deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-27962
Published: 2022-05-03
Description: Bluecms 1.6 has a SQL injection vulnerability at cooike.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/xunyang1/my-vulnerability/issues/1; https://github.com/xunyang1/my-vulnerability/issues/1
CVE: CVE-2022-28505
Published: 2022-05-03
Description: Jfinal_cms 5.1.0 is vulnerable to SQL Injection via com.jflyfox.system.log.LogController.java.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/jflyfox/jfinal_cms/issues/33; https://github.com/jflyfox/jfinal_cms/issues/33
CVE: CVE-2021-46440
Published: 2022-05-03
Description: Storing passwords in a recoverable format in the DOCUMENTATION plugin component of Strapi before 3.6.9 and 4.x before 4.1.5 allows an attacker to access a victim's HTTP request, get the victim's cookie, perform a base64 decode on the victim's cookie, and obtain a cleartext password, leading to getting API documentation for further API attacks.
CVSS Score: 7.5 (HIGH)
CWE: CWE-522
References: http://packetstormsecurity.com/files/166915/Strapi-3.6.8-Password-Disclosure-Insecure-Handling.html; https://github.com/strapi/strapi/pull/12246; https://hub.docker.com/r/strapi/strapi
CVE: CVE-2022-28585
Published: 2022-05-03
Description: EmpireCMS 7.5 has a SQL injection vulnerability in AdClass.php
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/leadscloud/EmpireCMS/issues/5; https://github.com/leadscloud/EmpireCMS/issues/5
CVE: CVE-2022-28588
Published: 2022-05-03
Description: In SpringBootMovie <=1.2 when adding movie names, malicious code can be stored because there are no filtering parameters, resulting in stored XSS.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/lkmc2/SpringBootMovie/issues/3; https://github.com/lkmc2/SpringBootMovie/issues/3
CVE: CVE-2022-28599
Published: 2022-05-03
Description: A stored cross-site scripting (XSS) vulnerability exists in FUEL-CMS 1.5.1 that allows an authenticated user to upload a malicious .pdf file which acts as a stored XSS payload. If this stored XSS payload is triggered by an administrator it will trigger a XSS attack.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/daylightstudio/FUEL-CMS/issues/595; https://github.com/daylightstudio/FUEL-CMS/issues/595
CVE: CVE-2022-29001
Published: 2022-05-03
Description: In SpringBootMovie <=1.2, the uploaded file suffix parameter is not filtered, resulting in arbitrary file upload vulnerability
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: https://github.com/lkmc2/SpringBootMovie/issues/4; https://github.com/lkmc2/SpringBootMovie/issues/4
CVE: CVE-2021-29854
Published: 2022-05-03
Description: IBM Maximo Asset Management 7.6.1.1 and 7.6.1.2 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. By sending a specially crafted HTTP request, a remote attacker could exploit this vulnerability to inject HTTP HOST header, which will allow the attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking. IBM X-Force ID: 205680.
CVSS Score: 7.2 (HIGH)
CWE: CWE-116
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/205680; https://www.ibm.com/support/pages/node/6579187; https://exchange.xforce.ibmcloud.com/vulnerabilities/205680
CVE: CVE-2022-1331
Published: 2022-05-03
Description: In four instances DMARS (All versions prior to v2.1.10.24) does not properly restrict references of XML external entities while processing specific project files, which may allow unauthorized information disclosure.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-611
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-104-01; https://www.cisa.gov/uscert/ics/advisories/icsa-22-104-01
CVE: CVE-2022-22368
Published: 2022-05-03
Description: IBM Spectrum Scale 5.1.0 through 5.1.3.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 221012.
CVSS Score: 7.5 (HIGH)
CWE: CWE-326
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/221012; https://www.ibm.com/support/pages/node/6579139; https://exchange.xforce.ibmcloud.com/vulnerabilities/221012
CVE: CVE-2022-20084
Published: 2022-05-03
Description: In telephony, there is a possible way to disable receiving emergency broadcasts due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06498874; Issue ID: ALPS06498874.
CVSS Score: 7.8 (HIGH)
CWE: CWE-862
References: https://corp.mediatek.com/product-security-bulletin/May-2022; https://corp.mediatek.com/product-security-bulletin/May-2022
CVE: CVE-2022-20085
Published: 2022-05-03
Description: In netdiag, there is a possible symbolic link following due to an improper link resolution. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06308877; Issue ID: ALPS06308877.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-59
References: https://corp.mediatek.com/product-security-bulletin/May-2022; https://corp.mediatek.com/product-security-bulletin/May-2022
CVE: CVE-2022-20087
Published: 2022-05-03
Description: In ccu, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06477970; Issue ID: ALPS06477970.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://corp.mediatek.com/product-security-bulletin/May-2022; https://corp.mediatek.com/product-security-bulletin/May-2022
CVE: CVE-2022-20088
Published: 2022-05-03
Description: In aee driver, there is a possible reference count mistake due to incorrect error handling. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06209201; Issue ID: ALPS06209201.
CVSS Score: 7.8 (HIGH)
CWE: CWE-755
References: https://corp.mediatek.com/product-security-bulletin/May-2022; https://corp.mediatek.com/product-security-bulletin/May-2022
CVE: CVE-2022-20089
Published: 2022-05-03
Description: In aee driver, there is a possible memory corruption due to active debug code. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06240397; Issue ID: ALPS06240397.
CVSS Score: 6.7 (MEDIUM)
References: https://corp.mediatek.com/product-security-bulletin/May-2022; https://corp.mediatek.com/product-security-bulletin/May-2022
CVE: CVE-2022-20090
Published: 2022-05-03
Description: In aee driver, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06209197; Issue ID: ALPS06209197.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-362, CWE-416
References: https://corp.mediatek.com/product-security-bulletin/May-2022; https://corp.mediatek.com/product-security-bulletin/May-2022
CVE: CVE-2022-20091
Published: 2022-05-03
Description: In aee driver, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06209201; Issue ID: ALPS06226345.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-362, CWE-416
References: https://corp.mediatek.com/product-security-bulletin/May-2022; https://corp.mediatek.com/product-security-bulletin/May-2022
CVE: CVE-2022-20092
Published: 2022-05-03
Description: In alac decoder, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06366061; Issue ID: ALPS06366061.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://corp.mediatek.com/product-security-bulletin/May-2022; https://corp.mediatek.com/product-security-bulletin/May-2022
CVE: CVE-2022-20093
Published: 2022-05-03
Description: In telephony, there is a possible way to disable receiving SMS messages due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06498868; Issue ID: ALPS06498868.
CVSS Score: 7.8 (HIGH)
CWE: CWE-862
References: https://corp.mediatek.com/product-security-bulletin/May-2022; https://corp.mediatek.com/product-security-bulletin/May-2022
CVE: CVE-2022-20094
Published: 2022-05-03
Description: In imgsensor, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06479763; Issue ID: ALPS06479734.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://corp.mediatek.com/product-security-bulletin/May-2022; https://corp.mediatek.com/product-security-bulletin/May-2022
CVE: CVE-2022-20095
Published: 2022-05-03
Description: In imgsensor, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06479763; Issue ID: ALPS06479763.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://corp.mediatek.com/product-security-bulletin/May-2022; https://corp.mediatek.com/product-security-bulletin/May-2022
CVE: CVE-2022-20096
Published: 2022-05-03
Description: In camera, there is a possible information disclosure due to uninitialized data. This could lead to local information disclosure with System execution privileges needed. User interaction is no needed for exploitation. Patch ID: ALPS06419003; Issue ID: ALPS06419003.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-908
References: https://corp.mediatek.com/product-security-bulletin/May-2022; https://corp.mediatek.com/product-security-bulletin/May-2022
CVE: CVE-2022-20097
Published: 2022-05-03
Description: In aee daemon, there is a possible information disclosure due to a race condition. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06383944; Issue ID: ALPS06383944.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-362
References: https://corp.mediatek.com/product-security-bulletin/May-2022; https://corp.mediatek.com/product-security-bulletin/May-2022
CVE: CVE-2022-20098
Published: 2022-05-03
Description: In aee daemon, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06419017; Issue ID: ALPS06419017.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-862
References: https://corp.mediatek.com/product-security-bulletin/May-2022; https://corp.mediatek.com/product-security-bulletin/May-2022
CVE: CVE-2022-20099
Published: 2022-05-03
Description: In aee daemon, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06296442; Issue ID: ALPS06296442.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://corp.mediatek.com/product-security-bulletin/May-2022; https://corp.mediatek.com/product-security-bulletin/May-2022
CVE: CVE-2022-20100
Published: 2022-05-03
Description: In aee daemon, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06383944; Issue ID: ALPS06270804.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-862
References: https://corp.mediatek.com/product-security-bulletin/May-2022; https://corp.mediatek.com/product-security-bulletin/May-2022
CVE: CVE-2022-20109
Published: 2022-05-03
Description: In ion, there is a possible use after free due to improper update of reference count. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06399915; Issue ID: ALPS06399915.
CVSS Score: 7.8 (HIGH)
References: https://corp.mediatek.com/product-security-bulletin/May-2022; https://corp.mediatek.com/product-security-bulletin/May-2022
CVE: CVE-2022-20110
Published: 2022-05-03
Description: In ion, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06399915; Issue ID: ALPS06399901.
CVSS Score: 7.0 (HIGH)
CWE: CWE-367
References: https://corp.mediatek.com/product-security-bulletin/May-2022; https://corp.mediatek.com/product-security-bulletin/May-2022
CVE: CVE-2022-27313
Published: 2022-05-03
Description: An arbitrary file deletion vulnerability in Gitea v1.16.3 allows attackers to cause a Denial of Service (DoS) via deleting the configuration file.
CVSS Score: 7.5 (HIGH)
References: https://github.com/go-gitea/gitea/pull/19072; https://github.com/go-gitea/gitea/pull/19072
CVE: CVE-2022-27330
Published: 2022-05-03
Description: A cross-site scripting (XSS) vulnerability in /public/admin/index.php?add_product of E-Commerce Website v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Product Title text field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/CP04042K/Full-Ecommece-Website-Add_Product-Stored_XSS-POC; https://github.com/CP04042K/Full-Ecommece-Website-Add_Product-Stored_XSS-POC
CVE: CVE-2022-28780
Published: 2022-05-03
Description: Improper access control vulnerability in Weather prior to SMR May-2022 Release 1 allows that attackers can access location information that set in Weather without permission. The patch adds proper protection to prevent access to location information.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-284
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=5; https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=5
CVE: CVE-2022-28781
Published: 2022-05-03
Description: Improper input validation in Settings prior to SMR-May-2022 Release 1 allows attackers to launch arbitrary activity with system privilege. The patch adds proper validation logic to check the caller.
CVSS Score: 7.7 (HIGH)
CWE: CWE-20, CWE-20
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=5; https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=5
CVE: CVE-2022-28782
Published: 2022-05-03
Description: Improper access control vulnerability in Contents To Window prior to SMR May-2022 Release 1 allows physical attacker to install package before completion of Setup wizard. The patch blocks entry point of the vulnerability.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-424
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=5; https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=5
CVE: CVE-2022-28783
Published: 2022-05-03
Description: Improper validation of removing package name in Galaxy Themes prior to SMR May-2022 Release 1 allows attackers to uninstall arbitrary packages without permission. The patch adds proper validation logic for removing package name.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=5; https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=5
CVE: CVE-2022-28784
Published: 2022-05-03
Description: Path traversal vulnerability in Galaxy Themes prior to SMR May-2022 Release 1 allows attackers to list file names in arbitrary directory as system user. The patch addresses incorrect implementation of file path validation check logic.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=5; https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=5
CVE: CVE-2022-28785
Published: 2022-05-03
Description: Improper buffer size check logic in aviextractor library prior to SMR May-2022 Release 1 allows out of bounds read leading to possible temporary denial of service. The patch adds buffer size check logic.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=5; https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=5
CVE: CVE-2022-28786
Published: 2022-05-03
Description: Improper buffer size check logic in aviextractor library prior to SMR May-2022 Release 1 allows out of bounds read leading to possible temporary denial of service. The patch adds buffer size check logic.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=5; https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=5
CVE: CVE-2022-28787
Published: 2022-05-03
Description: Improper buffer size check logic in wmfextractor library prior to SMR May-2022 Release 1 allows out of bounds read leading to possible temporary denial of service. The patch adds buffer size check logic.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=5; https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=5
CVE: CVE-2022-28788
Published: 2022-05-03
Description: Improper buffer size check logic in aviextractor library prior to SMR May-2022 Release 1 allows out of bounds read leading to possible temporary denial of service. The patch adds buffer size check logic.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=5; https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=5
CVE: CVE-2022-28789
Published: 2022-05-03
Description: Unprotected activities in Voice Note prior to version 21.3.51.11 allows attackers to record voice without user interaction. The patch adds proper permission for vulnerable activities.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=5; https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=5
CVE: CVE-2022-28790
Published: 2022-05-03
Description: Improper authentication in Link to Windows Service prior to version 2.3.04.1 allows attacker to lock the device. The patch adds proper caller signature check logic.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-287, CWE-287
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=5; https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=5
CVE: CVE-2022-28791
Published: 2022-05-03
Description: Improper input validation vulnerability in InstallAgent in Galaxy Store prior to version 4.5.41.8 allows attacker to overwrite files stored in a specific path. The patch adds proper protection to prevent overwrite to existing files.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=5; https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=5
CVE: CVE-2022-28792
Published: 2022-05-03
Description: DLL hijacking vulnerability in Gear IconX PC Manager prior to version 2.1.220405.51 allows attacker to execute arbitrary code. The patch adds proper absolute path to prevent dll hijacking.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-427, CWE-427
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=5; https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=5
CVE: CVE-2022-28793
Published: 2022-05-03
Description: Given the TEE is compromised and controlled by the attacker, improper state maintenance in StrongBox allows attackers to change Android ROT during device boot cycle after compromising TEE. The patch is applied in Galaxy S22 to prevent change of Android ROT after first initialization at boot time.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-754, CWE-754
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=5; https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=5
CVE: CVE-2021-22680
Published: 2022-05-03
Description: NXP MQX Versions 5.1 and prior are vulnerable to integer overflow in mem_alloc, _lwmem_alloc and _partition functions. This unverified memory assignment can lead to arbitrary memory allocation, resulting in unexpected behavior such as a crash or a remote code injection/execution.
CVSS Score: 7.3 (HIGH)
CWE: CWE-190
References: https://www.cisa.gov/uscert/ics/advisories/icsa-21-119-04; https://www.cisa.gov/uscert/ics/advisories/icsa-21-119-04
CVE: CVE-2021-27411
Published: 2022-05-03
Description: Micrium OS Versions 5.10.1 and prior are vulnerable to integer wrap-around in functions Mem_DynPoolCreate, Mem_DynPoolCreateHW and Mem_PoolCreate. This unverified memory assignment can lead to arbitrary memory allocation, resulting in unexpected behavior such as very small blocks of memory being allocated instead of very large ones.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-190
References: https://www.cisa.gov/uscert/ics/advisories/icsa-21-119-04; https://www.silabs.com/developers/micrium-os; https://www.cisa.gov/uscert/ics/advisories/icsa-21-119-04
CVE: CVE-2021-27417
Published: 2022-05-03
Description: eCosCentric eCosPro RTOS Versions 2.0.1 through 4.5.3 are vulnerable to integer wraparound in function calloc (an implementation of malloc). The unverified memory assignment can lead to arbitrary memory allocation, resulting in a heap-based buffer overflow.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-190, CWE-190
References: https://bugzilla.ecoscentric.com/show_bug.cgi?id=1002437; https://www.cisa.gov/uscert/ics/advisories/icsa-21-119-04; https://bugzilla.ecoscentric.com/show_bug.cgi?id=1002437
CVE: CVE-2021-27419
Published: 2022-05-03
Description: uClibc-ng versions prior to 1.0.37 are vulnerable to integer wrap-around in functions malloc-simple. This improper memory assignment can lead to arbitrary memory allocation, resulting in unexpected behavior such as a crash or a remote code injection/execution.
CVSS Score: 7.3 (HIGH)
CWE: CWE-190
References: https://downloads.uclibc-ng.org/releases/; https://www.cisa.gov/uscert/ics/advisories/icsa-21-119-04; https://downloads.uclibc-ng.org/releases/
CVE: CVE-2021-27421
Published: 2022-05-03
Description: NXP MCUXpresso SDK versions prior to 2.8.2 are vulnerable to integer overflow in SDK_Malloc function, which could allow to access memory locations outside the bounds of a specified array, leading to unexpected behavior such segmentation fault when assigning a particular block of memory from the heap via malloc.
CVSS Score: 7.3 (HIGH)
CWE: CWE-190
References: https://mcuxpresso.nxp.com/en/welcome; https://www.cisa.gov/uscert/ics/advisories/icsa-21-119-04; https://mcuxpresso.nxp.com/en/welcome
CVE: CVE-2021-27425
Published: 2022-05-03
Description: Cesanta Software Mongoose-OS v2.17.0 is vulnerable to integer wrap-around in function mm_malloc. This improper memory assignment can lead to arbitrary memory allocation, resulting in unexpected behavior such as a crash or a remote code injection/execution.
CVSS Score: 7.3 (HIGH)
CWE: CWE-190
References: https://github.com/cesanta/mongoose-os; https://www.cisa.gov/uscert/ics/advisories/icsa-21-119-04; https://github.com/cesanta/mongoose-os
CVE: CVE-2021-27427
Published: 2022-05-03
Description: RIOT OS version 2020.01.1 is vulnerable to integer wrap-around in its implementation of calloc function, which can lead to arbitrary memory allocation, resulting in unexpected behavior such as a crash or a remote code injection/execution.
CVSS Score: 7.3 (HIGH)
CWE: CWE-190
References: https://github.com/RIOT-OS/RIOT; https://www.cisa.gov/uscert/ics/advisories/icsa-21-119-04; https://github.com/RIOT-OS/RIOT