deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-44970
Published: 2022-02-10
Description: MiniCMS v1.11 was discovered to contain a cross-site scripting (XSS) vulnerability via /mc-admin/page-edit.php.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/bg5sbk/MiniCMS/issues/43; https://github.com/bg5sbk/MiniCMS/issues/43
CVE: CVE-2022-24646
Published: 2022-02-10
Description: Hospital Management System v4.0 was discovered to contain a SQL injection vulnerability in /Hospital-Management-System-master/contact.php via the txtMsg parameters.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://github.com/kishan0725/Hospital-Management-System/issues/18; https://github.com/nu11secur1ty/CVE-mitre/tree/main/2022/CVE-2022-24263; https://www.nu11secur1ty.com/2022/02/cve-2022-24263.html
CVE: CVE-2022-24647
Published: 2022-02-10
Description: Cuppa CMS v1.0 was discovered to contain an arbitrary file deletion vulnerability via the unlink() function.
CVSS Score: 8.1 (HIGH)
CWE: CWE-22
References: https://github.com/CuppaCMS/CuppaCMS/issues/23; https://github.com/CuppaCMS/CuppaCMS/issues/23
CVE: CVE-2022-23772
Published: 2022-02-11
Description: Rat.SetString in math/big in Go before 1.16.14 and 1.17.x before 1.17.7 has an overflow that can lead to Uncontrolled Memory Consumption.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: https://groups.google.com/g/golang-announce/c/SUsQn0aSgPQ; https://lists.debian.org/debian-lts-announce/2022/04/msg00017.html; https://lists.debian.org/debian-lts-announce/2022/04/msg00018.html
CVE: CVE-2022-23773
Published: 2022-02-11
Description: cmd/go in Go before 1.16.14 and 1.17.x before 1.17.7 can misinterpret branch names that falsely appear to be version tags. This can lead to incorrect access control if an actor is supposed to be able to create branches but not tags.
CVSS Score: 7.5 (HIGH)
CWE: CWE-436
References: https://groups.google.com/g/golang-announce/c/SUsQn0aSgPQ; https://security.gentoo.org/glsa/202208-02; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2022-23806
Published: 2022-02-11
Description: Curve.IsOnCurve in crypto/elliptic in Go before 1.16.14 and 1.17.x before 1.17.7 can incorrectly return true in situations with a big.Int value that is not a valid field element.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-252
References: https://groups.google.com/g/golang-announce/c/SUsQn0aSgPQ; https://lists.debian.org/debian-lts-announce/2022/04/msg00017.html; https://lists.debian.org/debian-lts-announce/2022/04/msg00018.html
CVE: CVE-2022-24954
Published: 2022-02-11
Description: Foxit PDF Reader before 11.2.1 and Foxit PDF Editor before 11.2.1 have a Stack-Based Buffer Overflow related to XFA, for the 'subform colSpan="-2"' and 'draw colSpan="1"' substrings.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://twitter.com/l33d0hyun/status/[PII_REDACTED]15459851; https://www.foxit.com/support/security-bulletins.html; https://twitter.com/l33d0hyun/status/[PII_REDACTED]15459851
CVE: CVE-2022-24955
Published: 2022-02-11
Description: Foxit PDF Reader before 11.2.1 and Foxit PDF Editor before 11.2.1 have an Uncontrolled Search Path Element for DLL files.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-427
References: https://www.foxit.com/support/security-bulletins.html; https://www.foxit.com/support/security-bulletins.html
CVE: CVE-2022-24958
Published: 2022-02-11
Description: drivers/usb/gadget/legacy/inode.c in the Linux kernel through 5.16.8 mishandles dev->buf release.
CVSS Score: 7.8 (HIGH)
CWE: CWE-763
References: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=89f3594d0de58e8a57d92d497dea9fee3d4b9cda; https://github.com/torvalds/linux/commit/501e38a5531efbd77d5c73c0ba838a889bfc1d74; https://github.com/torvalds/linux/commit/89f3594d0de58e8a57d92d497dea9fee3d4b9cda
CVE: CVE-2022-24959
Published: 2022-02-11
Description: An issue was discovered in the Linux kernel before 5.16.5. There is a memory leak in yam_siocdevprivate in drivers/net/hamradio/yam.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.16.5; https://github.com/torvalds/linux/commit/29eb31542787e1019208a2e1047bb7c76c069536; https://lists.debian.org/debian-lts-announce/2022/03/msg00012.html
CVE: CVE-2022-24961
Published: 2022-02-11
Description: In Portainer Agent before 2.11.1, an API server can continue running even if not associated with a Portainer instance in the past few days.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/portainer/agent/compare/2.11.0...2.11.1; https://github.com/portainer/agent/pull/225/commits/a66977c76043fcff4a8f69c4b65988272d27c01f; https://github.com/portainer/portainer/issues/6420
CVE: CVE-2022-0557
Published: 2022-02-11
Description: OS Command Injection in Packagist microweber/microweber prior to 1.2.11.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78, CWE-78
References: http://packetstormsecurity.com/files/166077/Microweber-1.2.11-Shell-Upload.html; https://github.com/microweber/microweber/commit/0a7e5f1d81de884861ca677ee1aaac31f188d632; https://huntr.dev/bounties/660c89af-2de5-41bc-aada-9e4e78142db8
CVE: CVE-2021-30309
Published: 2022-02-11
Description: Improper size validation of QXDM commands can lead to memory corruption in Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://www.qualcomm.com/company/product-security/bulletins/february-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/february-2022-bulletin
CVE: CVE-2021-30317
Published: 2022-02-11
Description: Improper validation of program headers containing ELF metadata can lead to image verification bypass in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-287
References: https://www.qualcomm.com/company/product-security/bulletins/february-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/february-2022-bulletin
CVE: CVE-2021-30318
Published: 2022-02-11
Description: Improper validation of input when provisioning the HDCP key can lead to memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Voice & Music, Snapdragon Wearables
CVSS Score: 8.4 (HIGH)
CWE: CWE-120
References: https://www.qualcomm.com/company/product-security/bulletins/february-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/february-2022-bulletin
CVE: CVE-2021-30322
Published: 2022-02-11
Description: Possible out of bounds write due to improper validation of number of GPIOs configured in an internal parameters array in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.qualcomm.com/company/product-security/bulletins/february-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/february-2022-bulletin
CVE: CVE-2021-30323
Published: 2022-02-11
Description: Improper validation of maximum size of data write to EFS file can lead to memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://www.qualcomm.com/company/product-security/bulletins/february-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/february-2022-bulletin
CVE: CVE-2021-30324
Published: 2022-02-11
Description: Possible out of bound write due to lack of boundary check for the maximum size of buffer when sending a DCI packet to remote process in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-120
References: https://www.qualcomm.com/company/product-security/bulletins/february-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/february-2022-bulletin
CVE: CVE-2021-30325
Published: 2022-02-11
Description: Possible out of bound access of DCI resources due to lack of validation process and resource allocation in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-129
References: https://www.qualcomm.com/company/product-security/bulletins/february-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/february-2022-bulletin
CVE: CVE-2021-30326
Published: 2022-02-11
Description: Possible assertion due to improper size validation while processing the DownlinkPreemption IE in an RRC Reconfiguration/RRC Setup message in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile
CVSS Score: 7.5 (HIGH)
CWE: CWE-617
References: https://www.qualcomm.com/company/product-security/bulletins/february-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/february-2022-bulletin
CVE: CVE-2021-35068
Published: 2022-02-11
Description: Lack of null check while freeing the device information buffer in the Bluetooth HFP protocol can lead to a NULL pointer dereference in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Voice & Music, Snapdragon Wearables
CVSS Score: 8.4 (HIGH)
CWE: CWE-476
References: https://www.qualcomm.com/company/product-security/bulletins/february-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/february-2022-bulletin
CVE: CVE-2021-35069
Published: 2022-02-11
Description: Improper validation of data length received from DMA buffer can lead to memory corruption. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: https://www.qualcomm.com/company/product-security/bulletins/february-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/february-2022-bulletin
CVE: CVE-2021-35074
Published: 2022-02-11
Description: Possible integer overflow due to improper fragment datatype while calculating number of fragments in a request message in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile
CVSS Score: 8.4 (HIGH)
CWE: CWE-190
References: https://www.qualcomm.com/company/product-security/bulletins/february-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/february-2022-bulletin
CVE: CVE-2021-35075
Published: 2022-02-11
Description: Possible null pointer dereference due to lack of WDOG structure validation during registration in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile
CVSS Score: 8.4 (HIGH)
CWE: CWE-476
References: https://www.qualcomm.com/company/product-security/bulletins/february-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/february-2022-bulletin
CVE: CVE-2021-35077
Published: 2022-02-11
Description: Possible use after free scenario in compute offloads to DSP while multiple calls spawn a dynamic process in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile
CVSS Score: 8.4 (HIGH)
CWE: CWE-416
References: https://www.qualcomm.com/company/product-security/bulletins/february-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/february-2022-bulletin
CVE: CVE-2021-44521
Published: 2022-02-11
Description: When running Apache Cassandra with the following configuration: enable_user_defined_functions: true enable_scripted_user_defined_functions: true enable_user_defined_functions_threads: false it is possible for an attacker to execute arbitrary code on the host. The attacker would need to have enough permissions to create user defined functions in the cluster to be able to exploit this. Note that this configuration is documented as unsafe, and will continue to be considered unsafe after this CVE.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-94, CWE-732
References: http://www.openwall.com/lists/oss-security/2022/02/11/4; https://jfrog.com/blog/cve-2021-44521-exploiting-apache-cassandra-user-defined-functions-for-remote-code-execution/; https://lists.apache.org/thread/y4nb9s4co34j8hdfmrshyl09lokm7356
CVE: CVE-2021-46355
Published: 2022-02-11
Description: OCS Inventory 2.9.1 is affected by Cross Site Scripting (XSS). To exploit the vulnerability, the attacker needs to manipulate the name of some device on your computer, such as a printer, replacing the device name with some malicious code that allows the execution of Stored Cross-site Scripting (XSS).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://ocs.com; https://medium.com/%40windsormoreira/ocs-inventory-2-9-1-cross-site-scripting-xss-cve-2021-46355-a88d72606b7e; http://ocs.com
CVE: CVE-2022-0560
Published: 2022-02-11
Description: Open Redirect in Packagist microweber/microweber prior to 1.2.11.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://github.com/microweber/microweber/commit/72d4b12cc487f56a859a8570ada4efb77b4b8c63; https://huntr.dev/bounties/c9d586e7-0fa1-47ab-a2b3-b890e8dc9b25; https://github.com/microweber/microweber/commit/72d4b12cc487f56a859a8570ada4efb77b4b8c63
CVE: CVE-2022-24112
Published: 2022-02-11
Description: An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. A default configuration of Apache APISIX (with default API key) is vulnerable to remote code execution. When the admin key was changed or the port of Admin API was changed to a port different from the data panel, the impact is lower. But there is still a risk to bypass the IP restriction of Apache APISIX's data panel. There is a check in the batch-requests plugin which overrides the client IP with its real remote IP. But due to a bug in the code, this check can be bypassed.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-290, CWE-290
References: http://packetstormsecurity.com/files/166228/Apache-APISIX-Remote-Code-Execution.html; http://packetstormsecurity.com/files/166328/Apache-APISIX-2.12.1-Remote-Code-Execution.html; http://www.openwall.com/lists/oss-security/2022/02/11/3
CVE: CVE-2022-24289
Published: 2022-02-11
Description: Hessian serialization is a network protocol that supports object-based transmission. Apache Cayenne's optional Remote Object Persistence (ROP) feature is a web services-based technology that provides object persistence and query functionality to 'remote' applications. In Apache Cayenne 4.1 and earlier, running on non-current patch versions of Java, an attacker with client access to Cayenne ROP can transmit a malicious payload to any vulnerable third-party dependency on the server. This can result in arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502, CWE-502
References: http://www.openwall.com/lists/oss-security/2022/02/11/1; https://lists.apache.org/thread/zthjy83t3o66x7xcbygn2vg3yjvlc9vc; http://www.openwall.com/lists/oss-security/2022/02/11/1
CVE: CVE-2021-38679
Published: 2022-02-11
Description: An improper authentication vulnerability has been reported to affect QNAP NAS running Kazoo Server. If exploited, this vulnerability allows attackers to compromise the security of the system. We have already fixed this vulnerability in the following versions of Kazoo Server: Kazoo Server 4.11.22 and later
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-287, CWE-287
References: https://www.qnap.com/en/security-advisory/qsa-22-01; https://www.qnap.com/en/security-advisory/qsa-22-01
CVE: CVE-2021-45402
Published: 2022-02-11
Description: The check_alu_op() function in kernel/bpf/verifier.c in the Linux kernel through v5.16-rc5 did not properly update bounds while handling the mov32 instruction, which allows local users to obtain potentially sensitive address information, aka a "pointer leak."
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-668
References: https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=3cf2b61eb06765e27fec6799292d9fb46d0b7e60; https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=b1a7288dedc6caf9023f2676b4f5ed34cf0d4029; https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=e572ff80f05c33cd0cb4860f864f5c9c044280b6
CVE: CVE-2020-13668
Published: 2022-02-11
Description: Access Bypass vulnerability in Drupal Core allows for an attacker to leverage the way that HTML is rendered for affected forms in order to exploit the vulnerability. This issue affects: Drupal Core 8.8.x versions prior to 8.8.10; 8.9.x versions prior to 8.9.6; 9.0.x versions prior to 9.0.6.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.drupal.org/sa-core-2020-009; https://www.drupal.org/sa-core-2020-009
CVE: CVE-2020-13669
Published: 2022-02-11
Description: Cross-site Scripting (XSS) vulnerability in ckeditor of Drupal Core allows attacker to inject XSS. This issue affects: Drupal Core 8.8.x versions prior to 8.8.10.; 8.9.x versions prior to 8.9.6; 9.0.x versions prior to 9.0.6.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.drupal.org/sa-core-2020-010; https://www.drupal.org/sa-core-2020-010
CVE: CVE-2020-13670
Published: 2022-02-11
Description: Information Disclosure vulnerability in file module of Drupal Core allows an attacker to gain access to the file metadata of a permanent private file that they do not have access to by guessing the ID of the file. This issue affects: Drupal Core 8.8.x versions prior to 8.8.10; 8.9.x versions prior to 8.9.6; 9.0.x versions prior to 9.0.6.
CVSS Score: 7.5 (HIGH)
CWE: CWE-668
References: https://www.drupal.org/sa-core-2020-011; https://www.drupal.org/sa-core-2020-011
CVE: CVE-2020-13672
Published: 2022-02-11
Description: Cross-site Scripting (XSS) vulnerability in Drupal core's sanitization API fails to properly filter cross-site scripting under certain circumstances. This issue affects: Drupal Core 9.1.x versions prior to 9.1.7; 9.0.x versions prior to 9.0.12; 8.9.x versions prior to 8.9.14; 7.x versions prior to 7.80.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.drupal.org/sa-core-2021-002; https://www.drupal.org/sa-core-2021-002
CVE: CVE-2020-13673
Published: 2022-02-11
Description: The Entity Embed module provides a filter to allow embedding entities in content fields. In certain circumstances, the filter could allow an unprivileged user to inject HTML into a page when it is accessed by a trusted user with permission to embed entities. In some cases, this could lead to cross-site scripting.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-352, CWE-79
References: https://www.drupal.org/sa-contrib-2021-028; https://www.drupal.org/sa-contrib-2021-028
CVE: CVE-2020-13674
Published: 2022-02-11
Description: The QuickEdit module does not properly validate access to routes, which could allow cross-site request forgery under some circumstances and lead to possible data integrity issues. Sites are only affected if the QuickEdit module (which comes with the Standard profile) is installed. Removing the "access in-place editing" permission from untrusted users will not fully mitigate the vulnerability.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://www.drupal.org/sa-core-2021-007; https://www.drupal.org/sa-core-2021-007
CVE: CVE-2020-13675
Published: 2022-02-11
Description: Drupal's JSON:API and REST/File modules allow file uploads through their HTTP APIs. The modules do not correctly run all file validation, which causes an access bypass vulnerability. An attacker might be able to upload files that bypass the file validation process implemented by modules on the site.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284, CWE-434
References: https://www.drupal.org/sa-core-2021-008; https://www.drupal.org/sa-core-2021-008
CVE: CVE-2020-13676
Published: 2022-02-11
Description: The QuickEdit module does not properly check access to fields in some circumstances, which can lead to unintended disclosure of field data. Sites are only affected if the QuickEdit module (which comes with the Standard profile) is installed.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284, CWE-863
References: https://www.drupal.org/sa-core-2021-009; https://www.drupal.org/sa-core-2021-009
CVE: CVE-2020-13677
Published: 2022-02-11
Description: Under some circumstances, the Drupal core JSON:API module does not properly restrict access to certain content, which may result in unintended access bypass. Sites that do not have the JSON:API module enabled are not affected.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://www.drupal.org/sa-core-2021-010; https://www.drupal.org/sa-core-2021-010
CVE: CVE-2020-36062
Published: 2022-02-11
Description: Dairy Farm Shop Management System v1.0 was discovered to contain hardcoded credentials in the source code which allows attackers access to the control panel if compromised.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://github.com/VivekPanday12/CVE-/issues/3; https://phpgurukul.com; https://phpgurukul.com/dairy-farm-shop-management-system-using-php-and-mysql/
CVE: CVE-2021-42940
Published: 2022-02-11
Description: A Cross Site Scripting (XSS) vulnerability exists in Projeqtor 9.3.1 via /projeqtor/tool/saveAttachment.php, which allows an attacker to upload a SVG file containing malicious JavaScript code.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-79
References: https://truedigitalsecurity.com/services/penetration-testing-services/advisory-summary-2.2022-cve-2021-42940; https://www.projeqtor.org/en/; https://truedigitalsecurity.com/services/penetration-testing-services/advisory-summary-2.2022-cve-2021-42940
CVE: CVE-2021-45385
Published: 2022-02-11
Description: A Null Pointer Dereference vulnerability exits in ffjpeg d5cfd49 (2021-12-06) in bmp_load(). When the size information in metadata of the bmp is out of range, it returns without assign memory buffer to `pb->pdata` and did not exit the program. So the program crashes when it tries to access the pb->data, in jfif_encode() at jfif.c:763. This is due to the incomplete patch for CVE-2020-13438.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/rockcarry/ffjpeg/issues/47; https://github.com/rockcarry/ffjpeg/pull/48; https://github.com/rockcarry/ffjpeg/issues/47
CVE: CVE-2021-23597
Published: 2022-02-11
Description: This affects the package fastify-multipart before 5.3.1. By providing a name=constructor property it is still possible to crash the application. **Note:** This is a bypass of CVE-2020-8136 (https://security.snyk.io/vuln/SNYK-JS-FASTIFYMULTIPART-1290382).
CVSS Score: 7.5 (HIGH)
CWE: CWE-1321
References: https://github.com/fastify/fastify-multipart/commit/a70dc7059a794589bd4fe066453141fc609e6066; https://github.com/fastify/fastify-multipart/releases/tag/v5.3.1; https://snyk.io/vuln/SNYK-JS-FASTIFYMULTIPART-2395480
CVE: CVE-2021-45386
Published: 2022-02-11
Description: tcpreplay 4.3.4 has a Reachable Assertion in add_tree_ipv6() at tree.c
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-617
References: https://github.com/appneta/tcpreplay/issues/687; https://security.gentoo.org/glsa/202210-08; https://github.com/appneta/tcpreplay/issues/687
CVE: CVE-2021-45387
Published: 2022-02-11
Description: tcpreplay 4.3.4 has a Reachable Assertion in add_tree_ipv4() at tree.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-617
References: https://github.com/appneta/tcpreplay/issues/687; https://security.gentoo.org/glsa/202210-08; https://github.com/appneta/tcpreplay/issues/687