deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-35415
Published: 2022-09-16
Description: An improper input validation in NI System Configuration Manager before 22.5 may allow a privileged user to potentially enable escalation of privilege via local access.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://ni.com; https://www.ni.com/en-us/support/documentation/supplemental/22/privilege-escalation-in-ni-configuration-manager-.html; https://ni.com
CVE: CVE-2022-36532
Published: 2022-09-16
Description: Bolt CMS contains a vulnerability in version 5.1.12 and below that allows an authenticated user with the ROLE_EDITOR privileges to upload and rename a malicious file to achieve remote code execution.
CVSS Score: 8.8 (HIGH)
References: http://bolt.com; https://lutrasecurity.com/en/articles/cve-2022-36532/; http://bolt.com
CVE: CVE-2022-36533
Published: 2022-09-16
Description: Super Flexible Software GmbH & Co. KG Syncovery 9 for Linux v9.47x and below was discovered to contain a cross-site scripting (XSS) vulnerability.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://super.com; http://syncovery.com; https://www.mgm-sp.com/en/multiple-vulnerabilities-in-syncovery-for-linux/
CVE: CVE-2022-36534
Published: 2022-09-16
Description: Super Flexible Software GmbH & Co. KG Syncovery 9 for Linux v9.47x and below was discovered to contain multiple remote code execution (RCE) vulnerabilities via the Job_ExecuteBefore and Job_ExecuteAfter parameters at post_profilesettings.php.
CVSS Score: 8.8 (HIGH)
References: http://packetstormsecurity.com/files/170245/Syncovery-For-Linux-Web-GUI-Authenticated-Remote-Command-Execution.html; http://super.com; http://syncovery.com
CVE: CVE-2022-36536
Published: 2022-09-16
Description: An issue in the component post_applogin.php of Super Flexible Software GmbH & Co. KG Syncovery 9 for Linux v9.47x and below allows attackers to escalate privileges via creating crafted session tokens.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-330
References: http://super.com; http://syncovery.com; https://www.mgm-sp.com/en/multiple-vulnerabilities-in-syncovery-for-linux/
CVE: CVE-2022-22066
Published: 2022-09-16
Description: Memory corruption occurs while processing command received from HLOS due to improper length check in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
CVSS Score: 8.4 (HIGH)
CWE: CWE-125
References: https://www.qualcomm.com/company/product-security/bulletins/september-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/september-2022-bulletin
CVE: CVE-2022-22074
Published: 2022-09-16
Description: Memory Corruption during wma file playback due to integer overflow in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
CVSS Score: 8.4 (HIGH)
CWE: CWE-190
References: https://www.qualcomm.com/company/product-security/bulletins/september-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/september-2022-bulletin
CVE: CVE-2022-22081
Published: 2022-09-16
Description: Memory corruption in audio module due to integer overflow in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Mobile, Snapdragon Wearables
CVSS Score: 8.4 (HIGH)
CWE: CWE-190
References: https://www.qualcomm.com/company/product-security/bulletins/september-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/september-2022-bulletin
CVE: CVE-2022-22089
Published: 2022-09-16
Description: Memory corruption in audio while playing record due to improper list handling in two threads in Snapdragon Connectivity, Snapdragon Mobile, Snapdragon Wearables
CVSS Score: 8.4 (HIGH)
CWE: CWE-190
References: https://www.qualcomm.com/company/product-security/bulletins/september-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/september-2022-bulletin
CVE: CVE-2022-22091
Published: 2022-09-16
Description: Improper authorization of a replayed LTE security mode command can lead to a denial of service in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables
CVSS Score: 7.5 (HIGH)
References: https://www.qualcomm.com/company/product-security/bulletins/september-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/september-2022-bulletin
CVE: CVE-2022-22092
Published: 2022-09-16
Description: Memory corruption in kernel due to use after free issue in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://www.qualcomm.com/company/product-security/bulletins/september-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/september-2022-bulletin
CVE: CVE-2022-22093
Published: 2022-09-16
Description: Memory corruption or temporary denial of service due to improper handling of concurrent hypervisor operations to attach or detach IRQs from virtual interrupt sources in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile
CVSS Score: 7.8 (HIGH)
CWE: CWE-367
References: https://www.qualcomm.com/company/product-security/bulletins/september-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/september-2022-bulletin
CVE: CVE-2022-22094
Published: 2022-09-16
Description: memory corruption in Kernel due to race condition while getting mapping reference in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile
CVSS Score: 7.8 (HIGH)
CWE: CWE-367
References: https://www.qualcomm.com/company/product-security/bulletins/september-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/september-2022-bulletin
CVE: CVE-2022-22095
Published: 2022-09-16
Description: Memory corruption in synx driver due to use-after-free condition in the synx driver due to accessing object handles without acquiring lock in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile
CVSS Score: 8.4 (HIGH)
CWE: CWE-416
References: https://www.qualcomm.com/company/product-security/bulletins/september-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/september-2022-bulletin
CVE: CVE-2022-22105
Published: 2022-09-16
Description: Memory corruption in bluetooth due to integer overflow while processing HFP-UNIT profile in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Mobile, Snapdragon Voice & Music
CVSS Score: 9.4 (CRITICAL)
CWE: CWE-190
References: https://www.qualcomm.com/company/product-security/bulletins/september-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/september-2022-bulletin
CVE: CVE-2022-25652
Published: 2022-09-16
Description: Cryptographic issues in BSP due to improper hash verification in Snapdragon Wired Infrastructure and Networking
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-287
References: https://www.qualcomm.com/company/product-security/bulletins/september-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/september-2022-bulletin
CVE: CVE-2022-25653
Published: 2022-09-16
Description: Information disclosure in video due to buffer over-read while processing avi file in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-125
References: https://www.qualcomm.com/company/product-security/bulletins/september-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/september-2022-bulletin
CVE: CVE-2022-25654
Published: 2022-09-16
Description: Memory corruption in kernel due to improper input validation while processing ION commands in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Wearables
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://www.qualcomm.com/company/product-security/bulletins/september-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/september-2022-bulletin
CVE: CVE-2022-25656
Published: 2022-09-16
Description: Possible integer overflow and memory corruption due to improper validation of buffer size sent to write to console when computing the payload size in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables
CVSS Score: 8.4 (HIGH)
CWE: CWE-190
References: https://www.qualcomm.com/company/product-security/bulletins/september-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/september-2022-bulletin
CVE: CVE-2022-25669
Published: 2022-09-16
Description: Denial of service in video due to buffer over read while parsing MP4 clip in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://www.qualcomm.com/company/product-security/bulletins/september-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/september-2022-bulletin
CVE: CVE-2022-25670
Published: 2022-09-16
Description: Denial of service in WLAN HOST due to buffer over read while unpacking frames in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://www.qualcomm.com/company/product-security/bulletins/september-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/september-2022-bulletin
CVE: CVE-2022-25686
Published: 2022-09-16
Description: Memory corruption in video module due to buffer overflow while processing WAV file in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables
CVSS Score: 7.3 (HIGH)
CWE: CWE-120
References: https://www.qualcomm.com/company/product-security/bulletins/september-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/september-2022-bulletin
CVE: CVE-2022-25688
Published: 2022-09-16
Description: Memory corruption in video due to buffer overflow while parsing ps video clips in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
CVSS Score: 7.3 (HIGH)
CWE: CWE-120
References: https://www.qualcomm.com/company/product-security/bulletins/september-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/september-2022-bulletin
CVE: CVE-2022-25690
Published: 2022-09-16
Description: Information disclosure in WLAN due to improper validation of array index while parsing crafted ANQP action frames in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music
CVSS Score: 7.5 (HIGH)
CWE: CWE-129
References: https://www.qualcomm.com/company/product-security/bulletins/september-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/september-2022-bulletin
CVE: CVE-2022-25693
Published: 2022-09-16
Description: Memory corruption in graphics due to use-after-free while graphics profiling in Snapdragon Connectivity, Snapdragon Mobile
CVSS Score: 8.4 (HIGH)
CWE: CWE-416
References: https://www.qualcomm.com/company/product-security/bulletins/september-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/september-2022-bulletin
CVE: CVE-2022-25696
Published: 2022-09-16
Description: Memory corruption in display due to time-of-check time-of-use race condition during map or unmap in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables
CVSS Score: 8.4 (HIGH)
CWE: CWE-367
References: https://www.qualcomm.com/company/product-security/bulletins/september-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/september-2022-bulletin
CVE: CVE-2022-25706
Published: 2022-09-16
Description: Information disclosure in Bluetooth driver due to buffer over-read while reading l2cap length in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables
CVSS Score: 8.2 (HIGH)
CWE: CWE-125
References: https://www.qualcomm.com/company/product-security/bulletins/september-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/september-2022-bulletin
CVE: CVE-2022-25708
Published: 2022-09-16
Description: Memory corruption in WLAN due to buffer copy without checking size of input while parsing keys in Snapdragon Connectivity, Snapdragon Mobile
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120, CWE-120
References: https://www.qualcomm.com/company/product-security/bulletins/september-2022-bulletin; https://www.qualcomm.com/company/product-security/bulletins/september-2022-bulletin
CVE: CVE-2022-1194
Published: 2022-09-16
Description: The Mobile Events Manager WordPress plugin before 1.4.8 does not properly escape the Enquiry source field when exporting events, or the Paid for field when exporting transactions as CSV, leading to a CSV injection vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-1236
References: https://wpscan.com/vulnerability/62be0991-f095-43cf-a167-3daaed254594; https://wpscan.com/vulnerability/62be0991-f095-43cf-a167-3daaed254594
CVE: CVE-2022-2351
Published: 2022-09-16
Description: The Post SMTP Mailer/Email Log WordPress plugin before 2.1.4 does not escape some of its settings before outputting them in the admins dashboard, allowing high privilege users to perform Cross-Site Scripting attacks against other users even when the unfiltered_html capability is disallowed.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/f3fda033-58f5-446d-ade4-2336a39bfb87; https://wpscan.com/vulnerability/f3fda033-58f5-446d-ade4-2336a39bfb87
CVE: CVE-2022-2575
Published: 2022-09-16
Description: The WBW Currency Switcher for WooCommerce WordPress plugin before 1.6.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/e934af78-9dfd-4e14-853d-dc453de6e365; https://wpscan.com/vulnerability/e934af78-9dfd-4e14-853d-dc453de6e365
CVE: CVE-2022-2635
Published: 2022-09-16
Description: The Autoptimize WordPress plugin before 3.1.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/219767a8-2427-42d5-8734-bd197d9ab46b; https://wpscan.com/vulnerability/219767a8-2427-42d5-8734-bd197d9ab46b
CVE: CVE-2022-2654
Published: 2022-09-16
Description: The Classima WordPress theme before 2.1.11 and some of its required plugins (Classified Listing before 2.2.14, Classified Listing Pro before 2.0.20, Classified Listing Store & Membership before 1.4.20 and Classima Core before 1.10) do not escape a parameter before outputting it back in attributes, leading to Reflected Cross-Site Scripting
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/845f44ca-f572-48d7-a19a-89cace0b8993; https://wpscan.com/vulnerability/845f44ca-f572-48d7-a19a-89cace0b8993
CVE: CVE-2022-2655
Published: 2022-09-16
Description: The Classified Listing Pro WordPress plugin before 2.0.20 does not escape a generated URL before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/acc9675a-56f6-411a-9594-07144c2aad1b; https://wpscan.com/vulnerability/acc9675a-56f6-411a-9594-07144c2aad1b
CVE: CVE-2022-2669
Published: 2022-09-16
Description: The WP Taxonomy Import WordPress plugin through 1.0.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/792d9f22-abf6-47b2-a247-d0cdb705cd81; https://wpscan.com/vulnerability/792d9f22-abf6-47b2-a247-d0cdb705cd81
CVE: CVE-2022-2737
Published: 2022-09-16
Description: The WP STAGING WordPress plugin before 2.9.18 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://wpscan.com/vulnerability/91bbdeb0-f2df-4500-b856-af0ff68fbb12; https://wpscan.com/vulnerability/91bbdeb0-f2df-4500-b856-af0ff68fbb12
CVE: CVE-2022-2798
Published: 2022-09-16
Description: The Affiliates Manager WordPress plugin before 2.9.14 does not validate and sanitise the affiliate data, which could allow users registering as affiliate to perform CSV injection attacks against an admin exporting the data
CVSS Score: 8.0 (HIGH)
CWE: CWE-1236
References: https://wpscan.com/vulnerability/f169567d-c682-4abe-94df-a9d00be90edd; https://wpscan.com/vulnerability/f169567d-c682-4abe-94df-a9d00be90edd
CVE: CVE-2022-2799
Published: 2022-09-16
Description: The Affiliates Manager WordPress plugin before 2.9.14 does not sanitise and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/4385370e-cf99-4249-b2c1-90cbfa8378a4; https://wpscan.com/vulnerability/4385370e-cf99-4249-b2c1-90cbfa8378a4
CVE: CVE-2022-2863
Published: 2022-09-16
Description: The Migration, Backup, Staging WordPress plugin before 0.9.76 does not sanitise and validate a parameter before using it to read the content of a file, allowing high privilege users to read any file from the web server via a Traversal attack
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.com/files/168616/WordPress-WPvivid-Backup-Path-Traversal.html; http://seclists.org/fulldisclosure/2022/Oct/0; https://wpscan.com/vulnerability/cb6a3304-2166-47a0-a011-4dcacaa133e5
CVE: CVE-2022-2877
Published: 2022-09-16
Description: The Titan Anti-spam & Security WordPress plugin before 7.3.1 does not properly checks HTTP headers in order to validate the origin IP address, allowing threat actors to bypass it's block feature by spoofing the headers.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-639
References: https://wpscan.com/vulnerability/f1af4267-3a43-4b88-a8b9-c1d5b2aa9d68; https://wpscan.com/vulnerability/f1af4267-3a43-4b88-a8b9-c1d5b2aa9d68
CVE: CVE-2022-2887
Published: 2022-09-16
Description: The WP Server Health Stats WordPress plugin before 1.7.0 does not escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/237541d5-c1a5-44f2-8e5f-82457b8f9497; https://wpscan.com/vulnerability/237541d5-c1a5-44f2-8e5f-82457b8f9497
CVE: CVE-2022-2912
Published: 2022-09-16
Description: The Craw Data WordPress plugin through 1.0.0 does not implement nonce checks, which could allow attackers to make a logged in admin change the url value performing unwanted crawls on third-party sites (SSRF).
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-918, CWE-918
References: https://wpscan.com/vulnerability/fd9853e8-b3ae-4a10-8389-8a4a11a8297c; https://wpscan.com/vulnerability/fd9853e8-b3ae-4a10-8389-8a4a11a8297c
CVE: CVE-2022-2913
Published: 2022-09-16
Description: The Login No Captcha reCAPTCHA WordPress plugin before 1.7 doesn't check the proper IP address allowing attackers to spoof IP addresses on the allow list and bypass the need for captcha on the login screen.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-639
References: https://wpscan.com/vulnerability/5231ac18-ea9a-4bb9-af9f-e3d95a3b54f1; https://wpscan.com/vulnerability/5231ac18-ea9a-4bb9-af9f-e3d95a3b54f1
CVE: CVE-2022-40149
Published: 2022-09-16
Description: Those using Jettison to parse untrusted XML or JSON data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-121, CWE-787
References: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46538; https://github.com/jettison-json/jettison/issues/45; https://lists.debian.org/debian-lts-announce/2022/11/msg00011.html
CVE: CVE-2022-40150
Published: 2022-09-16
Description: Those using Jettison to parse untrusted XML or JSON data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by Out of memory. This effect may support a denial of service attack.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400, CWE-674
References: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46549; https://github.com/jettison-json/jettison/issues/45; https://lists.debian.org/debian-lts-announce/2022/12/msg00045.html
CVE: CVE-2022-40151
Published: 2022-09-16
Description: Those using Xstream to seralize XML data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-121, CWE-787
References: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47367; https://github.com/x-stream/xstream/issues/304; https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47367
CVE: CVE-2022-40152
Published: 2022-09-16
Description: Those using Woodstox to parse XML data may be vulnerable to Denial of Service attacks (DOS) if DTD support is enabled. If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-121, CWE-787
References: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47434; https://github.com/x-stream/xstream/issues/304; https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47434
CVE: CVE-2022-40153
Published: 2022-09-16
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. Reason: This CVE has been rejected as it was incorrectly assigned. All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2022-40154
Published: 2022-09-16
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. Reason: This CVE has been rejected as it was incorrectly assigned. All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2022-40155
Published: 2022-09-16
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. Reason: This CVE has been rejected as it was incorrectly assigned. All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2022-40156
Published: 2022-09-16
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. Reason: This CVE has been rejected as it was incorrectly assigned. All references and descriptions in this candidate have been removed to prevent accidental usage.