deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-25660
Published: 2022-10-19
Description: Memory corruption due to double free issue in kernel in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile
CVSS Score: 7.8 (HIGH)
CWE: CWE-415, CWE-415
References: https://www.qualcomm.com/company/product-security/bulletins/october-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/october-2022-bulletin
CVE: CVE-2022-25661
Published: 2022-10-19
Description: Memory corruption due to untrusted pointer dereference in kernel in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile
CVSS Score: 8.4 (HIGH)
CWE: CWE-119, CWE-119
References: https://www.qualcomm.com/company/product-security/bulletins/october-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/october-2022-bulletin
CVE: CVE-2022-25662
Published: 2022-10-19
Description: Information disclosure due to untrusted pointer dereference in kernel in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-119, CWE-119
References: https://www.qualcomm.com/company/product-security/bulletins/october-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/october-2022-bulletin
CVE: CVE-2022-25663
Published: 2022-10-19
Description: Possible buffer overflow due to lack of buffer length check during management frame Rx handling lead to denial of service in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://www.qualcomm.com/company/product-security/bulletins/october-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/october-2022-bulletin
CVE: CVE-2022-25664
Published: 2022-10-19
Description: Information disclosure due to exposure of information while GPU reads the data in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-459, CWE-459
References: http://packetstormsecurity.com/files/172853/Qualcomm-Adreno-GPU-Information-Leak.html; https://www.qualcomm.com/company/product-security/bulletins/october-2022-bulletin; http://packetstormsecurity.com/files/172853/Qualcomm-Adreno-GPU-Information-Leak.html
CVE: CVE-2022-25665
Published: 2022-10-19
Description: Information disclosure due to buffer over read in kernel in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Mobile
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://www.qualcomm.com/company/product-security/bulletins/october-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/october-2022-bulletin
CVE: CVE-2022-25666
Published: 2022-10-19
Description: Memory corruption due to use after free in service while trying to access maps by different threads in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-416, CWE-416
References: https://www.qualcomm.com/company/product-security/bulletins/october-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/october-2022-bulletin
CVE: CVE-2022-25687
Published: 2022-10-19
Description: memory corruption in video due to buffer overflow while parsing asf clips in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
CVSS Score: 7.3 (HIGH)
CWE: CWE-120, CWE-120
References: https://www.qualcomm.com/company/product-security/bulletins/october-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/october-2022-bulletin
CVE: CVE-2022-25718
Published: 2022-10-19
Description: Cryptographic issue in WLAN due to improper check on return value while authentication handshake in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-252, CWE-252
References: https://www.qualcomm.com/company/product-security/bulletins/october-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/october-2022-bulletin
CVE: CVE-2022-25719
Published: 2022-10-19
Description: Information disclosure in WLAN due to improper length check while processing authentication handshake in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking
CVSS Score: 8.2 (HIGH)
CWE: CWE-125, CWE-125
References: https://www.qualcomm.com/company/product-security/bulletins/october-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/october-2022-bulletin
CVE: CVE-2022-25720
Published: 2022-10-19
Description: Memory corruption in WLAN due to out of bound array access during connect/roaming in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-129, CWE-129
References: https://www.qualcomm.com/company/product-security/bulletins/october-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/october-2022-bulletin
CVE: CVE-2022-25723
Published: 2022-10-19
Description: Memory corruption in multimedia due to use after free during callback registration failure in Snapdragon Mobile
CVSS Score: 8.4 (HIGH)
CWE: CWE-416, CWE-416
References: https://www.qualcomm.com/company/product-security/bulletins/october-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/october-2022-bulletin
CVE: CVE-2022-25736
Published: 2022-10-19
Description: Denial of service in WLAN due to out-of-bound read happens while processing VHT action frame in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking
CVSS Score: 7.5 (HIGH)
CWE: CWE-125, CWE-125
References: https://www.qualcomm.com/company/product-security/bulletins/october-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/october-2022-bulletin
CVE: CVE-2022-25748
Published: 2022-10-19
Description: Memory corruption in WLAN due to integer overflow to buffer overflow while parsing GTK frames. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190, CWE-190
References: https://www.qualcomm.com/company/product-security/bulletins/october-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/october-2022-bulletin
CVE: CVE-2022-25749
Published: 2022-10-19
Description: Transient Denial-of-Service in WLAN due to buffer over-read while parsing MDNS frames. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking
CVSS Score: 7.5 (HIGH)
CWE: CWE-125, CWE-125
References: https://www.qualcomm.com/company/product-security/bulletins/october-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/october-2022-bulletin
CVE: CVE-2022-25750
Published: 2022-10-19
Description: Memory corruption in BTHOST due to double free while music playback and calls over bluetooth headset in Snapdragon Mobile
CVSS Score: 8.4 (HIGH)
CWE: CWE-415, CWE-415
References: https://www.qualcomm.com/company/product-security/bulletins/october-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/october-2022-bulletin
CVE: CVE-2022-33210
Published: 2022-10-19
Description: Memory corruption in automotive multimedia due to use of out-of-range pointer offset while parsing command request packet with a very large type value. in Snapdragon Auto
CVSS Score: 8.4 (HIGH)
CWE: CWE-119, CWE-119
References: https://www.qualcomm.com/company/product-security/bulletins/october-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/october-2022-bulletin
CVE: CVE-2022-33214
Published: 2022-10-19
Description: Memory corruption in display due to time-of-check time-of-use of metadata reserved size in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables
CVSS Score: 8.4 (HIGH)
CWE: CWE-367, CWE-367
References: https://www.qualcomm.com/company/product-security/bulletins/october-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/october-2022-bulletin
CVE: CVE-2022-33217
Published: 2022-10-19
Description: Memory corruption in Qualcomm IPC due to buffer copy without checking the size of input while starting communication with a compromised kernel. in Snapdragon Mobile
CVSS Score: 7.8 (HIGH)
CWE: CWE-120, CWE-120
References: https://www.qualcomm.com/company/product-security/bulletins/october-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/october-2022-bulletin
CVE: CVE-2022-39233
Published: 2022-10-19
Description: Tuleap is a Free & Open Source Suite to improve management of software developments and collaboration. In versions 12.9.99.228 and above, prior to 14.0.99.24, authorizations are not properly verified when updating the branch prefix used by the GitLab repository integration. Authenticated users can change the branch prefix of any of the GitLab repository integration they can see vie the REST endpoint `PATCH /gitlab_repositories/{id}`. This action should be restricted to Git administrators. This issue is patched in Tuleap Community Edition 14.0.99.24 and Tuleap Enterprise Edition 14.0-3. There are no known workarounds.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://github.com/Enalean/tuleap/commit/a06cb42d55c840d61a484472ed6b169ab23853ac; https://github.com/Enalean/tuleap/security/advisories/GHSA-3884-972x-3ccq; https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=a06cb42d55c840d61a484472ed6b169ab23853ac
CVE: CVE-2022-39253
Published: 2022-10-19
Description: Git is an open source, scalable, distributed revision control system. Versions prior to 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4 are subject to exposure of sensitive information to a malicious actor. When performing a local clone (where the source and target of the clone are on the same volume), Git copies the contents of the source's `$GIT_DIR/objects` directory into the destination by either creating hardlinks to the source contents, or copying them (if hardlinks are disabled via `--no-hardlinks`). A malicious actor could convince a victim to clone a repository with a symbolic link pointing at sensitive information on the victim's machine. This can be done either by having the victim clone a malicious repository on the same machine, or having them clone a malicious repository embedded as a bare repository via a submodule from any source, provided they clone with the `--recurse-submodules` option. Git does not create symbolic links in the `$GIT_DIR/objects` directory. The problem has been patched in the versions published on 2022-10-18, and backported to v2.30.x. Potential workarounds: Avoid cloning untrusted repositories using the `--local` optimization when on a shared machine, either by passing the `--no-local` option to `git clone` or cloning from a URL that uses the `file://` scheme. Alternatively, avoid cloning repositories from untrusted sources with `--recurse-submodules` or run `git config --global protocol.file.allow user`.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200, CWE-59
References: http://seclists.org/fulldisclosure/2022/Nov/1; http://www.openwall.com/lists/oss-security/2023/02/14/5; http://www.openwall.com/lists/oss-security/2024/05/14/2
CVE: CVE-2022-39260
Published: 2022-10-19
Description: Git is an open source, scalable, distributed revision control system. `git shell` is a restricted login shell that can be used to implement Git's push/pull functionality via SSH. In versions prior to 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4, the function that splits the command arguments into an array improperly uses an `int` to represent the number of entries in the array, allowing a malicious actor to intentionally overflow the return value, leading to arbitrary heap writes. Because the resulting array is then passed to `execv()`, it is possible to leverage this attack to gain remote code execution on a victim machine. Note that a victim must first allow access to `git shell` as a login shell in order to be vulnerable to this attack. This problem is patched in versions 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4 and users are advised to upgrade to the latest version. Disabling `git shell` access via remote logins is a viable short-term workaround.
CVSS Score: 8.5 (HIGH)
CWE: CWE-122, CWE-787, CWE-787
References: http://seclists.org/fulldisclosure/2022/Nov/1; https://github.com/git/git/security/advisories/GHSA-rjr6-wcq6-83p6; https://lists.debian.org/debian-lts-announce/2022/12/msg00025.html
CVE: CVE-2022-41415
Published: 2022-10-19
Description: Acer Altos W2000h-W570h F4 R01.03.0018 was discovered to contain a stack overflow in the RevserveMem component. This vulnerability allows attackers to cause a Denial of Service (DoS) via injecting crafted shellcode into the NVRAM variable.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: http://acer.com; http://altos.com; https://github.com/10TG/vulnerabilities/blob/main/Acer/CVE-2022-41415/CVE-2022-41415.md
CVE: CVE-2022-39267
Published: 2022-10-19
Description: Bifrost is a heterogeneous middleware that synchronizes MySQL, MariaDB to Redis, MongoDB, ClickHouse, MySQL and other services for production environments. Versions prior to 1.8.8-release are subject to authentication bypass in the admin and monitor user groups by deleting the X-Requested-With: XMLHttpRequest field in the request header. This issue has been patched in 1.8.8-release. There are no known workarounds.
CVSS Score: 8.8 (HIGH)
CWE: CWE-287, CWE-287
References: https://github.com/brockercap/Bifrost/pull/201; https://github.com/brokercap/Bifrost/security/advisories/GHSA-mxrx-fg8p-5p5j; https://github.com/brockercap/Bifrost/pull/201
CVE: CVE-2022-3607
Published: 2022-10-19
Description: Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in GitHub repository octoprint/octoprint prior to 1.8.3.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-75, CWE-74
References: https://github.com/octoprint/octoprint/commit/3cca3a43f3d085e9bbe5a5840c8255bb1b5d052e; https://huntr.dev/bounties/2d1db3c9-93e8-4902-a55b-5ea53c22aa11; https://github.com/octoprint/octoprint/commit/3cca3a43f3d085e9bbe5a5840c8255bb1b5d052e
CVE: CVE-2022-3608
Published: 2022-10-19
Description: Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.2.0-alpha.
CVSS Score: 8.4 (HIGH)
CWE: CWE-79, CWE-79
References: https://github.com/thorsten/phpmyfaq/commit/37123edd50f854bd141e6fbe65221af2d5cf2677; https://huntr.dev/bounties/8f0f3635-9d81-4c55-9826-2ba955c3a850; https://github.com/thorsten/phpmyfaq/commit/37123edd50f854bd141e6fbe65221af2d5cf2677
CVE: CVE-2022-23734
Published: 2022-10-19
Description: A deserialization of untrusted data vulnerability was identified in GitHub Enterprise Server that could potentially lead to remote code execution on the SVNBridge. To exploit this vulnerability, an attacker would need to gain access via a server-side request forgery (SSRF) that would let an attacker control the data being deserialized. This vulnerability affected all versions of GitHub Enterprise Server prior to v3.6 and was fixed in versions 3.5.3, 3.4.6, 3.3.11, and 3.2.16. This vulnerability was reported via the GitHub Bug Bounty program.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502, CWE-502
References: https://docs.github.com/en/enterprise-server%403.2/admin/release-notes#3.2.16; https://docs.github.com/en/enterprise-server%403.3/admin/release-notes#3.3.11; https://docs.github.com/en/enterprise-server%403.4/admin/release-notes#3.4.6
CVE: CVE-2022-39301
Published: 2022-10-19
Description: sra-admin is a background rights management system that separates the front and back end. sra-admin version 1.1.1 has a storage cross-site scripting (XSS) vulnerability. After logging into the sra-admin background, an attacker can upload an html page containing xss attack code in "Personal Center" - "Profile Picture Upload" allowing theft of the user's personal information. This issue has been patched in 1.1.2. There are no known workarounds.
CVSS Score: 8.2 (HIGH)
CWE: CWE-80, CWE-434, CWE-434
References: https://github.com/momofoolish/sra-admin/security/advisories/GHSA-v7r9-qx74-h3v8; https://github.com/momofoolish/sra-admin/security/advisories/GHSA-v7r9-qx74-h3v8
CVE: CVE-2022-43032
Published: 2022-10-19
Description: An issue was discovered in Bento4 v1.6.0-639. There is a memory leak in AP4_DescriptorFactory::CreateDescriptorFromStream in Core/Ap4DescriptorFactory.cpp, as demonstrated by mp42aac.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-401, CWE-401
References: https://github.com/axiomatic-systems/Bento4/issues/763; https://github.com/axiomatic-systems/Bento4/issues/763
CVE: CVE-2022-43033
Published: 2022-10-19
Description: An issue was discovered in Bento4 1.6.0-639. There is a bad free in the component AP4_HdlrAtom::~AP4_HdlrAtom() which allows attackers to cause a Denial of Service (DoS) via a crafted input.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-416, CWE-416
References: https://github.com/axiomatic-systems/Bento4/issues/765; https://github.com/axiomatic-systems/Bento4/issues/765
CVE: CVE-2022-43034
Published: 2022-10-19
Description: An issue was discovered in Bento4 v1.6.0-639. There is a heap buffer overflow vulnerability in the AP4_BitReader::SkipBits(unsigned int) function in mp42ts.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://github.com/axiomatic-systems/Bento4/issues/764; https://github.com/axiomatic-systems/Bento4/issues/764
CVE: CVE-2022-43035
Published: 2022-10-19
Description: An issue was discovered in Bento4 v1.6.0-639. There is a heap-buffer-overflow in AP4_Dec3Atom::AP4_Dec3Atom at Ap4Dec3Atom.cpp, leading to a Denial of Service (DoS), as demonstrated by mp42aac.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://github.com/axiomatic-systems/Bento4/issues/762; https://github.com/axiomatic-systems/Bento4/issues/762
CVE: CVE-2022-43037
Published: 2022-10-19
Description: An issue was discovered in Bento4 1.6.0-639. There is a memory leak in the function AP4_File::ParseStream in /Core/Ap4File.cpp.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-401, CWE-401
References: https://github.com/axiomatic-systems/Bento4/issues/788; https://github.com/axiomatic-systems/Bento4/issues/788
CVE: CVE-2022-43038
Published: 2022-10-19
Description: Bento4 v1.6.0-639 was discovered to contain a heap overflow via the AP4_BitReader::ReadCache() function in mp42ts.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://github.com/axiomatic-systems/Bento4/issues/787; https://github.com/axiomatic-systems/Bento4/issues/787
CVE: CVE-2022-43039
Published: 2022-10-19
Description: GPAC 2.1-DEV-rev368-gfd054169b-master was discovered to contain a segmentation violation via the function gf_isom_meta_restore_items_ref at /isomedia/meta.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://github.com/gpac/gpac/issues/2281; https://github.com/gpac/gpac/issues/2281
CVE: CVE-2022-43040
Published: 2022-10-19
Description: GPAC 2.1-DEV-rev368-gfd054169b-master was discovered to contain a heap buffer overflow via the function gf_isom_box_dump_start_ex at /isomedia/box_funcs.c.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://github.com/gpac/gpac/issues/2280; https://github.com/gpac/gpac/issues/2280
CVE: CVE-2022-43042
Published: 2022-10-19
Description: GPAC 2.1-DEV-rev368-gfd054169b-master was discovered to contain a heap buffer overflow via the function FixSDTPInTRAF at isomedia/isom_intern.c.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://github.com/gpac/gpac/issues/2278; https://github.com/gpac/gpac/issues/2278
CVE: CVE-2022-43043
Published: 2022-10-19
Description: GPAC 2.1-DEV-rev368-gfd054169b-master was discovered to contain a segmentation violation via the function BD_CheckSFTimeOffset at /bifs/field_decode.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://github.com/gpac/gpac/issues/2276; https://github.com/gpac/gpac/issues/2276
CVE: CVE-2022-43044
Published: 2022-10-19
Description: GPAC 2.1-DEV-rev368-gfd054169b-master was discovered to contain a segmentation violation via the function gf_isom_get_meta_item_info at /isomedia/meta.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://github.com/gpac/gpac/issues/2282; https://github.com/gpac/gpac/issues/2282
CVE: CVE-2022-43045
Published: 2022-10-19
Description: GPAC 2.1-DEV-rev368-gfd054169b-master was discovered to contain a segmentation violation via the function gf_dump_vrml_sffield at /scene_manager/scene_dump.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://github.com/gpac/gpac/issues/2277; https://github.com/gpac/gpac/issues/2277
CVE: CVE-2022-43184
Published: 2022-10-19
Description: D-Link DIR878 1.30B08 Hotfix_04 was discovered to contain a command injection vulnerability via the component /bin/proc.cgi.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://github.com/HuangPayoung/CVE-request/tree/main/DLink/vuln2; https://www.dlink.com/en/security-bulletin/; https://github.com/HuangPayoung/CVE-request/tree/main/DLink/vuln2
CVE: CVE-2022-43185
Published: 2022-10-19
Description: A stored cross-site scripting (XSS) vulnerability in the Configuration/Holidays module of Rukovoditel v3.2.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/Kubozz/rukovoditel-3.2.1/issues/1; https://github.com/Kubozz/rukovoditel-3.2.1/issues/1
CVE: CVE-2022-43401
Published: 2022-10-19
Description: A sandbox bypass vulnerability involving various casts performed implicitly by the Groovy language runtime in Jenkins Script Security Plugin 1183.v774b_0b_0a_a_451 and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.
CVSS Score: 9.9 (CRITICAL)
References: http://www.openwall.com/lists/oss-security/2022/10/19/3; https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2824%20%281%29; http://www.openwall.com/lists/oss-security/2022/10/19/3
CVE: CVE-2022-43402
Published: 2022-10-19
Description: A sandbox bypass vulnerability involving various casts performed implicitly by the Groovy language runtime in Jenkins Pipeline: Groovy Plugin 2802.v5ea_628154b_c2 and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.
CVSS Score: 9.9 (CRITICAL)
References: http://www.openwall.com/lists/oss-security/2022/10/19/3; https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2824%20%281%29; http://www.openwall.com/lists/oss-security/2022/10/19/3