deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-30694
Published: 2022-11-08
Description: The login endpoint /FormLogin in affected web services does not apply proper origin checking.

This could allow authenticated remote attackers to track the activities of other users via a login cross-site request forgery attack.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://cert-portal.siemens.com/productcert/pdf/ssa-478960.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-478960.pdf
CVE: CVE-2022-39136
Published: 2022-11-08
Description: A vulnerability has been identified in JT2Go (All versions <  V14.1.0.4), Teamcenter Visualization V13.2 (All versions < V13.2.0.12), Teamcenter Visualization V13.3 (All versions < V13.3.0.7), Teamcenter Visualization V13.3 (All versions >= V13.3.0.7 < V13.3.0.8), Teamcenter Visualization V14.0 (All versions < V14.0.0.3), Teamcenter Visualization V14.1 (All versions < V14.1.0.4). The affected application is vulnerable to fixed-length heap-based buffer while parsing specially crafted TIF files. An attacker could leverage this vulnerability to execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://cert-portal.siemens.com/productcert/pdf/ssa-120378.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-120378.pdf
CVE: CVE-2022-39157
Published: 2022-11-08
Description: A vulnerability has been identified in Parasolid V34.0 (All versions < V34.0.252), Parasolid V34.0 (All versions >= V34.0.252 < V34.0.254), Parasolid V34.1 (All versions < V34.1.242), Parasolid V34.1 (All versions >= V34.1.242 < V34.1.244), Parasolid V35.0 (All versions < V35.0.170), Parasolid V35.0 (All versions >= V35.0.170 <  V35.0.184), Simcenter Femap (All versions < V2023.1). The affected application contains an out of bounds read past the end of an allocated structure while parsing specially crafted X_T files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-17745)
CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-125
References: https://cert-portal.siemens.com/productcert/pdf/ssa-565356.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-853037.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-565356.pdf
CVE: CVE-2022-41660
Published: 2022-11-08
Description: A vulnerability has been identified in JT2Go (All versions <  V14.1.0.4), Teamcenter Visualization V13.2 (All versions < V13.2.0.12), Teamcenter Visualization V13.3 (All versions < V13.3.0.7), Teamcenter Visualization V14.0 (All versions < V14.0.0.3), Teamcenter Visualization V14.1 (All versions < V14.1.0.4). The affected products contain an out of bounds write vulnerability when parsing a CGM file. An attacker can leverage this vulnerability to execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://cert-portal.siemens.com/productcert/pdf/ssa-120378.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-120378.pdf
CVE: CVE-2022-41661
Published: 2022-11-08
Description: A vulnerability has been identified in JT2Go (All versions <  V14.1.0.4), Teamcenter Visualization V13.2 (All versions < V13.2.0.12), Teamcenter Visualization V13.3 (All versions < V13.3.0.7), Teamcenter Visualization V14.0 (All versions < V14.0.0.3), Teamcenter Visualization V14.1 (All versions < V14.1.0.4). The affected products contain an out of bounds read vulnerability when parsing a CGM file. An attacker can leverage this vulnerability to execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-125
References: https://cert-portal.siemens.com/productcert/pdf/ssa-120378.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-120378.pdf
CVE: CVE-2022-41662
Published: 2022-11-08
Description: A vulnerability has been identified in JT2Go (All versions <  V14.1.0.4), Teamcenter Visualization V13.2 (All versions < V13.2.0.12), Teamcenter Visualization V13.3 (All versions < V13.3.0.7), Teamcenter Visualization V14.0 (All versions < V14.0.0.3), Teamcenter Visualization V14.1 (All versions < V14.1.0.4). The affected products contain an out of bounds read vulnerability when parsing a CGM file. An attacker can leverage this vulnerability to execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-125
References: https://cert-portal.siemens.com/productcert/pdf/ssa-120378.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-120378.pdf
CVE: CVE-2022-41663
Published: 2022-11-08
Description: A vulnerability has been identified in JT2Go (All versions <  V14.1.0.4), Teamcenter Visualization V13.2 (All versions < V13.2.0.12), Teamcenter Visualization V13.3 (All versions < V13.3.0.7), Teamcenter Visualization V14.0 (All versions < V14.0.0.3), Teamcenter Visualization V14.1 (All versions < V14.1.0.4). The affected applications contain a use-after-free vulnerability that could be triggered while parsing specially crafted CGM files. An attacker could leverage this vulnerability to execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://cert-portal.siemens.com/productcert/pdf/ssa-120378.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-120378.pdf
CVE: CVE-2022-41664
Published: 2022-11-08
Description: A vulnerability has been identified in JT2Go (All versions <  V14.1.0.4), Teamcenter Visualization V13.2 (All versions < V13.2.0.12), Teamcenter Visualization V13.3 (All versions < V13.3.0.7), Teamcenter Visualization V14.0 (All versions < V14.0.0.3), Teamcenter Visualization V14.1 (All versions < V14.1.0.4). The affected application contains a stack-based buffer overflow vulnerability that could be triggered while parsing specially crafted PDF files. This could allow an attacker to execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://cert-portal.siemens.com/productcert/pdf/ssa-120378.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-120378.pdf
CVE: CVE-2022-43397
Published: 2022-11-08
Description: A vulnerability has been identified in Parasolid V34.0 (All versions < V34.0.252), Parasolid V34.1 (All versions < V34.1.242), Parasolid V35.0 (All versions < V35.0.170), Simcenter Femap (All versions < V2023.1). The affected application contains an out of bounds write past the end of an allocated buffer while parsing specially crafted X_T files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-17854)
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://cert-portal.siemens.com/productcert/pdf/ssa-565356.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-853037.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-565356.pdf
CVE: CVE-2022-43398
Published: 2022-11-08
Description: A vulnerability has been identified in POWER METER SICAM Q100 (All versions < V2.50), POWER METER SICAM Q100 (All versions < V2.50), POWER METER SICAM Q100 (All versions < V2.50), POWER METER SICAM Q100 (All versions < V2.50). Affected devices do not renew the session cookie after login/logout and also accept user defined session cookies.  An attacker could overwrite the stored session cookie of a user. After the victim logged in, the attacker is given access to the user's account through the activated session.
CVSS Score: 7.5 (HIGH)
CWE: CWE-384, CWE-384
References: https://cert-portal.siemens.com/productcert/pdf/ssa-570294.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-887249.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-570294.pdf
CVE: CVE-2022-43439
Published: 2022-11-08
Description: A vulnerability has been identified in POWER METER SICAM Q100 (7KG9501-0AA01-0AA1) (All versions < V2.50), POWER METER SICAM Q100 (7KG9501-0AA01-2AA1) (All versions < V2.50), POWER METER SICAM Q100 (7KG9501-0AA31-0AA1) (All versions < V2.50), POWER METER SICAM Q100 (7KG9501-0AA31-2AA1) (All versions < V2.50), SICAM P850 (7KG8500-0AA00-0AA0) (All versions < V3.10), SICAM P850 (7KG8500-0AA00-2AA0) (All versions < V3.10), SICAM P850 (7KG8500-0AA10-0AA0) (All versions < V3.10), SICAM P850 (7KG8500-0AA10-2AA0) (All versions < V3.10), SICAM P850 (7KG8500-0AA30-0AA0) (All versions < V3.10), SICAM P850 (7KG8500-0AA30-2AA0) (All versions < V3.10), SICAM P850 (7KG8501-0AA01-0AA0) (All versions < V3.10), SICAM P850 (7KG8501-0AA01-2AA0) (All versions < V3.10), SICAM P850 (7KG8501-0AA02-0AA0) (All versions < V3.10), SICAM P850 (7KG8501-0AA02-2AA0) (All versions < V3.10), SICAM P850 (7KG8501-0AA11-0AA0) (All versions < V3.10), SICAM P850 (7KG8501-0AA11-2AA0) (All versions < V3.10), SICAM P850 (7KG8501-0AA12-0AA0) (All versions < V3.10), SICAM P850 (7KG8501-0AA12-2AA0) (All versions < V3.10), SICAM P850 (7KG8501-0AA31-0AA0) (All versions < V3.10), SICAM P850 (7KG8501-0AA31-2AA0) (All versions < V3.10), SICAM P850 (7KG8501-0AA32-0AA0) (All versions < V3.10), SICAM P850 (7KG8501-0AA32-2AA0) (All versions < V3.10), SICAM P855 (7KG8550-0AA00-0AA0) (All versions < V3.10), SICAM P855 (7KG8550-0AA00-2AA0) (All versions < V3.10), SICAM P855 (7KG8550-0AA10-0AA0) (All versions < V3.10), SICAM P855 (7KG8550-0AA10-2AA0) (All versions < V3.10), SICAM P855 (7KG8550-0AA30-0AA0) (All versions < V3.10), SICAM P855 (7KG8550-0AA30-2AA0) (All versions < V3.10), SICAM P855 (7KG8551-0AA01-0AA0) (All versions < V3.10), SICAM P855 (7KG8551-0AA01-2AA0) (All versions < V3.10), SICAM P855 (7KG8551-0AA02-0AA0) (All versions < V3.10), SICAM P855 (7KG8551-0AA02-2AA0) (All versions < V3.10), SICAM P855 (7KG8551-0AA11-0AA0) (All versions < V3.10), SICAM P855 (7KG8551-0AA11-2AA0) (All versions < V3.10), SICAM P855 (7KG8551-0AA12-0AA0) (All versions < V3.10), SICAM P855 (7KG8551-0AA12-2AA0) (All versions < V3.10), SICAM P855 (7KG8551-0AA31-0AA0) (All versions < V3.10), SICAM P855 (7KG8551-0AA31-2AA0) (All versions < V3.10), SICAM P855 (7KG8551-0AA32-0AA0) (All versions < V3.10), SICAM P855 (7KG8551-0AA32-2AA0) (All versions < V3.10), SICAM T (All versions < V3.0). Affected devices do not properly validate the Language-parameter in requests to the web interface on port  443/tcp. This could allow an authenticated remote attacker to crash the device (followed by an automatic reboot) or to execute arbitrary code on the device.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-20, CWE-20
References: https://cert-portal.siemens.com/productcert/html/ssa-471761.html; https://cert-portal.siemens.com/productcert/html/ssa-570294.html; https://cert-portal.siemens.com/productcert/html/ssa-572005.html
CVE: CVE-2022-43545
Published: 2022-11-08
Description: A vulnerability has been identified in POWER METER SICAM Q100 (All versions < V2.50), POWER METER SICAM Q100 (All versions < V2.50), POWER METER SICAM Q100 (All versions < V2.50), POWER METER SICAM Q100 (All versions < V2.50), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10). Affected devices do not properly validate the RecordType-parameter in requests to the web interface on port 443/tcp. This could allow an authenticated remote attacker to crash the device (followed by an automatic reboot) or to execute arbitrary code on the device.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-20, CWE-20
References: https://cert-portal.siemens.com/productcert/pdf/ssa-570294.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-572005.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-887249.pdf
CVE: CVE-2022-43546
Published: 2022-11-08
Description: A vulnerability has been identified in POWER METER SICAM Q100 (All versions < V2.50), POWER METER SICAM Q100 (All versions < V2.50), POWER METER SICAM Q100 (All versions < V2.50), POWER METER SICAM Q100 (All versions < V2.50), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P850 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10), SICAM P855 (All versions < V3.10). Affected devices do not properly validate the EndTime-parameter in requests to the web interface on port 443/tcp. This could allow an authenticated remote attacker to crash the device (followed by an automatic reboot) or to execute arbitrary code on the device.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-20, CWE-20
References: https://cert-portal.siemens.com/productcert/pdf/ssa-570294.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-572005.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-887249.pdf
CVE: CVE-2022-43958
Published: 2022-11-08
Description: A vulnerability has been identified in QMS Automotive (All versions < V12.39), QMS Automotive (All versions < V12.39). User credentials are stored in plaintext in the database without any hashing mechanism. This could allow an attacker to gain access to credentials and impersonate other users.
CVSS Score: 7.6 (HIGH)
CWE: CWE-256, CWE-312
References: https://cert-portal.siemens.com/productcert/pdf/ssa-147266.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-587547.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-147266.pdf
CVE: CVE-2022-44457
Published: 2022-11-08
Description: A vulnerability has been identified in Mendix SAML (Mendix 7 compatible) (All versions < V1.17.0), Mendix SAML (Mendix 7 compatible) (All versions >= V1.17.0 < V1.17.2), Mendix SAML (Mendix 8 compatible) (All versions < V2.3.0), Mendix SAML (Mendix 8 compatible) (All versions >= V2.3.0 < V2.3.2), Mendix SAML (Mendix 9 compatible, New Track) (All versions < V3.3.1), Mendix SAML (Mendix 9 compatible, New Track) (All versions >= V3.3.1 < V3.3.5), Mendix SAML (Mendix 9 compatible, Upgrade Track) (All versions < V3.3.0), Mendix SAML (Mendix 9 compatible, Upgrade Track) (All versions >= V3.3.0 < V3.3.4). Affected versions of the module insufficiently protect from packet capture replay, only when the not recommended, non default configuration option `'Allow Idp Initiated Authentication'` is enabled. This CVE entry describes the incomplete fix for CVE-2022-37011 in a specific non default configuration.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-294, CWE-294
References: https://cert-portal.siemens.com/productcert/pdf/ssa-638652.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-638652.pdf
CVE: CVE-2022-41757
Published: 2022-11-08
Description: An issue was discovered in the Arm Mali GPU Kernel Driver. A non-privileged user can make improper GPU processing operations to obtain write access to read-only memory, or obtain access to already freed memory. This affects Valhall r29p0 through r38p1 before r38p2, and r39p0 before r40p0.
CVSS Score: 8.8 (HIGH)
CWE: CWE-123
References: https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities; https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities
CVE: CVE-2022-43343
Published: 2022-11-08
Description: N-Prolog v1.91 was discovered to contain a global buffer overflow vulnerability in the function gettoken() at Main.c.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://github.com/sasagawa888/nprolog/issues/75; https://github.com/sasagawa888/nprolog/issues/75
CVE: CVE-2022-44311
Published: 2022-11-08
Description: html2xhtml v1.3 was discovered to contain an Out-Of-Bounds read in the function static void elm_close(tree_node_t *nodo) at procesador.c. This vulnerability allows attackers to access sensitive files or cause a Denial of Service (DoS) via a crafted html file.
CVSS Score: 8.1 (HIGH)
CWE: CWE-125, CWE-125
References: https://github.com/jfisteus/html2xhtml/issues/19; https://github.com/jfisteus/html2xhtml/issues/19
CVE: CVE-2022-44312
Published: 2022-11-08
Description: PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the ExpressionCoerceInteger function in expression.c when called from ExpressionInfixOperator.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://github.com/jpoirier/picoc/issues/37; https://gitlab.com/zsaleeba/picoc/-/issues/48; https://github.com/jpoirier/picoc/issues/37
CVE: CVE-2022-44313
Published: 2022-11-08
Description: PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the ExpressionCoerceUnsignedInteger function in expression.c when called from ExpressionParseFunctionCall.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://github.com/jpoirier/picoc/issues/37; https://gitlab.com/zsaleeba/picoc/-/issues/48; https://github.com/jpoirier/picoc/issues/37
CVE: CVE-2022-44314
Published: 2022-11-08
Description: PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the StringStrncpy function in cstdlib/string.c when called from ExpressionParseFunctionCall.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://github.com/jpoirier/picoc/issues/37; https://gitlab.com/zsaleeba/picoc/-/issues/48; https://github.com/jpoirier/picoc/issues/37
CVE: CVE-2022-44315
Published: 2022-11-08
Description: PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the ExpressionAssign function in expression.c when called from ExpressionParseFunctionCall.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://github.com/jpoirier/picoc/issues/37; https://gitlab.com/zsaleeba/picoc/-/issues/48; https://github.com/jpoirier/picoc/issues/37
CVE: CVE-2022-44316
Published: 2022-11-08
Description: PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the LexGetStringConstant function in lex.c when called from LexScanGetToken.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://github.com/jpoirier/picoc/issues/37; https://gitlab.com/zsaleeba/picoc/-/issues/48; https://github.com/jpoirier/picoc/issues/37
CVE: CVE-2022-44317
Published: 2022-11-08
Description: PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the StdioOutPutc function in cstdlib/stdio.c when called from ExpressionParseFunctionCall.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://github.com/jpoirier/picoc/issues/37; https://gitlab.com/zsaleeba/picoc/-/issues/48; https://github.com/jpoirier/picoc/issues/37
CVE: CVE-2022-44318
Published: 2022-11-08
Description: PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the StringStrcat function in cstdlib/string.c when called from ExpressionParseFunctionCall.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://github.com/jpoirier/picoc/issues/37; https://gitlab.com/zsaleeba/picoc/-/issues/48; https://github.com/jpoirier/picoc/issues/37
CVE: CVE-2022-44319
Published: 2022-11-08
Description: PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the StdioBasePrintf function in cstdlib/string.c when called from ExpressionParseFunctionCall.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://github.com/jpoirier/picoc/issues/37; https://gitlab.com/zsaleeba/picoc/-/issues/48; https://github.com/jpoirier/picoc/issues/37
CVE: CVE-2022-44320
Published: 2022-11-08
Description: PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the ExpressionCoerceFP function in expression.c when called from ExpressionParseFunctionCall.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://github.com/jpoirier/picoc/issues/37; https://gitlab.com/zsaleeba/picoc/-/issues/48; https://github.com/jpoirier/picoc/issues/37
CVE: CVE-2022-44321
Published: 2022-11-08
Description: PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the LexSkipComment function in lex.c when called from LexScanGetToken.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://github.com/jpoirier/picoc/issues/37; https://gitlab.com/zsaleeba/picoc/-/issues/48; https://github.com/jpoirier/picoc/issues/37
CVE: CVE-2021-40303
Published: 2022-11-08
Description: perfex crm 1.10 is vulnerable to Cross Site Scripting (XSS) via /clients/profile.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.exploit-db.com/exploits/50097; https://www.exploit-db.com/exploits/50097
CVE: CVE-2022-39069
Published: 2022-11-08
Description: There is a SQL injection vulnerability in ZTE ZAIP-AIE. Due to lack of input verification by the server, an attacker could trigger an attack by building malicious requests. Exploitation of this vulnerability could cause the leakage of the current table content.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1026604; https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1026604
CVE: CVE-2022-44556
Published: 2022-11-08
Description: Missing parameter type validation in the DRM module. Successful exploitation of this vulnerability may affect availability.


CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-20
References: https://consumer.huawei.com/en/support/bulletin/2022/11/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202212-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2022/11/
CVE: CVE-2022-27855
Published: 2022-11-08
Description: Cross-Site Request Forgery (CSRF) vulnerability in Fatcat Apps Analytics Cat plugin <= 1.0.9 on WordPress allows Plugin Settings Change.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://patchstack.com/database/vulnerability/analytics-cat/wordpress-analytics-cat-plugin-1-0-9-plugin-settings-change-via-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://wordpress.org/plugins/analytics-cat/#developers; https://patchstack.com/database/vulnerability/analytics-cat/wordpress-analytics-cat-plugin-1-0-9-plugin-settings-change-via-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2022-27858
Published: 2022-11-08
Description: CSV Injection vulnerability in Activity Log Team Activity Log <= 2.8.3 on WordPress.
CVSS Score: 7.4 (HIGH)
CWE: CWE-1236, CWE-1236
References: https://patchstack.com/database/vulnerability/aryo-activity-log/wordpress-activity-log-plugin-2-8-3-csv-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/aryo-activity-log/wordpress-activity-log-plugin-2-8-3-csv-injection-vulnerability?_s_id=cve