deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-21962
Published: 2022-02-04
Description: A heap-based buffer overflow vulnerability exists in the OTA Update u-download functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.34. A series of specially-crafted MQTT payloads can lead to remote code execution. An attacker must perform a man-in-the-middle attack in order to trigger this vulnerability.
CVSS Score: 8.1 (HIGH)
CWE: CWE-122, CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1390; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1390
CVE: CVE-2021-21963
Published: 2022-02-04
Description: An information disclosure vulnerability exists in the Web Server functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.34. A specially-crafted man-in-the-middle attack can lead to a disclosure of sensitive information. An attacker can perform a man-in-the-middle attack to trigger this vulnerability.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-311, CWE-311
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1391; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1391
CVE: CVE-2021-21964
Published: 2022-02-04
Description: A denial of service vulnerability exists in the Modbus configuration functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.34. Specially-crafted network packets can lead to denial of service. An attacker can send a malicious packet to trigger this vulnerability.
CVSS Score: 7.4 (HIGH)
CWE: CWE-284, CWE-306
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1392; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1392
CVE: CVE-2021-21965
Published: 2022-02-04
Description: A denial of service vulnerability exists in the SeaMax remote configuration functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.34. Specially-crafted network packets can lead to denial of service. An attacker can send a malicious packet to trigger this vulnerability.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-284, CWE-287
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1392; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1392
CVE: CVE-2021-21968
Published: 2022-02-04
Description: A file write vulnerability exists in the OTA update task functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.34. A specially-crafted MQTT payload can lead to arbitrary file overwrite. An attacker can perform a man-in-the-middle attack to trigger this vulnerability.
CVSS Score: 8.3 (HIGH)
CWE: CWE-20
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1395; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1395
CVE: CVE-2021-21969
Published: 2022-02-04
Description: An out-of-bounds write vulnerability exists in the HandleSeaCloudMessage functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.34. The HandleIncomingSeaCloudMessage function uses at [4] the json_object_get_string to populate the p_payload global variable. The p_payload is only 0x100 bytes long, and the total MQTT message could be up to 0x201 bytes. Because the function json_object_get_string will fill str based on the length of the json’s value and not the actual str size, this would result in a possible out-of-bounds write.
CVSS Score: 8.1 (HIGH)
CWE: CWE-120, CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1396; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1396
CVE: CVE-2021-21970
Published: 2022-02-04
Description: An out-of-bounds write vulnerability exists in the HandleSeaCloudMessage functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.34. The HandleIncomingSeaCloudMessage function uses at [3] the json_object_get_string to populate the p_name global variable. The p_name is only 0x80 bytes long, and the total MQTT message could be up to 0x201 bytes. Because the function json_object_get_string will fill str based on the length of the json’s value and not the actual str size, this would result in a possible out-of-bounds write.
CVSS Score: 8.1 (HIGH)
CWE: CWE-120, CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1396; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1396
CVE: CVE-2021-21971
Published: 2022-02-04
Description: An out-of-bounds write vulnerability exists in the URL_decode functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.34. A specially-crafted MQTT payload can lead to an out-of-bounds write. An attacker can perform a man-in-the-middle attack to trigger this vulnerability.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1406; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1397; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1406
CVE: CVE-2021-22284
Published: 2022-02-04
Description: Incorrect Permission Assignment for Critical Resource vulnerability in OPC Server for AC 800M allows an attacker to execute arbitrary code in the node running the AC800M OPC Server.
CVSS Score: 8.4 (HIGH)
CWE: CWE-732, CWE-732
References: https://search.abb.com/library/Download.aspx?DocumentID=7PAA000908&LanguageCode=en&DocumentPartId=&Action=Launch; https://search.abb.com/library/Download.aspx?DocumentID=7PAA000908&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2021-22285
Published: 2022-02-04
Description: Improper Handling of Exceptional Conditions, Improper Check for Unusual or Exceptional Conditions vulnerability in the ABB SPIET800 and PNI800 module that allows an attacker to cause the denial of service or make the module unresponsive.
CVSS Score: 7.5 (HIGH)
CWE: CWE-754, CWE-755, CWE-754, CWE-755
References: https://search.abb.com/library/Download.aspx?DocumentID=7PAA001353&LanguageCode=en&DocumentPartId=&Action=Launch; https://search.abb.com/library/Download.aspx?DocumentID=7PAA001353&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2021-22286
Published: 2022-02-04
Description: Improper Input Validation vulnerability in the ABB SPIET800 and PNI800 module allows an attacker to cause the denial of service or make the module unresponsive.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-20
References: https://search.abb.com/library/Download.aspx?DocumentID=7PAA001353&LanguageCode=en&DocumentPartId=&Action=Launch; https://search.abb.com/library/Download.aspx?DocumentID=7PAA001353&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2021-22288
Published: 2022-02-04
Description: Improper Input Validation vulnerability in the ABB SPIET800 and PNI800 module allows an attacker to cause the denial of service or make the module unresponsive.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-20
References: https://search.abb.com/library/Download.aspx?DocumentID=7PAA001353&LanguageCode=en&DocumentPartId=&Action=Launch; https://search.abb.com/library/Download.aspx?DocumentID=7PAA001353&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2021-28503
Published: 2022-02-04
Description: The impact of this vulnerability is that Arista's EOS eAPI may skip re-evaluating user credentials when certificate based authentication is used, which allows remote attackers to access the device via eAPI.
CVSS Score: 7.4 (HIGH)
CWE: CWE-305, CWE-287
References: https://www.arista.com/en/support/advisories-notices/security-advisories/13605-security-advisory-0072; https://www.arista.com/en/support/advisories-notices/security-advisories/13605-security-advisory-0072
CVE: CVE-2021-29218
Published: 2022-02-04
Description: A local unquoted search path security vulnerability has been identified in HPE Agentless Management Service for Windows version(s): Prior to 1.44.0.0, 10.96.0.0. This vulnerability could be exploited locally by a user with high privileges to execute malware that may lead to a loss of confidentiality, integrity, and availability. HPE has provided software updates to resolve the vulnerability in HPE Agentless Management Service for Windows.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-428
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn04233en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn04233en_us
CVE: CVE-2021-29219
Published: 2022-02-04
Description: A potential local buffer overflow vulnerability has been identified in HPE FlexNetwork 5130 EL Switch Series version: Prior to 5130_EI_7.10.R3507P02. HPE has made the following software update to resolve the vulnerability in HPE FlexNetwork 5130 EL Switch Series version 5130_EL_7.10.R3507P02.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbnw04234en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbnw04234en_us
CVE: CVE-2021-32036
Published: 2022-02-04
Description: An authenticated user without any specific authorizations may be able to repeatedly invoke the features command where at a high volume may lead to resource depletion or generate high lock contention. This may result in denial of service and in rare cases could result in id field collisions. This issue affects MongoDB Server v5.0 versions prior to and including 5.0.3; MongoDB Server v4.4 versions prior to and including 4.4.9; MongoDB Server v4.2 versions prior to and including 4.2.16 and MongoDB Server v4.0 versions prior to and including 4.0.28
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-770, CWE-770
References: https://jira.mongodb.org/browse/SERVER-59294; https://jira.mongodb.org/browse/SERVER-59294
CVE: CVE-2021-32732
Published: 2022-02-04
Description: ### Impact It's possible to know if a user has or not an account in a wiki related to an email address, and which username(s) is actually tied to that email by forging a request to the Forgot username page. Note that since this page does not have a CSRF check it's quite easy to perform a lot of those requests. ### Patches This issue has been patched in XWiki 12.10.5 and 13.2RC1. Two different patches are provided: - a first one to fix the CSRF problem - a more complex one that now relies on sending an email for the Forgot username process. ### Workarounds It's possible to fix the problem without uprading by editing the ForgotUsername page in version below 13.x, to use the following code: https://github.com/xwiki/xwiki-platform/blob/69548c0320cbd772540cf4668743e69f879812cf/xwiki-platform-core/xwiki-platform-administration/xwiki-platform-administration-ui/src/main/resources/XWiki/ForgotUsername.xml#L39-L123 In version after 13.x it's also possible to edit manually the forgotusername.vm file, but it's really encouraged to upgrade the version here. ### References * https://jira.xwiki.org/browse/XWIKI-18384 * https://jira.xwiki.org/browse/XWIKI-18408 ### For more information If you have any questions or comments about this advisory: * Open an issue in [Jira XWiki](https://jira.xwiki.org) * Email us at [security ML](mailto:security@xwiki.org)
CVSS Score: 7.5 (HIGH)
CWE: CWE-352, CWE-352
References: https://github.com/xwiki/xwiki-platform/commit/69548c0320cbd772540cf4668743e69f879812cf; https://github.com/xwiki/xwiki-platform/commit/f0440dfcbba705e03f7565cd88893dde57ca3fa8; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-vh5c-jqfg-mhrh
CVE: CVE-2021-36151
Published: 2022-02-04
Description: In Apache Gobblin, the Hadoop token is written to a temp file that is visible to all local users on Unix-like systems. This affects versions <= 0.15.0. Users should update to version 0.16.0 which addresses this issue.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://lists.apache.org/thread/3cdkyxdd6xk05lsvr3l66dsnvhwyo1t0; https://lists.apache.org/thread/3cdkyxdd6xk05lsvr3l66dsnvhwyo1t0
CVE: CVE-2021-36152
Published: 2022-02-04
Description: Apache Gobblin trusts all certificates used for LDAP connections in Gobblin-as-a-Service. This affects versions <= 0.15.0. Users should update to version 0.16.0 which addresses this issue.
CVSS Score: 9.8 (CRITICAL)
References: https://lists.apache.org/thread/3bxf7rbf4zh95r78jtgth6gwhr5fyl2j; https://lists.apache.org/thread/3bxf7rbf4zh95r78jtgth6gwhr5fyl2j
CVE: CVE-2021-38130
Published: 2022-02-04
Description: A potential Information leakage vulnerability has been identified in versions of Micro Focus Voltage SecureMail Mail Relay prior to 7.3.0.1. The vulnerability could be exploited to create an information leakage attack.
CVSS Score: 6.5 (MEDIUM)
References: https://portal.microfocus.com/s/article/KM000003667; https://portal.microfocus.com/s/article/KM000003667
CVE: CVE-2021-38960
Published: 2022-02-04
Description: IBM OPENBMC OP920, OP930, and OP940 could allow an unauthenticated user to obtain sensitive information. IBM X-Force ID: 212047.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/212047; https://www.ibm.com/support/pages/node/6529322; https://exchange.xforce.ibmcloud.com/vulnerabilities/212047
CVE: CVE-2021-40401
Published: 2022-02-04
Description: A use-after-free vulnerability exists in the RS-274X aperture definition tokenization functionality of Gerbv 2.7.0 and dev (commit b5f1eacd) and Gerbv forked 2.7.1. A specially-crafted gerber file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability.
CVSS Score: 8.6 (HIGH)
CWE: CWE-252, CWE-252
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TUM5GIUZJ7AVHVCXDZW6ZVCAPV2ISN47/; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1415; https://www.debian.org/security/2022/dsa-5306
CVE: CVE-2021-40403
Published: 2022-02-04
Description: An information disclosure vulnerability exists in the pick-and-place rotation parsing functionality of Gerbv 2.7.0 and dev (commit b5f1eacd), and Gerbv forked 2.8.0. A specially-crafted pick-and-place file can exploit the missing initialization of a structure to leak memory contents. An attacker can provide a malicious file to trigger this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-456, CWE-909
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PTGBC37N2FV7NKOWFVCFMPAFYEPHSB7C/; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1417; https://www.debian.org/security/2022/dsa-5306
CVE: CVE-2021-40420
Published: 2022-02-04
Description: A use-after-free vulnerability exists in the JavaScript engine of Foxit Software’s PDF Reader, version 11.1.0.52543. A specially-crafted PDF document can trigger the reuse of previously freed memory, which can lead to arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially-crafted, malicious site if the browser plugin extension is enabled.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1429; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1429
CVE: CVE-2021-43841
Published: 2022-02-04
Description: XWiki is a generic wiki platform offering runtime services for applications built on top of it. When using default XWiki configuration, it's possible for an attacker to upload an SVG containing a script executed when executing the download action on the file. This problem has been patched so that the default configuration doesn't allow to display the SVG files in the browser. Users are advised to update or to disallow uploads of SVG files.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/xwiki/xwiki-platform/commit/5853d492b3a274db0d94d560e2a5ea988a271c62; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-9jq9-c2cv-pcrj; https://jira.xwiki.org/browse/XWIKI-18368
CVE: CVE-2021-44204
Published: 2022-02-04
Description: Local privilege escalation via named pipe due to improper access control checks. The following products are affected: Acronis Cyber Protect 15 (Windows) before build 28035, Acronis Agent (Windows) before build 27147, Acronis Cyber Protect Home Office (Windows) before build 39612, Acronis True Image 2021 (Windows) before build 39287
CVSS Score: 7.8 (HIGH)
CWE: CWE-285
References: https://security-advisory.acronis.com/advisories/SEC-2355; https://security-advisory.acronis.com/advisories/SEC-2355
CVE: CVE-2021-44205
Published: 2022-02-04
Description: Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 39612, Acronis True Image 2021 (Windows) before build 39287
CVSS Score: 7.3 (HIGH)
CWE: CWE-427, CWE-427
References: https://security-advisory.acronis.com/advisories/SEC-3059; https://security-advisory.acronis.com/advisories/SEC-3059
CVE: CVE-2021-44206
Published: 2022-02-04
Description: Local privilege escalation due to DLL hijacking vulnerability in Acronis Media Builder service. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 39612, Acronis True Image 2021 (Windows) before build 39287
CVSS Score: 7.3 (HIGH)
CWE: CWE-427, CWE-427
References: https://security-advisory.acronis.com/advisories/SEC-3058; https://security-advisory.acronis.com/advisories/SEC-3058
CVE: CVE-2021-44779
Published: 2022-02-04
Description: Unauthenticated SQL Injection (SQLi) vulnerability discovered in [GWA] AutoResponder WordPress plugin (versions <= 2.3), vulnerable at (&listid). No patched version available, plugin closed.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89, CWE-89
References: https://patchstack.com/database/vulnerability/gwa-autoresponder/wordpress-gwa-autoresponder-plugin-2-3-unauthenticated-sql-injection-sqli-vulnerability; https://wordpress.org/plugins/gwa-autoresponder/; https://patchstack.com/database/vulnerability/gwa-autoresponder/wordpress-gwa-autoresponder-plugin-2-3-unauthenticated-sql-injection-sqli-vulnerability
CVE: CVE-2021-4043
Published: 2022-02-04
Description: NULL Pointer Dereference in GitHub repository gpac/gpac prior to 1.1.0.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/gpac/gpac/commit/64a2e1b799352ac7d7aad1989bc06e7b0f2b01db; https://huntr.dev/bounties/d7a534cb-df7a-48ba-8ce3-46b1551a9c47; https://www.debian.org/security/2023/dsa-5411
CVE: CVE-2021-4154
Published: 2022-02-04
Description: A use-after-free flaw was found in cgroup1_parse_param in kernel/cgroup/cgroup-v1.c in the Linux kernel's cgroup v1 parser. A local attacker with a user privilege could cause a privilege escalation by exploiting the fsconfig syscall parameter leading to a container breakout and a denial of service on the system.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://bugzilla.redhat.com/show_bug.cgi?id=2034514; https://cloud.google.com/anthos/clusters/docs/security-bulletins#gcp-2022-002; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3b0462726e7ef281c35a7a4ae33e93ee2bc9975b
CVE: CVE-2022-0218
Published: 2022-02-04
Description: The WP HTML Mail WordPress plugin is vulnerable to unauthorized access which allows unauthenticated attackers to retrieve and modify theme settings due to a missing capability check on the /themesettings REST-API endpoint found in the ~/includes/class-template-designer.php file, in versions up to and including 3.0.9. This makes it possible for attackers with no privileges to execute the endpoint and add malicious JavaScript to a vulnerable WordPress site.
CVSS Score: 8.3 (HIGH)
CWE: CWE-79, CWE-862, CWE-79
References: https://plugins.trac.wordpress.org/changeset/2656984/wp-html-mail/trunk/includes/class-template-designer.php; https://www.wordfence.com/blog/2022/01/unauthenticated-xss-vulnerability-patched-in-html-email-template-designer-plugin/; https://plugins.trac.wordpress.org/changeset/2656984/wp-html-mail/trunk/includes/class-template-designer.php
CVE: CVE-2022-0227
Published: 2022-02-04
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. Reason: This CVE has been rejected as it was incorrectly assigned. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2022-0264
Published: 2022-02-04
Description: A vulnerability was found in the Linux kernel's eBPF verifier when handling internal data structures. Internal memory locations could be returned to userspace. A local attacker with the permissions to insert eBPF code to the kernel can use this to leak internal kernel memory details defeating some of the exploit mitigations in place for the kernel. This flaws affects kernel versions < v5.16-rc6
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-755, CWE-755
References: https://bugzilla.redhat.com/show_bug.cgi?id=2041547; https://bugzilla.redhat.com/show_bug.cgi?id=2041547
CVE: CVE-2022-0317
Published: 2022-02-04
Description: An improper input validation vulnerability in go-attestation before 0.3.3 allows local users to provide a maliciously-formed Quote over no/some PCRs, causing AKPublic.Verify to succeed despite the inconsistency. Subsequent use of the same set of PCR values in Eventlog.Verify lacks the authentication performed by quote verification, meaning a local attacker could couple this vulnerability with a maliciously-crafted TCG log in Eventlog.Verify to spoof events in the TCG log, hence defeating remotely-attested measured-boot. We recommend upgrading to Version 0.4.0 or above.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://github.com/google/go-attestation/security/advisories/GHSA-99cg-575x-774p; https://github.com/google/go-attestation/security/advisories/GHSA-99cg-575x-774p
CVE: CVE-2022-0365
Published: 2022-02-04
Description: The affected product is vulnerable to an authenticated OS command injection, which may allow an attacker to inject and execute arbitrary shell commands as the Admin (root) user.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-032-01; https://www.cisa.gov/uscert/ics/advisories/icsa-22-032-01
CVE: CVE-2022-0380
Published: 2022-02-04
Description: The Fotobook WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to insufficient escaping and the use of $_SERVER['PHP_SELF'] found in the ~/options-fotobook.php file which allows attackers to inject arbitrary web scripts onto the page, in versions up to and including 3.2.3.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/fotobook/tags/3.2.3/options-fotobook.php#L128; https://www.wordfence.com/vulnerability-advisories/#CVE-2022-03801; https://plugins.trac.wordpress.org/browser/fotobook/tags/3.2.3/options-fotobook.php#L128
CVE: CVE-2022-0381
Published: 2022-02-04
Description: The Embed Swagger WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to insufficient escaping/sanitization and validation via the url parameter found in the ~/swagger-iframe.php file which allows attackers to inject arbitrary web scripts onto the page, in versions up to and including 1.0.0.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://gist.github.com/Xib3rR4dAr/4b3ea7960914e23c3a875b973a5b37a3; https://plugins.trac.wordpress.org/browser/embed-swagger/trunk/swagger-iframe.php#L59; https://www.wordfence.com/vulnerability-advisories/#CVE-2022-0381
CVE: CVE-2022-0472
Published: 2022-02-04
Description: Unrestricted Upload of File with Dangerous Type in Packagist jsdecena/laracom prior to v2.0.9.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-434, CWE-79, CWE-434
References: https://github.com/jsdecena/laracom/commit/256026193ce994dc4c1365e02f414d8a0cd77ae8; https://huntr.dev/bounties/cb5b8563-15cf-408c-9f79-4871ea0a8713; https://github.com/jsdecena/laracom/commit/256026193ce994dc4c1365e02f414d8a0cd77ae8
CVE: CVE-2022-0481
Published: 2022-02-04
Description: NULL Pointer Dereference in Homebrew mruby prior to 3.2.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://github.com/mruby/mruby/commit/ae3c99767a27f5c6c584162e2adc6a5d0eb2c54e; https://huntr.dev/bounties/54725c8c-87f4-41b6-878c-01d8e0ee7027; https://github.com/mruby/mruby/commit/ae3c99767a27f5c6c584162e2adc6a5d0eb2c54e