rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-0507 Vulnerability: Authenticated SQL Injection in API
Found a potential security vulnerability inside the Pandora API. Affected Pandora FMS version range: all versions of NG version, up to OUM 759. This vulnerability could allow an attacker with authenticated IP to inject SQL.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Artica PFMS
product: Pandora FMS
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 5.8
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:L
version: 3.1
Published: 2022-03-09T15:09:18.756Z
CVE-2022-0508 Server-Side Request Forgery (SSRF) in chocobozzz/peertube
Server-Side Request Forgery (SSRF) in GitHub repository chocobozzz/peertube prior to f33e515991a32885622b217bf2ed1d1b0d9d6832
Problem types: cwe_id: CWE-918
description: CWE-918 Server-Side Request Forgery (SSRF)
Affected products: vendor: chocobozzz
product: chocobozzz/peertube
Published: 2022-02-08T10:30:46.000Z
CVE-2022-0509 Cross-site Scripting (XSS) - Stored in pimcore/pimcore
Cross-site Scripting (XSS) - Stored in Packagist pimcore/pimcore prior to 10.3.1.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: pimcore
product: pimcore/pimcore
Published: 2022-02-08T11:30:11.000Z
CVE-2022-0510 Cross-site Scripting (XSS) - Reflected in pimcore/pimcore
Cross-site Scripting (XSS) - Reflected in Packagist pimcore/pimcore prior to 10.3.1.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: pimcore
product: pimcore/pimcore
Published: 2022-02-08T14:20:10.000Z
CVE-2022-0511 
Mozilla developers and community members Gabriele Svelto, Sebastian Hengst, Randell Jesup, Luan Herrera, Lars T Hansen, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 96. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 97.
Problem types: description: Memory safety bugs fixed in Firefox 97
Affected products: vendor: Mozilla
product: Firefox
Published: 2022-12-22T00:00:00.000Z
CVE-2022-0512 Authorization Bypass Through User-Controlled Key in unshiftio/url-parse
Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.6.
Problem types: cwe_id: CWE-639
description: CWE-639 Authorization Bypass Through User-Controlled Key
Affected products: vendor: unshiftio
product: unshiftio/url-parse
Published: 2022-02-14T00:00:00.000Z
CVE-2022-0513 WP Statistics <= 13.1.4 Unauthenticated Blind SQL Injection via exclusion_reason
The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the exclusion_reason parameter found in the ~/includes/class-wp-statistics-exclusion.php file which allows attackers without authentication to inject arbitrary SQL queries to obtain sensitive information, in versions up to and including 13.1.4. This requires the "Record Exclusions" option to be enabled on the vulnerable site.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: VeronaLabs
product: WP Statistics
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Cyku Hong from DEVCORE
Published: 2022-02-16T16:38:03.000Z
CVE-2022-0514 Business Logic Errors in crater-invoice/crater
Business Logic Errors in GitHub repository crater-invoice/crater prior to 6.0.5.
Problem types: cwe_id: CWE-840
description: CWE-840 Business Logic Errors
Affected products: vendor: crater-invoice
product: crater-invoice/crater
Published: 2022-03-21T18:50:16.000Z
CVE-2022-0515 Cross-Site Request Forgery (CSRF) in crater-invoice/crater
Cross-Site Request Forgery (CSRF) in GitHub repository crater-invoice/crater prior to 6.0.4.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: crater-invoice
product: crater-invoice/crater
Published: 2022-03-21T18:50:22.000Z
CVE-2022-0516 
A vulnerability was found in kvm_s390_guest_sida_op in the arch/s390/kvm/kvm-s390.c function in KVM for s390 in the Linux kernel. This flaw allows a local attacker with a normal user privilege to obtain unauthorized memory write access. This flaw affects Linux kernel versions prior to 5.17-rc4.
Problem types: cwe_id: CWE-200
description: CWE-200
Affected products: vendor: n/a
product: kernel
Published: 2022-03-08T14:06:13.000Z
CVE-2022-0517 
Mozilla VPN can load an OpenSSL configuration file from an unsecured directory. A user or attacker with limited privileges could leverage this to launch arbitrary code with SYSTEM privilege. This vulnerability affects Mozilla VPN < 2.7.1.
Problem types: description: Local privilege escalation vis uncontrolled OpenSSL search path
Affected products: vendor: Mozilla
product: Mozilla VPN
Published: 2022-12-22T00:00:00.000Z
CVE-2022-0518 Heap-based Buffer Overflow in radareorg/radare2
Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.6.2.
Problem types: cwe_id: CWE-122
description: CWE-122 Heap-based Buffer Overflow
Affected products: vendor: radareorg
product: radareorg/radare2
Published: 2022-02-08T20:20:11.000Z
CVE-2022-0519 Buffer Access with Incorrect Length Value in radareorg/radare2
Buffer Access with Incorrect Length Value in GitHub repository radareorg/radare2 prior to 5.6.2.
Problem types: cwe_id: CWE-805
description: CWE-805 Buffer Access with Incorrect Length Value
Affected products: vendor: radareorg
product: radareorg/radare2
Published: 2022-02-08T20:25:11.000Z
CVE-2022-0520 Use After Free in radareorg/radare2
Use After Free in NPM radare2.js prior to 5.6.2.
Problem types: cwe_id: CWE-416
description: CWE-416 Use After Free
Affected products: vendor: radareorg
product: radareorg/radare2
Published: 2022-02-08T20:40:15.000Z
CVE-2022-0521 Access of Memory Location After End of Buffer in radareorg/radare2
Access of Memory Location After End of Buffer in GitHub repository radareorg/radare2 prior to 5.6.2.
Problem types: cwe_id: CWE-788
description: CWE-788 Access of Memory Location After End of Buffer
Affected products: vendor: radareorg
product: radareorg/radare2
Published: 2022-02-08T20:50:10.000Z
CVE-2022-0522 Access of Memory Location Before Start of Buffer in radareorg/radare2
Access of Memory Location Before Start of Buffer in NPM radare2.js prior to 5.6.2.
Problem types: cwe_id: CWE-786
description: CWE-786 Access of Memory Location Before Start of Buffer
Affected products: vendor: radareorg
product: radareorg/radare2
Published: 2022-02-08T20:55:10.000Z
CVE-2022-0523 Use After Free in radareorg/radare2
Use After Free in GitHub repository radareorg/radare2 prior to 5.6.2.
Problem types: cwe_id: CWE-416
description: CWE-416 Use After Free
Affected products: vendor: radareorg
product: radareorg/radare2
Published: 2022-02-08T00:00:00.000Z
CVE-2022-0524 Business Logic Errors in publify/publify
Business Logic Errors in GitHub repository publify/publify prior to 9.2.7.
Problem types: cwe_id: CWE-840
description: CWE-840 Business Logic Errors
Affected products: vendor: publify
product: publify/publify
Published: 2022-02-08T22:00:17.000Z
CVE-2022-0525 Out-of-bounds Read in mruby/mruby
Out-of-bounds Read in Homebrew mruby prior to 3.2.
Problem types: cwe_id: CWE-125
description: CWE-125 Out-of-bounds Read
Affected products: vendor: mruby
product: mruby/mruby
Published: 2022-02-09T03:45:10.000Z
CVE-2022-0526 Cross-site Scripting (XSS) - Stored in chatwoot/chatwoot
Cross-site Scripting (XSS) - Stored in GitHub repository chatwoot/chatwoot prior to 2.2.0.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: chatwoot
product: chatwoot/chatwoot
Published: 2022-02-09T04:15:10.000Z
CVE-2022-0527 Cross-site Scripting (XSS) - Stored in chatwoot/chatwoot
Cross-site Scripting (XSS) - Stored in GitHub repository chatwoot/chatwoot prior to 2.2.0.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: chatwoot
product: chatwoot/chatwoot
Published: 2022-02-09T04:20:11.000Z
CVE-2022-0528 Server-Side Request Forgery (SSRF) in transloadit/uppy
Server-Side Request Forgery (SSRF) in GitHub repository transloadit/uppy prior to 3.3.1.
Problem types: cwe_id: CWE-918
description: CWE-918 Server-Side Request Forgery (SSRF)
Affected products: vendor: transloadit
product: transloadit/uppy
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
version: 3.1
Published: 2022-03-03T07:00:11.000Z
CVE-2022-0529 
A flaw was found in Unzip. The vulnerability occurs during the conversion of a wide string to a local string that leads to a heap of out-of-bound write. This flaw allows an attacker to input a specially crafted zip file, leading to a crash or code execution.
Problem types: description: SEGV
Affected products: vendor: n/a
product: unzip
Published: 2022-02-09T22:05:51.000Z
CVE-2022-0530 
A flaw was found in Unzip. The vulnerability occurs during the conversion of a wide string to a local string that leads to a heap of out-of-bound write. This flaw allows an attacker to input a specially crafted zip file, leading to a crash or code execution.
Problem types: description: SEGV
Affected products: vendor: n/a
product: unzip
Published: 2022-02-09T22:05:50.000Z
CVE-2022-0531 WPvivid Backup and Migration Plugin < 0.9.70 - Reflected Cross-Site Scripting
The Migration, Backup, Staging WordPress plugin before 0.9.70 does not sanitise and escape the sub_page parameter before outputting it back in the page, leading to a reflected Cross-Site Scripting
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Migration, Backup, Staging – WPvivid
Credits: lang: en
value: Krzysztof Zając
Published: 2022-04-11T14:40:47.000Z
CVE-2022-0532 
An incorrect sysctls validation vulnerability was found in CRI-O 1.18 and earlier. The sysctls from the list of "safe" sysctls specified for the cluster will be applied to the host if an attacker is able to create a pod with a hostIPC and hostNetwork kernel namespace.
Problem types: cwe_id: CWE-732
description: CWE-732
Affected products: vendor: n/a
product: cri-o
Published: 2022-02-09T22:05:13.000Z
CVE-2022-0533 Ditty (formerly Ditty News Ticker) < 3.0.15 - Reflected Cross-Site Scripting (XSS)
The Ditty (formerly Ditty News Ticker) WordPress plugin before 3.0.15 is affected by a Reflected Cross-Site Scripting (XSS) vulnerability.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Ditty (formerly Ditty News Ticker)
Credits: lang: en
value: Krzysztof Zając
Published: 2022-03-07T08:16:49.000Z
CVE-2022-0534 
A vulnerability was found in htmldoc version 1.9.15 where the stack out-of-bounds read takes place in gif_get_code() and occurs when opening a malicious GIF file, which can result in a crash (segmentation fault).
Problem types: cwe_id: CWE-125
description: CWE-125
Affected products: vendor: n/a
product: htmldoc
Published: 2022-02-09T22:03:41.000Z
CVE-2022-0535 E2Pdf < 1.16.45 - Admin+ Stored Cross-Site Scripting (XSS)
The E2Pdf WordPress plugin before 1.16.45 does not sanitise and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: E2Pdf – Export To Pdf Tool for WordPress
Credits: lang: en
value: Mika
Published: 2022-03-07T08:16:51.000Z
CVE-2022-0536 Improper Removal of Sensitive Information Before Storage or Transfer in follow-redirects/follow-redirects
Improper Removal of Sensitive Information Before Storage or Transfer in NPM follow-redirects prior to 1.14.8.
Problem types: cwe_id: CWE-212
description: CWE-212 Improper Removal of Sensitive Information Before Storage or Transfer
Affected products: vendor: follow-redirects
product: follow-redirects/follow-redirects
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: ADJACENT_NETWORK
availabilityImpact: NONE
baseScore: 2.6
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Published: 2022-02-09T10:45:10.000Z
CVE-2022-0537 MapPress Maps for WordPress < 2.73.13 - Admin+ File Upload to Remote Code Execution
The MapPress Maps for WordPress plugin before 2.73.13 allows a high privileged user to bypass the DISALLOW_FILE_EDIT and DISALLOW_FILE_MODS settings and upload arbitrary files to the site through the "ajax_save" function. The file is written relative to the current 's stylesheet directory, and a .php file extension is added. No validation is performed on the content of the file, triggering an RCE vulnerability by uploading a web shell. Further the name parameter is not sanitized, allowing the payload to be uploaded to any directory to which the server has write access.
Problem types: cwe_id: CWE-434
description: CWE-434 Unrestricted Upload of File with Dangerous Type
Affected products: vendor: Unknown
product: MapPress Maps for WordPress
Credits: lang: en
value: qerogram
Published: 2022-04-04T15:35:46.000Z
CVE-2022-0538 
Jenkins 2.333 and earlier, LTS 2.319.2 and earlier defines custom XStream converters that have not been updated to apply the protections for the vulnerability CVE-2021-43859 and allow unconstrained resource usage.
Affected products: vendor: Jenkins project
product: Jenkins
Published: 2022-02-09T13:30:15.000Z
CVE-2022-0539 Cross-site Scripting (XSS) - Stored in ptrofimov/beanstalk_console
Cross-site Scripting (XSS) - Stored in Packagist ptrofimov/beanstalk_console prior to 1.7.14.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: ptrofimov
product: ptrofimov/beanstalk_console
Published: 2022-02-09T14:05:11.000Z
CVE-2022-0540 
A vulnerability in Jira Seraph allows a remote, unauthenticated attacker to bypass authentication by sending a specially crafted HTTP request. This affects Atlassian Jira Server and Data Center versions before 8.13.18, versions 8.14.0 and later before 8.20.6, and versions 8.21.0 and later before 8.22.0. This also affects Atlassian Jira Service Management Server and Data Center versions before 4.13.18, versions 4.14.0 and later before 4.20.6, and versions 4.21.0 and later before 4.22.0.
Problem types: description: Improper Authentication
Affected products: vendor: Atlassian
product: Jira Core Server
vendor: Atlassian
product: Jira Software Server
vendor: Atlassian
product: Jira Software Data Center
vendor: Atlassian
product: Jira Service Management Server
vendor: Atlassian
product: Jira Service Management Data Center
Published: 2022-04-20T18:30:17.641Z
CVE-2022-0541 Flo Launch < 2.4.1 - Missing Authentication Allow Full Site Takeover
The flo-launch WordPress plugin before 2.4.1 injects code into wp-config.php when creating a cloned site, allowing any attacker to initiate a new site install by setting the flo_custom_table_prefix cookie to an arbitrary value.
Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Control
Affected products: vendor: Unknown
product: flo-launch
Credits: lang: en
value: Daniel Ruf
Published: 2022-04-25T15:50:59.000Z
CVE-2022-0542 Cross-site Scripting (XSS) - DOM in chatwoot/chatwoot
Cross-site Scripting (XSS) - DOM in GitHub repository chatwoot/chatwoot prior to 2.7.0.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: chatwoot
product: chatwoot/chatwoot
Published: 2022-08-19T17:55:09.000Z
CVE-2022-0543 
It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific) Lua sandbox escape, which could result in remote code execution.
Problem types: description: Lua sandbox escape
Affected products: vendor: Debian
product: redis
Published: 2022-02-18T19:25:16.932Z
CVE-2022-0544 
An integer underflow in the DDS loader of Blender leads to an out-of-bounds read, possibly allowing an attacker to read sensitive data using a crafted DDS image file. This flaw affects Blender versions prior to 2.83.19, 2.93.8 and 3.1.
Problem types: cwe_id: CWE-191
description: CWE-191->CWE-125
Affected products: vendor: n/a
product: Blender
Published: 2022-02-24T18:27:15.000Z
CVE-2022-0545 
An integer overflow in the processing of loaded 2D images leads to a write-what-where vulnerability and an out-of-bounds read vulnerability, allowing an attacker to leak sensitive information or achieve code execution in the context of the Blender process when a specially crafted image file is loaded. This flaw affects Blender versions prior to 2.83.19, 2.93.8 and 3.1.
Problem types: cwe_id: CWE-190
description: CWE-190->CWE-787
Affected products: vendor: n/a
product: Blender
Published: 2022-02-24T18:27:16.000Z
CVE-2022-0546 
A missing bounds check in the image loader used in Blender 3.x and 2.93.8 leads to out-of-bounds heap access, allowing an attacker to cause denial of service, memory corruption or potentially code execution.
Problem types: cwe_id: CWE-190
description: CWE-190->CWE-787
Affected products: vendor: n/a
product: Blender
Published: 2022-02-24T18:27:17.000Z
CVE-2022-0547 
OpenVPN 2.1 until v2.4.12 and v2.5.6 may enable authentication bypass in external authentication plug-ins when more than one of them makes use of deferred authentication replies, which allows an external user to be granted access with only partially correct credentials.
Problem types: cwe_id: CWE-305
description: CWE-305 - Authentication Bypass by Primary Weakness
Affected products: vendor: n/a
product: OpenVPN
Published: 2022-03-18T18:00:20.000Z
CVE-2022-0549 
An issue has been discovered in GitLab CE/EE affecting all versions before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. Under certain conditions, GitLab REST API may allow unprivileged users to add other users to groups even if that is not possible to do through the Web UI.
Problem types: description: Improper access control in GitLab
Affected products: vendor: GitLab
product: GitLab
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
version: 3.1
Credits: lang: en
value: This vulnerability was reported to us by a customer.
Published: 2022-03-28T18:53:00.000Z
CVE-2022-0550 Authenticated RCE on logo report upload in Guardian/CMC before 22.0.0
Improper Input Validation vulnerability in custom report logo upload in Nozomi Networks Guardian, and CMC allows an authenticated attacker with admin or report manager roles to execute unattended commands on the appliance using web server user privileges. This issue affects: Nozomi Networks Guardian versions prior to 22.0.0. Nozomi Networks CMC versions prior to 22.0.0.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Nozomi Networks
product: Guardian
default_status: unaffected
vendor: Nozomi Networks
product: CMC
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: SECURA B.V. found this bug during a scheduled VAPT testing session.
Published: 2022-03-24T14:15:20.000Z
CVE-2022-0551 Authenticated RCE on project configuration import in Guardian/CMC before 22.0.0
Improper Input Validation vulnerability in project file upload in Nozomi Networks Guardian and CMC allows an authenticated attacker with admin or import manager roles to execute unattended commands on the appliance using web server user privileges. This issue affects: Nozomi Networks Guardian versions prior to 22.0.0. Nozomi Networks CMC versions prior to 22.0.0.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Nozomi Networks
product: Guardian
default_status: unaffected
vendor: Nozomi Networks
product: CMC
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: SECURA B.V. found this bug during a scheduled VAPT testing session.
Published: 2022-03-24T14:15:22.000Z
CVE-2022-0552 
A flaw was found in the original fix for the netty-codec-http CVE-2021-21409, where the OpenShift Logging openshift-logging/elasticsearch6-rhel8 container was incomplete. The vulnerable netty-codec-http maven package was not removed from the image content. This flaw affects origin-aggregated-logging versions 3.11.
Problem types: cwe_id: CWE-444
description: CWE-444
Affected products: vendor: n/a
product: origin-aggregated-logging/elasticsearch
Published: 2022-04-11T19:38:32.000Z
CVE-2022-0553 Possible to retrieve uncrypted firmware image
There is no check to see if slot 0 is being uploaded from the device to the host. When using encrypted images this means the unencrypted firmware can be retrieved easily.
Problem types: cwe_id: CWE-200
description: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Affected products: vendor: zephyrproject-rtos
product: zephyr
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector: ADJACENT_NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
Published: 2023-01-11T00:00:00.000Z
CVE-2022-0554 Use of Out-of-range Pointer Offset in vim/vim
Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.
Problem types: cwe_id: CWE-823
description: CWE-823 Use of Out-of-range Pointer Offset
Affected products: vendor: vim
product: vim/vim
Published: 2022-02-10T00:00:00.000Z
CVE-2022-0555 
Subiquity Shows Guided Storage Passphrase in Plaintext with Read-all Permissions
Affected products: vendor: Canonical Ltd.
product: subiquity
Published: 2024-06-03T18:17:35.956Z