deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-39249
Published: 2022-09-28
Description: Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript. Prior to version 19.7.0, an attacker cooperating with a malicious homeserver can construct messages appearing to have come from another person. Such messages will be marked with a grey shield on some platforms, but this may be missing in others. This attack is possible due to the matrix-js-sdk implementing a too permissive key forwarding strategy on the receiving end. Starting with version 19.7.0, the default policy for accepting key forwards has been made more strict in the matrix-js-sdk. matrix-js-sdk will now only accept forwarded keys in response to previously issued requests and only from own, verified devices. The SDK now sets a `trusted` flag on the decrypted message upon decryption, based on whether the key used to decrypt the message was received from a trusted source. Clients need to ensure that messages decrypted with a key with `trusted = false` are decorated appropriately, for example, by showing a warning for such messages. This attack requires coordination between a malicious homeserver and an attacker, and those who trust your homeservers do not need a workaround.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287, CWE-322, CWE-287
References: https://github.com/matrix-org/matrix-js-sdk/commit/a587d7c36026fe1fcf93dfff63588abee359be76; https://github.com/matrix-org/matrix-js-sdk/releases/tag/v19.7.0; https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-6263-x97c-c4gg
CVE: CVE-2022-39251
Published: 2022-09-28
Description: Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript. Prior to version 19.7.0, an attacker cooperating with a malicious homeserver can construct messages that legitimately appear to have come from another person, without any indication such as a grey shield. Additionally, a sophisticated attacker cooperating with a malicious homeserver could employ this vulnerability to perform a targeted attack in order to send fake to-device messages appearing to originate from another user. This can allow, for example, to inject the key backup secret during a self-verification, to make a targeted device start using a malicious key backup spoofed by the homeserver. These attacks are possible due to a protocol confusion vulnerability that accepts to-device messages encrypted with Megolm instead of Olm. Starting with version 19.7.0, matrix-js-sdk has been modified to only accept Olm-encrypted to-device messages. Out of caution, several other checks have been audited or added. This attack requires coordination between a malicious home server and an attacker, so those who trust their home servers do not need a workaround.
CVSS Score: 8.6 (HIGH)
CWE: CWE-287, CWE-322, CWE-287
References: https://github.com/matrix-org/matrix-js-sdk/commit/a587d7c36026fe1fcf93dfff63588abee359be76; https://github.com/matrix-org/matrix-js-sdk/releases/tag/v19.7.0; https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-r48r-j8fx-mq2c
CVE: CVE-2022-3215
Published: 2022-09-28
Description: NIOHTTP1 and projects using it for generating HTTP responses can be subject to a HTTP Response Injection attack. This occurs when a HTTP/1.1 server accepts user generated input from an incoming request and reflects it into a HTTP/1.1 response header in some form. A malicious user can add newlines to their input (usually in encoded form) and "inject" those newlines into the returned HTTP response. This capability allows users to work around security headers and HTTP/1.1 framing headers by injecting entirely false responses or other new headers. The injected false responses may also be treated as the response to subsequent requests, which can lead to XSS, cache poisoning, and a number of other flaws. This issue was resolved by adding validation to the HTTPHeaders type, ensuring that there's no whitespace incorrectly present in the HTTP headers provided by users. As the existing API surface is non-failable, all invalid characters are replaced by linear whitespace.
CVSS Score: 7.5 (HIGH)
CWE: CWE-113, CWE-74
References: https://github.com/apple/swift-nio/security/advisories/GHSA-7fj7-39wj-c64f; https://github.com/apple/swift-nio/security/advisories/GHSA-7fj7-39wj-c64f
CVE: CVE-2022-3287
Published: 2022-09-28
Description: When creating an OPERATOR user account on the BMC, the redfish plugin saved the auto-generated password to /etc/fwupd/redfish.conf without proper restriction, allowing any user on the system to read the same configuration file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-256, CWE-552
References: https://github.com/fwupd/fwupd/commit/ea676855f2119e36d433fbd2ed604039f53b2091; https://github.com/fwupd/fwupd/commit/ea676855f2119e36d433fbd2ed604039f53b2091
CVE: CVE-2022-29089
Published: 2022-09-28
Description: Dell Networking OS10, versions prior to October 2021 with Smart Fabric Services enabled, contains an information disclosure vulnerability. A remote, unauthenticated attacker could potentially exploit this vulnerability by reverse engineering to retrieve sensitive information and access the REST API with admin privileges.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-522, CWE-522
References: https://www.dell.com/support/kbdoc/en-us/000202971/dsa-2022-135-dell-emc-smartfabric-os10-security-update-for-multiple-security-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000202971/dsa-2022-135-dell-emc-smartfabric-os10-security-update-for-multiple-security-vulnerabilities
CVE: CVE-2022-34394
Published: 2022-09-28
Description: Dell OS10, version 10.5.3.4, contains an Improper Certificate Validation vulnerability in Support Assist. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to unauthorized access to limited switch configuration data. The vulnerability could be leveraged by attackers to conduct man-in-the-middle attacks to gain access to the Support Assist information.
CVSS Score: 3.7 (LOW)
CWE: CWE-295, CWE-295
References: https://www.dell.com/support/kbdoc/en-us/000202974/dsa-2022-293-dell-networking-os10-security-update-for-a-support-assist-vulnerability; https://www.dell.com/support/kbdoc/en-us/000202974/dsa-2022-293-dell-networking-os10-security-update-for-a-support-assist-vulnerability
CVE: CVE-2022-34424
Published: 2022-09-28
Description: Networking OS10, versions 10.5.1.x, 10.5.2.x, and 10.5.3.x contain a vulnerability that could allow an attacker to cause a system crash by running particular security scans.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.dell.com/support/kbdoc/en-us/000202971/dsa-2022-135-dell-emc-smartfabric-os10-security-update-for-multiple-security-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000202971/dsa-2022-135-dell-emc-smartfabric-os10-security-update-for-multiple-security-vulnerabilities
CVE: CVE-2022-39255
Published: 2022-09-28
Description: Matrix iOS SDK allows developers to build iOS apps compatible with Matrix. Prior to version 0.23.19, an attacker cooperating with a malicious homeserver can construct messages that legitimately appear to have come from another person, without any indication such as a grey shield. Additionally, a sophisticated attacker cooperating with a malicious homeserver could employ this vulnerability to perform a targeted attack in order to send fake to-device messages appearing to originate from another user. This can allow, for example, to inject the key backup secret during a self-verification, to make a targeted device start using a malicious key backup spoofed by the homeserver. These attacks are possible due to a protocol confusion vulnerability that accepts to-device messages encrypted with Megolm instead of Olm. matrix-ios-sdk version 0.23.19 has been modified to only accept Olm-encrypted to-device messages. Out of caution, several other checks have been audited or added. This attack requires coordination between a malicious home server and an attacker, so those who trust their home servers do not need a workaround. To avoid malicious backup attacks, one should not verify one's new logins using emoji/QR verifications methods until patched.
CVSS Score: 8.6 (HIGH)
CWE: CWE-287, CWE-322, CWE-287
References: https://github.com/matrix-org/matrix-ios-sdk/commit/5ca86c328a5faaab429c240551cb9ca8f0f6262c; https://github.com/matrix-org/matrix-ios-sdk/releases/tag/v0.23.19; https://github.com/matrix-org/matrix-ios-sdk/security/advisories/GHSA-hw6g-j8v6-9hcm
CVE: CVE-2022-39257
Published: 2022-09-28
Description: Matrix iOS SDK allows developers to build iOS apps compatible with Matrix. Prior to version 0.23.19, an attacker cooperating with a malicious homeserver can construct messages appearing to have come from another person. Such messages will be marked with a grey shield on some platforms, but this may be missing in others. This attack is possible due to the matrix-ios-sdk implementing a too permissive key forwarding strategy. The default policy for accepting key forwards has been made more strict in the matrix-ios-sdk version 0.23.19. matrix-ios-sdk will now only accept forwarded keys in response to previously issued requests and only from own, verified devices. The SDK now sets a `trusted` flag on the decrypted message upon decryption, based on whether the key used to decrypt the message was received from a trusted source. Clients need to ensure that messages decrypted with a key with `trusted = false` are decorated appropriately (for example, by showing a warning for such messages). This attack requires coordination between a malicious home server and an attacker, so those who trust their home servers do not need a workaround.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287, CWE-322, CWE-287
References: https://github.com/matrix-org/matrix-ios-sdk/commit/5ca86c328a5faaab429c240551cb9ca8f0f6262c; https://github.com/matrix-org/matrix-ios-sdk/releases/tag/v0.23.19; https://github.com/matrix-org/matrix-ios-sdk/security/advisories/GHSA-qxr3-5jmq-xcf4
CVE: CVE-2022-39263
Published: 2022-09-28
Description: `@next-auth/upstash-redis-adapter` is the Upstash Redis adapter for NextAuth.js, which provides authentication for Next.js. Applications that use `next-auth` Email Provider and `@next-auth/upstash-redis-adapter` before v3.0.2 are affected by this vulnerability. The Upstash Redis adapter implementation did not check for both the identifier (email) and the token, but only checking for the identifier when verifying the token in the email callback flow. An attacker who knows about the victim's email could easily sign in as the victim, given the attacker also knows about the verification token's expired duration. The vulnerability is patched in v3.0.2. A workaround is available. Using Advanced Initialization, developers can check the requests and compare the query's token and identifier before proceeding.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-287
References: https://github.com/nextauthjs/next-auth/commit/d16e04848ee703cf797724194d4ad2907fe125a9; https://github.com/nextauthjs/next-auth/security/advisories/GHSA-4rxr-27mm-mxq9; https://github.com/nextauthjs/next-auth/commit/d16e04848ee703cf797724194d4ad2907fe125a9
CVE: CVE-2022-3292
Published: 2022-09-28
Description: Use of Cache Containing Sensitive Information in GitHub repository ikus060/rdiffweb prior to 2.4.8.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-524
References: https://github.com/ikus060/rdiffweb/commit/[PII_REDACTED]618405a13113377a784f3102465f40; https://huntr.dev/bounties/e9309018-e94f-4e15-b7d1-5d38b6021c5d; https://github.com/ikus060/rdiffweb/commit/[PII_REDACTED]618405a13113377a784f3102465f40
CVE: CVE-2022-40707
Published: 2022-09-28
Description: An Out-of-bounds read vulnerability in Trend Micro Deep Security 20 and Cloud One - Workload Security Agent for Windows could allow a local attacker to disclose sensitive information on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit these vulnerabilities. This vulnerability is similar to, but not identical to CVE-2022-40708.
CVSS Score: 3.3 (LOW)
CWE: CWE-125
References: https://success.trendmicro.com/solution/000291590; https://www.zerodayinitiative.com/advisories/ZDI-22-1297/; https://success.trendmicro.com/solution/000291590
CVE: CVE-2022-40708
Published: 2022-09-28
Description: An Out-of-bounds read vulnerability in Trend Micro Deep Security 20 and Cloud One - Workload Security Agent for Windows could allow a local attacker to disclose sensitive information on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit these vulnerabilities. This vulnerability is similar to, but not identical to CVE-2022-40707.
CVSS Score: 3.3 (LOW)
CWE: CWE-125, CWE-125
References: https://success.trendmicro.com/solution/000291590; https://www.zerodayinitiative.com/advisories/ZDI-22-1298/; https://success.trendmicro.com/solution/000291590
CVE: CVE-2022-40709
Published: 2022-09-28
Description: An Out-of-bounds read vulnerability in Trend Micro Deep Security 20 and Cloud One - Workload Security Agent for Windows could allow a local attacker to disclose sensitive information on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit these vulnerabilities. This vulnerability is similar to, but not identical to CVE-2022-40707 and 40708.
CVSS Score: 3.3 (LOW)
CWE: CWE-125
References: https://success.trendmicro.com/solution/000291590; https://www.zerodayinitiative.com/advisories/ZDI-22-1299/; https://success.trendmicro.com/solution/000291590
CVE: CVE-2022-40710
Published: 2022-09-28
Description: A link following vulnerability in Trend Micro Deep Security 20 and Cloud One - Workload Security Agent for Windows could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-59
References: https://success.trendmicro.com/solution/000291590; https://www.zerodayinitiative.com/advisories/ZDI-22-1296/; https://success.trendmicro.com/solution/000291590
CVE: CVE-2022-39264
Published: 2022-09-28
Description: nheko is a desktop client for the Matrix communication application. All versions below 0.10.2 are vulnerable homeservers inserting malicious secrets, which could lead to man-in-the-middle attacks. Users can upgrade to version 0.10.2 to protect against this issue. As a workaround, one may apply the patch manually, avoid doing verifications of one's own devices, and/or avoid pressing the request button in the settings menu.
CVSS Score: 8.6 (HIGH)
CWE: CWE-287, CWE-295
References: https://github.com/Nheko-Reborn/nheko/commit/67bee15a389f9b8a9f6c3a340558d1e2319e7199; https://github.com/Nheko-Reborn/nheko/releases/tag/v0.10.2; https://github.com/Nheko-Reborn/nheko/security/advisories/GHSA-8jcp-8jq4-5mm7
CVE: CVE-2022-31628
Published: 2022-09-28
Description: In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the phar uncompressor code would recursively uncompress "quines" gzip files, resulting in an infinite loop.
CVSS Score: 2.3 (LOW)
CWE: CWE-674, CWE-835
References: https://bugs.php.net/bug.php?id=81726; https://lists.debian.org/debian-lts-announce/2022/12/msg00030.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2L5SUVYGAKSWODUQPZFBUB3AL6E6CSEV/
CVE: CVE-2022-31629
Published: 2022-09-28
Description: In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the vulnerability enables network and same-site attackers to set a standard insecure cookie in the victim's browser which is treated as a `__Host-` or `__Secure-` cookie by PHP applications.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20, CWE-1284
References: http://www.openwall.com/lists/oss-security/2024/04/12/11; https://bugs.php.net/bug.php?id=81727; https://lists.debian.org/debian-lts-announce/2022/12/msg00030.html
CVE: CVE-2022-3326
Published: 2022-09-29
Description: Weak Password Requirements in GitHub repository ikus060/rdiffweb prior to 2.4.9.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-521, CWE-521
References: https://github.com/ikus060/rdiffweb/commit/ee98e5af78ec60db8a17fef6ea0ca250e3f31eec; https://huntr.dev/bounties/1f6a5e49-23f2-45f7-8661-19f9cee8ae97; https://github.com/ikus060/rdiffweb/commit/ee98e5af78ec60db8a17fef6ea0ca250e3f31eec
CVE: CVE-2022-35888
Published: 2022-09-29
Description: Ampere Altra and Ampere Altra Max devices through 2022-07-15 allow attacks via Hertzbleed, which is a power side-channel attack that extracts secret information from the CPU by correlating the power consumption with data being processed on the system.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-203, CWE-203
References: https://amperecomputing.com/products/security-bulletins/hertzbleed.html; https://developer.arm.com/documentation/ka005111/1-0/?lang=en; https://amperecomputing.com/products/security-bulletins/hertzbleed.html
CVE: CVE-2022-39173
Published: 2022-09-29
Description: In wolfSSL before 5.5.1, malicious clients can cause a buffer overflow during a TLS 1.3 handshake. This occurs when an attacker supposedly resumes a previous TLS session. During the resumption Client Hello a Hello Retry Request must be triggered. Both Client Hellos are required to contain a list of duplicate cipher suites to trigger the buffer overflow. In total, two Client Hellos have to be sent: one in the resumed session, and a second one as a response to a Hello Retry Request message.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-787
References: http://packetstormsecurity.com/files/169600/wolfSSL-Buffer-Overflow.html; http://seclists.org/fulldisclosure/2022/Oct/24; https://blog.trailofbits.com/2023/01/12/wolfssl-vulnerabilities-tlspuffin-fuzzing-ssh/
CVE: CVE-2022-40048
Published: 2022-09-29
Description: Flatpress v1.2.1 was discovered to contain a remote code execution (RCE) vulnerability in the Upload File function.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434, CWE-434
References: http://flatpress.com; https://github.com/flatpressblog/flatpress/issues/152; http://flatpress.com
CVE: CVE-2019-5797
Published: 2022-09-29
Description: Double free in DOMStorage in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 7.5 (HIGH)
CWE: CWE-415, CWE-415
References: https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html; https://crbug.com/916523; https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html
CVE: CVE-2011-4820
Published: 2022-09-29
Description: IBM Rational Asset Manager 7.5 could allow a remote attacker to bypass security restrictions. An attacker could exploit this vulnerability using the UID parameter to modify another user's preferences.
CVSS Score: 4.3 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/71161; https://exchange.xforce.ibmcloud.com/vulnerabilities/71161
CVE: CVE-2012-2160
Published: 2022-09-29
Description: IBM Rational Change 5.3 is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability using the SUPP_TEMPLATE_FLAG parameter in a specially-crafted URL to execute script in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/74753; https://www.ibm.com/support/pages/node/589933; https://exchange.xforce.ibmcloud.com/vulnerabilities/74753
CVE: CVE-2012-2201
Published: 2022-09-29
Description: IBM WebSphere MQ 7.1 is vulnerable to a denial of service, caused by an error when handling user ids. A remote attacker could exploit this vulnerability to bypass the security configuration setup on a SVRCONN channel and flood the queue manager.
CVSS Score: 7.5 (HIGH)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/76799; https://exchange.xforce.ibmcloud.com/vulnerabilities/76799
CVE: CVE-2012-4818
Published: 2022-09-29
Description: IBM InfoSphere Information Server 8.1, 8.5, and 8,7 could allow a remote authenticated attacker to obtain sensitive information, caused by improper restrictions on directories. An attacker could exploit this vulnerability via the DataStage application to load or import content functionality to view arbitrary files on the system.
CVSS Score: 6.5 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/78651; https://www.ibm.com/blogs/psirt/security-bulletin-lack-of-path-restriction-may-allow-access-to-sensitive-data-stored-on-ibm-infosphere-information-server-cve-2012-4818/?lnk=hm; https://exchange.xforce.ibmcloud.com/vulnerabilities/78651
CVE: CVE-2014-0144
Published: 2022-09-29
Description: QEMU before 2.0.0 block drivers for CLOOP, QCOW2 version 2 and various other image formats are vulnerable to potential memory corruptions, integer/buffer overflows or crash caused by missing input validations which could allow a remote user to execute arbitrary code on the host with the privileges of the QEMU process.
CVSS Score: 8.6 (HIGH)
CWE: CWE-20
References: http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=24342f2cae47d03911e346fe1e520b00dc2818e0; http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=2d51c32c4b511db8bb9e58208f1e2c25e4c06c85; http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=5dab2faddc8eaa1fb1abdbe2f502001fc13a1b21
CVE: CVE-2014-0147
Published: 2022-09-29
Description: Qemu before 1.6.2 block diver for the various disk image formats used by Bochs and for the QCOW version 2 format, are vulnerable to a possible crash caused by signed data types or a logic error while creating QCOW2 snapshots, which leads to incorrectly calling update_refcount() routine.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-190
References: http://git.qemu.org/?p=qemu.git%3Ba=commitdiff%3Bh=246f65838d19db6db55bfb41117c35645a2c4789; http://rhn.redhat.com/errata/RHSA-2014-0420.html; http://rhn.redhat.com/errata/RHSA-2014-0421.html
CVE: CVE-2014-0148
Published: 2022-09-29
Description: Qemu before 2.0 block driver for Hyper-V VHDX Images is vulnerable to infinite loops and other potential issues when calculating BAT entries, due to missing bounds checks for block_size and logical_sector_size variables. These are used to derive other fields like 'sectors_per_block' etc. A user able to alter the Qemu disk image could ise this flaw to crash the Qemu instance resulting in DoS.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-835
References: http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=1d7678dec4761acdc43439da6ceda41a703ba1a6; http://rhn.redhat.com/errata/RHSA-2014-0420.html; http://rhn.redhat.com/errata/RHSA-2014-0421.html
CVE: CVE-2015-1931
Published: 2022-09-29
Description: IBM Java Security Components in IBM SDK, Java Technology Edition 8 before SR1 FP10, 7 R1 before SR3 FP10, 7 before SR9 FP10, 6 R1 before SR8 FP7, 6 before SR16 FP7, and 5.0 before SR16 FP13 stores plaintext information in memory dumps, which allows local users to obtain sensitive information by reading a file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-312
References: http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00051.html; http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00014.html; http://rhn.redhat.com/errata/RHSA-2015-1485.html
CVE: CVE-2016-2338
Published: 2022-09-29
Description: An exploitable heap overflow vulnerability exists in the Psych::Emitter start_document function of Ruby. In Psych::Emitter start_document function heap buffer "head" allocation is made based on tags array length. Specially constructed object passed as element of tags array can increase this array size after mentioned allocation and cause heap overflow.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: http://www.talosintelligence.com/reports/TALOS-2016-0032/; https://lists.debian.org/debian-lts-announce/2020/03/msg00032.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/