deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-23770
Published: 2022-10-17
Description: This vulnerability could allow a remote attacker to execute remote commands with improper validation of parameters of certain API constructors. Remote attackers could use this vulnerability to execute malicious commands such as directory traversal.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20, CWE-22
References: https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66963; https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66963
CVE: CVE-2022-23771
Published: 2022-10-17
Description: This vulnerability occurs in user accounts creation and deleteion related pages of IPTIME NAS products. The vulnerability could be exploited by a lack of validation when a POST request is made to this page. An attacker can use this vulnerability to or delete user accounts, or to escalate arbitrary user privileges.
CVSS Score: 8.0 (HIGH)
CWE: CWE-352, CWE-352
References: https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66964; https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66964
CVE: CVE-2022-28291
Published: 2022-10-17
Description: Insufficiently Protected Credentials: An authenticated user with debug privileges can retrieve stored Nessus policy credentials from the “nessusd” process in cleartext via process dumping. The affected products are all versions of Nessus Essentials and Professional. The vulnerability allows an attacker to access credentials stored in Nessus scanners, potentially compromising its customers’ network of assets.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-522, CWE-522
References: https://cybersecurityworks.com/blog/zero-days/csw-expert-discovers-a-zero-day-vulnerability-in-tenables-nessus-scanner.html; https://cybersecurityworks.com/blog/zero-days/csw-expert-discovers-a-zero-day-vulnerability-in-tenables-nessus-scanner.html
CVE: CVE-2022-2428
Published: 2022-10-17
Description: A crafted tag in the Jupyter Notebook viewer in GitLab EE/CE affecting all versions before 15.1.6, 15.2 to 15.2.4, and 15.3 to 15.3.2 allows an attacker to issue arbitrary HTTP requests
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2428.json; https://gitlab.com/gitlab-org/gitlab/-/issues/362272; https://hackerone.com/reports/1563379
CVE: CVE-2022-2455
Published: 2022-10-17
Description: A business logic issue in the handling of large repositories in all versions of GitLab CE/EE from 10.0 before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions starting from 15.3 before 15.3.2 allowed an authenticated and authorized user to exhaust server resources by importing a malicious project.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400, CWE-400
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2455.json; https://gitlab.com/gitlab-org/gitlab/-/issues/359964; https://hackerone.com/reports/1542230
CVE: CVE-2022-2527
Published: 2022-10-17
Description: An issue in Incident Timelines has been discovered in GitLab CE/EE affecting all versions starting from 14.9 before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions starting from 15.3 before 15.3.2.which allowed an authenticated attacker to inject arbitrary content. A victim interacting with this content could lead to arbitrary requests.
CVSS Score: 7.3 (HIGH)
CWE: CWE-79, CWE-79
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2527.json; https://gitlab.com/gitlab-org/gitlab/-/issues/368676; https://hackerone.com/reports/1647446
CVE: CVE-2022-2533
Published: 2022-10-17
Description: An issue has been discovered in GitLab affecting all versions starting from 12.10 before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions starting from 15.3 before 15.3.2. GitLab was not performing correct authentication with some Package Registries when IP address restrictions were configured, allowing an attacker already in possession of a valid Deploy Token to misuse it from any location.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-287, CWE-287
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2533.json; https://gitlab.com/gitlab-org/gitlab/-/issues/363863; https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2533.json
CVE: CVE-2022-2592
Published: 2022-10-17
Description: A lack of length validation in Snippet descriptions in GitLab CE/EE affecting all versions prior to 15.1.6, 15.2 prior to 15.2.4 and 15.3 prior to 15.3.2 allows an authenticated attacker to create a maliciously large Snippet which when requested with or without authentication places excessive load on the server, potential leading to Denial of Service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-1284, CWE-1284
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2592.json; https://gitlab.com/gitlab-org/gitlab/-/issues/362566; https://hackerone.com/reports/1544507
CVE: CVE-2022-2630
Published: 2022-10-17
Description: An improper access control issue in GitLab CE/EE affecting all versions starting from 15.2 before 15.2.4, all versions from 15.3 before 15.3.2 allows disclosure of confidential information via the Incident timeline events.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2630.json; https://gitlab.com/gitlab-org/gitlab/-/issues/369429; https://hackerone.com/reports/1652853
CVE: CVE-2022-2865
Published: 2022-10-17
Description: A cross-site scripting issue has been discovered in GitLab CE/EE affecting all versions before 15.1.6, 15.2 to 15.2.4 and 15.3 prior to 15.3.2. It was possible to exploit a vulnerability in setting the labels colour feature which could lead to a stored XSS that allowed attackers to perform arbitrary actions on behalf of victims at client side.
CVSS Score: 7.3 (HIGH)
CWE: CWE-79, CWE-79
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2865.json; https://gitlab.com/gitlab-org/gitlab/-/issues/370873; https://hackerone.com/reports/1665658
CVE: CVE-2022-2884
Published: 2022-10-17
Description: A vulnerability in GitLab CE/EE affecting all versions from 11.3.4 prior to 15.1.5, 15.2 to 15.2.3, 15.3 to 15.3 to 15.3.1 allows an an authenticated user to achieve remote code execution via the Import from GitHub API endpoint
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-78, CWE-78
References: http://packetstormsecurity.com/files/171628/GitLab-15.3-Remote-Code-Execution.html; https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2884.json; https://gitlab.com/gitlab-org/gitlab/-/issues/371098
CVE: CVE-2022-2908
Published: 2022-10-17
Description: A potential DoS vulnerability was discovered in Gitlab CE/EE versions starting from 10.7 before 15.1.5, all versions starting from 15.2 before 15.2.3, all versions starting from 15.3 before 15.3.1 allowed an attacker to trigger high CPU usage via a special crafted input added in the Commit message field.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-1333, CWE-1333
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2908.json; https://gitlab.com/gitlab-org/gitlab/-/issues/363734; https://hackerone.com/reports/1584156
CVE: CVE-2022-2931
Published: 2022-10-17
Description: A potential DOS vulnerability was discovered in GitLab CE/EE affecting all versions before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions starting from 15.3 before 15.3.2. Malformed content added to the issue description could have been used to trigger high CPU usage.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2931.json; https://gitlab.com/gitlab-org/gitlab/-/issues/361982; https://hackerone.com/reports/1543718
CVE: CVE-2022-2992
Published: 2022-10-17
Description: A vulnerability in GitLab CE/EE affecting all versions from 11.10 prior to 15.1.6, 15.2 to 15.2.4, 15.3 to 15.3.2 allows an authenticated user to achieve remote code execution via the Import from GitHub API endpoint.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-74, CWE-74
References: http://packetstormsecurity.com/files/171008/GitLab-GitHub-Repo-Import-Deserialization-Remote-Code-Execution.html; https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2992.json; https://gitlab.com/gitlab-org/gitlab/-/issues/371884
CVE: CVE-2022-3030
Published: 2022-10-17
Description: An improper access control issue in GitLab CE/EE affecting all versions starting before 15.1.6, all versions from 15.2 before 15.2.4, all versions from 15.3 before 15.3.2 allows disclosure of pipeline status to unauthorized users.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3030.json; https://gitlab.com/gitlab-org/gitlab/-/issues/37959; https://hackerone.com/reports/749882
CVE: CVE-2022-3031
Published: 2022-10-17
Description: An issue has been discovered in GitLab CE/EE affecting all versions before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions starting from 15.3 before 15.3.2. It may be possible for an attacker to guess a user's password by brute force by sending crafted requests to a specific endpoint, even if the victim user has 2FA enabled on their account.
CVSS Score: 3.7 (LOW)
CWE: CWE-307
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3031.json; https://gitlab.com/gitlab-org/gitlab/-/issues/340395; https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3031.json
CVE: CVE-2022-3060
Published: 2022-10-17
Description: Improper control of a resource identifier in Error Tracking in GitLab CE/EE affecting all versions from 12.7 allows an authenticated attacker to generate content which could cause a victim to make unintended arbitrary requests
CVSS Score: 7.3 (HIGH)
CWE: CWE-22, CWE-22
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3060.json; https://gitlab.com/gitlab-org/gitlab/-/issues/365427; https://hackerone.com/reports/1600343
CVE: CVE-2022-3066
Published: 2022-10-17
Description: An issue has been discovered in GitLab affecting all versions starting from 10.0 before 15.2.5, all versions starting from 15.3 before 15.3.4, all versions starting from 15.4 before 15.4.1. It was possible for an unauthorised user to create issues in a project.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-284
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3066.json; https://gitlab.com/gitlab-org/gitlab/-/issues/372149; https://hackerone.com/reports/1685105
CVE: CVE-2022-3067
Published: 2022-10-17
Description: An issue has been discovered in the Import functionality of GitLab CE/EE affecting all versions starting from 14.4 before 15.2.5, all versions starting from 15.3 before 15.3.4, all versions starting from 15.4 before 15.4.1. It was possible for an authenticated user to read arbitrary projects' content given the project's ID.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3067.json; https://gitlab.com/gitlab-org/gitlab/-/issues/372165; https://hackerone.com/reports/1685822
CVE: CVE-2022-3165
Published: 2022-10-17
Description: An integer underflow issue was found in the QEMU VNC server while processing ClientCutText messages in the extended format. A malicious client could use this flaw to make QEMU unresponsive by sending a specially crafted payload message, resulting in a denial of service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-191
References: https://gitlab.com/qemu-project/qemu/-/commit/d307040b18; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I36LKZA7Z65J3LJU2P37LVTWDFTXBMPU/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZTY7TVHX62OJWF6IOBCIGLR2N5K4QN3E/
CVE: CVE-2022-3279
Published: 2022-10-17
Description: An unhandled exception in job log parsing in GitLab CE/EE affecting all versions prior to 15.2.5, 15.3 prior to 15.3.4, and 15.4 prior to 15.4.1 allows an attacker to prevent access to job logs
CVSS Score: 2.7 (LOW)
CWE: CWE-755, CWE-755
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3279.json; https://gitlab.com/gitlab-org/gitlab/-/issues/364249; https://hackerone.com/reports/1587261
CVE: CVE-2022-3283
Published: 2022-10-17
Description: A potential DOS vulnerability was discovered in GitLab CE/EE affecting all versions before before 15.2.5, all versions starting from 15.3 before 15.3.4, all versions starting from 15.4 before 15.4.1 While cloning an issue with special crafted content added to the description could have been used to trigger high CPU usage.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-400
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3283.json; https://gitlab.com/gitlab-org/gitlab/-/issues/361982; https://hackerone.com/reports/1543718
CVE: CVE-2022-3286
Published: 2022-10-17
Description: Lack of IP address checking in GitLab EE affecting all versions from 14.2 prior to 15.2.5, 15.3 prior to 15.3.4, and 15.4 prior to 15.4.1 allows a group member to bypass IP restrictions when using a deploy token
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-284
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3286.json; https://gitlab.com/gitlab-org/gitlab/-/issues/363827; https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3286.json
CVE: CVE-2022-3288
Published: 2022-10-17
Description: A branch/tag name confusion in GitLab CE/EE affecting all versions prior to 15.2.5, 15.3 prior to 15.3.4, and 15.4 prior to 15.4.1 allows an attacker to manipulate pages where the content of the default branch would be expected.
CVSS Score: 3.5 (LOW)
CWE: CWE-471
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3288.json; https://gitlab.com/gitlab-org/gitlab/-/issues/354948; https://hackerone.com/reports/1498354
CVE: CVE-2022-3291
Published: 2022-10-17
Description: Serialization of sensitive data in GitLab EE affecting all versions from 14.9 prior to 15.2.5, 15.3 prior to 15.3.4, and 15.4 prior to 15.4.1 can leak sensitive information via cache
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-502, CWE-502
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3291.json; https://gitlab.com/gitlab-org/gitlab/-/issues/354299; https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3291.json
CVE: CVE-2022-3293
Published: 2022-10-17
Description: Email addresses were leaked in WebHook logs in GitLab EE affecting all versions from 9.3 prior to 15.2.5, 15.3 prior to 15.3.4, and 15.4 prior to 15.4.1
CVSS Score: 3.5 (LOW)
CWE: CWE-532, CWE-532
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3293.json; https://gitlab.com/gitlab-org/gitlab/-/issues/369008; https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3293.json
CVE: CVE-2022-3325
Published: 2022-10-17
Description: Improper access control in the GitLab CE/EE API affecting all versions starting from 12.8 before 15.2.5, all versions starting from 15.3 before 15.3.4, all versions starting from 15.4 before 15.4.1. Allowed for editing the approval rules via the API by an unauthorised user.
CVSS Score: 2.7 (LOW)
CWE: CWE-284
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3325.json; https://gitlab.com/gitlab-org/gitlab/-/issues/360819; https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3325.json
CVE: CVE-2022-3330
Published: 2022-10-17
Description: It was possible for a guest user to read a todo targeting an inaccessible note in Gitlab CE/EE affecting all versions from 15.0 prior to 15.2.5, 15.3 prior to 15.3.4, and 15.4 prior to 15.4.1.
CVSS Score: 4.3 (MEDIUM)
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3330.json; https://gitlab.com/gitlab-org/gitlab/-/issues/365827; https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3330.json
CVE: CVE-2022-3331
Published: 2022-10-17
Description: An issue has been discovered in GitLab EE affecting all versions starting from 14.5 before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions starting from 15.3 before 15.3.2. GitLab's Zentao integration has an insecure direct object reference vulnerability that may be exploited by an attacker to leak Zentao project issues.
CVSS Score: 3.5 (LOW)
CWE: CWE-639, CWE-639
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3331.json; https://gitlab.com/gitlab-org/gitlab/-/issues/360372; https://hackerone.com/reports/1542834
CVE: CVE-2022-3351
Published: 2022-10-17
Description: An issue has been discovered in GitLab EE affecting all versions starting from 13.7 before 15.2.5, all versions starting from 15.3 before 15.3.4, all versions starting from 15.4 before 15.4.1. A user's primary email may be disclosed to an attacker through group member events webhooks.
CVSS Score: 4.3 (MEDIUM)
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3351.json; https://gitlab.com/gitlab-org/gitlab/-/issues/364266; https://hackerone.com/reports/1446022
CVE: CVE-2022-3540
Published: 2022-10-17
Description: An issue has been discovered in hunter2 affecting all versions before 2.1.0. Improper handling of auto-completion input allows an authenticated attacker to extract other users email addresses
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-312, CWE-312
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3540.json; https://gitlab.com/hunter2.app/hunter2/-/issues/529; https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3540.json
CVE: CVE-2022-42221
Published: 2022-10-17
Description: Netgear R6220 v1.1.0.114_1.0.1 suffers from Incorrect Access Control, resulting in a command injection vulnerability.
CVSS Score: 8.8 (HIGH)
References: https://github.com/Cj775995/CVE_Report/tree/main/Netgear/R6220; https://www.netgear.com/about/security/; https://github.com/Cj775995/CVE_Report/tree/main/Netgear/R6220
CVE: CVE-2022-26375
Published: 2022-10-17
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Mammothology AB Press Optimizer plugin <= 1.1.1 on WordPress.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/ab-press-optimizer-lite/wordpress-ab-press-optimizer-plugin-1-1-1-auth-stored-cross-site-scripting-xss-vulnerability?_s_id=cve; https://wordpress.org/plugins/ab-press-optimizer-lite/; https://patchstack.com/database/vulnerability/ab-press-optimizer-lite/wordpress-ab-press-optimizer-plugin-1-1-1-auth-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2022-3559
Published: 2022-10-17
Description: A vulnerability was found in Exim and classified as problematic. This issue affects some unknown processing of the component Regex Handler. The manipulation leads to use after free. The name of the patch is 4e9ed49f8f12eb331b29bd5b6dc3693c520fddc2. It is recommended to apply a patch to fix this issue. The identifier VDB-211073 was assigned to this vulnerability.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-119, CWE-416
References: https://bugs.exim.org/show_bug.cgi?id=2915; https://git.exim.org/exim.git/commit/4e9ed49f8f12eb331b29bd5b6dc3693c520fddc2; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EIH4W5R7SHTUEQFWWKB4TUO5YFZX64KV/
CVE: CVE-2022-40055
Published: 2022-10-17
Description: An issue in GX Group GPON ONT Titanium 2122A T2122-V1.26EXL allows attackers to escalate privileges via a brute force attack at the login page.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-307, CWE-307
References: http://gpon.com; http://gx.com; https://blog.alphathreat.in/index.php?post/2022/10/01/Achieving-CVE-2022-40055
CVE: CVE-2022-41751
Published: 2022-10-17
Description: Jhead 3.06.0.1 allows attackers to execute arbitrary OS commands by placing them in a JPEG filename and then using the regeneration -rgt50 option.
CVSS Score: 7.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://github.com/Matthias-Wandel/jhead; https://github.com/Matthias-Wandel/jhead/blob/63ce118c6a59ea64ac357236a11a47aaf569d622/jhead.c#L788; https://github.com/Matthias-Wandel/jhead/pull/57
CVE: CVE-2022-42029
Published: 2022-10-17
Description: Chamilo 1.11.16 is affected by an authenticated local file inclusion vulnerability which allows authenticated users with access to 'big file uploads' to copy/move files from anywhere in the file system into the web directory.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434, CWE-434
References: https://support.chamilo.org/projects/1/wiki/Security_issues#Issue-95-2022-09-14-High-impact-Moderate-risk-Authenticated-Local-file-inclusion; https://support.chamilo.org/projects/1/wiki/Security_issues#Issue-95-2022-09-14-High-impact-Moderate-risk-Authenticated-Local-file-inclusion
CVE: CVE-2022-32176
Published: 2022-10-17
Description: In "Gin-Vue-Admin", versions v2.5.1 through v2.5.3b are vulnerable to Unrestricted File Upload that leads to execution of javascript code, through the "Compress Upload" functionality to the Media Library. When an admin user views the uploaded file, a low privilege attacker will get access to the admin's cookie leading to account takeover.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-434, CWE-434
References: https://github.com/flipped-aurora/gin-vue-admin/blob/v2.5.3beta/web/src/components/upload/image.vue#L43-L49; https://www.mend.io/vulnerability-database/CVE-2022-32176; https://github.com/flipped-aurora/gin-vue-admin/blob/v2.5.3beta/web/src/components/upload/image.vue#L43-L49
CVE: CVE-2022-3563
Published: 2022-10-17
Description: A vulnerability classified as problematic has been found in Linux Kernel. Affected is the function read_50_controller_cap_complete of the file tools/mgmt-tester.c of the component BlueZ. The manipulation of the argument cap_len leads to null pointer dereference. It is recommended to apply a patch to fix this issue. VDB-211086 is the identifier assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-404
References: https://git.kernel.org/pub/scm/bluetooth/bluez.git/commit/?id=e3c92f1f786f0b55440bd908b55894d0c792cf0e; https://vuldb.com/?id.211086; https://git.kernel.org/pub/scm/bluetooth/bluez.git/commit/?id=e3c92f1f786f0b55440bd908b55894d0c792cf0e
CVE: CVE-2022-3564
Published: 2022-10-17
Description: A vulnerability classified as critical was found in Linux Kernel. Affected by this vulnerability is the function l2cap_reassemble_sdu of the file net/bluetooth/l2cap_core.c of the component Bluetooth. The manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-211087.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119, CWE-362
References: https://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next.git/commit/?id=89f9f3cb86b1c63badaf392a83dd661d56cc50b1; https://lists.debian.org/debian-lts-announce/2022/12/msg00031.html; https://lists.debian.org/debian-lts-announce/2022/12/msg00034.html
CVE: CVE-2022-3565
Published: 2022-10-17
Description: A vulnerability, which was classified as critical, has been found in Linux Kernel. Affected by this issue is the function del_timer of the file drivers/isdn/mISDN/l1oip_core.c of the component Bluetooth. The manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-211088.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-119, CWE-662
References: https://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next.git/commit/?id=2568a7e0832ee30b0a351016d03062ab4e0e0a3f; https://lists.debian.org/debian-lts-announce/2022/12/msg00031.html; https://lists.debian.org/debian-lts-announce/2022/12/msg00034.html
CVE: CVE-2022-3566
Published: 2022-10-17
Description: A vulnerability, which was classified as problematic, was found in Linux Kernel. This affects the function tcp_getsockopt/tcp_setsockopt of the component TCP Handler. The manipulation leads to race condition. It is recommended to apply a patch to fix this issue. The identifier VDB-211089 was assigned to this vulnerability.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-362
References: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=f49cd2f4d6170d27a2c61f1fecb03d8a70c91f57; https://vuldb.com/?id.211089; https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=f49cd2f4d6170d27a2c61f1fecb03d8a70c91f57