deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-39369
Published: 2022-11-01
Description: phpCAS is an authentication library that allows PHP applications to easily authenticate users via a Central Authentication Service (CAS) server. The phpCAS library uses HTTP headers to determine the service URL used to validate tickets. This allows an attacker to control the host header and use a valid ticket granted for any authorized service in the same SSO realm (CAS server) to authenticate to the service protected by phpCAS. Depending on the settings of the CAS server service registry in worst case this may be any other service URL (if the allowed URLs are configured to "^(https)://.*") or may be strictly limited to known and authorized services in the same SSO federation if proper URL service validation is applied. This vulnerability may allow an attacker to gain access to a victim's account on a vulnerable CASified service without victim's knowledge, when the victim visits attacker's website while being logged in to the same CAS server. phpCAS 1.6.0 is a major version upgrade that starts enforcing service URL discovery validation, because there is unfortunately no 100% safe default config to use in PHP. Starting this version, it is required to pass in an additional service base URL argument when constructing the client class. For more information, please refer to the upgrading doc. This vulnerability only impacts the CAS client that the phpCAS library protects against. The problematic service URL discovery behavior in phpCAS < 1.6.0 will only be disabled, and thus you are not impacted from it, if the phpCAS configuration has the following setup: 1. `phpCAS::setUrl()` is called (a reminder that you have to pass in the full URL of the current page, rather than your service base URL), and 2. `phpCAS::setCallbackURL()` is called, only when the proxy mode is enabled. 3. If your PHP's HTTP header input `X-Forwarded-Host`, `X-Forwarded-Server`, `Host`, `X-Forwarded-Proto`, `X-Forwarded-Protocol` is sanitized before reaching PHP (by a reverse proxy, for example), you will not be impacted by this vulnerability either. If your CAS server service registry is configured to only allow known and trusted service URLs the severity of the vulnerability is reduced substantially in its severity since an attacker must be in control of another authorized service. Otherwise, you should upgrade the library to get the safe service discovery behavior.
CVSS Score: 8.0 (HIGH)
CWE: CWE-99, CWE-1287
References: https://github.com/apereo/phpCAS/security/advisories/GHSA-8q72-6qq8-xv64; https://lists.debian.org/debian-lts-announce/2023/07/msg00007.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2XL7SMW6ESSP2Y6HHRYWW2MMCZSI4LBZ/
CVE: CVE-2022-40839
Published: 2022-11-01
Description: A SQL injection vulnerability in the height and width parameter in NdkAdvancedCustomizationFields v3.5.0 allows unauthenticated attackers to exfiltrate database data.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89, CWE-89
References: http://ndk.com; http://ndkadvancedcustomizationfields.com; https://github.com/daaaalllii/cve-s/blob/main/CVE-2022-40839/poc.txt
CVE: CVE-2020-4099
Published: 2022-11-01
Description: The application was signed using a key length less than or equal to 1024 bits, making it potentially vulnerable to forged digital signatures. An attacker could forge the same digital signature of the app after maliciously modifying the app.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-326, CWE-326
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0100861; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0100861
CVE: CVE-2022-23738
Published: 2022-11-01
Description: An improper cache key vulnerability was identified in GitHub Enterprise Server that allowed an unauthorized actor to access private repository files through a public repository. To exploit this, an actor would need to already be authorized on the GitHub Enterprise Server instance, be able to create a public repository, and have a site administrator visit a specially crafted URL. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.6 and was fixed in versions 3.2.20, 3.3.15, 3.4.10, 3.5.7, 3.6.3. This vulnerability was reported via the GitHub Bug Bounty program.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-200, CWE-552
References: https://docs.github.com/en/enterprise-server%403.2/admin/release-notes#3.2.20; https://docs.github.com/en/enterprise-server%403.3/admin/release-notes#3.3.15; https://docs.github.com/en/enterprise-server%403.4/admin/release-notes#3.4.10
CVE: CVE-2022-3602
Published: 2022-11-01
Description: A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed the malicious certificate or for the application to continue certificate verification despite failure to construct a path to a trusted issuer. An attacker can craft a malicious email address to overflow four attacker-controlled bytes on the stack. This buffer overflow could result in a crash (causing a denial of service) or potentially remote code execution. Many platforms implement stack overflow protections which would mitigate against the risk of remote code execution. The risk may be further mitigated based on stack layout for any given platform/compiler. Pre-announcements of CVE-2022-3602 described this issue as CRITICAL. Further analysis based on some of the mitigating factors described above have led this to be downgraded to HIGH. Users are still encouraged to upgrade to a new version as soon as possible. In a TLS client, this can be triggered by connecting to a malicious server. In a TLS server, this can be triggered if the server requests client authentication and a malicious client connects. Fixed in OpenSSL 3.0.7 (Affected 3.0.0,3.0.1,3.0.2,3.0.3,3.0.4,3.0.5,3.0.6).
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-787
References: http://packetstormsecurity.com/files/169687/OpenSSL-Security-Advisory-20221101.html; http://www.openwall.com/lists/oss-security/2022/11/01/15; http://www.openwall.com/lists/oss-security/2022/11/01/16
CVE: CVE-2022-3786
Published: 2022-11-01
Description: A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed a malicious certificate or for an application to continue certificate verification despite failure to construct a path to a trusted issuer. An attacker can craft a malicious email address in a certificate to overflow an arbitrary number of bytes containing the `.' character (decimal 46) on the stack. This buffer overflow could result in a crash (causing a denial of service). In a TLS client, this can be triggered by connecting to a malicious server. In a TLS server, this can be triggered if the server requests client authentication and a malicious client connects.


CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=c42165b5706e42f67ef8ef4c351a9a4c5d21639a; https://www.openssl.org/news/secadv/20221101.txt; https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=c42165b5706e42f67ef8ef4c351a9a4c5d21639a
CVE: CVE-2022-3304
Published: 2022-11-01
Description: Use after free in CSS in Google Chrome prior to 106.0.5249.62 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2022/09/stable-channel-update-for-desktop_27.html; https://crbug.com/1358907; https://chromereleases.googleblog.com/2022/09/stable-channel-update-for-desktop_27.html
CVE: CVE-2022-3780
Published: 2022-11-01
Description: Database connections on deleted users could stay active on MySQL data sources in Remote Desktop Manager 2022.3.7 and below which allow deleted users to access unauthorized data. 

This issue affects : 
Remote Desktop Manager 2022.3.7 and prior versions.


CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://devolutions.net/security/advisories/DEVO-2022-0008; https://devolutions.net/security/advisories/DEVO-2022-0008
CVE: CVE-2022-3781
Published: 2022-11-01
Description: Dashlane password and Keepass Server password in My Account Settings  are not encrypted in the database in Devolutions Remote Desktop Manager 2022.2.26 and prior versions and Devolutions Server 2022.3.1 and prior versions which allows database users to read the data.

This issue affects : 
Remote Desktop Manager 2022.2.26 and prior versions.

Devolutions Server 2022.3.1 and prior versions.



CVSS Score: 6.5 (MEDIUM)
CWE: CWE-311, CWE-522
References: https://devolutions.net/security/advisories/DEVO-2022-0009; https://devolutions.net/security/advisories/DEVO-2022-0009
CVE: CVE-2022-43328
Published: 2022-11-01
Description: Canteen Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /editorder.php.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/YReyi/bug_report/blob/main/vendors/mayuri_k/canteen-management-system/SQLi-2.md; https://github.com/YReyi/bug_report/blob/main/vendors/mayuri_k/canteen-management-system/SQLi-2.md
CVE: CVE-2022-43329
Published: 2022-11-01
Description: Canteen Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /print.php.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/YReyi/bug_report/blob/main/vendors/mayuri_k/canteen-management-system/SQLi-1.md; https://github.com/YReyi/bug_report/blob/main/vendors/mayuri_k/canteen-management-system/SQLi-1.md
CVE: CVE-2022-43330
Published: 2022-11-01
Description: Canteen Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /editorder.php.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/YReyi/bug_report/blob/main/vendors/mayuri_k/canteen-management-system/SQLi-2.md; https://github.com/YReyi/bug_report/blob/main/vendors/mayuri_k/canteen-management-system/SQLi-2.md
CVE: CVE-2022-43331
Published: 2022-11-01
Description: Canteen Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /php_action/printOrder.php.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/YReyi/bug_report/blob/main/vendors/mayuri_k/canteen-management-system/SQLi-3.md; https://github.com/YReyi/bug_report/blob/main/vendors/mayuri_k/canteen-management-system/SQLi-3.md
CVE: CVE-2022-43361
Published: 2022-11-01
Description: Senayan Library Management System v9.4.2 was discovered to contain a cross-site scripting (XSS) vulnerability via the component pop_chart.php.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/slims/slims9_bulian/issues/162; https://github.com/slims/slims9_bulian/issues/162
CVE: CVE-2022-43362
Published: 2022-11-01
Description: Senayan Library Management System v9.4.2 was discovered to contain a SQL injection vulnerability via the collType parameter at loan_by_class.php.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/slims/slims9_bulian/issues/163; https://github.com/slims/slims9_bulian/issues/163
CVE: CVE-2022-22658
Published: 2022-11-01
Description: An input validation issue was addressed with improved input validation. This issue is fixed in iOS 16.0.3. Processing a maliciously crafted email message may lead to a denial-of-service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://support.apple.com/en-us/HT213480; https://support.apple.com/en-us/HT213480
CVE: CVE-2022-22677
Published: 2022-11-01
Description: A logic issue in the handling of concurrent media was addressed with improved state handling. This issue is fixed in macOS Monterey 12.4, iOS 15.5 and iPadOS 15.5. Video self-preview in a webRTC call may be interrupted if the user answers a phone call.
CVSS Score: 4.3 (MEDIUM)
References: https://support.apple.com/en-us/HT213257; https://support.apple.com/en-us/HT213258; https://support.apple.com/en-us/HT213257
CVE: CVE-2022-26709
Published: 2022-11-01
Description: A use after free issue was addressed with improved memory management. This issue is fixed in tvOS 15.5, iOS 15.5 and iPadOS 15.5, watchOS 8.6, macOS Monterey 12.4, Safari 15.5. Processing maliciously crafted web content may lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://support.apple.com/en-us/HT213253; https://support.apple.com/en-us/HT213254; https://support.apple.com/en-us/HT213257
CVE: CVE-2022-26710
Published: 2022-11-01
Description: A use after free issue was addressed with improved memory management. This issue is fixed in iOS 15.5 and iPadOS 15.5, macOS Monterey 12.4, tvOS 15.5, watchOS 8.6. Processing maliciously crafted web content may lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://support.apple.com/en-us/HT213253; https://support.apple.com/en-us/HT213254; https://support.apple.com/en-us/HT213257
CVE: CVE-2022-26716
Published: 2022-11-01
Description: A memory corruption issue was addressed with improved state management. This issue is fixed in tvOS 15.5, iOS 15.5 and iPadOS 15.5, watchOS 8.6, macOS Monterey 12.4, Safari 15.5. Processing maliciously crafted web content may lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://support.apple.com/en-us/HT213253; https://support.apple.com/en-us/HT213254; https://support.apple.com/en-us/HT213257
CVE: CVE-2022-26717
Published: 2022-11-01
Description: A use after free issue was addressed with improved memory management. This issue is fixed in tvOS 15.5, watchOS 8.6, iOS 15.5 and iPadOS 15.5, macOS Monterey 12.4, Safari 15.5, iTunes 12.12.4 for Windows. Processing maliciously crafted web content may lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://support.apple.com/en-us/HT213253; https://support.apple.com/en-us/HT213254; https://support.apple.com/en-us/HT213257
CVE: CVE-2022-26719
Published: 2022-11-01
Description: A memory corruption issue was addressed with improved state management. This issue is fixed in tvOS 15.5, iOS 15.5 and iPadOS 15.5, watchOS 8.6, macOS Monterey 12.4, Safari 15.5. Processing maliciously crafted web content may lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://support.apple.com/en-us/HT213253; https://support.apple.com/en-us/HT213254; https://support.apple.com/en-us/HT213257
CVE: CVE-2022-26730
Published: 2022-11-01
Description: A memory corruption issue existed in the processing of ICC profiles. This issue was addressed with improved input validation. This issue is fixed in macOS Ventura 13. Processing a maliciously crafted image may lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://support.apple.com/en-us/HT213488; https://support.apple.com/en-us/HT213488
CVE: CVE-2022-26762
Published: 2022-11-01
Description: A memory corruption issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.4, iOS 15.5 and iPadOS 15.5. A malicious application may be able to execute arbitrary code with system privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://support.apple.com/en-us/HT213257; https://support.apple.com/en-us/HT213258; https://support.apple.com/en-us/HT213257
CVE: CVE-2022-32794
Published: 2022-11-01
Description: A logic issue was addressed with improved state management. This issue is fixed in Security Update 2022-004 Catalina, macOS Monterey 12.4, macOS Big Sur 11.6.6. An app may be able to gain elevated privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://support.apple.com/en-us/HT213255; https://support.apple.com/en-us/HT213256; https://support.apple.com/en-us/HT213257
CVE: CVE-2022-32827
Published: 2022-11-01
Description: A memory corruption issue was addressed with improved state management. This issue is fixed in iOS 16, macOS Ventura 13. An app may be able to cause a denial-of-service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: http://packetstormsecurity.com/files/169929/AppleAVD-deallocateKernelMemoryInternal-Missing-Surface-Lock.html; https://support.apple.com/en-us/HT213446; https://support.apple.com/en-us/HT213488
CVE: CVE-2022-32835
Published: 2022-11-01
Description: This issue was addressed with improved entitlements. This issue is fixed in iOS 16, watchOS 9. An app may be able to read a persistent device identifier.
CVSS Score: 3.3 (LOW)
CWE: CWE-200
References: https://support.apple.com/en-us/HT213446; https://support.apple.com/en-us/HT213486; https://support.apple.com/en-us/HT213446
CVE: CVE-2022-32858
Published: 2022-11-01
Description: The issue was addressed with improved memory handling. This issue is fixed in iOS 16, macOS Ventura 13, watchOS 9. An app may be able to leak sensitive kernel state.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://support.apple.com/en-us/HT213446; https://support.apple.com/en-us/HT213486; https://support.apple.com/en-us/HT213488
CVE: CVE-2022-32859
Published: 2022-11-01
Description: A logic issue was addressed with improved state management. This issue is fixed in iOS 16. Deleted contacts may still appear in spotlight search results.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-642
References: https://support.apple.com/en-us/HT213446; https://support.apple.com/en-us/HT213446
CVE: CVE-2022-32862
Published: 2022-11-01
Description: This issue was addressed with improved data protection. This issue is fixed in macOS Big Sur 11.7.1, macOS Ventura 13, macOS Monterey 12.6.1. An app with root privileges may be able to access private information.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://support.apple.com/en-us/HT213488; https://support.apple.com/en-us/HT213493; https://support.apple.com/en-us/HT213494
CVE: CVE-2022-32865
Published: 2022-11-01
Description: The issue was addressed with improved memory handling. This issue is fixed in iOS 16, macOS Ventura 13. An app may be able to execute arbitrary code with kernel privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://support.apple.com/en-us/HT213446; https://support.apple.com/en-us/HT213488; https://support.apple.com/en-us/HT213446
CVE: CVE-2022-32866
Published: 2022-11-01
Description: The issue was addressed with improved memory handling. This issue is fixed in macOS Big Sur 11.7, macOS Ventura 13, watchOS 9, macOS Monterey 12.6, tvOS 16. An app may be able to execute arbitrary code with kernel privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://support.apple.com/en-us/HT213443; https://support.apple.com/en-us/HT213444; https://support.apple.com/en-us/HT213486
CVE: CVE-2022-32867
Published: 2022-11-01
Description: This issue was addressed with improved data protection. This issue is fixed in iOS 16, macOS Ventura 13. A user with physical access to an iOS device may be able to read past diagnostic logs.
CVSS Score: 2.4 (LOW)
CWE: CWE-922
References: https://support.apple.com/en-us/HT213446; https://support.apple.com/en-us/HT213488; https://support.apple.com/en-us/HT213446
CVE: CVE-2022-32870
Published: 2022-11-01
Description: A logic issue was addressed with improved state management. This issue is fixed in iOS 16, macOS Ventura 13, watchOS 9. A user with physical access to a device may be able to use Siri to obtain some call history information.
CVSS Score: 2.4 (LOW)
CWE: CWE-200
References: https://support.apple.com/en-us/HT213446; https://support.apple.com/en-us/HT213486; https://support.apple.com/en-us/HT213488
CVE: CVE-2022-32875
Published: 2022-11-01
Description: A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.7, macOS Ventura 13, iOS 16, watchOS 9, macOS Monterey 12.6. An app may be able to read sensitive location information.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: https://support.apple.com/en-us/HT213443; https://support.apple.com/en-us/HT213444; https://support.apple.com/en-us/HT213446
CVE: CVE-2022-32877
Published: 2022-11-01
Description: A configuration issue was addressed with additional restrictions. This issue is fixed in macOS Big Sur 11.7, macOS Monterey 12.6. An app may be able to access user-sensitive data.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://support.apple.com/en-us/HT213443; https://support.apple.com/en-us/HT213444; https://support.apple.com/kb/HT213446
CVE: CVE-2022-32879
Published: 2022-11-01
Description: A logic issue was addressed with improved state management. This issue is fixed in macOS Ventura 13, iOS 16, iOS 15.7 and iPadOS 15.7, watchOS 9, tvOS 16. A user with physical access to a device may be able to access contacts from the lock screen.
CVSS Score: 2.4 (LOW)
References: https://support.apple.com/en-us/HT213445; https://support.apple.com/en-us/HT213446; https://support.apple.com/en-us/HT213486
CVE: CVE-2022-32881
Published: 2022-11-01
Description: A logic issue was addressed with improved restrictions. This issue is fixed in macOS Big Sur 11.7, macOS Ventura 13, iOS 16, watchOS 9, macOS Monterey 12.6, tvOS 16. An app may be able to modify protected parts of the file system.
CVSS Score: 5.5 (MEDIUM)
References: https://support.apple.com/en-us/HT213443; https://support.apple.com/en-us/HT213444; https://support.apple.com/en-us/HT213446
CVE: CVE-2022-32887
Published: 2022-11-01
Description: The issue was addressed with improved memory handling. This issue is fixed in iOS 16. An app may be able to execute arbitrary code with kernel privileges.
CVSS Score: 7.8 (HIGH)
References: https://support.apple.com/en-us/HT213446; https://support.apple.com/en-us/HT213446
CVE: CVE-2022-32888
Published: 2022-11-01
Description: An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Big Sur 11.7, macOS Ventura 13, iOS 16, iOS 15.7 and iPadOS 15.7, watchOS 9, macOS Monterey 12.6, tvOS 16. Processing maliciously crafted web content may lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: http://www.openwall.com/lists/oss-security/2022/11/04/4; https://security.gentoo.org/glsa/202305-32; https://support.apple.com/en-us/HT213443
CVE: CVE-2022-32889
Published: 2022-11-01
Description: The issue was addressed with improved memory handling. This issue is fixed in iOS 16, watchOS 9. An app may be able to execute arbitrary code with kernel privileges.
CVSS Score: 7.8 (HIGH)
References: https://support.apple.com/en-us/HT213446; https://support.apple.com/en-us/HT213486; https://support.apple.com/en-us/HT213446
CVE: CVE-2022-32890
Published: 2022-11-01
Description: A logic issue was addressed with improved checks. This issue is fixed in macOS Ventura 13. A sandboxed process may be able to circumvent sandbox restrictions.
CVSS Score: 8.6 (HIGH)
References: https://support.apple.com/en-us/HT213488; https://support.apple.com/en-us/HT213488
CVE: CVE-2022-32892
Published: 2022-11-01
Description: An access issue was addressed with improvements to the sandbox. This issue is fixed in Safari 16, iOS 15.7 and iPadOS 15.7, iOS 16, macOS Ventura 13. A sandboxed process may be able to circumvent sandbox restrictions.
CVSS Score: 8.6 (HIGH)
References: https://support.apple.com/en-us/HT213442; https://support.apple.com/en-us/HT213445; https://support.apple.com/en-us/HT213446
CVE: CVE-2022-32895
Published: 2022-11-01
Description: A race condition was addressed with improved state handling. This issue is fixed in macOS Ventura 13. An app may be able to modify protected parts of the file system.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-362, CWE-362
References: https://support.apple.com/en-us/HT213488; https://support.apple.com/en-us/HT213488