deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-6921
Published: 2022-02-16
Description: Potential security vulnerabilities including compromise of integrity, and allowed communication with untrusted clients has been identified in HP Support Assistant software.
CVSS Score: 7.8 (HIGH)
References: https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2022/MNDT-2022-0030/MNDT-2022-0030.md; https://support.hp.com/us-en/document/ish_5[PII_REDACTED]023-16; https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2022/MNDT-2022-0030/MNDT-2022-0030.md
CVE: CVE-2020-6922
Published: 2022-02-16
Description: Potential security vulnerabilities including compromise of integrity, and allowed communication with untrusted clients has been identified in HP Support Assistant software.
CVSS Score: 7.8 (HIGH)
References: https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2022/MNDT-2022-0030/MNDT-2022-0030.md; https://support.hp.com/us-en/document/ish_5[PII_REDACTED]023-16; https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2022/MNDT-2022-0030/MNDT-2022-0030.md
CVE: CVE-2021-21958
Published: 2022-02-16
Description: A heap-based buffer overflow vulnerability exists in the Hword HwordApp.dll functionality of Hancom Office 2020 11.0.0.2353. A specially-crafted malformed file can lead to memory corruption and potential arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1386; https://blog.talosintelligence.com/2022/02/vuln-spotlight-.html; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1386
CVE: CVE-2021-21966
Published: 2022-02-16
Description: An information disclosure vulnerability exists in the HTTP Server /ping.html functionality of Texas Instruments CC3200 SimpleLink Solution NWP 2.9.0.0. A specially-crafted HTTP request can lead to an uninitialized read. An attacker can send an HTTP request to trigger this vulnerability.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-457, CWE-908
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1393; https://www.ti.com/lit/an/swra740/swra740.pdf?ts=[PII_REDACTED]64&; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1393
CVE: CVE-2021-22040
Published: 2022-02-16
Description: VMware ESXi, Workstation, and Fusion contain a use-after-free vulnerability in the XHCI USB controller. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-416
References: https://www.vmware.com/security/advisories/VMSA-2022-0004.html; https://www.vmware.com/security/advisories/VMSA-2022-0004.html
CVE: CVE-2021-22041
Published: 2022-02-16
Description: VMware ESXi, Workstation, and Fusion contain a double-fetch vulnerability in the UHCI USB controller. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host.
CVSS Score: 6.7 (MEDIUM)
References: https://www.vmware.com/security/advisories/VMSA-2022-0004.html; https://www.vmware.com/security/advisories/VMSA-2022-0004.html
CVE: CVE-2021-22042
Published: 2022-02-16
Description: VMware ESXi contains an unauthorized access vulnerability due to VMX having access to settingsd authorization tickets. A malicious actor with privileges within the VMX process only, may be able to access settingsd service running as a high privileged user.
CVSS Score: 7.8 (HIGH)
CWE: CWE-863
References: https://www.vmware.com/security/advisories/VMSA-2022-0004.html; https://www.vmware.com/security/advisories/VMSA-2022-0004.html
CVE: CVE-2021-22043
Published: 2022-02-16
Description: VMware ESXi contains a TOCTOU (Time-of-check Time-of-use) vulnerability that exists in the way temporary files are handled. A malicious actor with access to settingsd, may exploit this issue to escalate their privileges by writing arbitrary files.
CVSS Score: 7.5 (HIGH)
CWE: CWE-367
References: https://www.vmware.com/security/advisories/VMSA-2022-0004.html; https://www.vmware.com/security/advisories/VMSA-2022-0004.html
CVE: CVE-2021-22050
Published: 2022-02-16
Description: ESXi contains a slow HTTP POST denial-of-service vulnerability in rhttpproxy. A malicious actor with network access to ESXi may exploit this issue to create a denial-of-service condition by overwhelming rhttpproxy service with multiple requests.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://www.vmware.com/security/advisories/VMSA-2022-0004.html; https://www.vmware.com/security/advisories/VMSA-2022-0004.html
CVE: CVE-2021-23682
Published: 2022-02-16
Description: This affects the package litespeed.js before 0.3.12; the package appwrite/server-ce from 0.12.0 and before 0.12.2, before 0.11.1. When parsing the query string in the getJsonFromUrl function, the key that is set in the result object is not properly sanitized leading to a Prototype Pollution vulnerability.
CVSS Score: 7.3 (HIGH)
CWE: CWE-1321
References: https://github.com/appwrite/appwrite/pull/2778; https://github.com/appwrite/appwrite/releases/tag/0.11.1; https://github.com/appwrite/appwrite/releases/tag/0.12.2
CVE: CVE-2021-39297
Published: 2022-02-16
Description: Potential vulnerabilities have been identified in UEFI firmware (BIOS) for some PC products which may allow escalation of privilege and arbitrary code execution.
CVSS Score: 8.8 (HIGH)
References: https://support.hp.com/us-en/document/ish_5[PII_REDACTED]090-16; https://support.hp.com/us-en/document/ish_5[PII_REDACTED]090-16
CVE: CVE-2021-39298
Published: 2022-02-16
Description: A potential vulnerability in AMD System Management Mode (SMM) interrupt handler may allow an attacker with high privileges to access the SMM resulting in arbitrary code execution which could be used by malicious actors to bypass security mechanisms provided in the UEFI firmware.
CVSS Score: 8.8 (HIGH)
References: https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1027; https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1032; https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1027
CVE: CVE-2021-39299
Published: 2022-02-16
Description: Potential vulnerabilities have been identified in UEFI firmware (BIOS) for some PC products which may allow escalation of privilege and arbitrary code execution.
CVSS Score: 8.8 (HIGH)
References: https://support.hp.com/us-en/document/ish_5[PII_REDACTED]090-16; https://support.hp.com/us-en/document/ish_5[PII_REDACTED]090-16
CVE: CVE-2021-39300
Published: 2022-02-16
Description: Potential vulnerabilities have been identified in UEFI firmware (BIOS) for some PC products which may allow escalation of privilege and arbitrary code execution.
CVSS Score: 8.8 (HIGH)
References: https://support.hp.com/us-en/document/ish_5[PII_REDACTED]090-16; https://support.hp.com/us-en/document/ish_5[PII_REDACTED]090-16
CVE: CVE-2021-39301
Published: 2022-02-16
Description: Potential vulnerabilities have been identified in UEFI firmware (BIOS) for some PC products which may allow escalation of privilege and arbitrary code execution.
CVSS Score: 8.8 (HIGH)
References: https://support.hp.com/us-en/document/ish_5[PII_REDACTED]090-16; https://support.hp.com/us-en/document/ish_5[PII_REDACTED]090-16
CVE: CVE-2021-3551
Published: 2022-02-16
Description: A flaw was found in the PKI-server, where the spkispawn command, when run in debug mode, stores admin credentials in the installation log file. This flaw allows a local attacker to retrieve the file to obtain the admin password and gain admin privileges to the Dogtag CA manager. The highest threat from this vulnerability is to confidentiality.
CVSS Score: 7.8 (HIGH)
CWE: CWE-312, CWE-312
References: https://bugzilla.redhat.com/show_bug.cgi?id=1959971; https://bugzilla.redhat.com/show_bug.cgi?id=1959971
CVE: CVE-2021-3557
Published: 2022-02-16
Description: A flaw was found in argocd. Any unprivileged user is able to deploy argocd in their namespace and with the created ServiceAccount argocd-argocd-server, the unprivileged user is able to read all resources of the cluster including all secrets which might enable privilege escalations. The highest threat from this vulnerability is to data confidentiality.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-732, CWE-732
References: https://bugzilla.redhat.com/show_bug.cgi?id=1961929; https://bugzilla.redhat.com/show_bug.cgi?id=1961929
CVE: CVE-2021-3648
Published: 2022-02-16
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-3530. Reason: This candidate is a reservation duplicate of CVE-2021-3530. Notes: All CVE users should reference CVE-2021-3530 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2021-4106
Published: 2022-02-16
Description: A vulnerability in Snow Inventory Java Scanner allows an attacker to run malicious code at a higher level of privileges. This issue affects: SNOW Snow Inventory Java Scanner 1.0
CVSS Score: 7.8 (HIGH)
CWE: CWE-691
References: https://community.snowsoftware.com/s/feed/0D5690000BObYdUCQV; https://community.snowsoftware.com/s/feed/0D5690000BObYdUCQV
CVE: CVE-2021-4134
Published: 2022-02-16
Description: The Fancy Product Designer WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the ID parameter found in the ~/inc/api/class-view.php file which allows attackers with administrative level permissions to inject arbitrary SQL queries to obtain sensitive information, in versions up to and including 4.7.4.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://support.fancyproductdesigner.com/support/discussions/topics/[PII_REDACTED]; https://www.wordfence.com/vulnerability-advisories/#CVE-2021-4134; https://support.fancyproductdesigner.com/support/discussions/topics/[PII_REDACTED]
CVE: CVE-2021-4220
Published: 2022-02-16
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2022-0513
Published: 2022-02-16
Description: The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the exclusion_reason parameter found in the ~/includes/class-wp-statistics-exclusion.php file which allows attackers without authentication to inject arbitrary SQL queries to obtain sensitive information, in versions up to and including 13.1.4. This requires the "Record Exclusions" option to be enabled on the vulnerable site.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://plugins.trac.wordpress.org/changeset/2671297/wp-statistics/trunk/includes/class-wp-statistics-hits.php; https://www.wordfence.com/blog/2022/02/unauthenticated-sql-injection-vulnerability-patched-in-wordpress-statistics-plugin/; https://plugins.trac.wordpress.org/changeset/2671297/wp-statistics/trunk/includes/class-wp-statistics-hits.php
CVE: CVE-2022-0617
Published: 2022-02-16
Description: A flaw null pointer dereference in the Linux kernel UDF file system functionality was found in the way user triggers udf_file_write_iter function for the malicious UDF image. A local user could use this flaw to crash the system. Actual from Linux kernel 4.2-rc1 till 5.17-rc2.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: http://www.openwall.com/lists/oss-security/2022/04/13/2; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=7fc3b7c2981bbd1047916ade327beccb90994eee; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=ea8569194b43f0f01f0a84c689388542c7254a1f
CVE: CVE-2022-22792
Published: 2022-02-16
Description: MobiSoft - MobiPlus User Take Over and Improper Handling of url Parameters Attacker can navigate to specific url which will expose all the users and password in clear text. http://IP/MobiPlusWeb/Handlers/MainHandler.ashx?MethodName=GridData&amp;GridName=Users
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-233
References: https://www.gov.il/en/departments/faq/cve_advisories; https://www.gov.il/en/departments/faq/cve_advisories
CVE: CVE-2022-22945
Published: 2022-02-16
Description: VMware NSX Edge contains a CLI shell injection vulnerability. A malicious actor with SSH access to an NSX-Edge appliance can execute arbitrary commands on the operating system as root.
CVSS Score: 7.8 (HIGH)
CWE: CWE-78
References: https://www.vmware.com/security/advisories/VMSA-2022-0005.html; https://www.vmware.com/security/advisories/VMSA-2022-0005.html
CVE: CVE-2022-23186
Published: 2022-02-16
Description: Adobe Illustrator versions 25.4.3 (and earlier) and 26.0.2 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/illustrator/apsb22-07.html; https://helpx.adobe.com/security/products/illustrator/apsb22-07.html
CVE: CVE-2022-23188
Published: 2022-02-16
Description: Adobe Illustrator versions 25.4.3 (and earlier) and 26.0.2 (and earlier) are affected by a buffer overflow vulnerability due to insecure handling of a crafted malicious file, potentially resulting in arbitrary code execution in the context of the current user. Exploitation requires user interaction in that a victim must open a crafted malicious file in Illustrator.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://helpx.adobe.com/security/products/illustrator/apsb22-07.html; https://helpx.adobe.com/security/products/illustrator/apsb22-07.html
CVE: CVE-2022-23189
Published: 2022-02-16
Description: Adobe Illustrator versions 25.4.3 (and earlier) and 26.0.2 (and earlier) are affected by a Null pointer dereference vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://helpx.adobe.com/security/products/illustrator/apsb22-07.html; https://helpx.adobe.com/security/products/illustrator/apsb22-07.html
CVE: CVE-2022-23190
Published: 2022-02-16
Description: Adobe Illustrator versions 25.4.3 (and earlier) and 26.0.2 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/illustrator/apsb22-07.html; https://helpx.adobe.com/security/products/illustrator/apsb22-07.html
CVE: CVE-2022-23191
Published: 2022-02-16
Description: Adobe Illustrator versions 25.4.3 (and earlier) and 26.0.2 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/illustrator/apsb22-07.html; https://helpx.adobe.com/security/products/illustrator/apsb22-07.html
CVE: CVE-2022-23192
Published: 2022-02-16
Description: Adobe Illustrator versions 25.4.3 (and earlier) and 26.0.2 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/illustrator/apsb22-07.html; https://helpx.adobe.com/security/products/illustrator/apsb22-07.html
CVE: CVE-2022-23193
Published: 2022-02-16
Description: Adobe Illustrator versions 25.4.3 (and earlier) and 26.0.2 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://helpx.adobe.com/security/products/illustrator/apsb22-07.html; https://helpx.adobe.com/security/products/illustrator/apsb22-07.html
CVE: CVE-2022-23194
Published: 2022-02-16
Description: Adobe Illustrator versions 25.4.3 (and earlier) and 26.0.2 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/illustrator/apsb22-07.html; https://helpx.adobe.com/security/products/illustrator/apsb22-07.html
CVE: CVE-2022-23195
Published: 2022-02-16
Description: Adobe Illustrator versions 25.4.3 (and earlier) and 26.0.2 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/illustrator/apsb22-07.html; https://helpx.adobe.com/security/products/illustrator/apsb22-07.html
CVE: CVE-2022-23196
Published: 2022-02-16
Description: Adobe Illustrator versions 25.4.3 (and earlier) and 26.0.2 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/illustrator/apsb22-07.html; https://helpx.adobe.com/security/products/illustrator/apsb22-07.html
CVE: CVE-2022-23197
Published: 2022-02-16
Description: Adobe Illustrator versions 25.4.3 (and earlier) and 26.0.2 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/illustrator/apsb22-07.html; https://helpx.adobe.com/security/products/illustrator/apsb22-07.html
CVE: CVE-2022-23198
Published: 2022-02-16
Description: Adobe Illustrator versions 25.4.3 (and earlier) and 26.0.2 (and earlier) are affected by a Null pointer dereference vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://helpx.adobe.com/security/products/illustrator/apsb22-07.html; https://helpx.adobe.com/security/products/illustrator/apsb22-07.html
CVE: CVE-2022-23199
Published: 2022-02-16
Description: Adobe Illustrator versions 25.4.3 (and earlier) and 26.0.2 (and earlier) are affected by a Null pointer dereference vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://helpx.adobe.com/security/products/illustrator/apsb22-07.html; https://helpx.adobe.com/security/products/illustrator/apsb22-07.html
CVE: CVE-2022-23200
Published: 2022-02-16
Description: Adobe After Effects versions 22.1.1 (and earlier) and 18.4.3 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/after_effects/apsb22-09.html; https://www.zerodayinitiative.com/advisories/ZDI-22-376/; https://helpx.adobe.com/security/products/after_effects/apsb22-09.html
CVE: CVE-2022-23202
Published: 2022-02-16
Description: Adobe Creative Cloud Desktop version 2.7.0.13 (and earlier) is affected by an Uncontrolled Search Path Element vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must download a malicious DLL file. The attacker has to deliver the DLL on the same folder as the installer which makes it as a high complexity attack vector.
CVSS Score: 7.0 (HIGH)
CWE: CWE-427
References: https://helpx.adobe.com/security/products/creative-cloud/apsb22-11.html; https://helpx.adobe.com/security/products/creative-cloud/apsb22-11.html
CVE: CVE-2022-23203
Published: 2022-02-16
Description: Adobe Photoshop versions 22.5.4 (and earlier) and 23.1 (and earlier) are affected by a buffer overflow vulnerability due to insecure handling of a crafted file, potentially resulting in arbitrary code execution in the context of the current user. Exploitation requires user interaction in that a victim must open a crafted file in Photoshop.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://helpx.adobe.com/security/products/photoshop/apsb22-08.html; https://helpx.adobe.com/security/products/photoshop/apsb22-08.html
CVE: CVE-2022-23204
Published: 2022-02-16
Description: Adobe Premiere Rush versions 2.0 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/premiere_rush/apsb22-06.html; https://helpx.adobe.com/security/products/premiere_rush/apsb22-06.html
CVE: CVE-2022-23803
Published: 2022-02-16
Description: A stack-based buffer overflow vulnerability exists in the Gerber Viewer gerber and excellon ReadXYCoord coordinate parsing functionality of KiCad EDA 6.0.1 and master commit de006fc010. A specially-crafted gerber or excellon file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://lists.debian.org/debian-lts-announce/2022/05/msg00009.html; https://lists.debian.org/debian-lts-announce/2022/08/msg00010.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5EMCGSSP3FIWCSL2KXVXLF35JYZKZE5Q/
CVE: CVE-2022-23804
Published: 2022-02-16
Description: A stack-based buffer overflow vulnerability exists in the Gerber Viewer gerber and excellon ReadIJCoord coordinate parsing functionality of KiCad EDA 6.0.1 and master commit de006fc010. A specially-crafted gerber or excellon file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://lists.debian.org/debian-lts-announce/2022/05/msg00009.html; https://lists.debian.org/debian-lts-announce/2022/08/msg00010.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5EMCGSSP3FIWCSL2KXVXLF35JYZKZE5Q/