deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-35021
Published: 2022-09-22
Description: OTFCC commit 617837b was discovered to contain a global buffer overflow via /release-x64/otfccdump+0x718693.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-120, CWE-120
References: https://drive.google.com/file/d/1Aer3pVGg3ZZrdlGOfMhdnSqAjOQj_3xK/view?usp=sharing; https://github.com/Cvjark/Poc/blob/main/otfcc/CVE-2022-35021.md; https://drive.google.com/file/d/1Aer3pVGg3ZZrdlGOfMhdnSqAjOQj_3xK/view?usp=sharing
CVE: CVE-2022-35022
Published: 2022-09-22
Description: OTFCC commit 617837b was discovered to contain a segmentation violation via /release-x64/otfccdump+0x6badae.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: https://drive.google.com/file/d/15eb-k1eDCeVLgb1G9JUSFHmGHHkDc79z/view?usp=sharing; https://github.com/Cvjark/Poc/blob/main/otfcc/CVE-2022-35022.md; https://drive.google.com/file/d/15eb-k1eDCeVLgb1G9JUSFHmGHHkDc79z/view?usp=sharing
CVE: CVE-2022-35023
Published: 2022-09-22
Description: OTFCC commit 617837b was discovered to contain a segmentation violation via /lib/x86_64-linux-gnu/libc.so.6+0xbb384.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: https://drive.google.com/file/d/17O7YeqDeVdrBJ1doBw46AvPIwQyYu0wM/view?usp=sharing; https://github.com/Cvjark/Poc/blob/main/otfcc/CVE-2022-35023.md; https://drive.google.com/file/d/17O7YeqDeVdrBJ1doBw46AvPIwQyYu0wM/view?usp=sharing
CVE: CVE-2022-35024
Published: 2022-09-22
Description: OTFCC commit 617837b was discovered to contain a segmentation violation via /multiarch/memmove-vec-unaligned-erms.S.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: https://drive.google.com/file/d/1s0VrWOJea_RRUJpZ0zgHV83NwGZlrIMt/view?usp=sharing; https://github.com/Cvjark/Poc/blob/main/otfcc/CVE-2022-35024.md; https://drive.google.com/file/d/1s0VrWOJea_RRUJpZ0zgHV83NwGZlrIMt/view?usp=sharing
CVE: CVE-2022-35025
Published: 2022-09-22
Description: OTFCC commit 617837b was discovered to contain a segmentation violation via /release-x64/otfccdump+0x5266a8.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: https://drive.google.com/file/d/1aXat1h1gl1HqxVNdS1ryFVp8Y3nD4TGZ/view?usp=sharing; https://github.com/Cvjark/Poc/blob/main/otfcc/CVE-2022-35025.md; https://drive.google.com/file/d/1aXat1h1gl1HqxVNdS1ryFVp8Y3nD4TGZ/view?usp=sharing
CVE: CVE-2022-35026
Published: 2022-09-22
Description: OTFCC commit 617837b was discovered to contain a segmentation violation via /release-x64/otfccdump+0x4fbc0b.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: https://drive.google.com/file/d/13A5FLmr3NiQZMNUpd9ir3owrnbn5lZbO/view?usp=sharing; https://github.com/Cvjark/Poc/blob/main/otfcc/CVE-2022-35026.md; https://drive.google.com/file/d/13A5FLmr3NiQZMNUpd9ir3owrnbn5lZbO/view?usp=sharing
CVE: CVE-2022-35027
Published: 2022-09-22
Description: OTFCC commit 617837b was discovered to contain a segmentation violation via /release-x64/otfccdump+0x4fe9a7.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: https://drive.google.com/file/d/1UEIyEM_nozYHYjSfc0HbbVnrR2oV9QJQ/view?usp=sharing; https://github.com/Cvjark/Poc/blob/main/otfcc/CVE-2022-35027.md; https://drive.google.com/file/d/1UEIyEM_nozYHYjSfc0HbbVnrR2oV9QJQ/view?usp=sharing
CVE: CVE-2022-35028
Published: 2022-09-22
Description: OTFCC commit 617837b was discovered to contain a segmentation violation via /release-x64/otfccdump+0x4fbbb6.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: https://drive.google.com/file/d/15hma-XPdkV0NfZZweuyYuxa8rMAfKbRG/view?usp=sharing; https://github.com/Cvjark/Poc/blob/main/otfcc/CVE-2022-35028.md; https://drive.google.com/file/d/15hma-XPdkV0NfZZweuyYuxa8rMAfKbRG/view?usp=sharing
CVE: CVE-2022-35029
Published: 2022-09-22
Description: OTFCC commit 617837b was discovered to contain a segmentation violation via /release-x64/otfccdump+0x6babea.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: https://drive.google.com/file/d/1x0eGL9tYqc7BEapsTqD78FTu9H8GKZ6l/view?usp=sharing; https://github.com/Cvjark/Poc/blob/main/otfcc/CVE-2022-35029.md; https://drive.google.com/file/d/1x0eGL9tYqc7BEapsTqD78FTu9H8GKZ6l/view?usp=sharing
CVE: CVE-2022-35030
Published: 2022-09-22
Description: OTFCC commit 617837b was discovered to contain a segmentation violation via /release-x64/otfccdump+0x4fe954.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: https://drive.google.com/file/d/15y2h3Z7LR3mgpoQ2QE2yM_my9i8A77AA/view?usp=sharing; https://github.com/Cvjark/Poc/blob/main/otfcc/CVE-2022-35030.md; https://drive.google.com/file/d/15y2h3Z7LR3mgpoQ2QE2yM_my9i8A77AA/view?usp=sharing
CVE: CVE-2022-35031
Published: 2022-09-22
Description: OTFCC commit 617837b was discovered to contain a segmentation violation via /release-x64/otfccdump+0x703969.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: https://drive.google.com/file/d/1ekHL103KNESRt8yFKhRfnhyzqlYRRUfs/view?usp=sharing; https://github.com/Cvjark/Poc/blob/main/otfcc/CVE-2022-35031.md; https://drive.google.com/file/d/1ekHL103KNESRt8yFKhRfnhyzqlYRRUfs/view?usp=sharing
CVE: CVE-2022-35032
Published: 2022-09-22
Description: OTFCC commit 617837b was discovered to contain a segmentation violation via /release-x64/otfccdump+0x6b6a8f.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: https://drive.google.com/file/d/1dldtU6kKgZbFdgQi4Md0p3t8RPOtKTG-/view?usp=sharing; https://github.com/Cvjark/Poc/blob/main/otfcc/CVE-2022-35032.md; https://drive.google.com/file/d/1dldtU6kKgZbFdgQi4Md0p3t8RPOtKTG-/view?usp=sharing
CVE: CVE-2022-35034
Published: 2022-09-22
Description: OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6e7e3d.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://drive.google.com/file/d/14qQpo_APymGhcKMU8B0epT20ImFC02LR/view?usp=sharing; https://github.com/Cvjark/Poc/blob/main/otfcc/CVE-2022-35034.md; https://drive.google.com/file/d/14qQpo_APymGhcKMU8B0epT20ImFC02LR/view?usp=sharing
CVE: CVE-2022-35035
Published: 2022-09-22
Description: OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6b559f.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://drive.google.com/file/d/1sRs48QDA0PSTYLUdkGyh_tvqs61yXNi7/view?usp=sharing; https://github.com/Cvjark/Poc/blob/main/otfcc/CVE-2022-35035.md; https://drive.google.com/file/d/1sRs48QDA0PSTYLUdkGyh_tvqs61yXNi7/view?usp=sharing
CVE: CVE-2022-35036
Published: 2022-09-22
Description: OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6e1fc8.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://drive.google.com/file/d/1tcZhjgZse-a8W6vOiBmdQhxtAVr2xyK0/view?usp=sharing; https://github.com/Cvjark/Poc/blob/main/otfcc/CVE-2022-35036.md; https://drive.google.com/file/d/1tcZhjgZse-a8W6vOiBmdQhxtAVr2xyK0/view?usp=sharing
CVE: CVE-2022-35037
Published: 2022-09-22
Description: OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6adb1e.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://drive.google.com/file/d/12SuaaZOa_I7ndwttQqaLWkBTWcIfTgu9/view?usp=sharing; https://github.com/Cvjark/Poc/blob/main/otfcc/CVE-2022-35037.md; https://drive.google.com/file/d/12SuaaZOa_I7ndwttQqaLWkBTWcIfTgu9/view?usp=sharing
CVE: CVE-2022-35038
Published: 2022-09-22
Description: OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6b064d.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://drive.google.com/file/d/1jhHvfkoD7fuMWbrhYxbOnJaSeW-Y2lKI/view?usp=sharing; https://github.com/Cvjark/Poc/blob/main/otfcc/CVE-2022-35038.md; https://drive.google.com/file/d/1jhHvfkoD7fuMWbrhYxbOnJaSeW-Y2lKI/view?usp=sharing
CVE: CVE-2022-35039
Published: 2022-09-22
Description: OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6e20a0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://drive.google.com/file/d/1EEF3Qb6qqaQrSdkxuaTLJB92bCfSi3od/view?usp=sharing; https://github.com/Cvjark/Poc/blob/main/otfcc/CVE-2022-35039.md; https://drive.google.com/file/d/1EEF3Qb6qqaQrSdkxuaTLJB92bCfSi3od/view?usp=sharing
CVE: CVE-2022-40933
Published: 2022-09-22
Description: Online Pet Shop We App v1.0 by oretnom23 is vulnerable to SQL injection via /pet_shop/classes/Master.php?f=delete_order,id.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/lime-10010/Bug_report/blob/main/vendors/oretnom23/online-pet-shop-we-app/SQLi-1.md; https://github.com/lime-10010/Bug_report/blob/main/vendors/oretnom23/online-pet-shop-we-app/SQLi-1.md
CVE: CVE-2022-40934
Published: 2022-09-22
Description: Online Pet Shop We App v1.0 is vulnerable to SQL injection via /pet_shop/classes/Master.php?f=delete_sub_category,id
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/lime-10010/Bug_report/blob/main/vendors/oretnom23/online-pet-shop-we-app/SQLi-3.md; https://github.com/lime-10010/Bug_report/blob/main/vendors/oretnom23/online-pet-shop-we-app/SQLi-3.md
CVE: CVE-2022-40935
Published: 2022-09-22
Description: Online Pet Shop We App v1.0 is vulnerable to SQL Injection via /pet_shop/classes/Master.php?f=delete_category,id.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/lime-10010/Bug_report/blob/main/vendors/oretnom23/online-pet-shop-we-app/SQLi-2.md; https://github.com/lime-10010/Bug_report/blob/main/vendors/oretnom23/online-pet-shop-we-app/SQLi-2.md
CVE: CVE-2022-34026
Published: 2022-09-22
Description: ICEcoder v8.1 allows attackers to execute a directory traversal.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: http://icecoder.com; https://gist.github.com/enferas/85cdbadf5cba32ec7c8db6ea9e6833bf; https://github.com/icecoder/ICEcoder
CVE: CVE-2022-35894
Published: 2022-09-22
Description: An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. The SMI handler for the FwBlockServiceSmm driver uses an untrusted pointer as the location to copy data to an attacker-specified buffer, leading to information disclosure.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-401, CWE-401
References: https://binarly.io/advisories/BRLY-2022-018/index.html; https://www.insyde.com/security-pledge; https://www.insyde.com/security-pledge/SA-2022030
CVE: CVE-2022-36062
Published: 2022-09-22
Description: Grafana is an open-source platform for monitoring and observability. In versions prior to 8.5.13, 9.0.9, and 9.1.6, Grafana is subject to Improper Preservation of Permissions resulting in privilege escalation on some folders where Admin is the only used permission. The vulnerability impacts Grafana instances where RBAC was disabled and enabled afterwards, as the migrations which are translating legacy folder permissions to RBAC permissions do not account for the scenario where the only user permission in the folder is Admin, as a result RBAC adds permissions for Editors and Viewers which allow them to edit and view folders accordingly. This issue has been patched in versions 8.5.13, 9.0.9, and 9.1.6. A workaround when the impacted folder/dashboard is known is to remove the additional permissions manually.
CVSS Score: 7.6 (HIGH)
CWE: CWE-281
References: https://github.com/grafana/grafana/security/advisories/GHSA-p978-56hq-r492; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://github.com/grafana/grafana/security/advisories/GHSA-p978-56hq-r492
CVE: CVE-2022-3274
Published: 2022-09-22
Description: Cross-Site Request Forgery (CSRF) in GitHub repository ikus060/rdiffweb prior to 2.4.7.
CVSS Score: 3.5 (LOW)
CWE: CWE-352
References: https://github.com/ikus060/rdiffweb/commit/e974df75bdbcff3996ad70bd1b4424ec1485ea3f; https://huntr.dev/bounties/8834c356-4ddb-4be7-898b-d76f480e9c3f; https://github.com/ikus060/rdiffweb/commit/e974df75bdbcff3996ad70bd1b4424ec1485ea3f
CVE: CVE-2022-37234
Published: 2022-09-22
Description: Netgear Nighthawk AC1900 Smart WiFi Dual Band Gigabit Router R7000-V1.0.11.134_10.2.119 is vulnerable to Buffer Overflow via the wl binary in firmware. There is a stack overflow vulnerability caused by strncpy.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://github.com/Davidteeri/Bug-Report/blob/main/netgear-R7000-0x461bc-strncpy.md; https://www.netgear.com/about/security/; https://www.netgear.com/support/download/?model=R7000
CVE: CVE-2021-27774
Published: 2022-09-22
Description: User input included in error response, which could be used in a phishing attack.
CVSS Score: 3.1 (LOW)
CWE: CWE-209, CWE-20
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0100491; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0100491
CVE: CVE-2022-23458
Published: 2022-09-22
Description: Toast UI Grid is a component to display and edit data. Versions prior to 4.21.3 are vulnerable to cross-site scripting attacks when pasting specially crafted content into editable cells. This issue was fixed in version 4.21.3. There are no known workarounds.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/nhn/tui.grid/commit/e9db5968675ae113c07efc091cce210f2b26854f; https://securitylab.github.com/advisories/GHSL-2022-029_nhn_tui_grid/; https://github.com/nhn/tui.grid/commit/e9db5968675ae113c07efc091cce210f2b26854f
CVE: CVE-2022-31937
Published: 2022-09-22
Description: Netgear N300 wireless router wnr2000v4-V1.0.0.70 was discovered to contain a stack overflow via strcpy in uhttpd.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://github.com/Davidteeri/Bug-Report/blob/main/netgear-n300-0x4297B4.md; https://www.netgear.com/about/security/; https://www.netgear.com/support/download/?model=WNR2000v4
CVE: CVE-2022-36934
Published: 2022-09-22
Description: An integer overflow in WhatsApp could result in remote code execution in an established video call.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-122, CWE-190
References: https://www.whatsapp.com/security/advisories/2022/; https://www.whatsapp.com/security/advisories/2022/
CVE: CVE-2022-40087
Published: 2022-09-22
Description: Simple College Website v1.0 was discovered to contain an arbitrary file write vulnerability via the function file_put_contents(). This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434, CWE-434
References: https://gowthamaraj-rajendran.medium.com/simple-college-website-1-0-unauthenticated-arbitrary-file-upload-rce-44341831bec8; https://www.sourcecodester.com/php/14548/simple-college-website-using-htmlphpmysqli-source-code.html; https://www.sourcecodester.com/sites/default/files/download/oretnom23/simple-college-website.zip
CVE: CVE-2022-40088
Published: 2022-09-22
Description: Simple College Website v1.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /college_website/index.php?page=. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the page parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://gowthamaraj-rajendran.medium.com/simple-college-website-1-0-xss-1f13228233a; https://www.sourcecodester.com/php/14548/simple-college-website-using-htmlphpmysqli-source-code.html; https://www.sourcecodester.com/sites/default/files/download/oretnom23/simple-college-website.zip
CVE: CVE-2022-40089
Published: 2022-09-22
Description: A remote file inclusion (RFI) vulnerability in Simple College Website v1.0 allows attackers to execute arbitrary code via a crafted PHP file. This vulnerability is exploitable when the directive allow_url_include is set to On.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-98
References: https://gowthamaraj-rajendran.medium.com/simple-college-website-1-0-rfi-cff8d827572e; https://www.sourcecodester.com/php/14548/simple-college-website-using-htmlphpmysqli-source-code.html; https://www.sourcecodester.com/sites/default/files/download/oretnom23/simple-college-website.zip
CVE: CVE-2022-30426
Published: 2022-09-23
Description: There is a stack buffer overflow vulnerability, which could lead to arbitrary code execution in UEFI DXE driver on some Acer products. An attack could exploit this vulnerability to escalate privilege from ring 3 to ring 0, and hijack control flow during UEFI DXE execution. This affects Altos T110 F3 firmware version <= P13 (latest) and AP130 F2 firmware version <= P04 (latest) and Aspire 1600X firmware version <= P11.A3L (latest) and Aspire 1602M firmware version <= P11.A3L (latest) and Aspire 7600U firmware version <= P11.A4 (latest) and Aspire MC605 firmware version <= P11.A4L (latest) and Aspire TC-105 firmware version <= P12.B0L (latest) and Aspire TC-120 firmware version <= P11-A4 (latest) and Aspire U5-620 firmware version <= P11.A1 (latest) and Aspire X1935 firmware version <= P11.A3L (latest) and Aspire X3475 firmware version <= P11.A3L (latest) and Aspire X3995 firmware version <= P11.A3L (latest) and Aspire XC100 firmware version <= P11.B3 (latest) and Aspire XC600 firmware version <= P11.A4 (latest) and Aspire Z3-615 firmware version <= P11.A2L (latest) and Veriton E430G firmware version <= P21.A1 (latest) and Veriton B630_49 firmware version <= AAP02SR (latest) and Veriton E430 firmware version <= P11.A4 (latest) and Veriton M2110G firmware version <= P21.A3 (latest) and Veriton M2120G fir.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: http://acer.com; http://altos.com; https://github.com/10TG/vulnerabilities/blob/main/Acer/CVE-2022-30426/CVE-2022-30426.md
CVE: CVE-2022-38573
Published: 2022-09-23
Description: 10-Strike Network Inventory Explorer v9.3 was discovered to contain a buffer overflow via the Add Computers function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120, CWE-120
References: https://packetstormsecurity.com; https://packetstormsecurity.com/files/168133/10-Strike-Network-Inventory-Explorer-9.3-Buffer-Overflow.html; https://packetstormsecurity.com
CVE: CVE-2022-40298
Published: 2022-09-23
Description: Crestron AirMedia for Windows before 5.5.1.84 has insecure inherited permissions, which leads to a privilege escalation vulnerability found in the AirMedia Windows Application, version 4.3.1.39. A low privileged user can initiate a repair of the system and gain a SYSTEM level shell.
CVSS Score: 8.8 (HIGH)
CWE: CWE-732, CWE-732
References: https://www.crestron.com/Security/Security_Advisories; https://www.crestron.com/release_notes/airmedia_windows_installer_release_notes_5.5.1.84.pdf; https://www.crestron.com/Security/Security_Advisories
CVE: CVE-2021-41803
Published: 2022-09-23
Description: HashiCorp Consul 1.8.1 up to 1.11.8, 1.12.4, and 1.13.1 do not properly validate the node or segment names prior to interpolation and usage in JWT claim assertions with the auto config RPC. Fixed in 1.11.9, 1.12.5, and 1.13.2."
CVSS Score: 7.1 (HIGH)
CWE: CWE-862, CWE-862
References: https://discuss.hashicorp.com/t/hcsec-2022-19-consul-auto-config-jwt-authorization-missing-input-validation/44627; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LYZOKMMVX4SIEHPJW3SJUQGMO5YZCPHC/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XNF4OLYZRQE75EB5TW5N42FSXHBXGWFE/
CVE: CVE-2022-37232
Published: 2022-09-23
Description: Netgear N300 wireless router wnr2000v4-V1.0.0.70 is vulnerable to Buffer Overflow via uhttpd. There is a stack overflow vulnerability caused by strcpy.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/Davidteeri/Bug-Report/blob/main/netgear-n300-0x429cbc.md; https://www.netgear.com/about/security/; https://www.netgear.com/support/download/?model=WNR2000v4
CVE: CVE-2022-37235
Published: 2022-09-23
Description: Netgear Nighthawk AC1900 Smart WiFi Dual Band Gigabit Router R7000-V1.0.11.134_10.2.119 is vulnerable to Buffer Overflow via the wl binary in firmware. There is a stack overflow vulnerability caused by strncat
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://github.com/Davidteeri/Bug-Report/blob/main/netgear-R7000-0x461bc.md; https://www.netgear.com/about/security/; https://www.netgear.com/support/download/?model=R7000
CVE: CVE-2022-35951
Published: 2022-09-23
Description: Redis is an in-memory database that persists on disk. Versions 7.0.0 and above, prior to 7.0.5 are vulnerable to an Integer Overflow. Executing an `XAUTOCLAIM` command on a stream key in a specific state, with a specially crafted `COUNT` argument may cause an integer overflow, a subsequent heap overflow, and potentially lead to remote code execution. This has been patched in Redis version 7.0.5. No known workarounds exist.
CVSS Score: 7.0 (HIGH)
CWE: CWE-190, CWE-190
References: https://github.com/redis/redis/security/advisories/GHSA-5gc4-76rx-22c9; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A7INCOOFPPEAKNDBZU3TIZJPYXBULI2C/; https://security.gentoo.org/glsa/202209-17
CVE: CVE-2022-41319
Published: 2022-09-23
Description: A Reflected Cross-Site Scripting (XSS) vulnerability affects the Veritas Desktop Laptop Option (DLO) application login page (aka the DLOServer/restore/login.jsp URI). This affects versions before 9.8 (e.g., 9.1 through 9.7).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.veritas.com/content/support/en_US/security/VTS22-014; https://www.veritas.com/content/support/en_US/security/VTS22-014
CVE: CVE-2022-41320
Published: 2022-09-23
Description: Veritas System Recovery (VSR) versions 18 and 21 store a network destination password in the Windows registry during configuration of the backup configuration. This vulnerability could provide a Windows user (who has sufficient privileges) to access a network file system that they were not authorized to access.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-922, CWE-922
References: https://www.veritas.com/content/support/en_US/security/VTS21-002; https://www.veritas.com/content/support/en_US/security/VTS21-002
CVE: CVE-2022-41322
Published: 2022-09-23
Description: In Kitty before 0.26.2, insufficient validation in the desktop notification escape sequence can lead to arbitrary code execution. The user must display attacker-controlled content in the terminal, then click on a notification popup.
CVSS Score: 7.8 (HIGH)
CWE: CWE-116, CWE-116
References: https://bugs.gentoo.org/868543; https://github.com/kovidgoyal/kitty/commit/f05783e64d5fa62e1aed603e8d69aced5e49824f; https://github.com/kovidgoyal/kitty/compare/v0.26.1...v0.26.2
CVE: CVE-2020-36604
Published: 2022-09-23
Description: hoek before 8.5.1 and 9.x before 9.0.3 allows prototype poisoning in the clone function.
CVSS Score: 8.1 (HIGH)
CWE: CWE-1321, CWE-1321
References: https://github.com/hapijs/hoek/issues/352; https://security.snyk.io/vuln/SNYK-JS-HAPIHOEK-548452%29; https://github.com/hapijs/hoek/issues/352
CVE: CVE-2022-39225
Published: 2022-09-23
Description: Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In versions prior to 4.10.15, or 5.0.0 and above prior to 5.2.6, a user can write to the session object of another user if the session object ID is known. For example, an attacker can assign the session object to their own user by writing to the `user` field and then read any custom fields of that session object. Note that assigning a session to another user does not usually change the privileges of either of the two users, and a user cannot assign their own session to another user. This issue is patched in version 4.10.15 and above, and 5.2.6 and above. To mitigate this issue in unpatched versions add a `beforeSave` trigger to the `_Session` class and prevent writing if the requesting user is different from the user in the session object.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-669
References: https://github.com/parse-community/parse-server/security/advisories/GHSA-6w4q-23cf-j9jp; https://github.com/parse-community/parse-server/security/advisories/GHSA-6w4q-23cf-j9jp