deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-4375
Published: 2022-12-09
Description: A vulnerability was found in Mingsoft MCMS up to 5.2.9. It has been classified as critical. Affected is an unknown function of the file /cms/category/list. The manipulation of the argument sqlWhere leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 5.2.10 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-215196.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-707, CWE-89
References: https://gitee.com/mingSoft/MCMS/issues/I61TG5; https://vuldb.com/?id.215196; https://gitee.com/mingSoft/MCMS/issues/I61TG5
CVE: CVE-2022-4377
Published: 2022-12-09
Description: A vulnerability was found in S-CMS 5.0 Build 20220328. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the component Contact Information Page. The manipulation of the argument Make a Call leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-215197 was assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-707, CWE-79
References: https://github.com/mengdeyin/main/blob/main/README.md; https://vuldb.com/?id.215197; https://github.com/mengdeyin/main/blob/main/README.md
CVE: CVE-2022-2752
Published: 2022-12-09
Description: A vulnerability in the web server of Secomea GateManager allows a local user to impersonate as the previous user under some failed login conditions.

This issue affects:

Secomea GateManager versions from 9.4 through 9.7.



CVSS Score: 5.5 (MEDIUM)
CWE: CWE-287, CWE-287
References: https://www.secomea.com/support/cybersecurity-advisory; https://www.secomea.com/support/cybersecurity-advisory
CVE: CVE-2022-44213
Published: 2022-12-09
Description: ZKTeco Xiamen Information Technology ZKBio ECO ADMS <=3.1-164 is vulnerable to Cross Site Scripting (XSS).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://the-it-wonders.blogspot.com/2022/09/zkt-eco-adms-stored-xss.html; https://the-it-wonders.blogspot.com/2022/09/zkt-eco-adms-stored-xss.html
CVE: CVE-2022-4264
Published: 2022-12-09
Description: Incorrect Privilege Assignment in M-Files Web (Classic) in M-Files before 22.8.11691.0 allows low privilege user to change some configuration.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-269, CWE-269
References: https://empower.m-files.com/security-advisories/CVE-2022-4264; https://product.m-files.com/security-advisories/cve-2022-4264/; https://www.m-files.com/about/trust-center/security-advisories/cve-2022-4264/
CVE: CVE-2022-44838
Published: 2022-12-09
Description: Automotive Shop Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /services/view_service.php.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/GkaMei/bug_report/blob/main/vendors/oretnom23/automotive-shop-management-system/SQLi-1.md; https://github.com/GkaMei/bug_report/blob/main/vendors/oretnom23/automotive-shop-management-system/SQLi-1.md
CVE: CVE-2022-23468
Published: 2022-12-09
Description: xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP).
xrdp < v0.9.21 contain a buffer over flow in xrdp_login_wnd_create() function. There are no known workarounds for this issue. Users are advised to upgrade.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-120, CWE-120
References: https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-8c2f-mw8m-qpx6; https://www.debian.org/security/2023/dsa-5502; https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-8c2f-mw8m-qpx6
CVE: CVE-2022-23477
Published: 2022-12-09
Description: xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP).
xrdp < v0.9.21 contain a buffer over flow in audin_send_open() function. There are no known workarounds for this issue. Users are advised to upgrade.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-120
References: https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-hqw2-jx2c-wrr2; https://www.debian.org/security/2023/dsa-5502; https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-hqw2-jx2c-wrr2
CVE: CVE-2022-23478
Published: 2022-12-09
Description: xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP).
xrdp < v0.9.21 contain a Out of Bound Write in xrdp_mm_trans_process_drdynvc_channel_open() function. There are no known workarounds for this issue. Users are advised to upgrade.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-787
References: https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-2f49-wwpm-78pj; https://www.debian.org/security/2023/dsa-5502; https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-2f49-wwpm-78pj
CVE: CVE-2022-23479
Published: 2022-12-09
Description: xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP).
xrdp < v0.9.21 contain a buffer over flow in xrdp_mm_chan_data_in() function. There are no known workarounds for this issue. Users are advised to upgrade.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-120
References: https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-pgx2-3fjj-fqqh; https://www.debian.org/security/2023/dsa-5502; https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-pgx2-3fjj-fqqh
CVE: CVE-2022-23480
Published: 2022-12-09
Description: xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP).
xrdp < v0.9.21 contain a buffer over flow in devredir_proc_client_devlist_announce_req() function. There are no known workarounds for this issue. Users are advised to upgrade.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-120, CWE-120
References: https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-3jmx-f6hv-95wg; https://www.debian.org/security/2023/dsa-5502; https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-3jmx-f6hv-95wg
CVE: CVE-2022-23481
Published: 2022-12-09
Description: xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP).
xrdp < v0.9.21 contain a Out of Bound Read in xrdp_caps_process_confirm_active() function. There are no known workarounds for this issue. Users are advised to upgrade.
CVSS Score: 0.0 (NONE)
CWE: CWE-125
References: https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-hm75-9jcg-p7hq; https://www.debian.org/security/2023/dsa-5502; https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-hm75-9jcg-p7hq
CVE: CVE-2022-23482
Published: 2022-12-09
Description: xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP).
xrdp < v0.9.21 contain a Out of Bound Read in xrdp_sec_process_mcs_data_CS_CORE() function. There are no known workarounds for this issue. Users are advised to upgrade.
CVSS Score: 0.0 (NONE)
CWE: CWE-125
References: https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-56pq-2pm9-7fhm; https://www.debian.org/security/2023/dsa-5502; https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-56pq-2pm9-7fhm
CVE: CVE-2022-23483
Published: 2022-12-09
Description: xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP).
xrdp < v0.9.21 contain a Out of Bound Read in libxrdp_send_to_channel() function. There are no known workarounds for this issue. Users are advised to upgrade.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-38rw-9ch2-fcxq; https://www.debian.org/security/2023/dsa-5502; https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-38rw-9ch2-fcxq
CVE: CVE-2022-23484
Published: 2022-12-09
Description: xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP).
xrdp < v0.9.21 contain a Integer Overflow in xrdp_mm_process_rail_update_window_text() function. There are no known workarounds for this issue. Users are advised to upgrade.
CVSS Score: 8.2 (HIGH)
CWE: CWE-190
References: https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-rqfx-5fv8-q9c6; https://www.debian.org/security/2023/dsa-5502; https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-rqfx-5fv8-q9c6
CVE: CVE-2022-23493
Published: 2022-12-09
Description: xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP).
xrdp < v0.9.21 contain a Out of Bound Read in xrdp_mm_trans_process_drdynvc_channel_close() function. There are no known workarounds for this issue. Users are advised to upgrade.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-125
References: https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-59wp-3wq6-jh5v; https://www.debian.org/security/2023/dsa-5502; https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-59wp-3wq6-jh5v
CVE: CVE-2022-25629
Published: 2022-12-09
Description: An authenticated user who has the privilege to add/edit annotations on the Content tab, can craft a malicious annotation that can be executed on the annotations page (Annotation Text Column).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/21115; https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/21115
CVE: CVE-2022-25630
Published: 2022-12-09
Description: An authenticated user can embed malicious content with XSS into the admin group policy page.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://packetstormsecurity.com/files/171781/Symantec-Messaging-Gateway-10.7.4-Cross-Site-Scripting.html; https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/21117; http://packetstormsecurity.com/files/171781/Symantec-Messaging-Gateway-10.7.4-Cross-Site-Scripting.html
CVE: CVE-2022-29838
Published: 2022-12-09
Description: Improper Authentication vulnerability in the encrypted volumes and auto mount features of Western Digital My Cloud devices allows insecure direct access to the drive information in the case of a device reset. This issue affects: Western Digital My Cloud My Cloud versions prior to 5.25.124 on Linux.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-287, CWE-287
References: https://www.westerndigital.com/support/product-security/wdc-22019-my-cloud-firmware-version-5-25-124; https://www.westerndigital.com/support/product-security/wdc-22019-my-cloud-firmware-version-5-25-124
CVE: CVE-2022-29839
Published: 2022-12-09
Description: Insufficiently Protected Credentials vulnerability in the remote backups application on Western Digital My Cloud devices that could allow an attacker who has gained access to a relevant endpoint to use that information to access protected data. This issue affects: Western Digital My Cloud My Cloud versions prior to 5.25.124 on Linux.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-522, CWE-522
References: https://www.westerndigital.com/support/product-security/wdc-22019-my-cloud-firmware-version-5-25-124; https://www.westerndigital.com/support/product-security/wdc-22019-my-cloud-firmware-version-5-25-124
CVE: CVE-2022-3259
Published: 2022-12-09
Description: Openshift 4.9 does not use HTTP Strict Transport Security (HSTS) which may allow man-in-the-middle (MITM) attacks.
CVSS Score: 7.4 (HIGH)
CWE: CWE-665
References: https://bugzilla.redhat.com/show_bug.cgi?id=2103220; https://bugzilla.redhat.com/show_bug.cgi?id=2103220
CVE: CVE-2022-3724
Published: 2022-12-09
Description: Crash in the USB HID protocol dissector in Wireshark 3.6.0 to 3.6.8 allows denial of service via packet injection or crafted capture file on Windows
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-134, CWE-134
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3724.json; https://gitlab.com/wireshark/wireshark/-/issues/18384; https://www.wireshark.org/security/wnpa-sec-2022-08.html
CVE: CVE-2022-4170
Published: 2022-12-09
Description: The rxvt-unicode package is vulnerable to a remote code execution, in the Perl background extension, when an attacker can control the data written to the user's terminal and certain options are set.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-74
References: https://bugzilla.redhat.com/show_bug.cgi?id=2151597; https://security.gentoo.org/glsa/202310-20; https://www.openwall.com/lists/oss-security/2022/12/05/1
CVE: CVE-2022-4336
Published: 2022-12-09
Description: In BAOTA linux panel there exists a stored xss vulnerability attackers can use to obtain sensitive information via the log analysis feature.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://mlux.cc/index.php/archives/100/; https://mlux.cc/index.php/archives/100/
CVE: CVE-2022-41299
Published: 2022-12-09
Description: IBM Cloud Transformation Advisor 2.0.1 through 3.3.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.  IBM X-Force ID:  237214.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/237214; https://www.ibm.com/support/pages/node/6846257; https://exchange.xforce.ibmcloud.com/vulnerabilities/237214
CVE: CVE-2022-45290
Published: 2022-12-09
Description: Kbase Doc v1.0 was discovered to contain an arbitrary file deletion vulnerability via the component /web/IndexController.java.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-22, CWE-22
References: https://github.com/HH1F/KbaseDoc-v1.0-Arbitrary-file-deletion-vulnerability/blob/main/README.md; https://github.com/HH1F/KbaseDoc-v1.0-Arbitrary-file-deletion-vulnerability/blob/main/README.md
CVE: CVE-2022-2993
Published: 2022-12-09
Description: There is an error in the condition of the last if-statement in the function smp_check_keys. It was rejecting current keys if all requirements were unmet.
CVSS Score: 8.6 (HIGH)
CWE: CWE-670
References: https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-3286-jgjx-8cvr; https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-3286-jgjx-8cvr
CVE: CVE-2022-4390
Published: 2022-12-09
Description: A network misconfiguration is present in versions prior to 1.0.9.90 of the NETGEAR RAX30 AX2400 series of routers. IPv6 is enabled for the WAN interface by default on these devices. While there are firewall restrictions in place that define access restrictions for IPv4 traffic, these restrictions do not appear to be applied to the WAN interface for IPv6. This allows arbitrary access to any services running on the device that may be inadvertently listening via IPv6, such as the SSH and Telnet servers spawned on ports 22 and 23 by default. This misconfiguration could allow an attacker to interact with services only intended to be accessible by clients on the local network.
CVSS Score: 10.0 (CRITICAL)
References: https://www.synacktiv.com/en/publications/cool-vulns-dont-live-long-netgear-and-pwn2own.html; https://www.tenable.com/security/research/tra-2022-36%2C; https://www.synacktiv.com/en/publications/cool-vulns-dont-live-long-netgear-and-pwn2own.html
CVE: CVE-2022-44790
Published: 2022-12-09
Description: Interspire Email Marketer through 6.5.1 allows SQL Injection via the surveys module. An unauthenticated attacker could successfully perform an attack to extract potentially sensitive information from the database if the survey id exists.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89, CWE-89
References: https://www.interspire.com/security-bulletin-2022-44790/; https://www.interspire.com/security-bulletin-2022-44790/
CVE: CVE-2022-46157
Published: 2022-12-09
Description: Akeneo PIM is an open source Product Information Management (PIM). Akeneo PIM Community Edition versions before v5.0.119 and v6.0.53 allows remote authenticated users to execute arbitrary PHP code on the server by uploading a crafted image. Akeneo PIM Community Edition after the versions aforementioned provides patched Apache HTTP server configuration file, for docker setup and in documentation sample, to fix this vulnerability.   Community Edition users must change their Apache HTTP server configuration accordingly to be protected. The patch for Cloud Based Akeneo PIM Services customers has been applied since 30th October 2022. Users are advised to upgrade. Users unable to upgrade may  Replace any reference to `<FilesMatch \.php$>` in their apache httpd configurations with: `<Location "/index.php">`.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: https://github.com/akeneo/pim-community-dev/blob/b4d79bb073c8b68ea26ab227c97cc78d86c4cba1/docker/httpd.conf#L39; https://github.com/akeneo/pim-community-dev/security/advisories/GHSA-w9wc-4xcq-8gr6; https://github.com/akeneo/pim-community-dev/blob/b4d79bb073c8b68ea26ab227c97cc78d86c4cba1/docker/httpd.conf#L39
CVE: CVE-2022-46166
Published: 2022-12-09
Description: Spring boot admins is an open source administrative user interface for management of spring boot applications. All users who run Spring Boot Admin Server, having enabled Notifiers (e.g. Teams-Notifier) and write access to environment variables via UI are affected. Users are advised to upgrade to the most recent releases of Spring Boot Admin 2.6.10 and 2.7.8 to resolve this issue. Users unable to upgrade may disable any notifier or disable write access (POST request) on `/env` actuator endpoint.


CVSS Score: 8.0 (HIGH)
CWE: CWE-94
References: https://github.com/codecentric/spring-boot-admin/commit/c14c3ec12533f71f84de9ce3ce5ceb7991975f75; https://github.com/codecentric/spring-boot-admin/security/advisories/GHSA-w3x5-427h-wfq6; https://github.com/codecentric/spring-boot-admin/commit/c14c3ec12533f71f84de9ce3ce5ceb7991975f75
CVE: CVE-2022-34297
Published: 2022-12-09
Description: Yii Yii2 Gii through 2.2.4 allows stored XSS by injecting a payload into any field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://gist.github.com/be4r/b5c48d97ef6726d3ee37f995ee5aac81; https://gist.github.com/be4r/b5c48d97ef6726d3ee37f995ee5aac81; https://github.com/yiisoft/yii2-gii
CVE: CVE-2022-45292
Published: 2022-12-09
Description: User invites for Funkwhale v1.2.8 do not permanently expire after being used for signup and can be used again after an account has been deleted.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-672, CWE-672
References: https://dev.funkwhale.audio/funkwhale/funkwhale/-/issues/1952; https://dev.funkwhale.audio/funkwhale/funkwhale/-/issues/1952
CVE: CVE-2022-23497
Published: 2022-12-09
Description: FreshRSS is a free, self-hostable RSS aggregator. User configuration files can be accessed by a remote user. In addition to user preferences, such configurations contain hashed passwords (brypt with cost 9, salted) of FreshRSS Web interface. If the API is used, the configuration might contain a hashed password (brypt with cost 9, salted) of the GReader API, and a hashed password (MD5 salted) of the Fever API. Users should update to version 1.20.2 or edge. Users unable to upgrade can apply the patch manually or delete the file `./FreshRSS/p/ext.php`.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://github.com/FreshRSS/FreshRSS/pull/4928; https://github.com/FreshRSS/FreshRSS/releases/tag/1.20.2; https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-hvrj-5fwj-p7v6
CVE: CVE-2022-23510
Published: 2022-12-09
Description: cube-js is a headless business intelligence platform. In version 0.31.23 all authenticated Cube clients could bypass SQL row-level security and run arbitrary SQL via the newly introduced /v1/sql-runner endpoint. This issue has been resolved in version 0.31.24. Users are advised to either upgrade to 0.31.24 or to downgrade to 0.31.22. There are no known workarounds for this vulnerability.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-89
References: https://github.com/cube-js/cube.js/commit/3c614674fed6ca17df08bbba8c835ef110167570; https://github.com/cube-js/cube.js/commit/f1140de508e359970ac82b50bae1c4bf152f6041; https://github.com/cube-js/cube.js/security/advisories/GHSA-6jqm-3c9g-pch7
CVE: CVE-2022-23485
Published: 2022-12-10
Description: Sentry is an error tracking and performance monitoring platform. In versions of the sentry python library prior to 22.11.0 an attacker with a known valid invite link could manipulate a cookie to allow the same invite link to be reused on multiple accounts when joining an organization. As a result an attacker with a valid invite link can create multiple users and join an organization they may not have been originally invited to. This issue was patched in version 22.11.0. Sentry SaaS customers do not need to take action. Self-hosted Sentry installs on systems which can not upgrade can disable the invite functionality until they are ready to deploy the patched version by editing their `sentry.conf.py` file (usually located at `~/.sentry/`).

CVSS Score: 6.4 (MEDIUM)
CWE: CWE-269, CWE-284, CWE-269
References: https://github.com/getsentry/sentry/security/advisories/GHSA-jv85-mqxj-3f9j; https://github.com/getsentry/sentry/security/advisories/GHSA-jv85-mqxj-3f9j
CVE: CVE-2022-4396
Published: 2022-12-10
Description: A vulnerability was found in RDFlib pyrdfa3 and classified as problematic. This issue affects the function _get_option of the file pyRdfa/__init__.py. The manipulation leads to cross site scripting. The attack may be initiated remotely. The name of the patch is ffd1d62dd50d5f4190013b39cedcdfbd81f3ce3e. It is recommended to apply a patch to fix this issue. The identifier VDB-215249 was assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 3.5 (LOW)
CWE: CWE-707, CWE-79
References: https://github.com/RDFLib/pyrdfa3/commit/ffd1d62dd50d5f4190013b39cedcdfbd81f3ce3e; https://github.com/RDFLib/pyrdfa3/pull/40; https://vuldb.com/?id.215249
CVE: CVE-2022-45145
Published: 2022-12-10
Description: egg-compile.scm in CHICKEN 5.x before 5.3.1 allows arbitrary OS command execution during package installation via escape characters in a .egg file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://code.call-cc.org/cgi-bin/gitweb.cgi?p=chicken-core.git%3Ba=blobdiff%3Bf=NEWS%3Bh=54888afff[PII_REDACTED]3673c407cabfe76a5ce77%3Bhp=a3fd88a892f82c8353267f50509d018bbb1934b9%3Bhb=670478435a982fc4d1f001ea08669f53d35a51cd%3Bhpb=a08f8f548d772ef410c672ba33a27108d8d434f3; https://code.call-cc.org/cgi-bin/gitweb.cgi?p=chicken-core.git%3Ba=blobdiff%3Bf=egg-compile.scm%3Bh=9ba[PII_REDACTED]ec75204cba55e43e27925e2d6fe%3Bhp=c1f2ceb0fb470f63c2ba2a1cf9d8d40083c2359f%3Bhb=a08f8f548d772ef410c672ba33a27108d8d434f3%3Bhpb=9c6fb001c25de4390f46ffd7c3c94237f4df92a9; https://lists.gnu.org/archive/html/chicken-announce/2022-11/msg00000.html
CVE: CVE-2022-4397
Published: 2022-12-10
Description: A vulnerability was found in morontt zend-blog-number-2. It has been classified as problematic. Affected is an unknown function of the file application/forms/Comment.php of the component Comment Handler. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. The name of the patch is 36b2d4abe20a6245e4f8df7a4b14e130b24d429d. It is recommended to apply a patch to fix this issue. VDB-215250 is the identifier assigned to this vulnerability.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863, CWE-352
References: https://github.com/morontt/zend-blog-number-2/commit/36b2d4abe20a6245e4f8df7a4b14e130b24d429d; https://vuldb.com/?id.215250; https://github.com/morontt/zend-blog-number-2/commit/36b2d4abe20a6245e4f8df7a4b14e130b24d429d
CVE: CVE-2022-4398
Published: 2022-12-10
Description: Integer Overflow or Wraparound in GitHub repository radareorg/radare2 prior to 5.8.0.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190, CWE-190
References: https://github.com/radareorg/radare2/commit/b53a1583d05c3a5bfe5fa60da133fe59dfbb02b8; https://huntr.dev/bounties/c6f8d3ef-5420-4eba-9a5f-aba5e2b5fea2; https://github.com/radareorg/radare2/commit/b53a1583d05c3a5bfe5fa60da133fe59dfbb02b8