deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-43756
Published: 2022-06-15
Description: Adobe Media Encoder versions 22.0, 15.4.2 (and earlier) are affected by an Out-of-bounds Write vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://helpx.adobe.com/security/products/media-encoder/apsb21-118.html; https://helpx.adobe.com/security/products/media-encoder/apsb21-118.html
CVE: CVE-2022-24004
Published: 2022-06-15
Description: A Stored Cross-Site Scripting (XSS) vulnerability was discovered in Messenger/messenger_ajax.php in REDCap 12.0.11. This issue allows any authenticated user to inject arbitrary code into the messenger title (aka new_title) field when editing an existing conversation. The payload executes in the browser of any conversation participant with the sidebar shown.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://labs.nettitude.com/blog/cve-2022-24004-cve-2022-24127-vanderbilt-redcap-stored-cross-site-scripting/; https://www.evms.edu/research/resources_services/redcap/redcap_change_log/; https://labs.nettitude.com/blog/cve-2022-24004-cve-2022-24127-vanderbilt-redcap-stored-cross-site-scripting/
CVE: CVE-2022-24127
Published: 2022-06-15
Description: A Stored Cross-Site Scripting (XSS) vulnerability was discovered in ProjectGeneral/edit_project_settings.php in REDCap 12.0.11. This issue allows any user with project management permissions to inject arbitrary code into the project title (app_title) field when editing an existing project. The payload is then reflected within the title tag of the page.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://labs.nettitude.com/blog/cve-2022-24004-cve-2022-24127-vanderbilt-redcap-stored-cross-site-scripting/; https://www.evms.edu/research/resources_services/redcap/redcap_change_log/; https://labs.nettitude.com/blog/cve-2022-24004-cve-2022-24127-vanderbilt-redcap-stored-cross-site-scripting/
CVE: CVE-2022-26057
Published: 2022-06-15
Description: Vulnerabilities in the Mint WorkBench allow a low privileged attacker to create and write to a file anywhere on the file system as SYSTEM with arbitrary content as long as the file does not already exist. The Mint WorkBench installer file allows a low-privileged user to run a "repair" operation on the product
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-269, CWE-269
References: https://search.abb.com/library/Download.aspx?DocumentID=9AKK108467A0305&LanguageCode=en&DocumentPartId=&Action=Launch&_ga=2.38[PII_REDACTED]47[PII_REDACTED][PII_REDACTED]97[PII_REDACTED]; https://search.abb.com/library/Download.aspx?DocumentID=9AKK108467A0305&LanguageCode=en&DocumentPartId=&Action=Launch&_ga=2.38[PII_REDACTED]47[PII_REDACTED][PII_REDACTED]97[PII_REDACTED]
CVE: CVE-2022-29443
Published: 2022-06-15
Description: Multiple Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerabilities in Nicdark's Hotel Booking plugin <= 3.0 at WordPress.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/nd-booking/wordpress-hotel-booking-plugin-3-0-multiple-authenticated-stored-cross-site-scripting-xss-vulnerabilities; https://wordpress.org/plugins/nd-booking/; https://patchstack.com/database/vulnerability/nd-booking/wordpress-hotel-booking-plugin-3-0-multiple-authenticated-stored-cross-site-scripting-xss-vulnerabilities
CVE: CVE-2022-29450
Published: 2022-06-15
Description: Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Admin Management Xtended plugin <= 2.4.4 at WordPress.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://github.com/oliverschloebe/admin-management-xtended/commit/f94732d222414f10ce015e95b5c7c9fba13a8a20; https://patchstack.com/database/vulnerability/admin-management-xtended/wordpress-admin-management-xtended-plugin-2-4-4-multiple-cross-site-request-forgery-csrf-vulnerabilities?_s_id=cve; https://github.com/oliverschloebe/admin-management-xtended/commit/f94732d222414f10ce015e95b5c7c9fba13a8a20
CVE: CVE-2022-31044
Published: 2022-06-15
Description: Rundeck is an open source automation service with a web console, command line tools and a WebAPI. The Key Storage converter plugin mechanism was not enabled correctly in Rundeck 4.2.0 and 4.2.1, resulting in use of the encryption layer for Key Storage possibly not working. Any credentials created or overwritten using Rundeck 4.2.0 or 4.2.1 might result in them being written in plaintext to the backend storage. This affects those using any `Storage Converter` plugin. Rundeck 4.3.1 and 4.2.2 have fixed the code and upon upgrade will re-encrypt any plain text values. Version 4.3.0 does not have the vulnerability, but does not include the patch to re-encrypt plain text values if 4.2.0 or 4.2.1 were used. To prevent plaintext credentials from being stored in Rundeck 4.2.0/4.2.1, write access to key storage can be disabled via ACLs. After upgrading to 4.3.1 or later, write access can be restored.
CVSS Score: 7.5 (HIGH)
CWE: CWE-256, CWE-522
References: https://github.com/rundeck/rundeck/security/advisories/GHSA-hprf-rrwq-jm5c; https://github.com/rundeck/rundeck/security/advisories/GHSA-hprf-rrwq-jm5c
CVE: CVE-2022-31069
Published: 2022-06-15
Description: NestJS Proxy is a NestJS module to decorate and proxy calls. Prior to version 0.7.0, the nestjs-proxy library did not have a way to control when Authorization headers should should be forwarded for specific backend services configured by the application developer. This could have resulted in sensitive information such as OAuth bearer access tokens being inadvertently exposed to such services that should not see them. A new feature has been introduced in the patched version of nestjs-proxy that allows application developers to opt out of forwarding the Authorization headers on a per service basis using the `forwardToken` config setting. Developers are advised to review the README for this library on Github or NPM for further details on how this configuration can be applied. This issue has been fixed in version 0.7.0 of `@finastra/nestjs-proxy`. Users of `@ffdc/nestjs-proxy` are advised that this package has been deprecated and is no longer being maintained or receiving updates. Such users should update their package.json file to use `@finastra/nestjs-proxy` instead.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-200, CWE-200
References: https://github.com/Finastra/finastra-nodejs-libs/pull/231; https://github.com/Finastra/finastra-nodejs-libs/security/advisories/GHSA-j562-c3cw-3p5g; https://github.com/Finastra/finastra-nodejs-libs/pull/231
CVE: CVE-2022-31070
Published: 2022-06-15
Description: NestJS Proxy is a NestJS module to decorate and proxy calls. Prior to version 0.7.0, the nestjs-proxy library did not have a way to block sensitive cookies (e.g. session cookies) from being forwarded to backend services configured by the application developer. This could have led to sensitive cookies being inadvertently exposed to such services that should not see them. The patched version now blocks cookies from being forwarded by default. However developers can configure an allow-list of cookie names by using the `allowedCookies` config setting. This issue has been fixed in version 0.7.0 of `@finastra/nestjs-proxy`. Users of `@ffdc/nestjs-proxy` are advised that this package has been deprecated and is no longer being maintained or receiving updates. Such users should update their package.json file to use `@finastra/nestjs-proxy` instead.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-200
References: https://github.com/Finastra/finastra-nodejs-libs/pull/232; https://github.com/Finastra/finastra-nodejs-libs/security/advisories/GHSA-77mv-4rg7-r8qv; https://github.com/Finastra/finastra-nodejs-libs/pull/232
CVE: CVE-2022-31216
Published: 2022-06-15
Description: Vulnerabilities in the Drive Composer allow a low privileged attacker to create and write to a file anywhere on the file system as SYSTEM with arbitrary content as long as the file does not already exist. The Drive Composer installer file allows a low-privileged user to run a "repair" operation on the product.
CVSS Score: 7.8 (HIGH)
CWE: CWE-59, CWE-59
References: https://search.abb.com/library/Download.aspx?DocumentID=9AKK108467A0305&LanguageCode=en&DocumentPartId=&Action=Launch&_ga=2.38[PII_REDACTED]47[PII_REDACTED][PII_REDACTED]97[PII_REDACTED]; https://search.abb.com/library/Download.aspx?DocumentID=9AKK108467A0305&LanguageCode=en&DocumentPartId=&Action=Launch&_ga=2.38[PII_REDACTED]47[PII_REDACTED][PII_REDACTED]97[PII_REDACTED]
CVE: CVE-2022-31217
Published: 2022-06-15
Description: Vulnerabilities in the Drive Composer allow a low privileged attacker to create and write to a file anywhere on the file system as SYSTEM with arbitrary content as long as the file does not already exist. The Drive Composer installer file allows a low-privileged user to run a "repair" operation on the product.
CVSS Score: 7.8 (HIGH)
CWE: CWE-59, CWE-59
References: https://search.abb.com/library/Download.aspx?DocumentID=9AKK108467A0305&LanguageCode=en&DocumentPartId=&Action=Launch&_ga=2.38[PII_REDACTED]47[PII_REDACTED][PII_REDACTED]97[PII_REDACTED]; https://search.abb.com/library/Download.aspx?DocumentID=9AKK108467A0305&LanguageCode=en&DocumentPartId=&Action=Launch&_ga=2.38[PII_REDACTED]47[PII_REDACTED][PII_REDACTED]97[PII_REDACTED]
CVE: CVE-2022-31218
Published: 2022-06-15
Description: Vulnerabilities in the Drive Composer allow a low privileged attacker to create and write to a file anywhere on the file system as SYSTEM with arbitrary content as long as the file does not already exist. The Drive Composer installer file allows a low-privileged user to run a "repair" operation on the product.
CVSS Score: 7.8 (HIGH)
CWE: CWE-59, CWE-59
References: https://search.abb.com/library/Download.aspx?DocumentID=9AKK108467A0305&LanguageCode=en&DocumentPartId=&Action=Launch&_ga=2.38[PII_REDACTED]47[PII_REDACTED][PII_REDACTED]97[PII_REDACTED]; https://search.abb.com/library/Download.aspx?DocumentID=9AKK108467A0305&LanguageCode=en&DocumentPartId=&Action=Launch&_ga=2.38[PII_REDACTED]47[PII_REDACTED][PII_REDACTED]97[PII_REDACTED]
CVE: CVE-2022-31219
Published: 2022-06-15
Description: Vulnerabilities in the Drive Composer allow a low privileged attacker to create and write to a file anywhere on the file system as SYSTEM with arbitrary content as long as the file does not already exist. The Drive Composer installer file allows a low-privileged user to run a "repair" operation on the product.
CVSS Score: 7.3 (HIGH)
CWE: CWE-59, CWE-59
References: https://search.abb.com/library/Download.aspx?DocumentID=9AKK108467A0305&LanguageCode=en&DocumentPartId=&Action=Launch&_ga=2.38[PII_REDACTED]47[PII_REDACTED][PII_REDACTED]97[PII_REDACTED]; https://search.abb.com/library/Download.aspx?DocumentID=9AKK108467A0305&LanguageCode=en&DocumentPartId=&Action=Launch&_ga=2.38[PII_REDACTED]47[PII_REDACTED][PII_REDACTED]97[PII_REDACTED]
CVE: CVE-2022-32375
Published: 2022-06-15
Description: itsourcecode Advanced School Management System v1.0 is vulnerable to SQL Injection via /school/model/get_timetable.php?id=.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/itsourcecode.com/advanced-school-management-system/SQLi-6.md; https://github.com/k0xx11/bug_report/blob/main/vendors/itsourcecode.com/advanced-school-management-system/SQLi-6.md
CVE: CVE-2022-32376
Published: 2022-06-15
Description: itsourcecode Advanced School Management System v1.0 is vulnerable to SQL Injection via /school/model/get_events.php?event_id=.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/itsourcecode.com/advanced-school-management-system/SQLi-8.md; https://github.com/k0xx11/bug_report/blob/main/vendors/itsourcecode.com/advanced-school-management-system/SQLi-8.md
CVE: CVE-2022-32377
Published: 2022-06-15
Description: itsourcecode Advanced School Management System v1.0 is vulnerable to SQL Injection via /school/model/get_exam_timetable.php?id=.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/itsourcecode.com/advanced-school-management-system/SQLi-9.md; https://github.com/k0xx11/bug_report/blob/main/vendors/itsourcecode.com/advanced-school-management-system/SQLi-9.md
CVE: CVE-2022-32378
Published: 2022-06-15
Description: itsourcecode Advanced School Management System v1.0 is vulnerable to SQL Injection via /school/model/get_teacher_profile.php?my_index=.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/itsourcecode.com/advanced-school-management-system/SQLi-13.md; https://github.com/k0xx11/bug_report/blob/main/vendors/itsourcecode.com/advanced-school-management-system/SQLi-13.md
CVE: CVE-2022-32379
Published: 2022-06-15
Description: itsourcecode Advanced School Management System v1.0 is vulnerable to SQL Injection via /school/model/get_parents_profile.php?my_index=.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/itsourcecode.com/advanced-school-management-system/SQLi-10.md; https://github.com/k0xx11/bug_report/blob/main/vendors/itsourcecode.com/advanced-school-management-system/SQLi-10.md
CVE: CVE-2022-32380
Published: 2022-06-15
Description: itsourcecode Advanced School Management System v1.0 is vulnerable to SQL Injection via /school/model/get_student_subject.php?index=.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/itsourcecode.com/advanced-school-management-system/SQLi-12.md; https://github.com/k0xx11/bug_report/blob/main/vendors/itsourcecode.com/advanced-school-management-system/SQLi-12.md
CVE: CVE-2022-32381
Published: 2022-06-15
Description: itsourcecode Advanced School Management System v1.0 is vulnerable to SQL Injection via /school/model/get_admin_profile.php?my_index=.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/k0xx11/bug_report/blob/main/vendors/itsourcecode.com/advanced-school-management-system/SQLi-11.md; https://github.com/k0xx11/bug_report/blob/main/vendors/itsourcecode.com/advanced-school-management-system/SQLi-11.md
CVE: CVE-2022-32433
Published: 2022-06-15
Description: itsourcecode Advanced School Management System v1.0 is vulnerable to Arbitrary code execution via ip/school/view/all_teacher.php.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: https://github.com/tamchikit/bug_report/blob/main/vendors/itsourcecode.com/advanced-school-management-system/RCE-1.md; https://github.com/tamchikit/bug_report/blob/main/vendors/itsourcecode.com/advanced-school-management-system/RCE-1.md
CVE: CVE-2022-32550
Published: 2022-06-15
Description: An issue was discovered in AgileBits 1Password, involving the method various 1Password apps and integrations used to create connections to the 1Password service. In specific circumstances, this issue allowed a malicious server to convince a 1Password app or integration it is communicating with the 1Password service.
CVSS Score: 4.8 (MEDIUM)
References: https://support.1password.com/kb/202206/; https://support.1password.com/kb/202206/
CVE: CVE-2021-25261
Published: 2022-06-15
Description: Local privilege vulnerability in Yandex Browser for Windows prior to 22.5.0.862 allows a local, low privileged, attacker to execute arbitary code with the SYSTEM privileges through manipulating symlinks to installation file during Yandex Browser update process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-59
References: https://yandex.com/bugbounty/i/hall-of-fame-browser/; https://yandex.com/bugbounty/i/hall-of-fame-browser/
CVE: CVE-2021-36891
Published: 2022-06-15
Description: Cross-Site Request Forgery (CSRF) vulnerability in Photo Gallery by Supsystic plugin <= 1.15.5 at WordPress allows changing the plugin settings.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/gallery-by-supsystic/wordpress-photo-gallery-by-supsystic-plugin-1-15-5-cross-site-request-forgery-csrf-leading-to-plugin-settings-change; https://wordpress.org/plugins/gallery-by-supsystic/#developers; https://patchstack.com/database/vulnerability/gallery-by-supsystic/wordpress-photo-gallery-by-supsystic-plugin-1-15-5-cross-site-request-forgery-csrf-leading-to-plugin-settings-change
CVE: CVE-2021-41415
Published: 2022-06-15
Description: Subscription-Manager v1.0 /main.js has a cross-site scripting (XSS) vulnerability in the machineDetail parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/youranreus/Subscription-Manager/issues/2; https://github.com/youranreus/Subscription-Manager/issues/2
CVE: CVE-2021-41418
Published: 2022-06-15
Description: AriaNg v0.1.0~v1.2.2 is affected by an incorrect access control vulnerability through not authenticating visitors' access rights.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://github.com/Amozing/Am0zang/issues/1; https://github.com/Amozing/Am0zang/issues/1
CVE: CVE-2021-42735
Published: 2022-06-15
Description: Adobe Photoshop version 22.5.1 (and earlier versions ) is affected by an Access of Memory Location After End of Buffer vulnerability, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required to exploit this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-788
References: https://helpx.adobe.com/security/products/photoshop/apsb21-109.html; https://helpx.adobe.com/security/products/photoshop/apsb21-109.html
CVE: CVE-2021-43755
Published: 2022-06-15
Description: Adobe After Effects versions 22.0 (and earlier) and 18.4.2 (and earlier) are affected by an Out-of-bounds Write vulnerability due to insecure handling of a malicious file, potentially resulting in arbitrary code execution in the context of the current user.  User interaction is required to exploit this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://helpx.adobe.com/security/products/after_effects/apsb21-115.html; https://helpx.adobe.com/security/products/after_effects/apsb21-115.html
CVE: CVE-2022-21123
Published: 2022-06-15
Description: Incomplete cleanup of multi-core shared buffers for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-459, CWE-459
References: http://www.openwall.com/lists/oss-security/2022/06/16/1; https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FHTEW3RXU2GW6S3RCPQG4VNCZGI3TOSV/
CVE: CVE-2022-21125
Published: 2022-06-15
Description: Incomplete cleanup of microarchitectural fill buffers on some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-459, CWE-459
References: http://www.openwall.com/lists/oss-security/2022/06/16/1; http://xenbits.xen.org/xsa/advisory-404.html; https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html
CVE: CVE-2022-21127
Published: 2022-06-15
Description: Incomplete cleanup in specific special register read operations for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-459, CWE-459
References: http://www.openwall.com/lists/oss-security/2022/06/16/1; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.debian.org/security/2022/dsa-5178
CVE: CVE-2022-21935
Published: 2022-06-15
Description: A vulnerability in Metasys ADS/ADX/OAS 10 versions prior to 10.1.5 and Metasys ADS/ADX/OAS 11 versions prior to 11.0.2 allows unverified password change.
CVSS Score: 7.5 (HIGH)
CWE: CWE-620, CWE-287
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-165-01; https://www.johnsoncontrols.com/cyber-solutions/security-advisories; https://www.cisa.gov/uscert/ics/advisories/icsa-22-165-01
CVE: CVE-2022-21937
Published: 2022-06-15
Description: Under certain circumstances, a vulnerability in Metasys ADS/ADX/OAS 10 versions prior to 10.1.5 and Metasys ADS/ADX/OAS 11 versions prior to 11.0.2 could allow a user to inject malicious code into the web interface.
CVSS Score: 8.7 (HIGH)
CWE: CWE-79, CWE-79
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-165-01; https://www.johnsoncontrols.com/cyber-solutions/security-advisories; https://www.cisa.gov/uscert/ics/advisories/icsa-22-165-01
CVE: CVE-2022-23823
Published: 2022-06-15
Description: A potential vulnerability in some AMD processors using frequency scaling may allow an authenticated attacker to execute a timing attack to potentially enable information disclosure.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-203
References: https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1038; https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1038
CVE: CVE-2022-28225
Published: 2022-06-15
Description: Local privilege vulnerability in Yandex Browser for Windows prior to 22.3.3.684 allows a local, low privileged, attacker to execute arbitary code with the SYSTEM privileges through manipulating symlinks to installation file during Yandex Browser update process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-59
References: https://yandex.com/bugbounty/i/hall-of-fame-browser/; https://yandex.com/bugbounty/i/hall-of-fame-browser/
CVE: CVE-2022-28226
Published: 2022-06-15
Description: Local privilege vulnerability in Yandex Browser for Windows prior to 22.3.3.801 allows a local, low privileged, attacker to execute arbitary code with the SYSTEM privileges through manipulating temporary files in directory with insecure permissions during Yandex Browser update process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-668
References: https://yandex.com/bugbounty/i/hall-of-fame-browser/; https://yandex.com/bugbounty/i/hall-of-fame-browser/
CVE: CVE-2022-28612
Published: 2022-06-15
Description: Improper Access Control vulnerability leading to multiple Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerabilities in Muneeb's Custom Popup Builder plugin <= 1.3.1 at WordPress.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-284
References: https://patchstack.com/database/vulnerability/m-wp-popup/wordpress-custom-popup-builder-plugin-1-3-1-improper-access-control-vulnerability-leading-to-multiple-authenticated-stored-xss; https://wordpress.org/plugins/m-wp-popup/; https://patchstack.com/database/vulnerability/m-wp-popup/wordpress-custom-popup-builder-plugin-1-3-1-improper-access-control-vulnerability-leading-to-multiple-authenticated-stored-xss
CVE: CVE-2022-28839
Published: 2022-06-15
Description: Adobe Bridge version 12.0.1 (and earlier versions) is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/bridge/apsb22-25.html; https://helpx.adobe.com/security/products/bridge/apsb22-25.html
CVE: CVE-2022-28840
Published: 2022-06-15
Description: Adobe Bridge version 12.0.1 (and earlier versions) is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/bridge/apsb22-25.html; https://helpx.adobe.com/security/products/bridge/apsb22-25.html
CVE: CVE-2022-28841
Published: 2022-06-15
Description: Adobe Bridge version 12.0.1 (and earlier versions) is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://helpx.adobe.com/security/products/bridge/apsb22-25.html; https://helpx.adobe.com/security/products/bridge/apsb22-25.html