deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-41902
Published: 2022-12-06
Description: TensorFlow is an open source platform for machine learning. The function MakeGrapplerFunctionItem takes arguments that determine the sizes of inputs and outputs. If the inputs given are greater than or equal to the sizes of the outputs, an out-of-bounds memory read or a crash is triggered. We have patched the issue in GitHub commit a65411a1d69edfb16b25907ffb8f73556ce36bb7. The fix will be included in TensorFlow 2.11.0. We will also cherrypick this commit on TensorFlow 2.8.4, 2.9.3, and 2.10.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-787, CWE-125
References: https://github.com/tensorflow/tensorflow/blob/master/tensorflow/core/grappler/utils/functions.cc#L221; https://github.com/tensorflow/tensorflow/commit/a65411a1d69edfb16b25907ffb8f73556ce36bb7; https://github.com/tensorflow/tensorflow/security/advisories/GHSA-cg88-rpvp-cjv5
CVE: CVE-2022-41910
Published: 2022-12-06
Description: TensorFlow is an open source platform for machine learning. The function MakeGrapplerFunctionItem takes arguments that determine the sizes of inputs and outputs. If the inputs given are greater than or equal to the sizes of the outputs, an out-of-bounds memory read or a crash is triggered. We have patched the issue in GitHub commit a65411a1d69edfb16b25907ffb8f73556ce36bb7. The fix will be included in TensorFlow 2.11.0. We will also cherrypick this commit on TensorFlow 2.8.4, 2.9.3, and 2.10.1.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-125
References: https://github.com/tensorflow/tensorflow/blob/master/tensorflow/core/grappler/utils/functions.cc#L221; https://github.com/tensorflow/tensorflow/commit/a65411a1d69edfb16b25907ffb8f73556ce36bb7; https://github.com/tensorflow/tensorflow/security/advisories/GHSA-frqp-wp83-qggv
CVE: CVE-2022-45816
Published: 2022-12-06
Description: Auth. Stored Cross-Site Scripting (XSS) vulnerability in GD bbPress Attachments plugin <= 4.3.1 on WordPress.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/gd-bbpress-attachments/wordpress-gd-bbpress-attachments-plugin-4-3-1-auth-stored-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/gd-bbpress-attachments/wordpress-gd-bbpress-attachments-plugin-4-3-1-auth-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2022-45829
Published: 2022-12-06
Description: Auth. Path Traversal vulnerability in Easy WP SMTP plugin <= 1.5.1 at WordPress.
CVSS Score: 8.7 (HIGH)
CWE: CWE-22
References: https://patchstack.com/database/vulnerability/easy-wp-smtp/wordpress-easy-wp-smtp-plugin-1-5-1-auth-arbitrary-file-deletion-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/easy-wp-smtp/wordpress-easy-wp-smtp-plugin-1-5-1-auth-arbitrary-file-deletion-vulnerability?_s_id=cve
CVE: CVE-2022-45833
Published: 2022-12-06
Description: Auth. Path Traversal vulnerability in Easy WP SMTP plugin <= 1.5.1 on WordPress.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: https://patchstack.com/database/vulnerability/easy-wp-smtp/wordpress-easy-wp-smtp-plugin-1-5-1-auth-arbitrary-file-read-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/easy-wp-smtp/wordpress-easy-wp-smtp-plugin-1-5-1-auth-arbitrary-file-read-vulnerability?_s_id=cve
CVE: CVE-2022-42699
Published: 2022-12-06
Description: Auth. Remote Code Execution vulnerability in Easy WP SMTP plugin <= 1.5.1 on WordPress.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-94
References: https://patchstack.com/database/vulnerability/easy-wp-smtp/wordpress-easy-wp-smtp-plugin-1-5-1-auth-remote-code-execution-rce-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/easy-wp-smtp/wordpress-easy-wp-smtp-plugin-1-5-1-auth-remote-code-execution-rce-vulnerability?_s_id=cve
CVE: CVE-2022-44030
Published: 2022-12-06
Description: Redmine 5.x before 5.0.4 allows downloading of file attachments of any Issue or any Wiki page due to insufficient permission checks. Depending on the configuration, this may require login as a registered user.
CVSS Score: 7.5 (HIGH)
CWE: CWE-755, CWE-755
References: https://www.redmine.org/news/139; https://www.redmine.org/projects/redmine/wiki/Security_Advisories; https://www.redmine.org/news/139
CVE: CVE-2022-3643
Published: 2022-12-07
Description: Guests can trigger NIC interface reset/abort/crash via netback It is possible for a guest to trigger a NIC interface reset/abort/crash in a Linux based network backend by sending certain kinds of packets. It appears to be an (unwritten?) assumption in the rest of the Linux network stack that packet protocol headers are all contained within the linear section of the SKB and some NICs behave badly if this is not the case. This has been reported to occur with Cisco (enic) and Broadcom NetXtrem II BCM5780 (bnx2x) though it may be an issue with other NICs/drivers as well. In case the frontend is sending requests with split headers, netback will forward those violating above mentioned assumption to the networking core, resulting in said misbehavior.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-74
References: http://packetstormsecurity.com/files/175963/Kernel-Live-Patch-Security-Notice-LSN-0099-1.html; http://www.openwall.com/lists/oss-security/2022/12/07/2; https://lists.debian.org/debian-lts-announce/2022/12/msg00031.html
CVE: CVE-2022-42328
Published: 2022-12-07
Description: Guests can trigger deadlock in Linux netback driver T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The patch for XSA-392 introduced another issue which might result in a deadlock when trying to free the SKB of a packet dropped due to the XSA-392 handling (CVE-2022-42328). Additionally when dropping packages for other reasons the same deadlock could occur in case of netpoll being active for the interface the xen-netback driver is connected to (CVE-2022-42329).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-667, CWE-667
References: http://www.openwall.com/lists/oss-security/2022/12/08/2; http://www.openwall.com/lists/oss-security/2022/12/08/3; http://www.openwall.com/lists/oss-security/2022/12/09/2
CVE: CVE-2022-42329
Published: 2022-12-07
Description: Guests can trigger deadlock in Linux netback driver T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The patch for XSA-392 introduced another issue which might result in a deadlock when trying to free the SKB of a packet dropped due to the XSA-392 handling (CVE-2022-42328). Additionally when dropping packages for other reasons the same deadlock could occur in case of netpoll being active for the interface the xen-netback driver is connected to (CVE-2022-42329).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-667, CWE-667
References: http://www.openwall.com/lists/oss-security/2022/12/08/2; http://www.openwall.com/lists/oss-security/2022/12/08/3; http://www.openwall.com/lists/oss-security/2022/12/09/2
CVE: CVE-2022-45915
Published: 2022-12-07
Description: ILIAS before 7.16 allows OS Command Injection.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: http://packetstormsecurity.com/files/170181/ILIAS-eLearning-7.15-Command-Injection-XSS-LFI-Open-Redirect.html; http://seclists.org/fulldisclosure/2022/Dec/7; https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-ilias-elearning-platform/
CVE: CVE-2022-45917
Published: 2022-12-07
Description: ILIAS before 7.16 has an Open Redirect.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601, CWE-601
References: http://packetstormsecurity.com/files/170181/ILIAS-eLearning-7.15-Command-Injection-XSS-LFI-Open-Redirect.html; http://seclists.org/fulldisclosure/2022/Dec/7; https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-ilias-elearning-platform/
CVE: CVE-2022-45918
Published: 2022-12-07
Description: ILIAS before 7.16 allows External Control of File Name or Path.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-610
References: http://packetstormsecurity.com/files/170181/ILIAS-eLearning-7.15-Command-Injection-XSS-LFI-Open-Redirect.html; http://seclists.org/fulldisclosure/2022/Dec/7; https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-ilias-elearning-platform/
CVE: CVE-2022-44153
Published: 2022-12-07
Description: Rapid Software LLC Rapid SCADA 5.8.4 is vulnerable to Cross Site Scripting (XSS).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://nitroteam.kz/index.php?action=researches&slug=CVE-2022-44153-Rapid-SCADA-ru; https://nitroteam.kz/index.php?action=researches&slug=CVE-2022-44153-Rapid-SCADA-ru
CVE: CVE-2022-44942
Published: 2022-12-07
Description: Casdoor before v1.126.1 was discovered to contain an arbitrary file deletion vulnerability via the uploadFile function.
CVSS Score: 8.1 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/casdoor/casdoor/issues/1171; https://github.com/casdoor/casdoor/issues/1171
CVE: CVE-2022-45008
Published: 2022-12-07
Description: Online Leave Management System v1.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the component /leave_system/admin/?page=maintenance/department. This vulnerability allows attackers to execute arbitrary web scripts or HTML via crafted payload injected into the Name field under the Create New module.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/realguoxiufeng/bug_report/blob/main/vendors/oretnom23/Online%20Leave%20Management%20System/XSS-1.md; https://github.com/realguoxiufeng/bug_report/blob/main/vendors/oretnom23/Online%20Leave%20Management%20System/XSS-1.md
CVE: CVE-2022-45009
Published: 2022-12-07
Description: Online Leave Management System v1.0 was discovered to contain an arbitrary file upload vulnerability at /leave_system/classes/SystemSettings.php?f=update_settings. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434, CWE-434
References: https://github.com/realguoxiufeng/bug_report/blob/main/vendors/oretnom23/Online%20Leave%20Management%20System/UPLOAD.md; https://github.com/realguoxiufeng/bug_report/blob/main/vendors/oretnom23/Online%20Leave%20Management%20System/UPLOAD.md
CVE: CVE-2022-45010
Published: 2022-12-07
Description: Simple Phone Book/Directory Web App v1.0 was discovered to contain a SQL injection vulnerability via the editid parameter at /PhoneBook/edit.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/realguoxiufeng/bug_report/blob/main/vendors/bakhtiar/Simple%20Phone%20book_directory%20Web%20App/SQLi-1.md; https://github.com/realguoxiufeng/bug_report/blob/main/vendors/bakhtiar/Simple%20Phone%20book_directory%20Web%20App/SQLi-1.md
CVE: CVE-2022-45025
Published: 2022-12-07
Description: Markdown Preview Enhanced v0.6.5 and v0.19.6 for VSCode and Atom was discovered to contain a command injection vulnerability via the PDF file import function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://github.com/shd101wyy/vscode-markdown-preview-enhanced/issues/639; https://github.com/shd101wyy/vscode-markdown-preview-enhanced/issues/639
CVE: CVE-2022-45026
Published: 2022-12-07
Description: An issue in Markdown Preview Enhanced v0.6.5 and v0.19.6 for VSCode and Atom allows attackers to execute arbitrary commands during the GFM export process.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://github.com/shd101wyy/vscode-markdown-preview-enhanced/issues/640; https://github.com/shd101wyy/vscode-markdown-preview-enhanced/issues/640
CVE: CVE-2022-44849
Published: 2022-12-07
Description: A Cross-Site Request Forgery (CSRF) in the Administrator List of MetInfo v7.7 allows attackers to arbitrarily add Super Administrator account.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://gitee.com/MetInfo_1/MetInfo/issues/I5YM81?from=project-issue; https://gitee.com/MetInfo_1/MetInfo/issues/I5YM81?from=project-issue
CVE: CVE-2022-37406
Published: 2022-12-07
Description: Cross-site scripting vulnerability in Aficio SP 4210N firmware versions prior to Web Support 1.05 allows a remote authenticated attacker with an administrative privilege to inject an arbitrary script.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://jvn.jp/en/jp/JVN24659622/index.html; https://support.ricoh.com/bb/html/dr_ut_e/rc3/model/sp42/sp42.htm; https://support.ricoh.com/bbv2/html/dr_ut_d/ipsio/history/w/bb/pub_j/dr_ut_d/4101044/[PII_REDACTED]/V101/5236968/redirect_CLUTool_DOM/history.htm
CVE: CVE-2022-41622
Published: 2022-12-07
Description: In all versions, 

BIG-IP and BIG-IQ are vulnerable to cross-site request forgery (CSRF) attacks through iControl SOAP.  

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.


CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://support.f5.com/csp/article/K94221585; https://support.f5.com/csp/article/K94221585
CVE: CVE-2022-41783
Published: 2022-12-07
Description: tdpServer of TP-Link RE300 V1 improperly processes its input, which may allow an attacker to cause a denial-of-service (DoS) condition of the product's OneMesh function.
CVSS Score: 5.5 (MEDIUM)
References: https://jvn.jp/en/jp/JVN29657972/index.html; https://www.tp-link.com/en/support/download/re300/v1/#Firmware; https://jvn.jp/en/jp/JVN29657972/index.html
CVE: CVE-2022-41800
Published: 2022-12-07
Description: 
In all versions of BIG-IP, when running in Appliance mode, an authenticated user assigned the Administrator role may be able to bypass Appliance mode restrictions, utilizing an undisclosed iControl REST endpoint. A successful exploit can allow the attacker to cross a security boundary.  

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.


CVSS Score: 8.7 (HIGH)
CWE: CWE-77, CWE-77
References: https://support.f5.com/csp/article/K13325942; https://support.f5.com/csp/article/K13325942
CVE: CVE-2022-41994
Published: 2022-12-07
Description: Stored cross-site scripting vulnerability in Permission Settings of baserCMS versions prior to 4.7.2 allows a remote authenticated attacker with an administrative privilege to inject an arbitrary script.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://basercms.net/security/JVN_53682526; https://jvn.jp/en/jp/JVN53682526/index.html; https://basercms.net/security/JVN_53682526
CVE: CVE-2022-42486
Published: 2022-12-07
Description: Stored cross-site scripting vulnerability in User group management of baserCMS versions prior to 4.7.2 allows a remote authenticated attacker with an administrative privilege to inject an arbitrary script.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://basercms.net/security/JVN_53682526; https://jvn.jp/en/jp/JVN53682526/index.html; https://basercms.net/security/JVN_53682526
CVE: CVE-2022-43464
Published: 2022-12-07
Description: Hidden functionality vulnerability in UDR-JA1604/UDR-JA1608/UDR-JA1616 firmware versions 71x10.1.107112.43A and earlier allows a remote authenticated attacker to execute an arbitrary OS command on the device or alter the device settings.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: http://www.unimo.co.jp/table_notice/index.php?act=1&resid=[PII_REDACTED]-004418; https://jvn.jp/en/vu/JVNVU94514762/index.html; http://www.unimo.co.jp/table_notice/index.php?act=1&resid=[PII_REDACTED]-004418
CVE: CVE-2022-43468
Published: 2022-12-07
Description: External initialization of trusted variables or data stores vulnerability exists in WordPress Popular Posts 6.0.5 and earlier, therefore the vulnerable product accepts untrusted external inputs to update certain internal variables. As a result, the number of views for an article may be manipulated through a crafted input.
CVSS Score: 7.5 (HIGH)
CWE: CWE-665, CWE-665
References: https://github.com/cabrerahector/wordpress-popular-posts/; https://jvn.jp/en/jp/JVN13927745/index.html; https://wordpress.org/plugins/wordpress-popular-posts/
CVE: CVE-2022-43508
Published: 2022-12-07
Description: Use-after free vulnerability exists in CX-Programmer v.9.77 and earlier, which may lead to information disclosure and/or arbitrary code execution by having a user to open a specially crafted CXP file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://jvn.jp/en/vu/JVNVU92877622/index.html; https://jvn.jp/vu/JVNVU92877622/index.html; https://jvn.jp/en/vu/JVNVU92877622/index.html
CVE: CVE-2022-43509
Published: 2022-12-07
Description: Out-of-bounds write vulnerability exists in CX-Programmer v.9.77 and earlier, which may lead to information disclosure and/or arbitrary code execution by having a user to open a specially crafted CXP file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://jvn.jp/en/vu/JVNVU92877622/index.html; https://jvn.jp/vu/JVNVU92877622/index.html; https://jvn.jp/en/vu/JVNVU92877622/index.html
CVE: CVE-2022-43660
Published: 2022-12-07
Description: Improper neutralization of Server-Side Includes (SSW) within a web page in Movable Type series allows a remote authenticated attacker with Privilege of 'Manage of Content Types' may execute an arbitrary Perl script and/or an arbitrary OS command. Affected products/versions are as follows: Movable Type 7 r.5301 and earlier (Movable Type 7 Series), Movable Type Advanced 7 r.5301 and earlier (Movable Type Advanced 7 Series), Movable Type Premium 1.53 and earlier, and Movable Type Premium Advanced 1.53 and earlier.
CVSS Score: 7.2 (HIGH)
CWE: CWE-94, CWE-94
References: https://jvn.jp/en/jp/JVN37014768/index.html; https://movabletype.org/news/2022/11/mt-796-688-released.html; https://jvn.jp/en/jp/JVN37014768/index.html
CVE: CVE-2022-43667
Published: 2022-12-07
Description: Stack-based buffer overflow vulnerability exists in CX-Programmer v.9.77 and earlier, which may lead to information disclosure and/or arbitrary code execution by having a user to open a specially crafted CXP file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://jvn.jp/en/vu/JVNVU92877622/index.html; https://jvn.jp/vu/JVNVU92877622/index.html; https://jvn.jp/en/vu/JVNVU92877622/index.html
CVE: CVE-2022-43668
Published: 2022-12-07
Description: Typora versions prior to 1.4.4 fails to properly neutralize JavaScript code, which may result in executing JavaScript code contained in the file when opening a file with the affected product.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://jvn.jp/en/jp/JVN26044739/index.html; https://typora.io/releases/all; https://jvn.jp/en/jp/JVN26044739/index.html
CVE: CVE-2022-44606
Published: 2022-12-07
Description: OS command injection vulnerability in UDR-JA1604/UDR-JA1608/UDR-JA1616 firmware versions 71x10.1.107112.43A and earlier allows a remote authenticated attacker to execute an arbitrary OS command on the device or alter the device settings.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: http://www.unimo.co.jp/table_notice/index.php?act=1&resid=[PII_REDACTED]-004418; https://jvn.jp/en/vu/JVNVU94514762/index.html; http://www.unimo.co.jp/table_notice/index.php?act=1&resid=[PII_REDACTED]-004418
CVE: CVE-2022-44608
Published: 2022-12-07
Description: Uncontrolled resource consumption vulnerability in Cybozu Remote Service 4.0.0 to 4.0.3 allows a remote authenticated attacker to consume huge storage space, which may result in a denial-of-service (DoS) condition.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-400
References: https://cs.cybozu.co.jp/2022/007754.html; https://jvn.jp/en/jp/JVN87895771/index.html; https://cs.cybozu.co.jp/2022/007754.html
CVE: CVE-2022-44620
Published: 2022-12-07
Description: Improper authentication vulnerability in UDR-JA1604/UDR-JA1608/UDR-JA1616 firmware versions 71x10.1.107112.43A and earlier allows a remote authenticated attacker to execute an arbitrary OS command on the device or alter the device settings.
CVSS Score: 8.8 (HIGH)
CWE: CWE-287, CWE-287
References: http://www.unimo.co.jp/table_notice/index.php?act=1&resid=[PII_REDACTED]-004418; https://jvn.jp/en/vu/JVNVU94514762/index.html; http://www.unimo.co.jp/table_notice/index.php?act=1&resid=[PII_REDACTED]-004418
CVE: CVE-2022-45113
Published: 2022-12-07
Description: Improper validation of syntactic correctness of input vulnerability exist in Movable Type series. Having a user to access a specially crafted URL may allow a remote unauthenticated attacker to set a specially crafted URL to the Reset Password page and conduct a phishing attack. Affected products/versions are as follows: Movable Type 7 r.5301 and earlier (Movable Type 7 Series), Movable Type Advanced 7 r.5301 and earlier (Movable Type Advanced 7 Series), Movable Type 6.8.7 and earlier (Movable Type 6 Series), Movable Type Advanced 6.8.7 and earlier (Movable Type Advanced 6 Series), Movable Type Premium 1.53 and earlier, and Movable Type Premium Advanced 1.53 and earlier.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://jvn.jp/en/jp/JVN37014768/index.html; https://movabletype.org/news/2022/11/mt-796-688-released.html; https://jvn.jp/en/jp/JVN37014768/index.html
CVE: CVE-2022-45122
Published: 2022-12-07
Description: Cross-site scripting vulnerability in Movable Type Movable Type 7 r.5301 and earlier (Movable Type 7 Series), Movable Type Advanced 7 r.5301 and earlier (Movable Type Advanced 7 Series), Movable Type 6.8.7 and earlier (Movable Type 6 Series), Movable Type Advanced 6.8.7 and earlier (Movable Type Advanced 6 Series), Movable Type Premium 1.53 and earlier, and Movable Type Premium Advanced 1.53 and earlier allows a remote unauthenticated attacker to inject an arbitrary script.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://jvn.jp/en/jp/JVN37014768/index.html; https://movabletype.org/news/2022/11/mt-796-688-released.html; https://jvn.jp/en/jp/JVN37014768/index.html
CVE: CVE-2022-4322
Published: 2022-12-07
Description: A vulnerability, which was classified as critical, was found in maku-boot up to 2.2.0. This affects the function doExecute of the file AbstractScheduleJob.java of the component Scheduled Task Handler. The manipulation leads to injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 446eb7294332efca2bfd791bc37281cedac0d0ff. It is recommended to apply a patch to fix this issue. The identifier VDB-215013 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-707, CWE-89
References: https://gitee.com/makunet/maku-boot/commit/446eb7294332efca2bfd791bc37281cedac0d0ff; https://gitee.com/makunet/maku-boot/issues/I5ZUYI; https://vuldb.com/?id.215013
CVE: CVE-2020-35588
Published: 2022-12-07
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn. Further investigation showed that it was not a vulnerability. Notes: none.
CVE: CVE-2022-46741
Published: 2022-12-07
Description: Out-of-bounds read in gather_tree in PaddlePaddle before 2.4. 
CVSS Score: 7.1 (HIGH)
CWE: CWE-125, CWE-125
References: https://github.com/PaddlePaddle/Paddle/blob/develop/security/advisory/pdsa-2022-001.md; https://github.com/PaddlePaddle/Paddle/blob/develop/security/advisory/pdsa-2022-001.md
CVE: CVE-2022-46742
Published: 2022-12-07
Description: Code injection in paddle.audio.functional.get_window in PaddlePaddle 2.4.0-rc0 allows arbitrary code execution.

CVSS Score: 10.0 (CRITICAL)
CWE: CWE-94, CWE-94
References: https://github.com/PaddlePaddle/Paddle/blob/develop/security/advisory/pdsa-2022-002.md; https://github.com/PaddlePaddle/Paddle/blob/develop/security/advisory/pdsa-2022-002.md