deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-35239
Published: 2022-08-16
Description: The image file management page of SolarView Compact SV-CPT-MC310 Ver.7.23 and earlier, and SV-CPT-MC310F Ver.7.23 and earlier contains an insufficient verification vulnerability when uploading files. If this vulnerability is exploited, arbitrary PHP code may be executed if a remote authenticated attacker uploads a specially crafted PHP file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: https://jvn.jp/en/vu/JVNVU93696585/; https://www.contec.com/jp/api/downloadlogger?download=/jp/-/media/Contec/jp/support/security-info/contec_security_solarview_220727.pdf; https://www.contec.com/jp/download/donwload-list/?itemid=b28c8b7c-9f40-40b2-843c-b5b04c035b0e#firmware
CVE: CVE-2022-35734
Published: 2022-08-16
Description: 'Hulu / フールー' App for Android from version 3.0.47 to the version prior to 3.1.2 uses a hard-coded API key for an external service. By exploiting this vulnerability, API key for an external service may be obtained by analyzing data in the app.
CVSS Score: 7.5 (HIGH)
CWE: CWE-798
References: https://jvn.jp/en/jp/JVN40907489/index.html; https://jvn.jp/en/jp/JVN40907489/index.html
CVE: CVE-2022-36293
Published: 2022-08-16
Description: Buffer overflow vulnerability in Nintendo Wi-Fi Network Adaptor WAP-001 All versions allows an attacker with an administrative privilege to execute arbitrary code via unspecified vectors.
CVSS Score: 7.2 (HIGH)
CWE: CWE-120
References: https://jvn.jp/en/jp/JVN17625382/index.html; https://www.nintendo.co.jp/support/information/2022/0720.html; https://jvn.jp/en/jp/JVN17625382/index.html
CVE: CVE-2022-36344
Published: 2022-08-16
Description: An unquoted search path vulnerability exists in 'JustSystems JUST Online Update for J-License' bundled with multiple products for corporate users as in Ichitaro through Pro5 and others. Since the affected product starts another program with an unquoted file path, a malicious file may be executed with the privilege of the Windows service if it is placed in a certain path. Affected products are bundled with the following product series: Office and Office Integrated Software, ATOK, Hanako, JUST PDF, Shuriken, Homepage Builder, JUST School, JUST Smile Class, JUST Smile, JUST Frontier, JUST Jump, and Tri-De DetaProtect.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-428
References: https://jvn.jp/en/jp/JVN57073973/index.html; https://www.justsystems.com/jp/corporate/info/js22001.html; https://jvn.jp/en/jp/JVN57073973/index.html
CVE: CVE-2022-36381
Published: 2022-08-16
Description: OS command injection vulnerability in Nintendo Wi-Fi Network Adaptor WAP-001 All versions allows an attacker with an administrative privilege to execute arbitrary OS commands via unspecified vectors.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://jvn.jp/en/jp/JVN17625382/index.html; https://www.nintendo.co.jp/support/information/2022/0720.html; https://jvn.jp/en/jp/JVN17625382/index.html
CVE: CVE-2022-2838
Published: 2022-08-16
Description: In Eclipse Sphinx™ before version 0.13.1, Apache Xerces XML Parser was used without disabling processing of referenced external entities allowing the injection of arbitrary definitions which is able to access local files and expose their contents via HTTP requests.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-611, CWE-611
References: https://bugs.eclipse.org/580542; https://bugs.eclipse.org/580542
CVE: CVE-2021-30490
Published: 2022-08-16
Description: upsMonitor in ViewPower (aka ViewPowerHTML) 1.04-21012 through 1.04-21353 has insecure permissions for the service binary that enable an Authenticated User to modify files, allowing for privilege escalation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: https://www.0x90.zone/binary/reverse/exploitation/2020/08/16/Privilege-Escalation-ViewPower.html; https://www.power-software-download.com/viewpower.html; https://www.0x90.zone/binary/reverse/exploitation/2020/08/16/Privilege-Escalation-ViewPower.html
CVE: CVE-2022-29959
Published: 2022-08-16
Description: Emerson OpenBSI through 2022-04-29 mishandles credential storage. It is an engineering environment for the ControlWave and Bristol Babcock line of RTUs. This environment provides access control functionality through user authentication and privilege management. The credentials for various users are stored insecurely in the SecUsers.ini file by using a simple string transformation rather than a cryptographic mechanism.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-522
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-221-03; https://www.forescout.com/blog/; https://www.cisa.gov/uscert/ics/advisories/icsa-22-221-03
CVE: CVE-2022-30264
Published: 2022-08-16
Description: The Emerson ROC and FloBoss RTU product lines through 2022-05-02 perform insecure filesystem operations. They utilize the ROC protocol (4000/TCP, 5000/TCP) for communications between a master terminal and RTUs. Opcode 203 of this protocol allows a master terminal to transfer files to and from the flash filesystem and carrying out arbitrary file and directory read, write, and delete operations.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-345
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-223-04; https://www.forescout.com/blog/; https://www.cisa.gov/uscert/ics/advisories/icsa-22-223-04
CVE: CVE-2022-36272
Published: 2022-08-16
Description: Mingsoft MCMS 5.2.8 was discovered to contain a SQL injection vulnerability in /mdiy/page/verify URI via fieldName parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/ming-soft/MCMS/issues/97; https://github.com/ming-soft/MCMS/issues/97
CVE: CVE-2022-36273
Published: 2022-08-16
Description: Tenda AC9 V15.03.2.21_cn is vulnerable to command injection via goform/SetSysTimeCfg.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/F0und-icu/CVEIDs/tree/main/TendaAC9; https://github.com/F0und-icu/CVEIDs/tree/main/TendaAC9
CVE: CVE-2022-36530
Published: 2022-08-16
Description: An issue was discovered in rageframe2 2.6.37. There is a XSS vulnerability in the user agent related parameters of the info.php page.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://rageframe2.com; https://github.com/jianyan74/rageframe2; https://github.com/jianyan74/rageframe2/issues/106
CVE: CVE-2022-36599
Published: 2022-08-16
Description: Mingsoft MCMS 5.2.8 was discovered to contain a SQL injection vulnerability in /mdiy/model/delete URI via models Lists.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://gitee.com/mingSoft/MCMS/issues/I5I1P5; https://gitee.com/mingSoft/MCMS/issues/I5I1P5
CVE: CVE-2022-38362
Published: 2022-08-16
Description: Apache Airflow Docker's Provider prior to 3.0.0 shipped with an example DAG that was vulnerable to (authenticated) remote code exploit of code on the Airflow worker host.
CVSS Score: 8.8 (HIGH)
References: http://www.openwall.com/lists/oss-security/2022/08/16/1; https://lists.apache.org/thread/614p38nf4gbk8xhvnskj9b1sqo2dknkb; http://www.openwall.com/lists/oss-security/2022/08/16/1
CVE: CVE-2022-38192
Published: 2022-08-16
Description: A stored Cross Site Scripting (XSS) vulnerability in Esri Portal for ArcGIS may allow a remote, authenticated attacker to pass and store malicious strings via crafted queries which when accessed could potentially execute arbitrary JavaScript code in the user’s browser.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/portal-for-arcgis-security-2022-update-1-patch/; https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/portal-for-arcgis-security-2022-update-1-patch/
CVE: CVE-2022-38193
Published: 2022-08-16
Description: There is a code injection vulnerability in Esri Portal for ArcGIS versions 10.8.1 and below that may allow a remote, unauthenticated attacker to pass strings which could potentially cause arbitrary code execution.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-95, CWE-94
References: https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/portal-for-arcgis-security-2022-update-1-patch/; https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/portal-for-arcgis-security-2022-update-1-patch/
CVE: CVE-2022-38194
Published: 2022-08-16
Description: In Esri Portal for ArcGIS versions 10.8.1, a system property is not properly encrypted. This may lead to a local user reading sensitive information from a properties file.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-311, CWE-311
References: https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/portal-for-arcgis-security-2022-update-1-patch/; https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/portal-for-arcgis-security-2022-update-1-patch/
CVE: CVE-2022-30575
Published: 2022-08-16
Description: The Web Console component of TIBCO Software Inc.'s TIBCO Data Science - Workbench, TIBCO Statistica, TIBCO Statistica - Estore Edition, and TIBCO Statistica Trial contains easily exploitable Reflected Cross Site Scripting (XSS) vulnerabilities that allow a low privileged attacker with network access to execute scripts targeting the affected system or the victim's local system. Affected releases are TIBCO Software Inc.'s TIBCO Data Science - Workbench: versions 14.0.0 and below, TIBCO Statistica: versions 14.0.0 and below, TIBCO Statistica - Estore Edition: versions 14.0.0 and below, and TIBCO Statistica Trial: versions 14.0.0 and below.
CVSS Score: 7.3 (HIGH)
CWE: CWE-79
References: https://www.tibco.com/services/support/advisories; https://www.tibco.com/support/advisories/2022/08/tibco-security-advisory-august-16-2022-tibco-statistica-cve-2022-30575; https://www.tibco.com/services/support/advisories
CVE: CVE-2022-30576
Published: 2022-08-16
Description: The Web Console component of TIBCO Software Inc.'s TIBCO Data Science - Workbench, TIBCO Statistica, TIBCO Statistica - Estore Edition, and TIBCO Statistica Trial contains an easily exploitable vulnerability that allows a low privileged attacker with network access to execute Stored Cross Site Scripting (XSS) on the affected system. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.'s TIBCO Data Science - Workbench: versions 14.0.0 and below, TIBCO Statistica: versions 14.0.0 and below, TIBCO Statistica - Estore Edition: versions 14.0.0 and below, and TIBCO Statistica Trial: versions 14.0.0 and below.
CVSS Score: 8.7 (HIGH)
CWE: CWE-79
References: https://www.tibco.com/services/support/advisories; https://www.tibco.com/support/advisories/2022/08/tibco-security-advisory-august-16-2022-tibco-statistica-cve-2022-30576; https://www.tibco.com/services/support/advisories
CVE: CVE-2022-36242
Published: 2022-08-16
Description: Clinic's Patient Management System v1.0 is vulnerable to SQL Injection via /pms/update_medicine.php?id=.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/MouZhou/bug_report/blob/main/vendors/oretnom23/clinics-patient-management-system/SQLi-1.md; https://github.com/MouZhou/bug_report/blob/main/vendors/oretnom23/clinics-patient-management-system/SQLi-1.md
CVE: CVE-2022-38184
Published: 2022-08-16
Description: There is an improper access control vulnerability in Portal for ArcGIS versions 10.8.1 and below which could allow a remote, unauthenticated attacker to access an API that may induce Esri Portal for ArcGIS to read arbitrary URLs.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/portal-for-arcgis-security-2022-update-1-patch/; https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/portal-for-arcgis-security-2022-update-1-patch/
CVE: CVE-2022-38189
Published: 2022-08-16
Description: A stored Cross Site Scripting (XSS) vulnerability in Esri Portal for ArcGIS may allow a remote, authenticated attacker to pass and store malicious strings via crafted queries which when accessed could potentially execute arbitrary JavaScript code in the user’s browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/portal-for-arcgis-security-2022-update-1-patch/; https://www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/portal-for-arcgis-security-2022-update-1-patch/
CVE: CVE-2021-39035
Published: 2022-08-16
Description: IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.5, 6.1.0.0 through 6.1.0.4, and 6.1.1.0 through 6.1.1.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 213965.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/213965; https://www.ibm.com/support/pages/node/6612499; https://exchange.xforce.ibmcloud.com/vulnerabilities/213965
CVE: CVE-2021-39085
Published: 2022-08-16
Description: IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.5, 6.1.0.0 through 6.1.0.4, and 6.1.1.0 through 6.1.1.1 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 215888.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/215888; https://www.ibm.com/support/pages/node/6612505; https://exchange.xforce.ibmcloud.com/vulnerabilities/215888
CVE: CVE-2021-39086
Published: 2022-08-16
Description: IBM Sterling File Gateway 6.0.0.0 through 6.0.3.5, 6.1.0.0 through 6.1.0.4, and 6.1.1.0 through 6.1.1.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 215889.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-209
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/215889; https://www.ibm.com/support/pages/node/6612537; https://exchange.xforce.ibmcloud.com/vulnerabilities/215889
CVE: CVE-2021-39087
Published: 2022-08-16
Description: IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.5, 6.1.0.0 through 6.1.0.4, and 6.1.1.0 through 6.1.1.1 could allow an authenticated user to obtain sensitive information due to improper permission controls. IBM X-Force ID: 216109.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-276
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/216109; https://www.ibm.com/support/pages/node/6612541; https://exchange.xforce.ibmcloud.com/vulnerabilities/216109
CVE: CVE-2022-2843
Published: 2022-08-16
Description: A vulnerability was found in MotoPress Timetable and Event Schedule. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /wp-admin/admin-ajax.php of the component Quick Edit. The manipulation of the argument post_title with the input <img src=x onerror=alert`2`> leads to cross site scripting. The attack may be launched remotely. VDB-206486 is the identifier assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://vuldb.com/?id.206486; https://vuldb.com/?id.206486
CVE: CVE-2022-2844
Published: 2022-08-16
Description: A vulnerability classified as problematic has been found in MotoPress Timetable and Event Schedule up to 1.4.06. This affects an unknown part of the file /wp/?cpmvc_id=1&cpmvc_do_action=mvparse&f=datafeed&calid=1&month_index=1&method=adddetails&id=2 of the component Calendar Handler. The manipulation of the argument Subject/Location/Description leads to cross site scripting. It is possible to initiate the attack remotely. The associated identifier of this vulnerability is VDB-206487.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://vuldb.com/?id.206487; https://vuldb.com/?id.206487
CVE: CVE-2022-2846
Published: 2022-08-16
Description: The Calendar Event Multi View WordPress plugin before 1.4.07 does not have any authorisation and CSRF checks in place when creating an event, and is also lacking sanitisation as well as escaping in some of the event fields. This could allow unauthenticated attackers to create arbitrary events and put Cross-Site Scripting payloads in it.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-862, CWE-352, CWE-862
References: http://packetstormsecurity.com/files/171697/Calendar-Event-Multi-View-1.4.07-Cross-Site-Scripting.html; https://wpscan.com/vulnerability/95f92062-08ce-478a-a2bc-6d026adf657c; http://packetstormsecurity.com/files/171697/Calendar-Event-Multi-View-1.4.07-Cross-Site-Scripting.html
CVE: CVE-2022-2847
Published: 2022-08-16
Description: A vulnerability, which was classified as critical, has been found in SourceCodester Guest Management System. This issue affects some unknown processing of the file /guestmanagement/front.php. The manipulation of the argument rid leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-206489 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://s1.ax1x.com/2022/08/13/vtDZfe.png; https://vuldb.com/?id.206489; https://s1.ax1x.com/2022/08/13/vtDZfe.png
CVE: CVE-2022-37393
Published: 2022-08-16
Description: Zimbra's sudo configuration permits the zimbra user to execute the zmslapd binary as root with arbitrary parameters. As part of its intended functionality, zmslapd can load a user-defined configuration file, which includes plugins in the form of .so files, which also execute as root.
CVSS Score: 7.8 (HIGH)
CWE: CWE-284
References: https://attackerkb.com/topics/92AeLOE1M1/cve-2022-37393/rapid7-analysis; https://darrenmartyn.ie/2021/10/27/zimbra-zmslapd-local-root-exploit/; https://github.com/rapid7/metasploit-framework/pull/16807
CVE: CVE-2020-10710
Published: 2022-08-16
Description: A flaw was found where the Plaintext Candlepin password is disclosed while updating Red Hat Satellite through the satellite-installer. This flaw allows an attacker with sufficiently high privileges, such as root, to retrieve the Candlepin plaintext password.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-522, CWE-522
References: https://bugzilla.redhat.com/show_bug.cgi?id=1816747; https://bugzilla.redhat.com/show_bug.cgi?id=1816747
CVE: CVE-2020-10728
Published: 2022-08-16
Description: A flaw was found in automationbroker/apb container in versions up to and including 2.0.4-1. This container grants all users sudoer permissions allowing an unauthorized user with access to the running container the ability to escalate their own privileges. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-266, CWE-269
References: https://bugzilla.redhat.com/show_bug.cgi?id=1829674; https://bugzilla.redhat.com/show_bug.cgi?id=1829674
CVE: CVE-2020-14320
Published: 2022-08-16
Description: In Moodle before 3.9.1, 3.8.4 and 3.7.7, the filter in the admin task log required extra sanitizing to prevent a reflected XSS risk.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://moodle.org/mod/forum/discuss.php?d=407392; https://moodle.org/mod/forum/discuss.php?d=407392
CVE: CVE-2020-14321
Published: 2022-08-16
Description: In Moodle before 3.9.1, 3.8.4, 3.7.7 and 3.5.13, teachers of a course were able to assign themselves the manager role within that course.
CVSS Score: 8.8 (HIGH)
CWE: CWE-863, CWE-863
References: https://moodle.org/mod/forum/discuss.php?d=407393; https://moodle.org/mod/forum/discuss.php?d=407393
CVE: CVE-2020-14322
Published: 2022-08-16
Description: In Moodle before 3.9.1, 3.8.4, 3.7.7 and 3.5.13, yui_combo needed to limit the amount of files it can load to help mitigate the risk of denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770, CWE-770
References: https://moodle.org/mod/forum/discuss.php?d=407394; https://moodle.org/mod/forum/discuss.php?d=407394
CVE: CVE-2020-14379
Published: 2022-08-16
Description: A flaw was found in Red Hat AMQ Broker in a way that a XEE attack can be done via Broker's configuration files, leading to denial of service and information disclosure.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-611, CWE-611
References: https://bugzilla.redhat.com/show_bug.cgi?id=1840862; https://bugzilla.redhat.com/show_bug.cgi?id=1840862
CVE: CVE-2020-1755
Published: 2022-08-16
Description: In Moodle before 3.8.2, 3.7.5, 3.6.9 and 3.5.11, X-Forwarded-For headers could be used to spoof a user's IP, in order to bypass remote address checks.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-345, CWE-345
References: https://moodle.org/mod/forum/discuss.php?d=398351; https://moodle.org/mod/forum/discuss.php?d=398351
CVE: CVE-2020-1756
Published: 2022-08-16
Description: In Moodle before 3.8.2, 3.7.5, 3.6.9 and 3.5.11, insufficient input escaping was applied to the PHP unit webrunner admin tool.
CVSS Score: 7.2 (HIGH)
CWE: CWE-20, CWE-20
References: https://moodle.org/mod/forum/discuss.php?d=398352; https://moodle.org/mod/forum/discuss.php?d=398352
CVE: CVE-2022-2661
Published: 2022-08-16
Description: Sequi PortBloque S has an improper authorization vulnerability, which may allow a low-privileged user to perform administrative functions using specifically crafted requests.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-285
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-228-07; https://www.cisa.gov/uscert/ics/advisories/icsa-22-228-07
CVE: CVE-2022-2662
Published: 2022-08-16
Description: Sequi PortBloque S has a improper authentication issues which may allow an attacker to bypass the authentication process and gain user-level access to the device.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-287
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-228-07; https://www.cisa.gov/uscert/ics/advisories/icsa-22-228-07
CVE: CVE-2022-2831
Published: 2022-08-16
Description: A flaw was found in Blender 3.3.0. An interger overflow in source/blender/blendthumb/src/blendthumb_extract.cc may lead to program crash or memory corruption.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190, CWE-125, CWE-787
References: https://developer.blender.org/T99705; https://developer.blender.org/rB32df09b2416a6961704eca0fe73534c8c4e715b2; https://developer.blender.org/rBb1329d7eaa52a11c73b75d19d20bd8f6d11ac535
CVE: CVE-2022-2832
Published: 2022-08-16
Description: A flaw was found in Blender 3.3.0. A null pointer dereference exists in source/blender/gpu/opengl/gl_backend.cc that may lead to loss of confidentiality and integrity.
CVSS Score: 7.5 (HIGH)
CWE: CWE-395, CWE-476
References: https://developer.blender.org/D15463; https://developer.blender.org/T99706; https://developer.blender.org/rB00dc7477022acdd969e4d709a235c0be819efa6c
CVE: CVE-2022-2833
Published: 2022-08-16
Description: Endless Infinite loop in Blender-thumnailing due to logical bugs.
CVSS Score: 7.5 (HIGH)
CWE: CWE-835
References: https://developer.blender.org/T99711; https://developer.blender.org/rB24a2b5cb1292f769dd86e[PII_REDACTED]76d5e9512; https://developer.blender.org/T99711
CVE: CVE-2022-34253
Published: 2022-08-16
Description: Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an XML Injection vulnerability in the Widgets Module. An attacker with admin privileges can trigger a specially crafted script to achieve remote code execution. Exploitation of this issue does not require user interaction.
CVSS Score: 7.2 (HIGH)
CWE: CWE-91
References: https://helpx.adobe.com/security/products/magento/apsb22-38.html; https://helpx.adobe.com/security/products/magento/apsb22-38.html