deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2016-2101
Published: 2022-07-28
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2016. Notes: none
CVE: CVE-2016-2122
Published: 2022-07-28
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2016. Notes: none
CVE: CVE-2016-3692
Published: 2022-07-28
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2016. Notes: none
CVE: CVE-2016-3700
Published: 2022-07-28
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2016. Notes: none
CVE: CVE-2016-3701
Published: 2022-07-28
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2016. Notes: none
CVE: CVE-2016-3709
Published: 2022-07-28
Description: Possible cross-site scripting vulnerability in libxml after commit 960f0e2.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://mail.gnome.org/archives/xml/2018-January/msg00010.html; https://lists.debian.org/debian-lts-announce/2024/09/msg00021.html; https://mail.gnome.org/archives/xml/2018-January/msg00010.html
CVE: CVE-2016-3730
Published: 2022-07-28
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2016. Notes: none
CVE: CVE-2016-4426
Published: 2022-07-28
Description: In zulip before 1.3.12, bot API keys were accessible to other users in the same realm.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284
References: https://zulip.readthedocs.io/en/2.1.7/overview/changelog.html#id35; https://zulip.readthedocs.io/en/2.1.7/overview/changelog.html#id35
CVE: CVE-2016-4427
Published: 2022-07-28
Description: In zulip before 1.3.12, deactivated users could access messages if SSO was enabled.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://zulip.readthedocs.io/en/2.1.7/overview/changelog.html#id35; https://zulip.readthedocs.io/en/2.1.7/overview/changelog.html#id35
CVE: CVE-2016-4452
Published: 2022-07-28
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2016. Notes: none
CVE: CVE-2016-4458
Published: 2022-07-28
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2016. Notes: none
CVE: CVE-2016-4991
Published: 2022-07-28
Description: Input passed to the Pdf() function is shell escaped and passed to child_process.exec() during PDF rendering. However, the shell escape does not properly encode all special characters, namely, semicolon and curly braces. This can be abused to achieve command execution. This problem affects nodepdf 1.3.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-77
References: https://lf.lc/cve/cve-2016-4991/; https://lf.lc/cve/cve-2016-4991/
CVE: CVE-2016-5413
Published: 2022-07-28
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2016. Notes: none
CVE: CVE-2016-5415
Published: 2022-07-28
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2016. Notes: none
CVE: CVE-2016-5428
Published: 2022-07-28
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2016. Notes: none
CVE: CVE-2016-6314
Published: 2022-07-28
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2016. Notes: none
CVE: CVE-2016-6315
Published: 2022-07-28
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2016. Notes: none
CVE: CVE-2016-6324
Published: 2022-07-28
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2016. Notes: none
CVE: CVE-2016-6326
Published: 2022-07-28
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2016. Notes: none
CVE: CVE-2016-7029
Published: 2022-07-28
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2016. Notes: none
CVE: CVE-2016-7049
Published: 2022-07-28
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2016. Notes: none
CVE: CVE-2022-2564
Published: 2022-07-28
Description: Prototype Pollution in GitHub repository automattic/mongoose prior to 6.4.6.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1321, CWE-1321
References: https://github.com/Automattic/mongoose/blob/51e758541763b6f14569744ced15cc23ab8b50c6/lib/schema.js#L88-L141; https://github.com/Automattic/mongoose/compare/6.4.5...6.4.6; https://github.com/automattic/mongoose/commit/a45cfb6b0ce0067ae9794cfa80f7917e1fb3c6f8
CVE: CVE-2022-34578
Published: 2022-07-28
Description: Open Source Point of Sale v3.3.7 was discovered to contain an arbitrary file upload vulnerability via the Update Branding Settings page.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: https://grimthereaperteam.medium.com/open-source-point-of-sale-v3-3-7-file-upload-cross-site-scripting-4900d717b2c3; https://grimthereaperteam.medium.com/open-source-point-of-sale-v3-3-7-file-upload-cross-site-scripting-4900d717b2c3
CVE: CVE-2022-34593
Published: 2022-07-28
Description: DPTech VPN v8.1.28.0 was discovered to contain an arbitrary file read vulnerability.
CVSS Score: 7.5 (HIGH)
References: https://github.com/Liyou-ZY/POC/issues/1; https://github.com/Liyou-ZY/POC/issues/1
CVE: CVE-2021-41556
Published: 2022-07-28
Description: sqclass.cpp in Squirrel through 2.2.5 and 3.x through 3.1 allows an out-of-bounds read (in the core interpreter) that can lead to Code Execution. If a victim executes an attacker-controlled squirrel script, it is possible for the attacker to break out of the squirrel script sandbox even if all dangerous functionality such as File System functions has been disabled. An attacker might abuse this bug to target (for example) Cloud services that allow customization via SquirrelScripts, or distribute malware through video games that embed a Squirrel Engine.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-125
References: http://www.squirrel-lang.org/#download; https://blog.sonarsource.com/squirrel-vm-sandbox-escape/; https://github.com/albertodemichelis/squirrel/commit/23a[PII_REDACTED]b996d20da3d4dd1a0dcf9b0bd98
CVE: CVE-2022-29360
Published: 2022-07-28
Description: The Email Viewer in RainLoop through 1.6.0 allows XSS via a crafted email message.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://blog.sonarsource.com/rainloop-emails-at-risk-due-to-code-flaw/; https://lists.debian.org/debian-lts-announce/2023/05/msg00027.html; https://www.rainloop.net/changelog/
CVE: CVE-2022-29558
Published: 2022-07-28
Description: Realtek rtl819x-SDK before v3.6.1 allows command injection over the web interface.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: https://www.realtek.com; https://www.realtek.com/images/safe-report/Realtek_APRouter_SDK_Advisory-CVE-2022-29558.pdf; https://www.realtek.com
CVE: CVE-2022-2399
Published: 2022-07-28
Description: Use after free in WebGPU in Google Chrome prior to 100.0.4896.88 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2022/04/stable-channel-update-for-desktop_11.html; https://crbug.com/1313172; https://chromereleases.googleblog.com/2022/04/stable-channel-update-for-desktop_11.html
CVE: CVE-2022-30287
Published: 2022-07-28
Description: Horde Groupware Webmail Edition through 5.2.22 allows a reflection injection attack through which an attacker can instantiate a driver class. This then leads to arbitrary deserialization of PHP objects.
CVSS Score: 8.0 (HIGH)
CWE: CWE-470, CWE-502
References: https://blog.sonarsource.com/horde-webmail-rce-via-email/; https://lists.debian.org/debian-lts-announce/2022/08/msg00022.html; https://www.horde.org/apps/webmail
CVE: CVE-2022-34568
Published: 2022-07-28
Description: SDL v1.2 was discovered to contain a use-after-free via the XFree function at /src/video/x11/SDL_x11yuv.c.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416
References: https://github.com/libsdl-org/SDL-1.2/issues/863; https://security.gentoo.org/glsa/202305-17; https://github.com/libsdl-org/SDL-1.2/issues/863
CVE: CVE-2022-34580
Published: 2022-07-28
Description: Advanced School Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the address parameter at ip/school/index.php.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/wencongzhao/bug_report/blob/main/vendors/itsourcecode.com/advanced-school-management-system/XSS-1.md; https://github.com/wencongzhao/bug_report/blob/main/vendors/itsourcecode.com/advanced-school-management-system/XSS-1.md
CVE: CVE-2021-39088
Published: 2022-07-28
Description: IBM QRadar SIEM 7.3, 7.4, and 7.5 is vulnerable to local privilege escalation if this could be combined with other unknown vulnerabilities then privilege escalation could be performed. IBM X-Force ID: 216111.
CVSS Score: 7.8 (HIGH)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/216111; https://www.ibm.com/support/pages/node/6607129; https://exchange.xforce.ibmcloud.com/vulnerabilities/216111
CVE: CVE-2022-34555
Published: 2022-07-28
Description: TP-LINK TL-R473G 2.0.1 Build 220529 Rel.65574n was discovered to contain a remote code execution vulnerability which is exploited via a crafted packet.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/skyedai910/Vuln/tree/master/TL-R473G/command_execution_0; https://github.com/skyedai910/Vuln/tree/master/TL-R473G/command_execution_0
CVE: CVE-2022-34556
Published: 2022-07-28
Description: PicoC v3.2.2 was discovered to contain a NULL pointer dereference at variable.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/jpoirier/picoc/issues/34; https://gitlab.com/zsaleeba/picoc/-/issues/47; https://github.com/jpoirier/picoc/issues/34
CVE: CVE-2022-34557
Published: 2022-07-28
Description: Barangay Management System v1.0 was discovered to contain a SQL injection vulnerability via the hidden_id parameter at /pages/permit/permit.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/AD-Appledog/bug_report/blob/main/vendors/itsourcecode.com/barangay-management-system/SQLi-1.md; https://github.com/AD-Appledog/bug_report/blob/main/vendors/itsourcecode.com/barangay-management-system/SQLi-1.md
CVE: CVE-2022-34558
Published: 2022-07-28
Description: WMAgent v1.3.3rc2 and 1.3.3rc1, reqmgr 2 1.4.1rc5 and 1.4.0rc2, reqmon 1.4.1rc5, and global-workqueue 1.4.1rc5 allows attackers to execute arbitrary code via a crafted dbs-client package.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/dmwm/WMCore/issues/11188; https://github.com/dmwm/WMCore/issues/11188
CVE: CVE-2022-36234
Published: 2022-07-28
Description: SimpleNetwork TCP Server commit 29bc615f0d9910eb2f59aa8dff1f54f0e3af4496 was discovered to contain a double free vulnerability which is exploited via crafted TCP packets.
CVSS Score: 7.5 (HIGH)
CWE: CWE-415
References: https://github.com/kashimAstro/SimpleNetwork/issues/22; https://github.com/kashimAstro/SimpleNetwork/issues/22
CVE: CVE-2022-36752
Published: 2022-07-28
Description: png2webp v1.0.4 was discovered to contain an out-of-bounds write via the function w2p. This vulnerability is exploitable via a crafted png file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://github.com/landfillbaby/png2webp/commit/8f21ad79b0cd98fc22d5b[PII_REDACTED]1946abbff; https://github.com/landfillbaby/png2webp/issues/3; https://github.com/landfillbaby/png2webp/commit/8f21ad79b0cd98fc22d5b[PII_REDACTED]1946abbff
CVE: CVE-2021-3601
Published: 2022-07-29
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. OpenSSL does not class this issue as a security vulnerability. The trusted CA store should not contain anything that the user does not trust to issue other certificates. Notes: https://github.com/openssl/openssl/issues/5236#issuecomment-119646061
CVE: CVE-2022-1799
Published: 2022-07-29
Description: Incorrect signature trust exists within Google Play services SDK play-services-basement. A debug version of Google Play services is trusted by the SDK for devices that are non-GMS. We recommend upgrading the SDK past the 2022-05-03 release.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-501
References: https://developers.google.com/android/guides/releases#may_03_2022; https://developers.google.com/android/guides/releases#may_03_2022
CVE: CVE-2022-24912
Published: 2022-07-29
Description: The package github.com/runatlantis/atlantis/server/controllers/events before 0.19.7 are vulnerable to Timing Attack in the webhook event validator code, which does not use a constant-time comparison function to validate the webhook secret. It can allow an attacker to recover this secret as an attacker and then forge webhook events.
CVSS Score: 7.5 (HIGH)
CWE: CWE-203
References: https://github.com/runatlantis/atlantis/commit/[PII_REDACTED]4adddaa4c99c8089e79b7d787fa820; https://github.com/runatlantis/atlantis/issues/2391; https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMRUNATLANTISATLANTISSERVERCONTROLLERSEVENTS-2950851
CVE: CVE-2022-1277
Published: 2022-07-29
Description: Inavitas Solar Log product has an unauthenticated SQL Injection vulnerability.
CVSS Score: 9.4 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://www.usom.gov.tr/bildirim/tr-22-0514; https://www.usom.gov.tr/bildirim/tr-22-0514
CVE: CVE-2022-2576
Published: 2022-07-29
Description: In Eclipse Californium version 2.0.0 to 2.7.2 and 3.0.0-3.5.0 a DTLS resumption handshake falls back to a DTLS full handshake on a parameter mismatch without using a HelloVerifyRequest. Especially, if used with certificate based cipher suites, that results in message amplification (DDoS other peers) and high CPU load (DoS own peer). The misbehavior occurs only with DTLS_VERIFY_PEERS_ON_RESUMPTION_THRESHOLD values larger than 0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-408
References: https://bugs.eclipse.org/580018; https://bugs.eclipse.org/580018
CVE: CVE-2022-35643
Published: 2022-07-29
Description: IBM PowerVM VIOS 3.1 could allow a remote attacker to tamper with system configuration or cause a denial of service. IBM X-Force ID: 230956.
CVSS Score: 9.1 (CRITICAL)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/230956; https://www.ibm.com/support/pages/node/6607886; https://exchange.xforce.ibmcloud.com/vulnerabilities/230956
CVE: CVE-2022-36123
Published: 2022-07-29
Description: The Linux kernel before 5.18.13 lacks a certain clear operation for the block starting symbol (.bss). This allows Xen PV guest OS users to cause a denial of service or gain privileges.
CVSS Score: 7.8 (HIGH)
References: https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.18.13; https://github.com/sickcodes/security/blob/master/advisories/SICK-2022-128.md; https://github.com/torvalds/linux/commit/74a0032b8524ee2bd4443128c0bf[PII_REDACTED]b0
CVE: CVE-2016-4981
Published: 2022-07-29
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-4982. Reason: This candidate is a duplicate of CVE-2016-4982. Notes: All CVE users should reference CVE-2016-4982 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2022-27873
Published: 2022-07-29
Description: An attacker can force the victim’s device to perform arbitrary HTTP requests in WAN through a malicious SVG file being parsed by Autodesk Fusion 360’s document parser. The vulnerability exists in the application’s ‘Insert SVG’ procedure. An attacker can also leverage this vulnerability to obtain victim’s public IP and possibly other sensitive information.
CVSS Score: 7.8 (HIGH)
CWE: CWE-611
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0013; https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0013
CVE: CVE-2022-2577
Published: 2022-07-29
Description: A vulnerability classified as critical was found in SourceCodester Garage Management System 1.0. This vulnerability affects unknown code of the file /edituser.php. The manipulation of the argument id with the input -2'%20UNION%20select%2011,user(),333,444--+ leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/ch0ing/vul/blob/main/WebRay.com.cn/Garage%20Management%20System%28SQLI%29.md; https://vuldb.com/?id.205300; https://github.com/ch0ing/vul/blob/main/WebRay.com.cn/Garage%20Management%20System%28SQLI%29.md
CVE: CVE-2022-2578
Published: 2022-07-29
Description: A vulnerability, which was classified as critical, has been found in SourceCodester Garage Management System 1.0. This issue affects some unknown processing of the file /php_action/createUser.php. The manipulation leads to improper access controls. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-284
References: https://github.com/ch0ing/vul/blob/main/WebRay.com.cn/Garage%20Management%20System--.md; https://vuldb.com/?id.205301; https://github.com/ch0ing/vul/blob/main/WebRay.com.cn/Garage%20Management%20System--.md
CVE: CVE-2022-2579
Published: 2022-07-29
Description: A vulnerability, which was classified as problematic, was found in SourceCodester Garage Management System 1.0. Affected is an unknown function of the file /php_action/createUser.php. The manipulation of the argument userName with the input lala<img src="" onerror=alert(1)> leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/ch0ing/vul/blob/main/WebRay.com.cn/Garage%20Management%20System%28XSS%29.md; https://vuldb.com/?id.205302; https://github.com/ch0ing/vul/blob/main/WebRay.com.cn/Garage%20Management%20System%28XSS%29.md
CVE: CVE-2022-33881
Published: 2022-07-29
Description: Parsing a maliciously crafted PRT file can force Autodesk AutoCAD 2023 to read beyond allocated boundaries. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0014; https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0014
CVE: CVE-2022-35629
Published: 2022-07-29
Description: Due to a bug in the handling of the communication between the client and server, it was possible for one client, already registered with their own client ID, to send messages to the server claiming to come from another client ID. This issue was resolved in Velociraptor 0.6.5-2.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-287, CWE-290
References: https://www.rapid7.com/blog/post/2022/07/26/cve-2022-35629-35632-velociraptor-multiple-vulnerabilities-fixed/; https://www.rapid7.com/blog/post/2022/07/26/cve-2022-35629-35632-velociraptor-multiple-vulnerabilities-fixed/
CVE: CVE-2022-35630
Published: 2022-07-29
Description: A cross-site scripting (XSS) issue in generating a collection report made it possible for malicious clients to inject JavaScript code into the static HTML file. This issue was resolved in Velociraptor 0.6.5-2.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.rapid7.com/blog/post/2022/07/26/cve-2022-35629-35632-velociraptor-multiple-vulnerabilities-fixed/; https://www.rapid7.com/blog/post/2022/07/26/cve-2022-35629-35632-velociraptor-multiple-vulnerabilities-fixed/
CVE: CVE-2022-35631
Published: 2022-07-29
Description: On MacOS and Linux, it may be possible to perform a symlink attack by replacing this predictable file name with a symlink to another file and have the Velociraptor client overwrite the other file. This issue was resolved in Velociraptor 0.6.5-2.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-377, CWE-59
References: https://www.rapid7.com/blog/post/2022/07/26/cve-2022-35629-35632-velociraptor-multiple-vulnerabilities-fixed/; https://www.rapid7.com/blog/post/2022/07/26/cve-2022-35629-35632-velociraptor-multiple-vulnerabilities-fixed/
CVE: CVE-2022-35632
Published: 2022-07-29
Description: The Velociraptor GUI contains an editor suggestion feature that can display the description field of a VQL function, plugin or artifact. This field was not properly sanitized and can lead to cross-site scripting (XSS). This issue was resolved in Velociraptor 0.6.5-2.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.rapid7.com/blog/post/2022/07/26/cve-2022-35629-35632-velociraptor-multiple-vulnerabilities-fixed/; https://www.rapid7.com/blog/post/2022/07/26/cve-2022-35629-35632-velociraptor-multiple-vulnerabilities-fixed/
CVE: CVE-2022-23001
Published: 2022-07-29
Description: When compressing or decompressing elliptic curve points using the Sweet B library, an incorrect choice of sign bit is used. An attacker with user level privileges and no other user's assistance can exploit this vulnerability with only knowledge of the public key and the library. The resulting output may cause an error when used in other operations; for instance, verification of a valid signature under a decompressed public key may fail. This may be leveraged by an attacker to cause an error scenario in applications which use the library, resulting in a limited denial of service for an individual user. The scope of impact cannot extend to other components.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-682, CWE-682
References: https://www.westerndigital.com/support/product-security/wdc-22013-sweet-b-incorrect-output-vulnerabilities; https://www.westerndigital.com/support/product-security/wdc-22013-sweet-b-incorrect-output-vulnerabilities
CVE: CVE-2022-23002
Published: 2022-07-29
Description: When compressing or decompressing a point on the NIST P-256 elliptic curve with an X coordinate of zero, the resulting output is not properly reduced modulo the P-256 field prime and is invalid. The resulting output will cause an error when used in other operations. This may be leveraged by an attacker to cause an error scenario in applications which use the library, resulting in a limited denial of service for an individual user. The scope of impact cannot extend to other components.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-703
References: https://www.westerndigital.com/support/product-security/wdc-22013-sweet-b-incorrect-output-vulnerabilities; https://www.westerndigital.com/support/product-security/wdc-22013-sweet-b-incorrect-output-vulnerabilities