deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-40654
Published: 2022-09-15
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ansys SpaceClaim 2022 R1. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of X_T files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18351.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.zerodayinitiative.com/advisories/ZDI-22-1210/; https://www.zerodayinitiative.com/advisories/ZDI-22-1210/
CVE: CVE-2022-40655
Published: 2022-09-15
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of NIKON NIS-Elements Viewer 1.2100.1483.0. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of ND2 files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15071.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://www.zerodayinitiative.com/advisories/ZDI-22-1211/; https://www.software-dl.microscope.healthcare.nikon.com/vuln/index.html; https://www.software-dl.microscope.healthcare.nikon.com/vuln/pdf/Vulnerabilities_on_NIS-Elements_Freeware_and_L_en_240917_02.pdf
CVE: CVE-2022-40656
Published: 2022-09-15
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of NIKON NIS-Elements Viewer 13.2.0.21165. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of ND2 files. Crafted data in a ND2 file can trigger a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15072.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-125
References: https://www.zerodayinitiative.com/advisories/ZDI-22-1212/; https://www.software-dl.microscope.healthcare.nikon.com/vuln/index.html; https://www.software-dl.microscope.healthcare.nikon.com/vuln/pdf/Vulnerabilities_on_NIS-Elements_Freeware_and_L_en_240917_02.pdf
CVE: CVE-2022-40657
Published: 2022-09-15
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of NIKON NIS-Elements Viewer 1.2100.1483.0. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PSD files. Crafted data in a PSD file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15073.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.zerodayinitiative.com/advisories/ZDI-22-1213/; https://www.software-dl.microscope.healthcare.nikon.com/vuln/index.html; https://www.software-dl.microscope.healthcare.nikon.com/vuln/pdf/Vulnerabilities_on_NIS-Elements_Freeware_and_L_en_240917_02.pdf
CVE: CVE-2022-40658
Published: 2022-09-15
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of NIKON NIS-Elements Viewer 1.2100.1483.0. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of TIF images. Crafted data in a TIF file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15166.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.zerodayinitiative.com/advisories/ZDI-22-1214/; https://www.software-dl.microscope.healthcare.nikon.com/vuln/index.html; https://www.software-dl.microscope.healthcare.nikon.com/vuln/pdf/Vulnerabilities_on_NIS-Elements_Freeware_and_L_en_240917_02.pdf
CVE: CVE-2022-40659
Published: 2022-09-15
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of NIKON NIS-Elements Viewer 1.2100.1483.0. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of TIF images. Crafted data in a TIF file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15214.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.zerodayinitiative.com/advisories/ZDI-22-1215/; https://www.software-dl.microscope.healthcare.nikon.com/vuln/index.html; https://www.software-dl.microscope.healthcare.nikon.com/vuln/pdf/Vulnerabilities_on_NIS-Elements_Freeware_and_L_en_240917_02.pdf
CVE: CVE-2022-40660
Published: 2022-09-15
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of NIKON NIS-Elements Viewer 1.2100.1483.0. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PSD images. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15135.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://www.zerodayinitiative.com/advisories/ZDI-22-1216/; https://www.software-dl.microscope.healthcare.nikon.com/vuln/index.html; https://www.software-dl.microscope.healthcare.nikon.com/vuln/pdf/Vulnerabilities_on_NIS-Elements_Freeware_and_L_en_240917_02.pdf
CVE: CVE-2022-40661
Published: 2022-09-15
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of NIKON NIS-Elements Viewer 1.2100.1483.0. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of BMP images. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15134.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://www.zerodayinitiative.com/advisories/ZDI-22-1217/; https://www.software-dl.microscope.healthcare.nikon.com/vuln/index.html; https://www.software-dl.microscope.healthcare.nikon.com/vuln/pdf/Vulnerabilities_on_NIS-Elements_Freeware_and_L_en_240917_02.pdf
CVE: CVE-2022-40662
Published: 2022-09-15
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of NIKON NIS-Elements Viewer 1.2100.1483.0. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of TIF images. Crafted data in a TIF image can trigger a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15351.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-125
References: https://www.zerodayinitiative.com/advisories/ZDI-22-1218/; https://www.software-dl.microscope.healthcare.nikon.com/vuln/index.html; https://www.software-dl.microscope.healthcare.nikon.com/vuln/pdf/Vulnerabilities_on_NIS-Elements_Freeware_and_L_en_240917_02.pdf
CVE: CVE-2022-40663
Published: 2022-09-15
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of NIKON NIS-Elements Viewer 1.2100.1483.0. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of TIF images. Crafted data in a TIF image can trigger a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15697.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-125
References: https://www.zerodayinitiative.com/advisories/ZDI-22-1219/; https://www.software-dl.microscope.healthcare.nikon.com/vuln/index.html; https://www.software-dl.microscope.healthcare.nikon.com/vuln/pdf/Vulnerabilities_on_NIS-Elements_Freeware_and_L_en_240917_02.pdf
CVE: CVE-2022-38534
Published: 2022-09-15
Description: TOTOLINK-720R v4.1.5cu.374 was discovered to contain a remote code execution (RCE) vulnerability via the setdiagnosicfg function.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://github.com/Jfox816/TOTOLINK-720R/blob/fb6ba109ba9c5bd1b0d8e22c88ee14bdc4a75e6b/TOTOLINK%20720%20RCode%20Execution.md; https://github.com/Jfox816/TOTOLINK-720R/blob/fb6ba109ba9c5bd1b0d8e22c88ee14bdc4a75e6b/TOTOLINK%20720%20RCode%20Execution.md
CVE: CVE-2022-38535
Published: 2022-09-15
Description: TOTOLINK-720R v4.1.5cu.374 was discovered to contain a remote code execution (RCE) vulnerability via the setTracerouteCfg function.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://github.com/Jfox816/TOTOLINK-720R/blob/177ee39a5a8557a6bd19586731b0e624548b67ee/totolink%20720%20RCode%20Execution2.md; https://github.com/Jfox816/TOTOLINK-720R/blob/177ee39a5a8557a6bd19586731b0e624548b67ee/totolink%20720%20RCode%20Execution2.md
CVE: CVE-2022-39209
Published: 2022-09-15
Description: cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. In versions prior to 0.29.0.gfm.6 a polynomial time complexity issue in cmark-gfm's autolink extension may lead to unbounded resource exhaustion and subsequent denial of service. Users may verify the patch by running `python3 -c 'print("![l"* 100000 + "\n")' | ./cmark-gfm -e autolink`, which will resource exhaust on unpatched cmark-gfm but render correctly on patched cmark-gfm. This vulnerability has been patched in 0.29.0.gfm.6. Users are advised to upgrade. Users unable to upgrade should disable the use of the autolink extension.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-407
References: https://en.wikipedia.org/wiki/Time_complexity; https://github.com/github/cmark-gfm/commit/9d57d8a23142b316282bdfc954cb0ecda40a8655; https://github.com/github/cmark-gfm/security/advisories/GHSA-cgh3-p57x-9q7q
CVE: CVE-2022-37260
Published: 2022-09-15
Description: A Regular Expression Denial of Service (ReDoS) flaw was found in stealjs steal 2.2.4 via the input variable in main.js.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1333
References: https://github.com/stealjs/steal/blob/c9dd1eb19ed3f97aeb93cf9dcea5d68ad5d0ced9/main.js#L2490; https://github.com/stealjs/steal/blob/c9dd1eb19ed3f97aeb93cf9dcea5d68ad5d0ced9/main.js#L3344; https://github.com/stealjs/steal/issues/1529
CVE: CVE-2022-38325
Published: 2022-09-15
Description: Tenda AC15 WiFi Router V15.03.05.19_multi and AC18 WiFi Router V15.03.05.19_multi were discovered to contain a buffer overflow via the filePath parameter at /goform/expandDlnaFile.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://github.com/[PII_REDACTED]/Vuls/blob/main/Tenda/AC/Vul_expandDlnaFile.md; https://github.com/[PII_REDACTED]/Vuls/blob/main/Tenda/AC/Vul_expandDlnaFile.md
CVE: CVE-2022-38326
Published: 2022-09-15
Description: Tenda AC15 WiFi Router V15.03.05.19_multi and AC18 WiFi Router V15.03.05.19_multi were discovered to contain a buffer overflow via the page parameter at /goform/NatStaticSetting.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://github.com/[PII_REDACTED]/Vuls/blob/main/Tenda/AC/Vul_NatStaticSetting.md; https://github.com/[PII_REDACTED]/Vuls/blob/main/Tenda/AC/Vul_NatStaticSetting.md
CVE: CVE-2022-38814
Published: 2022-09-15
Description: A stored cross-site scripting (XSS) vulnerability in the auth_settings component of FiberHome AN5506-02-B vRP2521 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the sncfg_loid text field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://packetstormsecurity.com/files/168065/Fiberhome-AN5506-02-B-Cross-Site-Scripting.html; https://packetstormsecurity.com/files/168065/Fiberhome-AN5506-02-B-Cross-Site-Scripting.html
CVE: CVE-2022-38334
Published: 2022-09-15
Description: XPDF v4.04 and earlier was discovered to contain a stack overflow via the function Catalog::countPageTree() at Catalog.cc.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-674
References: https://forum.xpdfreader.com/viewtopic.php?f=3&t=42122; https://forum.xpdfreader.com/viewtopic.php?f=3&t=42314&p=43872; https://forum.xpdfreader.com/viewtopic.php?f=3&t=42122
CVE: CVE-2022-27561
Published: 2022-09-15
Description: There is a reflected Cross-Site Scripting vulnerability in the HCL Traveler web admin (LotusTraveler.nsf).
CVSS Score: 7.5 (HIGH)
CWE: CWE-79, CWE-79
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0100435; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0100435
CVE: CVE-2022-29240
Published: 2022-09-15
Description: Scylla is a real-time big data database that is API-compatible with Apache Cassandra and Amazon DynamoDB. When decompressing CQL frame received from user, Scylla assumes that user-provided uncompressed length is correct. If user provides fake length, that is greater than the real one, part of decompression buffer won't be overwritten, and will be left uninitialized. This can be exploited in several ways, depending on the privileges of the user. 1. The main exploit is that an attacker with access to CQL port, but no user account, can bypass authentication, but only if there are other legitimate clients making connections to the cluster, and they use LZ4. 2. Attacker that already has a user account on the cluster can read parts of uninitialized memory, which can contain things like passwords of other users or fragments of other queries / results, which leads to authorization bypass and sensitive information disclosure. The bug has been patched in the following versions: Scylla Enterprise: 2020.1.14, 2021.1.12, 2022.1.0. Scylla Open Source: 4.6.7, 5.0.3. Users unable to upgrade should make sure none of their drivers connect to cluster using LZ4 compression, and that Scylla CQL port is behind firewall. Additionally make sure no untrusted client can connect to Scylla, by setting up authentication and applying workarounds from previous point (firewall, no lz4 compression).
CVSS Score: 8.1 (HIGH)
CWE: CWE-908
References: https://github.com/scylladb/scylla/security/advisories/GHSA-25pq-rrqm-6fmr; https://github.com/scylladb/scylladb/commit/1c2eef384da439b0457b6d71c7e37d7268e471cb; https://github.com/scylladb/scylladb/issues/11476
CVE: CVE-2022-36074
Published: 2022-09-15
Description: Nextcloud server is an open source personal cloud product. Affected versions of this package are vulnerable to Information Exposure which fails to strip the Authorization header on HTTP downgrade. This can lead to account access exposure and compromise. It is recommended that the Nextcloud Server is upgraded to 23.0.7 or 24.0.3. It is recommended that the Nextcloud Enterprise Server is upgraded to 22.2.11, 23.0.7 or 24.0.3. There are no known workarounds for this issue.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-200, CWE-863
References: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-vqgm-f748-g76v; https://github.com/nextcloud/server/pull/32941; https://github.com/nextcloud/security-advisories/security/advisories/GHSA-vqgm-f748-g76v
CVE: CVE-2022-36075
Published: 2022-09-15
Description: Nextcloud files access control is a nextcloud app to manage access control for files. Users with limited access can see file names in certain cases where they do not have privilege to do so. This issue has been addressed and it is recommended that the Nextcloud Files Access Control app is upgraded to 1.12.2, 1.13.1 or 1.14.1. There are no known workarounds for this issue
CVSS Score: 2.6 (LOW)
CWE: CWE-200, CWE-269
References: https://github.com/nextcloud/files_accesscontrol/pull/248; https://github.com/nextcloud/security-advisories/security/advisories/GHSA-4m73-g7v7-v62w; https://github.com/nextcloud/files_accesscontrol/pull/248
CVE: CVE-2022-39213
Published: 2022-09-15
Description: go-cvss is a Go module to manipulate Common Vulnerability Scoring System (CVSS). In affected versions when a full CVSS v2.0 vector string is parsed using `ParseVector`, an Out-of-Bounds Read is possible due to a lack of tests. The Go module will then panic. The problem is patched in tag `v0.4.0`, by the commit `d9d478ff0c13b8b09ace030db9262f3c2fe031f4`. Users are advised to upgrade. Users unable to upgrade may avoid this issue by parsing only CVSS v2.0 vector strings that do not have all attributes defined (e.g. `AV:N/AC:L/Au:N/C:P/I:P/A:C/E:U/RL:OF/RC:C/CDP:MH/TD:H/CR:M/IR:M/AR:M`). As stated in [SECURITY.md](https://github.com/pandatix/go-cvss/blob/master/SECURITY.md), the CPE v2.3 to refer to this Go module is `cpe:2.3:a:pandatix:go_cvss:*:*:*:*:*:*:*:*`. The entry has already been requested to the NVD CPE dictionary.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://github.com/pandatix/go-cvss/blob/master/SECURITY.md; https://github.com/pandatix/go-cvss/commit/d9d478ff0c13b8b09ace030db9262f3c2fe031f4; https://github.com/pandatix/go-cvss/security/advisories/GHSA-xhmf-mmv2-4hhx
CVE: CVE-2022-39215
Published: 2022-09-15
Description: Tauri is a framework for building binaries for all major desktop platforms. Due to missing canonicalization when `readDir` is called recursively, it was possible to display directory listings outside of the defined `fs` scope. This required a crafted symbolic link or junction folder inside an allowed path of the `fs` scope. No arbitrary file content could be leaked. The issue has been resolved in version 1.0.6 and the implementation now properly checks if the requested (sub) directory is a symbolic link outside of the defined `scope`. Users are advised to upgrade. Users unable to upgrade should disable the `readDir` endpoint in the `allowlist` inside the `tauri.conf.json`.
CVSS Score: 8.3 (HIGH)
CWE: CWE-22, CWE-59
References: https://github.com/tauri-apps/tauri/issues/4882; https://github.com/tauri-apps/tauri/pull/5123; https://github.com/tauri-apps/tauri/pull/5123/commits/1f9b9e8d26a2c915390323e161020bcb36d44678
CVE: CVE-2022-26959
Published: 2022-09-16
Description: There are two full (read/write) Blind/Time-based SQL injection vulnerabilities in the Northstar Club Management version 6.3 application. The vulnerabilities exist in the userName parameter of the processlogin.jsp page in the /northstar/Portal/ directory and the userID parameter of the login.jsp page in the /northstar/iphone/ directory. Exploitation of the SQL injection vulnerabilities allows full access to the database which contains critical data for organization’s that make full use of the software suite.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-89
References: https://assura.atlassian.net/wiki/spaces/VULNS/pages/[PII_REDACTED]/CVE-2022-26959+Northstar+Club+Management+software+version+6.3+-+Full+Blind+Time-based+SQL+Injection; https://www.assurainc.com/services/advisory-services/threat-vuln-assessment/; https://assura.atlassian.net/wiki/spaces/VULNS/pages/[PII_REDACTED]/CVE-2022-26959+Northstar+Club+Management+software+version+6.3+-+Full+Blind+Time-based+SQL+Injection
CVE: CVE-2022-34002
Published: 2022-09-16
Description: The ‘document’ parameter of PDS Vista 7’s /application/documents/display.aspx page is vulnerable to a Local File Inclusion vulnerability which allows an low-privileged authenticated attacker to leak the configuration files and source code of the web application.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://assura.atlassian.net/wiki/spaces/VULNS/pages/[PII_REDACTED]/CVE-2022-34002+Personnel+Data+Systems+PDS+Vista+7+-+Local+File+Inclusion; https://assurainc.com; https://assura.atlassian.net/wiki/spaces/VULNS/pages/[PII_REDACTED]/CVE-2022-34002+Personnel+Data+Systems+PDS+Vista+7+-+Local+File+Inclusion
CVE: CVE-2020-23550
Published: 2022-09-16
Description: IrfanView 4.54 allows a user-mode write access violation starting at FORMATS!GetPlugInInfo+0x[PII_REDACTED]007e82.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/nhiephon/Research; https://www.irfanview.com/plugins.htm; https://github.com/nhiephon/Research
CVE: CVE-2020-23551
Published: 2022-09-16
Description: IrfanView 4.54 allows a user-mode write access violation starting at FORMATS!GetPlugInInfo+0x[PII_REDACTED]007e30.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/nhiephon/Research; https://www.irfanview.com/plugins.htm; https://github.com/nhiephon/Research
CVE: CVE-2020-23552
Published: 2022-09-16
Description: IrfanView 4.54 allows a user-mode write access violation starting at FORMATS!GetPlugInInfo+0x[PII_REDACTED]007e62.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/nhiephon/Research; https://www.irfanview.com/plugins.htm; https://github.com/nhiephon/Research
CVE: CVE-2020-23553
Published: 2022-09-16
Description: IrfanView 4.54 allows a user-mode write access violation starting at FORMATS!GetPlugInInfo+0x[PII_REDACTED]007d33.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/nhiephon/Research; https://www.irfanview.com/plugins.htm; https://github.com/nhiephon/Research
CVE: CVE-2020-23554
Published: 2022-09-16
Description: IrfanView 4.54 allows a user-mode write access violation starting at FORMATS!GetPlugInInfo+0x[PII_REDACTED]007e20.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/nhiephon/Research; https://www.irfanview.com/plugins.htm; https://github.com/nhiephon/Research
CVE: CVE-2020-23555
Published: 2022-09-16
Description: IrfanView 4.54 allows a user-mode write access violation starting at FORMATS!GetPlugInInfo+0x[PII_REDACTED]007e6e.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/nhiephon/Research; https://www.irfanview.com/plugins.htm; https://github.com/nhiephon/Research
CVE: CVE-2020-23556
Published: 2022-09-16
Description: IrfanView 4.54 allows a user-mode write access violation starting at FORMATS!GetPlugInInfo+0x[PII_REDACTED]007e28.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/nhiephon/Research; https://www.irfanview.com/plugins.htm; https://github.com/nhiephon/Research
CVE: CVE-2020-23557
Published: 2022-09-16
Description: IrfanView 4.54 allows a user-mode write access violation starting at FORMATS!ShowPlugInSaveOptions_W+0x[PII_REDACTED]00755d.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/nhiephon/Research; https://www.irfanview.com/plugins.htm; https://github.com/nhiephon/Research
CVE: CVE-2020-23558
Published: 2022-09-16
Description: IrfanView 4.54 allows a user-mode write access violation starting at FORMATS!ShowPlugInSaveOptions_W+0x[PII_REDACTED]007f4b.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/nhiephon/Research; https://www.irfanview.com/plugins.htm; https://github.com/nhiephon/Research
CVE: CVE-2020-23559
Published: 2022-09-16
Description: IrfanView 4.54 allows a user-mode write access violation starting at FORMATS!ShowPlugInSaveOptions_W+0x[PII_REDACTED]007d7f.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/nhiephon/Research; https://www.irfanview.com/plugins.htm; https://github.com/nhiephon/Research
CVE: CVE-2020-23560
Published: 2022-09-16
Description: IrfanView 4.54 allows a user-mode write access violation starting at FORMATS!ShowPlugInSaveOptions_W+0x[PII_REDACTED]01bcab.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/nhiephon/Research; https://www.irfanview.com/plugins.htm; https://github.com/nhiephon/Research