deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-28754
Published: 2023-07-19
Description: Deserialization of Untrusted Data vulnerability in Apache ShardingSphere-Agent, which allows attackers to execute arbitrary code by constructing a special YAML configuration file.

The attacker needs to have permission to modify the ShardingSphere Agent YAML configuration file on the target machine, and the target machine can access the URL with the arbitrary code JAR.
An attacker can use SnakeYAML to deserialize java.net.URLClassLoader and make it load a JAR from a specified URL, and then deserialize javax.script.ScriptEngineManager to load code using that ClassLoader. When the ShardingSphere JVM process starts and uses the ShardingSphere-Agent, the arbitrary code specified by the attacker will be executed during the deserialization of the YAML configuration file by the Agent.

This issue affects ShardingSphere-Agent: through 5.3.2. This vulnerability is fixed in Apache ShardingSphere 5.4.0.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502, CWE-502
References: http://www.openwall.com/lists/oss-security/2023/07/19/3; https://lists.apache.org/thread/p8onhqox5kkwow9lc6gs03z28wtyp1cg; http://www.openwall.com/lists/oss-security/2023/07/19/3
CVE: CVE-2023-3446
Published: 2023-07-19
Description: Issue summary: Checking excessively long DH keys or parameters may be very slow.

Impact summary: Applications that use the functions DH_check(), DH_check_ex()
or EVP_PKEY_param_check() to check a DH key or DH parameters may experience long
delays. Where the key or parameters that are being checked have been obtained
from an untrusted source this may lead to a Denial of Service.

The function DH_check() performs various checks on DH parameters. One of those
checks confirms that the modulus ('p' parameter) is not too large. Trying to use
a very large modulus is slow and OpenSSL will not normally use a modulus which
is over 10,000 bits in length.

However the DH_check() function checks numerous aspects of the key or parameters
that have been supplied. Some of those checks use the supplied modulus value
even if it has already been found to be too large.

An application that calls DH_check() and supplies a key or parameters obtained
from an untrusted source could be vulernable to a Denial of Service attack.

The function DH_check() is itself called by a number of other OpenSSL functions.
An application calling any of those other functions may similarly be affected.
The other functions affected by this are DH_check_ex() and
EVP_PKEY_param_check().

Also vulnerable are the OpenSSL dhparam and pkeyparam command line applications
when using the '-check' option.

The OpenSSL SSL/TLS implementation is not affected by this issue.
The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-606, CWE-1333
References: https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=1fa20cf2f506113c761777127a38bce5068740eb; https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=8780a896543a654e757db1b9396383f9d8095528; https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=9a0a4d3c1e[PII_REDACTED]c0df4fe6a3f9377b839c
CVE: CVE-2023-27379
Published: 2023-07-19
Description: A use-after-free vulnerability exists in the JavaScript engine of Foxit Software’s PDF Reader, version 12.1.2.15332. By prematurely deleting objects associated with pages, a specially crafted PDF document can trigger the reuse of previously freed memory, which can lead to arbitrary code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially crafted, malicious site if the browser plugin extension is enabled.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://talosintelligence.com/vulnerability_reports/TALOS-2023-1756; https://talosintelligence.com/vulnerability_reports/TALOS-2023-1756; https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1756
CVE: CVE-2023-28744
Published: 2023-07-19
Description: A use-after-free vulnerability exists in the JavaScript engine of Foxit Software's PDF Reader, version 12.1.1.15289. A specially crafted PDF document can trigger the reuse of previously freed memory by manipulating form fields of a specific type. This can lead to memory corruption and arbitrary code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially crafted, malicious site if the browser plugin extension is enabled.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://talosintelligence.com/vulnerability_reports/TALOS-2023-1739; https://talosintelligence.com/vulnerability_reports/TALOS-2023-1739; https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1739
CVE: CVE-2023-32664
Published: 2023-07-19
Description: A type confusion vulnerability exists in the Javascript checkThisBox method as implemented in Foxit Reader 12.1.2.15332. Specially crafted Javascript code inside a malicious PDF document can cause memory corruption and lead to remote code execution. User would need to open a malicious file to trigger the vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-843
References: https://talosintelligence.com/vulnerability_reports/TALOS-2023-1795; https://talosintelligence.com/vulnerability_reports/TALOS-2023-1795; https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1795
CVE: CVE-2023-33866
Published: 2023-07-19
Description: A use-after-free vulnerability exists in the JavaScript engine of Foxit Software’s PDF Reader, version 12.1.2.15332. By prematurely deleting objects associated with pages, a specially crafted PDF document can trigger the reuse of previously freed memory, which can lead to arbitrary code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially crafted, malicious site if the browser plugin extension is enabled.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://talosintelligence.com/vulnerability_reports/TALOS-2023-1757; https://talosintelligence.com/vulnerability_reports/TALOS-2023-1757; https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1757
CVE: CVE-2023-33876
Published: 2023-07-19
Description: A use-after-free vulnerability exists in the way Foxit Reader 12.1.2.15332 handles destroying annotations. Specially crafted Javascript code inside a malicious PDF document can trigger reuse of a previously freed object, which can lead to memory corruption and result in arbitrary code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially crafted, malicious site if the browser plugin extension is enabled.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://talosintelligence.com/vulnerability_reports/TALOS-2023-1796; https://talosintelligence.com/vulnerability_reports/TALOS-2023-1796; https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1796
CVE: CVE-2023-3463
Published: 2023-07-19
Description: 
All versions of GE Digital CIMPLICITY that are not adhering to SDG guidance and accepting documents from untrusted sources are vulnerable to memory corruption issues due to insufficient input validation, including issues such as out-of-bounds reads and writes, use-after-free, stack-based buffer overflows, uninitialized pointers, and a heap-based buffer overflow. Successful exploitation could allow an attacker to execute arbitrary code.


CVSS Score: 6.6 (MEDIUM)
CWE: CWE-122, CWE-787
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-199-06; https://www.cisa.gov/news-events/ics-advisories/icsa-23-199-06
CVE: CVE-2022-40896
Published: 2023-07-19
Description: A ReDoS issue was discovered in pygments/lexers/smithy.py in pygments through 2.15.0 via SmithyLexer.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-434
References: https://github.com/pygments/pygments/blob/master/pygments/lexers/smithy.py#L61; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EZGMXALE3HSP4OXC7UUWIKX3OXKZDTY3/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VUZO4BQCIY2S2KZYHERQMKURB7AHXDBO/
CVE: CVE-2023-30799
Published: 2023-07-19
Description: MikroTik RouterOS stable before 6.49.7 and long-term through 6.48.6 are vulnerable to a privilege escalation issue. A remote and authenticated attacker can escalate privileges from admin to super-admin on the Winbox or HTTP interface. The attacker can abuse this vulnerability to execute arbitrary code on the system.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-269
References: https://github.com/MarginResearch/FOISted; https://vulncheck.com/advisories/mikrotik-foisted; https://github.com/MarginResearch/FOISted
CVE: CVE-2023-34034
Published: 2023-07-19
Description: Using "**" as a pattern in Spring Security configuration 
for WebFlux creates a mismatch in pattern matching between Spring 
Security and Spring WebFlux, and the potential for a security bypass.


CVSS Score: 9.1 (CRITICAL)
CWE: CWE-281
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://spring.io/security/cve-2023-34034; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2023-3638
Published: 2023-07-19
Description: In GeoVision GV-ADR2701 cameras, an attacker could edit the login response to access the web application.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-199-05; https://www.cisa.gov/news-events/ics-advisories/icsa-23-199-05
CVE: CVE-2023-25838
Published: 2023-07-19
Description: 
There is SQL injection vulnerability in Esri ArcGIS Insights 2022.1 for ArcGIS Enterprise and that may allow a remote, authorized attacker to execute arbitrary SQL commands against the back-end database. The effort required to generate the crafted input required to exploit this issue is complex and requires significant effort before a successful attack can be expected.


CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/arcgis-insights-security-patches-for-arcgis-insights-2022-1-are-now-available/; https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/arcgis-insights-security-patches-for-arcgis-insights-2022-1-are-now-available/
CVE: CVE-2023-25839
Published: 2023-07-19
Description: 
There is SQL injection vulnerability in Esri ArcGIS Insights Desktop for Mac and Windows version 2022.1  that may allow a local, authorized attacker to execute arbitrary SQL commands against the back-end database. The effort required to generate the crafted input required to exploit this issue is complex and requires significant effort before a successful attack can be expected.


CVSS Score: 7.0 (HIGH)
CWE: CWE-89
References: https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/arcgis-insights-security-patches-for-arcgis-insights-2022-1-are-now-available/; https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/arcgis-insights-security-patches-for-arcgis-insights-2022-1-are-now-available/
CVE: CVE-2023-32261
Published: 2023-07-19
Description: 
A potential vulnerability has been identified in the Micro Focus Dimensions CM Plugin for Jenkins. The vulnerability allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
See the following Jenkins security advisory for details:  *   https://www.jenkins.io/security/advisory/2023-06-14/ https://www.jenkins.io/security/advisory/2023-06-14/ 





CVSS Score: 4.2 (MEDIUM)
CWE: CWE-863
References: https://plugins.jenkins.io/dimensionsscm/; https://portal.microfocus.com/s/article/KM000019297; https://www.jenkins.io/security/advisory/2023-06-14/
CVE: CVE-2023-32262
Published: 2023-07-19
Description: 
A potential vulnerability has been identified in the Micro Focus Dimensions CM Plugin for Jenkins. The vulnerability allows attackers with Item/Configure permission to access and capture credentials they are not entitled to.
See the following Jenkins security advisory for details:  *   https://www.jenkins.io/security/advisory/2023-06-14/ https://www.jenkins.io/security/advisory/2023-06-14/ 





CVSS Score: 4.3 (MEDIUM)
References: https://plugins.jenkins.io/dimensionsscm/; https://portal.microfocus.com/s/article/KM000019298; https://www.jenkins.io/security/advisory/2023-06-14/
CVE: CVE-2023-32263
Published: 2023-07-19
Description: 
A potential vulnerability has been identified in the Micro Focus Dimensions CM Plugin for Jenkins. The vulnerability could be exploited to retrieve a login certificate if an authenticated user is duped into using an attacker-controlled Dimensions CM server.  This vulnerability only applies when the Jenkins plugin is configured to use login certificate credentials.


  https://www.jenkins.io/security/advisory/2023-06-14/ 


CVSS Score: 2.6 (LOW)
References: https://plugins.jenkins.io/dimensionsscm/; https://portal.microfocus.com/s/article/KM000019293; https://plugins.jenkins.io/dimensionsscm/
CVE: CVE-2023-37748
Published: 2023-07-19
Description: ngiflib commit 5e7292 was discovered to contain an infinite loop via the function DecodeGifImg at ngiflib.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-835
References: https://github.com/miniupnp/ngiflib/; https://github.com/miniupnp/ngiflib/issues/25; https://github.com/miniupnp/ngiflib/
CVE: CVE-2023-3519
Published: 2023-07-19
Description: Unauthenticated remote code execution
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94, CWE-94
References: http://packetstormsecurity.com/files/173997/Citrix-ADC-NetScaler-Remote-Code-Execution.html; https://support.citrix.com/article/CTX561482/citrix-adc-and-citrix-gateway-security-bulletin-for-cve20233519-cve20233466-cve20233467; http://packetstormsecurity.com/files/173997/Citrix-ADC-NetScaler-Remote-Code-Execution.html
CVE: CVE-2023-37733
Published: 2023-07-19
Description: An arbitrary file upload vulnerability in tduck-platform v4.0 allows attackers to execute arbitrary code via a crafted HTML file.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://v40.com; https://github.com/TDuckCloud/tduck-platform; https://github.com/TDuckCloud/tduck-platform/issues/17
CVE: CVE-2023-3466
Published: 2023-07-19
Description: Reflected Cross-Site Scripting (XSS)

CVSS Score: 8.3 (HIGH)
CWE: CWE-20, CWE-79
References: https://support.citrix.com/article/CTX561482/citrix-adc-and-citrix-gateway-security-bulletin-for-cve20233519-cve20233466-cve20233467; https://support.citrix.com/article/CTX561482/citrix-adc-and-citrix-gateway-security-bulletin-for-cve20233519-cve20233466-cve20233467
CVE: CVE-2023-3467
Published: 2023-07-19
Description: Privilege Escalation to root administrator (nsroot)

CVSS Score: 8.0 (HIGH)
CWE: CWE-269
References: https://support.citrix.com/article/CTX561482/citrix-adc-and-citrix-gateway-security-bulletin-for-cve20233519-cve20233466-cve20233467; https://support.citrix.com/article/CTX561482/citrix-adc-and-citrix-gateway-security-bulletin-for-cve20233519-cve20233466-cve20233467
CVE: CVE-2023-3674
Published: 2023-07-19
Description: A flaw was found in the keylime attestation verifier, which fails to flag a device's submitted TPM quote as faulty when the quote's signature does not validate for some reason. Instead, it will only emit an error in the log without flagging the device as untrusted.
CVSS Score: 2.3 (LOW)
CWE: CWE-1283
References: https://access.redhat.com/errata/RHSA-2024:1139; https://access.redhat.com/security/cve/CVE-2023-3674; https://bugzilla.redhat.com/show_bug.cgi?id=2222903
CVE: CVE-2023-37276
Published: 2023-07-19
Description: aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. aiohttp v3.8.4 and earlier are bundled with llhttp v6.0.6. Vulnerable code is used by aiohttp for its HTTP request parser when available which is the default case when installing from a wheel. This vulnerability only affects users of aiohttp as an HTTP server (ie `aiohttp.Application`), you are not affected by this vulnerability if you are using aiohttp as an HTTP client library (ie `aiohttp.ClientSession`). Sending a crafted HTTP request will cause the server to misinterpret one of the HTTP header values leading to HTTP request smuggling. This issue has been addressed in version 3.8.5. Users are advised to upgrade. Users unable to upgrade can reinstall aiohttp using `AIOHTTP_NO_EXTENSIONS=1` as an environment variable to disable the llhttp HTTP request parser implementation. The pure Python implementation isn't vulnerable.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-444, CWE-444
References: https://github.com/aio-libs/aiohttp/blob/v3.8.4/.gitmodules; https://github.com/aio-libs/aiohttp/commit/9337fb3f2ab2b5f38d7e98a194bde6f7e3d16c40; https://github.com/aio-libs/aiohttp/security/advisories/GHSA-45c4-8wx5-qw6w
CVE: CVE-2023-37899
Published: 2023-07-19
Description: Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. Feathers socket handler did not catch invalid string conversion errors like `const message = ${{ toString: '' }}` which would cause the NodeJS process to crash when sending an unexpected Socket.io message like `socket.emit('find', { toString: '' })`.  A fix has been released in versions 5.0.8 and 4.5.18. Users are advised to upgrade. There is no known workaround for this vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-754
References: https://github.com/feathersjs/feathers/blob/crow/CHANGELOG.md#4518-2023-07-19; https://github.com/feathersjs/feathers/blob/dove/CHANGELOG.md#508-2023-07-19; https://github.com/feathersjs/feathers/pull/3241
CVE: CVE-2023-3722
Published: 2023-07-19
Description: An OS command injection vulnerability was found in the Avaya Aura Device Services Web application which could allow remote code execution as the Web server user via a malicious uploaded file. This issue affects Avaya Aura Device Services version 8.1.4.0 and earlier.
CVSS Score: 8.6 (HIGH)
CWE: CWE-434, CWE-434
References: https://download.avaya.com/css/public/documents/101076366; https://download.avaya.com/css/public/documents/101076366
CVE: CVE-2023-26217
Published: 2023-07-19
Description: The Data Exchange Add-on component of TIBCO Software Inc.'s TIBCO EBX Add-ons contains an easily exploitable vulnerability that allows a low privileged user with import permissions and network access to the EBX server to execute arbitrary SQL statements on the affected system. Affected releases are TIBCO Software Inc.'s TIBCO EBX Add-ons: versions 4.5.17 and below, versions 5.6.2 and below, version 6.1.0.


CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://www.tibco.com/services/support/advisories; https://www.tibco.com/services/support/advisories
CVE: CVE-2023-3782
Published: 2023-07-19
Description: DoS of the OkHttp client when using a BrotliInterceptor and surfing to a malicious web server, or when an attacker can perform MitM to inject a Brotli zip-bomb into an HTTP response


CVSS Score: 5.9 (MEDIUM)
CWE: CWE-400
References: https://github.com/square/okhttp/issues/7738; https://research.jfrog.com/vulnerabilities/okhttp-client-brotli-dos/; https://github.com/square/okhttp/issues/7738
CVE: CVE-2023-32657
Published: 2023-07-19
Description: 


Weintek Weincloud v0.13.6

 

could allow an attacker to efficiently develop a brute force attack on credentials with authentication hints from error message responses.








CVSS Score: 5.3 (MEDIUM)
CWE: CWE-307
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-199-04; https://www.cisa.gov/news-events/ics-advisories/icsa-23-199-04
CVE: CVE-2023-34394
Published: 2023-07-19
Description: 






In Keysight Geolocation Server v2.4.2 and prior, an attacker could upload a specially crafted malicious file or delete any file or directory with SYSTEM privileges due to an improper path validation, which could result in local privilege escalation or a denial-of-service condition.














CVSS Score: 7.8 (HIGH)
CWE: CWE-23, CWE-434
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-199-02; https://www.cisa.gov/news-events/ics-advisories/icsa-23-199-02
CVE: CVE-2023-34429
Published: 2023-07-19
Description: 


Weintek Weincloud v0.13.6

 

could allow an attacker to cause a denial-of-service condition for Weincloud by sending a forged JWT token.










CVSS Score: 7.5 (HIGH)
CWE: CWE-237
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-199-04; https://www.cisa.gov/news-events/ics-advisories/icsa-23-199-04
CVE: CVE-2023-35134
Published: 2023-07-19
Description: 


Weintek Weincloud v0.13.6

 could allow an attacker to reset a password with the corresponding account’s JWT token only.




CVSS Score: 7.4 (HIGH)
CWE: CWE-640
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-199-04; https://www.cisa.gov/news-events/ics-advisories/icsa-23-199-04
CVE: CVE-2023-36853
Published: 2023-07-19
Description: 




​In Keysight Geolocation Server v2.4.2 and prior, a low privileged attacker could create a local ZIP file containing a malicious script in any location. The attacker could abuse this to load a DLL with SYSTEM privileges.












CVSS Score: 7.8 (HIGH)
CWE: CWE-749, CWE-427
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-199-02; https://www.cisa.gov/news-events/ics-advisories/icsa-23-199-02
CVE: CVE-2023-37362
Published: 2023-07-19
Description: Weintek Weincloud v0.13.6

 

could allow an attacker to abuse the registration functionality to login with testing credentials to the official website.
CVSS Score: 7.2 (HIGH)
CWE: CWE-522
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-199-04; https://www.cisa.gov/news-events/ics-advisories/icsa-23-199-04
CVE: CVE-2023-3072
Published: 2023-07-20
Description: HashiCorp Nomad and Nomad Enterprise 0.7.0 up to 1.5.6 and 1.4.10 ACL policies using a block without a label generates unexpected results. Fixed in 1.6.0, 1.5.7, and 1.4.11.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-266, CWE-862
References: https://discuss.hashicorp.com/t/hcsec-2023-20-nomad-acl-policies-without-label-are-applied-to-unexpected-resources/56270; https://discuss.hashicorp.com/t/hcsec-2023-20-nomad-acl-policies-without-label-are-applied-to-unexpected-resources/56270
CVE: CVE-2023-3299
Published: 2023-07-20
Description: HashiCorp Nomad Enterprise 1.2.11 up to 1.5.6, and 1.4.10 ACL policies using a block without a label generates unexpected results. Fixed in 1.6.0, 1.5.7, and 1.4.11.
CVSS Score: 3.4 (LOW)
CWE: CWE-201, CWE-668
References: https://discuss.hashicorp.com/t/hcsec-2023-21-nomad-caller-acl-tokens-secret-id-is-exposed-to-sentinel/56271; https://discuss.hashicorp.com/t/hcsec-2023-21-nomad-caller-acl-tokens-secret-id-is-exposed-to-sentinel/56271
CVE: CVE-2023-3300
Published: 2023-07-20
Description: HashiCorp Nomad and Nomad Enterprise 0.11.0 up to 1.5.6 and 1.4.1 HTTP search API can reveal names of available CSI plugins to unauthenticated users or users without the plugin:read policy. Fixed in 1.6.0, 1.5.7, and 1.4.1.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-266, CWE-862
References: https://discuss.hashicorp.com/t/hcsec-2023-22-nomad-search-api-leaks-information-about-csi-plugins/56272; https://discuss.hashicorp.com/t/hcsec-2023-22-nomad-search-api-leaks-information-about-csi-plugins/56272
CVE: CVE-2022-28733
Published: 2023-07-20
Description: Integer underflow in grub_net_recv_ip4_packets; A malicious crafted IP packet can lead to an integer underflow in grub_net_recv_ip4_packets() function on rsm->total_len value. Under certain circumstances the total_len value may end up wrapping around to a small integer number which will be used in memory allocation. If the attack succeeds in such way, subsequent operations can write past the end of the buffer.
CVSS Score: 8.1 (HIGH)
CWE: CWE-191, CWE-191
References: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-28733; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.openwall.com/lists/oss-security/2022/06/07/5