deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-23686
Published: 2022-09-06
Description: Multiple vulnerabilities exist in the processing of packet data by the LLDP service of AOS-CX. Successful exploitation of these vulnerabilities may allow an attacker to impact the availability of the AOS-CX LLDP service and/or the management plane of the switch in ArubaOS-CX Switches version(s): AOS-CX 10.09.xxxx: 10.09.1010 and below, AOS-CX 10.08.xxxx: 10.08.1050 and below, AOS-CX 10.06.xxxx: 10.06.0190 and below. Aruba has released upgrades for ArubaOS-CX Switch Devices that address these security vulnerabilities.
CVSS Score: 4.3 (MEDIUM)
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-012.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-012.txt
CVE: CVE-2022-23687
Published: 2022-09-06
Description: Multiple vulnerabilities exist in the processing of packet data by the LLDP service of AOS-CX. Successful exploitation of these vulnerabilities may allow an attacker to impact the availability of the AOS-CX LLDP service and/or the management plane of the switch in ArubaOS-CX Switches version(s): AOS-CX 10.09.xxxx: 10.09.1010 and below, AOS-CX 10.08.xxxx: 10.08.1050 and below, AOS-CX 10.06.xxxx: 10.06.0190 and below. Aruba has released upgrades for ArubaOS-CX Switch Devices that address these security vulnerabilities.
CVSS Score: 4.3 (MEDIUM)
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-012.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-012.txt
CVE: CVE-2022-23688
Published: 2022-09-06
Description: Multiple vulnerabilities exist in the processing of packet data by the LLDP service of AOS-CX. Successful exploitation of these vulnerabilities may allow an attacker to impact the availability of the AOS-CX LLDP service and/or the management plane of the switch in ArubaOS-CX Switches version(s): AOS-CX 10.09.xxxx: 10.09.1010 and below, AOS-CX 10.08.xxxx: 10.08.1050 and below, AOS-CX 10.06.xxxx: 10.06.0190 and below. Aruba has released upgrades for ArubaOS-CX Switch Devices that address these security vulnerabilities.
CVSS Score: 4.3 (MEDIUM)
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-012.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-012.txt
CVE: CVE-2022-23689
Published: 2022-09-06
Description: Multiple vulnerabilities exist in the processing of packet data by the LLDP service of AOS-CX. Successful exploitation of these vulnerabilities may allow an attacker to impact the availability of the AOS-CX LLDP service and/or the management plane of the switch in ArubaOS-CX Switches version(s): AOS-CX 10.09.xxxx: 10.09.1010 and below, AOS-CX 10.08.xxxx: 10.08.1050 and below, AOS-CX 10.06.xxxx: 10.06.0190 and below. Aruba has released upgrades for ArubaOS-CX Switch Devices that address these security vulnerabilities.
CVSS Score: 4.3 (MEDIUM)
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-012.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-012.txt
CVE: CVE-2022-23690
Published: 2022-09-06
Description: A vulnerability in the web-based management interface of AOS-CX could allow a remote unauthenticated attacker to fingerprint the exact version AOS-CX running on the switch. This allows an attacker to retrieve information which could be used to more precisely target the switch for further exploitation in ArubaOS-CX Switches version(s): AOS-CX 10.10.xxxx: 10.10.0002 and below, AOS-CX 10.09.xxxx: 10.09.1020 and below, AOS-CX 10.08.xxxx: 10.08.1060 and below, AOS-CX 10.06.xxxx: 10.06.0200 and below. Aruba has released upgrades for ArubaOS-CX Switch Devices that address this security vulnerability.
CVSS Score: 5.3 (MEDIUM)
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-012.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-012.txt
CVE: CVE-2022-23691
Published: 2022-09-06
Description: A vulnerability exists in certain AOS-CX switch models which could allow an attacker with access to the recovery console to bypass normal authentication. A successful exploit allows an attacker to bypass system authentication and achieve total switch compromise in ArubaOS-CX Switches version(s): AOS-CX 10.10.xxxx: 10.10.0002 and below, AOS-CX 10.09.xxxx: 10.09.1030 and below, AOS-CX 10.08.xxxx: 10.08.1070 and below, AOS-CX 10.06.xxxx: 10.06.0210 and below. Aruba has released upgrades for ArubaOS-CX Switch Devices that address this security vulnerability.
CVSS Score: 6.8 (MEDIUM)
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-012.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-012.txt
CVE: CVE-2022-25308
Published: 2022-09-06
Description: A stack-based buffer overflow flaw was found in the Fribidi package. This flaw allows an attacker to pass a specially crafted file to the Fribidi application, which leads to a possible memory leak or a denial of service.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://access.redhat.com/security/cve/CVE-2022-25308; https://bugzilla.redhat.com/show_bug.cgi?id=2047890; https://github.com/fribidi/fribidi/issues/181
CVE: CVE-2022-25309
Published: 2022-09-06
Description: A heap-based buffer overflow flaw was found in the Fribidi package and affects the fribidi_cap_rtl_to_unicode() function of the fribidi-char-sets-cap-rtl.c file. This flaw allows an attacker to pass a specially crafted file to the Fribidi application with the '--caprtl' option, leading to a crash and causing a denial of service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-122, CWE-787
References: https://access.redhat.com/security/cve/CVE-2022-25309; https://bugzilla.redhat.com/show_bug.cgi?id=2047896; https://github.com/fribidi/fribidi/commit/f22593b82b5d1668d1997dbccd10a9c31ffea3b3
CVE: CVE-2022-25310
Published: 2022-09-06
Description: A segmentation fault (SEGV) flaw was found in the Fribidi package and affects the fribidi_remove_bidi_marks() function of the lib/fribidi.c file. This flaw allows an attacker to pass a specially crafted file to Fribidi, leading to a crash and causing a denial of service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119, CWE-476
References: https://access.redhat.com/security/cve/CVE-2022-25310; https://bugzilla.redhat.com/show_bug.cgi?id=2047923; https://github.com/fribidi/fribidi/issues/183
CVE: CVE-2022-26447
Published: 2022-09-06
Description: In BT firmware, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06784478; Issue ID: ALPS06784478.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://corp.mediatek.com/product-security-bulletin/September-2022; https://corp.mediatek.com/product-security-bulletin/September-2022
CVE: CVE-2022-26448
Published: 2022-09-06
Description: In apusys, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07063849; Issue ID: ALPS07063849.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://corp.mediatek.com/product-security-bulletin/September-2022; https://corp.mediatek.com/product-security-bulletin/September-2022
CVE: CVE-2022-26449
Published: 2022-09-06
Description: In apusys, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07177810; Issue ID: ALPS07177810.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://corp.mediatek.com/product-security-bulletin/September-2022; https://corp.mediatek.com/product-security-bulletin/September-2022
CVE: CVE-2022-26450
Published: 2022-09-06
Description: In apusys, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07177801; Issue ID: ALPS07177801.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-362
References: https://corp.mediatek.com/product-security-bulletin/September-2022; https://corp.mediatek.com/product-security-bulletin/September-2022
CVE: CVE-2022-26451
Published: 2022-09-06
Description: In ged, there is a possible use after free due to improper locking. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07202966; Issue ID: ALPS07202966.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-667
References: https://corp.mediatek.com/product-security-bulletin/September-2022; https://corp.mediatek.com/product-security-bulletin/September-2022
CVE: CVE-2022-26453
Published: 2022-09-06
Description: In teei, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06664675; Issue ID: ALPS06664675.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-416
References: https://corp.mediatek.com/product-security-bulletin/September-2022; https://corp.mediatek.com/product-security-bulletin/September-2022
CVE: CVE-2022-26454
Published: 2022-09-06
Description: In teei, there is a possible memory corruption due to an integer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06664701; Issue ID: ALPS06664701.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-190
References: https://corp.mediatek.com/product-security-bulletin/September-2022; https://corp.mediatek.com/product-security-bulletin/September-2022
CVE: CVE-2022-26455
Published: 2022-09-06
Description: In gz, there is a possible memory corruption due to incorrect error handling. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07177858; Issue ID: ALPS07177858.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://corp.mediatek.com/product-security-bulletin/September-2022; https://corp.mediatek.com/product-security-bulletin/September-2022
CVE: CVE-2022-26456
Published: 2022-09-06
Description: In vow, there is a possible information disclosure due to a symbolic link following. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06545473; Issue ID: ALPS06545473.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-59
References: https://corp.mediatek.com/product-security-bulletin/September-2022; https://corp.mediatek.com/product-security-bulletin/September-2022
CVE: CVE-2022-26457
Published: 2022-09-06
Description: In vow, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07138490; Issue ID: ALPS07138490.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://corp.mediatek.com/product-security-bulletin/September-2022; https://corp.mediatek.com/product-security-bulletin/September-2022
CVE: CVE-2022-26458
Published: 2022-09-06
Description: In vow, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07032678; Issue ID: ALPS07032678.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://corp.mediatek.com/product-security-bulletin/September-2022; https://corp.mediatek.com/product-security-bulletin/September-2022
CVE: CVE-2022-26459
Published: 2022-09-06
Description: In vow, there is a possible out of bounds read due to an integer overflow. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07032634; Issue ID: ALPS07032634.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-190
References: https://corp.mediatek.com/product-security-bulletin/September-2022; https://corp.mediatek.com/product-security-bulletin/September-2022
CVE: CVE-2022-26460
Published: 2022-09-06
Description: In vow, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07032590; Issue ID: ALPS07032590.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://corp.mediatek.com/product-security-bulletin/September-2022; https://corp.mediatek.com/product-security-bulletin/September-2022
CVE: CVE-2022-26461
Published: 2022-09-06
Description: In vow, there is a possible undefined behavior due to an API misuse. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07032604; Issue ID: ALPS07032604.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-670
References: https://corp.mediatek.com/product-security-bulletin/September-2022; https://corp.mediatek.com/product-security-bulletin/September-2022
CVE: CVE-2022-26462
Published: 2022-09-06
Description: In vow, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07032660; Issue ID: ALPS07032660.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-125
References: https://corp.mediatek.com/product-security-bulletin/September-2022; https://corp.mediatek.com/product-security-bulletin/September-2022
CVE: CVE-2022-26463
Published: 2022-09-06
Description: In vow, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07032686; Issue ID: ALPS07032686.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-125
References: https://corp.mediatek.com/product-security-bulletin/September-2022; https://corp.mediatek.com/product-security-bulletin/September-2022
CVE: CVE-2022-26464
Published: 2022-09-06
Description: In vow, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07032699; Issue ID: ALPS07032699.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://corp.mediatek.com/product-security-bulletin/September-2022; https://corp.mediatek.com/product-security-bulletin/September-2022
CVE: CVE-2022-26465
Published: 2022-09-06
Description: In audio ipi, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06558799; Issue ID: ALPS06558799.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://corp.mediatek.com/product-security-bulletin/September-2022; https://corp.mediatek.com/product-security-bulletin/September-2022
CVE: CVE-2022-26466
Published: 2022-09-06
Description: In audio ipi, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06558777; Issue ID: ALPS06558777.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-190
References: https://corp.mediatek.com/product-security-bulletin/September-2022; https://corp.mediatek.com/product-security-bulletin/September-2022
CVE: CVE-2022-26467
Published: 2022-09-06
Description: In rpmb, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07167738; Issue ID: ALPS07167738.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://corp.mediatek.com/product-security-bulletin/September-2022; https://corp.mediatek.com/product-security-bulletin/September-2022
CVE: CVE-2022-26468
Published: 2022-09-06
Description: In preloader (usb), there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege, for an attacker who has physical access to the device, with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS07168125; Issue ID: ALPS07168125.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-787
References: https://corp.mediatek.com/product-security-bulletin/September-2022; https://corp.mediatek.com/product-security-bulletin/September-2022
CVE: CVE-2022-26469
Published: 2022-09-06
Description: In MtkEmail, there is a possible escalation of privilege due to fragment injection. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07216598; Issue ID: ALPS07216598.
CVSS Score: 7.8 (HIGH)
CWE: CWE-470
References: https://corp.mediatek.com/product-security-bulletin/September-2022; https://corp.mediatek.com/product-security-bulletin/September-2022
CVE: CVE-2022-26470
Published: 2022-09-06
Description: In aie, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07116037; Issue ID: ALPS07116037.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://corp.mediatek.com/product-security-bulletin/September-2022; https://corp.mediatek.com/product-security-bulletin/September-2022
CVE: CVE-2022-27491
Published: 2022-09-06
Description: A improper verification of source of a communication channel in Fortinet FortiOS with IPS engine version 7.201 through 7.214, 7.001 through 7.113, 6.001 through 6.121, 5.001 through 5.258 and before 4.086 allows a remote and unauthenticated attacker to trigger the sending of "blocked page" HTML data to an arbitrary victim via crafted TCP requests, potentially flooding the victim.
CVSS Score: 6.8 (MEDIUM)
References: https://fortiguard.com/psirt/FG-IR-22-073; https://fortiguard.com/psirt/FG-IR-22-073
CVE: CVE-2022-27664
Published: 2022-09-06
Description: In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error.
CVSS Score: 7.5 (HIGH)
References: https://groups.google.com/g/golang-announce; https://groups.google.com/g/golang-announce/c/x49AQzIVX-s; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JXKTHIGE5F576MAPFYCIJXNRGBSPISUF/
CVE: CVE-2022-28884
Published: 2022-09-06
Description: A Denial-of-Service vulnerability was discovered in the F-Secure and WithSecure products where aerdl.dll may go into an infinite loop when unpacking PE files. It is possible that this can crash the scanning engine.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-835
References: https://www.withsecure.com/en/expertise/people; https://www.withsecure.com/en/support/security-advisories; https://www.withsecure.com/en/expertise/people
CVE: CVE-2022-28885
Published: 2022-09-06
Description: A Denial-of-Service (DoS) vulnerability was discovered in the fsicapd component used in WithSecure products whereby the service may crash while parsing the scanning request.
CVSS Score: 4.3 (MEDIUM)
References: https://www.withsecure.com/en/expertise/people; https://www.withsecure.com/en/support/security-advisories; https://www.withsecure.com/en/expertise/people
CVE: CVE-2022-29053
Published: 2022-09-06
Description: A missing cryptographic steps vulnerability [CWE-325] in the functions that encrypt the keytab files in FortiOS version 7.2.0, 7.0.0 through 7.0.5 and below 7.0.0 may allow an attacker in possession of the encrypted file to decipher it.
CVSS Score: 2.3 (LOW)
References: https://fortiguard.com/psirt/FG-IR-22-158; https://fortiguard.com/psirt/FG-IR-22-158
CVE: CVE-2022-29058
Published: 2022-09-06
Description: An improper neutralization of special elements [CWE-89] used in an OS command vulnerability [CWE-78] in the command line interpreter of FortiAP 6.0.0 through 6.4.7, 7.0.0 through 7.0.3, 7.2.0, FortiAP-S 6.0.0 through 6.4.7, FortiAP-W2 6.0.0 through 6.4.7, 7.0.0 through 7.0.3, 7.2.0 and FortiAP-U 5.4.0 through 6.2.3 may allow an authenticated attacker to execute unauthorized commands via specifically crafted arguments to existing commands.
CVSS Score: 7.8 (HIGH)
CWE: CWE-89
References: https://fortiguard.com/psirt/FG-IR-21-163; https://fortiguard.com/psirt/FG-IR-21-163
CVE: CVE-2022-29062
Published: 2022-09-06
Description: Multiple relative path traversal vulnerabilities [CWE-23] in Fortinet FortiSOAR before 7.2.1 allows an authenticated attacker to write to the underlying filesystem with nginx permissions via crafted HTTP requests.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-22
References: https://fortiguard.com/psirt/FG-IR-22-154; https://fortiguard.com/psirt/FG-IR-22-154
CVE: CVE-2022-2233
Published: 2022-09-06
Description: The Banner Cycler plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.4. This is due to missing nonce protection on the pabc_admin_slides_postback() function found in the ~/admin/admin.php file. This makes it possible for unauthenticated attackers to inject malicious web scripts into the page, granted they can trick a site’s administrator into performing an action such as clicking on a link
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352, CWE-352
References: https://plugins.trac.wordpress.org/browser/banner-cycler/trunk/admin/admin.php#L131; https://www.wordfence.com/threat-intel/vulnerabilities/id/6cc1d7f2-053d-42d4-afb7-6fb69fd71b91?source=cve; https://www.wordfence.com/vulnerability-advisories/#CVE-2022-2233
CVE: CVE-2022-2402
Published: 2022-09-06
Description: The vulnerability in the driver dlpfde.sys enables a user logged into the system to perform system calls leading to kernel stack overflow, resulting in a system crash, for instance, a BSOD.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-121, CWE-787
References: https://support.eset.com/en/ca8298-vulnerability-fixed-in-eset-endpoint-encryption-and-eset-full-disk-encryption-for-windows; https://support.eset.com/en/ca8298-vulnerability-fixed-in-eset-endpoint-encryption-and-eset-full-disk-encryption-for-windows
CVE: CVE-2022-2429
Published: 2022-09-06
Description: The Ultimate SMS Notifications for WooCommerce plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 1.4.1 via the 'Export Utility' functionality. This makes it possible for authenticated attackers, such as a subscriber, to add untrusted input into billing information like their First Name that will embed into the exported CSV file triggered by an administrator and can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-138, CWE-1236
References: https://plugins.trac.wordpress.org/browser/ultimate-sms-notifications/trunk/README.txt?rev=2441845#L92; https://www.wordfence.com/vulnerability-advisories/#CVE-2022-2429; https://plugins.trac.wordpress.org/browser/ultimate-sms-notifications/trunk/README.txt?rev=2441845#L92