deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-40607
Published: 2022-06-28
Description: The schm_box_size function in GPAC 1.0.1 allows attackers to cause a denial of service via a crafted file in the MP4Box command.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-770
References: https://github.com/gpac/gpac/issues/1879; https://github.com/gpac/gpac/issues/1879
CVE: CVE-2021-40608
Published: 2022-06-28
Description: The gf_hinter_track_finalize function in GPAC 1.0.1 allows attackers to cause a denial of service via a crafted file in the MP4Box command.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-908
References: https://github.com/gpac/gpac/issues/1883; https://www.debian.org/security/2023/dsa-5411; https://github.com/gpac/gpac/issues/1883
CVE: CVE-2021-40609
Published: 2022-06-28
Description: The GetHintFormat function in GPAC 1.0.1 allows attackers to cause a denial of service via a crafted file in the MP4Box command.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-770
References: https://github.com/gpac/gpac/issues/1894; https://www.debian.org/security/2023/dsa-5411; https://github.com/gpac/gpac/issues/1894
CVE: CVE-2021-40943
Published: 2022-06-28
Description: In Bento4 1.6.0-638, there is a null pointer reference in the function AP4_DescriptorListInspector::Action function in Ap4Descriptor.h:124 , as demonstrated by GPAC. This can cause a denial of service (DOS).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/axiomatic-systems/Bento4/issues/643; https://github.com/axiomatic-systems/Bento4/issues/643
CVE: CVE-2021-40944
Published: 2022-06-28
Description: In GPAC MP4Box 1.1.0, there is a Null pointer reference in the function gf_filter_pid_get_packet function in src/filter_core/filter_pid.c:5394, as demonstrated by GPAC. This can cause a denial of service (DOS).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/gpac/gpac/issues/1906; https://www.debian.org/security/2023/dsa-5411; https://github.com/gpac/gpac/issues/1906
CVE: CVE-2021-41460
Published: 2022-06-28
Description: ECShop 4.1.0 has SQL injection vulnerability, which can be exploited by attackers to obtain sensitive information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://www.cnvd.org.cn/flaw/show/CNVD-2020-58823; https://www.cnvd.org.cn/flaw/show/CNVD-2020-58823
CVE: CVE-2021-41687
Published: 2022-06-28
Description: DCMTK through 3.6.6 does not handle memory free properly. The program malloc a heap memory for parsing data, but does not free it when error in parsing. Sending specific requests to the dcmqrdb program incur the memory leak. An attacker can use it to launch a DoS attack.
CVSS Score: 7.5 (HIGH)
CWE: CWE-401
References: https://github.com/DCMTK/dcmtk; https://github.com/DCMTK/dcmtk/commit/a9697dfeb672b0b9412c00c7d36d801e27ec85cb; https://lists.debian.org/debian-lts-announce/2024/06/msg00022.html
CVE: CVE-2021-41688
Published: 2022-06-28
Description: DCMTK through 3.6.6 does not handle memory free properly. The object in the program is free but its address is still used in other locations. Sending specific requests to the dcmqrdb program will incur a double free. An attacker can use it to launch a DoS attack.
CVSS Score: 7.5 (HIGH)
CWE: CWE-415
References: https://github.com/DCMTK/dcmtk; https://github.com/DCMTK/dcmtk/commit/a9697dfeb672b0b9412c00c7d36d801e27ec85cb; https://lists.debian.org/debian-lts-announce/2024/06/msg00022.html
CVE: CVE-2021-41689
Published: 2022-06-28
Description: DCMTK through 3.6.6 does not handle string copy properly. Sending specific requests to the dcmqrdb program, it would query its database and copy the result even if the result is null, which can incur a head-based overflow. An attacker can use it to launch a DoS attack.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476, CWE-476
References: https://github.com/DCMTK/dcmtk; https://github.com/DCMTK/dcmtk/commit/5c14bf53fb42ceca12bbcc0016e8704b1580920d; https://lists.debian.org/debian-lts-announce/2024/06/msg00022.html
CVE: CVE-2021-41690
Published: 2022-06-28
Description: DCMTK through 3.6.6 does not handle memory free properly. The malloced memory for storing all file information are recorded in a global variable LST and are not freed properly. Sending specific requests to the dcmqrdb program can incur a memory leak. An attacker can use it to launch a DoS attack.
CVSS Score: 7.5 (HIGH)
CWE: CWE-401
References: https://github.com/DCMTK/dcmtk; https://github.com/DCMTK/dcmtk/commit/a9697dfeb672b0b9412c00c7d36d801e27ec85cb; https://lists.debian.org/debian-lts-announce/2024/06/msg00022.html
CVE: CVE-2022-23896
Published: 2022-06-28
Description: Admidio 4.1.2 version is affected by stored cross-site scripting (XSS).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://huntr.dev/bounties/79c2d16c-bae2-417f-ab50-10c52707a30f/; https://huntr.dev/bounties/79c2d16c-bae2-417f-ab50-10c52707a30f/
CVE: CVE-2022-29519
Published: 2022-06-28
Description: Cleartext transmission of sensitive information vulnerability exists in STARDOM FCN Controller and FCJ Controller R1.01 to R4.31, which may allow an adjacent attacker to login the affected products and alter device configuration settings or tamper with device firmware.
CVSS Score: 7.5 (HIGH)
CWE: CWE-319
References: https://jvn.jp/vu/JVNVU95452299/index.html; https://web-material3.yokogawa.com/1/32885/files/YSAR-22-0007-E.pdf; https://web-material3.yokogawa.com/19/32885/files/YSAR-22-0007-J.pdf
CVE: CVE-2022-30707
Published: 2022-06-28
Description: Violation of secure design principles exists in the communication of CAMS for HIS. Affected products and versions are CENTUM series where LHS4800 is installed (CENTUM CS 3000 and CENTUM CS 3000 Small R3.08.10 to R3.09.00), CENTUM series where CAMS function is used (CENTUM VP, CENTUM VP Small, and CENTUM VP Basic R4.01.00 to R4.03.00), CENTUM series regardless of the use of CAMS function (CENTUM VP, CENTUM VP Small, and CENTUM VP Basic R5.01.00 to R5.04.20 and R6.01.00 to R6.09.00), Exaopc R3.72.00 to R3.80.00 (only if NTPF100-S6 'For CENTUM VP Support CAMS for HIS' is installed), B/M9000 CS R5.04.01 to R5.05.01, and B/M9000 VP R6.01.01 to R8.03.01). If an adjacent attacker successfully compromises a computer using CAMS for HIS software, they can use credentials from the compromised machine to access data from another machine using CAMS for HIS software. This can lead to a disabling of CAMS for HIS software functions on any affected machines, or information disclosure/alteration.
CVSS Score: 8.8 (HIGH)
References: https://jvn.jp/vu/JVNVU92819891/index.html; https://web-material3.yokogawa.com/1/32780/files/YSAR-22-0006-E.pdf; https://web-material3.yokogawa.com/19/32780/files/YSAR-22-0006-J.pdf
CVE: CVE-2022-30997
Published: 2022-06-28
Description: Use of hard-coded credentials vulnerability exists in STARDOM FCN Controller and FCJ Controller R4.10 to R4.31, which may allow an attacker with an administrative privilege to read/change configuration settings or update the controller with tampered firmware.
CVSS Score: 7.2 (HIGH)
CWE: CWE-798, CWE-798
References: https://jvn.jp/vu/JVNVU95452299/index.html; https://web-material3.yokogawa.com/1/32885/files/YSAR-22-0007-E.pdf; https://web-material3.yokogawa.com/19/32885/files/YSAR-22-0007-J.pdf
CVE: CVE-2022-34750
Published: 2022-06-28
Description: An issue was discovered in MediaWiki through 1.38.1. The lemma length of a Wikibase lexeme is currently capped at a thousand characters. Unfortunately, this length is not validated, allowing much larger lexemes to be created, which introduces various denial-of-service attack vectors within the Wikibase and WikibaseLexeme extensions. This is related to Special:NewLexeme and Special:NewProperty.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://gerrit.wikimedia.org/r/q/I8171bfef73e525d73efa60b407ce147130ea4742; https://gerrit.wikimedia.org/r/q/Id89a9b08e40f075d2d422cafd03668dff3ce7fc9; https://phabricator.wikimedia.org/T308659
CVE: CVE-2022-23763
Published: 2022-06-28
Description: Origin validation error vulnerability in NeoRS’s ActiveX moudle allows attackers to download and execute arbitrary files. Remote attackers can use this vulerability to encourage users to access crafted web pages, causing damage such as malicious code infections.
CVSS Score: 7.8 (HIGH)
CWE: CWE-346, CWE-346
References: https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66788; https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66788
CVE: CVE-2022-30560
Published: 2022-06-28
Description: When an attacker obtaining the administrative account and password, or through a man-in-the-middle attack, the attacker could send a specified crafted packet to the vulnerable interface then lead the device to crash.
CVSS Score: 7.4 (HIGH)
References: https://www.dahuasecurity.com/support/cybersecurity/details/1017; https://www.dahuasecurity.com/support/cybersecurity/details/1017
CVE: CVE-2022-30561
Published: 2022-06-28
Description: When an attacker uses a man-in-the-middle attack to sniff the request packets with success logging in, the attacker could log in to the device by replaying the user's login packet.
CVSS Score: 5.9 (MEDIUM)
References: https://www.dahuasecurity.com/support/cybersecurity/details/1017; https://www.dahuasecurity.com/support/cybersecurity/details/1017
CVE: CVE-2022-30562
Published: 2022-06-28
Description: If the user enables the https function on the device, an attacker can modify the user’s request data packet through a man-in-the-middle attack ,Injection of a malicious URL in the Host: header of the HTTP Request results in a 302 redirect to an attacker-controlled page.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-601
References: https://www.dahuasecurity.com/support/cybersecurity/details/1017; https://www.dahuasecurity.com/support/cybersecurity/details/1017
CVE: CVE-2022-30563
Published: 2022-06-28
Description: When an attacker uses a man-in-the-middle attack to sniff the request packets with success logging in through ONVIF, he can log in to the device by replaying the user's login packet.
CVSS Score: 7.4 (HIGH)
References: https://www.dahuasecurity.com/support/cybersecurity/details/1017; https://www.dahuasecurity.com/support/cybersecurity/details/1017
CVE: CVE-2022-0085
Published: 2022-06-28
Description: Server-Side Request Forgery (SSRF) in GitHub repository dompdf/dompdf prior to 2.0.0.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-918
References: https://github.com/dompdf/dompdf/commit/bb1ef65011a14730b7cfbe73506b4bb8a03704bd; https://huntr.dev/bounties/73dbcc78-5ba9-492f-9133-13bbc9f31236; https://github.com/dompdf/dompdf/commit/bb1ef65011a14730b7cfbe73506b4bb8a03704bd
CVE: CVE-2021-3779
Published: 2022-06-28
Description: A malicious MySQL server can request local file content from a client using ruby-mysql prior to version 2.10.0 without explicit authorization from the user. This issue was resolved in version 2.10.0 and later.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-610, CWE-610
References: https://www.rapid7.com/blog/post/2022/06/28/cve-2021-3779-ruby-mysql-gem-client-file-read-fixed/; https://www.rapid7.com/blog/post/2022/06/28/cve-2021-3779-ruby-mysql-gem-client-file-read-fixed/
CVE: CVE-2021-40553
Published: 2022-06-28
Description: piwigo 11.5.0 is affected by a remote code execution (RCE) vulnerability in the LocalFiles Editor.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: https://github.com/Yang9999999/vuln/blob/main/README.md; https://github.com/Yang9999999/vuln/blob/main/README.md
CVE: CVE-2022-0987
Published: 2022-06-28
Description: A flaw was found in PackageKit in the way some of the methods exposed by the Transaction interface examines files. This issue allows a local user to measure the time the methods take to execute and know whether a file owned by root or other users exists.
CVSS Score: 3.3 (LOW)
CWE: CWE-200
References: https://bugzilla.redhat.com/show_bug.cgi?id=2064315; https://bugzilla.redhat.com/show_bug.cgi?id=2064315
CVE: CVE-2022-31052
Published: 2022-06-28
Description: Synapse is an open source home server implementation for the Matrix chat network. In versions prior to 1.61.1 URL previews of some web pages can exhaust the available stack space for the Synapse process due to unbounded recursion. This is sometimes recoverable and leads to an error for the request causing the problem, but in other cases the Synapse process may crash altogether. It is possible to exploit this maliciously, either by malicious users on the homeserver, or by remote users sending URLs that a local user's client may automatically request a URL preview for. Remote users are not able to exploit this directly, because the URL preview endpoint is authenticated. Deployments with `url_preview_enabled: false` set in configuration are not affected. Deployments with `url_preview_enabled: true` set in configuration **are** affected. Deployments with no configuration value set for `url_preview_enabled` are not affected, because the default is `false`. Administrators of homeservers with URL previews enabled are advised to upgrade to v1.61.1 or higher. Users unable to upgrade should set `url_preview_enabled` to false.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-674
References: https://github.com/matrix-org/synapse/commit/fa[PII_REDACTED]ac7b7d20e954ba7372c5ac292333; https://github.com/matrix-org/synapse/security/advisories/GHSA-22p3-qrh9-cx32; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7EARKKJZ2W7WUITFDT4EG4NVATFYJQHF/
CVE: CVE-2022-33108
Published: 2022-06-28
Description: XPDF v4.04 was discovered to contain a stack overflow vulnerability via the Object::Copy class of object.cc files.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://forum.xpdfreader.com/viewtopic.php?f=3&t=42284; https://forum.xpdfreader.com/viewtopic.php?f=3&t=42286; https://forum.xpdfreader.com/viewtopic.php?f=3&t=42287
CVE: CVE-2022-28621
Published: 2022-06-28
Description: A remote disclosure of sensitive information vulnerability was discovered in HPE NonStop DSM/SCM version: T6031H03^ADP. HPE has provided a software update to resolve this vulnerability in HPE NonStop DSM/SCM.
CVSS Score: 7.5 (HIGH)
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbns04328en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbns04328en_us
CVE: CVE-2022-2145
Published: 2022-06-28
Description: Cloudflare WARP client for Windows (up to v. 2022.5.309.0) allowed creation of mount points from its ProgramData folder. During installation of the WARP client, it was possible to escalate privileges and overwrite SYSTEM protected files.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20, CWE-59, CWE-59
References: https://github.com/cloudflare/advisories/security/advisories/GHSA-6fpc-qxmr-6wrq; https://github.com/cloudflare/advisories/security/advisories/GHSA-6fpc-qxmr-6wrq
CVE: CVE-2022-31056
Published: 2022-06-28
Description: GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. In affected versions all assistance forms (Ticket/Change/Problem) permit sql injection on the actor fields. This issue has been resolved in version 10.0.2 and all affected users are advised to upgrade.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: http://packetstormsecurity.com/files/171656/GLPI-10.0.2-SQL-Injection-Remote-Code-Execution.html; https://github.com/glpi-project/glpi/security/advisories/GHSA-9q9x-7xxh-w4cg; http://packetstormsecurity.com/files/171656/GLPI-10.0.2-SQL-Injection-Remote-Code-Execution.html
CVE: CVE-2022-31061
Published: 2022-06-28
Description: GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. In affected versions there is a SQL injection vulnerability which is possible on login page. No user credentials are required to exploit this vulnerability. Users are advised to upgrade as soon as possible. There are no known workarounds for this issue.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/glpi-project/glpi/commit/21ae07d00d0b3230f6235386e98388cfc5bb0514; https://github.com/glpi-project/glpi/security/advisories/GHSA-w2gc-v2gm-q7wq; https://github.com/glpi-project/glpi/commit/21ae07d00d0b3230f6235386e98388cfc5bb0514
CVE: CVE-2022-31068
Published: 2022-06-28
Description: GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. In affected versions all GLPI instances with the native inventory used may leak sensitive information. The feature to get refused file is not authenticated. This issue has been addressed in version 10.0.2 and all affected users are advised to upgrade.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://github.com/glpi-project/glpi/commit/9953a644777e4167b06db9e14fc93b945a557be5; https://github.com/glpi-project/glpi/security/advisories/GHSA-g4hm-6vfr-q3wg; https://github.com/glpi-project/glpi/commit/9953a644777e4167b06db9e14fc93b945a557be5
CVE: CVE-2022-31106
Published: 2022-06-28
Description: Underscore.deep is a collection of Underscore mixins that operate on nested objects. Versions of `underscore.deep` prior to version 0.5.3 are vulnerable to a prototype pollution vulnerability. An attacker can craft a malicious payload and pass it to `deepFromFlat`, which would pollute any future Objects created. Any users that have `deepFromFlat` or `deepPick` (due to its dependency on `deepFromFlat`) in their code should upgrade to version 0.5.3 as soon as possible. Users unable to upgrade may mitigate this issue by modifying `deepFromFlat` to prevent specific keywords which will prevent this from happening.
CVSS Score: 8.3 (HIGH)
CWE: CWE-915, CWE-1321, CWE-1321
References: https://github.com/Clever/underscore.deep/commit/b5e109ad05b48371be225fa4d490dd08a94e8ef7; https://github.com/Clever/underscore.deep/security/advisories/GHSA-8j79-hfj5-f2xm; https://github.com/Clever/underscore.deep/commit/b5e109ad05b48371be225fa4d490dd08a94e8ef7
CVE: CVE-2022-31108
Published: 2022-06-28
Description: Mermaid is a JavaScript based diagramming and charting tool that uses Markdown-inspired text definitions and a renderer to create and modify complex diagrams. An attacker is able to inject arbitrary `CSS` into the generated graph allowing them to change the styling of elements outside of the generated graph, and potentially exfiltrate sensitive information by using specially crafted `CSS` selectors. The following example shows how an attacker can exfiltrate the contents of an input field by bruteforcing the `value` attribute one character at a time. Whenever there is an actual match, an `http` request will be made by the browser in order to "load" a background image that will let an attacker know what's the value of the character. This issue may lead to `Information Disclosure` via CSS selectors and functions able to generate HTTP requests. This also allows an attacker to change the document in ways which may lead a user to perform unintended actions, such as clicking on a link, etc. This issue has been resolved in version 9.1.3. Users are advised to upgrade. Users unable to upgrade should ensure that user input is adequately escaped before embedding it in CSS blocks.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-74, CWE-79
References: https://github.com/mermaid-js/mermaid/commit/0ae1bdb61adff1cd485caff8c62ec6b8ac57b225; https://github.com/mermaid-js/mermaid/security/advisories/GHSA-x3vm-38hw-55wf; https://github.com/mermaid-js/mermaid/commit/0ae1bdb61adff1cd485caff8c62ec6b8ac57b225
CVE: CVE-2022-31229
Published: 2022-06-28
Description: Dell PowerScale OneFS, 8.2.x through 9.3.0.x, contain an error message with sensitive information. An administrator could potentially exploit this vulnerability, leading to disclosure of sensitive information. This sensitive information can be used to access sensitive resources.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-209, CWE-209
References: https://www.dell.com/support/kbdoc/en-us/000200681/dsa-2022-118-dell-emc-powerscale-onefs-security-update?lang=en; https://www.dell.com/support/kbdoc/en-us/000200681/dsa-2022-118-dell-emc-powerscale-onefs-security-update?lang=en
CVE: CVE-2022-31230
Published: 2022-06-28
Description: Dell PowerScale OneFS, versions 8.2.x-9.2.x, contain broken or risky cryptographic algorithm. A remote unprivileged malicious attacker could potentially exploit this vulnerability, leading to full system access.
CVSS Score: 8.1 (HIGH)
CWE: CWE-327, CWE-327
References: https://www.dell.com/support/kbdoc/en-us/000200681/dsa-2022-118-dell-emc-powerscale-onefs-security-update; https://www.dell.com/support/kbdoc/en-us/000200681/dsa-2022-118-dell-emc-powerscale-onefs-security-update
CVE: CVE-2021-3430
Published: 2022-06-28
Description: Assertion reachable with repeated LL_CONNECTION_PARAM_REQ. Zephyr versions >= v1.14 contain Reachable Assertion (CWE-617). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-46h3-hjcq-2jjr
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-617, CWE-617
References: http://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-46h3-hjcq-2jjr; http://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-46h3-hjcq-2jjr
CVE: CVE-2021-3431
Published: 2022-06-28
Description: Assertion reachable with repeated LL_FEATURE_REQ. Zephyr versions >= v2.5.0 contain Reachable Assertion (CWE-617). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-7548-5m6f-mqv9
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-617, CWE-617
References: http://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-7548-5m6f-mqv9; http://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-7548-5m6f-mqv9
CVE: CVE-2021-3432
Published: 2022-06-28
Description: Invalid interval in CONNECT_IND leads to Division by Zero. Zephyr versions >= v1.14.0 Divide By Zero (CWE-369). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-7364-p4wc-8mj4
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-369, CWE-369
References: http://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-7364-p4wc-8mj4; http://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-7364-p4wc-8mj4
CVE: CVE-2021-3433
Published: 2022-06-28
Description: Invalid channel map in CONNECT_IND results to Deadlock. Zephyr versions >= v2.5.0 Improper Check or Handling of Exceptional Conditions (CWE-703). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-3c2f-w4v6-qxrp
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-703
References: http://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-3c2f-w4v6-qxrp; http://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-3c2f-w4v6-qxrp
CVE: CVE-2021-3434
Published: 2022-06-28
Description: Stack based buffer overflow in le_ecred_conn_req(). Zephyr versions >= v2.5.0 Stack-based Buffer Overflow (CWE-121). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-8w87-6rfp-cfrm
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-121, CWE-787
References: http://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-8w87-6rfp-cfrm; http://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-8w87-6rfp-cfrm
CVE: CVE-2021-3435
Published: 2022-06-28
Description: Information leakage in le_ecred_conn_req(). Zephyr versions >= v2.4.0 Use of Uninitialized Resource (CWE-908). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-xhg3-gvj6-4rqh
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-908, CWE-908
References: http://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-xhg3-gvj6-4rqh; http://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-xhg3-gvj6-4rqh
CVE: CVE-2022-2231
Published: 2022-06-28
Description: NULL Pointer Dereference in GitHub repository vim/vim prior to 8.2.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/vim/vim/commit/79481367a457951aabd9501b510fd7e3eb29c3d8; https://huntr.dev/bounties/8dae6ab4-7a7a-4716-a65c-9b090fa057b5; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GFD2A4YLBR7OIRHTL7CK6YNMEIQ264CN/