deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-41950
Published: 2022-11-22
Description: super-xray is the GUI alternative for vulnerability scanning tool xray. In 0.2-beta, a privilege escalation vulnerability was discovered. This caused inaccurate default xray permissions. Note: this vulnerability only affects Linux and Mac OS systems. Users should upgrade to super-xray 0.3-beta.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-250
References: https://github.com/4ra1n/super-xray/releases/tag/0.3-beta; https://github.com/4ra1n/super-xray/security/advisories/GHSA-2g28-xrw6-fq5f; https://github.com/4ra1n/super-xray/releases/tag/0.3-beta
CVE: CVE-2022-43212
Published: 2022-11-22
Description: Billing System Project v1.0 was discovered to contain a SQL injection vulnerability via the orderId parameter at fetchOrderData.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/Qrayyy/CVE/blob/main/Billing%20System%20Project%20v1.0/CVE-2022-43212%28sql%20in%20fetchOrderData.php%29.md; https://www.sourcecodester.com/php/14831/billing-system-project-php-source-code-free-download.html; https://github.com/Qrayyy/CVE/blob/main/Billing%20System%20Project%20v1.0/CVE-2022-43212%28sql%20in%20fetchOrderData.php%29.md
CVE: CVE-2022-3500
Published: 2022-11-22
Description: A vulnerability was found in keylime. This security issue happens in some circumstances, due to some improperly handled exceptions, there exists the possibility that a rogue agent could create errors on the verifier that stopped attestation attempts for that host leaving it in an attested state but not verifying that anymore.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-248
References: https://access.redhat.com/security/cve/CVE-2022-3500; https://github.com/keylime/keylime/pull/1128; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PUTHMDVFNGGVPCNPOGULMJAAFEP7MEXP/
CVE: CVE-2022-40228
Published: 2022-11-22
Description: 


IBM DataPower Gateway 10.0.3.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.9, 2018.4.1.0 through 2018.4.1.22, and 10.5.0.0 through 10.5.0.2 does not invalidate session after a password change which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 235527.


CVSS Score: 3.7 (LOW)
CWE: CWE-613, CWE-613
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/235527; https://www.ibm.com/support/pages/node/6840759; https://exchange.xforce.ibmcloud.com/vulnerabilities/235527
CVE: CVE-2022-41942
Published: 2022-11-22
Description: Sourcegraph is a code intelligence platform. In versions prior to 4.1.0 a command Injection vulnerability existed in the gitserver service, present in all Sourcegraph deployments. This vulnerability was caused by a lack of input validation on the host parameter of the `/list-gitolite` endpoint. It was possible to send a crafted request to gitserver that would execute commands inside the container. Successful exploitation requires the ability to send local requests to gitserver. The issue is patched in version 4.1.0.
CVSS Score: 7.9 (HIGH)
CWE: CWE-20, CWE-78
References: https://github.com/sourcegraph/sourcegraph/pull/42553; https://github.com/sourcegraph/sourcegraph/security/advisories/GHSA-pfm3-23mh-6xjp; https://github.com/sourcegraph/sourcegraph/pull/42553
CVE: CVE-2022-41943
Published: 2022-11-22
Description: sourcegraph is a code intelligence platform. As a site admin it was possible to execute arbitrary commands on Gitserver when the experimental `customGitFetch` feature was enabled. This experimental feature has now been disabled by default. This issue has been patched in version 4.1.0.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-276
References: https://github.com/sourcegraph/sourcegraph/pull/42704; https://github.com/sourcegraph/sourcegraph/security/advisories/GHSA-4qhq-4x4h-fxm8; https://github.com/sourcegraph/sourcegraph/pull/42704
CVE: CVE-2022-4116
Published: 2022-11-22
Description: A vulnerability was found in quarkus. This security flaw happens in Dev UI Config Editor which is vulnerable to drive-by localhost attacks leading to remote code execution.
CVSS Score: 9.8 (CRITICAL)
References: https://access.redhat.com/security/cve/CVE-2022-4116; https://access.redhat.com/security/cve/CVE-2022-4116
CVE: CVE-2022-2791
Published: 2022-11-22
Description: Emerson Electric's Proficy Machine Edition Version 9.00 and prior is vulnerable to CWE-434 Unrestricted Upload of File with Dangerous Type, and will upload any file written into the PLC logic folder to the connected PLC.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-434
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-228-06; https://www.cisa.gov/uscert/ics/advisories/icsa-22-228-06
CVE: CVE-2022-39199
Published: 2022-11-22
Description: immudb is a database with built-in cryptographic proof and verification. immudb client SDKs use server's UUID to distinguish between different server instance so that the client can connect to different immudb instances and keep the state for multiple servers. SDK does not validate this uuid and can accept any value reported by the server. A malicious server can change the reported UUID tricking the client to treat it as a different server thus accepting a state completely irrelevant to the one previously retrieved from the server. This issue has been patched in version 1.4.1. As a workaround, when initializing an immudb client object a custom state handler can be used to store the state. Providing custom implementation that ignores the server UUID can be used to ensure that even if the server changes the UUID, client will still consider it to be the same server.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-345
References: https://github.com/codenotary/immudb/releases/tag/v1.4.1; https://github.com/codenotary/immudb/security/advisories/GHSA-6cqj-6969-p57x; https://github.com/codenotary/immudb/releases/tag/v1.4.1
CVE: CVE-2022-41919
Published: 2022-11-22
Description: Fastify is a web framework with minimal overhead and plugin architecture. The attacker can use the incorrect `Content-Type` to bypass the `Pre-Flight` checking of `fetch`. `fetch()` requests with Content-Type’s essence as "application/x-www-form-urlencoded", "multipart/form-data", or "text/plain", could potentially be used to invoke routes that only accepts `application/json` content type, thus bypassing any CORS protection, and therefore they could lead to a Cross-Site Request Forgery attack. This issue has been patched in version 4.10.2 and 3.29.4. As a workaround, implement Cross-Site Request Forgery protection using `@fastify/csrf'.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-352
References: https://github.com/fastify/fastify/commit/62dde76f1f7aca76e38625fe8d983761f26e6fc9; https://github.com/fastify/fastify/security/advisories/GHSA-3fjj-p79j-c9hh; https://www.npmjs.com/package/%40fastify/csrf
CVE: CVE-2022-39397
Published: 2022-11-22
Description: aliyun-oss-client is a rust client for Alibaba Cloud OSS. Users of this library will be affected, the incoming secret will be disclosed unintentionally. This issue has been patched in version 0.8.1.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-200
References: https://github.com/tu6ge/oss-rs/commit/e4553f7d74fce682d802f8fb[PII_REDACTED]96df29; https://github.com/tu6ge/oss-rs/security/advisories/GHSA-3w3h-7xgx-grwc; https://github.com/tu6ge/oss-rs/commit/e4553f7d74fce682d802f8fb[PII_REDACTED]96df29
CVE: CVE-2022-45330
Published: 2022-11-22
Description: AeroCMS v0.0.1 was discovered to contain a SQL Injection vulnerability via the Category parameter at \category.php. This vulnerability allows attackers to access database information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/rdyx0/CVE/blob/master/AeroCMS/AeroCMS-v0.0.1-SQLi/category_sql_injection/category_sql_injection.md; https://rdyx0.github.io/2018/09/02/AeroCMS-v0.0.1-SQLi%20category_sql_injectin/; https://github.com/rdyx0/CVE/blob/master/AeroCMS/AeroCMS-v0.0.1-SQLi/category_sql_injection/category_sql_injection.md
CVE: CVE-2022-45331
Published: 2022-11-22
Description: AeroCMS v0.0.1 was discovered to contain a SQL Injection vulnerability via the p_id parameter at \post.php. This vulnerability allows attackers to access database information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/rdyx0/CVE/blob/master/AeroCMS/AeroCMS-v0.0.1-SQLi/post_sql_injection/post_sql_injection.md; https://rdyx0.github.io/2018/09/03/AeroCMS-v0.0.1-SQLi%20post_sql_injectin/; https://github.com/rdyx0/CVE/blob/master/AeroCMS/AeroCMS-v0.0.1-SQLi/post_sql_injection/post_sql_injection.md
CVE: CVE-2022-45529
Published: 2022-11-22
Description: AeroCMS v0.0.1 was discovered to contain a SQL Injection vulnerability via the post_category_id parameter at \admin\includes\edit_post.php. This vulnerability allows attackers to access database information.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://github.com/rdyx0/CVE/blob/master/AeroCMS/AeroCMS-v0.0.1-SQLi/edit_post_post_category_id_sql_injection/edit_post_post_category_id_sql_injection.md; https://rdyx0.github.io/2018/09/05/AeroCMS-v0.0.1-SQLi%20edit_post_post_category_id_sql_injectin/; https://github.com/rdyx0/CVE/blob/master/AeroCMS/AeroCMS-v0.0.1-SQLi/edit_post_post_category_id_sql_injection/edit_post_post_category_id_sql_injection.md
CVE: CVE-2022-45535
Published: 2022-11-22
Description: AeroCMS v0.0.1 was discovered to contain a SQL Injection vulnerability via the edit parameter at \admin\categories.php. This vulnerability allows attackers to access database information.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://github.com/rdyx0/CVE/blob/master/AeroCMS/AeroCMS-v0.0.1-SQLi/update_categories_sql_injection/update_categories_sql_injection.md; https://rdyx0.github.io/2018/09/06/AeroCMS-v0.0.1-SQLi%20update_categories_sql_injection/; https://github.com/rdyx0/CVE/blob/master/AeroCMS/AeroCMS-v0.0.1-SQLi/update_categories_sql_injection/update_categories_sql_injection.md
CVE: CVE-2022-45536
Published: 2022-11-22
Description: AeroCMS v0.0.1 was discovered to contain a SQL Injection vulnerability via the id parameter at \admin\post_comments.php. This vulnerability allows attackers to access database information.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://github.com/rdyx0/CVE/blob/master/AeroCMS/AeroCMS-v0.0.1-SQLi/post_comments_sql_injection/post_comments_sql_injection.md; https://rdyx0.github.io/2018/09/07/AeroCMS-v0.0.1-SQLi%20post_comments_sql_injection/; https://github.com/rdyx0/CVE/blob/master/AeroCMS/AeroCMS-v0.0.1-SQLi/post_comments_sql_injection/post_comments_sql_injection.md
CVE: CVE-2022-37773
Published: 2022-11-23
Description: An authenticated SQL Injection vulnerability in the statistics page (/statistics/retrieve) of Maarch RM 2.8, via the filter parameter, allows the complete disclosure of all databases.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89, CWE-89
References: http://maarch.com; https://github.com/frame84/vulns/blob/main/MaarchRM/CVE-2022-37773/README.md; http://maarch.com
CVE: CVE-2022-37774
Published: 2022-11-23
Description: There is a broken access control vulnerability in the Maarch RM 2.8.3 solution. When accessing some specific document (pdf, email) from an archive, a preview is proposed by the application. This preview generates a URL including an md5 hash of the file accessed. The document's URL (https://{url}/tmp/{MD5 hash of the document}) is then accessible without authentication.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-287, CWE-287
References: http://maarch.com; https://github.com/frame84/vulns/blob/main/MaarchRM/CVE-2022-37774/README.md; http://maarch.com
CVE: CVE-2022-38724
Published: 2022-11-23
Description: Silverstripe silverstripe/framework through 4.11.0, silverstripe/assets through 1.11.0, and silverstripe/asset-admin through 1.11.0 allow XSS.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://forum.silverstripe.org/c/releases; https://www.silverstripe.org/blog/tag/release; https://www.silverstripe.org/download/security-releases/
CVE: CVE-2022-40303
Published: 2022-11-23
Description: An issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with the XML_PARSE_HUGE parser option enabled, several integer counters can overflow. This results in an attempt to access an array at a negative 2GB offset, typically leading to a segmentation fault.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190, CWE-190
References: http://seclists.org/fulldisclosure/2022/Dec/21; http://seclists.org/fulldisclosure/2022/Dec/24; http://seclists.org/fulldisclosure/2022/Dec/25
CVE: CVE-2022-40870
Published: 2022-11-23
Description: The Web Client of Parallels Remote Application Server v18.0 is vulnerable to Host Header Injection attacks. This vulnerability allows attackers to execute arbitrary commands via a crafted payload injected into the Host header.
CVSS Score: 8.1 (HIGH)
CWE: CWE-116, CWE-116
References: https://github.com/IthacaLabs/Parallels/blob/main/ParallelsRemoteApplicationServer/HHI_CVE-2022-40870.txt; https://github.com/IthacaLabs/Parallels/tree/main/ParallelsRemoteApplicationServer; https://github.com/IthacaLabs/Parallels/blob/main/ParallelsRemoteApplicationServer/HHI_CVE-2022-40870.txt
CVE: CVE-2022-43751
Published: 2022-11-23
Description: McAfee Total Protection prior to version 16.0.49 contains an uncontrolled search path element vulnerability due to the use of a variable pointing to a subdirectory that may be controllable by an unprivileged user. This may have allowed the unprivileged user to execute arbitrary code with system privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427, CWE-427
References: https://mcafee.com; https://www.mcafee.com/support/?articleId=TS103348&page=shell&shell=article-view; https://mcafee.com
CVE: CVE-2020-23583
Published: 2022-11-23
Description: OPTILINK OP-XT71000N V2.2 is vulnerable to Remote Code Execution. The issue occurs when the attacker sends an arbitrary code on "/diag_ping_admin.asp" to "PingTest" interface that leads to COMMAND EXECUTION. An attacker can successfully trigger the COMMAND and can compromise full system.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-77
References: https://github.com/huzaifahussain98/CVE-2020-23583; https://github.com/huzaifahussain98/CVE-2020-23583
CVE: CVE-2020-23585
Published: 2022-11-23
Description: A remote attacker can conduct a cross-site request forgery (CSRF) attack on OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OP_V3.3.1-191028. The vulnerability is due to insufficient CSRF protections for the "mgm_config_file.asp" because of which attacker can create a crafted "csrf form" which sends " malicious xml data" to "/boaform/admin/formMgmConfigUpload". the exploit allows attacker to "gain full privileges" and to "fully compromise of router & network".
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://github.com/huzaifahussain98/CVE-2020-23585; https://github.com/huzaifahussain98/CVE-2020-23585
CVE: CVE-2020-23593
Published: 2022-11-23
Description: A vulnerability in OPTILINK OP-XT71000N Hardware Version: V2.2, Firmware Version: OP_V3.3.1-191028 allows an unauthenticated, remote attacker to conduct a cross site request forgery (CSRF) attack to enable syslog mode through ' /mgm_log_cfg.asp.' The system starts to log events, 'Remote' mode or 'Both' mode on "Syslog -- Configuration page" logs events and sends to remote syslog server IP and Port.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://github.com/huzaifahussain98/CVE-2020-23593; https://github.com/huzaifahussain98/CVE-2020-23593
CVE: CVE-2020-23584
Published: 2022-11-23
Description: Unauthenticated remote code execution in OPTILINK OP-XT71000N, Hardware Version: V2.2 occurs when the attacker passes arbitrary commands with IP-ADDRESS using " | " to execute commands on " /diag_tracert_admin.asp " in the "PingTest" parameter that leads to command execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-77
References: https://github.com/huzaifahussain98/CVE-2020-23584; https://github.com/huzaifahussain98/CVE-2020-23584
CVE: CVE-2020-23586
Published: 2022-11-23
Description: A vulnerability found in OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OP_V3.3.1-191028 allows an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack to Add Network Traffic Control Type Rule.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://github.com/huzaifahussain98/CVE-2020-23586; https://github.com/huzaifahussain98/CVE-2020-23586
CVE: CVE-2020-23587
Published: 2022-11-23
Description: A vulnerability found in the OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OP_V3.3.1-191028 allows an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack to men in the middle attack by adding New Routes in RoutingConfiguration on " /routing.asp ".
CVSS Score: 3.1 (LOW)
CWE: CWE-352, CWE-352
References: https://github.com/huzaifahussain98/CVE-2020-23587; https://github.com/huzaifahussain98/CVE-2020-23587
CVE: CVE-2020-23588
Published: 2022-11-23
Description: A vulnerability in OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OP_V3.3.1-191028 allows an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack to "Enable or Disable Ports" and to "Change port number" through " /rmtacc.asp ".
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://github.com/huzaifahussain98/CVE-2020-23588; https://github.com/huzaifahussain98/CVE-2020-23588
CVE: CVE-2020-23589
Published: 2022-11-23
Description: A vulnerability in OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OP_V3.3.1-191028 allows an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack to cause a Denial of Service by Rebooting the router through " /mgm_dev_reboot.asp."
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://github.com/huzaifahussain98/CVE-2020-23589; https://github.com/huzaifahussain98/CVE-2020-23589
CVE: CVE-2020-23590
Published: 2022-11-23
Description: A vulnerability in Optilink OP-XT71000N Hardware version: V2.2 , Firmware Version: OP_V3.3.1-191028 allows an unauthenticated remote attacker to conduct a cross-site request forgery (CSRF) attack to change the Password for "WLAN SSID" through "wlwpa.asp".
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://github.com/huzaifahussain98/CVE-2020-23590; https://github.com/huzaifahussain98/CVE-2020-23590
CVE: CVE-2020-23591
Published: 2022-11-23
Description: A vulnerability in OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OP_V3.3.1-191028 allows an attacker to upload arbitrary files through " /mgm_dev_upgrade.asp " which can "delete every file for Denial of Service (using 'rm -rf *.*' in the code), reverse connection (using '.asp' webshell), backdoor.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434, CWE-434
References: https://github.com/huzaifahussain98/CVE-2020-23591; https://github.com/huzaifahussain98/CVE-2020-23591
CVE: CVE-2020-23592
Published: 2022-11-23
Description: A vulnerability in OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OP_V3.3.1-191028 allows an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack to Reset ONU to Factory Default through ' /mgm_dev_reset.asp.' Resetting to default leads to Escalation of Privileges by logging-in with default credentials.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://github.com/huzaifahussain98/CVE-2020-23592; https://github.com/huzaifahussain98/CVE-2020-23592
CVE: CVE-2022-35500
Published: 2022-11-23
Description: Amasty Blog 2.10.3 is vulnerable to Cross Site Scripting (XSS) via leave comment functionality.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://amasty.com; https://github.com/afine-com/CVE-2022-35500; http://amasty.com
CVE: CVE-2022-37429
Published: 2022-11-23
Description: Silverstripe silverstripe/framework through 4.11 allows XSS (issue 1 of 2) via JavaScript payload to the href attribute of a link by splitting a javascript URL with white space characters.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://forum.silverstripe.org/c/releases; https://www.silverstripe.org/blog/tag/release; https://www.silverstripe.org/download/security-releases/
CVE: CVE-2022-37430
Published: 2022-11-23
Description: Silverstripe silverstripe/framework through 4.11 allows XSS vulnerability via href attribute of a link (issue 2 of 2).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://forum.silverstripe.org/c/releases; https://www.silverstripe.org/blog/tag/release; https://www.silverstripe.org/download/security-releases/
CVE: CVE-2022-37772
Published: 2022-11-23
Description: Maarch RM 2.8.3 solution contains an improper restriction of excessive authentication attempts due to excessive verbose responses from the application. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to compromised accounts.
CVSS Score: 7.5 (HIGH)
CWE: CWE-307, CWE-307
References: http://maarch.com; https://github.com/frame84/vulns/blob/main/MaarchRM/CVE-2022-37772/README.md; http://maarch.com
CVE: CVE-2022-38145
Published: 2022-11-23
Description: Silverstripe silverstripe/framework through 4.11 allows XSS (issue 1 of 3) via remote attackers adding a Javascript payload to a page's meta description and get it executed in the versioned history compare view.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://forum.silverstripe.org/c/releases; https://www.silverstripe.org/blog/tag/release; https://www.silverstripe.org/download/security-releases/
CVE: CVE-2022-42095
Published: 2022-11-23
Description: Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Page content.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://backdropcms.org; https://github.com/backdrop/backdrop/releases/tag/1.23.0; https://github.com/bypazs/CVE-2022-42095
CVE: CVE-2022-34830
Published: 2022-11-23
Description: An Arm product family through 2022-06-29 has a TOCTOU Race Condition that allows non-privileged user to make improper GPU processing operations to gain access to already freed memory.
CVSS Score: 7.5 (HIGH)
CWE: CWE-367, CWE-367
References: https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities; https://developer.arm.com/support/arm-security-updates; https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities
CVE: CVE-2022-36337
Published: 2022-11-23
Description: An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. A stack buffer overflow vulnerability in the MebxConfiguration driver leads to arbitrary code execution. Control of a UEFI variable under the OS can cause this overflow when read by BIOS code.
CVSS Score: 8.2 (HIGH)
CWE: CWE-787, CWE-121
References: https://www.insyde.com/security-pledge; https://www.insyde.com/security-pledge/SA-2022039; https://www.insyde.com/security-pledge
CVE: CVE-2022-37421
Published: 2022-11-23
Description: Silverstripe silverstripe/cms through 4.11.0 allows XSS.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://forum.silverstripe.org/c/releases; https://www.silverstripe.org/blog/tag/release; https://www.silverstripe.org/download/security-releases/
CVE: CVE-2022-38147
Published: 2022-11-23
Description: Silverstripe silverstripe/framework through 4.11 allows XSS (issue 3 of 3).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://forum.silverstripe.org/c/releases; https://www.silverstripe.org/blog/tag/release; https://www.silverstripe.org/download/security-releases/
CVE: CVE-2022-40770
Published: 2022-11-23
Description: Zoho ManageEngine ServiceDesk Plus versions 13010 and prior are vulnerable to authenticated command injection. This can be exploited by high-privileged users.
CVSS Score: 7.2 (HIGH)
CWE: CWE-77, CWE-77
References: https://manageengine.com; https://www.manageengine.com/products/service-desk/CVE-2022-40770.html; https://manageengine.com