deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-21993
Published: 2022-02-09
Description: Windows Services for NFS ONCRPC XDR Driver Information Disclosure Vulnerability
CVSS Score: 7.5 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21993; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21993
CVE: CVE-2022-21994
Published: 2022-02-09
Description: Windows DWM Core Library Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21994; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21994
CVE: CVE-2022-21995
Published: 2022-02-09
Description: Windows Hyper-V Remote Code Execution Vulnerability
CVSS Score: 7.9 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21995; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21995
CVE: CVE-2022-21996
Published: 2022-02-09
Description: Win32k Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21996; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21996
CVE: CVE-2022-21997
Published: 2022-02-09
Description: Windows Print Spooler Elevation of Privilege Vulnerability
CVSS Score: 7.1 (HIGH)
CWE: CWE-59
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21997; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21997
CVE: CVE-2022-21998
Published: 2022-02-09
Description: Windows Common Log File System Driver Information Disclosure Vulnerability
CVSS Score: 5.5 (MEDIUM)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21998; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21998
CVE: CVE-2022-21999
Published: 2022-02-09
Description: Windows Print Spooler Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-22, CWE-59, CWE-22, CWE-59
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21999; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21999; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-21999
CVE: CVE-2022-22000
Published: 2022-02-09
Description: Windows Common Log File System Driver Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-22000; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-22000
CVE: CVE-2022-22001
Published: 2022-02-09
Description: Windows Remote Access Connection Manager Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-22001; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-22001
CVE: CVE-2022-22002
Published: 2022-02-09
Description: Windows User Account Profile Picture Denial of Service Vulnerability
CVSS Score: 5.5 (MEDIUM)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-22002; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-22002
CVE: CVE-2022-22003
Published: 2022-02-09
Description: Microsoft Office Graphics Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-22003; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-22003
CVE: CVE-2022-22004
Published: 2022-02-09
Description: Microsoft Office ClickToRun Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-22004; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-22004
CVE: CVE-2022-22005
Published: 2022-02-09
Description: Microsoft SharePoint Server Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
CWE: CWE-502
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-22005; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-22005
CVE: CVE-2022-22709
Published: 2022-02-09
Description: VP9 Video Extensions Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-22709; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-22709
CVE: CVE-2022-22710
Published: 2022-02-09
Description: Windows Common Log File System Driver Denial of Service Vulnerability
CVSS Score: 5.5 (MEDIUM)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-22710; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-22710
CVE: CVE-2022-22712
Published: 2022-02-09
Description: Windows Hyper-V Denial of Service Vulnerability
CVSS Score: 5.6 (MEDIUM)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-22712; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-22712
CVE: CVE-2022-22715
Published: 2022-02-09
Description: Named Pipe File System Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-191
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-22715; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-22715
CVE: CVE-2022-22716
Published: 2022-02-09
Description: Microsoft Excel Information Disclosure Vulnerability
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-22716; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-22716
CVE: CVE-2022-22717
Published: 2022-02-09
Description: Windows Print Spooler Elevation of Privilege Vulnerability
CVSS Score: 7.0 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-22717; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-22717
CVE: CVE-2022-22718
Published: 2022-02-09
Description: Windows Print Spooler Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-22718; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-22718; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-22718
CVE: CVE-2022-23252
Published: 2022-02-09
Description: Microsoft Office Information Disclosure Vulnerability
CVSS Score: 5.5 (MEDIUM)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23252; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23252
CVE: CVE-2022-23254
Published: 2022-02-09
Description: Microsoft Power BI Information Disclosure Vulnerability
CVSS Score: 4.9 (MEDIUM)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23254; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23254
CVE: CVE-2022-23255
Published: 2022-02-09
Description: Microsoft OneDrive for Android Security Feature Bypass Vulnerability
CVSS Score: 5.9 (MEDIUM)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23255; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23255
CVE: CVE-2022-23256
Published: 2022-02-09
Description: Azure Data Explorer Spoofing Vulnerability
CVSS Score: 8.1 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23256; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-23256
CVE: CVE-2022-23269
Published: 2022-02-09
Description: Microsoft Dynamics GP Spoofing Vulnerability
CVSS Score: 5.4 (MEDIUM)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23269; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23269
CVE: CVE-2022-23271
Published: 2022-02-09
Description: Microsoft Dynamics GP Elevation Of Privilege Vulnerability
CVSS Score: 6.5 (MEDIUM)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23271; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23271
CVE: CVE-2022-23272
Published: 2022-02-09
Description: Microsoft Dynamics GP Elevation Of Privilege Vulnerability
CVSS Score: 8.1 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23272; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23272
CVE: CVE-2022-23273
Published: 2022-02-09
Description: Microsoft Dynamics GP Elevation Of Privilege Vulnerability
CVSS Score: 7.1 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23273; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23273
CVE: CVE-2022-23274
Published: 2022-02-09
Description: Microsoft Dynamics GP Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23274; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23274
CVE: CVE-2022-23276
Published: 2022-02-09
Description: SQL Server for Linux Containers Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23276; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23276
CVE: CVE-2022-23280
Published: 2022-02-09
Description: Microsoft Outlook for Mac Security Feature Bypass Vulnerability
CVSS Score: 5.3 (MEDIUM)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23280; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23280
CVE: CVE-2021-45330
Published: 2022-02-09
Description: An issue exsits in Gitea through 1.15.7, which could let a malicious user gain privileges due to client side cookies not being deleted and the session remains valid on the server side for reuse.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-459
References: https://github.com/go-gitea/gitea/issues/4336; https://github.com/go-gitea/gitea/issues/4336
CVE: CVE-2021-45331
Published: 2022-02-09
Description: An Authentication Bypass vulnerability exists in Gitea before 1.5.0, which could let a malicious user gain privileges. If captured, the TOTP code for the 2FA can be submitted correctly more than once.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://blog.gitea.io/2018/08/gitea-1.5.0-is-released/; https://github.com/go-gitea/gitea/pull/3878; https://blog.gitea.io/2018/08/gitea-1.5.0-is-released/
CVE: CVE-2021-36302
Published: 2022-02-09
Description: All Dell EMC Integrated System for Microsoft Azure Stack Hub versions contain a privilege escalation vulnerability. A remote malicious user with standard level JEA credentials may potentially exploit this vulnerability to elevate privileges and take over the system.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-269, CWE-269
References: https://www.dell.com/support/kbdoc/en-us/000191165/dsa-2021-178-dell-emc-integrated-solution-for-microsoft-azure-stack-hub-security-update-for-a-just-enough-administration-jea-vulnerability; https://www.dell.com/support/kbdoc/en-us/000191165/dsa-2021-178-dell-emc-integrated-solution-for-microsoft-azure-stack-hub-security-update-for-a-just-enough-administration-jea-vulnerability
CVE: CVE-2021-41442
Published: 2022-02-09
Description: An HTTP smuggling attack in the web application of D-Link DIR-X1860 before v1.10WWB09_Beta allows a remote unauthenticated attacker to DoS the web application via sending a specific HTTP packet.
CVSS Score: 7.5 (HIGH)
CWE: CWE-444
References: http://d-link.com; http://dir-x1860.com; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10283
CVE: CVE-2021-45286
Published: 2022-02-09
Description: Directory Traversal vulnerability exists in ZZCMS 2021 via the skin parameter in 1) index.php, 2) bottom.php, and 3) top_index.php.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: https://github.com/Boomingjacob/ZZCMS2021#readme; https://github.com/Boomingjacob/ZZCMS2021#readme
CVE: CVE-2022-21660
Published: 2022-02-09
Description: Gin-vue-admin is a backstage management system based on vue and gin. In versions prior to 2.4.7 low privilege users are able to modify higher privilege users. Authentication is missing on the `setUserInfo` function. Users are advised to update as soon as possible. There are no known workarounds.
CVSS Score: 8.1 (HIGH)
CWE: CWE-862
References: https://github.com/flipped-aurora/gin-vue-admin/security/advisories/GHSA-xxvh-9c87-pqjx; https://github.com/flipped-aurora/gin-vue-admin/security/advisories/GHSA-xxvh-9c87-pqjx
CVE: CVE-2022-22566
Published: 2022-02-09
Description: Select Dell Client Commercial and Consumer platforms contain a pre-boot direct memory access (DMA) vulnerability. An authenticated attacker with physical access to the system may potentially exploit this vulnerability in order to execute arbitrary code on the device.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-1190
References: https://www.dell.com/support/kbdoc/en-us/000195905/dsa-2022-028; https://www.dell.com/support/kbdoc/en-us/000195905/dsa-2022-028
CVE: CVE-2022-22567
Published: 2022-02-09
Description: Select Dell Client Commercial and Consumer platforms are vulnerable to an insufficient verification of data authenticity vulnerability. An authenticated malicious user may exploit this vulnerability in order to install modified BIOS firmware.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-345, CWE-345
References: https://www.dell.com/support/kbdoc/en-us/000195905/dsa-2022-028; https://www.dell.com/support/kbdoc/en-us/000195905/dsa-2022-028
CVE: CVE-2022-23615
Published: 2022-02-09
Description: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions any user with SCRIPT right can save a document with the right of the current user which allow accessing API requiring programming right if the current user has programming right. This has been patched in XWiki 13.0. Users are advised to update to resolve this issue. The only known workaround is to limit SCRIPT access.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-863, CWE-863
References: https://github.com/xwiki/xwiki-platform/commit/7ab0fe7b96809c7a[PII_REDACTED]598d46a1c9bbbe; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-f4cj-3q3h-884r; https://jira.xwiki.org/browse/XWIKI-5024
CVE: CVE-2022-23616
Published: 2022-02-09
Description: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions it's possible for an unprivileged user to perform a remote code execution by injecting a groovy script in her own profile and by calling the Reset password feature since the feature is performing a save of the user profile with programming rights in the impacted versions of XWiki. The issue has been patched in XWiki 13.1RC1. There are two different possible workarounds, each consisting of modifying the XWiki/ResetPassword page. 1. The Reset password feature can be entirely disabled by deleting the XWiki/ResetPassword page. 2. The script in XWiki/ResetPassword can also be modified or removed: an administrator can replace it with a simple email contact to ask an administrator to reset the password.
CVSS Score: 8.8 (HIGH)
CWE: CWE-74
References: https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-mgjw-2wrp-r535; https://jira.xwiki.org/browse/XWIKI-16661; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-mgjw-2wrp-r535
CVE: CVE-2022-23617
Published: 2022-02-09
Description: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions any user with edit right can copy the content of a page it does not have access to by using it as template of a new page. This issue has been patched in XWiki 13.2CR1 and 12.10.6. Users are advised to update. There are no known workarounds for this issue.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://github.com/xwiki/xwiki-platform/commit/30c52b01559b8ef5ed1035dac7c34aaf805764d5; https://github.com/xwiki/xwiki-platform/commit/b35ef0edd4f2ff2c974cbeef6b80fcf9b5a44554; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-gf7x-2j2x-7f73
CVE: CVE-2022-23618
Published: 2022-02-09
Description: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions there is no protection against URL redirection to untrusted sites, in particular some well known parameters (xredirect) can be used to perform url redirections. This problem has been patched in XWiki 12.10.7 and XWiki 13.3RC1. Users are advised to update. There are no known workarounds for this issue.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-601
References: https://github.com/xwiki/xwiki-platform/commit/5251c02080466bf9fb55288f04a37671108f8096; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-jp55-vvmf-63mv; https://jira.xwiki.org/browse/XWIKI-10309
CVE: CVE-2022-23619
Published: 2022-02-09
Description: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions it's possible to guess if a user has an account on the wiki by using the "Forgot your password" form, even if the wiki is closed to guest users. This problem has been patched on XWiki 12.10.9, 13.4.1 and 13.6RC1. Users are advised yo update. There are no known workarounds for this issue.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200, CWE-640
References: https://github.com/xwiki/xwiki-platform/commit/d8a3cce48e0ac1a0f4a3cea7a19747382d9c9494; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-35fg-hjcr-j65f; https://jira.xwiki.org/browse/XWIKI-18787
CVE: CVE-2022-23620
Published: 2022-02-09
Description: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions AbstractSxExportURLFactoryActionHandler#processSx does not escape anything from SSX document references when serializing it on filesystem, it is possible to for the HTML export process to contain reference elements containing filesystem syntax like "../", "./". or "/" in general. The referenced elements are not properly escaped. This issue has been resolved in version 13.6-rc-1. This issue can be worked around by limiting or disabling document export.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22, CWE-116
References: https://github.com/xwiki/xwiki-platform/commit/ab778254fb8f71c774e1c1239368c44fe3b6bba5; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-7ph6-5cmq-xgjq; https://jira.xwiki.org/browse/XWIKI-18819
CVE: CVE-2022-23621
Published: 2022-02-09
Description: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions any user with SCRIPT right can read any file located in the XWiki WAR (for example xwiki.cfg and xwiki.properties) through XWiki#invokeServletAndReturnAsString as `$xwiki.invokeServletAndReturnAsString("/WEB-INF/xwiki.cfg")`. This issue has been patched in XWiki versions 12.10.9, 13.4.3 and 13.7-rc-1. Users are advised to update. The only workaround is to limit SCRIPT right.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-862, CWE-552, CWE-862
References: https://github.com/xwiki/xwiki-platform/commit/df8bd49b5a4d87a427002c6535fb5b1746ff117a; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-2jhm-qp48-hv5j; https://jira.xwiki.org/browse/XWIKI-18870
CVE: CVE-2022-23622
Published: 2022-02-09
Description: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions there is a cross site scripting (XSS) vector in the `registerinline.vm` template related to the `xredirect` hidden field. This template is only used in the following conditions: 1. The wiki must be open to registration for anyone. 2. The wiki must be closed to view for Guest users or more specifically the XWiki.Registration page must be forbidden in View for guest user. A way to obtain the second condition is when administrators checked the "Prevent unregistered users from viewing pages, regardless of the page rights" box in the administration rights. This issue is patched in versions 12.10.11, 14.0-rc-1, 13.4.7, 13.10.3. There are two main ways for protecting against this vulnerability, the easiest and the best one is by applying a patch in the `registerinline.vm` template, the patch consists in checking the value of the xredirect field to ensure it matches: `<input type="hidden" name="xredirect" value="$escapetool.xml($!request.xredirect)" />`. If for some reason it's not possible to patch this file, another workaround is to ensure "Prevent unregistered users from viewing pages, regardless of the page rights" is not checked in the rights and apply a better right scheme using groups and rights on spaces.
CVSS Score: 7.4 (HIGH)
CWE: CWE-79
References: https://github.com/xwiki/xwiki-platform/commit/053d957d53f2a543d158f3ab651e390d2728e0b9; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-gx6h-936c-vrrr; https://jira.xwiki.org/browse/XWIKI-19291
CVE: CVE-2022-23628
Published: 2022-02-09
Description: OPA is an open source, general-purpose policy engine. Under certain conditions, pretty-printing an abstract syntax tree (AST) that contains synthetic nodes could change the logic of some statements by reordering array literals. Example of policies impacted are those that parse and compare web paths. **All of these** three conditions have to be met to create an adverse effect: 1. An AST of Rego had to be **created programmatically** such that it ends up containing terms without a location (such as wildcard variables). 2. The AST had to be **pretty-printed** using the `github.com/open-policy-agent/opa/format` package. 3. The result of the pretty-printing had to be **parsed and evaluated again** via an OPA instance using the bundles, or the Golang packages. If any of these three conditions are not met, you are not affected. Notably, all three would be true if using **optimized bundles**, i.e. bundles created with `opa build -O=1` or higher. In that case, the optimizer would fulfil condition (1.), the result of that would be pretty-printed when writing the bundle to disk, fulfilling (2.). When the bundle was then used, we'd satisfy (3.). As a workaround users may disable optimization when creating bundles.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-682
References: https://github.com/open-policy-agent/opa/commit/932e4ffc37a590ace79e9b75ca4340288c220239; https://github.com/open-policy-agent/opa/commit/bfd984ddf93ef2c4963a08d4fdadae0bcf1a3717; https://github.com/open-policy-agent/opa/pull/3851
CVE: CVE-2022-23631
Published: 2022-02-09
Description: superjson is a program to allow JavaScript expressions to be serialized to a superset of JSON. In versions prior to 1.8.1 superjson allows input to run arbitrary code on any server using superjson input without prior authentication or knowledge. The only requirement is that the server implements at least one endpoint which uses superjson during request processing. This has been patched in superjson 1.8.1. Users are advised to update. There are no known workarounds for this issue.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-94, CWE-1321
References: https://github.com/advisories/GHSA-5888-ffcr-r425; https://github.com/blitz-js/superjson/security/advisories/GHSA-5888-ffcr-r425; https://www.sonarsource.com/blog/blitzjs-prototype-pollution/
CVE: CVE-2021-0060
Published: 2022-02-09
Description: Insufficient compartmentalization in HECI subsystem for the Intel(R) SPS before versions SPS_E5_04.01.04.516.0, SPS_E5_04.04.04.033.0, SPS_E5_04.04.03.281.0, SPS_E5_03.01.03.116.0, SPS_E3_05.01.04.309.0, SPS_02.04.00.101.0, SPS_SoC-A_05.00.03.114.0, SPS_SoC-X_04.00.04.326.0, SPS_SoC-X_03.00.03.117.0, IGN_E5_91.00.00.167.0, SPS_PHI_03.01.03.078.0 may allow an authenticated user to potentially enable escalation of privilege via physical access.
CVSS Score: 6.6 (MEDIUM)
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00470.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2021-0066
Published: 2022-02-09
Description: Improper input validation in firmware for Intel(R) PROSet/Wireless Wi-Fi in multiple operating systems and Killer(TM) Wi-Fi in Windows 10 and 11 may allow an unauthenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 8.4 (HIGH)
CWE: CWE-20, CWE-20
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00539.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00539.html