deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-22784
Published: 2022-05-18
Description: The Zoom Client for Meetings (for Android, iOS, Linux, MacOS, and Windows) before version 5.10.0 failed to properly parse XML stanzas in XMPP messages. This can allow a malicious user to break out of the current XMPP message context and create a new message context to have the receiving users client perform a variety of actions.This issue could be used in a more sophisticated attack to forge XMPP messages from the server.
CVSS Score: 8.1 (HIGH)
CWE: CWE-91
References: https://explore.zoom.us/en/trust/security/security-bulletin; https://explore.zoom.us/en/trust/security/security-bulletin
CVE: CVE-2022-22785
Published: 2022-05-18
Description: The Zoom Client for Meetings (for Android, iOS, Linux, MacOS, and Windows) before version 5.10.0 failed to properly constrain client session cookies to Zoom domains. This issue could be used in a more sophisticated attack to send an unsuspecting users Zoom-scoped session cookies to a non-Zoom domain. This could potentially allow for spoofing of a Zoom user.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-565
References: https://explore.zoom.us/en/trust/security/security-bulletin; https://explore.zoom.us/en/trust/security/security-bulletin
CVE: CVE-2022-22786
Published: 2022-05-18
Description: The Zoom Client for Meetings for Windows before version 5.10.0 and Zoom Rooms for Conference Room for Windows before version 5.10.0, fails to properly check the installation version during the update process. This issue could be used in a more sophisticated attack to trick a user into downgrading their Zoom client to a less secure version.
CVSS Score: 7.5 (HIGH)
CWE: CWE-494
References: https://explore.zoom.us/en/trust/security/security-bulletin; https://explore.zoom.us/en/trust/security/security-bulletin
CVE: CVE-2022-28917
Published: 2022-05-18
Description: Tenda AX12 v22.03.01.21_cn was discovered to contain a stack overflow via the lanIp parameter in /goform/AdvSetLanIp.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://github.com/NSSCYCTFER/SRC-CVE; https://github.com/NSSCYCTFER/SRC-CVE
CVE: CVE-2022-30105
Published: 2022-05-18
Description: In Belkin N300 Firmware 1.00.08, the script located at /setting_hidden.asp, which is accessible before and after configuring the device, exhibits multiple remote command injection vulnerabilities. The following parameters in the [form name] form; [list vulnerable parameters], are not properly sanitized after being submitted to the web interface in a POST request. With specially crafted parameters, it is possible to inject a an OS command which will be executed with root privileges, as the web interface, and all processes on the device, run as root.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://www.exploitee.rs/index.php/Belkin_N300#Remote_Root; https://www.exploitee.rs/index.php/Belkin_N300#Remote_Root
CVE: CVE-2021-42700
Published: 2022-05-18
Description: Inkscape 0.91 is vulnerable to an out-of-bounds read, which may allow an attacker to have access to unauthorized information.
CVSS Score: 3.3 (LOW)
CWE: CWE-125, CWE-125
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-132-03; https://www.integraxor.com/scada-animation-graphic-editor-extension-inkscape/; https://www.cisa.gov/uscert/ics/advisories/icsa-22-132-03
CVE: CVE-2021-42702
Published: 2022-05-18
Description: Inkscape version 0.91 can access an uninitialized pointer, which may allow an attacker to have access to unauthorized information.
CVSS Score: 3.3 (LOW)
CWE: CWE-824
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-132-03; https://www.integraxor.com/scada-animation-graphic-editor-extension-inkscape/; https://www.cisa.gov/uscert/ics/advisories/icsa-22-132-03
CVE: CVE-2021-42704
Published: 2022-05-18
Description: Inkscape version 0.91 is vulnerable to an out-of-bounds write, which may allow an attacker to arbitrary execute code.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-132-03; https://www.integraxor.com/scada-animation-graphic-editor-extension-inkscape/; https://www.cisa.gov/uscert/ics/advisories/icsa-22-132-03
CVE: CVE-2022-0883
Published: 2022-05-18
Description: SLM has an issue with Windows Unquoted/Trusted Service Paths Security Issue. All installations version 9.x.x prior to 9.20.1 should be patched.
CVSS Score: 7.3 (HIGH)
CWE: CWE-428, CWE-428
References: https://community.snowsoftware.com/s/feed/0D5690000BsNCO6CQO; https://community.snowsoftware.com/s/feed/0D5690000BsNCO6CQO
CVE: CVE-2022-1734
Published: 2022-05-18
Description: A flaw in Linux Kernel found in nfcmrvl_nci_unregister_dev() in drivers/nfc/nfcmrvl/main.c can lead to use after free both read or write when non synchronized between cleanup routine and firmware download routine.
CVSS Score: 7.0 (HIGH)
CWE: CWE-416, CWE-416
References: http://www.openwall.com/lists/oss-security/2022/06/05/4; http://www.openwall.com/lists/oss-security/2022/06/09/1; https://github.com/torvalds/linux/commit/d270453a0d9ec10bb8a802a142fb1b3601a83098
CVE: CVE-2022-22776
Published: 2022-05-18
Description: The Web Server component of TIBCO Software Inc.'s TIBCO BusinessConnect Trading Community Management contains easily exploitable vulnerabilities that allows a low privileged attacker with network access to execute Stored Cross Site Scripting (XSS) on the affected system. A successful attack using these vulnerabilities requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.'s TIBCO BusinessConnect Trading Community Management: versions 6.1.0 and below.
CVSS Score: 8.0 (HIGH)
CWE: CWE-79
References: https://www.tibco.com/services/support/advisories; https://www.tibco.com/support/advisories/2022/05/tibco-security-advisory-may-18-2022-tibco-bctcm-cve-2022-22776; https://www.tibco.com/services/support/advisories
CVE: CVE-2022-22777
Published: 2022-05-18
Description: The Web Server component of TIBCO Software Inc.'s TIBCO BusinessConnect Trading Community Management contains easily exploitable Reflected Cross Site Scripting (XSS) vulnerabilities that allow an unauthenticated attacker with network access to execute scripts targeting the affected system or the victim's local system. Affected releases are TIBCO Software Inc.'s TIBCO BusinessConnect Trading Community Management: versions 6.1.0 and below.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.tibco.com/services/support/advisories; https://www.tibco.com/support/advisories/2022/05/tibco-security-advisory-may-18-2022-tibco-bctcm-cve-2022-22777; https://www.tibco.com/services/support/advisories
CVE: CVE-2022-22778
Published: 2022-05-18
Description: The Web Server component of TIBCO Software Inc.'s TIBCO BusinessConnect Trading Community Management contains an easily exploitable vulnerability that allows an unauthenticated attacker with network access to execute Cross-Site Request Forgery (CSRF) on the affected system. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.'s TIBCO BusinessConnect Trading Community Management: versions 6.1.0 and below.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://www.tibco.com/services/support/advisories; https://www.tibco.com/support/advisories/2022/05/tibco-security-advisory-may-18-2022-tibco-bctcm-cve-2022-22778; https://www.tibco.com/services/support/advisories
CVE: CVE-2022-22787
Published: 2022-05-18
Description: The Zoom Client for Meetings (for Android, iOS, Linux, macOS, and Windows) before version 5.10.0 fails to properly validate the hostname during a server switch request. This issue could be used in a more sophisticated attack to trick an unsuspecting users client to connect to a malicious server when attempting to use Zoom services.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295
References: http://packetstormsecurity.com/files/167238/Zoom-XMPP-Stanza-Smuggling-Remote-Code-Execution.html; https://explore.zoom.us/en/trust/security/security-bulletin; http://packetstormsecurity.com/files/167238/Zoom-XMPP-Stanza-Smuggling-Remote-Code-Execution.html
CVE: CVE-2022-25161
Published: 2022-05-18
Description: Improper Input Validation vulnerability in Mitsubishi Electric MELSEC iQ-F series FX5U-xMy/z(x=32,64,80, y=T,R, z=ES,DS,ESS,DSS) with serial number 17X**** or later and versions prior to 1.270, Mitsubishi Electric Mitsubishi Electric MELSEC iQ-F series FX5U-xMy/z(x=32,64,80, y=T,R, z=ES,DS,ESS,DSS) with serial number 179**** and prior and versions prior to 1.073, MELSEC iQ-F series FX5UC-xMy/z(x=32,64,96, y=T,R, z=D,DSS) with serial number 17X**** or later and versions prior to 1.270, Mitsubishi Electric MELSEC iQ-F series FX5UC-xMy/z(x=32,64,96, y=T,R, z=D,DSS) with serial number 179**** and prior and versions prior to 1.073, Mitsubishi Electric MELSEC iQ-F series FX5UC-32MT/DS-TS versions prior to 1.270, Mitsubishi Electric MELSEC iQ-F series FX5UC-32MT/DSS-TS versions prior to 1.270, Mitsubishi Electric MELSEC iQ-F series FX5UC-32MR/DS-TS versions prior to 1.270, Mitsubishi Electric MELSEC iQ-F series FX5UJ-xMy/z(x=24,40,60, y=T,R, z=ES,ESS) versions prior to 1.030, Mitsubishi Electric MELSEC iQ-F series FX5UJ-xMy/ES-A(x=24,40,60, y=T,R) versions prior to 1.031 and Mitsubishi Electric MELSEC iQ-F series FX5S-xMy/z(x=30,40,60,80, y=T,R, z=ES,ESS) version 1.000 allows a remote unauthenticated attacker to cause a DoS condition for the product's program execution or communication by sending specially crafted packets. System reset of the product is required for recovery.
CVSS Score: 8.6 (HIGH)
CWE: CWE-20
References: https://jvn.jp/vu/JVNVU95926817/index.html; https://www.cisa.gov/uscert/ics/advisories/icsa-22-139-01; https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-004_en.pdf
CVE: CVE-2022-25162
Published: 2022-05-18
Description: Improper Input Validation vulnerability in Mitsubishi Electric MELSEC iQ-F series FX5U-xMy/z(x=32,64,80, y=T,R, z=ES,DS,ESS,DSS) with serial number 17X**** or later and versions prior to 1.270, Mitsubishi Electric Mitsubishi Electric MELSEC iQ-F series FX5U-xMy/z(x=32,64,80, y=T,R, z=ES,DS,ESS,DSS) with serial number 179**** and prior and versions prior to 1.073, MELSEC iQ-F series FX5UC-xMy/z(x=32,64,96, y=T,R, z=D,DSS) with serial number 17X**** or later and versions prior to 1.270, Mitsubishi Electric MELSEC iQ-F series FX5UC-xMy/z(x=32,64,96, y=T,R, z=D,DSS) with serial number 179**** and prior and versions prior to 1.073, Mitsubishi Electric MELSEC iQ-F series FX5UC-32MT/DS-TS versions prior to 1.270, Mitsubishi Electric MELSEC iQ-F series FX5UC-32MT/DSS-TS versions prior to 1.270, Mitsubishi Electric MELSEC iQ-F series FX5UC-32MR/DS-TS versions prior to 1.270, Mitsubishi Electric MELSEC iQ-F series FX5UJ-xMy/z(x=24,40,60, y=T,R, z=ES,ESS) versions prior to 1.030, Mitsubishi Electric MELSEC iQ-F series FX5UJ-xMy/ES-A(x=24,40,60, y=T,R) versions prior to 1.031 and Mitsubishi Electric MELSEC iQ-F series FX5S-xMy/z(x=30,40,60,80, y=T,R, z=ES,ESS) version 1.000 allows a remote unauthenticated attacker to cause a temporary DoS condition for the product's communication by sending specially crafted packets.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20
References: https://jvn.jp/vu/JVNVU95926817/index.html; https://www.cisa.gov/uscert/ics/advisories/icsa-22-139-01; https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-004_en.pdf
CVE: CVE-2022-28924
Published: 2022-05-18
Description: An information disclosure vulnerability in UniverSIS-Students before v1.5.0 allows attackers to obtain sensitive information via a crafted GET request to the endpoint /api/students/me/courses/.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-668
References: https://suumcuique.org/blog/posts/information-disclosure-vulnerability-universis; https://suumcuique.org/blog/posts/information-disclosure-vulnerability-universis
CVE: CVE-2022-29445
Published: 2022-05-18
Description: Authenticated (administrator or higher role) Local File Inclusion (LFI) vulnerability in Wow-Company's Popup Box plugin <= 2.1.2 at WordPress.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-706, CWE-706
References: https://patchstack.com/database/vulnerability/popup-box/wordpress-popup-box-plugin-2-1-2-authenticated-local-file-inclusion-lfi-vulnerability; https://wordpress.org/plugins/popup-box/#developers; https://patchstack.com/database/vulnerability/popup-box/wordpress-popup-box-plugin-2-1-2-authenticated-local-file-inclusion-lfi-vulnerability
CVE: CVE-2022-30596
Published: 2022-05-18
Description: A flaw was found in moodle where ID numbers displayed when bulk allocating markers to assignments required additional sanitizing to prevent a stored XSS risk.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-74204; https://bugzilla.redhat.com/show_bug.cgi?id=2083583; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OGF35EN5K2R6X3NTY3XPZSJ3UDASMXI6/
CVE: CVE-2022-25617
Published: 2022-05-18
Description: Reflected Cross-Site Scripting (XSS) vulnerability in Code Snippets plugin <= 2.14.3 at WordPress via &orderby vulnerable parameter.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/code-snippets/wordpress-code-snippets-plugin-2-14-3-authenticated-reflected-cross-site-scripting-xss-vulnerability; https://wordpress.org/plugins/code-snippets/; https://patchstack.com/database/vulnerability/code-snippets/wordpress-code-snippets-plugin-2-14-3-authenticated-reflected-cross-site-scripting-xss-vulnerability
CVE: CVE-2022-28921
Published: 2022-05-18
Description: A Cross-Site Request Forgery (CSRF) vulnerability discovered in BlogEngine.Net v3.3.8.0 allows unauthenticated attackers to read arbitrary files on the hosting web server.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://blogengine.io/; https://www.0xlanks.me/blog/cve-2022-28921-advisory/; https://blogengine.io/
CVE: CVE-2022-30111
Published: 2022-05-18
Description: Due to the use of an insecure algorithm for rolling codes in MCK Smartlock 1.0, allows attackers to unlock the mechanism via replay attacks.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-327
References: https://tiger-team-1337.blogspot.com/2022/05/rf-remote-mck-lock-predictable-rolling.html; https://twitter.com/Kevin2600/status/[PII_REDACTED]19038213; https://www.youtube.com/watch?v=EruaGuE-cWI
CVE: CVE-2022-30597
Published: 2022-05-18
Description: A flaw was found in moodle where the description user field was not hidden when being set as a hidden user field.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-472
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-74318; https://bugzilla.redhat.com/show_bug.cgi?id=2083585; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OGF35EN5K2R6X3NTY3XPZSJ3UDASMXI6/
CVE: CVE-2022-30598
Published: 2022-05-18
Description: A flaw was found in moodle where global search results could include author information on some activities where a user may not otherwise have access to it.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-71623; https://bugzilla.redhat.com/show_bug.cgi?id=2083592; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OGF35EN5K2R6X3NTY3XPZSJ3UDASMXI6/
CVE: CVE-2022-30599
Published: 2022-05-18
Description: A flaw was found in moodle where an SQL injection risk was identified in Badges code relating to configuring criteria.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-74333; https://bugzilla.redhat.com/show_bug.cgi?id=2083610; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OGF35EN5K2R6X3NTY3XPZSJ3UDASMXI6/
CVE: CVE-2022-30600
Published: 2022-05-18
Description: A flaw was found in moodle where logic used to count failed login attempts could result in the account lockout threshold being bypassed.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-682, CWE-682
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-73736; https://bugzilla.redhat.com/show_bug.cgi?id=2083613; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OGF35EN5K2R6X3NTY3XPZSJ3UDASMXI6/
CVE: CVE-2021-38944
Published: 2022-05-18
Description: IBM DataPower Gateway 10.0.2.0 through 1.0.3.0, 10.0.1.0 through 10.0.1.5, and 2018.4.1.0 through 2018.4.1.18 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking. IBM X-Force ID: 211236.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/211236; https://www.ibm.com/support/pages/node/6587070; https://exchange.xforce.ibmcloud.com/vulnerabilities/211236
CVE: CVE-2022-1771
Published: 2022-05-18
Description: Uncontrolled Recursion in GitHub repository vim/vim prior to 8.2.4975.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-674, CWE-674
References: https://github.com/vim/vim/commit/51f0bfb88a3554ca2dde777d78a59880d1ee37a8; https://huntr.dev/bounties/faa74175-5317-4b71-a363-dfc39094ecbb; https://security.gentoo.org/glsa/202208-32
CVE: CVE-2022-30033
Published: 2022-05-18
Description: Tenda TX9 Pro V22.03.02.10 is vulnerable to Buffer Overflow via the functtion setIPv6Status() in httpd module.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120
References: https://github.com/H4niz/Vulnerability/blob/main/Tenda-TX9-V22.03.02.10-19042022-2.md; https://github.com/H4niz/Vulnerability/blob/main/Tenda-TX9-V22.03.02.10-19042022-2.md
CVE: CVE-2022-30990
Published: 2022-05-18
Description: Sensitive information disclosure due to insecure folder permissions. The following products are affected: Acronis Cyber Protect 15 (Linux) before build 29240, Acronis Agent (Linux) before build 28037
CVSS Score: 7.5 (HIGH)
CWE: CWE-200, CWE-732
References: https://security-advisory.acronis.com/advisories/SEC-2299; https://security-advisory.acronis.com/advisories/SEC-2299
CVE: CVE-2022-30991
Published: 2022-05-18
Description: HTML injection via report name. The following products are affected: Acronis Cyber Protect 15 (Linux, Windows) before build 29240
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-74, CWE-79
References: https://security-advisory.acronis.com/advisories/SEC-3928; https://security-advisory.acronis.com/advisories/SEC-3928
CVE: CVE-2022-30992
Published: 2022-05-18
Description: Open redirect via user-controlled query parameter. The following products are affected: Acronis Cyber Protect 15 (Linux, Windows) before build 29240
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601, CWE-601
References: https://security-advisory.acronis.com/advisories/SEC-2917; https://security-advisory.acronis.com/advisories/SEC-2917
CVE: CVE-2022-30993
Published: 2022-05-18
Description: Cleartext transmission of sensitive information. The following products are affected: Acronis Cyber Protect 15 (Linux, Windows) before build 29240
CVSS Score: 7.5 (HIGH)
CWE: CWE-319, CWE-319
References: https://security-advisory.acronis.com/advisories/SEC-2441; https://security-advisory.acronis.com/advisories/SEC-2441
CVE: CVE-2022-30994
Published: 2022-05-18
Description: Cleartext transmission of sensitive information. The following products are affected: Acronis Cyber Protect 15 (Windows) before build 29240
CVSS Score: 7.5 (HIGH)
CWE: CWE-319, CWE-319
References: https://security-advisory.acronis.com/advisories/SEC-2388; https://security-advisory.acronis.com/advisories/SEC-2388
CVE: CVE-2022-1774
Published: 2022-05-18
Description: Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository jgraph/drawio prior to 18.0.7.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-200, CWE-601
References: https://github.com/jgraph/drawio/commit/c63f3a04450f30798df47f9badbc74eb8a69fbdf; https://huntr.dev/bounties/6ac07c49-bb7f-47b5-b361-33e6757b8757; https://github.com/jgraph/drawio/commit/c63f3a04450f30798df47f9badbc74eb8a69fbdf
CVE: CVE-2022-29229
Published: 2022-05-18
Description: CaSS is a Competency and Skills System. CaSS Library, (npm:cassproject) has a missing cryptographic step when storing cryptographic keys that can allow a server administrator access to an account’s cryptographic keys. This affects CaSS servers using standalone username/password authentication, which uses a method that expects e2e cryptographic security of authorization credentials. The issue has been patched in 1.5.8, however, the vulnerable accounts are only resecured when the user next logs in using standalone authentication, as the data required to resecure the account is not available to the server. The issue may be mitigated by using SSO or client side certificates to log in. Please note that SSO and client side certificate authentication does not have this expectation of no-knowledge credential access, and cryptographic keys are available to the server administrator.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-325
References: https://github.com/cassproject/CASS/releases/tag/1.5.8; https://github.com/cassproject/CASS/security/advisories/GHSA-7qcx-4p32-qcmx; https://github.com/cassproject/CASS/releases/tag/1.5.8
CVE: CVE-2022-29230
Published: 2022-05-18
Description: Hydrogen is a React-based framework for building dynamic, Shopify-powered custom storefronts. There is a potential Cross-Site Scripting (XSS) vulnerability where an arbitrary user is able to execute scripts on pages that are built with Hydrogen. This affects all versions of Hydrogen starting from version 0.10.0 to 0.18.0. This vulnerability is exploitable in applications whose hydrating data is user controlled. All Hydrogen users should upgrade their project to version 0.19.0. There is no current workaround, and users should update as soon as possible. Additionally, the Content Security Policy is not an effective mitigation for this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-79
References: https://github.com/Shopify/hydrogen/pull/1272; https://github.com/Shopify/hydrogen/releases/tag/%40shopify/hydrogen%400.19.0; https://github.com/Shopify/hydrogen/security/advisories/GHSA-6j22-wv8g-894f
CVE: CVE-2022-30138
Published: 2022-05-18
Description: Windows Print Spooler Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30138; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-30138
CVE: CVE-2022-28348
Published: 2022-05-19
Description: Arm Mali GPU Kernel Driver (Midgard r4p0 through r31p0, Bifrost r0p0 through r36p0 before r37p0, and Valhall r19p0 through r36p0 before r37p0) allows improper GPU memory operations to reach a use-after-free situation.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities; https://developer.arm.com/support/arm-security-updates; https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities
CVE: CVE-2022-28349
Published: 2022-05-19
Description: Arm Mali GPU Kernel Driver has a use-after-free: Midgard r28p0 through r29p0 before r30p0, Bifrost r17p0 through r23p0 before r24p0, and Valhall r19p0 through r23p0 before r24p0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities; https://developer.arm.com/support/arm-security-updates; https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities
CVE: CVE-2022-28350
Published: 2022-05-19
Description: Arm Mali GPU Kernel Driver allows improper GPU operations in Valhall r29p0 through r36p0 before r37p0 to reach a use-after-free situation.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities; https://developer.arm.com/support/arm-security-updates; https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities