rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-3029 Fatal error on incorrect base64 data in RRDP
In NLnet Labs Routinator 0.9.0 up to and including 0.11.2, due to a mistake in error handling, data in RRDP snapshot and delta files that isn’t correctly base 64 encoded is treated as a fatal error and causes Routinator to exit. Worst case impact of this vulnerability is denial of service for the RPKI data that Routinator provides to routers. This may stop your network from validating route origins based on RPKI data. This vulnerability does not allow an attacker to manipulate RPKI data.
Problem types: cwe_id: CWE-241
description: CWE-241: Improper Handling of Unexpected Data Type
Affected products: vendor: NLnet Labs
product: Routinator
Credits: lang: en
value: We would like to thank Donika Mirdita and Haya Shulman from Fraunhofer SIT and ATHENE for discovering and reporting the issue.
Published: 2022-09-13T15:17:57.226Z
CVE-2022-3030 
An improper access control issue in GitLab CE/EE affecting all versions starting before 15.1.6, all versions from 15.2 before 15.2.4, all versions from 15.3 before 15.3.2 allows disclosure of pipeline status to unauthorized users.
Problem types: description: Improper access control in GitLab
Affected products: vendor: GitLab
product: GitLab
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
Credits: lang: en
value: Thanks [rpadovani](https://hackerone.com/rpadovani) for reporting this vulnerability through our HackerOne bug bounty program
Published: 2022-10-17T00:00:00.000Z
CVE-2022-3031 
An issue has been discovered in GitLab CE/EE affecting all versions before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions starting from 15.3 before 15.3.2. It may be possible for an attacker to guess a user's password by brute force by sending crafted requests to a specific endpoint, even if the victim user has 2FA enabled on their account.
Problem types: description: Improper access control in GitLab
Affected products: vendor: GitLab
product: GitLab
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
baseScore: 3.7
baseSeverity: LOW
Credits: lang: en
value: This vulnerability was reported to us by a customer.
Published: 2022-10-17T00:00:00.000Z
CVE-2022-3032 
When receiving an HTML email that contained an <code>iframe</code> element, which used a <code>srcdoc</code> attribute to define the inner HTML document, remote objects specified in the nested document, for example images or videos, were not blocked. Rather, the network was accessed, the objects were loaded and displayed. This vulnerability affects Thunderbird < 102.2.1 and Thunderbird < 91.13.1.
Problem types: description: Remote content specified in an HTML document that was nested inside an iframe's srcdoc attribute was not blocked
Affected products: vendor: Mozilla
product: Thunderbird
Published: 2022-12-22T00:00:00.000Z
CVE-2022-3033 
If a Thunderbird user replied to a crafted HTML email containing a <code>meta</code> tag, with the <code>meta</code> tag having the <code>http-equiv="refresh"</code> attribute, and the content attribute specifying an URL, then Thunderbird started a network request to that URL, regardless of the configuration to block remote content. In combination with certain other HTML elements and attributes in the email, it was possible to execute JavaScript code included in the message in the context of the message compose document. The JavaScript code was able to perform actions including, but probably not limited to, read and modify the contents of the message compose document, including the quoted original message, which could potentially contain the decrypted plaintext of encrypted data in the crafted email. The contents could then be transmitted to the network, either to the URL specified in the META refresh tag, or to a different URL, as the JavaScript code could modify the URL specified in the document. This bug doesn't affect users who have changed the default Message Body display setting to 'simple html' or 'plain text'. This vulnerability affects Thunderbird < 102.2.1 and Thunderbird < 91.13.1.
Problem types: description: Leaking of sensitive information when composing a response to an HTML email with a META refresh tag
Affected products: vendor: Mozilla
product: Thunderbird
Published: 2022-12-22T00:00:00.000Z
CVE-2022-3034 
When receiving an HTML email that specified to load an <code>iframe</code> element from a remote location, a request to the remote document was sent. However, Thunderbird didn't display the document. This vulnerability affects Thunderbird < 102.2.1 and Thunderbird < 91.13.1.
Problem types: description: An iframe element in an HTML email could trigger a network request
Affected products: vendor: Mozilla
product: Thunderbird
Published: 2022-12-22T00:00:00.000Z
CVE-2022-3035 Cross-site Scripting (XSS) - Stored in snipe/snipe-it
Cross-site Scripting (XSS) - Stored in GitHub repository snipe/snipe-it prior to v6.0.11.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: snipe
product: snipe/snipe-it
Published: 2022-08-29T19:35:09.000Z
CVE-2022-3036 Gettext override translations < 2.0.0 - Admin+ Stored Cross-Site Scripting
The Gettext override translations WordPress plugin before 2.0.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Gettext override translations
Credits: lang: en
value: Su Xue Ming
Published: 2022-09-19T14:01:06.000Z
CVE-2022-3037 Use After Free in vim/vim
Use After Free in GitHub repository vim/vim prior to 9.0.0322.
Problem types: cwe_id: CWE-416
description: CWE-416 Use After Free
Affected products: vendor: vim
product: vim/vim
Published: 2022-08-30T20:35:10.000Z
CVE-2022-3038 
Use after free in Network Service in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2022-09-26T15:01:19.000Z
CVE-2022-3039 
Use after free in WebSQL in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2022-09-26T15:01:20.000Z
CVE-2022-3040 
Use after free in Layout in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2022-09-26T15:01:20.000Z
CVE-2022-3041 
Use after free in WebSQL in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2022-09-26T15:01:21.000Z
CVE-2022-3042 
Use after free in PhoneHub in Google Chrome on Chrome OS prior to 105.0.5195.52 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2022-09-26T15:01:22.000Z
CVE-2022-3043 
Heap buffer overflow in Screen Capture in Google Chrome on Chrome OS prior to 105.0.5195.52 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Heap buffer overflow
Affected products: vendor: Google
product: Chrome
Published: 2022-09-26T15:01:23.000Z
CVE-2022-3044 
Inappropriate implementation in Site Isolation in Google Chrome prior to 105.0.5195.52 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page.
Problem types: description: Inappropriate implementation
Affected products: vendor: Google
product: Chrome
Published: 2022-09-26T15:01:24.000Z
CVE-2022-3045 
Insufficient validation of untrusted input in V8 in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Insufficient validation of untrusted input
Affected products: vendor: Google
product: Chrome
Published: 2022-09-26T15:01:25.000Z
CVE-2022-3046 
Use after free in Browser Tag in Google Chrome prior to 105.0.5195.52 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2022-09-26T15:01:26.000Z
CVE-2022-3047 
Insufficient policy enforcement in Extensions API in Google Chrome prior to 105.0.5195.52 allowed an attacker who convinced a user to install a malicious extension to bypass downloads policy via a crafted HTML page.
Problem types: description: Insufficient policy enforcement
Affected products: vendor: Google
product: Chrome
Published: 2022-09-26T15:01:27.000Z
CVE-2022-3048 
Inappropriate implementation in Chrome OS lockscreen in Google Chrome on Chrome OS prior to 105.0.5195.52 allowed a local attacker to bypass lockscreen navigation restrictions via physical access to the device.
Problem types: description: Inappropriate implementation
Affected products: vendor: Google
product: Chrome
Published: 2022-09-26T15:01:27.000Z
CVE-2022-3049 
Use after free in SplitScreen in Google Chrome on Chrome OS, Lacros prior to 105.0.5195.52 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2022-09-26T15:01:28.000Z
CVE-2022-3050 
Heap buffer overflow in WebUI in Google Chrome on Chrome OS prior to 105.0.5195.52 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via crafted UI interactions.
Problem types: description: Heap buffer overflow
Affected products: vendor: Google
product: Chrome
Published: 2022-09-26T15:01:29.000Z
CVE-2022-3051 
Heap buffer overflow in Exosphere in Google Chrome on Chrome OS, Lacros prior to 105.0.5195.52 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via crafted UI interactions.
Problem types: description: Heap buffer overflow
Affected products: vendor: Google
product: Chrome
Published: 2022-09-26T15:01:30.000Z
CVE-2022-3052 
Heap buffer overflow in Window Manager in Google Chrome on Chrome OS, Lacros prior to 105.0.5195.52 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via crafted UI interactions.
Problem types: description: Heap buffer overflow
Affected products: vendor: Google
product: Chrome
Published: 2022-09-26T15:01:31.000Z
CVE-2022-3053 
Inappropriate implementation in Pointer Lock in Google Chrome on Mac prior to 105.0.5195.52 allowed a remote attacker to restrict user navigation via a crafted HTML page.
Problem types: description: Inappropriate implementation
Affected products: vendor: Google
product: Chrome
Published: 2022-09-26T15:01:32.000Z
CVE-2022-3054 
Insufficient policy enforcement in DevTools in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Insufficient policy enforcement
Affected products: vendor: Google
product: Chrome
Published: 2022-09-26T15:01:33.000Z
CVE-2022-3055 
Use after free in Passwords in Google Chrome prior to 105.0.5195.52 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2022-09-26T15:01:34.000Z
CVE-2022-3056 
Insufficient policy enforcement in Content Security Policy in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to bypass content security policy via a crafted HTML page.
Problem types: description: Insufficient policy enforcement
Affected products: vendor: Google
product: Chrome
Published: 2022-09-26T15:01:35.000Z
CVE-2022-3057 
Inappropriate implementation in iframe Sandbox in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
Problem types: description: Inappropriate implementation
Affected products: vendor: Google
product: Chrome
Published: 2022-09-26T15:01:35.000Z
CVE-2022-3058 
Use after free in Sign-In Flow in Google Chrome prior to 105.0.5195.52 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via crafted UI interaction.
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2022-09-26T15:01:36.000Z
CVE-2022-3059 SQL injection in Schoolbox version 21.0.2, by Schoolbox Pty Ltd

The application was vulnerable to multiple instances of SQL injection (authenticated and unauthenticated) through a vulnerable parameter. Due to the stacked query support, complex SQL commands could be crafted and injected into the vulnerable parameter and using a sleep based inferential SQL injection it was possible to extract data from the database.


Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Schoolbox Pty Ltd
product: Schoolbox
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 8.6
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
version: 3.1
Published: 2022-10-31T20:06:55.882Z
CVE-2022-3060 
Improper control of a resource identifier in Error Tracking in GitLab CE/EE affecting all versions from 12.7 allows an authenticated attacker to generate content which could cause a victim to make unintended arbitrary requests
Problem types: description: Improper control of resource identifiers ('resource injection') in GitLab
Affected products: vendor: GitLab
product: GitLab
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: NONE
baseScore: 7.3
baseSeverity: HIGH
Credits: lang: en
value: Thanks [@joaxcar](https://hackerone.com/joaxcar) for reporting this vulnerability through our HackerOne bug bounty program
Published: 2022-10-17T00:00:00.000Z
CVE-2022-3061 
Found Linux Kernel flaw in the i740 driver. The Userspace program could pass any values to the driver through ioctl() interface. The driver doesn't check the value of 'pixclock', so it may cause a divide by zero error.
Problem types: cwe_id: CWE-369
description: CWE-369
Affected products: vendor: n/a
product: Kernel
Published: 2022-09-01T00:00:00.000Z
CVE-2022-3062 Simple File List < 4.4.12 - Reflected Cross-Site Scripting
The Simple File List WordPress plugin before 4.4.12 does not escape parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Simple File List
Credits: lang: en
value: Raad Haddad of Cloudyrion GmbH
Published: 2022-09-26T12:35:39.000Z
CVE-2022-3064 Excessive resource consumption in gopkg.in/yaml.v2
Parsing malicious or large YAML documents can consume excessive amounts of CPU or memory.
Problem types: description: CWE 400: Uncontrolled Resource Consumption
Affected products: vendor: gopkg.in/yaml.v2
product: gopkg.in/yaml.v2
default_status: unaffected
Published: 2022-12-27T21:17:41.860Z
CVE-2022-3065 Improper Access Control in jgraph/drawio
Improper Access Control in GitHub repository jgraph/drawio prior to 20.2.8.
Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Control
Affected products: vendor: jgraph
product: jgraph/drawio
Published: 2022-09-02T18:15:12.000Z
CVE-2022-3066 
An issue has been discovered in GitLab affecting all versions starting from 10.0 before 15.2.5, all versions starting from 15.3 before 15.3.4, all versions starting from 15.4 before 15.4.1. It was possible for an unauthorised user to create issues in a project.
Problem types: description: Authorization bypass through user-controlled key in GitLab
Affected products: vendor: GitLab
product: GitLab
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
Credits: lang: en
value: Thanks [vakzz](https://hackerone.com/vakzz) for reporting this vulnerability through our HackerOne bug bounty program
Published: 2022-10-17T00:00:00.000Z
CVE-2022-3067 
An issue has been discovered in the Import functionality of GitLab CE/EE affecting all versions starting from 14.4 before 15.2.5, all versions starting from 15.3 before 15.3.4, all versions starting from 15.4 before 15.4.1. It was possible for an authenticated user to read arbitrary projects' content given the project's ID.
Problem types: description: Improper access control in GitLab
Affected products: vendor: GitLab
product: GitLab
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
Credits: lang: en
value: Thanks [vakzz](https://hackerone.com/vakzz) for reporting this vulnerability through our HackerOne bug bounty program
Published: 2022-10-17T00:00:00.000Z
CVE-2022-3068 Improper Privilege Management in octoprint/octoprint
Improper Privilege Management in GitHub repository octoprint/octoprint prior to 1.8.3.
Problem types: cwe_id: CWE-269
description: CWE-269 Improper Privilege Management
Affected products: vendor: octoprint
product: octoprint/octoprint
Published: 2022-09-21T11:55:09.000Z
CVE-2022-3069 Wordlift < 3.37.2 - Admin+ Stored Cross-Site Scripting
The WordLift WordPress plugin before 3.37.2 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: WordLift – AI powered SEO – Schema
Credits: lang: en
value: Anurag Bhoir
Published: 2022-09-26T12:35:39.000Z
CVE-2022-3070 Generate PDF using Contact Form 7 < 3.6 - Admin+ Stored Cross-Site Scripting
The Generate PDF WordPress plugin before 3.6 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Generate PDF using Contact Form 7
Credits: lang: en
value: Anurag Bhoir
Published: 2022-09-26T12:35:40.000Z
CVE-2022-3071 
Use after free in Tab Strip in Google Chrome on Chrome OS, Lacros prior to 105.0.5195.52 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via crafted UI interaction.
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2022-09-26T15:01:37.000Z
CVE-2022-3072 Cross-site Scripting (XSS) - Stored in francoisjacquet/rosariosis
Cross-site Scripting (XSS) - Stored in GitHub repository francoisjacquet/rosariosis prior to 8.9.3.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: francoisjacquet
product: francoisjacquet/rosariosis
Published: 2022-09-01T07:30:12.000Z
CVE-2022-3073 Quaonos Schema ST4 example templates prone to XSS
Quanos "SCHEMA ST4" example web templates in version Bootstrap 2019 v2/2021 v1/2022 v1/2022 SP1 v1 or below are prone to JavaScript injection allowing a remote attacker to hijack existing sessions to e.g. other web services in the same environment or execute scripts in the users browser environment. The affected script is '*-schema.js'.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Quanos
product: Schema ST4 example web templates
default_status: unaffected
vendor: Quanos
product: Schema ST4 example web templates
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Published: 2022-12-14T08:17:08.816Z
CVE-2022-3074 Slider Hero < 8.4.4 - Admin+ Stored Cross-Site Scripting
The Slider Hero WordPress plugin before 8.4.4 does not escape the slider Name, which could allow high-privileged users to perform Cross-Site Scripting attacks.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Slider Hero with Animation, Video Background
Credits: lang: en
value: yuyudhn
Published: 2022-09-26T12:35:41.000Z
CVE-2022-3075 
Insufficient data validation in Mojo in Google Chrome prior to 105.0.5195.102 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
Problem types: description: Insufficient data validation
Affected products: vendor: Google
product: Chrome
Published: 2022-09-26T15:01:38.000Z
CVE-2022-3076 CM Download Manager < 2.8.6 - Admin+ Arbitrary File Upload
The CM Download Manager WordPress plugin before 2.8.6 allows high privilege users such as admin to upload arbitrary files by setting the any extension via the plugin's setting, which could be used by admins of multisite blog to upload PHP files for example.
Problem types: cwe_id: CWE-434
description: CWE-434 Unrestricted Upload of File with Dangerous Type
Affected products: vendor: Unknown
product: CM Download Manager
Credits: lang: en
value: Mika
Published: 2022-09-26T12:35:42.000Z
CVE-2022-3077 
A buffer overflow vulnerability was found in the Linux kernel Intel’s iSMT SMBus host controller driver in the way it handled the I2C_SMBUS_BLOCK_PROC_CALL case (via the ioctl I2C_SMBUS) with malicious input data. This flaw could allow a local user to crash the system.
Problem types: cwe_id: CWE-120
description: CWE-120
Affected products: vendor: n/a
product: kernel
Published: 2022-09-09T14:39:54.000Z
CVE-2022-3078 
An issue was discovered in the Linux kernel through 5.16-rc6. There is a lack of check after calling vzalloc() and lack of free after allocation in drivers/media/test-drivers/vidtv/vidtv_s302m.c.
Problem types: cwe_id: CWE-476
description: CWE-476
Affected products: vendor: n/a
product: Kernel
Published: 2022-09-01T20:52:56.000Z