deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-25104
Published: 2022-02-24
Description: HorizontCMS v1.0.0-beta.2 was discovered to contain an arbitrary file download vulnerability via the component /admin/file-manager/.
CVSS Score: 7.5 (HIGH)
CWE: CWE-552
References: https://github.com/ttimot24/HorizontCMS/issues/43; https://github.com/ttimot24/HorizontCMS/issues/43
CVE: CVE-2022-25290
Published: 2022-02-24
Description: WatchGuard Firebox and XTM appliances allow an authenticated remote attacker with unprivileged credentials to retrieve certificate private keys. This vulnerability impacts Fireware OS before 12.7.2_U2, 12.x before 12.1.3_U8, and 12.2.x through 12.5.x before 12.5.9_U2.
CVSS Score: 6.5 (MEDIUM)
References: https://www.watchguard.com/support/release-notes/fireware/12/en-US/EN_ReleaseNotes_Fireware_12_7_2/index.html#Fireware/en-US/resolved_issues.html; https://www.watchguard.com/support/release-notes/fireware/12/en-US/EN_ReleaseNotes_Fireware_12_7_2/index.html#Fireware/en-US/resolved_issues.html
CVE: CVE-2022-25291
Published: 2022-02-24
Description: An integer overflow in WatchGuard Firebox and XTM appliances allows an authenticated remote attacker to trigger a heap-based buffer overflow and potentially execute arbitrary code by initiating a firmware update with a malicious upgrade image. This vulnerability impacts Fireware OS before 12.7.2_U2, 12.x before 12.1.3_U8, and 12.2.x through 12.5.x before 12.5.9_U2.
CVSS Score: 8.8 (HIGH)
CWE: CWE-190
References: https://www.watchguard.com/support/release-notes/fireware/12/en-US/EN_ReleaseNotes_Fireware_12_7_2/index.html#Fireware/en-US/resolved_issues.html; https://www.watchguard.com/support/release-notes/fireware/12/en-US/EN_ReleaseNotes_Fireware_12_7_2/index.html#Fireware/en-US/resolved_issues.html
CVE: CVE-2022-25292
Published: 2022-02-24
Description: A wgagent stack-based buffer overflow in WatchGuard Firebox and XTM appliances allows an authenticated remote attacker to potentially execute arbitrary code by initiating a firmware update with a malicious upgrade image. This vulnerability impacts Fireware OS before 12.7.2_U2, 12.x before 12.1.3_U8, and 12.2.x through 12.5.x before 12.5.9_U2.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://cwe.mitre.org/data/definitions/121.html; https://www.watchguard.com/support/release-notes/fireware/12/en-US/EN_ReleaseNotes_Fireware_12_7_2/index.html#Fireware/en-US/resolved_issues.html; https://cwe.mitre.org/data/definitions/121.html
CVE: CVE-2022-25293
Published: 2022-02-24
Description: A systemd stack-based buffer overflow in WatchGuard Firebox and XTM appliances allows an authenticated remote attacker to potentially execute arbitrary code by initiating a firmware update with a malicious upgrade image. This vulnerability impacts Fireware OS before 12.7.2_U2, 12.x before 12.1.3_U8, and 12.2.x through 12.5.x before 12.5.9_U2.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://cwe.mitre.org/data/definitions/121.html; https://www.watchguard.com/support/release-notes/fireware/12/en-US/EN_ReleaseNotes_Fireware_12_7_2/index.html#Fireware/en-US/resolved_issues.html; https://cwe.mitre.org/data/definitions/121.html
CVE: CVE-2022-25355
Published: 2022-02-24
Description: EC-CUBE 3.0.0 to 3.0.18-p3 and EC-CUBE 4.0.0 to 4.1.1 improperly handle HTTP Host header values, which may lead a remote unauthenticated attacker to direct the vulnerable version of EC-CUBE to send an Email with some forged reissue-password URL to EC-CUBE users.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-913
References: https://jvn.jp/en/jp/JVN53871926/index.html; https://www.ec-cube.net/info/weakness/20220221/; https://jvn.jp/en/jp/JVN53871926/index.html
CVE: CVE-2022-25360
Published: 2022-02-24
Description: WatchGuard Firebox and XTM appliances allow an authenticated remote attacker with unprivileged credentials to upload files to arbitrary locations. This vulnerability impacts Fireware OS before 12.7.2_U2, 12.x before 12.1.3_U8, and 12.2.x through 12.5.x before 12.5.9_U2.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://www.watchguard.com/support/release-notes/fireware/12/en-US/EN_ReleaseNotes_Fireware_12_7_2/index.html#Fireware/en-US/resolved_issues.html; https://www.watchguard.com/support/release-notes/fireware/12/en-US/EN_ReleaseNotes_Fireware_12_7_2/index.html#Fireware/en-US/resolved_issues.html
CVE: CVE-2022-25363
Published: 2022-02-24
Description: WatchGuard Firebox and XTM appliances allow an authenticated remote attacker with unprivileged credentials to modify privileged management user credentials. This vulnerability impacts Fireware OS before 12.7.2_U2, 12.x before 12.1.3_U8, and 12.2.x through 12.5.x before 12.5.9_U2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: https://www.watchguard.com/support/release-notes/fireware/12/en-US/EN_ReleaseNotes_Fireware_12_7_2/index.html#Fireware/en-US/resolved_issues.html; https://www.watchguard.com/support/release-notes/fireware/12/en-US/EN_ReleaseNotes_Fireware_12_7_2/index.html#Fireware/en-US/resolved_issues.html
CVE: CVE-2022-25401
Published: 2022-02-24
Description: The copy function of the file manager in Cuppa CMS v1.0 allows any file to be copied to the current directory, granting attackers read access to arbitrary files.
CVSS Score: 7.5 (HIGH)
References: https://github.com/dota-st/Vulnerability/blob/master/CuppaCMS/CuppaCMS_second.md; https://github.com/dota-st/Vulnerability/blob/master/CuppaCMS/CuppaCMS_second.md
CVE: CVE-2022-25402
Published: 2022-02-24
Description: An incorrect access control issue in HMS v1.0 allows unauthenticated attackers to read and modify all PHP files.
CVSS Score: 9.1 (CRITICAL)
References: https://github.com/dota-st/Vulnerability/blob/master/HMS/HMS.md; https://github.com/dota-st/Vulnerability/blob/master/HMS/HMS.md
CVE: CVE-2022-25403
Published: 2022-02-24
Description: HMS v1.0 was discovered to contain a SQL injection vulnerability via the component admin.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/dota-st/Vulnerability/blob/master/HMS/HMS.md; https://github.com/dota-st/Vulnerability/blob/master/HMS/HMS.md
CVE: CVE-2022-25404
Published: 2022-02-24
Description: Tongda2000 v11.10 was discovered to contain a SQL injection vulnerability in delete.php via the DELETE_STR parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/dota-st/Vulnerability/blob/master/tongdaOA/V11.10.md; https://exchange.xforce.ibmcloud.com/vulnerabilities/220423; https://github.com/dota-st/Vulnerability/blob/master/tongdaOA/V11.10.md
CVE: CVE-2022-25405
Published: 2022-02-24
Description: Tongda2000 v11.10 was discovered to contain a SQL injection vulnerability in change_box.php via the DELETE_STR parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/dota-st/Vulnerability/blob/master/tongdaOA/V11.10_sql_1.md; https://exchange.xforce.ibmcloud.com/vulnerabilities/220422; https://github.com/dota-st/Vulnerability/blob/master/tongdaOA/V11.10_sql_1.md
CVE: CVE-2022-25406
Published: 2022-02-24
Description: Tongda2000 v11.10 was discovered to contain a SQL injection vulnerability in delete_query.php via the DELETE_STR parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/dota-st/Vulnerability/blob/master/tongdaOA/V11.10_sql_2.md; https://exchange.xforce.ibmcloud.com/vulnerabilities/220421; https://github.com/dota-st/Vulnerability/blob/master/tongdaOA/V11.10_sql_2.md
CVE: CVE-2022-25414
Published: 2022-02-24
Description: Tenda AC9 V15.03.2.21_cn was discovered to contain a stack overflow via the parameter NPTR.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/EPhaha/IOT_vuln/tree/main/Tenda/AC9/1; https://github.com/EPhaha/IOT_vuln/tree/main/Tenda/AC9/1
CVE: CVE-2022-25417
Published: 2022-02-24
Description: Tenda AC9 V15.03.2.21_cn was discovered to contain a stack overflow via the function saveparentcontrolinfo.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/EPhaha/IOT_vuln/tree/main/Tenda/AC9/3; https://github.com/EPhaha/IOT_vuln/tree/main/Tenda/AC9/3
CVE: CVE-2022-25418
Published: 2022-02-24
Description: Tenda AC9 V15.03.2.21_cn was discovered to contain a stack overflow via the function openSchedWifi.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/EPhaha/IOT_vuln/tree/main/Tenda/AC9/2; https://github.com/EPhaha/IOT_vuln/tree/main/Tenda/AC9/2
CVE: CVE-2022-25636
Published: 2022-02-24
Description: net/netfilter/nf_dup_netdev.c in the Linux kernel 5.4 through 5.6.10 allows local users to gain privileges because of a heap out-of-bounds write. This is related to nf_tables_offload.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: http://packetstormsecurity.com/files/166444/Kernel-Live-Patch-Security-Notice-LSN-0085-1.html; http://www.openwall.com/lists/oss-security/2022/02/22/1; https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git/commit/?id=b1a5983f56e371046dcf164f90bfaf704d2b89f6
CVE: CVE-2022-25638
Published: 2022-02-24
Description: In wolfSSL before 5.2.0, certificate validation may be bypassed during attempted authentication by a TLS 1.3 client to a TLS 1.3 server. This occurs when the sig_algo field differs between the certificate_verify message and the certificate message.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-295
References: https://github.com/wolfSSL/wolfssl/pull/4813; https://www.wolfssl.com/docs/security-vulnerabilities/; https://github.com/wolfSSL/wolfssl/pull/4813
CVE: CVE-2022-25640
Published: 2022-02-24
Description: In wolfSSL before 5.2.0, a TLS 1.3 server cannot properly enforce a requirement for mutual authentication. A client can simply omit the certificate_verify message from the handshake, and never present a certificate.
CVSS Score: 7.5 (HIGH)
CWE: CWE-295
References: https://github.com/wolfSSL/wolfssl/pull/4831; https://github.com/wolfSSL/wolfssl/pull/4831
CVE: CVE-2022-25643
Published: 2022-02-24
Description: seatd-launch in seatd 0.6.x before 0.6.4 allows removing files with escalated privileges when installed setuid root. The attack vector is a user-supplied socket pathname.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-668
References: https://github.com/kennylevinsen/seatd/commit/10658dc5439db429af0088295a051c53925a4416; https://github.com/kennylevinsen/seatd/commit/7cffe0797fdb17a9c[PII_REDACTED]5b1b187394335; https://github.com/kennylevinsen/seatd/compare/0.6.3...0.6.4
CVE: CVE-2022-25809
Published: 2022-02-24
Description: Improper Neutralization of audio output from 3rd and 4th Generation Amazon Echo Dot devices allows arbitrary voice command execution on these devices via a malicious skill (in the case of remote attackers) or by pairing a malicious Bluetooth device (in the case of physically proximate attackers), aka an "Alexa versus Alexa (AvA)" attack.
CVSS Score: 9.8 (CRITICAL)
References: https://arxiv.org/abs/2202.08619; https://arxiv.org/abs/2202.08619
CVE: CVE-2022-25838
Published: 2022-02-24
Description: Laravel Fortify before 1.11.1 allows reuse within a short time window, thus calling into question the "OT" part of the "TOTP" concept.
CVSS Score: 8.1 (HIGH)
CWE: CWE-294
References: https://github.com/laravel/fortify/issues/201#issuecomment[PII_REDACTED]; https://github.com/laravel/fortify/issues/201#issuecomment[PII_REDACTED]
CVE: CVE-2022-0732
Published: 2022-02-24
Description: The backend infrastructure shared by multiple mobile device monitoring services does not adequately authenticate or authorize API requests, creating an IDOR (Insecure Direct Object Reference) vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284, CWE-639
References: https://cwe.mitre.org/data/definitions/284.html; https://kb.cert.org/vuls/id/229438; https://techcrunch.com/2022/02/22/stalkerware-network-spilling-data/
CVE: CVE-2022-24687
Published: 2022-02-24
Description: HashiCorp Consul and Consul Enterprise 1.9.0 through 1.9.14, 1.10.7, and 1.11.2 clusters with at least one Ingress Gateway allow a user with service:write to register a specifically-defined service that can cause Consul servers to panic. Fixed in 1.9.15, 1.10.8, and 1.11.3.
CVSS Score: 6.5 (MEDIUM)
References: https://discuss.hashicorp.com; https://discuss.hashicorp.com/t/hcsec-2022-05-consul-ingress-gateway-panic-can-shutdown-servers/; https://security.gentoo.org/glsa/202208-09
CVE: CVE-2022-24707
Published: 2022-02-24
Description: Anuko Time Tracker is an open source, web-based time tracking application written in PHP. UNION SQL injection and time-based blind injection vulnerabilities existed in Time Tracker Puncher plugin in versions of anuko timetracker prior to 1.20.0.5642. This was happening because the Puncher plugin was reusing code from other places and was relying on an unsanitized date parameter in POST requests. Because the parameter was not checked, it was possible to craft POST requests with malicious SQL for Time Tracker database. This issue has been resolved in in version 1.20.0.5642. Users unable to upgrade are advised to add their own checks to input.
CVSS Score: 7.4 (HIGH)
CWE: CWE-89, CWE-89
References: http://packetstormsecurity.com/files/167060/Anuko-Time-Tracker-1.20.0.5640-SQL-Injection.html; https://github.com/anuko/timetracker/commit/0e2d6563e2d969209c502a1eae4ddd8e87b73299; https://github.com/anuko/timetracker/security/advisories/GHSA-wqx7-95fx-wjxj
CVE: CVE-2022-24708
Published: 2022-02-24
Description: Anuko Time Tracker is an open source, web-based time tracking application written in PHP. ttUser.class.php in Time Tracker versions prior to 1.20.0.5646 was not escaping primary group name for display. Because of that, it was possible for a logged in user to modify primary group name with elements of JavaScript. Such script could then be executed in user browser on subsequent requests on pages where primary group name was displayed. This is vulnerability has been fixed in version 1.20.0.5646. Users who are unable to upgrade may modify ttUser.class.php to use an additional call to htmlspecialchars when printing group name.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://github.com/anuko/timetracker/commit/6aaad31630500d13b6c8459daa9f406fd5eb4330; https://github.com/anuko/timetracker/security/advisories/GHSA-rgcm-xgvj-5mqh; https://github.com/anuko/timetracker/commit/6aaad31630500d13b6c8459daa9f406fd5eb4330
CVE: CVE-2021-38994
Published: 2022-02-24
Description: IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the AIX kernel to cause a denial of service. IBM X-Force ID: 213072.
CVSS Score: 5.5 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/213072; https://www.ibm.com/support/pages/node/6558948; https://exchange.xforce.ibmcloud.com/vulnerabilities/213072
CVE: CVE-2021-38995
Published: 2022-02-24
Description: IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the AIX kernel to cause a denial of service. IBM X-Force ID: 213073.
CVSS Score: 5.5 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/213073; https://www.ibm.com/support/pages/node/6558948; https://exchange.xforce.ibmcloud.com/vulnerabilities/213073
CVE: CVE-2021-39038
Published: 2022-02-24
Description: IBM WebSphere Application Server 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 22.0.0.2 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim. IBM X-Force ID: 213968.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-1021
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/213968; https://www.ibm.com/support/pages/node/6559044; https://exchange.xforce.ibmcloud.com/vulnerabilities/213968
CVE: CVE-2022-22349
Published: 2022-02-24
Description: IBM Sterling External Authentication Server 3.4.3.2, 6.0.2.0, and 6.0.3.0 is vulnerable to path traversals, due to not properly validating RESTAPI configuration data. An authorized user could import invalid data which could be used for an attack. IBM X-Force ID: 220144.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/220144; https://www.ibm.com/support/pages/node/6558928; https://exchange.xforce.ibmcloud.com/vulnerabilities/220144
CVE: CVE-2022-22793
Published: 2022-02-24
Description: Cybonet - PineApp Mail Relay Local File Inclusion. Attacker can send a request to : /manage/mailpolicymtm/log/eml_viewer/email.content.body.php?filesystem_path=ENCDODED PATH and by doing that, the attacker can read Local Files inside the server.
CVSS Score: 6.1 (MEDIUM)
References: https://www.gov.il/en/departments/faq/cve_advisories; https://www.gov.il/en/departments/faq/cve_advisories
CVE: CVE-2022-22794
Published: 2022-02-24
Description: Cybonet - PineApp Mail Relay Unauthenticated Sql Injection. Attacker can send a request to: /manage/emailrichment/userlist.php?CUSTOMER_ID_INNER=1 /admin/emailrichment/userlist.php?CUSTOMER_ID_INNER=1 /manage/emailrichment/usersunlist.php?CUSTOMER_ID_INNER=1 /admin/emailrichment/usersunlist.php?CUSTOMER_ID_INNER=1 and by doing that, the attacker can run Remote Code Execution in one liner.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: https://www.gov.il/en/departments/faq/cve_advisories; https://www.gov.il/en/departments/faq/cve_advisories
CVE: CVE-2020-10632
Published: 2022-02-24
Description: Inadequate folder security permissions in Emerson OpenEnterprise versions through 3.3.4 may allow modification of important configuration files, which could cause the system to fail or behave in an unpredictable manner.
CVSS Score: 8.8 (HIGH)
CWE: CWE-282
References: https://www.cisa.gov/uscert/ics/advisories/icsa-20-140-02; https://www.cisa.gov/uscert/ics/advisories/icsa-20-140-02
CVE: CVE-2020-10635
Published: 2022-02-24
Description: Simulation models for KUKA.Sim Pro version 3.1 are hosted by a server maintained by KUKA. When these devices request a model, the server transmits the model in plaintext.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-924, CWE-924
References: https://www.cisa.gov/uscert/ics/advisories/icsa-20-098-05; https://www.cisa.gov/uscert/ics/advisories/icsa-20-098-05
CVE: CVE-2020-10636
Published: 2022-02-24
Description: Inadequate encryption may allow the passwords for Emerson OpenEnterprise versions through 3.3.4 user accounts to be obtained.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-326, CWE-326
References: https://www.cisa.gov/uscert/ics/advisories/icsa-20-140-02; https://www.cisa.gov/uscert/ics/advisories/icsa-20-140-02
CVE: CVE-2020-10640
Published: 2022-02-24
Description: Emerson OpenEnterprise versions through 3.3.4 may allow an attacker to run an arbitrary commands with system privileges or perform remote code execution via a specific communication service.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-306, CWE-306
References: https://www.cisa.gov/uscert/ics/advisories/icsa-20-140-02; https://www.cisa.gov/uscert/ics/advisories/icsa-20-140-02
CVE: CVE-2020-14478
Published: 2022-02-24
Description: A local, authenticated attacker could use an XML External Entity (XXE) attack to exploit weakly configured XML files to access local or remote content. A successful exploit could potentially cause a denial-of-service condition and allow the attacker to arbitrarily read any local file via system-level services.
CVSS Score: 7.1 (HIGH)
CWE: CWE-611, CWE-611
References: https://www.cisa.gov/uscert/ics/advisories/icsa-20-177-02; https://www.cisa.gov/uscert/ics/advisories/icsa-20-177-02
CVE: CVE-2020-14480
Published: 2022-02-24
Description: Due to usernames/passwords being stored in plaintext in Random Access Memory (RAM), a local, authenticated attacker could gain access to certain credentials, including Windows Logon credentials.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-312, CWE-312
References: https://www.cisa.gov/uscert/ics/advisories/icsa-20-177-03; https://www.cisa.gov/uscert/ics/advisories/icsa-20-177-03
CVE: CVE-2020-14481
Published: 2022-02-24
Description: The DeskLock tool provided with FactoryTalk View SE uses a weak encryption algorithm that may allow a local, authenticated attacker to decipher user credentials, including the Windows user or Windows DeskLock passwords. If the compromised user has an administrative account, an attacker could gain full access to the user’s operating system and certain components of FactoryTalk View SE.
CVSS Score: 7.8 (HIGH)
CWE: CWE-261, CWE-326
References: https://www.cisa.gov/uscert/ics/advisories/icsa-20-177-03; https://www.cisa.gov/uscert/ics/advisories/icsa-20-177-03
CVE: CVE-2020-14502
Published: 2022-02-24
Description: The web interface of the 1734-AENTR communication module is vulnerable to stored XSS. A remote, unauthenticated attacker could store a malicious script within the web interface that, when executed, could modify some string values on the homepage of the web interface.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.cisa.gov/uscert/ics/advisories/icsa-21-063-01; https://www.cisa.gov/uscert/ics/advisories/icsa-21-063-01
CVE: CVE-2020-14504
Published: 2022-02-24
Description: The web interface of the 1734-AENTR communication module mishandles authentication for HTTP POST requests. A remote, unauthenticated attacker can send a crafted request that may allow for modification of the configuration settings.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-284, CWE-287, CWE-287
References: https://www.cisa.gov/uscert/ics/advisories/icsa-21-063-01; https://www.cisa.gov/uscert/ics/advisories/icsa-21-063-01
CVE: CVE-2021-26252
Published: 2022-02-24
Description: A flaw was found in htmldoc in v1.9.12. Heap buffer overflow in pspdf_prepare_page(),in ps-pdf.cxx may lead to execute arbitrary code and denial of service.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://bugzilla.redhat.com/show_bug.cgi?id=1967009; https://bugzilla.redhat.com/show_bug.cgi?id=1967009
CVE: CVE-2021-3596
Published: 2022-02-24
Description: A NULL pointer dereference flaw was found in ImageMagick in versions prior to 7.0.10-31 in ReadSVGImage() in coders/svg.c. This issue is due to not checking the return value from libxml2's xmlCreatePushParserCtxt() and uses the value directly, which leads to a crash and segmentation fault.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://bugzilla.redhat.com/show_bug.cgi?id=1970569; https://github.com/ImageMagick/ImageMagick/issues/2624; https://lists.debian.org/debian-lts-announce/2022/05/msg00018.html
CVE: CVE-2021-3607
Published: 2022-02-24
Description: An integer overflow was found in the QEMU implementation of VMWare's paravirtual RDMA device in versions prior to 6.1.0. The issue occurs while handling a "PVRDMA_REG_DSRHIGH" write from the guest due to improper input validation. This flaw allows a privileged guest user to make QEMU allocate a large amount of memory, resulting in a denial of service. The highest threat from this vulnerability is to system availability.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-190, CWE-190
References: https://bugzilla.redhat.com/show_bug.cgi?id=1973349; https://lists.debian.org/debian-lts-announce/2022/09/msg00008.html; https://lists.gnu.org/archive/html/qemu-devel/2021-06/msg07925.html
CVE: CVE-2021-3608
Published: 2022-02-24
Description: A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device in versions prior to 6.1.0. The issue occurs while handling a "PVRDMA_REG_DSRHIGH" write from the guest and may result in a crash of QEMU or cause undefined behavior due to the access of an uninitialized pointer. The highest threat from this vulnerability is to system availability.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-824, CWE-824
References: https://bugzilla.redhat.com/show_bug.cgi?id=1973383; https://lists.debian.org/debian-lts-announce/2022/09/msg00008.html; https://lists.gnu.org/archive/html/qemu-devel/2021-06/msg07926.html
CVE: CVE-2021-3610
Published: 2022-02-24
Description: A heap-based buffer overflow vulnerability was found in ImageMagick in versions prior to 7.0.11-14 in ReadTIFFImage() in coders/tiff.c. This issue is due to an incorrect setting of the pixel array size, which can lead to a crash and segmentation fault.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125, CWE-787
References: http://www.openwall.com/lists/oss-security/2023/05/29/4; http://www.openwall.com/lists/oss-security/2023/06/05/1; https://bugzilla.redhat.com/show_bug.cgi?id=1973689