deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-39409
Published: 2022-10-18
Description: Vulnerability in the Oracle Transportation Management product of Oracle Supply Chain (component: Business Process Automation). Supported versions that are affected are 6.4.3 and 6.5.1. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Transportation Management. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Transportation Management. CVSS 3.1 Base Score 2.7 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L).
CVSS Score: 2.7 (LOW)
References: https://www.oracle.com/security-alerts/cpuoct2022.html; https://www.oracle.com/security-alerts/cpuoct2022.html
CVE: CVE-2022-39410
Published: 2022-10-18
Description: Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.30 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
CVSS Score: 6.5 (MEDIUM)
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EG3VBUHKCUXVWBSCD2FHCWIAMZO4X3PR/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NGZ4B5IQJEZQFSXGCZKSJ6GO3HLQ6URQ/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2022-39411
Published: 2022-10-18
Description: Vulnerability in the Oracle Transportation Management product of Oracle Supply Chain (component: Business Process Automation). Supported versions that are affected are 6.4.3 and 6.5.1. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Transportation Management. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Transportation Management accessible data. CVSS 3.1 Base Score 4.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N).
CVSS Score: 4.9 (MEDIUM)
References: https://www.oracle.com/security-alerts/cpuoct2022.html; https://www.oracle.com/security-alerts/cpuoct2022.html
CVE: CVE-2022-39412
Published: 2022-10-18
Description: Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Admin Console). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Access Manager accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: https://www.oracle.com/security-alerts/cpuoct2022.html; https://www.oracle.com/security-alerts/cpuoct2022.html
CVE: CVE-2022-39417
Published: 2022-10-18
Description: Vulnerability in the Oracle Solaris product of Oracle Systems (component: Filesystem). The supported version that is affected is 11. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Solaris. CVSS 3.1 Base Score 5.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
CVSS Score: 5.5 (MEDIUM)
References: https://www.oracle.com/security-alerts/cpuoct2022.html; https://www.oracle.com/security-alerts/cpuoct2022.html
CVE: CVE-2022-39419
Published: 2022-10-18
Description: Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 19c and 21c. Easily exploitable vulnerability allows low privileged attacker having Create Procedure privilege with network access via Oracle Net to compromise Java VM. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java VM accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
CVSS Score: 4.3 (MEDIUM)
References: https://www.oracle.com/security-alerts/cpuoct2022.html; https://www.oracle.com/security-alerts/cpuoct2022.html
CVE: CVE-2022-39420
Published: 2022-10-18
Description: Vulnerability in the Oracle Transportation Management product of Oracle Supply Chain (component: Data, Functional Security). Supported versions that are affected are 6.4.3 and 6.5.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Transportation Management. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Transportation Management accessible data as well as unauthorized read access to a subset of Oracle Transportation Management accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).
CVSS Score: 5.4 (MEDIUM)
References: https://www.oracle.com/security-alerts/cpuoct2022.html; https://www.oracle.com/security-alerts/cpuoct2022.html
CVE: CVE-2022-39421
Published: 2022-10-18
Description: Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 6.1.40. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. Note: This vulnerability applies to Windows systems only. CVSS 3.1 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H).
CVSS Score: 7.3 (HIGH)
CWE: CWE-284
References: https://security.gentoo.org/glsa/202212-03; https://www.oracle.com/security-alerts/cpuoct2022.html; https://security.gentoo.org/glsa/202212-03
CVE: CVE-2022-39422
Published: 2022-10-18
Description: Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 6.1.38. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H).
CVSS Score: 7.5 (HIGH)
CWE: CWE-269
References: https://security.gentoo.org/glsa/202212-03; https://www.oracle.com/security-alerts/cpuoct2022.html; https://security.gentoo.org/glsa/202212-03
CVE: CVE-2022-39423
Published: 2022-10-18
Description: Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 6.1.38. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 6.0 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N).
CVSS Score: 6.0 (MEDIUM)
References: https://security.gentoo.org/glsa/202212-03; https://www.oracle.com/security-alerts/cpuoct2022.html; https://security.gentoo.org/glsa/202212-03
CVE: CVE-2022-39424
Published: 2022-10-18
Description: Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 6.1.40. Difficult to exploit vulnerability allows unauthenticated attacker with network access via VRDP to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVSS Score: 8.1 (HIGH)
CWE: CWE-94
References: https://security.gentoo.org/glsa/202212-03; https://www.oracle.com/security-alerts/cpuoct2022.html; https://security.gentoo.org/glsa/202212-03
CVE: CVE-2022-39425
Published: 2022-10-18
Description: Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 6.1.40. Difficult to exploit vulnerability allows unauthenticated attacker with network access via VRDP to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVSS Score: 8.1 (HIGH)
CWE: CWE-306
References: https://security.gentoo.org/glsa/202212-03; https://www.oracle.com/security-alerts/cpuoct2022.html; https://security.gentoo.org/glsa/202212-03
CVE: CVE-2022-39426
Published: 2022-10-18
Description: Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 6.1.40. Difficult to exploit vulnerability allows unauthenticated attacker with network access via VRDP to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVSS Score: 8.1 (HIGH)
CWE: CWE-306
References: https://security.gentoo.org/glsa/202212-03; https://www.oracle.com/security-alerts/cpuoct2022.html; https://security.gentoo.org/glsa/202212-03
CVE: CVE-2022-39427
Published: 2022-10-18
Description: Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 6.1.40. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. Note: This vulnerability applies to Windows systems only. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
CVSS Score: 8.8 (HIGH)
References: https://www.oracle.com/security-alerts/cpuoct2022.html; https://www.oracle.com/security-alerts/cpuoct2022.html
CVE: CVE-2022-39428
Published: 2022-10-18
Description: Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: Upload). Supported versions that are affected are 12.2.3-12.2.11. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Web Applications Desktop Integrator. Successful attacks of this vulnerability can result in takeover of Oracle Web Applications Desktop Integrator. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVSS Score: 9.8 (CRITICAL)
References: https://www.oracle.com/security-alerts/cpuoct2022.html; https://www.oracle.com/security-alerts/cpuoct2022.html
CVE: CVE-2022-42112
Published: 2022-10-18
Description: A Cross-site scripting (XSS) vulnerability in the Portal Search module's Sort widget in Liferay Portal 7.2.0 through 7.4.3.24, and Liferay DXP 7.2 before fix pack 19, 7.3 before update 5, and DXP 7.4 before update 25 allows remote attackers to inject arbitrary web script or HTML via a crafted payload.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://liferay.com; https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42112; http://liferay.com
CVE: CVE-2022-42113
Published: 2022-10-18
Description: A Cross-site scripting (XSS) vulnerability in Document Library module in Liferay Portal 7.4.3.30 through 7.4.3.36, and Liferay DXP 7.4 update 30 through update 36 allows remote attackers to inject arbitrary web script or HTML via the `redirect` parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://liferay.com; https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42113; http://liferay.com
CVE: CVE-2022-42114
Published: 2022-10-18
Description: A Cross-site scripting (XSS) vulnerability in the Role module's edit role assignees page in Liferay Portal 7.4.0 through 7.4.3.36, and Liferay DXP 7.4 before update 37 allows remote attackers to inject arbitrary web script or HTML.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://liferay.com; https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42114; http://liferay.com
CVE: CVE-2022-42115
Published: 2022-10-18
Description: Cross-site scripting (XSS) vulnerability in the Object module's edit object details page in Liferay Portal 7.4.3.4 through 7.4.3.36 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into the object field's `Label` text field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://liferay.com; https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42115; http://liferay.com
CVE: CVE-2022-42116
Published: 2022-10-18
Description: A Cross-site scripting (XSS) vulnerability in the Frontend Editor module's integration with CKEditor in Liferay Portal 7.3.2 through 7.4.3.14, and Liferay DXP 7.3 before update 6, and 7.4 before update 15 allows remote attackers to inject arbitrary web script or HTML via the (1) name, or (2) namespace parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://liferay.com; https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42116; http://liferay.com
CVE: CVE-2022-42117
Published: 2022-10-18
Description: A Cross-site scripting (XSS) vulnerability in the Frontend Taglib module in Liferay Portal 7.3.2 through 7.4.3.16, and Liferay DXP 7.3 before update 6, and 7.4 before update 17 allows remote attackers to inject arbitrary web script or HTML.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://liferay.com; https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42117; http://liferay.com
CVE: CVE-2022-42218
Published: 2022-10-18
Description: Open Source SACCO Management System v1.0 vulnerable to SQL Injection via /sacco_shield/manage_loan.php.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/CNchenjiabao/bug_report/blob/main/vendors/mayuri_k/open-source-sacco-management-system/SQLi-1.md; https://github.com/CNchenjiabao/bug_report/blob/main/vendors/mayuri_k/open-source-sacco-management-system/SQLi-1.md
CVE: CVE-2022-41500
Published: 2022-10-18
Description: EyouCMS V1.5.9 was discovered to contain multiple Cross-Site Request Forgery (CSRF) vulnerabilities via the Members Center, Editorial Membership, and Points Recharge components.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://github.com/weng-xianhu/eyoucms/issues/27#issue[PII_REDACTED]; https://github.com/weng-xianhu/eyoucms/issues/27#issue[PII_REDACTED]
CVE: CVE-2022-33077
Published: 2022-10-19
Description: An access control issue in nopcommerce v4.50.2 allows attackers to arbitrarily modify any customer's address via the addressedit endpoint.
CVSS Score: 7.5 (HIGH)
CWE: CWE-639, CWE-639
References: http://nopcommerce.com; https://medium.com/%40rohan_pagey/cve-2022-33077-idor-to-change-address-of-any-customer-via-parameter-pollution-in-nopcommerce-4-5-2fa4bc763cc6; http://nopcommerce.com
CVE: CVE-2022-35860
Published: 2022-10-19
Description: Missing AES encryption in Corsair K63 Wireless 3.1.3 allows physically proximate attackers to inject and sniff keystrokes via 2.4 GHz radio transmissions.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-311, CWE-311
References: http://kth.diva-portal.org/smash/get/diva2:1701492/FULLTEXT01.pdf; http://kth.diva-portal.org/smash/record.jsf?pid=diva2%3A1701492&dswid=-3616; https://www.corsair.com/us/en/Categories/Products/Gaming-Keyboards/Wireless-Keyboards/K63-Wireless-Mechanical-Gaming-Keyboard-%E2%80%94-Blue-LED-%E2%80%94-CHERRY%C2%AE-MX-Red/p/CH-9145030-NA
CVE: CVE-2022-38901
Published: 2022-10-19
Description: A Cross-site scripting (XSS) vulnerability in the Document and Media module - file upload functionality in Liferay Digital Experience Platform 7.3.10 SP3 allows remote attackers to inject arbitrary JS script or HTML into the description field of uploaded svg file.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://liferay.com; https://drive.proton.me/urls/D27RQ14NGW#b71d8XrBl2Mu; https://www.offensity.com/en/blog/authenticated-persistent-xss-in-liferay-dxp-cms-cve-2022-38901-and-cve-2022-38902/
CVE: CVE-2022-40798
Published: 2022-10-19
Description: OcoMon 4.0RC1 is vulnerable to Incorrect Access Control. Through a request the user can obtain the real email, sending the same request with correct email its possible to account takeover.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://gist.github.com/ninj4c0d3r/89bdd6702bf00d768302f5e0e5bb8adc; https://ocomonphp.sourceforge.io/; https://gist.github.com/ninj4c0d3r/89bdd6702bf00d768302f5e0e5bb8adc
CVE: CVE-2016-20016
Published: 2022-10-19
Description: MVPower CCTV DVR models, including TV-7104HE 1.8.4 115215B9 and TV7108HE, contain a web shell that is accessible via a /shell URI. A remote unauthenticated attacker can execute arbitrary operating system commands as root. This vulnerability has also been referred to as the "JAWS webserver RCE" because of the easily identifying HTTP response server field. Other firmware versions, at least from 2014 through 2019, can be affected. This was exploited in the wild in 2017 through 2022.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://blog.netlab.360.com/iot_reaper-a-rappid-spreading-new-iot-botnet-en/; https://www.exploit-db.com/exploits/41471; https://www.pentestpartners.com/security-blog/pwning-cctv-cameras/
CVE: CVE-2016-20017
Published: 2022-10-19
Description: D-Link DSL-2750B devices before 1.05 allow remote unauthenticated command injection via the login.cgi cli parameter, as exploited in the wild in 2016 through 2022.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-77
References: https://seclists.org/fulldisclosure/2016/Feb/53; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10088; https://www.exploit-db.com/exploits/44760
CVE: CVE-2022-42466
Published: 2022-10-19
Description: Prior to 2.0.0-M9, it was possible for an end-user to set the value of an editable string property of a domain object to a value that would be rendered unchanged when the value was saved. In particular, the end-user could enter javascript or similar and this would be executed. As of this release, the inputted strings are properly escaped when rendered.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://www.openwall.com/lists/oss-security/2022/10/19/2; https://lists.apache.org/thread/83ftj5jgtv3mbm28w3trjyvd591jztrz; http://www.openwall.com/lists/oss-security/2022/10/19/2
CVE: CVE-2022-42467
Published: 2022-10-19
Description: When running in prototype mode, the h2 webconsole module (accessible from the Prototype menu) is automatically made available with the ability to directly query the database. It was felt that it is safer to require the developer to explicitly enable this capability. As of 2.0.0-M8, this can now be done using the 'isis.prototyping.h2-console.web-allow-remote-access' configuration property; the web console will be unavailable without setting this configuration. As an additional safeguard, the new 'isis.prototyping.h2-console.generate-random-web-admin-password' configuration parameter (enabled by default) requires that the administrator use a randomly generated password to use the console. The password is printed to the log, as "webAdminPass: xxx" (where "xxx") is the password. To revert to the original behaviour, the administrator would therefore need to set these configuration parameter: isis.prototyping.h2-console.web-allow-remote-access=true isis.prototyping.h2-console.generate-random-web-admin-password=false Note also that the h2 webconsole is never available in production mode, so these safeguards are only to ensure that the webconsole is secured by default also in prototype mode.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-1188, CWE-1188, CWE-1188
References: http://www.openwall.com/lists/oss-security/2022/10/19/1; https://lists.apache.org/thread/jbv2ddt00h7ntlbm6vkk4wdmb31pm8q3; http://www.openwall.com/lists/oss-security/2022/10/19/1
CVE: CVE-2022-3606
Published: 2022-10-19
Description: A vulnerability was found in Linux Kernel. It has been classified as problematic. This affects the function find_prog_by_sec_insn of the file tools/lib/bpf/libbpf.c of the component BPF. The manipulation leads to null pointer dereference. It is recommended to apply a patch to fix this issue. The identifier VDB-211749 was assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-404
References: https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git/commit/?id=d0d382f95a9270dcf803539d6781d6bd67e3f5b2; https://vuldb.com/?id.211749; https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git/commit/?id=d0d382f95a9270dcf803539d6781d6bd67e3f5b2
CVE: CVE-2020-23648
Published: 2022-10-19
Description: Asus RT-N12E 2.0.0.39 is affected by an incorrect access control vulnerability. Through system.asp / start_apply.htm, an attacker can change the administrator password without any authentication.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306, CWE-306
References: https://gist.github.com/ninj4c0d3r/574d2753d469e4ba51dfe555d9c2d4fb; https://www.asus.com/Networking/RTN12E/HelpDesk_BIOS/; https://www.shodan.io/search?query=rt-n12e
CVE: CVE-2022-22077
Published: 2022-10-19
Description: Memory corruption in graphics due to use-after-free in graphics dispatcher logic in Snapdragon Mobile
CVSS Score: 8.4 (HIGH)
CWE: CWE-416, CWE-416
References: https://www.qualcomm.com/company/product-security/bulletins/october-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/october-2022-bulletin
CVE: CVE-2022-22078
Published: 2022-10-19
Description: Denial of service in BOOT when partition size for a particular partition is requested due to integer overflow when blocks are calculated in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-190, CWE-190
References: https://www.qualcomm.com/company/product-security/bulletins/october-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/october-2022-bulletin