deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-20830
Published: 2022-10-10
Description: A vulnerability in authentication mechanism of Cisco Software-Defined Application Visibility and Control (SD-AVC) on Cisco vManage could allow an unauthenticated, remote attacker to access the GUI of Cisco SD-AVC without authentication. This vulnerability exists because the GUI is accessible on self-managed cloud installations or local server installations of Cisco vManage. An attacker could exploit this vulnerability by accessing the exposed GUI of Cisco SD-AVC. A successful exploit could allow the attacker to view managed device names, SD-AVC logs, and SD-AVC DNS server IP addresses.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-306, CWE-306
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-avc-NddSGB8; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-avc-NddSGB8
CVE: CVE-2022-20837
Published: 2022-10-10
Description: A vulnerability in the DNS application layer gateway (ALG) functionality that is used by Network Address Translation (NAT) in Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload. This vulnerability is due to a logic error that occurs when an affected device inspects certain TCP DNS packets. An attacker could exploit this vulnerability by sending crafted DNS packets through the affected device that is performing NAT for DNS packets. A successful exploit could allow the attacker to cause the device to reload, resulting in a denial of service (DoS) condition on the affected device. Note: This vulnerability can be exploited only by sending IPv4 TCP packets through an affected device. This vulnerability cannot be exploited by sending IPv6 traffic.
CVSS Score: 8.6 (HIGH)
CWE: CWE-754, CWE-754
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-alg-dos-KU9Z8kFX; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-alg-dos-KU9Z8kFX
CVE: CVE-2022-20864
Published: 2022-10-10
Description: A vulnerability in the password-recovery disable feature of Cisco IOS XE ROM Monitor (ROMMON) Software for Cisco Catalyst Switches could allow an unauthenticated, local attacker to recover the configuration or reset the enable password. This vulnerability is due to a problem with the file and boot variable permissions in ROMMON. An attacker could exploit this vulnerability by rebooting the switch into ROMMON and entering specific commands through the console. A successful exploit could allow the attacker to read any file or reset the enable password.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-538
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-info-disc-nrORXjO; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-info-disc-nrORXjO
CVE: CVE-2022-20870
Published: 2022-10-10
Description: A vulnerability in the egress MPLS packet processing function of Cisco IOS XE Software for Cisco Catalyst 3650, Catalyst 3850, and Catalyst 9000 Family Switches could allow an unauthenticated, remote attacker to cause an affected device to reload unexpectedly, resulting in a denial of service (DoS) condition. This vulnerability is due to insufficient input validation of IPv4 traffic. An attacker could exploit this vulnerability by sending a malformed packet out of an affected MPLS-enabled interface. A successful exploit could allow the attacker to cause the device to reload, resulting in a DoS condition.
CVSS Score: 8.6 (HIGH)
CWE: CWE-130
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-mpls-dos-Ab4OUL3; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-mpls-dos-Ab4OUL3
CVE: CVE-2022-20915
Published: 2022-10-10
Description: A vulnerability in the implementation of IPv6 VPN over MPLS (6VPE) with Zone-Based Firewall (ZBFW) of Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper error handling of an IPv6 packet that is forwarded from an MPLS and ZBFW-enabled interface in a 6VPE deployment. An attacker could exploit this vulnerability by sending a crafted IPv6 packet sourced from a device on the IPv6-enabled virtual routing and forwarding (VRF) interface through the affected device. A successful exploit could allow the attacker to reload the device, resulting in a DoS condition.
CVSS Score: 7.4 (HIGH)
CWE: CWE-115, CWE-436
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-6vpe-dos-tJBtf5Zv; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-6vpe-dos-tJBtf5Zv
CVE: CVE-2022-20920
Published: 2022-10-10
Description: A vulnerability in the SSH implementation of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker to cause an affected device to reload. This vulnerability is due to improper handling of resources during an exceptional situation. An attacker could exploit this vulnerability by continuously connecting to an affected device and sending specific SSH requests. A successful exploit could allow the attacker to cause the affected device to reload.
CVSS Score: 7.7 (HIGH)
CWE: CWE-755, CWE-755
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ssh-excpt-dos-FzOBQTnk; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ssh-excpt-dos-FzOBQTnk
CVE: CVE-2022-20944
Published: 2022-10-10
Description: A vulnerability in the software image verification functionality of Cisco IOS XE Software for Cisco Catalyst 9200 Series Switches could allow an unauthenticated, physical attacker to execute unsigned code at system boot time. This vulnerability is due to an improper check in the code function that manages the verification of the digital signatures of system image files during the initial boot process. An attacker could exploit this vulnerability by loading unsigned software on an affected device. A successful exploit could allow the attacker to boot a malicious software image or execute unsigned code and bypass the image verification check part of the boot process of the affected device. To exploit this vulnerability, the attacker needs either unauthenticated physical access to the device or privileged access to the root shell on the device. Note: In Cisco IOS XE Software releases 16.11.1 and later, root shell access is protected by the Consent Token mechanism. However, an attacker with level-15 privileges could easily downgrade the Cisco IOS XE Software running on a device to a release where root shell access is more readily available.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-347, CWE-347
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-xe-cat-verify-D4NEQA6q; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-xe-cat-verify-D4NEQA6q
CVE: CVE-2022-2350
Published: 2022-10-10
Description: The Disable User Login WordPress plugin through 1.0.1 does not have authorisation and CSRF checks when updating its settings, allowing unauthenticated attackers to block (or unblock) users at will.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-352, CWE-862, CWE-352, CWE-862
References: https://wpscan.com/vulnerability/de28543b-c110-4a9f-bfe9-febccfba3a96; https://wpscan.com/vulnerability/de28543b-c110-4a9f-bfe9-febccfba3a96
CVE: CVE-2022-2448
Published: 2022-10-10
Description: The reSmush.it WordPress plugin before 0.4.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when unfiltered_html is disallowed.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/a4[PII_REDACTED]-4da4-b55d-077775323b61; https://wpscan.com/vulnerability/a4[PII_REDACTED]-4da4-b55d-077775323b61
CVE: CVE-2022-2554
Published: 2022-10-10
Description: The Enable Media Replace WordPress plugin before 4.0.0 does not ensure that renamed files are moved to the Upload folder, which could allow high privilege users such as admin to move them outside to the web root directory via a path traversal attack for example
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-22
References: https://wpscan.com/vulnerability/5872f4bf-f423-4ace-b8b6-d4cc4f6ca8d9; https://wpscan.com/vulnerability/5872f4bf-f423-4ace-b8b6-d4cc4f6ca8d9
CVE: CVE-2022-2629
Published: 2022-10-10
Description: The Top Bar WordPress plugin before 3.0.4 does not sanitise and escape some of its settings before outputting them in frontend pages, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/25a0d41f-3b6f-4d18-b4d5-767ac60ee8a8; https://wpscan.com/vulnerability/25a0d41f-3b6f-4d18-b4d5-767ac60ee8a8
CVE: CVE-2022-2823
Published: 2022-10-10
Description: The Slider, Gallery, and Carousel by MetaSlider WordPress plugin before 3.27.9 does not sanitise and escape some of its Gallery Image parameters, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/c88c85b3-2830-4354-99fd-af6bce6bb4ef; https://wpscan.com/vulnerability/c88c85b3-2830-4354-99fd-af6bce6bb4ef
CVE: CVE-2022-2891
Published: 2022-10-10
Description: The WP 2FA WordPress plugin before 2.3.0 uses comparison operators that don't mitigate time-based attacks, which could be abused to leak information about the authentication codes being compared.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-203
References: https://wpscan.com/vulnerability/301b3dce-2584-46ec-92ed-1c[PII_REDACTED]; https://wpscan.com/vulnerability/301b3dce-2584-46ec-92ed-1c[PII_REDACTED]
CVE: CVE-2022-2981
Published: 2022-10-10
Description: The Download Monitor WordPress plugin before 4.5.98 does not ensure that files to be downloaded are inside the blog folders, and not sensitive, allowing high privilege users such as admin to download the wp-config.php or /etc/passwd even in an hardened environment or multisite setup.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-552
References: https://wpscan.com/vulnerability/30ce32ce-161c-4388-8d22-751350b7b305; https://wpscan.com/vulnerability/30ce32ce-161c-4388-8d22-751350b7b305
CVE: CVE-2022-34334
Published: 2022-10-10
Description: IBM Sterling Partner Engagement Manager 2.0 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 229704.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-384
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/229704; https://www.ibm.com/support/pages/node/6828097; https://exchange.xforce.ibmcloud.com/vulnerabilities/229704
CVE: CVE-2022-34402
Published: 2022-10-10
Description: Dell Wyse ThinOS 2205 contains a Regular Expression Denial of Service Vulnerability in UI. An admin privilege attacker could potentially exploit this vulnerability, leading to denial-of-service.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-1333, CWE-1333
References: https://www.dell.com/support/kbdoc/en-us/000203376/dsa-2022-247-dell-wyse-thinos-security-update-for-a-regular-expression-vulnerability; https://www.dell.com/support/kbdoc/en-us/000203376/dsa-2022-247-dell-wyse-thinos-security-update-for-a-regular-expression-vulnerability
CVE: CVE-2022-34425
Published: 2022-10-10
Description: Dell Enterprise SONiC OS, 4.0.0, 4.0.1, contain a cryptographic key vulnerability in SSH. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to unauthorized access to communication.
CVSS Score: 7.5 (HIGH)
CWE: CWE-321, CWE-798
References: https://www.dell.com/support/kbdoc/en-us/000203395/dsa-2022-257-dell-emc-enterprise-sonic-security-update-for-ssh-cryptographic-key-vulnerability; https://www.dell.com/support/kbdoc/en-us/000203395/dsa-2022-257-dell-emc-enterprise-sonic-security-update-for-ssh-cryptographic-key-vulnerability
CVE: CVE-2022-36063
Published: 2022-10-10
Description: Azure RTOS USBx is a USB host, device, and on-the-go (OTG) embedded stack, fully integrated with Azure RTOS ThreadX and available for all Azure RTOS ThreadX–supported processors. Azure RTOS USBX implementation of host support for USB CDC ECM includes an integer underflow and a buffer overflow in the `_ux_host_class_cdc_ecm_mac_address_get` function which may be potentially exploited to achieve remote code execution or denial of service. Setting mac address string descriptor length to a `0` or `1` allows an attacker to introduce an integer underflow followed (string_length) by a buffer overflow of the `cdc_ecm -> ux_host_class_cdc_ecm_node_id` array. This may allow one to redirect the code execution flow or introduce a denial of service. The fix has been included in USBX release [6.1.12](https://github.com/azure-rtos/usbx/releases/tag/v6.1.12_rel). Improved mac address string descriptor length validation to check for unexpectedly small values may be used as a workaround.
CVSS Score: 7.6 (HIGH)
CWE: CWE-121, CWE-191, CWE-1284
References: https://github.com/azure-rtos/usbx/blob/master/common/usbx_host_classes/src/ux_host_class_cdc_ecm_mac_address_get.c#L264; https://github.com/azure-rtos/usbx/releases/tag/v6.1.12_rel; https://github.com/azure-rtos/usbx/security/advisories/GHSA-chpp-5fv9-6368
CVE: CVE-2022-39288
Published: 2022-10-10
Description: fastify is a fast and low overhead web framework, for Node.js. Affected versions of fastify are subject to a denial of service via malicious use of the Content-Type header. An attacker can send an invalid Content-Type header that can cause the application to crash. This issue has been addressed in commit `fbb07e8d` and will be included in release version 4.8.1. Users are advised to upgrade. Users unable to upgrade may manually filter out http content with malicious Content-Type headers.
CVSS Score: 7.5 (HIGH)
CWE: CWE-754
References: https://github.com/fastify/fastify/commit/fbb07e8dfad74c69cd4cd2211aedab87194618e3; https://github.com/fastify/fastify/security/advisories/GHSA-455w-c45v-86rg; https://github.com/fastify/fastify/security/policy
CVE: CVE-2022-3136
Published: 2022-10-10
Description: The Social Rocket WordPress plugin before 1.3.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/913d7e78-23f6-4b0d-aca3-17051a2dc649; https://wpscan.com/vulnerability/913d7e78-23f6-4b0d-aca3-17051a2dc649
CVE: CVE-2022-3137
Published: 2022-10-10
Description: The Taskbuilder WordPress plugin before 1.0.8 does not validate and sanitise task's attachments, which could allow any authenticated user (such as subscriber) creating a task to perform Stored Cross-Site Scripting by attaching a malicious SVG file
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/524928d6-d4e9-4a2f-b410-46958da549d8; https://wpscan.com/vulnerability/524928d6-d4e9-4a2f-b410-46958da549d8
CVE: CVE-2022-3154
Published: 2022-10-10
Description: The Woo Billingo Plus WordPress plugin before 4.4.5.4, Integration for Billingo & Gravity Forms WordPress plugin before 1.0.4, Integration for Szamlazz.hu & Gravity Forms WordPress plugin before 1.2.7 are lacking CSRF checks in various AJAX actions, which could allow attackers to make logged in Shop Managers and above perform unwanted actions, such as deactivate the plugin's license
CVSS Score: 7.1 (HIGH)
CWE: CWE-352, CWE-352
References: https://wpscan.com/vulnerability/cda978b2-b31f-495d-8601-0aaa3e4b45cd; https://wpscan.com/vulnerability/cda978b2-b31f-495d-8601-0aaa3e4b45cd
CVE: CVE-2022-3207
Published: 2022-10-10
Description: The Simple File List WordPress plugin before 4.4.12 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/b57272ea-9a8a-482a-bbaa-5f202ca5b9aa; https://wpscan.com/vulnerability/b57272ea-9a8a-482a-bbaa-5f202ca5b9aa
CVE: CVE-2022-3208
Published: 2022-10-10
Description: The Simple File List WordPress plugin before 4.4.12 does not implement nonce checks, which could allow attackers to make a logged in admin create new page and change it's content via a CSRF attack.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/80d475ca-b475-4789-8eef-9c4d880853b7; https://wpscan.com/vulnerability/80d475ca-b475-4789-8eef-9c4d880853b7
CVE: CVE-2022-3209
Published: 2022-10-10
Description: The soledad WordPress theme before 8.2.5 does not sanitise the {id,datafilter[type],...} parameters in its penci_more_slist_post_ajax AJAX action, leading to a Reflected Cross-Site Scripting (XSS) vulnerability.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/7a244fb1-fa0b-4294-9b51-588bf5d673a2; https://wpscan.com/vulnerability/7a244fb1-fa0b-4294-9b51-588bf5d673a2
CVE: CVE-2022-3220
Published: 2022-10-10
Description: The Advanced Comment Form WordPress plugin before 1.2.1 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/cb6f4953-e68b-48f3-a821-a1d77e5476ef; https://wpscan.com/vulnerability/cb6f4953-e68b-48f3-a821-a1d77e5476ef
CVE: CVE-2022-41744
Published: 2022-10-10
Description: A Time-of-Check Time-Of-Use vulnerability in the Trend Micro Apex One Vulnerability Protection integrated component could allow a local attacker to escalate privileges and turn a specific working directory into a mount point on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
CVSS Score: 7.0 (HIGH)
CWE: CWE-367
References: https://success.trendmicro.com/solution/000291645; https://www.zerodayinitiative.com/advisories/ZDI-22-1404/; https://success.trendmicro.com/solution/000291645
CVE: CVE-2022-41745
Published: 2022-10-10
Description: An Out-of-Bounds access vulnerability in Trend Micro Apex One could allow a local attacker to create a specially crafted message to cause memory corruption on a certain service process which could lead to local privilege escalation on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
CVSS Score: 7.0 (HIGH)
CWE: CWE-125
References: https://success.trendmicro.com/solution/000291645; https://www.zerodayinitiative.com/advisories/ZDI-22-1401/; https://success.trendmicro.com/solution/000291645
CVE: CVE-2022-41746
Published: 2022-10-10
Description: A forced browsing vulnerability in Trend Micro Apex One could allow an attacker with access to the Apex One console on affected installations to escalate privileges and modify certain agent groupings. Please note: an attacker must first obtain the ability to log onto the Apex One web console in order to exploit this vulnerability.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-425
References: https://success.trendmicro.com/solution/000291645; https://www.zerodayinitiative.com/advisories/ZDI-22-1403/; https://success.trendmicro.com/solution/000291645
CVE: CVE-2022-41747
Published: 2022-10-10
Description: An improper certification validation vulnerability in Trend Micro Apex One agents could allow a local attacker to load a DLL file with system service privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-295
References: https://success.trendmicro.com/solution/000291645; https://www.zerodayinitiative.com/advisories/ZDI-22-1402/; https://success.trendmicro.com/solution/000291645
CVE: CVE-2022-41748
Published: 2022-10-10
Description: A registry permissions vulnerability in the Trend Micro Apex One Data Loss Prevention (DLP) module could allow a local attacker with administrative credentials to bypass certain elements of the product's anti-tampering mechanisms on affected installations. Please note: an attacker must first obtain administrative credentials on the target system in order to exploit this vulnerability.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-276
References: https://success.trendmicro.com/solution/000291645; https://success.trendmicro.com/solution/000291645
CVE: CVE-2022-41749
Published: 2022-10-10
Description: An origin validation error vulnerability in Trend Micro Apex One agents could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-346
References: https://success.trendmicro.com/solution/000291645; https://www.zerodayinitiative.com/advisories/ZDI-22-1400/; https://success.trendmicro.com/solution/000291645
CVE: CVE-2022-3433
Published: 2022-10-10
Description: The aeson library is not safe to use to consume untrusted JSON input. A remote user could abuse this flaw to produce a hash collision in the underlying unordered-containers library by sending specially crafted JSON data, resulting in a denial of service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-328, CWE-326
References: https://cs-syd.eu/posts/2021-09-11-json-vulnerability; https://cs-syd.eu/posts/2021-09-11-json-vulnerability
CVE: CVE-2021-35226
Published: 2022-10-10
Description: An entity in Network Configuration Manager product is misconfigured and exposing password field to Solarwinds Information Service (SWIS). Exposed credentials are encrypted and require authenticated access with an NCM role.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-326, CWE-326
References: https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35226; https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35226
CVE: CVE-2022-32234
Published: 2022-10-11
Description: An out of bounds write in hermes, while handling large arrays, prior to commit 06eaec767e376bfdb883d912cb15e987ddf2bda1 allows attackers to potentially execute arbitrary code via crafted JavaScript. Note that this is only exploitable if the application using Hermes permits evaluation of untrusted JavaScript. Hence, most React Native applications are not affected.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://github.com/facebook/hermes/commit/06eaec767e376bfdb883d912cb15e987ddf2bda1; https://www.facebook.com/security/advisories/CVE-2022-32234; https://github.com/facebook/hermes/commit/06eaec767e376bfdb883d912cb15e987ddf2bda1
CVE: CVE-2022-35289
Published: 2022-10-11
Description: A write-what-where condition in hermes caused by an integer overflow, prior to commit 5b6255ae049fa4641791e47fad994e8e8c4da374 allows attackers to potentially execute arbitrary code via crafted JavaScript. Note that this is only exploitable if the application using Hermes permits evaluation of untrusted JavaScript. Hence, most React Native applications are not affected.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-680, CWE-190
References: https://github.com/facebook/hermes/commit/5b6255ae049fa4641791e47fad994e8e8c4da374; https://www.facebook.com/security/advisories/CVE-2022-35289; https://github.com/facebook/hermes/commit/5b6255ae049fa4641791e47fad994e8e8c4da374