deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-46434
Published: 2022-12-20
Description: An issue in the firmware update process of TP-Link TL-WA7510N v1 v3.12.6 and earlier allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via uploading a crafted firmware image.
CVSS Score: 7.5 (HIGH)
References: https://hackmd.io/%40slASVrz_SrW7NQCsunofeA/rJl69Icws; https://www.tp-link.com/us/press/security-advisory/; https://hackmd.io/%40slASVrz_SrW7NQCsunofeA/rJl69Icws
CVE: CVE-2022-46435
Published: 2022-12-20
Description: An issue in the firmware update process of TP-Link TL-WR941ND V2/V3 up to 3.13.9 and TL-WR941ND V4 up to 3.12.8 allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via uploading a crafted firmware image.
CVSS Score: 8.8 (HIGH)
References: https://hackmd.io/%40slASVrz_SrW7NQCsunofeA/SyvnlO9Pi; https://www.tp-link.com/us/press/security-advisory/; https://hackmd.io/%40slASVrz_SrW7NQCsunofeA/SyvnlO9Pi
CVE: CVE-2022-46771
Published: 2022-12-20
Description: 
IBM UrbanCode Deploy (UCD) 6.2.0.0 through 6.2.7.18, 7.0.5.0 through 7.0.5.13, 7.1.0.0 through 7.1.2.9, 7.2.0.0 through 7.2.3.2 and 7.3.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 242273.


CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/242273; https://www.ibm.com/support/pages/node/6848897; https://exchange.xforce.ibmcloud.com/vulnerabilities/242273
CVE: CVE-2022-46910
Published: 2022-12-20
Description: An issue in the firmware update process of TP-Link TL-WA901ND V1 up to v3.11.2 and TL-WA901N V2 up to v3.12.16 allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via uploading a crafted firmware image.
CVSS Score: 8.8 (HIGH)
References: https://hackmd.io/%40slASVrz_SrW7NQCsunofeA/BkwzORiDo; https://www.tp-link.com/us/press/security-advisory/; https://hackmd.io/%40slASVrz_SrW7NQCsunofeA/BkwzORiDo
CVE: CVE-2022-46912
Published: 2022-12-20
Description: An issue in the firmware update process of TP-Link TL-WR841N / TL-WA841ND V7 3.13.9 and earlier allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via uploading a crafted firmware image.
CVSS Score: 8.8 (HIGH)
References: https://hackmd.io/%40slASVrz_SrW7NQCsunofeA/Sk6sfbTPi; https://www.tp-link.com/us/press/security-advisory/; https://hackmd.io/%40slASVrz_SrW7NQCsunofeA/Sk6sfbTPi
CVE: CVE-2022-46914
Published: 2022-12-20
Description: An issue in the firmware update process of TP-LINK TL-WA801N / TL-WA801ND V1 v3.12.16 and earlier allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via uploading a crafted firmware image.
CVSS Score: 8.8 (HIGH)
References: https://hackmd.io/%40slASVrz_SrW7NQCsunofeA/BJ4czlpwi; https://www.tp-link.com/us/press/security-advisory/; https://hackmd.io/%40slASVrz_SrW7NQCsunofeA/BJ4czlpwi
CVE: CVE-2021-46856
Published: 2022-12-20
Description: The multi-screen collaboration module has a path traversal vulnerability. Successful exploitation of this vulnerability may affect data confidentiality.


CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://consumer.huawei.com/en/support/bulletin/2023/1/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202212-[PII_REDACTED]; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202301-[PII_REDACTED]
CVE: CVE-2022-23542
Published: 2022-12-20
Description: OpenFGA is an authorization/permission engine built for developers and inspired by Google Zanzibar. During an internal security assessment, it was discovered that OpenFGA version 0.3.0 is vulnerable to authorization bypass under certain conditions. This issue has been patched in version 0.3.1 and is backward compatible.


CVSS Score: 7.7 (HIGH)
CWE: CWE-285
References: https://github.com/openfga/openfga/pull/422; https://github.com/openfga/openfga/releases/tag/v0.3.1; https://github.com/openfga/openfga/security/advisories/GHSA-m3q4-7qmj-657m
CVE: CVE-2022-38391
Published: 2022-12-20
Description: 
IBM Spectrum Control 5.4 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 233982.


CVSS Score: 5.1 (MEDIUM)
CWE: CWE-327, CWE-327
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/233982; https://www.ibm.com/support/pages/node/6847541; https://exchange.xforce.ibmcloud.com/vulnerabilities/233982
CVE: CVE-2022-38733
Published: 2022-12-20
Description: OnCommand Insight versions 7.3.1 through 7.3.14 are susceptible to an authentication bypass vulnerability in the Data Warehouse component.
CVSS Score: 8.6 (HIGH)
References: https://security.netapp.com/advisory/NTAP-20[PII_REDACTED]/; https://security.netapp.com/advisory/NTAP-20[PII_REDACTED]/
CVE: CVE-2022-39166
Published: 2022-12-20
Description: 
IBM Security Guardium 11.4 could allow a privileged user to obtain sensitive information inside of an HTTP response. IBM X-Force ID: 235405.


CVSS Score: 4.4 (MEDIUM)
CWE: CWE-200
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/235405; https://www.ibm.com/support/pages/node/6848317; https://exchange.xforce.ibmcloud.com/vulnerabilities/235405
CVE: CVE-2022-41590
Published: 2022-12-20
Description: Some smartphones have authentication-related (including session management) vulnerabilities as the setup wizard is bypassed. Successful exploitation of this vulnerability affects the smartphone availability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-287, CWE-287
References: https://device.harmonyos.com/en/docs/security/update/security-bulletins-202212-[PII_REDACTED]; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202212-[PII_REDACTED]
CVE: CVE-2022-41591
Published: 2022-12-20
Description: The backup module has a path traversal vulnerability. Successful exploitation of this vulnerability causes unauthorized access to other system files.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://consumer.huawei.com/en/support/bulletin/2022/12/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202212-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2022/12/
CVE: CVE-2022-41596
Published: 2022-12-20
Description: The system tool has inconsistent serialization and deserialization. Successful exploitation of this vulnerability will cause unauthorized startup of components.
CVSS Score: 7.5 (HIGH)
CWE: CWE-502, CWE-502
References: https://consumer.huawei.com/en/support/bulletin/2022/12/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202212-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2022/12/
CVE: CVE-2022-41599
Published: 2022-12-20
Description: The system service has a vulnerability that causes incorrect return values. Successful exploitation of this vulnerability may affect data confidentiality.
CVSS Score: 7.5 (HIGH)
References: https://consumer.huawei.com/en/support/bulletin/2022/12/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202212-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2022/12/
CVE: CVE-2022-43382
Published: 2022-12-20
Description: IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1could allow a local user with elevated privileges to exploit a vulnerability in the lpd daemon to cause a denial of service.  IBM X-Force ID:  238641.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-399
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/238641; https://www.ibm.com/support/pages/node/6848309; https://exchange.xforce.ibmcloud.com/vulnerabilities/238641
CVE: CVE-2022-46310
Published: 2022-12-20
Description: The TelephonyProvider module has a vulnerability in obtaining values.Successful exploitation of this vulnerability may affect data confidentiality.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://device.harmonyos.com/en/docs/security/update/security-bulletins-202212-[PII_REDACTED]; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202212-[PII_REDACTED]
CVE: CVE-2022-46311
Published: 2022-12-20
Description: The contacts component has a free (undefined) provider vulnerability. Successful exploitation of this vulnerability may affect data integrity.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416, CWE-416
References: https://device.harmonyos.com/en/docs/security/update/security-bulletins-202212-[PII_REDACTED]; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202212-[PII_REDACTED]
CVE: CVE-2022-46312
Published: 2022-12-20
Description: The application management module has a vulnerability in permission verification. Successful exploitation of this vulnerability causes unexpected clear of device applications.
CVSS Score: 7.5 (HIGH)
CWE: CWE-285
References: https://consumer.huawei.com/en/support/bulletin/2022/12/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202212-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2022/12/
CVE: CVE-2022-46313
Published: 2022-12-20
Description: The sensor privacy module has an authentication vulnerability. Successful exploitation of this vulnerability may cause unavailability of the smartphone's camera and microphone.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-287, CWE-287
References: https://device.harmonyos.com/en/docs/security/update/security-bulletins-202212-[PII_REDACTED]; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202212-[PII_REDACTED]
CVE: CVE-2022-46314
Published: 2022-12-20
Description: The IPC module has defects introduced in the design process. Successful exploitation of this vulnerability may affect system availability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-404
References: https://device.harmonyos.com/en/docs/security/update/security-bulletins-202212-[PII_REDACTED]; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202212-[PII_REDACTED]
CVE: CVE-2022-46315
Published: 2022-12-20
Description: The ProfileSDK has defects introduced in the design process. Successful exploitation of this vulnerability may affect system availability.


CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://consumer.huawei.com/en/support/bulletin/2023/3; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202212-[PII_REDACTED]; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202303-[PII_REDACTED]
CVE: CVE-2022-46316
Published: 2022-12-20
Description: A thread security vulnerability exists in the authentication process. Successful exploitation of this vulnerability may affect data integrity, confidentiality, and availability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287, CWE-287
References: https://device.harmonyos.com/en/docs/security/update/security-bulletins-202212-[PII_REDACTED]; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202212-[PII_REDACTED]
CVE: CVE-2022-46317
Published: 2022-12-20
Description: The power consumption module has an out-of-bounds read vulnerability. Successful exploitation of this vulnerability may affect system availability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125, CWE-125
References: https://consumer.huawei.com/en/support/bulletin/2022/12/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202212-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2022/12/
CVE: CVE-2022-46318
Published: 2022-12-20
Description: The HAware module has a function logic error. Successful exploitation of this vulnerability will affect the account removal function in Settings.
CVSS Score: 5.3 (MEDIUM)
References: https://consumer.huawei.com/en/support/bulletin/2022/12/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202212-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2022/12/
CVE: CVE-2022-46319
Published: 2022-12-20
Description: Fingerprint calibration has a vulnerability of lacking boundary judgment. Successful exploitation of this vulnerability may cause out-of-bounds write.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://consumer.huawei.com/en/support/bulletin/2022/12/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202212-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2022/12/
CVE: CVE-2022-46320
Published: 2022-12-20
Description: The kernel module has an out-of-bounds read vulnerability. Successful exploitation of this vulnerability may cause memory overwriting.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125, CWE-125
References: https://consumer.huawei.com/en/support/bulletin/2022/12/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202212-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2022/12/
CVE: CVE-2022-46321
Published: 2022-12-20
Description: The Wi-Fi module has a vulnerability in permission verification. Successful exploitation of this vulnerability may affect data confidentiality.
CVSS Score: 7.5 (HIGH)
References: https://consumer.huawei.com/en/support/bulletin/2022/12/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202212-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2022/12/
CVE: CVE-2022-46322
Published: 2022-12-20
Description: Some smartphones have the out-of-bounds write vulnerability. Successful exploitation of this vulnerability may cause system service exceptions.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-787
References: https://consumer.huawei.com/en/support/bulletin/2022/12/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202212-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2022/12/
CVE: CVE-2022-46323
Published: 2022-12-20
Description: Some smartphones have the out-of-bounds write vulnerability.Successful exploitation of this vulnerability may cause system service exceptions.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://consumer.huawei.com/en/support/bulletin/2022/12/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202212-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2022/12/
CVE: CVE-2022-46324
Published: 2022-12-20
Description: Some smartphones have the out-of-bounds write vulnerability. Successful exploitation of this vulnerability may cause system service exceptions.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://consumer.huawei.com/en/support/bulletin/2022/12/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202212-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2022/12/
CVE: CVE-2022-46325
Published: 2022-12-20
Description: Some smartphones have the out-of-bounds write vulnerability.Successful exploitation of this vulnerability may cause system service exceptions.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://consumer.huawei.com/en/support/bulletin/2022/12/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202212-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2022/12/
CVE: CVE-2022-46326
Published: 2022-12-20
Description: Some smartphones have the out-of-bounds write vulnerability. Successful exploitation of this vulnerability may cause system service exceptions.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://consumer.huawei.com/en/support/bulletin/2022/12/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202212-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2022/12/
CVE: CVE-2022-46327
Published: 2022-12-20
Description: Some smartphones have configuration issues. Successful exploitation of this vulnerability may cause privilege escalation, which results in system service exceptions.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-269
References: https://consumer.huawei.com/en/support/bulletin/2022/12/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202212-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2022/12/
CVE: CVE-2022-46328
Published: 2022-12-20
Description: Some smartphones have the input validation vulnerability. Successful exploitation of this vulnerability may affect data confidentiality.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-20
References: https://consumer.huawei.com/en/support/bulletin/2022/12/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202212-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2022/12/
CVE: CVE-2022-42046
Published: 2022-12-20
Description: wfshbr64.sys and wfshbr32.sys specially crafted IOCTL allows arbitrary user to perform local privilege escalation
CVSS Score: 7.8 (HIGH)
CWE: CWE-269, CWE-269
References: https://github.com/kkent030315/CVE-2022-42046; https://www.wfs.games/news/20221220_01.html; https://github.com/kkent030315/CVE-2022-42046
CVE: CVE-2022-47629
Published: 2022-12-20
Description: Libksba before 1.6.3 is prone to an integer overflow vulnerability in the CRL signature parser.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190, CWE-190
References: https://dev.gnupg.org/T6284; https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libksba.git%3Ba=commit%3Bh=f61a5ea4e0f6a80fd4b28ef0174bee77793cf070; https://lists.debian.org/debian-lts-announce/2022/12/msg00035.html
CVE: CVE-2022-42949
Published: 2022-12-21
Description: Silverstripe silverstripe/subsites through 2.6.0 has Insecure Permissions.
CVSS Score: 7.5 (HIGH)
CWE: CWE-732, CWE-732
References: https://www.silverstripe.org/download/security-releases/; https://www.silverstripe.org/download/security-releases/cve-2022-42949; https://www.silverstripe.org/download/security-releases/
CVE: CVE-2022-4617
Published: 2022-12-21
Description: Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 1.3.2.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/microweber/microweber/commit/df8add930ecfa7f5b18c67c3f748c137fe890906; https://huntr.dev/bounties/1fb2ce08-7016-45fa-b402-ec08d700e4df; https://github.com/microweber/microweber/commit/df8add930ecfa7f5b18c67c3f748c137fe890906
CVE: CVE-2022-38546
Published: 2022-12-21
Description: A DNS misconfiguration was found in Zyxel NBG7510 firmware versions prior to V1.00(ABZY.3)C0, which could allow an unauthenticated attacker to access the DNS server when the device is switched to the AP mode.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-284
References: https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-dns-misconfiguration-in-nbg7510-home-router; https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-dns-misconfiguration-in-nbg7510-home-router
CVE: CVE-2022-24431
Published: 2022-12-21
Description: All versions of package abacus-ext-cmdline are vulnerable to Command Injection via the execute function due to improper user-input sanitization.
CVSS Score: 7.4 (HIGH)
CWE: CWE-78, CWE-78
References: https://security.snyk.io/vuln/SNYK-JS-ABACUSEXTCMDLINE-3157950; https://security.snyk.io/vuln/SNYK-JS-ABACUSEXTCMDLINE-3157950
CVE: CVE-2022-25893
Published: 2022-12-21
Description: The package vm2 before 3.9.10 are vulnerable to Arbitrary Code Execution due to the usage of prototype lookup for the WeakMap.prototype.set method. Exploiting this vulnerability leads to access to a host object and a sandbox compromise.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-471
References: https://github.com/patriksimek/vm2/issues/444; https://github.com/patriksimek/vm2/pull/445; https://github.com/patriksimek/vm2/pull/445/commits/3a9876482be487b78a90ac459675da7f83f46d69
CVE: CVE-2022-25895
Published: 2022-12-21
Description: All versions of package lite-dev-server are vulnerable to Directory Traversal due to missing input sanitization and sandboxes being employed to the req.url user input that is passed to the server code.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://gist.github.com/lirantal/0f8a48c3f5ac581ce73123abe9f7f120; https://github.com/shadowwzw/lite-dev-server/blob/master/src/server.js%23L134; https://security.snyk.io/vuln/SNYK-JS-LITEDEVSERVER-3153718
CVE: CVE-2022-25929
Published: 2022-12-21
Description: The package smoothie from 1.31.0 and before 1.36.1 are vulnerable to Cross-site Scripting (XSS) due to improper user input sanitization in strokeStyle and tooltipLabel properties. Exploiting this vulnerability is possible when the user can control these properties.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/joewalnes/smoothie/commit/8e0920d50da82f4b6e605d56f41b69fbb9606a98; https://github.com/joewalnes/smoothie/pull/147; https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-3177369
CVE: CVE-2022-47635
Published: 2022-12-21
Description: Wildix WMS 6 before 6.02.20221216, WMS 5 before 5.04.20221214, and WMS4 before 4.04.45396.23 allows Server-side request forgery (SSRF) via ZohoClient.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-918, CWE-918
References: https://wildix.atlassian.net/wiki/spaces/DOC/pages/30279136/Changelogs; https://wildix.atlassian.net/wiki/spaces/DOC/pages/30279136/Changelogs
CVE: CVE-2022-43543
Published: 2022-12-21
Description: KDDI +Message App, NTT DOCOMO +Message App, and SoftBank +Message App contain a vulnerability caused by improper handling of Unicode control characters. +Message App displays text unprocessed, even when control characters are contained, and the text is shown based on Unicode control character's specifications. Therefore, a crafted text may display misleading web links. As a result, a spoofed URL may be displayed and phishing attacks may be conducted. Affected products and versions are as follows: KDDI +Message App for Android prior to version 3.9.2 and +Message App for iOS prior to version 3.9.4, NTT DOCOMO +Message App for Android prior to version 54.49.0500 and +Message App for iOS prior to version 3.9.4, and SoftBank +Message App for Android prior to version 12.9.5 and +Message App for iOS prior to version 3.9.4
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-116
References: https://jvn.jp/en/jp/JVN43561812/index.html; https://www.au.com/mobile/service/plus-message/information/; https://www.docomo.ne.jp/service/plus_message/
CVE: CVE-2022-44449
Published: 2022-12-21
Description: Stored cross-site scripting vulnerability in Zenphoto versions prior to 1.6 allows remote a remote authenticated attacker with an administrative privilege to inject an arbitrary script.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/zenphoto/zenphoto; https://jvn.jp/en/jp/JVN06093462/index.html; https://www.zenphoto.org/
CVE: CVE-2022-46282
Published: 2022-12-21
Description: Use after free vulnerability in CX-Drive V3.00 and earlier allows a local attacker to execute arbitrary code by having a user to open a specially crafted file,
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://jvn.jp/en/vu/JVNVU92689335/index.html; https://jvn.jp/en/vu/JVNVU92689335/index.html
CVE: CVE-2022-46330
Published: 2022-12-21
Description: Squirrel.Windows is both a toolset and a library that provides installation and update functionality for Windows desktop applications. Installers generated by Squirrel.Windows 2.0.1 and earlier contain an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries. As a result, arbitrary code may be executed with the privilege of the user invoking the installer.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427, CWE-427
References: https://github.com/Squirrel/Squirrel.Windows; https://github.com/Squirrel/Squirrel.Windows/pull/1807; https://jvn.jp/en/jp/JVN29902403/index.html