deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-35677
Published: 2022-08-11
Description: Adobe FrameMaker versions 2019 Update 8 (and earlier) and 2020 Update 4 (and earlier) are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122
References: https://helpx.adobe.com/security/products/framemaker/apsb22-42.html; https://helpx.adobe.com/security/products/framemaker/apsb22-42.html
CVE: CVE-2022-35678
Published: 2022-08-11
Description: Adobe Acrobat Reader versions 22.001.20169 (and earlier), 20.005.30362 (and earlier) and 17.012.30249 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/acrobat/apsb22-39.html; https://helpx.adobe.com/security/products/acrobat/apsb22-39.html
CVE: CVE-2022-2779
Published: 2022-08-12
Description: A vulnerability classified as critical was found in SourceCodester Gas Agency Management System. Affected by this vulnerability is an unknown functionality of the file /gasmark/assets/myimages/oneWord.php. The manipulation of the argument shell leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-206173 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-434
References: https://github.com/Drun1baby/CVE_Pentest/blob/main/Gas%20Agency%20Management%20System%20CMS/images/oneWorld.png; https://vuldb.com/?id.206173; https://github.com/Drun1baby/CVE_Pentest/blob/main/Gas%20Agency%20Management%20System%20CMS/images/oneWorld.png
CVE: CVE-2022-38179
Published: 2022-08-12
Description: JetBrains Ktor before 2.1.0 was vulnerable to the Reflect File Download attack
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-184, CWE-697
References: https://github.com/ktorio/ktor/pull/3110; https://www.jetbrains.com/privacy-security/issues-fixed/; https://github.com/ktorio/ktor/pull/3110
CVE: CVE-2022-38180
Published: 2022-08-12
Description: In JetBrains Ktor before 2.1.0 the wrong authentication provider could be selected in some cases
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-287, CWE-287
References: https://github.com/ktorio/ktor/pull/3092; https://www.jetbrains.com/privacy-security/issues-fixed/; https://github.com/ktorio/ktor/pull/3092
CVE: CVE-2022-2390
Published: 2022-08-12
Description: Apps developed with Google Play Services SDK incorrectly had the mutability flag set to PendingIntents that were passed to the Notification service. As Google Play services SDK is so widely used, this bug affects many applications. For an application affected, this bug will let the attacker, gain the access to all non-exported providers and/or gain the access to other providers the victim has permissions. We recommend upgrading to version 18.0.2 of the Play Service SDK as well as rebuilding and redeploying apps.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-471
References: https://developers.google.com/android/guides/releases#may_03_2022; https://mvnrepository.com/artifact/com.google.android.gms/play-services-basement/18.0.2; https://developers.google.com/android/guides/releases#may_03_2022
CVE: CVE-2022-2503
Published: 2022-08-12
Description: Dm-verity is used for extending root-of-trust to root filesystems. LoadPin builds on this property to restrict module/firmware loads to just the trusted root filesystem. Device-mapper table reloads currently allow users with root privileges to switch out the target with an equivalent dm-linear target and bypass verification till reboot. This allows root to bypass LoadPin and can be used to load untrusted and unverified kernel modules and firmware, which implies arbitrary kernel execution and persistence for peripherals that do not verify firmware updates. We recommend upgrading past commit 4caae58406f8ceb741603eee460d79bacca9b1b5
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-302, CWE-287
References: https://github.com/google/security-research/security/advisories/GHSA-6vq3-w69p-w63m; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://github.com/google/security-research/security/advisories/GHSA-6vq3-w69p-w63m
CVE: CVE-2021-44720
Published: 2022-08-12
Description: In Ivanti Pulse Secure Pulse Connect Secure (PCS) before 9.1R12, the administrator password is stored in the HTML source code of the "Maintenance > Push Configuration > Targets > Target Name" targets.cgi screen. A read-only administrative user can escalate to a read-write administrative role.
CVSS Score: 7.2 (HIGH)
CWE: CWE-798
References: https://gist.github.com/JGarciaSec/2060ec1c8efc1d573a1ddb754c6b4f84; https://kb.pulsesecure.net/?atype=sa; https://gist.github.com/JGarciaSec/2060ec1c8efc1d573a1ddb754c6b4f84
CVE: CVE-2022-20253
Published: 2022-08-12
Description: In Bluetooth, there is a possible cleanup failure due to an uncaught exception. This could lead to remote denial of service in Bluetooth with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-224545125
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-755
References: https://source.android.com/security/bulletin/android-13; https://source.android.com/security/bulletin/android-13
CVE: CVE-2022-20254
Published: 2022-08-12
Description: In Wi-Fi, there is a permissions bypass. This could lead to local escalation of privilege from the guest user with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-223377547
CVSS Score: 8.8 (HIGH)
References: https://source.android.com/security/bulletin/android-13; https://source.android.com/security/bulletin/android-13
CVE: CVE-2022-20255
Published: 2022-08-12
Description: In SettingsProvider, there is a possible way to read or change the default ringtone due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-222687217
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-862
References: https://source.android.com/security/bulletin/android-13; https://source.android.com/security/bulletin/android-13
CVE: CVE-2022-20256
Published: 2022-08-12
Description: In the Audio HAL, there is a possible out of bounds write due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-222572821
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-362
References: https://source.android.com/security/bulletin/android-13; https://source.android.com/security/bulletin/android-13
CVE: CVE-2022-20257
Published: 2022-08-12
Description: In Bluetooth, there is a possible way to pair a display only device without PIN confirmation due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-222289114
CVSS Score: 3.3 (LOW)
References: https://source.android.com/security/bulletin/android-13; https://source.android.com/security/bulletin/android-13
CVE: CVE-2022-20258
Published: 2022-08-12
Description: In Bluetooth, there is a possible way to bypass compiler exploit mitigations due to a configuration error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-221893030
CVSS Score: 7.8 (HIGH)
References: https://source.android.com/security/bulletin/android-13; https://source.android.com/security/bulletin/android-13
CVE: CVE-2022-20259
Published: 2022-08-12
Description: In Telephony, there is a possible leak of ICCID and EID due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-221431393
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-862
References: https://source.android.com/security/bulletin/android-13; https://source.android.com/security/bulletin/android-13
CVE: CVE-2022-20260
Published: 2022-08-12
Description: In the Phone app, there is a possible crash loop due to resource exhaustion. This could lead to local persistent denial of service in the Phone app with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-220865698
CVSS Score: 5.5 (MEDIUM)
References: https://source.android.com/security/bulletin/android-13; https://source.android.com/security/bulletin/android-13
CVE: CVE-2022-20261
Published: 2022-08-12
Description: In LocationManager, there is a possible way to get location information due to a missing permission check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-219835125
CVSS Score: 2.3 (LOW)
CWE: CWE-862
References: https://source.android.com/security/bulletin/android-13; https://source.android.com/security/bulletin/android-13
CVE: CVE-2022-20262
Published: 2022-08-12
Description: In ActivityManager, there is a possible way to check another process's capabilities due to a missing permission check. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-218338453
CVSS Score: 3.3 (LOW)
CWE: CWE-862
References: https://source.android.com/security/bulletin/android-13; https://source.android.com/security/bulletin/android-13
CVE: CVE-2022-20263
Published: 2022-08-12
Description: In ActivityManager, there is a way to read process state for other users due to a missing permission check. This could lead to local information disclosure of app usage with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-217935264
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-862
References: https://source.android.com/security/bulletin/android-13; https://source.android.com/security/bulletin/android-13
CVE: CVE-2022-20265
Published: 2022-08-12
Description: In Settings, there is a possible way to bypass factory reset permissions due to a permissions bypass. This could lead to local escalation of privilege with physical access to the device with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-212804898
CVSS Score: 4.6 (MEDIUM)
References: https://source.android.com/security/bulletin/android-13; https://source.android.com/security/bulletin/android-13
CVE: CVE-2022-20266
Published: 2022-08-12
Description: In Companion, there is a possible way to keep a service running with elevated importance without showing foreground service notification due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-211757348
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: https://source.android.com/security/bulletin/android-13; https://source.android.com/security/bulletin/android-13
CVE: CVE-2022-20267
Published: 2022-08-12
Description: In bluetooth, there is a possible way to enable or disable bluetooth connection without user consent due to a missing permission check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-211646835
CVSS Score: 3.3 (LOW)
CWE: CWE-862
References: https://source.android.com/security/bulletin/android-13; https://source.android.com/security/bulletin/android-13
CVE: CVE-2022-20268
Published: 2022-08-12
Description: In RestrictionsManager, there is a possible way to send a broadcast that should be restricted to system apps due to a permissions bypass. This could lead to local escalation of privilege on an enterprise managed device with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-210468836
CVSS Score: 7.8 (HIGH)
References: https://source.android.com/security/bulletin/android-13; https://source.android.com/security/bulletin/android-13
CVE: CVE-2022-20269
Published: 2022-08-12
Description: In Bluetooth, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-209062898
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-787
References: https://source.android.com/security/bulletin/android-13; https://source.android.com/security/bulletin/android-13
CVE: CVE-2022-20270
Published: 2022-08-12
Description: In Content, there is a possible way to learn gmail account name on the device due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-209005023
CVSS Score: 5.5 (MEDIUM)
References: https://source.android.com/security/bulletin/android-13; https://source.android.com/security/bulletin/android-13
CVE: CVE-2022-20271
Published: 2022-08-12
Description: In PermissionController, there is a possible way to grant some permissions without user consent due to misleading or insufficient UI. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-207672635
CVSS Score: 7.8 (HIGH)
References: https://source.android.com/security/bulletin/android-13; https://source.android.com/security/bulletin/android-13
CVE: CVE-2022-20272
Published: 2022-08-12
Description: In PermissionController, there is a possible misunderstanding about the default SMS application's permission set due to misleading text. This could lead to local information disclosure with User privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-207672568
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-276
References: https://source.android.com/security/bulletin/android-13; https://source.android.com/security/bulletin/android-13
CVE: CVE-2022-20273
Published: 2022-08-12
Description: In Bluetooth, there is a possible out of bounds read due to a heap buffer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-206478022
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: https://source.android.com/security/bulletin/android-13; https://source.android.com/security/bulletin/android-13
CVE: CVE-2022-20274
Published: 2022-08-12
Description: In Keyguard, there is a missing permission check. This could lead to local escalation of privilege and prevention of screen timeout with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-206470146
CVSS Score: 7.8 (HIGH)
CWE: CWE-862
References: https://source.android.com/security/bulletin/android-13; https://source.android.com/security/bulletin/android-13
CVE: CVE-2022-20275
Published: 2022-08-12
Description: In DevicePolicyManager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-205836975
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-203
References: https://source.android.com/security/bulletin/android-13; https://source.android.com/security/bulletin/android-13
CVE: CVE-2022-20276
Published: 2022-08-12
Description: In DevicePolicyManager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-205706731
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-203
References: https://source.android.com/security/bulletin/android-13; https://source.android.com/security/bulletin/android-13
CVE: CVE-2022-20277
Published: 2022-08-12
Description: In DevicePolicyManager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-205145497
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-203
References: https://source.android.com/security/bulletin/android-13; https://source.android.com/security/bulletin/android-13
CVE: CVE-2022-20278
Published: 2022-08-12
Description: In Accounts, there is a possible way to write sensitive information to the system log due to insufficient log filtering. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-205130113
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-532
References: https://source.android.com/security/bulletin/android-13; https://source.android.com/security/bulletin/android-13
CVE: CVE-2022-20279
Published: 2022-08-12
Description: In DevicePolicyManager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-204877302
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-203
References: https://source.android.com/security/bulletin/android-13; https://source.android.com/security/bulletin/android-13
CVE: CVE-2022-20280
Published: 2022-08-12
Description: In MMSProvider, there is a possible read of protected data due to improper input validationSQL injection. This could lead to local information disclosure of sms/mms data with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-204117261
CVSS Score: 3.3 (LOW)
CWE: CWE-89
References: https://source.android.com/security/bulletin/android-13; https://source.android.com/security/bulletin/android-13
CVE: CVE-2022-20281
Published: 2022-08-12
Description: In Core, there is a possible way to start an activity from the background due to a missing permission check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-204083967
CVSS Score: 7.8 (HIGH)
CWE: CWE-862
References: https://source.android.com/security/bulletin/android-13; https://source.android.com/security/bulletin/android-13
CVE: CVE-2022-20282
Published: 2022-08-12
Description: In AppWidget, there is a possible way to start an activity from the background due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-204083104
CVSS Score: 7.8 (HIGH)
CWE: CWE-862
References: https://source.android.com/security/bulletin/android-13; https://source.android.com/security/bulletin/android-13
CVE: CVE-2022-20283
Published: 2022-08-12
Description: In Bluetooth, there is a possible out of bounds write due to an integer overflow. This could lead to remote code execution over Bluetooth with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-233069336
CVSS Score: 8.8 (HIGH)
CWE: CWE-190
References: https://source.android.com/security/bulletin/android-13; https://source.android.com/security/bulletin/android-13
CVE: CVE-2022-20284
Published: 2022-08-12
Description: In Telephony, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure of phone accounts with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-231986341
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-862
References: https://source.android.com/security/bulletin/android-13; https://source.android.com/security/bulletin/android-13
CVE: CVE-2022-20285
Published: 2022-08-12
Description: In PackageManager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-230868108
CVSS Score: 5.5 (MEDIUM)
References: https://source.android.com/security/bulletin/android-13; https://source.android.com/security/bulletin/android-13
CVE: CVE-2022-20286
Published: 2022-08-12
Description: In Connectivity, there is a possible bypass the restriction of starting activity from background due to a logic error in the code. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-230866011
CVSS Score: 7.8 (HIGH)
References: https://source.android.com/security/bulletin/android-13; https://source.android.com/security/bulletin/android-13
CVE: CVE-2022-20287
Published: 2022-08-12
Description: In AppSearchManagerService, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-204082784
CVSS Score: 5.5 (MEDIUM)
References: https://source.android.com/security/bulletin/android-13; https://source.android.com/security/bulletin/android-13
CVE: CVE-2022-20288
Published: 2022-08-12
Description: In AppSearchManagerService, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-204082360
CVSS Score: 5.5 (MEDIUM)
References: https://source.android.com/security/bulletin/android-13; https://source.android.com/security/bulletin/android-13
CVE: CVE-2022-20289
Published: 2022-08-12
Description: In PackageInstaller, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-203683960
CVSS Score: 5.5 (MEDIUM)
References: https://source.android.com/security/bulletin/android-13; https://source.android.com/security/bulletin/android-13