deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-39201
Published: 2022-10-13
Description: Grafana is an open source observability and data visualization platform. Starting with version 5.0.0-beta1 and prior to versions 8.5.14 and 9.1.8, Grafana could leak the authentication cookie of users to plugins. The vulnerability impacts data source and plugin proxy endpoints under certain conditions. The destination plugin could receive a user's Grafana authentication cookie. Versions 9.1.8 and 8.5.14 contain a patch for this issue. There are no known workarounds.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-200
References: https://github.com/grafana/grafana/commit/b571acc1dc130a33f24742c1f93b93216da6cf57; https://github.com/grafana/grafana/commit/c658816f5229d17f877579250c07799d3bbaebc9; https://github.com/grafana/grafana/releases/tag/v9.1.8
CVE: CVE-2022-39229
Published: 2022-10-13
Description: Grafana is an open source data visualization platform for metrics, logs, and traces. Versions prior to 9.1.8 and 8.5.14 allow one user to block another user's login attempt by registering someone else'e email address as a username. A Grafana user’s username and email address are unique fields, that means no other user can have the same username or email address as another user. A user can have an email address as a username. However, the login system allows users to log in with either username or email address. Since Grafana allows a user to log in with either their username or email address, this creates an usual behavior where `user_1` can register with one email address and `user_2` can register their username as `user_1`’s email address. This prevents `user_1` logging into the application since `user_1`'s password won’t match with `user_2`'s email address. Versions 9.1.8 and 8.5.14 contain a patch. There are no workarounds for this issue.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-287
References: https://github.com/grafana/grafana/commit/5644758f0c5ae9955a4e5480d71f9bef57fdce35; https://github.com/grafana/grafana/releases/tag/v9.1.8; https://github.com/grafana/grafana/security/advisories/GHSA-gj7m-853r-289r
CVE: CVE-2022-39278
Published: 2022-10-13
Description: Istio is an open platform-independent service mesh that provides traffic management, policy enforcement, and telemetry collection. Prior to versions 1.15.2, 1.14.5, and 1.13.9, the Istio control plane, istiod, is vulnerable to a request processing error, allowing a malicious attacker that sends a specially crafted or oversized message which results in the control plane crashing when the Kubernetes validating or mutating webhook service is exposed publicly. This endpoint is served over TLS port 15017, but does not require any authentication from the attacker. For simple installations, Istiod is typically only reachable from within the cluster, limiting the blast radius. However, for some deployments, especially external istiod topologies, this port is exposed over the public internet. Versions 1.15.2, 1.14.5, and 1.13.9 contain patches for this issue. There are no effective workarounds, beyond upgrading. This bug is due to an error in `regexp.Compile` in Go.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://github.com/istio/istio/security/advisories/GHSA-86vr-4wcv-mm9w; https://istio.io/latest/news/releases/1.13.x/announcing-1.13.9/; https://istio.io/latest/news/releases/1.15.x/announcing-1.15.2/
CVE: CVE-2022-39295
Published: 2022-10-13
Description: Knowage is an open source suite for modern business analytics alternative over big data systems. KnowageLabs / Knowage-Server starting with the 6.x branch and prior to versions 7.4.22, 8.0.9, and 8.1.0 is vulnerable to cross-site scripting because the `XSSRequestWrapper::stripXSS` method can be bypassed. Versions 7.4.22, 8.0.9, and 8.1.0 contain patches for this issue. There are no known workarounds.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-87, CWE-79
References: https://github.com/KnowageLabs/Knowage-Server/blob/b079a654c1708f82f6914c55be6715ad621d9edd/knowageutils/src/main/java/it/eng/spagobi/utilities/filters/XSSRequestWrapper.java#L82-L206; https://github.com/KnowageLabs/Knowage-Server/security/advisories/GHSA-f2gr-6h9j-rwcw; https://github.com/KnowageLabs/Knowage-Server/blob/b079a654c1708f82f6914c55be6715ad621d9edd/knowageutils/src/main/java/it/eng/spagobi/utilities/filters/XSSRequestWrapper.java#L82-L206
CVE: CVE-2022-39303
Published: 2022-10-13
Description: Ree6 is a moderation bot. This vulnerability allows manipulation of SQL queries. This issue has been patched in version 1.7.0 by using Javas PreparedStatements, which allow object setting without the risk of SQL injection. There are currently no known workarounds.
CVSS Score: 8.1 (HIGH)
CWE: CWE-89
References: https://github.com/Ree6-Applications/Ree6/compare/1.6.4...1.7.; https://github.com/Ree6-Applications/Ree6/security/advisories/GHSA-69xv-xjfw-4pv8; https://github.com/Ree6-Applications/Ree6/compare/1.6.4...1.7.
CVE: CVE-2022-41390
Published: 2022-10-13
Description: OcoMon v4.0 was discovered to contain a SQL injection vulnerability via the cod parameter at download.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://gist.github.com/fgimenesp/a30dcc4fb7912334b6fb1b145a56ad88; https://gist.github.com/fgimenesp/a30dcc4fb7912334b6fb1b145a56ad88
CVE: CVE-2022-41391
Published: 2022-10-13
Description: OcoMon v4.0 was discovered to contain a SQL injection vulnerability via the cod parameter at showImg.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-79
References: https://gist.github.com/fgimenesp/a30dcc4fb7912334b6fb1b145a56ad88; https://gist.github.com/fgimenesp/a30dcc4fb7912334b6fb1b145a56ad88
CVE: CVE-2022-42719
Published: 2022-10-13
Description: A use-after-free in the mac80211 stack when parsing a multi-BSSID element in the Linux kernel 5.2 through 5.19.x before 5.19.16 could be used by attackers (able to inject WLAN frames) to crash the kernel and potentially execute code.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: http://packetstormsecurity.com/files/171005/Kernel-Live-Patch-Security-Notice-LNS-0091-1.html; http://www.openwall.com/lists/oss-security/2022/10/13/2; http://www.openwall.com/lists/oss-security/2022/10/13/5
CVE: CVE-2022-39302
Published: 2022-10-14
Description: Ree6 is a moderation bot. This vulnerability would allow other server owners to create configurations such as "Better-Audit-Logging" which contain a channel from another server as a target. This would mean you could send log messages to another Guild channel and bypass raid and webhook protections. A specifically crafted log message could allow spamming and mass advertisements. This issue has been patched in version 1.9.9. There are currently no known workarounds.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-863
References: https://github.com/Ree6-Applications/Ree6/commit/459b5bc24f0ea27e50031f563373926e94b9aa0a; https://github.com/Ree6-Applications/Ree6/security/advisories/GHSA-v574-xgcf-5w8x; https://github.com/Ree6-Applications/Ree6/commit/459b5bc24f0ea27e50031f563373926e94b9aa0a
CVE: CVE-2022-41674
Published: 2022-10-14
Description: An issue was discovered in the Linux kernel before 5.19.16. Attackers able to inject WLAN frames could cause a buffer overflow in the ieee80211_bss_info_update function in net/mac80211/scan.c.
CVSS Score: 8.1 (HIGH)
CWE: CWE-787, CWE-787
References: http://packetstormsecurity.com/files/169951/Kernel-Live-Patch-Security-Notice-LSN-0090-1.html; http://www.openwall.com/lists/oss-security/2022/10/13/2; https://bugzilla.suse.com/show_bug.cgi?id=1203770
CVE: CVE-2022-42720
Published: 2022-10-14
Description: Various refcounting bugs in the multi-BSS handling in the mac80211 stack in the Linux kernel 5.1 through 5.19.x before 5.19.16 could be used by local attackers (able to inject WLAN frames) to trigger use-after-free conditions to potentially execute code.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: http://packetstormsecurity.com/files/169951/Kernel-Live-Patch-Security-Notice-LSN-0090-1.html; http://www.openwall.com/lists/oss-security/2022/10/13/5; https://bugzilla.suse.com/show_bug.cgi?id=1204059
CVE: CVE-2022-42721
Published: 2022-10-14
Description: A list management bug in BSS handling in the mac80211 stack in the Linux kernel 5.1 through 5.19.x before 5.19.16 could be used by local attackers (able to inject WLAN frames) to corrupt a linked list and, in turn, potentially execute code.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-835, CWE-835
References: http://packetstormsecurity.com/files/169951/Kernel-Live-Patch-Security-Notice-LSN-0090-1.html; http://www.openwall.com/lists/oss-security/2022/10/13/5; https://bugzilla.suse.com/show_bug.cgi?id=1204060
CVE: CVE-2022-42722
Published: 2022-10-14
Description: In the Linux kernel 5.8 through 5.19.x before 5.19.16, local attackers able to inject WLAN frames into the mac80211 stack could cause a NULL pointer dereference denial-of-service attack against the beacon protection of P2P devices.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: http://packetstormsecurity.com/files/169951/Kernel-Live-Patch-Security-Notice-LSN-0090-1.html; http://www.openwall.com/lists/oss-security/2022/10/13/5; https://bugzilla.suse.com/show_bug.cgi?id=1204125
CVE: CVE-2022-36802
Published: 2022-10-14
Description: The ManageJiraConnectors API in Atlassian Jira Align before version 10.109.2 allows remote attackers to exploit this issue to access internal network resources via a Server-Side Request Forgery. This can be exploited by a remote, unauthenticated attacker with Super Admin privileges by sending a specially crafted HTTP request.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-918, CWE-918
References: https://jira.atlassian.com/browse/JIRAALIGN-4326; https://jira.atlassian.com/browse/JIRAALIGN-4326
CVE: CVE-2022-36803
Published: 2022-10-14
Description: The MasterUserEdit API in Atlassian Jira Align Server before version 10.109.2 allows An authenticated attacker with the People role permission to use the MasterUserEdit API to modify any users role to Super Admin. This vulnerability was reported by Jacob Shafer from Bishop Fox.
CVSS Score: 8.8 (HIGH)
CWE: CWE-276, CWE-276
References: https://jira.atlassian.com/browse/JIRAALIGN-4281; https://jira.atlassian.com/browse/JIRAALIGN-4281
CVE: CVE-2022-41538
Published: 2022-10-14
Description: Wedding Planner v1.0 was discovered to contain an arbitrary file upload vulnerability in the component /Wedding-Management-PHP/admin/photos_add.php. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434, CWE-434
References: https://github.com/gougou123-hash/bug_report/blob/main/vendors/pushpam02/wedding-planner/RCE-1.md; https://github.com/gougou123-hash/bug_report/blob/main/vendors/pushpam02/wedding-planner/RCE-1.md
CVE: CVE-2022-41539
Published: 2022-10-14
Description: Wedding Planner v1.0 was discovered to contain an arbitrary file upload vulnerability in the component /admin/users_add.php. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434, CWE-434
References: https://github.com/gougou123-hash/bug_report/blob/main/vendors/pushpam02/wedding-planner/RCE-2.md; https://github.com/gougou123-hash/bug_report/blob/main/vendors/pushpam02/wedding-planner/RCE-2.md
CVE: CVE-2022-41535
Published: 2022-10-14
Description: Open Source SACCO Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /sacco_shield/manage_borrower.php.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/coues/bug_report/blob/main/vendors/mayuri_k/open-source-sacco-management-system/SQLi-1.md; https://github.com/coues/bug_report/blob/main/vendors/mayuri_k/open-source-sacco-management-system/SQLi-1.md
CVE: CVE-2022-41536
Published: 2022-10-14
Description: Open Source SACCO Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /sacco_shield/manage_user.php.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/coues/bug_report/blob/main/vendors/mayuri_k/open-source-sacco-management-system/SQLi-2.md; https://github.com/coues/bug_report/blob/main/vendors/mayuri_k/open-source-sacco-management-system/SQLi-2.md
CVE: CVE-2022-2780
Published: 2022-10-14
Description: In affected versions of Octopus Server it is possible to use the Git Connectivity test function on the VCS project to initiate an SMB request resulting in the potential for an NTLM relay attack.
CVSS Score: 8.1 (HIGH)
CWE: CWE-294, CWE-294
References: https://advisories.octopus.com/post/2022/sa2022-20/; https://advisories.octopus.com/post/2022/sa2022-20/
CVE: CVE-2022-32177
Published: 2022-10-14
Description: In "Gin-Vue-Admin", versions v2.5.1 through v2.5.3beta are vulnerable to Unrestricted File Upload that leads to execution of javascript code, through the 'Normal Upload' functionality to the Media Library. When an admin user views the uploaded file, a low privilege attacker will get access to the admin’s cookie leading to account takeover.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-434, CWE-434
References: https://github.com/flipped-aurora/gin-vue-admin/blob/v2.5.3beta/web/src/components/upload/common.vue#L29-L37; https://www.mend.io/vulnerability-database/CVE-2022-32177; https://github.com/flipped-aurora/gin-vue-admin/blob/v2.5.3beta/web/src/components/upload/common.vue#L29-L37
CVE: CVE-2022-3495
Published: 2022-10-14
Description: A vulnerability has been found in SourceCodester Simple Online Public Access Catalog 1.0 and classified as critical. This vulnerability affects unknown code of the file /opac/Actions.php?a=login of the component Admin Login. The manipulation of the argument username/password leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-210784.
CVSS Score: 7.3 (HIGH)
CWE: CWE-707, CWE-89
References: https://github.com/Hakcoder/Simple-Online-Public-Access-Catalog-OPAC---SQL-injection/blob/main/POC; https://vuldb.com/?id.210784; https://github.com/Hakcoder/Simple-Online-Public-Access-Catalog-OPAC---SQL-injection/blob/main/POC
CVE: CVE-2022-3496
Published: 2022-10-14
Description: A vulnerability was found in SourceCodester Human Resource Management System 1.0 and classified as critical. This issue affects some unknown processing of the file employeeadd.php of the component Admin Panel. The manipulation leads to improper access controls. The attack may be initiated remotely. The identifier VDB-210785 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-266
References: https://vuldb.com/?id.210785; https://vuldb.com/?id.210785
CVE: CVE-2022-3497
Published: 2022-10-14
Description: A vulnerability was found in SourceCodester Human Resource Management System 1.0. It has been classified as problematic. Affected is an unknown function of the component Master List. The manipulation of the argument city/state/country/position leads to cross site scripting. It is possible to launch the attack remotely. VDB-210786 is the identifier assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-707, CWE-79
References: https://vuldb.com/?id.210786; https://vuldb.com/?id.210786
CVE: CVE-2022-37602
Published: 2022-10-14
Description: Prototype pollution vulnerability in karma-runner grunt-karma 4.0.1 via the key variable in grunt-karma.js.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1321, CWE-1321
References: https://github.com/karma-runner/grunt-karma/blob/45b925964f55870f375c6e670d9945b223c984f5/tasks/grunt-karma.js#L109; https://github.com/karma-runner/grunt-karma/blob/45b925964f55870f375c6e670d9945b223c984f5/tasks/grunt-karma.js#L26; https://github.com/karma-runner/grunt-karma/issues/311
CVE: CVE-2022-3502
Published: 2022-10-14
Description: A vulnerability was found in Human Resource Management System 1.0. It has been classified as problematic. This affects an unknown part of the component Leave Handler. The manipulation of the argument Reason leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-210831.
CVSS Score: 3.5 (LOW)
CWE: CWE-707, CWE-79
References: https://github.com/draco1725/POC/blob/main/Exploit/Stored%20Xss; https://vuldb.com/?id.210831; https://github.com/draco1725/POC/blob/main/Exploit/Stored%20Xss
CVE: CVE-2022-3503
Published: 2022-10-14
Description: A vulnerability was found in SourceCodester Purchase Order Management System 1.0. It has been declared as problematic. This vulnerability affects unknown code of the component Supplier Handler. The manipulation of the argument Supplier Name/Address/Contact person/Contact leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-210832.
CVSS Score: 3.5 (LOW)
CWE: CWE-707
References: https://github.com/DisguisedRoot/Exploit/blob/main/Persistent%20XSS/PoC; https://vuldb.com/?id.210832; https://github.com/DisguisedRoot/Exploit/blob/main/Persistent%20XSS/PoC
CVE: CVE-2022-35040
Published: 2022-10-14
Description: OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6b5567.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://drive.google.com/file/d/1MPyMYxi3cqeAzJYl-TU6NuSxDC53aVyl/view?usp=sharing; https://github.com/Cvjark/Poc/blob/main/otfcc/CVE-2022-35040.md; https://drive.google.com/file/d/1MPyMYxi3cqeAzJYl-TU6NuSxDC53aVyl/view?usp=sharing
CVE: CVE-2022-35041
Published: 2022-10-14
Description: OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6b558f.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://drive.google.com/file/d/1pzPVwMvEu-qvuyw6Mbu42zuKoaq6cp-6/view?usp=sharing; https://github.com/Cvjark/Poc/blob/main/otfcc/CVE-2022-35041.md; https://drive.google.com/file/d/1pzPVwMvEu-qvuyw6Mbu42zuKoaq6cp-6/view?usp=sharing
CVE: CVE-2022-35042
Published: 2022-10-14
Description: OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x4adb11.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://drive.google.com/file/d/1Gj8rA1kD89lxUZVb_t-s3-18-ospJRJC/view?usp=sharing; https://github.com/Cvjark/Poc/blob/main/otfcc/CVE-2022-35042.md; https://drive.google.com/file/d/1Gj8rA1kD89lxUZVb_t-s3-18-ospJRJC/view?usp=sharing
CVE: CVE-2022-35043
Published: 2022-10-14
Description: OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6c08a6.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://drive.google.com/file/d/14CXldgbsymRm_4PkWmuVSIvliOiG2rOa/view?usp=sharing; https://github.com/Cvjark/Poc/blob/main/otfcc/CVE-2022-35043.md; https://drive.google.com/file/d/14CXldgbsymRm_4PkWmuVSIvliOiG2rOa/view?usp=sharing
CVE: CVE-2022-35044
Published: 2022-10-14
Description: OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x617087.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://drive.google.com/file/d/1A9LlI9ioeAnoZjA_9c7WQbckV8gCiVIn/view?usp=sharing; https://github.com/Cvjark/Poc/blob/main/otfcc/CVE-2022-35044.md; https://drive.google.com/file/d/1A9LlI9ioeAnoZjA_9c7WQbckV8gCiVIn/view?usp=sharing
CVE: CVE-2022-35045
Published: 2022-10-14
Description: OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6b0d63.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://drive.google.com/file/d/1eIYb4VDyDnXLCjXKSoFQjkmoXyaCmr-m/view?usp=sharing; https://github.com/Cvjark/Poc/blob/main/otfcc/CVE-2022-35045.md; https://drive.google.com/file/d/1eIYb4VDyDnXLCjXKSoFQjkmoXyaCmr-m/view?usp=sharing
CVE: CVE-2022-35046
Published: 2022-10-14
Description: OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6b0466.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://drive.google.com/file/d/1M8imA5zUlsMA6lgUbvLQ6rbEn6CO6QKq/view?usp=sharing; https://github.com/Cvjark/Poc/blob/main/otfcc/CVE-2022-35046.md; https://drive.google.com/file/d/1M8imA5zUlsMA6lgUbvLQ6rbEn6CO6QKq/view?usp=sharing
CVE: CVE-2022-35047
Published: 2022-10-14
Description: OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6b05aa.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://drive.google.com/file/d/10asu-uKB2GIpnoGkAvvZPTqt4ylBU83s/view?usp=sharing; https://github.com/Cvjark/Poc/blob/main/otfcc/CVE-2022-35047.md; https://drive.google.com/file/d/10asu-uKB2GIpnoGkAvvZPTqt4ylBU83s/view?usp=sharing
CVE: CVE-2022-35048
Published: 2022-10-14
Description: OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6b0b2c.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://drive.google.com/file/d/18cCD_Z6TDbx9IDQQKq3ZTALMGWSl_qWH/view?usp=sharing; https://github.com/Cvjark/Poc/blob/main/otfcc/CVE-2022-35048.md; https://drive.google.com/file/d/18cCD_Z6TDbx9IDQQKq3ZTALMGWSl_qWH/view?usp=sharing
CVE: CVE-2022-35049
Published: 2022-10-14
Description: OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6b03b5.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://drive.google.com/file/d/1h9mF80-Q13S3ZDZGLEM7hBIzCPwNDWhm/view?usp=sharing; https://github.com/Cvjark/Poc/blob/main/otfcc/CVE-2022-35049.md; https://drive.google.com/file/d/1h9mF80-Q13S3ZDZGLEM7hBIzCPwNDWhm/view?usp=sharing
CVE: CVE-2022-35050
Published: 2022-10-14
Description: OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6b04de.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://drive.google.com/file/d/1WdB1yvIoEvOB4iWh5TLiMJIzxUQNln56/view?usp=sharing; https://github.com/Cvjark/Poc/blob/main/otfcc/CVE-2022-35050.md; https://drive.google.com/file/d/1WdB1yvIoEvOB4iWh5TLiMJIzxUQNln56/view?usp=sharing
CVE: CVE-2022-35051
Published: 2022-10-14
Description: OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6b55af.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: https://drive.google.com/file/d/1169h7-GXUmb2wlDYe_5C8ro25fS50u_-/view?usp=sharing; https://github.com/Cvjark/Poc/blob/main/otfcc/CVE-2022-35051.md; https://drive.google.com/file/d/1169h7-GXUmb2wlDYe_5C8ro25fS50u_-/view?usp=sharing
CVE: CVE-2022-35052
Published: 2022-10-14
Description: OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6b84b1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://drive.google.com/file/d/134NkAgE_Dcmx558FgvTHifl_avVlF-AH/view?usp=sharing; https://github.com/Cvjark/Poc/blob/main/otfcc/CVE-2022-35052.md; https://drive.google.com/file/d/134NkAgE_Dcmx558FgvTHifl_avVlF-AH/view?usp=sharing
CVE: CVE-2022-35053
Published: 2022-10-14
Description: OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x61731f.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://drive.google.com/file/d/1frfdVcR0UJVO-vKDLb19yWQgeTqdeohJ/view?usp=sharing; https://github.com/Cvjark/Poc/blob/main/otfcc/CVE-2022-35053.md; https://drive.google.com/file/d/1frfdVcR0UJVO-vKDLb19yWQgeTqdeohJ/view?usp=sharing
CVE: CVE-2022-35054
Published: 2022-10-14
Description: OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6171b2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://drive.google.com/file/d/1FoSPYJUO3hvUQywukndavdmu-45A-v2l/view?usp=sharing; https://github.com/Cvjark/Poc/blob/main/otfcc/CVE-2022-35054.md; https://drive.google.com/file/d/1FoSPYJUO3hvUQywukndavdmu-45A-v2l/view?usp=sharing
CVE: CVE-2022-35055
Published: 2022-10-14
Description: OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6c0473.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://drive.google.com/file/d/1PZ0D3DslISfUxI6CJ--giXQHYKE0JZ7K/view?usp=sharing; https://github.com/Cvjark/Poc/blob/main/otfcc/CVE-2022-35055.md; https://drive.google.com/file/d/1PZ0D3DslISfUxI6CJ--giXQHYKE0JZ7K/view?usp=sharing