deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-33873
Published: 2022-10-18
Description: An improper neutralization of special elements used in an OS Command ('OS Command Injection') vulnerabilities [CWE-78] in Console login components of FortiTester 2.3.0 through 3.9.1, 4.0.0 through 4.2.0, 7.0.0 through 7.1.0 may allow an unauthenticated attacker to execute arbitrary command in the underlying shell.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-78
References: https://fortiguard.com/psirt/FG-IR-22-237; https://fortiguard.com/psirt/FG-IR-22-237
CVE: CVE-2022-33874
Published: 2022-10-18
Description: An improper neutralization of special elements used in an OS Command ('OS Command Injection') vulnerabilities [CWE-78] in SSH login components of FortiTester 2.3.0 through 3.9.1, 4.0.0 through 4.2.0, 7.0.0 through 7.1.0 may allow an unauthenticated remote attacker to execute arbitrary command in the underlying shell.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://fortiguard.com/psirt/FG-IR-22-237; https://fortiguard.com/psirt/FG-IR-22-237
CVE: CVE-2022-41537
Published: 2022-10-18
Description: Online Tours & Travels Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via the component /user_operations/profile.php. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434, CWE-434
References: https://github.com/SmallDarkRoom1/bug_report/blob/main/vendors/mayuri_k/online-tours-travels-management-system/RCE-1.md; https://github.com/SmallDarkRoom1/bug_report/blob/main/vendors/mayuri_k/online-tours-travels-management-system/RCE-1.md
CVE: CVE-2022-41540
Published: 2022-10-18
Description: The web app client of TP-Link AX10v1 V1_211117 uses hard-coded cryptographic keys when communicating with the router. Attackers who are able to intercept the communications between the web client and router through a man-in-the-middle attack can then obtain the sequence key via a brute-force attack, and access sensitive information.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-798, CWE-798
References: https://github.com/efchatz/easy-exploits/tree/main/Web/TP-Link/Offline-decryption; https://www.tp-link.com/us/support/download/archer-ax10/v1/#Firmware; https://github.com/efchatz/easy-exploits/tree/main/Web/TP-Link/Offline-decryption
CVE: CVE-2022-41541
Published: 2022-10-18
Description: TP-Link AX10v1 V1_211117 allows attackers to execute a replay attack by using a previously transmitted encrypted authentication message and valid authentication token. Attackers are able to login to the web application as an admin user.
CVSS Score: 8.1 (HIGH)
CWE: CWE-294, CWE-294
References: https://github.com/efchatz/easy-exploits/tree/main/Web/TP-Link/Replay; https://www.tp-link.com/us/support/download/archer-ax10/v1/#Firmware; https://github.com/efchatz/easy-exploits/tree/main/Web/TP-Link/Replay
CVE: CVE-2022-41544
Published: 2022-10-18
Description: GetSimple CMS v3.3.16 was discovered to contain a remote code execution (RCE) vulnerability via the edited_file parameter in admin/theme-edit.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: http://packetstormsecurity.com/files/172553/GetSimple-CMS-3.3.16-Shell-Upload.html; https://github.com/GetSimpleCMS/GetSimpleCMS/issues/1352; http://packetstormsecurity.com/files/172553/GetSimple-CMS-3.3.16-Shell-Upload.html
CVE: CVE-2022-41547
Published: 2022-10-18
Description: Mobile Security Framework (MobSF) v0.9.2 and below was discovered to contain a local file inclusion (LFI) vulnerability in the StaticAnalyzer/views.py script. This vulnerability allows attackers to read arbitrary files via a crafted HTTP request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-98
References: https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/b9cdd1f52bdf127cf33bb1be369e374a2855f8e6#diff-69d2e38f6bba208c333da6a09a83ca65056fcb60f4e10d23f67c01bcc1ffb58c; https://github.com/MobSF/Mobile-Security-Framework-MobSF/pull/166; https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/b9cdd1f52bdf127cf33bb1be369e374a2855f8e6#diff-69d2e38f6bba208c333da6a09a83ca65056fcb60f4e10d23f67c01bcc1ffb58c
CVE: CVE-2022-43259
Published: 2022-10-18
Description: Tenda AC15 V15.03.05.18 was discovered to contain a stack overflow via the timeZone parameter in the form_fast_setting_wifi_set function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-787
References: https://drive.google.com/file/d/1VjYjZKv7MJ69hGPG-xD0xublUw-taq4w/view?usp=sharing; https://drive.google.com/file/d/1VjYjZKv7MJ69hGPG-xD0xublUw-taq4w/view?usp=sharing
CVE: CVE-2022-43260
Published: 2022-10-18
Description: Tenda AC18 V15.03.05.19(6318) was discovered to contain a stack overflow via the time parameter in the fromSetSysTime function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://drive.google.com/file/d/1elSFijqHselDzRNuawGfcHD4uL4N8_mM/view?usp=sharing; https://drive.google.com/file/d/1elSFijqHselDzRNuawGfcHD4uL4N8_mM/view?usp=sharing
CVE: CVE-2022-39198
Published: 2022-10-18
Description: A deserialization vulnerability existed in dubbo hessian-lite 3.2.12 and its earlier versions, which could lead to malicious code execution. This issue affects Apache Dubbo 2.7.x version 2.7.17 and prior versions; Apache Dubbo 3.0.x version 3.0.11 and prior versions; Apache Dubbo 3.1.x version 3.1.0 and prior versions.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://lists.apache.org/thread/8d3zqrkoy4jh8dy37j4rd7g9jodzlvkk; https://lists.apache.org/thread/8d3zqrkoy4jh8dy37j4rd7g9jodzlvkk
CVE: CVE-2022-42188
Published: 2022-10-18
Description: In Lavalite 9.0.0, the XSRF-TOKEN cookie is vulnerable to path traversal attacks, enabling read access to arbitrary files on the server.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/LavaLite; https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/LavaLite
CVE: CVE-2022-3593
Published: 2022-10-18
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2022-3594
Published: 2022-10-18
Description: A vulnerability was found in Linux Kernel. It has been declared as problematic. Affected by this vulnerability is the function intr_callback of the file drivers/net/usb/r8152.c of the component BPF. The manipulation leads to logging of excessive data. The attack can be launched remotely. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-211363.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-404
References: https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git/commit/?id=93e2be344a7db169b7119de21ac1bf253b8c6907; https://lists.debian.org/debian-lts-announce/2022/12/msg00031.html; https://lists.debian.org/debian-lts-announce/2022/12/msg00034.html
CVE: CVE-2022-3595
Published: 2022-10-18
Description: A vulnerability was found in Linux Kernel. It has been rated as problematic. Affected by this issue is the function sess_free_buffer of the file fs/cifs/sess.c of the component CIFS Handler. The manipulation leads to double free. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-211364.
CVSS Score: 3.5 (LOW)
CWE: CWE-119, CWE-415
References: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=b854b4ee66437e6e1622fda90529c814978cb4ca; https://vuldb.com/?id.211364; https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=b854b4ee66437e6e1622fda90529c814978cb4ca
CVE: CVE-2022-21587
Published: 2022-10-18
Description: Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: Upload). Supported versions that are affected are 12.2.3-12.2.11. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Web Applications Desktop Integrator. Successful attacks of this vulnerability can result in takeover of Oracle Web Applications Desktop Integrator. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306, CWE-306
References: http://packetstormsecurity.com/files/171208/Oracle-E-Business-Suite-EBS-Unauthenticated-Arbitrary-File-Upload.html; https://www.oracle.com/security-alerts/cpuoct2022.html; http://packetstormsecurity.com/files/171208/Oracle-E-Business-Suite-EBS-Unauthenticated-Arbitrary-File-Upload.html
CVE: CVE-2022-21589
Published: 2022-10-18
Description: Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions that are affected are 5.7.39 and prior and 8.0.16 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Server accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
CVSS Score: 4.3 (MEDIUM)
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.oracle.com/security-alerts/cpuoct2022.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2022-21590
Published: 2022-10-18
Description: Vulnerability in the Oracle BI Publisher product of Oracle Fusion Middleware (component: Core Formatting API). Supported versions that are affected are 5.9.0.0, 6.4.0.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle BI Publisher. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle BI Publisher accessible data as well as unauthorized update, insert or delete access to some of Oracle BI Publisher accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle BI Publisher. CVSS 3.1 Base Score 7.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L).
CVSS Score: 7.6 (HIGH)
References: https://www.oracle.com/security-alerts/cpuoct2022.html; https://www.oracle.com/security-alerts/cpuoct2022.html
CVE: CVE-2022-21591
Published: 2022-10-18
Description: Vulnerability in the Oracle Transportation Management product of Oracle Supply Chain (component: UI Infrastructure). Supported versions that are affected are 6.4.3 and 6.5.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Transportation Management. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Transportation Management accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Transportation Management. CVSS 3.1 Base Score 5.4 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L).
CVSS Score: 5.4 (MEDIUM)
References: https://www.oracle.com/security-alerts/cpuoct2022.html; https://www.oracle.com/security-alerts/cpuoct2022.html
CVE: CVE-2022-21592
Published: 2022-10-18
Description: Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Encryption). Supported versions that are affected are 5.7.39 and prior and 8.0.29 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Server accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
CVSS Score: 4.3 (MEDIUM)
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.oracle.com/security-alerts/cpuoct2022.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2022-21593
Published: 2022-10-18
Description: Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: OHS Config MBeans). Supported versions that are affected are 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle HTTP Server. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle HTTP Server accessible data as well as unauthorized update, insert or delete access to some of Oracle HTTP Server accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N).
CVSS Score: 7.1 (HIGH)
References: https://www.oracle.com/security-alerts/cpuoct2022.html; https://www.oracle.com/security-alerts/cpuoct2022.html
CVE: CVE-2022-21594
Published: 2022-10-18
Description: Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.30 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
CVSS Score: 4.9 (MEDIUM)
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EG3VBUHKCUXVWBSCD2FHCWIAMZO4X3PR/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NGZ4B5IQJEZQFSXGCZKSJ6GO3HLQ6URQ/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2022-21595
Published: 2022-10-18
Description: Vulnerability in the MySQL Server product of Oracle MySQL (component: C API). Supported versions that are affected are 5.7.36 and prior and 8.0.27 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).
CVSS Score: 4.4 (MEDIUM)
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.oracle.com/security-alerts/cpuoct2022.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2022-21596
Published: 2022-10-18
Description: Vulnerability in the Oracle Database - Advanced Queuing component of Oracle Database Server. The supported version that is affected is 19c. Easily exploitable vulnerability allows high privileged attacker having DBA user privilege with network access via Oracle Net to compromise Oracle Database - Advanced Queuing. Successful attacks of this vulnerability can result in takeover of Oracle Database - Advanced Queuing. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
CVSS Score: 7.2 (HIGH)
References: https://www.oracle.com/security-alerts/cpuoct2022.html; https://www.oracle.com/security-alerts/cpuoct2022.html
CVE: CVE-2022-21597
Published: 2022-10-18
Description: Vulnerability in the Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JavaScript). Supported versions that are affected are Oracle GraalVM Enterprise Edition: 20.3.7, 21.3.3 and 22.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle GraalVM Enterprise Edition accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
CVSS Score: 5.3 (MEDIUM)
References: https://www.oracle.com/security-alerts/cpuoct2022.html; https://www.oracle.com/security-alerts/cpuoct2022.html
CVE: CVE-2022-21598
Published: 2022-10-18
Description: Vulnerability in the Siebel Core - DB Deployment and Configuration product of Oracle Siebel CRM (component: Repository Utilities). Supported versions that are affected are 22.8 and prior. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel Core - DB Deployment and Configuration. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Siebel Core - DB Deployment and Configuration accessible data. CVSS 3.1 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).
CVSS Score: 7.5 (HIGH)
References: https://www.oracle.com/security-alerts/cpuoct2022.html; https://www.oracle.com/security-alerts/cpuoct2022.html
CVE: CVE-2022-21599
Published: 2022-10-18
Description: Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Stored Procedure). Supported versions that are affected are 8.0.30 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
CVSS Score: 4.9 (MEDIUM)
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EG3VBUHKCUXVWBSCD2FHCWIAMZO4X3PR/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NGZ4B5IQJEZQFSXGCZKSJ6GO3HLQ6URQ/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2022-21600
Published: 2022-10-18
Description: Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.27 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in takeover of MySQL Server. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
CVSS Score: 7.2 (HIGH)
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.oracle.com/security-alerts/cpuoct2022.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2022-21601
Published: 2022-10-18
Description: Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications Applications (component: Connection Manager). Supported versions that are affected are 12.0.0.4.0-12.0.0.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Communications Billing and Revenue Management. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Communications Billing and Revenue Management accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Communications Billing and Revenue Management. CVSS 3.1 Base Score 6.5 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L).
CVSS Score: 6.5 (MEDIUM)
References: https://www.oracle.com/security-alerts/cpuoct2022.html; https://www.oracle.com/security-alerts/cpuoct2022.html
CVE: CVE-2022-21602
Published: 2022-10-18
Description: Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal). Supported versions that are affected are 8.58, 8.59 and 8.60. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
CVSS Score: 5.3 (MEDIUM)
References: https://www.oracle.com/security-alerts/cpuoct2022.html; https://www.oracle.com/security-alerts/cpuoct2022.html
CVE: CVE-2022-21603
Published: 2022-10-18
Description: Vulnerability in the Oracle Database - Sharding component of Oracle Database Server. Supported versions that are affected are 19c and 21c. Easily exploitable vulnerability allows high privileged attacker having Local Logon privilege with network access via Local Logon to compromise Oracle Database - Sharding. Successful attacks of this vulnerability can result in takeover of Oracle Database - Sharding. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
CVSS Score: 7.2 (HIGH)
References: https://www.oracle.com/security-alerts/cpuoct2022.html; https://www.oracle.com/security-alerts/cpuoct2022.html
CVE: CVE-2022-21604
Published: 2022-10-18
Description: Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.30 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
CVSS Score: 4.9 (MEDIUM)
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EG3VBUHKCUXVWBSCD2FHCWIAMZO4X3PR/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NGZ4B5IQJEZQFSXGCZKSJ6GO3HLQ6URQ/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2022-21605
Published: 2022-10-18
Description: Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Data Dictionary). Supported versions that are affected are 8.0.28 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
CVSS Score: 4.9 (MEDIUM)
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.oracle.com/security-alerts/cpuoct2022.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/