty before 0.13, DECRQSS in text written to the terminal can achieve arbitrary code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://bugs.gentoo.org/868495; https://github.com/tomszilagyi/zutty/commit/bde7458c60a7bafe08bbeaafbf861eb865edfa38; https://github.com/tomszilagyi/zutty/compare/0.12...0.13
CVE: CVE-2022-30579
Published: 2022-09-20
Description: The Web Player component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace and TIBCO Spotfire Server contains a difficult to exploit vulnerability that allows a low privileged attacker with network access to execute blind Server Side Request Forgery (SSRF) on the affected system. Affected releases are TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace: version 12.0.0 and TIBCO Spotfire Server: version 12.0.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-918, CWE-918
References: https://www.tibco.com/services/support/advisories; https://www.tibco.com/support/advisories/2022/09/tibco-security-advisory-september-20-2022-tibco-spotfire-cve-2022-30579; https://www.tibco.com/services/support/advisories
CVE: CVE-2022-37972
Published: 2022-09-20
Description: Microsoft Endpoint Configuration Manager Spoofing Vulnerability
CVSS Score: 7.5 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-37972; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-37972
CVE: CVE-2020-36602
Published: 2022-09-20
Description: There is an out-of-bounds read and write vulnerability in some headset products. An unauthenticated attacker gets the device physically and crafts malformed message with specific parameter and sends the message to the affected products. Due to insufficient validation of message, which may be exploited to cause out-of-bounds read and write.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-125, CWE-787, CWE-125, CWE-787
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20220826-01-outofboundread-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20220826-01-outofboundread-en
CVE: CVE-2021-46834
Published: 2022-09-20
Description: A permission bypass vulnerability in Huawei cross device task management could allow an attacker to access certain resource in the attacked devices. Affected product versions include:JAD-AL50 versions 102.0.0.225(C00E220R3P4).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-276, CWE-276
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20220819-01-7e0a6103-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20220819-01-7e0a6103-en
CVE: CVE-2021-46835
Published: 2022-09-20
Description: There is a traffic hijacking vulnerability in WS7200-10 11.0.2.13. Successful exploitation of this vulnerability can cause packets to be hijacked by attackers.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-294
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20220831-01-5370a6df-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20220831-01-5370a6df-en
CVE: CVE-2022-33735
Published: 2022-09-20
Description: There is a password verification vulnerability in WS7200-10 11.0.2.13. Attackers on the LAN may use brute force cracking to obtain passwords, which may cause sensitive system information to be disclosed.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-307, CWE-307
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20220628-01-2eda0853-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20220628-01-2eda0853-en
CVE: CVE-2022-37395
Published: 2022-09-20
Description: A Huawei device has an input verification vulnerability. Successful exploitation of this vulnerability may lead to DoS attacks.Affected product versions include:CV81-WDM FW versions 01.70.49.29.46.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-20
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20220810-01-8cfecdcc-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20220810-01-8cfecdcc-en
CVE: CVE-2022-37877
Published: 2022-09-20
Description: A vulnerability in the ClearPass OnGuard macOS agent could allow malicious users on a macOS instance to elevate their user privileges. A successful exploit could allow these users to execute arbitrary code with root level privileges on the macOS instance in Aruba ClearPass Policy Manager version(s): 6.10.x: 6.10.6 and below; 6.9.x: 6.9.11 and below. Aruba has released upgrades for Aruba ClearPass Policy Manager that address this security vulnerability.
CVSS Score: 7.8 (HIGH)
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-013.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-013.txt
CVE: CVE-2022-37878
Published: 2022-09-20
Description: Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complete system compromise in Aruba ClearPass Policy Manager version(s): 6.10.x: 6.10.6 and below; 6.9.x: 6.9.11 and below. Aruba has released upgrades for Aruba ClearPass Policy Manager that address these security vulnerabilities.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78, CWE-78
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-013.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-013.txt
CVE: CVE-2022-37879
Published: 2022-09-20
Description: Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complete system compromise in Aruba ClearPass Policy Manager version(s): 6.10.x: 6.10.6 and below; 6.9.x: 6.9.11 and below. Aruba has released upgrades for Aruba ClearPass Policy Manager that address these security vulnerabilities.
CVSS Score: 7.2 (HIGH)
CWE: CWE-77
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-013.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-013.txt
CVE: CVE-2022-37880
Published: 2022-09-20
Description: Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complete system compromise in Aruba ClearPass Policy Manager version(s): 6.10.x: 6.10.6 and below; 6.9.x: 6.9.11 and below. Aruba has released upgrades for Aruba ClearPass Policy Manager that address these security vulnerabilities.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-013.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-013.txt
CVE: CVE-2022-37881
Published: 2022-09-20
Description: Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complete system compromise in Aruba ClearPass Policy Manager version(s): 6.10.x: 6.10.6 and below; 6.9.x: 6.9.11 and below. Aruba has released upgrades for Aruba ClearPass Policy Manager that address these security vulnerabilities.
CVSS Score: 7.2 (HIGH)
CWE: CWE-77
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-013.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-013.txt
CVE: CVE-2022-37882
Published: 2022-09-20
Description: Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complete system compromise in Aruba ClearPass Policy Manager version(s): 6.10.x: 6.10.6 and below; 6.9.x: 6.9.11 and below. Aruba has released upgrades for Aruba ClearPass Policy Manager that address these security vulnerabilities.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-013.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-013.txt
CVE: CVE-2022-37883
Published: 2022-09-20
Description: Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complete system compromise in Aruba ClearPass Policy Manager version(s): 6.10.x: 6.10.6 and below; 6.9.x: 6.9.11 and below. Aruba has released upgrades for Aruba ClearPass Policy Manager that address these security vulnerabilities.
CVSS Score: 7.2 (HIGH)
CWE: CWE-77
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-013.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-013.txt
CVE: CVE-2022-37884
Published: 2022-09-20
Description: A vulnerability exists in the ClearPass Policy Manager Guest User Interface that can allow an unauthenticated attacker to send specific operations which result in a Denial-of-Service condition. A successful exploitation of this vulnerability results in the unavailability of the guest interface in Aruba ClearPass Policy Manager version(s): 6.10.x: 6.10.6 and below; 6.9.x: 6.9.11 and below. Aruba has released upgrades for Aruba ClearPass Policy Manager that address this security vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-013.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-013.txt
CVE: CVE-2022-38931
Published: 2022-09-20
Description: A Server-Side Request Forgery (SSRF) in fetch_net_file_upload function of baijiacmsV4 v4.1.4 allows remote attackers to force the application to make arbitrary requests via injection of arbitrary URLs into the url parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-918, CWE-918
References: https://github.com/zer0yu/CVE_Request/blob/master/baijiacms/baijiacmsv4_ssrf.md; https://github.com/zer0yu/CVE_Request/blob/master/baijiacms/baijiacmsv4_ssrf.md
CVE: CVE-2022-39218
Published: 2022-09-20
Description: The JS Compute Runtime for Fastly's Compute@Edge platform provides the environment JavaScript is executed in when using the Compute@Edge JavaScript SDK. In versions prior to 0.5.3, the `Math.random` and `crypto.getRandomValues` methods fail to use sufficiently random values. The initial value to seed the PRNG (pseudorandom number generator) is baked-in to the final WebAssembly module, making the sequence of random values for that specific WebAssembly module predictable. An attacker can use the fixed seed to predict random numbers generated by these functions and bypass cryptographic security controls, for example to disclose sensitive data encrypted by functions that use these generators. The problem has been patched in version 0.5.3. No known workarounds exist.
CVSS Score: 7.5 (HIGH)
CWE: CWE-335
References: https://github.com/fastly/js-compute-runtime/security/advisories/GHSA-cmr8-5w4c-44v8; https://github.com/fastly/js-compute-runtime/security/advisories/GHSA-cmr8-5w4c-44v8
CVE: CVE-2022-40008
Published: 2022-09-20
Description: SWFTools commit 772e55a was discovered to contain a heap-buffer overflow via the function readU8 at /lib/ttf.c.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://github.com/matthiaskramm/swftools/issues/188; https://github.com/matthiaskramm/swftools/issues/188
CVE: CVE-2022-40009
Published: 2022-09-20
Description: SWFTools commit 772e55a was discovered to contain a heap-use-after-free via the function grow_unicode at /lib/ttf.c.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416, CWE-416
References: https://github.com/matthiaskramm/swftools/issues/190; https://github.com/matthiaskramm/swftools/issues/190
CVE: CVE-2022-23685
Published: 2022-09-20
Description: A vulnerability in the ClearPass Policy Manager web-based management interface exists which exposes some endpoints to a lack of Cross-Site Request Forgery (CSRF) protection. This could allow a remote unauthenticated attacker to execute arbitrary input against these endpoints if the attacker can convince an authenticated user of the interface to interact with a specially crafted URL in Aruba ClearPass Policy Manager version(s): 6.10.x: 6.10.6 and below; 6.9.x: 6.9.11 and below. Aruba has released upgrades for Aruba ClearPass Policy Manager that address this security vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-013.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-013.txt
CVE: CVE-2022-23692
Published: 2022-09-20
Description: Vulnerabilities in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct SQL injection attacks against the ClearPass Policy Manager instance. An attacker could exploit these vulnerabilities to obtain and modify sensitive information in the underlying database potentially leading to complete compromise of the ClearPass Policy Manager cluster in Aruba ClearPass Policy Manager version(s): 6.10.x: 6.10.6 and below; 6.9.x: 6.9.11 and below. Aruba has released upgrades for Aruba ClearPass Policy Manager that address these security vulnerabilities.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-013.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-013.txt
CVE: CVE-2022-23693
Published: 2022-09-20
Description: Vulnerabilities in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct SQL injection attacks against the ClearPass Policy Manager instance. An attacker could exploit these vulnerabilities to obtain and modify sensitive information in the underlying database potentially leading to complete compromise of the ClearPass Policy Manager cluster in Aruba ClearPass Policy Manager version(s): 6.10.x: 6.10.6 and below; 6.9.x: 6.9.11 and below. Aruba has released upgrades for Aruba ClearPass Policy Manager that address these security vulnerabilities.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-013.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-013.txt
CVE: CVE-2022-23694
Published: 2022-09-20
Description: Vulnerabilities in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct SQL injection attacks against the ClearPass Policy Manager instance. An attacker could exploit these vulnerabilities to obtain and modify sensitive information in the underlying database potentially leading to complete compromise of the ClearPass Policy Manager cluster in Aruba ClearPass Policy Manager version(s): 6.10.x: 6.10.6 and below; 6.9.x: 6.9.11 and below. Aruba has released upgrades for Aruba ClearPass Policy Manager that address these security vulnerabilities.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-013.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-013.txt
CVE: CVE-2022-23695
Published: 2022-09-20
Description: Vulnerabilities in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct SQL injection attacks against the ClearPass Policy Manager instance. An attacker could exploit these vulnerabilities to obtain and modify sensitive information in the underlying database potentially leading to complete compromise of the ClearPass Policy Manager cluster in Aruba ClearPass Policy Manager version(s): 6.10.x: 6.10.6 and below; 6.9.x: 6.9.11 and below. Aruba has released upgrades for Aruba ClearPass Policy Manager that address these security vulnerabilities.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-013.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-013.txt
CVE: CVE-2022-23696
Published: 2022-09-20
Description: Vulnerabilities in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct SQL injection attacks against the ClearPass Policy Manager instance. An attacker could exploit these vulnerabilities to obtain and modify sensitive information in the underlying database potentially leading to complete compromise of the ClearPass Policy Manager cluster in Aruba ClearPass Policy Manager version(s): 6.10.x: 6.10.6 and below; 6.9.x: 6.9.11 and below. Aruba has released upgrades for Aruba ClearPass Policy Manager that address these security vulnerabilities.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-013.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-013.txt
CVE: CVE-2022-26696
Published: 2022-09-20
Description: This issue was addressed with improved environment sanitization. This issue is fixed in macOS Monterey 12.4. A sandboxed process may be able to circumvent sandbox restrictions.
CVSS Score: 8.8 (HIGH)
CWE: CWE-693
References: https://support.apple.com/en-us/HT213257; https://support.apple.com/en-us/HT213257
CVE: CVE-2022-28637
Published: 2022-09-20
Description: A local Denial of Service (DoS) and local arbitrary code execution vulnerability that could potentially lead to a loss of confidentiality, integrity, and availability were discovered in HPE Integrated Lights-Out 5 (iLO 5) in Version: 2.71. Hewlett Packard Enterprise has provided updated firmware for HPE Integrated Lights-Out 5 (iLO 5) that addresses these security vulnerabilities.
CVSS Score: 7.8 (HIGH)
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04365en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04365en_us
CVE: CVE-2022-28638
Published: 2022-09-20
Description: An isolated local disclosure of information and potential isolated local arbitrary code execution vulnerability that could potentially lead to a loss of confidentiality, integrity, and availability were discovered in HPE Integrated Lights-Out 5 (iLO 5) in Version: 2.71. Hewlett Packard Enterprise has provided updated firmware for HPE Integrated Lights-Out 5 (iLO 5) that addresses these security vulnerabilities.
CVSS Score: 7.8 (HIGH)
CWE: CWE-200
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04365en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04365en_us
CVE: CVE-2022-28639
Published: 2022-09-20
Description: A remote potential adjacent denial of service (DoS) and potential adjacent arbitrary code execution vulnerability that could potentially lead to a loss of confidentiality, integrity, and availability were discovered in HPE Integrated Lights-Out 5 (iLO 5) in Version: 2.71. Hewlett Packard Enterprise has provided updated firmware for HPE Integrated Lights-Out 5 (iLO 5) that addresses these security vulnerabilities.
CVSS Score: 8.8 (HIGH)
CWE: CWE-400
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04365en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04365en_us
CVE: CVE-2022-28640
Published: 2022-09-20
Description: A potential local adjacent arbitrary code execution vulnerability that could potentially lead to a loss of confidentiality, integrity, and availability was discovered in HPE Integrated Lights-Out 5 (iLO 5) in Version: 2.71. Hewlett Packard Enterprise has provided updated firmware for HPE Integrated Lights-Out 5 (iLO 5) that addresses this security vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04365en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04365en_us
CVE: CVE-2022-32788
Published: 2022-09-20
Description: A buffer overflow was addressed with improved bounds checking. This issue is fixed in watchOS 8.7, tvOS 15.6, iOS 15.6 and iPadOS 15.6, macOS Monterey 12.5. A remote user may be able to cause kernel code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120, CWE-120
References: https://support.apple.com/en-us/HT213340; https://support.apple.com/en-us/HT213342; https://support.apple.com/en-us/HT213345
CVE: CVE-2022-32795
Published: 2022-09-20
Description: This issue was addressed with improved checks. This issue is fixed in iOS 16, iOS 15.7 and iPadOS 15.7. Visiting a malicious website may lead to address bar spoofing.
CVSS Score: 4.3 (MEDIUM)
References: http://seclists.org/fulldisclosure/2022/Oct/39; http://seclists.org/fulldisclosure/2022/Oct/40; https://support.apple.com/en-us/HT213445
CVE: CVE-2022-32802
Published: 2022-09-20
Description: A logic issue was addressed with improved checks. This issue is fixed in iOS 15.6 and iPadOS 15.6, tvOS 15.6, macOS Monterey 12.5. Processing a maliciously crafted file may lead to arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-693
References: https://support.apple.com/en-us/HT213342; https://support.apple.com/en-us/HT213345; https://support.apple.com/en-us/HT213346
CVE: CVE-2022-32854
Published: 2022-09-20
Description: This issue was addressed with improved checks. This issue is fixed in iOS 15.7 and iPadOS 15.7, iOS 16, macOS Big Sur 11.7. An app may be able to bypass Privacy preferences.
CVSS Score: 5.5 (MEDIUM)
References: http://seclists.org/fulldisclosure/2022/Oct/39; http://seclists.org/fulldisclosure/2022/Oct/40; http://seclists.org/fulldisclosure/2022/Oct/45
CVE: CVE-2022-32861
Published: 2022-09-20
Description: A logic issue was addressed with improved state management. This issue is fixed in Safari 15.6, macOS Monterey 12.5. A user may be tracked through their IP address.
CVSS Score: 5.3 (MEDIUM)
References: https://support.apple.com/en-us/HT213341; https://support.apple.com/en-us/HT213345; https://support.apple.com/en-us/HT213341
CVE: CVE-2022-32863
Published: 2022-09-20
Description: A memory corruption issue was addressed with improved state management. This issue is fixed in Safari 15.6, macOS Monterey 12.5. Processing maliciously crafted web content may lead to arbitrary code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://support.apple.com/en-us/HT213341; https://support.apple.com/en-us/HT213345; https://support.apple.com/kb/HT213346
CVE: CVE-2022-32864
Published: 2022-09-20
Description: The issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.6, iOS 15.7 and iPadOS 15.7, iOS 16, macOS Big Sur 11.7. An app may be able to disclose kernel memory.
CVSS Score: 5.5 (MEDIUM)
References: http://seclists.org/fulldisclosure/2022/Oct/28; http://seclists.org/fulldisclosure/2022/Oct/39; http://seclists.org/fulldisclosure/2022/Oct/40