deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-28367
Published: 2022-04-21
Description: OWASP AntiSamy before 1.6.6 allows XSS via HTML tag smuggling on STYLE content with crafted input. The output serializer does not properly encode the supposed Cascading Style Sheets (CSS) content.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/nahsra/antisamy/commit/0199e7e194dba5e7d7197703f43ebe22401e61ae; https://github.com/nahsra/antisamy/releases/tag/v1.6.6; https://github.com/nahsra/antisamy/commit/0199e7e194dba5e7d7197703f43ebe22401e61ae
CVE: CVE-2022-29577
Published: 2022-04-21
Description: OWASP AntiSamy before 1.6.7 allows XSS via HTML tag smuggling on STYLE content with crafted input. The output serializer does not properly encode the supposed Cascading Style Sheets (CSS) content. NOTE: this issue exists because of an incomplete fix for CVE-2022-28367.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/nahsra/antisamy/commit/32e273507da0e964b58c50fd8a4c94c9d9363af0; https://github.com/nahsra/antisamy/releases/tag/v1.6.7; https://www.oracle.com/security-alerts/cpujul2022.html
CVE: CVE-2022-26672
Published: 2022-04-22
Description: ASUS WebStorage has a hardcoded API Token in the APP source code. An unauthenticated remote attacker can use this token to establish connections with the server and carry out login attempts to general user accounts. A successful login to a general user account allows the attacker to access, modify or delete this user account information.
CVSS Score: 7.3 (HIGH)
CWE: CWE-798, CWE-798
References: https://www.twcert.org.tw/tw/cp-132-6041-7bd67-1.html; https://www.twcert.org.tw/tw/cp-132-6041-7bd67-1.html
CVE: CVE-2022-26673
Published: 2022-04-22
Description: ASUS RT-AX88U has insufficient filtering for special characters in the HTTP header parameter. A remote attacker with general user privilege can exploit this vulnerability to inject JavaScript and perform Stored Cross-Site Scripting (XSS) attacks.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.twcert.org.tw/tw/cp-132-6042-6cc0f-1.html; https://www.twcert.org.tw/tw/cp-132-6042-6cc0f-1.html
CVE: CVE-2022-26674
Published: 2022-04-22
Description: ASUS RT-AX88U has a Format String vulnerability, which allows an unauthenticated remote attacker to write to arbitrary memory address and perform remote arbitrary code execution, arbitrary system operation or disrupt service.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-134, CWE-134
References: https://www.twcert.org.tw/tw/cp-132-6043-0f72c-1.html; https://www.twcert.org.tw/tw/cp-132-6043-0f72c-1.html
CVE: CVE-2022-1429
Published: 2022-04-22
Description: SQL injection in GridHelperService.php in GitHub repository pimcore/pimcore prior to 10.3.6. This vulnerability is capable of steal the data
CVSS Score: 7.5 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/pimcore/pimcore/commit/523a735ab94f004459b84ffdfd3db784586bbd82; https://huntr.dev/bounties/cfba30b4-85fa-4499-9160-cd6e3119310e; https://github.com/pimcore/pimcore/commit/523a735ab94f004459b84ffdfd3db784586bbd82
CVE: CVE-2022-27404
Published: 2022-04-22
Description: FreeType commit 1e2eb65048f75c64b68708efed6ce904c31f3b2f was discovered to contain a heap buffer overflow via the function sfnt_init_face.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://gitlab.freedesktop.org/freetype/freetype/-/issues/1138; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EFPNRKDLCXHZVYYQLQMP44UHLU32GA6Z/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FDU2FOEMCEF6WVR6ZBIH5MT5O7FAK6UP/
CVE: CVE-2022-27405
Published: 2022-04-22
Description: FreeType commit 53dfdcd8198d2b3201a23c4bad9190519ba918db was discovered to contain a segmentation violation via the function FNT_Size_Request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: http://freetype.com; https://gitlab.freedesktop.org/freetype/freetype/-/issues/1139; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EFPNRKDLCXHZVYYQLQMP44UHLU32GA6Z/
CVE: CVE-2022-27406
Published: 2022-04-22
Description: FreeType commit 22a0cccb4d9d002f33c1ba7a4b36812c7d4f46b5 was discovered to contain a segmentation violation via the function FT_Request_Size.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: http://freetype.com; https://gitlab.freedesktop.org/freetype/freetype/-/issues/1140; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EFPNRKDLCXHZVYYQLQMP44UHLU32GA6Z/
CVE: CVE-2022-28074
Published: 2022-04-22
Description: Halo-1.5.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via \admin\index.html#/system/tools.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/halo-dev/halo/issues/1769; https://github.com/halo-dev/halo/issues/1769
CVE: CVE-2021-32927
Published: 2022-04-22
Description: An attacker may be able to inject client-side JavaScript code on multiple instances within all versions of Uffizio GPS Tracker.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://www.cisa.gov/uscert/ics/advisories/icsa-21-287-02; https://www.cisa.gov/uscert/ics/advisories/icsa-21-287-02
CVE: CVE-2021-32929
Published: 2022-04-22
Description: All versions of Uffizio GPS Tracker may allow an attacker to perform unintended actions on behalf of a user.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://www.cisa.gov/uscert/ics/advisories/icsa-21-287-02; https://www.cisa.gov/uscert/ics/advisories/icsa-21-287-02
CVE: CVE-2021-36203
Published: 2022-04-22
Description: The affected product may allow an attacker to identify and forge requests to internal systems by way of a specially crafted request.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-918, CWE-918
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-111-02; https://www.cisa.gov/uscert/ics/advisories/icsa-22-111-02
CVE: CVE-2022-1437
Published: 2022-04-22
Description: Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.7.0. The bug causes the program reads data past the end of the intented buffer. Typically, this can allow attackers to read sensitive information from other memory locations or cause a crash.
CVSS Score: 7.1 (HIGH)
CWE: CWE-122, CWE-787
References: https://github.com/radareorg/radare2/commit/669a404b6d98d5db409a5ebadae4e94b34ef5136; https://huntr.dev/bounties/af6c3e9e-b7df-4d80-b48f-77fdd17b4038; https://github.com/radareorg/radare2/commit/669a404b6d98d5db409a5ebadae4e94b34ef5136
CVE: CVE-2020-14123
Published: 2022-04-22
Description: There is a pointer double free vulnerability in Some MIUI Services. When a function is called, the memory pointer is copied to two function modules, and an attacker can cause the pointer to be repeatedly released through malicious operations, resulting in the affected module crashing and affecting normal functionality, and if successfully exploited the vulnerability can cause elevation of privileges.
CVSS Score: 7.5 (HIGH)
CWE: CWE-415
References: https://trust.mi.com/zh-CN/misrc/bulletins/advisory?cveId=134; https://trust.mi.com/zh-CN/misrc/bulletins/advisory?cveId=134
CVE: CVE-2022-29582
Published: 2022-04-22
Description: In the Linux kernel before 5.17.3, fs/io_uring.c has a use-after-free due to a race condition in io_uring timeouts. This can be triggered by a local user who has no access to any user namespace; however, the race condition perhaps can only be exploited infrequently.
CVSS Score: 7.0 (HIGH)
CWE: CWE-362
References: http://www.openwall.com/lists/oss-security/2022/04/22/4; http://www.openwall.com/lists/oss-security/2022/08/08/3; http://www.openwall.com/lists/oss-security/2024/04/24/3
CVE: CVE-2022-29583
Published: 2022-04-22
Description: service_windows.go in the kardianos service package for Go omits quoting that is sometimes needed for execution of a Windows service executable from the intended directory. NOTE: this finding could not be reproduced by its original reporter or by others.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: https://github.com/kardianos/service/pull/290; https://github.com/kardianos/service/pull/290
CVE: CVE-2021-20464
Published: 2022-04-22
Description: IBM Cognos Analytics PowerPlay (IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7) could be vulnerable to an XML Bomb attack by a malicious authenticated user. IBM X-Force ID: 196813.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-776
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/196813; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.ibm.com/support/pages/node/6570957
CVE: CVE-2021-29824
Published: 2022-04-22
Description: IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 is vulnerable to priviledge escalation where a lower level user could have read access to to the 'Data Connections' page to which they don't have access. IBM X-Force ID: 204468.
CVSS Score: 4.3 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/204468; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.ibm.com/support/pages/node/6570957
CVE: CVE-2021-38886
Published: 2022-04-22
Description: IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 209399.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/209399; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.ibm.com/support/pages/node/6570957
CVE: CVE-2021-38903
Published: 2022-04-22
Description: IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability to inject malicious script into a Web page which would be executed in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials. IBM X-Force ID: 209691.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/209691; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.ibm.com/support/pages/node/6570957
CVE: CVE-2021-38904
Published: 2022-04-22
Description: IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 could allow a remote attacker to obtain credentials from a user's browser via incorrect autocomplete settings. IBM X-Force ID: 209693.
CVSS Score: 6.5 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/209693; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.ibm.com/support/pages/node/6570957
CVE: CVE-2021-38905
Published: 2022-04-22
Description: IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 could allow an authenticated user to view report pages that they should not have access to. IBM X-Force ID: 209697.
CVSS Score: 4.3 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/209697; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.ibm.com/support/pages/node/6570957
CVE: CVE-2021-38946
Published: 2022-04-22
Description: IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 211240.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/211240; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.ibm.com/support/pages/node/6570957
CVE: CVE-2022-1439
Published: 2022-04-22
Description: Reflected XSS on demo.microweber.org/demo/module/ in GitHub repository microweber/microweber prior to 1.2.15. Execute Arbitrary JavaScript as the attacked user. It's the only payload I found working, you might need to press "tab" but there is probably a paylaod that runs without user interaction.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/microweber/microweber/commit/ad3928f67b2cd4443f4323d858b666d35a919ba8; https://huntr.dev/bounties/86f6a762-0f3d-443d-a676-20f8496907e0; https://github.com/microweber/microweber/commit/ad3928f67b2cd4443f4323d858b666d35a919ba8
CVE: CVE-2022-29589
Published: 2022-04-22
Description: Crypt Server before 3.3.0 allows XSS in the index view. This is related to serial, computername, and username.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/grahamgilbert/Crypt-Server/pull/109; https://github.com/grahamgilbert/Crypt-Server/releases/tag/3.3.0; https://github.com/grahamgilbert/Crypt-Server/pull/109
CVE: CVE-2022-1440
Published: 2022-04-22
Description: Command Injection vulnerability in git-interface@2.1.1 in GitHub repository yarkeev/git-interface prior to 2.1.2. If both are provided by user input, then the use of a `--upload-pack` command-line argument feature of git is also supported for `git clone`, which would then allow for any operating system command to be spawned by the attacker.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://github.com/yarkeev/git-interface/commit/f828aa790016fee3aa667f7b44cf94bf0aa8c60d; https://huntr.dev/bounties/cdc25408-d3c1-4a9d-bb45-33b12a715ca1; https://github.com/yarkeev/git-interface/commit/f828aa790016fee3aa667f7b44cf94bf0aa8c60d
CVE: CVE-2022-27340
Published: 2022-04-22
Description: MCMS v5.2.7 contains a Cross-Site Request Forgery (CSRF) via /role/saveOrUpdateRole.do. This vulnerability allows attackers to escalate privileges and modify data.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/UDKI11/vul/blob/main/Mcms%E8%B7%A8%E7%AB%99%E8%AF%B7%E6%B1%82%E4%BC%AA%E9%80%A0.docx; https://github.com/ming-soft/MCMS; https://github.com/UDKI11/vul/blob/main/Mcms%E8%B7%A8%E7%AB%99%E8%AF%B7%E6%B1%82%E4%BC%AA%E9%80%A0.docx
CVE: CVE-2022-27341
Published: 2022-04-22
Description: JFinalCMS v2.0 was discovered to contain a SQL injection vulnerability via the Article Management function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/UDKI11/vul/blob/main/JFinalCMS-sqli-2.docx; https://github.com/UDKI11/vul/blob/main/JFinalCMS-sqli-2.docx
CVE: CVE-2022-27342
Published: 2022-04-22
Description: Link-Admin v0.0.1 was discovered to contain a SQL injection vulnerability via DictRest.ResponseResult().
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/UDKI11/vul/blob/main/link-admin.docx; https://github.com/UDKI11/vul/blob/main/link-admin.docx
CVE: CVE-2021-3721
Published: 2022-04-22
Description: A denial of service vulnerability was reported in Lenovo PCManager prior to version 4.0.20.10282 that could allow an attacker with local access to trigger a blue screen error.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://iknow.lenovo.com.cn/detail/dc_200016.html; https://iknow.lenovo.com.cn/detail/dc_200016.html
CVE: CVE-2021-3722
Published: 2022-04-22
Description: A denial of service vulnerability was reported in Lenovo PCManager prior to version 4.0.40.2175 that could allow configuration files to be written to non-standard locations during installation.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-276, CWE-276
References: https://iknow.lenovo.com.cn/detail/dc_199218.html; https://iknow.lenovo.com.cn/detail/dc_199218.html
CVE: CVE-2021-3849
Published: 2022-04-22
Description: An authentication bypass vulnerability was discovered in the web interface of the Lenovo Fan Power Controller2 (FPC2) and Lenovo System Management Module (SMM) firmware that could allow an unauthenticated attacker to execute commands on the SMM and FPC2. SMM2 is not affected.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-288
References: https://support.lenovo.com/us/en/product_security/LEN-72615; https://support.lenovo.com/us/en/product_security/LEN-72615
CVE: CVE-2021-3897
Published: 2022-04-22
Description: An authentication bypass vulnerability was discovered in an internal service of the Lenovo Fan Power Controller2 (FPC2) and Lenovo System Management Module (SMM) firmware during an that could allow an unauthenticated attacker to execute commands on the SMM and FPC2. SMM2 is not affected.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-288
References: https://support.lenovo.com/us/en/product_security/LEN-72615; https://support.lenovo.com/us/en/product_security/LEN-72615
CVE: CVE-2021-3898
Published: 2022-04-22
Description: Versions of Motorola Ready For and Motorola Device Help Android applications prior to 2021-04-08 do not properly verify the server certificate which could lead to the communication channel being accessible by an attacker.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-295, CWE-295
References: https://support.lenovo.com/us/en/product_security/LEN-58311; https://support.lenovo.com/us/en/product_security/LEN-58311
CVE: CVE-2021-3970
Published: 2022-04-22
Description: A potential vulnerability in LenovoVariable SMI Handler due to insufficient validation in some Lenovo Notebook models BIOS may allow an attacker with local access and elevated privileges to execute arbitrary code.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://support.lenovo.com/us/en/product_security/LEN-73440; https://support.lenovo.com/us/en/product_security/LEN-73440
CVE: CVE-2021-3971
Published: 2022-04-22
Description: A potential vulnerability by a driver used during older manufacturing processes on some consumer Lenovo Notebook devices that was mistakenly included in the BIOS image could allow an attacker with elevated privileges to modify firmware protection region by modifying an NVRAM variable.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-489
References: https://support.lenovo.com/us/en/product_security/LEN-73440; https://support.lenovo.com/us/en/product_security/LEN-73440
CVE: CVE-2021-3972
Published: 2022-04-22
Description: A potential vulnerability by a driver used during manufacturing process on some consumer Lenovo Notebook devices' BIOS that was mistakenly not deactivated may allow an attacker with elevated privileges to modify secure boot setting by modifying an NVRAM variable.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-489
References: https://support.lenovo.com/us/en/product_security/LEN-73440; https://support.lenovo.com/us/en/product_security/LEN-73440
CVE: CVE-2021-4210
Published: 2022-04-22
Description: A potential vulnerability in the SMI callback function used in the NVME driver in some Lenovo Desktop, ThinkStation, and ThinkEdge models may allow an attacker with local access and elevated privileges to execute arbitrary code.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-20
References: https://support.lenovo.com/us/en/product_security/LEN-77639; https://support.lenovo.com/us/en/product_security/LEN-77639
CVE: CVE-2021-4211
Published: 2022-04-22
Description: A potential vulnerability in the SMI callback function used in the SMBIOS event log driver in some Lenovo Desktop, ThinkStation, and ThinkEdge models may allow an attacker with local access and elevated privileges to execute arbitrary code.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://support.lenovo.com/us/en/product_security/LEN-77639; https://support.lenovo.com/us/en/product_security/LEN-77639
CVE: CVE-2021-4212
Published: 2022-04-22
Description: A potential vulnerability in the SMI callback function used in the Legacy BIOS mode driver in some Lenovo Notebook models may allow an attacker with local access and elevated privileges to execute arbitrary code.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://support.lenovo.com/us/en/product_security/LEN-77639; https://support.lenovo.com/us/en/product_security/LEN-77639
CVE: CVE-2022-0192
Published: 2022-04-22
Description: A DLL search path vulnerability was reported in Lenovo PCManager prior to version 4.0.40.2175 that could allow privilege escalation.
CVSS Score: 7.3 (HIGH)
CWE: CWE-427, CWE-427
References: https://iknow.lenovo.com.cn/detail/dc_201470.html; https://iknow.lenovo.com.cn/detail/dc_201470.html
CVE: CVE-2022-0354
Published: 2022-04-22
Description: A vulnerability was reported in Lenovo System Update that could allow a local user with interactive system access the ability to execute code with elevated privileges only during the installation of a System Update package released before 2022-02-25 that displays a command prompt window.
CVSS Score: 7.3 (HIGH)
References: https://support.lenovo.com/us/en/product_security/LEN-76673; https://www.infosec.tirol/cve-2022-0354/; https://support.lenovo.com/us/en/product_security/LEN-76673
CVE: CVE-2022-0636
Published: 2022-04-22
Description: A denial of service vulnerability was reported in Lenovo Thin Installer prior to version 1.3.0039 that could trigger a system crash.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-120, CWE-120
References: https://support.lenovo.com/us/en/product_security/LEN-78116; https://support.lenovo.com/us/en/product_security/LEN-78116
CVE: CVE-2022-1107
Published: 2022-04-22
Description: During an internal product security audit a potential vulnerability due to use of Boot Services in the SmmOEMInt15 SMI handler was discovered in some ThinkPad models could be exploited by an attacker with elevated privileges that could allow for execution of code.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-20, CWE-20, CWE-269
References: https://support.lenovo.com/us/en/product_security/LEN-84943; https://support.lenovo.com/us/en/product_security/LEN-84943
CVE: CVE-2022-1108
Published: 2022-04-22
Description: A potential vulnerability due to improper buffer validation in the SMI handler LenovoFlashDeviceInterface in Thinkpad X1 Fold Gen 1 could be exploited by an attacker with local access and elevated privileges to execute arbitrary code.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-20, CWE-20, CWE-269
References: https://support.lenovo.com/us/en/product_security/LEN-84943; https://support.lenovo.com/us/en/product_security/LEN-84943
CVE: CVE-2022-1427
Published: 2022-04-23
Description: Out-of-bounds Read in mrb_obj_is_kind_of in in GitHub repository mruby/mruby prior to 3.2. # Impact: Possible arbitrary code execution if being exploited.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-125
References: https://github.com/mruby/mruby/commit/a4d97934d51cb88954cc49161dc1d151f64afb6b; https://huntr.dev/bounties/23b6f0a9-64f5-421e-a55f-b5b7a671f301; https://github.com/mruby/mruby/commit/a4d97934d51cb88954cc49161dc1d151f64afb6b
CVE: CVE-2022-1444
Published: 2022-04-23
Description: heap-use-after-free in GitHub repository radareorg/radare2 prior to 5.7.0. This vulnerability is capable of inducing denial of service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416, CWE-416
References: https://github.com/radareorg/radare2/commit/[PII_REDACTED]c27981adb4c2c2aed2863c1859ec5; https://huntr.dev/bounties/b438a940-f8a4-4872-b030-59bdd1ab72aa; https://github.com/radareorg/radare2/commit/[PII_REDACTED]c27981adb4c2c2aed2863c1859ec5
CVE: CVE-2022-1445
Published: 2022-04-24
Description: Stored Cross Site Scripting vulnerability in the checked_out_to parameter in GitHub repository snipe/snipe-it prior to 5.4.3. The vulnerability is capable of stolen the user Cookie.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/snipe/snipe-it/commit/f623d05d0c3487ae24c4f13907e4709484e5bf41; https://huntr.dev/bounties/f4[PII_REDACTED]-4051-a458-5d4f1d5b7abd; https://github.com/snipe/snipe-it/commit/f623d05d0c3487ae24c4f13907e4709484e5bf41
CVE: CVE-2022-1451
Published: 2022-04-24
Description: Out-of-bounds Read in r_bin_java_constant_value_attr_new function in GitHub repository radareorg/radare2 prior to 5.7.0. The bug causes the program reads data past the end 2f the intented buffer. Typically, this can allow attackers to read sensitive information from other memory locations or cause a crash. More details see [CWE-125: Out-of-bounds read](https://cwe.mitre.org/data/definitions/125.html).
CVSS Score: 7.1 (HIGH)
CWE: CWE-788, CWE-125
References: https://github.com/radareorg/radare2/commit/0927ed3ae99444e7b47b84e43118deb10fe37529; https://huntr.dev/bounties/229a2e0d-9e5c-402f-9a24-57fa2eb1aaa7; https://github.com/radareorg/radare2/commit/0927ed3ae99444e7b47b84e43118deb10fe37529