deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-43400
Published: 2022-10-21
Description: A vulnerability has been identified in Siveillance Video Mobile Server V2022 R2 (All versions < V22.2a (80)). The mobile server component of affected applications improperly handles the log in for Active Directory accounts that are part of Administrators group. This could allow an unauthenticated remote attacker to access the application without a valid account.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1390, CWE-287
References: https://cert-portal.siemens.com/productcert/pdf/ssa-640732.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-640732.pdf
CVE: CVE-2022-3640
Published: 2022-10-21
Description: A vulnerability, which was classified as critical, was found in Linux Kernel. Affected is the function l2cap_conn_del of the file net/bluetooth/l2cap_core.c of the component Bluetooth. The manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-211944.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119, CWE-416
References: https://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next.git/commit/?id=42cf46dea905a80f6de218e837ba4d4cc33d6979; https://lists.debian.org/debian-lts-announce/2022/12/msg00031.html; https://lists.debian.org/debian-lts-announce/2022/12/msg00034.html
CVE: CVE-2022-1059
Published: 2022-10-21
Description: Aethon TUG Home Base Server versions prior to version 24 are affected by un unauthenticated attacker who can freely access hashed user credentials.
CVSS Score: 8.2 (HIGH)
CWE: CWE-79, CWE-79
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-102-05; https://www.cisa.gov/uscert/ics/advisories/icsa-22-102-05
CVE: CVE-2022-1066
Published: 2022-10-21
Description: Aethon TUG Home Base Server versions prior to version 24 are affected by un unauthenticated attacker who can freely access hashed user credentials.
CVSS Score: 8.2 (HIGH)
CWE: CWE-862, CWE-284
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-102-05; https://www.cisa.gov/uscert/ics/advisories/icsa-22-102-05
CVE: CVE-2022-1070
Published: 2022-10-21
Description: Aethon TUG Home Base Server versions prior to version 24 are affected by un unauthenticated attacker who can freely access hashed user credentials.
CVSS Score: 8.2 (HIGH)
CWE: CWE-862, CWE-200, CWE-306
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-102-05; https://www.cisa.gov/uscert/ics/advisories/icsa-22-102-05
CVE: CVE-2022-26423
Published: 2022-10-21
Description: Aethon TUG Home Base Server versions prior to version 24 are affected by un unauthenticated attacker who can freely access hashed user credentials.
CVSS Score: 8.2 (HIGH)
CWE: CWE-862, CWE-200, CWE-284
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-102-05; https://www.cisa.gov/uscert/ics/advisories/icsa-22-102-05
CVE: CVE-2022-27494
Published: 2022-10-21
Description: Aethon TUG Home Base Server versions prior to version 24 are affected by un unauthenticated attacker who can freely access hashed user credentials.
CVSS Score: 8.2 (HIGH)
CWE: CWE-79, CWE-79
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-102-05; https://www.cisa.gov/uscert/ics/advisories/icsa-22-102-05
CVE: CVE-2022-38104
Published: 2022-10-21
Description: Auth. WordPress Options Change (siteurl, users_can_register, default_role, admin_email and new_admin_email) vulnerability in Biplob Adhikari's Accordions – Multiple Accordions or FAQs Builder plugin (versions <= 2.0.3 on WordPress.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: https://patchstack.com/database/vulnerability/accordions-or-faqs/wordpress-accordions-plugin-2-0-3-authenticated-wordpress-options-change-vulnerability?_s_id=cve; https://wordpress.org/plugins/accordions-or-faqs/#developers; https://patchstack.com/database/vulnerability/accordions-or-faqs/wordpress-accordions-plugin-2-0-3-authenticated-wordpress-options-change-vulnerability?_s_id=cve
CVE: CVE-2022-3570
Published: 2022-10-21
Description: Multiple heap buffer overflows in tiffcrop.c utility in libtiff library Version 4.4.0 allows attacker to trigger unsafe or out of bounds memory access via crafted TIFF image file which could result into application crash, potential information disclosure or any other context-dependent impact
CVSS Score: 7.7 (HIGH)
CWE: CWE-787, CWE-787
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3570.json; https://gitlab.com/libtiff/libtiff/-/commit/bd94a9b383d8755a27b5a1bc27660b8ad10b094c; https://gitlab.com/libtiff/libtiff/-/issues/381
CVE: CVE-2022-3597
Published: 2022-10-21
Description: LibTIFF 4.4.0 has an out-of-bounds write in _TIFFmemcpy in libtiff/tif_unix.c:346 when called from extractImageSection, tools/tiffcrop.c:6826, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 236b7191.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3597.json; https://gitlab.com/libtiff/libtiff/-/commit/236b7191f04c60d09ee836ae13b50f812c841047; https://gitlab.com/libtiff/libtiff/-/issues/413
CVE: CVE-2022-3598
Published: 2022-10-21
Description: LibTIFF 4.4.0 has an out-of-bounds write in extractContigSamplesShifted24bits in tools/tiffcrop.c:3604, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit cfbb883b.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3598.json; https://gitlab.com/libtiff/libtiff/-/commit/cfbb883bf6ea7bedcb04177cc4e52d304522fdff; https://gitlab.com/libtiff/libtiff/-/issues/435
CVE: CVE-2022-3599
Published: 2022-10-21
Description: LibTIFF 4.4.0 has an out-of-bounds read in writeSingleSection in tools/tiffcrop.c:7345, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit e8131125.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3599.json; https://gitlab.com/libtiff/libtiff/-/commit/e[PII_REDACTED][PII_REDACTED]3d61afd16ac094ff246; https://gitlab.com/libtiff/libtiff/-/issues/398
CVE: CVE-2022-3626
Published: 2022-10-21
Description: LibTIFF 4.4.0 has an out-of-bounds write in _TIFFmemset in libtiff/tif_unix.c:340 when called from processCropSelections, tools/tiffcrop.c:7619, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 236b7191.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3626.json; https://gitlab.com/libtiff/libtiff/-/commit/236b7191f04c60d09ee836ae13b50f812c841047; https://gitlab.com/libtiff/libtiff/-/issues/426
CVE: CVE-2022-3627
Published: 2022-10-21
Description: LibTIFF 4.4.0 has an out-of-bounds write in _TIFFmemcpy in libtiff/tif_unix.c:346 when called from extractImageSection, tools/tiffcrop.c:6860, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 236b7191.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3627.json; https://gitlab.com/libtiff/libtiff/-/commit/236b7191f04c60d09ee836ae13b50f812c841047; https://gitlab.com/libtiff/libtiff/-/issues/411
CVE: CVE-2022-3639
Published: 2022-10-21
Description: A potential DOS vulnerability was discovered in GitLab CE/EE affecting all versions from 10.8 before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions starting from 15.3 before 15.3.2. Improper data handling on branch creation could have been used to trigger high CPU usage.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-400, CWE-400
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3639.json; https://gitlab.com/gitlab-org/gitlab/-/issues/366876; https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3639.json
CVE: CVE-2022-3642
Published: 2022-10-21
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2022-40311
Published: 2022-10-21
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) in Fatcat Apps Analytics Cat plugin <= 1.0.9 on WordPress.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/analytics-cat/wordpress-analytics-cat-plugin-1-0-9-authenticated-stored-cross-site-scripting-xss-vulnerability?_s_id=cve; https://wordpress.org/plugins/analytics-cat/#developers; https://patchstack.com/database/vulnerability/analytics-cat/wordpress-analytics-cat-plugin-1-0-9-authenticated-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2022-41309
Published: 2022-10-21
Description: A malicious crafted .dwf or .pct file when consumed through DesignReview.exe application could lead to memory corruption vulnerability by write access violation. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0004; https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0004
CVE: CVE-2022-41310
Published: 2022-10-21
Description: A malicious crafted .dwf or .pct file when consumed through DesignReview.exe application could lead to memory corruption vulnerability by write access violation. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0004; https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0004
CVE: CVE-2022-41638
Published: 2022-10-21
Description: Auth. Stored Cross-Site Scripting (XSS) in Pop-Up Chop Chop plugin <= 2.1.7 on WordPress.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/pop-up/wordpress-pop-up-chop-chop-plugin-2-1-7-authenticated-stored-cross-site-scripting-xss-vulnerability?_s_id=cve; https://wordpress.org/plugins/pop-up/; https://patchstack.com/database/vulnerability/pop-up/wordpress-pop-up-chop-chop-plugin-2-1-7-authenticated-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2022-42933
Published: 2022-10-21
Description: A malicious crafted .dwf or .pct file when consumed through DesignReview.exe application could lead to memory corruption vulnerability by write access violation. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0004; https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0004
CVE: CVE-2022-42934
Published: 2022-10-21
Description: A malicious crafted .dwf or .pct file when consumed through DesignReview.exe application could lead to memory corruption vulnerability by write access violation. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0004; https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0004
CVE: CVE-2022-42935
Published: 2022-10-21
Description: A malicious crafted .dwf or .pct file when consumed through DesignReview.exe application could lead to memory corruption vulnerability by write access violation. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0004; https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0004
CVE: CVE-2022-42936
Published: 2022-10-21
Description: A malicious crafted .dwf or .pct file when consumed through DesignReview.exe application could lead to memory corruption vulnerability by write access violation. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0004; https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0004
CVE: CVE-2022-42937
Published: 2022-10-21
Description: A malicious crafted .dwf or .pct file when consumed through DesignReview.exe application could lead to memory corruption vulnerability by write access violation. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0004; https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0004
CVE: CVE-2022-42938
Published: 2022-10-21
Description: A malicious crafted TGA file when consumed through DesignReview.exe application could lead to memory corruption vulnerability. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0004; https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0004
CVE: CVE-2022-42939
Published: 2022-10-21
Description: A malicious crafted TGA file when consumed through DesignReview.exe application could lead to memory corruption vulnerability. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0004; https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0004
CVE: CVE-2022-42940
Published: 2022-10-21
Description: A malicious crafted TGA file when consumed through DesignReview.exe application could lead to memory corruption vulnerability. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0004; https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0004
CVE: CVE-2022-42941
Published: 2022-10-21
Description: A malicious crafted dwf or .pct file when consumed through DesignReview.exe application could lead to memory corruption vulnerability by read access violation. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0004; https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0004
CVE: CVE-2022-42942
Published: 2022-10-21
Description: A malicious crafted dwf or .pct file when consumed through DesignReview.exe application could lead to memory corruption vulnerability by read access violation. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0004; https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0004
CVE: CVE-2022-42943
Published: 2022-10-21
Description: A malicious crafted dwf or .pct file when consumed through DesignReview.exe application could lead to memory corruption vulnerability by read access violation. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0004; https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0004
CVE: CVE-2022-42944
Published: 2022-10-21
Description: A malicious crafted dwf or .pct file when consumed through DesignReview.exe application could lead to memory corruption vulnerability by read access violation. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0004; https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0004
CVE: CVE-2020-5355
Published: 2022-10-21
Description: The Dell Isilon OneFS versions 8.2.2 and earlier SSHD process improperly allows Transmission Control Protocol (TCP) and stream forwarding. This provides the remotesupport user and users with restricted shells more access than is intended.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-276, CWE-276
References: https://support.emc.com/kb/543561; https://support.emc.com/kb/543561
CVE: CVE-2022-26870
Published: 2022-10-21
Description: Dell PowerStore versions 2.1.0.x contain an Authentication bypass vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability under specific configuration. An attacker would gain unauthorized access upon successful exploit.
CVSS Score: 7.0 (HIGH)
CWE: CWE-288, CWE-287
References: https://www.dell.com/support/kbdoc/000196367; https://www.dell.com/support/kbdoc/000196367
CVE: CVE-2022-31239
Published: 2022-10-21
Description: Dell PowerScale OneFS, versions 9.0.0 up to and including 9.1.0.19, 9.2.1.12, and 9.3.0.6, contain sensitive data in log files vulnerability. A privileged local user may potentially exploit this vulnerability, leading to disclosure of this sensitive data.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-532, CWE-532
References: https://www.dell.com/support/kbdoc/en-us/000201094/dsa-2022-149-dell-emc-powerscale-onefs-security-update?lang=en; https://www.dell.com/support/kbdoc/en-us/000201094/dsa-2022-149-dell-emc-powerscale-onefs-security-update?lang=en
CVE: CVE-2022-34437
Published: 2022-10-21
Description: Dell PowerScale OneFS, versions 8.2.2-9.3.0, contain an OS command injection vulnerability. A privileged local malicious user could potentially exploit this vulnerability, leading to a full system compromise. This impacts compliance mode clusters.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-78, CWE-78
References: https://www.dell.com/support/kbdoc/en-us/000204053/dsa-2022-245-dell-emc-powerscale-onefs-security-update-for-multiple-security-updates; https://www.dell.com/support/kbdoc/en-us/000204053/dsa-2022-245-dell-emc-powerscale-onefs-security-update-for-multiple-security-updates
CVE: CVE-2022-34438
Published: 2022-10-21
Description: Dell PowerScale OneFS, versions 8.2.x-9.4.0.x, contain a privilege context switching error. A local authenticated malicious user with high privileges could potentially exploit this vulnerability, leading to full system compromise. This impacts compliance mode clusters.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-269, CWE-269
References: https://www.dell.com/support/kbdoc/en-us/000204053/dsa-2022-245-dell-emc-powerscale-onefs-security-update-for-multiple-security-updates; https://www.dell.com/support/kbdoc/en-us/000204053/dsa-2022-245-dell-emc-powerscale-onefs-security-update-for-multiple-security-updates
CVE: CVE-2022-34439
Published: 2022-10-21
Description: Dell PowerScale OneFS, versions 8.2.0.x-9.4.0.x contain allocation of Resources Without Limits or Throttling vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to denial of service and performance issue on that node.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-770, CWE-770
References: https://www.dell.com/support/kbdoc/en-us/000204053/dsa-2022-245-dell-emc-powerscale-onefs-security-update-for-multiple-security-updates; https://www.dell.com/support/kbdoc/en-us/000204053/dsa-2022-245-dell-emc-powerscale-onefs-security-update-for-multiple-security-updates
CVE: CVE-2022-3646
Published: 2022-10-21
Description: A vulnerability, which was classified as problematic, has been found in Linux Kernel. This issue affects the function nilfs_attach_log_writer of the file fs/nilfs2/segment.c of the component BPF. The manipulation leads to memory leak. The attack may be initiated remotely. It is recommended to apply a patch to fix this issue. The identifier VDB-211961 was assigned to this vulnerability.
CVSS Score: 3.1 (LOW)
CWE: CWE-404, CWE-401
References: https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git/commit/?id=d0d51a97063db4704a5ef6bc978dddab1636a306; https://lists.debian.org/debian-lts-announce/2022/11/msg00001.html; https://lists.debian.org/debian-lts-announce/2022/12/msg00034.html
CVE: CVE-2022-3647
Published: 2022-10-21
Description: ** DISPUTED ** A vulnerability, which was classified as problematic, was found in Redis up to 6.2.7/7.0.5. Affected is the function sigsegvHandler of the file debug.c of the component Crash Report. The manipulation leads to denial of service. The complexity of an attack is rather high. The exploitability is told to be difficult. The real existence of this vulnerability is still doubted at the moment. Upgrading to version 6.2.8 and 7.0.6 is able to address this issue. The patch is identified as 0bf90d944313919eb8e63d3588bf63a367f020a3. It is recommended to apply a patch to fix this issue. VDB-211962 is the identifier assigned to this vulnerability. NOTE: The vendor claims that this is not a DoS because it applies to the crash logging mechanism which is triggered after a crash has occurred.
CVSS Score: 3.1 (LOW)
CWE: CWE-404
References: https://github.com/redis/redis/commit/0bf90d944313919eb8e63d3588bf63a367f020a3; https://vuldb.com/?ctiid.211962; https://vuldb.com/?id.211962
CVE: CVE-2022-3649
Published: 2022-10-21
Description: A vulnerability was found in Linux Kernel. It has been classified as problematic. Affected is the function nilfs_new_inode of the file fs/nilfs2/inode.c of the component BPF. The manipulation leads to use after free. It is possible to launch the attack remotely. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-211992.
CVSS Score: 3.1 (LOW)
CWE: CWE-119, CWE-416
References: https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git/commit/?id=d325dc6eb763c10f591c239550b8c7e5466a5d09; https://lists.debian.org/debian-lts-announce/2022/11/msg00001.html; https://lists.debian.org/debian-lts-announce/2022/12/msg00034.html
CVE: CVE-2022-23462
Published: 2022-10-21
Description: IOWOW is a C utility library and persistent key/value storage engine. Versions 1.4.15 and prior contain a stack buffer overflow vulnerability that allows for Denial of Service (DOS) when it parses scientific notation numbers present in JSON. A patch for this issue is available at commit a79d31e4cff1d5a08f665574b29fd885897a28fd in the `master` branch of the repository. There are no workarounds other than applying the patch.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-120, CWE-121, CWE-787
References: https://github.com/Softmotions/iowow/commit/a79d31e4cff1d5a08f665574b29fd885897a28fd; https://securitylab.github.com/advisories/GHSL-2022-066_iowow/; https://github.com/Softmotions/iowow/commit/a79d31e4cff1d5a08f665574b29fd885897a28fd
CVE: CVE-2022-39259
Published: 2022-10-21
Description: jadx is a set of command line and GUI tools for producing Java source code from Android Dex and Apk files. versions prior to 1.4.5 are subject to a Denial of Service when opening zip files with HTML sequences. This issue has been patched in version 1.4.5. There are no known workarounds.
CVSS Score: 3.3 (LOW)
CWE: CWE-20
References: https://github.com/skylot/jadx/security/advisories/GHSA-3r7j-8mqh-6qhx; https://github.com/skylot/jadx/security/advisories/GHSA-3r7j-8mqh-6qhx