deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-27914
Published: 2022-11-08
Description: An issue was discovered in Joomla! 4.0.0 through 4.2.4. Inadequate filtering of potentially malicious user input leads to reflected XSS vulnerabilities in com_media.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://developer.joomla.org/security-centre/[PII_REDACTED]1-core-rxss-through-reflection-of-user-input-in-com-media.html; https://developer.joomla.org/security-centre/[PII_REDACTED]1-core-rxss-through-reflection-of-user-input-in-com-media.html
CVE: CVE-2022-30545
Published: 2022-11-08
Description: Auth. Reflected Cross-Site Scripting (XSS) vulnerability in 5 Anker Connect plugin <= 1.2.6 on WordPress.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/5-anker-connect/wordpress-5-anker-connect-plugin-1-2-6-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://wordpress.org/plugins/5-anker-connect/; https://patchstack.com/database/vulnerability/5-anker-connect/wordpress-5-anker-connect-plugin-1-2-6-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2022-32587
Published: 2022-11-08
Description: Cross-Site Request Forgery (CSRF) vulnerability in CodeAndMore WP Page Widget plugin <= 3.9 on WordPress leading to plugin settings change.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://patchstack.com/database/vulnerability/wp-page-widget/wordpress-wp-page-widget-plugin-3-9-cross-site-request-forgery-csrf-vulnerability; https://wordpress.org/plugins/wp-page-widget/; https://patchstack.com/database/vulnerability/wp-page-widget/wordpress-wp-page-widget-plugin-3-9-cross-site-request-forgery-csrf-vulnerability
CVE: CVE-2022-32776
Published: 2022-11-08
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Advanced Ads GmbH Advanced Ads – Ad Manager & AdSense plugin <= 1.31.1 on WordPress.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/advanced-ads/wordpress-advanced-ads-ad-manager-adsense-plugin-1-31-1-authenticated-stored-cross-site-scripting-xss-vulnerability?_s_id=cve; https://wordpress.org/plugins/advanced-ads/; https://patchstack.com/database/vulnerability/advanced-ads/wordpress-advanced-ads-ad-manager-adsense-plugin-1-31-1-authenticated-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2022-38137
Published: 2022-11-08
Description: Cross-Site Request Forgery (CSRF) vulnerability in Analytify plugin <= 4.2.2 on WordPress.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://patchstack.com/database/vulnerability/wp-analytify/wordpress-analytify-plugin-4-2-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://wordpress.org/plugins/wp-analytify/; https://patchstack.com/database/vulnerability/wp-analytify/wordpress-analytify-plugin-4-2-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2022-40128
Published: 2022-11-08
Description: Cross-Site Request Forgery (CSRF) vulnerability in Advanced Order Export For WooCommerce plugin <= 3.3.2 on WordPress leading to export file download.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://patchstack.com/database/vulnerability/woo-order-export-lite/wordpress-advanced-order-export-for-woocommerce-plugin-3-3-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://wordpress.org/plugins/woo-order-export-lite/; https://patchstack.com/database/vulnerability/woo-order-export-lite/wordpress-advanced-order-export-for-woocommerce-plugin-3-3-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2022-40205
Published: 2022-11-08
Description: Insecure direct object references (IDOR) vulnerability in the wpForo Forum plugin <= 2.0.5 on WordPress allows attackers with subscriber or higher user roles to mark any forum post as solved/unsolved.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-639, CWE-639
References: https://patchstack.com/database/vulnerability/wpforo/wordpress-wpforo-forum-plugin-2-0-5-insecure-direct-object-references-idor-vulnerability-2?_s_id=cve; https://wordpress.org/plugins/wpforo/; https://patchstack.com/database/vulnerability/wpforo/wordpress-wpforo-forum-plugin-2-0-5-insecure-direct-object-references-idor-vulnerability-2?_s_id=cve
CVE: CVE-2022-40206
Published: 2022-11-08
Description: Insecure direct object references (IDOR) vulnerability in the wpForo Forum plugin <= 2.0.5 on WordPress allows attackers with subscriber or higher user roles to mark any forum post as private/public.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-639, CWE-639
References: https://patchstack.com/database/vulnerability/wpforo/wordpress-wpforo-forum-plugin-2-0-5-insecure-direct-object-references-idor-vulnerability?_s_id=cve; https://wordpress.org/plugins/wpforo/; https://patchstack.com/database/vulnerability/wpforo/wordpress-wpforo-forum-plugin-2-0-5-insecure-direct-object-references-idor-vulnerability?_s_id=cve
CVE: CVE-2022-40223
Published: 2022-11-08
Description: Nonce token leakage and missing authorization in SearchWP premium plugin <= 4.2.5 on WordPress leading to plugin settings change.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://patchstack.com/database/vulnerability/searchwp/wordpress-searchwp-premium-plugin-4-2-5-broken-authentication-vulnerability?_s_id=cve; https://searchwp.com/documentation/changelog/; https://patchstack.com/database/vulnerability/searchwp/wordpress-searchwp-premium-plugin-4-2-5-broken-authentication-vulnerability?_s_id=cve
CVE: CVE-2022-40632
Published: 2022-11-08
Description: Cross-Site Request Forgery (CSRF) vulnerability in gVectors Team wpForo Forum plugin <= 2.0.5 on WordPress leading to topic deletion.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://patchstack.com/database/vulnerability/wpforo/wordpress-wpforo-forum-plugin-2-0-5-cross-site-request-forgery-csrf-vulnerability-2?_s_id=cve; https://wordpress.org/plugins/wpforo/; https://patchstack.com/database/vulnerability/wpforo/wordpress-wpforo-forum-plugin-2-0-5-cross-site-request-forgery-csrf-vulnerability-2?_s_id=cve
CVE: CVE-2022-41136
Published: 2022-11-08
Description: Cross-Site Request Forgery (CSRF) vulnerability leading to Stored Cross-Site Scripting (XSS) in Vladimir Anokhin's Shortcodes Ultimate plugin <= 5.12.0 on WordPress.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-352, CWE-352
References: https://patchstack.com/database/vulnerability/shortcodes-ultimate/wordpress-shortcodes-ultimate-plugin-5-12-0-csrf-vulnerability-leading-to-stored-xss?_s_id=cve; https://wordpress.org/plugins/shortcodes-ultimate/#developers; https://patchstack.com/database/vulnerability/shortcodes-ultimate/wordpress-shortcodes-ultimate-plugin-5-12-0-csrf-vulnerability-leading-to-stored-xss?_s_id=cve
CVE: CVE-2022-41980
Published: 2022-11-08
Description: Auth. (admin+) Cross-Site Scripting (XSS) vulnerability in Mantenimiento web plugin <= 0.13 on WordPress.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/mantenimiento-web/wordpress-mantenimiento-web-plugin-0-13-auth-cross-site-scripting-xss-vulnerability?_s_id=cve; https://wordpress.org/plugins/mantenimiento-web/; https://patchstack.com/database/vulnerability/mantenimiento-web/wordpress-mantenimiento-web-plugin-0-13-auth-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2022-42494
Published: 2022-11-08
Description: Server Side Request Forgery (SSRF) vulnerability in All in One SEO Pro plugin <= 4.2.5.1 on WordPress.
CVSS Score: 3.0 (LOW)
CWE: CWE-918, CWE-918
References: https://aioseo.com/changelog/; https://patchstack.com/database/vulnerability/all-in-one-seo-pack-pro/wordpress-all-in-one-seo-pro-plugin-4-2-5-1-server-side-request-forgery-ssrf-vulnerability?_s_id=cve; https://aioseo.com/changelog/
CVE: CVE-2022-43481
Published: 2022-11-08
Description: Cross-Site Request Forgery (CSRF) vulnerability in Advanced Coupons for WooCommerce Coupons plugin <= 4.5 on WordPress leading to notice dismissal.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://patchstack.com/database/vulnerability/advanced-coupons-for-woocommerce-free/wordpress-advanced-coupons-for-woocommerce-coupons-plugin-4-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://wordpress.org/plugins/advanced-coupons-for-woocommerce-free/; https://patchstack.com/database/vulnerability/advanced-coupons-for-woocommerce-free/wordpress-advanced-coupons-for-woocommerce-coupons-plugin-4-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2022-43491
Published: 2022-11-08
Description: Cross-Site Request Forgery (CSRF) vulnerability in Advanced Dynamic Pricing for WooCommerce plugin <= 4.1.5 on WordPress leading to plugin settings import.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://patchstack.com/database/vulnerability/advanced-dynamic-pricing-for-woocommerce/wordpress-advanced-dynamic-pricing-for-woocommerce-plugin-4-1-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://wordpress.org/plugins/advanced-dynamic-pricing-for-woocommerce/; https://patchstack.com/database/vulnerability/advanced-dynamic-pricing-for-woocommerce/wordpress-advanced-dynamic-pricing-for-woocommerce-plugin-4-1-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2022-44741
Published: 2022-11-08
Description: Cross-Site Request Forgery (CSRF) vulnerability leading to Cross-Site Scripting (XSS) in David Anderson Testimonial Slider plugin <= 1.3.1 on WordPress.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-352, CWE-352
References: https://patchstack.com/database/vulnerability/testimonial-slider/wordpress-testimonial-slider-plugin-1-3-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://wordpress.org/plugins/testimonial-slider/; https://patchstack.com/database/vulnerability/testimonial-slider/wordpress-testimonial-slider-plugin-1-3-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2022-33321
Published: 2022-11-08
Description: Cleartext Transmission of Sensitive Information vulnerability due to the use of Basic Authentication for HTTP connections in Mitsubishi Electric consumer electronics products (PHOTOVOLTAIC COLOR MONITOR ECO-GUIDE, HEMS adapter, Wi-Fi Interface, Air Conditioning, Induction hob, Mitsubishi Electric HEMS Energy Measurement Unit, Refrigerator, Remote control with Wi-Fi Interface, BATHROOM THERMO VENTILATOR, Rice cooker, Mitsubishi Electric HEMS control adapter, Energy Recovery Ventilator, Smart Switch, Ventilating Fan, Range hood fan, Energy Measurement Unit and Air Purifier) allows a remote unauthenticated attacker to disclose information in the products or cause a denial of service (DoS) condition as a result by sniffing credential information (username and password).
The wide range of models/versions of Mitsubishi Electric consumer electronics products are affected by this vulnerability.
As for the affected product models/versions, see the Mitsubishi Electric's advisory which is listed in [References] section.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-319, CWE-319
References: https://jvn.jp/vu/JVNVU96767562/index.html; https://www.mitsubishielectric.co.jp/psirt/vulnerability/pdf/2022-010.pdf; https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-010_en.pdf
CVE: CVE-2022-33322
Published: 2022-11-08
Description: Cross-site scripting vulnerability in Mitsubishi Electric consumer electronics products (Air Conditioning, Wi-Fi Interface, Refrigerator, HEMS adapter, Remote control with Wi-Fi Interface, BATHROOM THERMO VENTILATOR, Rice cooker, Mitsubishi Electric HEMS control adapter, Energy Recovery Ventilator, Smart Switch and Air Purifier) allows a remote unauthenticated attacker to execute an malicious script on a user's browser to disclose information, etc. The wide range of models/versions of Mitsubishi Electric consumer electronics products are affected by this vulnerability. As for the affected product models/versions, see the Mitsubishi Electric's advisory which is listed in [References] section.


CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://jvn.jp/vu/JVNVU96767562/index.html; https://www.mitsubishielectric.co.jp/psirt/vulnerability/pdf/2022-011.pdf; https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-011_en.pdf
CVE: CVE-2022-39377
Published: 2022-11-08
Description: sysstat is a set of system performance tools for the Linux operating system. On 32 bit systems, in versions 9.1.16 and newer but prior to 12.7.1, allocate_structures contains a size_t overflow in sa_common.c. The allocate_structures function insufficiently checks bounds before arithmetic multiplication, allowing for an overflow in the size allocated for the buffer representing system activities. This issue may lead to Remote Code Execution (RCE). This issue has been patched in version 12.7.1.
CVSS Score: 7.0 (HIGH)
CWE: CWE-120, CWE-131, CWE-131
References: https://github.com/sysstat/sysstat/security/advisories/GHSA-q8r6-g56f-9w7x; https://lists.debian.org/debian-lts-announce/2022/11/msg00014.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6F26ALXWYHT4LN2AHPZM34OQEXTJE3JZ/
CVE: CVE-2022-21778
Published: 2022-11-08
Description: In vpu, there is a possible information disclosure due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06382421; Issue ID: ALPS06382421.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://corp.mediatek.com/product-security-bulletin/November-2022; https://corp.mediatek.com/product-security-bulletin/November-2022
CVE: CVE-2022-26446
Published: 2022-11-08
Description: In Modem 4G RRC, there is a possible system crash due to improper input validation. This could lead to remote denial of service, when concatenating improper SIB12 (CMAS message), with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY00867883; Issue ID: ALPS07274118.
CVSS Score: 7.5 (HIGH)
CWE: CWE-617, CWE-617
References: https://corp.mediatek.com/product-security-bulletin/November-2022; https://corp.mediatek.com/product-security-bulletin/November-2022
CVE: CVE-2022-32601
Published: 2022-11-08
Description: In telephony, there is a possible permission bypass due to a parcel format mismatch. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07319132; Issue ID: ALPS07319132.
CVSS Score: 7.8 (HIGH)
CWE: CWE-502, CWE-502
References: https://corp.mediatek.com/product-security-bulletin/November-2022; https://corp.mediatek.com/product-security-bulletin/November-2022
CVE: CVE-2022-32602
Published: 2022-11-08
Description: In keyinstall, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07388790; Issue ID: ALPS07388790.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://corp.mediatek.com/product-security-bulletin/November-2022; https://corp.mediatek.com/product-security-bulletin/November-2022
CVE: CVE-2022-32603
Published: 2022-11-08
Description: In gpu drm, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07310704; Issue ID: ALPS07310704.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://corp.mediatek.com/product-security-bulletin/November-2022; https://corp.mediatek.com/product-security-bulletin/November-2022
CVE: CVE-2022-32605
Published: 2022-11-08
Description: In isp, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07213898; Issue ID: ALPS07213898.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://corp.mediatek.com/product-security-bulletin/November-2022; https://corp.mediatek.com/product-security-bulletin/November-2022
CVE: CVE-2022-32607
Published: 2022-11-08
Description: In aee, there is a possible use after free due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07202891; Issue ID: ALPS07202891.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-416, CWE-416
References: https://corp.mediatek.com/product-security-bulletin/November-2022; https://corp.mediatek.com/product-security-bulletin/November-2022
CVE: CVE-2022-32608
Published: 2022-11-08
Description: In jpeg, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07388753; Issue ID: ALPS07388753.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-367, CWE-367
References: https://corp.mediatek.com/product-security-bulletin/November-2022; https://corp.mediatek.com/product-security-bulletin/November-2022
CVE: CVE-2022-32609
Published: 2022-11-08
Description: In vcu, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07203410; Issue ID: ALPS07203410.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-662, CWE-662
References: https://corp.mediatek.com/product-security-bulletin/November-2022; https://corp.mediatek.com/product-security-bulletin/November-2022
CVE: CVE-2022-32610
Published: 2022-11-08
Description: In vcu, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07203476; Issue ID: ALPS07203476.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-662, CWE-662
References: https://corp.mediatek.com/product-security-bulletin/November-2022; https://corp.mediatek.com/product-security-bulletin/November-2022
CVE: CVE-2022-32611
Published: 2022-11-08
Description: In isp, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07340373; Issue ID: ALPS07340373.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://corp.mediatek.com/product-security-bulletin/November-2022; https://corp.mediatek.com/product-security-bulletin/November-2022
CVE: CVE-2022-32612
Published: 2022-11-08
Description: In vcu, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07203500; Issue ID: ALPS07203500.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-362, CWE-362
References: https://corp.mediatek.com/product-security-bulletin/November-2022; https://corp.mediatek.com/product-security-bulletin/November-2022
CVE: CVE-2022-32613
Published: 2022-11-08
Description: In vcu, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07206340; Issue ID: ALPS07206340.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-362, CWE-362
References: https://corp.mediatek.com/product-security-bulletin/November-2022; https://corp.mediatek.com/product-security-bulletin/November-2022
CVE: CVE-2022-32614
Published: 2022-11-08
Description: In audio, there is a possible memory corruption due to a logic error. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07310571; Issue ID: ALPS07310571.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-415, CWE-415
References: https://corp.mediatek.com/product-security-bulletin/November-2022; https://corp.mediatek.com/product-security-bulletin/November-2022
CVE: CVE-2022-32615
Published: 2022-11-08
Description: In ccd, there is a possible out of bounds write due to uninitialized data. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07326559; Issue ID: ALPS07326559.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-908, CWE-908
References: https://corp.mediatek.com/product-security-bulletin/November-2022; https://corp.mediatek.com/product-security-bulletin/November-2022
CVE: CVE-2022-32616
Published: 2022-11-08
Description: In isp, there is a possible out of bounds write due to uninitialized data. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07341258; Issue ID: ALPS07341258.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-908, CWE-908
References: https://corp.mediatek.com/product-security-bulletin/November-2022; https://corp.mediatek.com/product-security-bulletin/November-2022
CVE: CVE-2022-32617
Published: 2022-11-08
Description: In typec, there is a possible out of bounds write due to an incorrect calculation of buffer size. This could lead to local escalation of privilege, for an attacker who has physical access to the device, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07262364; Issue ID: ALPS07262364.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-131, CWE-131
References: https://corp.mediatek.com/product-security-bulletin/November-2022; https://corp.mediatek.com/product-security-bulletin/November-2022
CVE: CVE-2022-32618
Published: 2022-11-08
Description: In typec, there is a possible out of bounds write due to an incorrect calculation of buffer size. This could lead to local escalation of privilege, for an attacker who has physical access to the device, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07262454; Issue ID: ALPS07262454.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-131, CWE-131
References: https://corp.mediatek.com/product-security-bulletin/November-2022; https://corp.mediatek.com/product-security-bulletin/November-2022
CVE: CVE-2021-1050
Published: 2022-11-08
Description: In MMU_UnmapPages of the PowerVR kernel driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android SoCAndroid ID: A-243825200
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: http://packetstormsecurity.com/files/175260/PowerVR-Out-Of-Bounds-Access-Information-Leak.html; https://source.android.com/security/bulletin/2022-11-01; http://packetstormsecurity.com/files/175260/PowerVR-Out-Of-Bounds-Access-Information-Leak.html
CVE: CVE-2021-39661
Published: 2022-11-08
Description: In _PMRLogicalOffsetToPhysicalOffset of the PowerVR kernel driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android SoCAndroid ID: A-246824784
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://source.android.com/security/bulletin/2022-11-01; https://source.android.com/security/bulletin/2022-11-01
CVE: CVE-2022-20414
Published: 2022-11-08
Description: In setImpl of AlarmManagerService.java, there is a possible way to put a device into a boot loop due to an uncaught exception. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-234441463
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-755, CWE-755
References: https://source.android.com/security/bulletin/2022-11-01; https://source.android.com/security/bulletin/2022-11-01