deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-39920
Published: 2022-12-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none.
CVE: CVE-2022-39921
Published: 2022-12-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none.
CVE: CVE-2022-39922
Published: 2022-12-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none.
CVE: CVE-2022-39923
Published: 2022-12-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none.
CVE: CVE-2022-39924
Published: 2022-12-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none.
CVE: CVE-2022-39925
Published: 2022-12-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none.
CVE: CVE-2022-39926
Published: 2022-12-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none.
CVE: CVE-2022-39927
Published: 2022-12-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none.
CVE: CVE-2022-39928
Published: 2022-12-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none.
CVE: CVE-2022-39929
Published: 2022-12-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none.
CVE: CVE-2022-39930
Published: 2022-12-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none.
CVE: CVE-2022-39931
Published: 2022-12-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none.
CVE: CVE-2022-39932
Published: 2022-12-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none.
CVE: CVE-2022-39933
Published: 2022-12-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none.
CVE: CVE-2022-39934
Published: 2022-12-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none.
CVE: CVE-2022-39935
Published: 2022-12-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none.
CVE: CVE-2022-39936
Published: 2022-12-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none.
CVE: CVE-2022-39937
Published: 2022-12-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none.
CVE: CVE-2022-39938
Published: 2022-12-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none.
CVE: CVE-2022-39939
Published: 2022-12-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none.
CVE: CVE-2022-39940
Published: 2022-12-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none.
CVE: CVE-2022-39941
Published: 2022-12-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none.
CVE: CVE-2022-39942
Published: 2022-12-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none.
CVE: CVE-2022-39943
Published: 2022-12-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none.
CVE: CVE-2022-3427
Published: 2022-12-15
Description: The Corner Ad plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.56. This is due to missing or incorrect nonce validation on its corner_ad_settings_page function. This makes it possible for unauthenticated attackers to trigger the deletion of ads via forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/corner-ad/trunk/corner-ad.php?rev=2782613#L240; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2765630%40corner-ad%2Ftrunk&old=2719671%40corner-ad%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/0a6c5e9a-754f-41c8-b27b-caa133b5070f?source=cve
CVE: CVE-2022-40000
Published: 2022-12-15
Description: Cross Site Scripting (XSS) vulnerability in FeehiCMS-2.1.1 allows remote attackers to run arbitrary code via the username field of the admin log in page.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/liufee/cms/issues/64; https://github.com/liufee/cms/issues/64
CVE: CVE-2022-40001
Published: 2022-12-15
Description: Cross Site Scripting (XSS) vulnerability in FeehiCMS-2.1.1 allows remote attackers to run arbitrary code via the title field of the create article page.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/liufee/cms/issues/65; https://github.com/liufee/cms/issues/65
CVE: CVE-2022-40002
Published: 2022-12-15
Description: Cross Site Scripting (XSS) vulnerability in FeehiCMS-2.1.1 allows remote attackers to run arbirtary code via the callback parameter to /cms/notify.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/liufee/cms/issues/66; https://github.com/liufee/cms/issues/66
CVE: CVE-2022-40373
Published: 2022-12-15
Description: Cross Site Scripting (XSS) vulnerability in FeehiCMS 2.1.1 allows remote attackers to run arbitrary code via upload of crafted XML file.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/liufee/cms/issues/67; https://github.com/liufee/cms/issues/67
CVE: CVE-2022-42805
Published: 2022-12-15
Description: An integer overflow was addressed with improved input validation. This issue is fixed in iOS 15.6 and iPadOS 15.6, macOS Monterey 12.5. An app may be able to execute arbitrary code with kernel privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190, CWE-190
References: https://support.apple.com/en-us/HT213345; https://support.apple.com/en-us/HT213346; https://support.apple.com/en-us/HT213345
CVE: CVE-2022-42821
Published: 2022-12-15
Description: A logic issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.6.2, macOS Big Sur 11.7.2, macOS Ventura 13. An app may bypass Gatekeeper checks.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-693
References: http://seclists.org/fulldisclosure/2022/Dec/24; http://seclists.org/fulldisclosure/2022/Dec/25; https://support.apple.com/en-us/HT213488
CVE: CVE-2022-42837
Published: 2022-12-15
Description: An issue existed in the parsing of URLs. This issue was addressed with improved input validation. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Ventura 13.1, iOS 15.7.2 and iPadOS 15.7.2, watchOS 9.2. A remote user may be able to cause unexpected app termination or arbitrary code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: http://seclists.org/fulldisclosure/2022/Dec/20; http://seclists.org/fulldisclosure/2022/Dec/21; http://seclists.org/fulldisclosure/2022/Dec/23
CVE: CVE-2022-42840
Published: 2022-12-15
Description: The issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.6.2, macOS Ventura 13.1, macOS Big Sur 11.7.2, iOS 15.7.2 and iPadOS 15.7.2, iOS 16.2 and iPadOS 16.2. An app may be able to execute arbitrary code with kernel privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://seclists.org/fulldisclosure/2022/Dec/20; http://seclists.org/fulldisclosure/2022/Dec/21; http://seclists.org/fulldisclosure/2022/Dec/23
CVE: CVE-2022-42841
Published: 2022-12-15
Description: A type confusion issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.6.2, macOS Ventura 13.1, macOS Big Sur 11.7.2. Processing a maliciously crafted package may lead to arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-843, CWE-843
References: http://seclists.org/fulldisclosure/2022/Dec/23; http://seclists.org/fulldisclosure/2022/Dec/24; http://seclists.org/fulldisclosure/2022/Dec/25
CVE: CVE-2022-42842
Published: 2022-12-15
Description: The issue was addressed with improved memory handling. This issue is fixed in tvOS 16.2, macOS Monterey 12.6.2, macOS Ventura 13.1, macOS Big Sur 11.7.2, iOS 16.2 and iPadOS 16.2, watchOS 9.2. A remote user may be able to cause kernel code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: http://seclists.org/fulldisclosure/2022/Dec/20; http://seclists.org/fulldisclosure/2022/Dec/23; http://seclists.org/fulldisclosure/2022/Dec/24
CVE: CVE-2022-42843
Published: 2022-12-15
Description: This issue was addressed with improved data protection. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Ventura 13.1, tvOS 16.2, watchOS 9.2. A user may be able to view sensitive user information.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://seclists.org/fulldisclosure/2022/Dec/20; http://seclists.org/fulldisclosure/2022/Dec/23; http://seclists.org/fulldisclosure/2022/Dec/26
CVE: CVE-2022-42844
Published: 2022-12-15
Description: The issue was addressed with improved memory handling. This issue is fixed in iOS 16.2 and iPadOS 16.2. An app may be able to break out of its sandbox.
CVSS Score: 8.6 (HIGH)
CWE: CWE-119
References: http://seclists.org/fulldisclosure/2022/Dec/20; https://support.apple.com/en-us/HT213530; http://seclists.org/fulldisclosure/2022/Dec/20
CVE: CVE-2022-42845
Published: 2022-12-15
Description: The issue was addressed with improved memory handling. This issue is fixed in tvOS 16.2, macOS Monterey 12.6.2, macOS Ventura 13.1, macOS Big Sur 11.7.2, iOS 16.2 and iPadOS 16.2, watchOS 9.2. An app with root privileges may be able to execute arbitrary code with kernel privileges.
CVSS Score: 7.2 (HIGH)
CWE: CWE-787
References: http://seclists.org/fulldisclosure/2022/Dec/20; http://seclists.org/fulldisclosure/2022/Dec/23; http://seclists.org/fulldisclosure/2022/Dec/24
CVE: CVE-2022-42846
Published: 2022-12-15
Description: The issue was addressed with improved memory handling. This issue is fixed in iOS 16.2 and iPadOS 16.2, iOS 15.7.2 and iPadOS 15.7.2. Parsing a maliciously crafted video file may lead to unexpected system termination.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: http://seclists.org/fulldisclosure/2022/Dec/20; http://seclists.org/fulldisclosure/2022/Dec/21; https://support.apple.com/en-us/HT213530
CVE: CVE-2022-42847
Published: 2022-12-15
Description: An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in macOS Ventura 13.1. An app may be able to execute arbitrary code with kernel privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: http://seclists.org/fulldisclosure/2022/Dec/23; https://support.apple.com/en-us/HT213532; http://seclists.org/fulldisclosure/2022/Dec/23
CVE: CVE-2022-42848
Published: 2022-12-15
Description: A logic issue was addressed with improved checks. This issue is fixed in iOS 16.2 and iPadOS 16.2, iOS 15.7.2 and iPadOS 15.7.2, tvOS 16.2. An app may be able to execute arbitrary code with kernel privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-693
References: http://seclists.org/fulldisclosure/2022/Dec/20; http://seclists.org/fulldisclosure/2022/Dec/21; http://seclists.org/fulldisclosure/2022/Dec/26
CVE: CVE-2022-42849
Published: 2022-12-15
Description: An access issue existed with privileged API calls. This issue was addressed with additional restrictions. This issue is fixed in iOS 16.2 and iPadOS 16.2, tvOS 16.2, watchOS 9.2. A user may be able to elevate privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: http://seclists.org/fulldisclosure/2022/Dec/20; http://seclists.org/fulldisclosure/2022/Dec/26; http://seclists.org/fulldisclosure/2022/Dec/27
CVE: CVE-2022-42850
Published: 2022-12-15
Description: The issue was addressed with improved memory handling. This issue is fixed in iOS 16.2 and iPadOS 16.2. An app may be able to execute arbitrary code with kernel privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://seclists.org/fulldisclosure/2022/Dec/20; https://support.apple.com/en-us/HT213530; http://seclists.org/fulldisclosure/2022/Dec/20
CVE: CVE-2022-42851
Published: 2022-12-15
Description: The issue was addressed with improved memory handling. This issue is fixed in iOS 16.2 and iPadOS 16.2, tvOS 16.2. Parsing a maliciously crafted TIFF file may lead to disclosure of user information.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: http://seclists.org/fulldisclosure/2022/Dec/20; http://seclists.org/fulldisclosure/2022/Dec/26; https://support.apple.com/en-us/HT213530
CVE: CVE-2022-42852
Published: 2022-12-15
Description: The issue was addressed with improved memory handling. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 15.7.2 and iPadOS 15.7.2, iOS 16.2 and iPadOS 16.2, watchOS 9.2. Processing maliciously crafted web content may result in the disclosure of process memory.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: http://seclists.org/fulldisclosure/2022/Dec/20; http://seclists.org/fulldisclosure/2022/Dec/21; http://seclists.org/fulldisclosure/2022/Dec/23
CVE: CVE-2022-42853
Published: 2022-12-15
Description: An access issue was addressed with improved access restrictions. This issue is fixed in macOS Ventura 13.1. An app may be able to modify protected parts of the file system.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-284
References: http://seclists.org/fulldisclosure/2022/Dec/23; https://support.apple.com/en-us/HT213532; https://support.apple.com/kb/HT213533
CVE: CVE-2022-42854
Published: 2022-12-15
Description: The issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.6.2, macOS Ventura 13.1. An app may be able to disclose kernel memory.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://seclists.org/fulldisclosure/2022/Dec/23; http://seclists.org/fulldisclosure/2022/Dec/24; https://support.apple.com/en-us/HT213532
CVE: CVE-2022-42855
Published: 2022-12-15
Description: A logic issue was addressed with improved state management. This issue is fixed in tvOS 16.2, macOS Monterey 12.6.2, macOS Ventura 13.1, iOS 15.7.2 and iPadOS 15.7.2, iOS 16.2 and iPadOS 16.2. An app may be able to use arbitrary entitlements.
CVSS Score: 7.1 (HIGH)
CWE: CWE-269
References: http://packetstormsecurity.com/files/170518/libCoreEntitlements-CEContextQuery-Arbitrary-Entitlement-Returns.html; http://seclists.org/fulldisclosure/2022/Dec/20; http://seclists.org/fulldisclosure/2022/Dec/21
CVE: CVE-2022-42856
Published: 2022-12-15
Description: A type confusion issue was addressed with improved state handling. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 15.7.2 and iPadOS 15.7.2, iOS 16.1.2. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.1..
CVSS Score: 8.8 (HIGH)
CWE: CWE-843, CWE-843
References: http://seclists.org/fulldisclosure/2022/Dec/21; http://seclists.org/fulldisclosure/2022/Dec/22; http://seclists.org/fulldisclosure/2022/Dec/23
CVE: CVE-2022-42859
Published: 2022-12-15
Description: Multiple issues were addressed by removing the vulnerable code. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Ventura 13.1, watchOS 9.2. An app may be able to bypass Privacy preferences.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-284
References: http://seclists.org/fulldisclosure/2022/Dec/20; http://seclists.org/fulldisclosure/2022/Dec/23; http://seclists.org/fulldisclosure/2022/Dec/27
CVE: CVE-2022-42861
Published: 2022-12-15
Description: This issue was addressed with improved checks. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Monterey 12.6.2, macOS Ventura 13.1, iOS 15.7.2 and iPadOS 15.7.2. An app may be able to break out of its sandbox.
CVSS Score: 8.8 (HIGH)
CWE: CWE-284
References: http://seclists.org/fulldisclosure/2022/Dec/20; http://seclists.org/fulldisclosure/2022/Dec/21; http://seclists.org/fulldisclosure/2022/Dec/23
CVE: CVE-2022-42862
Published: 2022-12-15
Description: This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Ventura 13.1. An app may be able to bypass Privacy preferences.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-284
References: http://seclists.org/fulldisclosure/2022/Dec/20; http://seclists.org/fulldisclosure/2022/Dec/23; https://support.apple.com/en-us/HT213530
CVE: CVE-2022-42863
Published: 2022-12-15
Description: A memory corruption issue was addressed with improved state management. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 16.2 and iPadOS 16.2, watchOS 9.2. Processing maliciously crafted web content may lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: http://seclists.org/fulldisclosure/2022/Dec/20; http://seclists.org/fulldisclosure/2022/Dec/23; http://seclists.org/fulldisclosure/2022/Dec/26
CVE: CVE-2022-42864
Published: 2022-12-15
Description: A race condition was addressed with improved state handling. This issue is fixed in tvOS 16.2, macOS Monterey 12.6.2, macOS Ventura 13.1, macOS Big Sur 11.7.2, iOS 15.7.2 and iPadOS 15.7.2, iOS 16.2 and iPadOS 16.2, watchOS 9.2. An app may be able to execute arbitrary code with kernel privileges.
CVSS Score: 7.0 (HIGH)
CWE: CWE-362, CWE-362
References: http://seclists.org/fulldisclosure/2022/Dec/20; http://seclists.org/fulldisclosure/2022/Dec/21; http://seclists.org/fulldisclosure/2022/Dec/23
CVE: CVE-2022-42865
Published: 2022-12-15
Description: This issue was addressed by enabling hardened runtime. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Ventura 13.1, tvOS 16.2, watchOS 9.2. An app may be able to bypass Privacy preferences.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-284
References: http://seclists.org/fulldisclosure/2022/Dec/20; http://seclists.org/fulldisclosure/2022/Dec/23; http://seclists.org/fulldisclosure/2022/Dec/26
CVE: CVE-2022-42866
Published: 2022-12-15
Description: The issue was addressed with improved handling of caches. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Ventura 13.1, tvOS 16.2, watchOS 9.2. An app may be able to read sensitive location information.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://seclists.org/fulldisclosure/2022/Dec/20; http://seclists.org/fulldisclosure/2022/Dec/23; http://seclists.org/fulldisclosure/2022/Dec/26
CVE: CVE-2022-42867
Published: 2022-12-15
Description: A use after free issue was addressed with improved memory management. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 16.2 and iPadOS 16.2, watchOS 9.2. Processing maliciously crafted web content may lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: http://seclists.org/fulldisclosure/2022/Dec/20; http://seclists.org/fulldisclosure/2022/Dec/23; http://seclists.org/fulldisclosure/2022/Dec/26
CVE: CVE-2022-44235
Published: 2022-12-15
Description: Beijing Zed-3 Technologies Co.,Ltd VoIP simpliclty ASG 8.5.0.17807 (20181130-16:12) is vulnerable to Cross Site Scripting (XSS).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/liong007/Zed-3/issues/1; https://github.com/liong007/Zed-3/issues/1
CVE: CVE-2022-44236
Published: 2022-12-15
Description: Beijing Zed-3 Technologies Co.,Ltd VoIP simpliclty ASG 8.5.0.17807 (20181130-16:12) has a Weak password vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-521, CWE-521
References: https://github.com/liong007/Zed-3/issues/2; https://github.com/liong007/Zed-3/issues/2
CVE: CVE-2022-44588
Published: 2022-12-15
Description: Unauth. SQL Injection vulnerability in Cryptocurrency Widgets Pack Plugin <=1.8.1 on WordPress.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-89
References: https://patchstack.com/database/vulnerability/cryptocurrency-widgets-pack/wordpress-cryptocurrency-widgets-pack-plugin-1-8-1-sql-injection-sqli-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/cryptocurrency-widgets-pack/wordpress-cryptocurrency-widgets-pack-plugin-1-8-1-sql-injection-sqli-vulnerability?_s_id=cve
CVE: CVE-2022-45033
Published: 2022-12-15
Description: A cross-site scripting (XSS) vulnerability in Expense Tracker 1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Chat text field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/cyb3r-n3rd/cve-request/blob/main/cve-poc-payload; https://github.com/cyb3r-n3rd/cve-request/blob/main/cve-poc-payload
CVE: CVE-2022-46689
Published: 2022-12-15
Description: A race condition was addressed with additional validation. This issue is fixed in tvOS 16.2, macOS Monterey 12.6.2, macOS Ventura 13.1, macOS Big Sur 11.7.2, iOS 15.7.2 and iPadOS 15.7.2, iOS 16.2 and iPadOS 16.2, watchOS 9.2. An app may be able to execute arbitrary code with kernel privileges.
CVSS Score: 7.0 (HIGH)
CWE: CWE-362, CWE-362
References: http://seclists.org/fulldisclosure/2022/Dec/20; http://seclists.org/fulldisclosure/2022/Dec/21; http://seclists.org/fulldisclosure/2022/Dec/23
CVE: CVE-2022-46690
Published: 2022-12-15
Description: An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Ventura 13.1, tvOS 16.2, watchOS 9.2. An app may be able to execute arbitrary code with kernel privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: http://seclists.org/fulldisclosure/2022/Dec/20; http://seclists.org/fulldisclosure/2022/Dec/23; http://seclists.org/fulldisclosure/2022/Dec/26
CVE: CVE-2022-46691
Published: 2022-12-15
Description: A memory consumption issue was addressed with improved memory handling. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 15.7.2 and iPadOS 15.7.2, iOS 16.2 and iPadOS 16.2, watchOS 9.2. Processing maliciously crafted web content may lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: http://seclists.org/fulldisclosure/2022/Dec/20; http://seclists.org/fulldisclosure/2022/Dec/21; http://seclists.org/fulldisclosure/2022/Dec/23