rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-23427 
PendingIntent hijacking vulnerability in KnoxPrivacyNoticeReceiver prior to SMR Feb-2022 Release 1 allows local attackers to access media files without permission via implicit Intent.
Problem types: cwe_id: CWE-20
description: CWE-20: Improper Input Validation
Affected products: vendor: Samsung Mobile
product: Samsung Mobile Devices
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 3.9
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
version: 3.1
Published: 2022-02-11T17:40:10.000Z
CVE-2022-23428 
An improper boundary check in eden_runtime hal service prior to SMR Feb-2022 Release 1 allows arbitrary memory write and code execution.
Problem types: cwe_id: CWE-120
description: CWE-120:Buffer Copy without Checking Size of Input
Affected products: vendor: Samsung Mobile
product: Samsung Mobile Devices with Exynos chipsets
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 8.4
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2022-02-11T17:40:11.000Z
CVE-2022-23429 
An improper boundary check in audio hal service prior to SMR Feb-2022 Release 1 allows attackers to read invalid memory and it leads to application crash.
Problem types: cwe_id: CWE-125
description: CWE-125:Out-of-bounds Read
Affected products: vendor: Samsung Mobile
product: Samsung Mobile Devices
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
version: 3.1
Published: 2022-02-11T17:40:12.000Z
CVE-2022-23431 
An improper boundary check in RPMB ldfw prior to SMR Feb-2022 Release 1 allows arbitrary memory write and code execution.
Problem types: cwe_id: CWE-120
description: CWE-120:Buffer Copy without Checking Size of Input
Affected products: vendor: Samsung Mobile
product: Samsung Mobile Devices with Exynos chipsets
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.4
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2022-02-11T17:40:13.000Z
CVE-2022-23432 
An improper input validation in SMC_SRPMB_WSM handler of RPMB ldfw prior to SMR Feb-2022 Release 1 allows arbitrary memory write and code execution.
Problem types: cwe_id: CWE-20
description: CWE-20: Improper Input Validation
Affected products: vendor: Samsung Mobile
product: Samsung Mobile Devices with Exynos chipsets
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.4
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2022-02-11T17:40:13.000Z
CVE-2022-23433 
Improper access control vulnerability in Reminder prior to versions 12.3.01.3000 in Android S(12), 12.2.05.6000 in Android R(11) and 11.6.08.6000 in Andoid Q(10) allows attackers to register reminders or execute exporeted activities remotely.
Problem types: cwe_id: CWE-284
description: CWE-284: Improper Access Control
Affected products: vendor: Samsung Mobile
product: Reminder
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
version: 3.1
Published: 2022-02-11T17:40:14.000Z
CVE-2022-23434 
A vulnerability using PendingIntent in Bixby Vision prior to versions 3.7.60.8 in Android S(12), 3.7.50.6 in Andorid R(11) and below allows attackers to execute privileged action by hijacking and modifying the intent.
Problem types: cwe_id: CWE-94
description: CWE-94: Improper Control of Generation of Code ('Code Injection')
Affected products: vendor: Samsung Mobile
product: Bixby Vision
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 4.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
version: 3.1
Published: 2022-02-11T17:40:15.000Z
CVE-2022-23435 
decoding.c in android-gif-drawable before 1.2.24 does not limit the maximum length of a comment, leading to denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-19T00:26:04.000Z
CVE-2022-23437 Infinite loop within Apache XercesJ xml parser
There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted XML document payloads. This causes, the XercesJ XML parser to wait in an infinite loop, which may sometimes consume system resources for prolonged duration. This vulnerability is present within XercesJ version 2.12.1 and the previous versions.
Problem types: description: Infinite loop within Apache XercesJ xml parser
Affected products: vendor: Apache Software Foundation
product: Apache Xerces
Credits: lang: en
value: This issue was discovered by Sergey Temnikov and Ziyi Luo, from Amazon Corretto/JDK Team
Published: 2022-01-24T00:00:00.000Z
CVE-2022-23438 
An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability in FortiOS version 7.0.5 and prior and 6.4.9 and prior may allow an unauthenticated remote attacker to perform a reflected cross site scripting (XSS) attack in the captive portal authentication replacement page.
Problem types: description: Execute unauthorized code or commands
Affected products: vendor: Fortinet
product: Fortinet FortiOS
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.7
baseSeverity: MEDIUM
confidentialityImpact: LOW
exploitCodeMaturity: UNPROVEN
integrityImpact: LOW
privilegesRequired: NONE
remediationLevel: WORKAROUND
reportConfidence: UNKNOWN
scope: CHANGED
temporalScore: 3.9
temporalSeverity: LOW
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N/E:U/RL:W/RC:U
version: 3.1
Published: 2022-07-18T16:40:44.000Z
CVE-2022-23440 
A use of hard-coded cryptographic key vulnerability [CWE-321] in the registration mechanism of FortiEDR collectors versions 5.0.2, 5.0.1, 5.0.0, 4.0.0 may allow a local attacker to disable and uninstall the collectors from the end-points within the same deployment.
Problem types: description: Denial of service
Affected products: vendor: Fortinet
product: Fortinet FortiEDR
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
exploitCodeMaturity: FUNCTIONAL
integrityImpact: HIGH
privilegesRequired: LOW
remediationLevel: UNAVAILABLE
reportConfidence: CONFIRMED
scope: UNCHANGED
temporalScore: 7.6
temporalSeverity: HIGH
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:U/RC:C
version: 3.1
Published: 2022-04-06T09:30:14.000Z
CVE-2022-23441 
A use of hard-coded cryptographic key vulnerability [CWE-321] in FortiEDR versions 5.0.2, 5.0.1, 5.0.0, 4.0.0 may allow an unauthenticated attacker on the network to disguise as and forge messages from other collectors.
Problem types: description: Improper access control
Affected products: vendor: Fortinet
product: Fortinet FortiEDR
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 9.1
baseSeverity: CRITICAL
confidentialityImpact: HIGH
exploitCodeMaturity: PROOF_OF_CONCEPT
integrityImpact: HIGH
privilegesRequired: NONE
remediationLevel: UNAVAILABLE
reportConfidence: CONFIRMED
scope: UNCHANGED
temporalScore: 8.6
temporalSeverity: HIGH
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:P/RL:U/RC:C
version: 3.1
Published: 2022-04-06T09:10:10.000Z
CVE-2022-23442 
An improper access control vulnerability [CWE-284] in FortiOS versions 6.2.0 through 6.2.11, 6.4.0 through 6.4.8 and 7.0.0 through 7.0.5 may allow an authenticated attacker with a restricted user profile to gather the checksum information about the other VDOMs via CLI commands.
Problem types: description: Improper access control
Affected products: vendor: Fortinet
product: Fortinet FortiOS
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
exploitCodeMaturity: NOT_DEFINED
integrityImpact: NONE
privilegesRequired: LOW
remediationLevel: NOT_DEFINED
reportConfidence: NOT_DEFINED
scope: UNCHANGED
temporalScore: 4.3
temporalSeverity: MEDIUM
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:X/RL:X/RC:X
version: 3.1
Published: 2022-08-03T13:20:27.000Z
CVE-2022-23443 
An improper access control in Fortinet FortiSOAR before 7.2.0 allows unauthenticated attackers to access gateway API data via crafted HTTP GET requests.
Problem types: description: Information disclosure
Affected products: vendor: Fortinet
product: Fortinet FortiSOAR
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
exploitCodeMaturity: PROOF_OF_CONCEPT
integrityImpact: NONE
privilegesRequired: NONE
remediationLevel: TEMPORARY_FIX
reportConfidence: CONFIRMED
scope: UNCHANGED
temporalScore: 6.8
temporalSeverity: MEDIUM
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:T/RC:C
version: 3.1
Published: 2022-05-04T15:25:21.000Z
CVE-2022-23446 
A improper control of a resource through its lifetime in Fortinet FortiEDR version 5.0.3 and earlier allows attacker to make the whole application unresponsive via changing its root directory access permission.
Problem types: description: Denial of service
Affected products: vendor: Fortinet
product: Fortinet FortiEDR
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 4.4
baseSeverity: MEDIUM
confidentialityImpact: NONE
exploitCodeMaturity: PROOF_OF_CONCEPT
integrityImpact: NONE
privilegesRequired: HIGH
remediationLevel: OFFICIAL_FIX
reportConfidence: CONFIRMED
scope: UNCHANGED
temporalScore: 4
temporalSeverity: MEDIUM
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C
version: 3.1
Published: 2022-04-06T09:00:17.000Z
CVE-2022-23447 
An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability [CWE-22] in FortiExtender management interface  7.0.0 through 7.0.3, 4.2.0 through 4.2.4, 4.1.1 through 4.1.8, 4.0.0 through 4.0.2, 3.3.0 through 3.3.2, 3.2.1 through 3.2.3, 5.3 all versions may allow an unauthenticated and remote attacker to retrieve arbitrary files from the underlying filesystem via specially crafted web requests.
Problem types: cwe_id: CWE-22
description: Information disclosure
Affected products: vendor: Fortinet
product: FortiExtender
default_status: unaffected
CVSS v3.1: version: 3.1
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.3
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:F/RL:U/RC:C
Published: 2023-07-11T16:52:42.353Z
CVE-2022-23448 
A vulnerability has been identified in SIMATIC Energy Manager Basic (All versions < V7.3 Update 1), SIMATIC Energy Manager PRO (All versions < V7.3 Update 1). Affected applications improperly assign permissions to critical directories and files used by the application processes. This could allow a local unprivileged attacker to achieve code execution with ADMINISTRATOR or even NT AUTHORITY/SYSTEM privileges.
Problem types: cwe_id: CWE-732
description: CWE-732: Incorrect Permission Assignment for Critical Resource
Affected products: vendor: Siemens
product: SIMATIC Energy Manager Basic
vendor: Siemens
product: SIMATIC Energy Manager PRO
Published: 2022-04-12T09:07:35.000Z
CVE-2022-23449 
A vulnerability has been identified in SIMATIC Energy Manager Basic (All versions < V7.3 Update 1), SIMATIC Energy Manager PRO (All versions < V7.3 Update 1). A DLL Hijacking vulnerability could allow a local attacker to execute code with elevated privileges by placing a malicious DLL in one of the directories on the DLL search path.
Problem types: cwe_id: CWE-427
description: CWE-427: Uncontrolled Search Path Element
Affected products: vendor: Siemens
product: SIMATIC Energy Manager Basic
vendor: Siemens
product: SIMATIC Energy Manager PRO
Published: 2022-04-12T09:07:37.000Z
CVE-2022-23450 
A vulnerability has been identified in SIMATIC Energy Manager Basic (All versions < V7.3 Update 1), SIMATIC Energy Manager PRO (All versions < V7.3 Update 1). The affected system allows remote users to send maliciously crafted objects. Due to insecure deserialization of user-supplied content by the affected software, an unauthenticated attacker could exploit this vulnerability by sending a maliciously crafted serialized object. This could allow the attacker to execute arbitrary code on the device with SYSTEM privileges.
Problem types: cwe_id: CWE-502
description: CWE-502: Deserialization of Untrusted Data
Affected products: vendor: Siemens
product: SIMATIC Energy Manager Basic
vendor: Siemens
product: SIMATIC Energy Manager PRO
Published: 2022-04-12T09:07:38.000Z
CVE-2022-23451 
An authorization flaw was found in openstack-barbican. The default policy rules for the secret metadata API allowed any authenticated user to add, modify, or delete metadata from any secret regardless of ownership. This flaw allows an attacker on the network to modify or delete protected data, causing a denial of service by consuming protected resources.
Problem types: cwe_id: CWE-863
description: CWE-863 - Incorrect Authorization.
Affected products: vendor: n/a
product: openstack/barbican
Published: 2022-09-06T17:18:52.000Z
CVE-2022-23452 
An authorization flaw was found in openstack-barbican, where anyone with an admin role could add secrets to a different project container. This flaw allows an attacker on the network to consume protected resources and cause a denial of service.
Problem types: cwe_id: CWE-863
description: CWE-863 - Incorrect Authorization.
Affected products: vendor: n/a
product: openstack/barbican
Published: 2022-09-01T20:57:45.000Z
CVE-2022-23453 
Potential security vulnerabilities have been identified in HP Support Assistant. These vulnerabilities include privilege escalation, compromise of integrity, allowed communication with untrusted clients, and unauthorized modification of files.
Problem types: description: n/a
Affected products: vendor: HP Inc.
product: HP Support Assistant
Published: 2023-01-30T21:34:48.942Z
CVE-2022-23454 
Potential security vulnerabilities have been identified in HP Support Assistant. These vulnerabilities include privilege escalation, compromise of integrity, allowed communication with untrusted clients, and unauthorized modification of files.
Problem types: description: n/a
Affected products: vendor: HP Inc.
product: HP Support Assistant
Published: 2023-01-30T21:35:42.349Z
CVE-2022-23455 
Potential security vulnerabilities have been identified in HP Support Assistant. These vulnerabilities include privilege escalation, compromise of integrity, allowed communication with untrusted clients, and unauthorized modification of files.
Problem types: description: n/a
Affected products: vendor: HP Inc.
product: HP Support Assistant
Published: 2023-01-30T21:36:24.359Z
CVE-2022-23456 
Potential arbitrary file deletion vulnerability has been identified in HP Support Assistant software.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-28T19:09:58.000Z
CVE-2022-23457 Path Traversal in ESAPI
ESAPI (The OWASP Enterprise Security API) is a free, open source, web application security control library. Prior to version 2.3.0.0, the default implementation of `Validator.getValidDirectoryPath(String, String, File, boolean)` may incorrectly treat the tested input string as a child of the specified parent directory. This potentially could allow control-flow bypass checks to be defeated if an attack can specify the entire string representing the 'input' path. This vulnerability is patched in release 2.3.0.0 of ESAPI. As a workaround, it is possible to write one's own implementation of the Validator interface. However, maintainers do not recommend this.
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: OWASP ESAPI
product: org.owasp.esapi:esapi
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
Published: 2022-04-25T00:00:00.000Z
CVE-2022-23458 Toast UI Grid vulnerable to Cross-site scripting
Toast UI Grid is a component to display and edit data. Versions prior to 4.21.3 are vulnerable to cross-site scripting attacks when pasting specially crafted content into editable cells. This issue was fixed in version 4.21.3. There are no known workarounds.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: nhn
product: tui.grid
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Published: 2022-09-22T22:05:09.000Z
CVE-2022-23459 Double free or Use after Free in Value class of Jsonxx
Jsonxx or Json++ is a JSON parser, writer and reader written in C++. In affected versions of jsonxx use of the Value class may lead to memory corruption via a double free or via a use after free. The value class has a default assignment operator which may be used with pointer types which may point to alterable data where the pointer itself is not updated. This issue exists on the current commit of the jsonxx project. The project itself has been archived and updates are not expected. Users are advised to find a replacement.
Problem types: cwe_id: CWE-416
description: CWE-416 Use After Free
cwe_id: CWE-415
description: CWE-415 Double Free
Affected products: vendor: hjiang
product: Jsonxx
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2022-08-19T19:00:16.000Z
CVE-2022-23460 Stack overflow in Jsonxx
Jsonxx or Json++ is a JSON parser, writer and reader written in C++. In affected versions of jsonxx json parsing may lead to stack exhaustion in an address sanitized (ASAN) build. This issue may lead to Denial of Service if the program using the jsonxx library crashes. This issue exists on the current commit of the jsonxx project and the project itself has been archived. Updates are not expected. Users are advised to find a replacement.
Problem types: cwe_id: CWE-121
description: CWE-121 Stack-based Buffer Overflow
Affected products: vendor: hjiang
product: Jsonxx
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2022-08-19T20:10:08.000Z
CVE-2022-23461 Cross-Site Scripting (XSS) in Jodit Editor
Jodit Editor is a WYSIWYG editor written in pure TypeScript without the use of additional libraries. Jodit Editor is vulnerable to XSS attacks when pasting specially constructed input. This issue has not been fully patched. There are no known workarounds.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: xdan
product: Jodit Editor
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Published: 2022-09-24T03:05:08.000Z
CVE-2022-23462 Stack Buffer Overflow in iowow
IOWOW is a C utility library and persistent key/value storage engine. Versions 1.4.15 and prior contain a stack buffer overflow vulnerability that allows for Denial of Service (DOS) when it parses scientific notation numbers present in JSON. A patch for this issue is available at commit a79d31e4cff1d5a08f665574b29fd885897a28fd in the `master` branch of the repository. There are no workarounds other than applying the patch.
Problem types: cwe_id: CWE-120
description: CWE-120 Buffer Overflow
cwe_id: CWE-121
description: CWE-121 Stack-based Buffer Overflow
Affected products: vendor: Softmotions
product: iowow
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
baseScore: 6.2
baseSeverity: MEDIUM
Published: 2022-10-21T00:00:00.000Z
CVE-2022-23463 SpEL Injection in Nepxion Discovery
Nepxion Discovery is a solution for Spring Cloud. Discover is vulnerable to SpEL Injection in discovery-commons. DiscoveryExpressionResolver’s eval method is evaluating expression with a StandardEvaluationContext, allowing the expression to reach and interact with Java classes such as java.lang.Runtime, leading to Remote Code Execution. There is no patch available for this issue at time of publication. There are no known workarounds.
Problem types: cwe_id: CWE-917
description: CWE-917 Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')
Affected products: vendor: Nepxion
product: Discover
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 9.4
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
version: 3.1
Published: 2022-09-24T04:40:12.000Z
CVE-2022-23464 Potential Server Side Request Forgery (SSRF) in Nepxion Discovery
Nepxion Discovery is a solution for Spring Cloud. Discovery is vulnerable to a potential Server-Side Request Forgery (SSRF). RouterResourceImpl uses RestTemplate’s getForEntity to retrieve the contents of a URL containing user-controlled input, potentially resulting in Information Disclosure. There is no patch available for this issue at time of publication. There are no known workarounds.
Problem types: cwe_id: CWE-918
description: CWE-918 Server-Side Request Forgery (SSRF)
Affected products: vendor: Nepxion
product: Discovery
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Published: 2022-09-24T04:40:08.000Z