deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-37866
Published: 2022-11-07
Description: When Apache Ivy downloads artifacts from a repository it stores them in the local file system based on a user-supplied "pattern" that may include placeholders for artifacts coordinates like the organisation, module or version. If said coordinates contain "../" sequences - which are valid characters for Ivy coordinates in general - it is possible the artifacts are stored outside of Ivy's local cache or repository or can overwrite different artifacts inside of the local cache. In order to exploit this vulnerability an attacker needs collaboration by the remote repository as Ivy will issue http requests containing ".." sequences and a "normal" repository will not interpret them as part of the artifact coordinates. Users of Apache Ivy 2.0.0 to 2.5.1 should upgrade to Ivy 2.5.1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://lists.apache.org/thread/htxbr8oc464hxrgroftnz3my70whk93b; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YDIFDL5WSBEKBUVKTABUFDDD25SBNJLS/; https://lists.apache.org/thread/htxbr8oc464hxrgroftnz3my70whk93b
CVE: CVE-2022-38163
Published: 2022-11-07
Description: A Drag and Drop spoof vulnerability was discovered in F-Secure SAFE Browser for Android and iOS version 19.0 and below. Drag and drop operation by user on address bar could lead to a spoofing of the address bar.
CVSS Score: 3.5 (LOW)
CWE: CWE-451
References: https://withsecure.com; https://www.f-secure.com/en/home/support/security-advisories; https://www.f-secure.com/en/home/support/security-advisories/cve-2022-38163
CVE: CVE-2022-43303
Published: 2022-11-07
Description: The d8s-strings for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. A potential code execution backdoor inserted by third parties is the democritus-uuids package. The affected version of d8s-htm is 0.1.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434, CWE-434
References: https://github.com/dadadadada111/info/issues/8; https://pypi.org/project/d8s-strings/; https://pypi.org/project/democritus-uuids/
CVE: CVE-2022-43304
Published: 2022-11-07
Description: The d8s-timer for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. A potential code execution backdoor inserted by third parties is the democritus-uuids package. The affected version of d8s-htm is 0.1.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434, CWE-434
References: https://github.com/dadadadada111/info/issues/9; https://pypi.org/project/d8s-timer/; https://pypi.org/project/democritus-uuids/
CVE: CVE-2022-43305
Published: 2022-11-07
Description: The d8s-python for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. A potential code execution backdoor inserted by third parties is the democritus-algorithms package. The affected version of d8s-htm is 0.1.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434, CWE-434
References: https://github.com/dadadadada111/info/issues/10; https://pypi.org/project/d8s-python/; https://pypi.org/project/democritus-algorithms/
CVE: CVE-2022-43306
Published: 2022-11-07
Description: The d8s-timer for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. A potential code execution backdoor inserted by third parties is the democritus-dates package. The affected version of d8s-htm is 0.1.0.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434, CWE-434
References: https://github.com/dadadadada111/info/issues/11; https://pypi.org/project/d8s-timer/; https://pypi.org/project/democritus-dates/
CVE: CVE-2022-43317
Published: 2022-11-07
Description: A cross-site scripting (XSS) vulnerability in /hrm/index.php?msg of Human Resource Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/ImaizumiYui/bug_report/blob/main/vendors/oretnom23/Human%20Resource%20Management%20System/XSS-1.md; https://github.com/ImaizumiYui/bug_report/blob/main/vendors/oretnom23/Human%20Resource%20Management%20System/XSS-1.md
CVE: CVE-2022-43318
Published: 2022-11-07
Description: Human Resource Management System v1.0 was discovered to contain a SQL injection vulnerability via the stateedit parameter at /hrm/state.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/ImaizumiYui/bug_report/blob/main/vendors/oretnom23/Human%20Resource%20Management%20System/SQLi-1.md; https://github.com/ImaizumiYui/bug_report/blob/main/vendors/oretnom23/Human%20Resource%20Management%20System/SQLi-1.md
CVE: CVE-2022-43319
Published: 2022-11-07
Description: An information disclosure vulnerability in the component vcs/downloadFiles.php?download=./search.php of Simple E-Learning System v1.0 allows attackers to read arbitrary files.
CVSS Score: 7.5 (HIGH)
References: https://github.com/ImaizumiYui/bug_report/blob/main/vendors/oretnom23/Simple%20E-Learning%20System/discl1.md; https://github.com/ImaizumiYui/bug_report/blob/main/vendors/oretnom23/Simple%20E-Learning%20System/discl1.md
CVE: CVE-2022-43350
Published: 2022-11-07
Description: Sanitization Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /php-sms/classes/Master.php?f=delete_inquiry.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/Hujozay/bug_report/blob/main/vendors/oretnom23/sanitization-management-system/SQLi-2.md; https://github.com/Hujozay/bug_report/blob/main/vendors/oretnom23/sanitization-management-system/SQLi-2.md
CVE: CVE-2022-43351
Published: 2022-11-07
Description: Sanitization Management System v1.0 was discovered to contain an arbitrary file deletion vulnerability via the component /classes/Master.php?f=delete_img.
CVSS Score: 6.5 (MEDIUM)
References: https://github.com/Hujozay/bug_report/blob/main/vendors/oretnom23/sanitization-management-system/delete-file-1.md; https://github.com/Hujozay/bug_report/blob/main/vendors/oretnom23/sanitization-management-system/delete-file-1.md
CVE: CVE-2022-43352
Published: 2022-11-07
Description: Sanitization Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /php-sms/classes/Master.php?f=delete_quote.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/Hujozay/bug_report/blob/main/vendors/oretnom23/sanitization-management-system/SQLi-1.md; https://github.com/Hujozay/bug_report/blob/main/vendors/oretnom23/sanitization-management-system/SQLi-1.md
CVE: CVE-2022-44048
Published: 2022-11-07
Description: The d8s-urls for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. A potential code execution backdoor inserted by third parties is the democritus-domains package. The affected version of d8s-htm is 0.1.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434, CWE-434
References: https://github.com/dadadadada111/info/issues/12; https://pypi.org/project/d8s-urls/; https://pypi.org/project/democritus-domains/
CVE: CVE-2022-44049
Published: 2022-11-07
Description: The d8s-python for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. A potential code execution backdoor inserted by third parties is the democritus-grammars package. The affected version of d8s-htm is 0.1.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434, CWE-434
References: https://github.com/dadadadada111/info/issues/13; https://pypi.org/project/d8s-python/; https://pypi.org/project/democritus-grammars/
CVE: CVE-2022-44050
Published: 2022-11-07
Description: The d8s-networking for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. A potential code execution backdoor inserted by third parties is the democritus-json package. The affected version of d8s-htm is 0.1.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434, CWE-434
References: https://github.com/dadadadada111/info/issues/14; https://pypi.org/project/d8s-networking/; https://pypi.org/project/democritus-json/
CVE: CVE-2022-44051
Published: 2022-11-07
Description: The d8s-stats for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. A potential code execution backdoor inserted by third parties is the democritus-math package. The affected version of d8s-htm is 0.1.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434, CWE-434
References: https://github.com/dadadadada111/info/issues/15; https://pypi.org/project/d8s-stats/; https://pypi.org/project/democritus-math/
CVE: CVE-2022-44052
Published: 2022-11-07
Description: The d8s-dates for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. A potential code execution backdoor inserted by third parties is the democritus-timezones package. The affected version of d8s-htm is 0.1.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434, CWE-434
References: https://github.com/dadadadada111/info/issues/16; https://pypi.org/project/d8s-dates/; https://pypi.org/project/democritus-timezones/
CVE: CVE-2022-44053
Published: 2022-11-07
Description: The d8s-networking for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. A potential code execution backdoor inserted by third parties is the democritus-user-agents package. The affected version of d8s-htm is 0.1.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434, CWE-434
References: https://github.com/dadadadada111/info/issues/17; https://pypi.org/project/d8s-networking/; https://pypi.org/project/democritus-user-agents/
CVE: CVE-2022-44054
Published: 2022-11-07
Description: The d8s-xml for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. A potential code execution backdoor inserted by third parties is the democritus-utility package. The affected version of d8s-htm is 0.1.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434, CWE-434
References: https://github.com/dadadadada111/info/issues/18; https://pypi.org/project/d8s-xml/; https://pypi.org/project/democritus-utility/
CVE: CVE-2021-42205
Published: 2022-11-07
Description: ELAN Miniport touchpad Windows driver before 24.21.51.2, as used in PC hardware from multiple manufacturers, allows local users to cause a system crash by sending a certain IOCTL request, because that request is handled twice.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-703
References: https://www.emc.com.tw/upload/F2E/Vulnerability%20Report/Vulnerability%20Report_Miniport%20touchpad%20Windows%20driver_20221107.pdf; https://www.emc.com.tw/upload/F2E/Vulnerability%20Report/Vulnerability%20Report_Miniport%20touchpad%20Windows%20driver_20221107.pdf
CVE: CVE-2022-3878
Published: 2022-11-07
Description: A vulnerability classified as critical has been found in Maxon ERP. This affects an unknown part of the file /index.php/purchase_order/browse_data. The manipulation of the argument tb_search leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-213039.
CVSS Score: 7.3 (HIGH)
CWE: CWE-707, CWE-89
References: https://github.com/huclilu/CVE_Add; https://vuldb.com/?id.213039; https://github.com/huclilu/CVE_Add
CVE: CVE-2022-42990
Published: 2022-11-07
Description: Food Ordering Management System v1.0 was discovered to contain a SQL injection vulnerability via the component /foms/all-orders.php?status=Cancelled%20by%20Customer.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/YorkLee2022/bug_report/blob/main/vendors/onetnom23/Food%20Ordering%20Management%20System/SQLi-1.md; https://github.com/YorkLee2022/bug_report/blob/main/vendors/onetnom23/Food%20Ordering%20Management%20System/SQLi-1.md
CVE: CVE-2022-38164
Published: 2022-11-07
Description: A vulnerability affecting F-Secure SAFE browser for Android and iOS was discovered. A maliciously crafted website could make a phishing attack with URL spoofing as the browser only display certain part of the entire URL.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-290
References: https://withsecure.com; https://www.f-secure.com/en/home/support/security-advisories; https://withsecure.com
CVE: CVE-2022-44732
Published: 2022-11-07
Description: Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 39900.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269, CWE-732
References: https://security-advisory.acronis.com/advisories/SEC-3040; https://security-advisory.acronis.com/advisories/SEC-3040
CVE: CVE-2022-44733
Published: 2022-11-07
Description: Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 39900.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269, CWE-732
References: https://security-advisory.acronis.com/advisories/SEC-3968; https://security-advisory.acronis.com/advisories/SEC-3968
CVE: CVE-2022-43050
Published: 2022-11-07
Description: Online Tours & Travels Management System v1.0 was discovered to contain an arbitrary file upload vulnerability in the component update_profile.php. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434, CWE-434
References: https://github.com/[PII_REDACTED]/bug_report/blob/main/vendors/mayuri_k/online-tours-travels-management-system/RCE-1.md; https://github.com/[PII_REDACTED]/bug_report/blob/main/vendors/mayuri_k/online-tours-travels-management-system/RCE-1.md
CVE: CVE-2022-43051
Published: 2022-11-07
Description: Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /odlms/classes/Users.php?f=delete_test.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/[PII_REDACTED]/bug_report/blob/main/vendors/oretnom23/online-diagnostic-lab-management-system/SQLi-1.md; https://github.com/[PII_REDACTED]/bug_report/blob/main/vendors/oretnom23/online-diagnostic-lab-management-system/SQLi-1.md
CVE: CVE-2022-43052
Published: 2022-11-07
Description: Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /odlms/classes/Users.php?f=delete.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/[PII_REDACTED]/bug_report/blob/main/vendors/oretnom23/online-diagnostic-lab-management-system/SQLi-2.md; https://github.com/[PII_REDACTED]/bug_report/blob/main/vendors/oretnom23/online-diagnostic-lab-management-system/SQLi-2.md
CVE: CVE-2022-44744
Published: 2022-11-07
Description: Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 40107.
CVSS Score: 7.3 (HIGH)
CWE: CWE-427, CWE-427
References: https://security-advisory.acronis.com/advisories/SEC-2718; https://security-advisory.acronis.com/advisories/SEC-2718
CVE: CVE-2022-44745
Published: 2022-11-07
Description: Sensitive information leak through log files. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 40107.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-532, CWE-532
References: https://security-advisory.acronis.com/advisories/SEC-3481; https://security-advisory.acronis.com/advisories/SEC-3481
CVE: CVE-2022-44746
Published: 2022-11-07
Description: Sensitive information disclosure due to insecure folder permissions. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 40107.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200, CWE-732
References: https://security-advisory.acronis.com/advisories/SEC-4398; https://security-advisory.acronis.com/advisories/SEC-4398
CVE: CVE-2022-44747
Published: 2022-11-07
Description: Local privilege escalation due to improper soft link handling. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 40107.
CVSS Score: 7.8 (HIGH)
CWE: CWE-610, CWE-59
References: https://security-advisory.acronis.com/advisories/SEC-4540; https://security-advisory.acronis.com/advisories/SEC-4540
CVE: CVE-2022-3872
Published: 2022-11-07
Description: An off-by-one read/write issue was found in the SDHCI device of QEMU. It occurs when reading/writing the Buffer Data Port Register in sdhci_read_dataport and sdhci_write_dataport, respectively, if data_count == block_size. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition.
CVSS Score: 8.6 (HIGH)
CWE: CWE-193
References: https://lists.nongnu.org/archive/html/qemu-devel/2022-11/msg01068.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://lists.nongnu.org/archive/html/qemu-devel/2022-11/msg01068.html
CVE: CVE-2022-43046
Published: 2022-11-07
Description: Food Ordering Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /foms/place-order.php.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/Oudaorui/bug_report/blob/main/vendors/oretnom23/Food%20Ordering%20Management%20System/XSS-1.md; https://github.com/Oudaorui/bug_report/blob/main/vendors/oretnom23/Food%20Ordering%20Management%20System/XSS-1.md
CVE: CVE-2022-43049
Published: 2022-11-07
Description: Canteen Management System Project v1.0 was discovered to contain a SQL injection vulnerability via the component /youthappam/add-food.php.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/sdpyly/bug_report_canteen/blob/master/SQLi.md; https://github.com/sdpyly/bug_report_canteen/blob/master/SQLi.md
CVE: CVE-2022-43359
Published: 2022-11-07
Description: Gifdec commit 1dcbae[PII_REDACTED]f6623010cc80abad4e47f7c was discovered to contain an out-of-bounds read in the function read_image_data. This vulnerability is triggered when parsing a crafted Gif file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-125
References: https://github.com/lecram/gifdec/pull/23; https://github.com/lecram/gifdec/pull/23
CVE: CVE-2022-31199
Published: 2022-11-08
Description: Remote code execution vulnerabilities exist in the Netwrix Auditor User Activity Video Recording component affecting both the Netwrix Auditor server and agents installed on monitored systems. The remote code execution vulnerabilities exist within the underlying protocol used by the component, and potentially allow an unauthenticated remote attacker to execute arbitrary code as the NT AUTHORITY\SYSTEM user on affected systems, including on systems Netwrix Auditor monitors.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502, CWE-502
References: https://bishopfox.com/blog/netwrix-auditor-advisory; https://bishopfox.com/blog/netwrix-auditor-advisory; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-31199
CVE: CVE-2022-41432
Published: 2022-11-08
Description: EyesOfNetwork Web Interface v5.3 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /module/report_event/index.php.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://gist.github.com/delyura/bda0b16cf99cb14bb767db84e5110419; https://gist.github.com/delyura/bda0b16cf99cb14bb767db84e5110419
CVE: CVE-2022-41433
Published: 2022-11-08
Description: EyesOfNetwork Web Interface v5.3 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /module/admin_bp/add_application.php.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://gist.github.com/delyura/b7419cab29f4105df1c1fbe5d99edd7c; https://gist.github.com/delyura/b7419cab29f4105df1c1fbe5d99edd7c
CVE: CVE-2022-41434
Published: 2022-11-08
Description: EyesOfNetwork Web Interface v5.3 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /lilac/main.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://gist.github.com/delyura/83553302a1960311c8c4c8cc4a974577; https://gist.github.com/delyura/83553302a1960311c8c4c8cc4a974577
CVE: CVE-2020-35473
Published: 2022-11-08
Description: An information leakage vulnerability in the Bluetooth Low Energy advertisement scan response in Bluetooth Core Specifications 4.0 through 5.2, and extended scan response in Bluetooth Core Specifications 5.0 through 5.2, may be used to identify devices using Resolvable Private Addressing (RPA) by their response or non-response to specific scan requests from remote addresses. RPAs that have been associated with a specific remote device may also be used to identify a peer in the same manner by using its reaction to an active scan request. This has also been called an allowlist-based side channel.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-203, CWE-294, CWE-294
References: https://dl.acm.org/doi/10.1145/3[PII_REDACTED]372; https://www.sigsac.org/ccs/CCS2022/proceedings/ccs-proceedings.html; https://dl.acm.org/doi/10.1145/3[PII_REDACTED]372
CVE: CVE-2022-36077
Published: 2022-11-08
Description: The Electron framework enables writing cross-platform desktop applications using JavaScript, HTML and CSS. In versions prior to 21.0.0-beta.1, 20.0.1, 19.0.11, and 18.3.7, Electron is vulnerable to Exposure of Sensitive Information. When following a redirect, Electron delays a check for redirecting to file:// URLs from other schemes. The contents of the file is not available to the renderer following the redirect, but if the redirect target is a SMB URL such as `file://some.website.com/`, then in some cases, Windows will connect to that server and attempt NTLM authentication, which can include sending hashed credentials.This issue has been patched in versions: 21.0.0-beta.1, 20.0.1, 19.0.11, and 18.3.7. Users are recommended to upgrade to the latest stable version of Electron. If upgrading isn't possible, this issue can be addressed without upgrading by preventing redirects to file:// URLs in the `WebContents.on('will-redirect')` event, for all WebContents as a workaround.
CVSS Score: 7.2 (HIGH)
CWE: CWE-200, CWE-522, CWE-522
References: https://github.com/electron/electron/security/advisories/GHSA-p2jh-44qj-pf2v; https://github.com/electron/electron/security/advisories/GHSA-p2jh-44qj-pf2v
CVE: CVE-2022-39343
Published: 2022-11-08
Description: Azure RTOS FileX is a FAT-compatible file system that’s fully integrated with Azure RTOS ThreadX. In versions before 6.2.0, the Fault Tolerant feature of Azure RTOS FileX includes integer under and overflows which may be exploited to achieve buffer overflow and modify memory contents. When a valid log file with correct ID and checksum is detected by the `_fx_fault_tolerant_enable` function an attempt to recover the previous failed write operation is taken by call of `_fx_fault_tolerant_apply_logs`. This function iterates through the log entries and performs required recovery operations. When properly crafted a log including entries of type `FX_FAULT_TOLERANT_DIR_LOG_TYPE` may be utilized to introduce unexpected behavior. This issue has been patched in version 6.2.0. A workaround to fix line 218 in fx_fault_tolerant_apply_logs.c is documented in the GHSA.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-120, CWE-190, CWE-191
References: https://github.com/azure-rtos/filex/blob/master/common/src/fx_fault_tolerant_apply_logs.c#L218; https://github.com/azure-rtos/filex/security/advisories/GHSA-8jqf-wjhq-4w9f; https://github.com/azure-rtos/filex/blob/master/common/src/fx_fault_tolerant_apply_logs.c#L218
CVE: CVE-2022-39352
Published: 2022-11-08
Description: OpenFGA is a high-performance authorization/permission engine inspired by Google Zanzibar. Versions prior to 0.2.5 are vulnerable to authorization bypass under certain conditions. You are affected by this vulnerability if you added a tuple with a wildcard (*) assigned to a tupleset relation (the right hand side of a ‘from’ statement). This issue has been patched in version v0.2.5. This update is not backward compatible with any authorization model that uses wildcard on a tupleset relation.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-863, CWE-863
References: https://github.com/openfga/openfga/security/advisories/GHSA-3gfj-fxx4-f22w; https://github.com/openfga/openfga/security/advisories/GHSA-3gfj-fxx4-f22w