rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-43673 
Wire through 3.22.3993 on Windows advertises deletion of sent messages; nonetheless, all messages can be retrieved (for a limited period of time) from the AppData\Roaming\Wire\IndexedDB\https_app.wire.com_0.indexeddb.leveldb database.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-18T00:00:00.000Z
CVE-2022-43675 
An issue was discovered in NOKIA NFM-T R19.9. Reflected XSS in the Network Element Manager exists via /oms1350/pages/otn/cpbLogDisplay via the filename parameter, under /oms1350/pages/otn/connection/E2ERoutingDisplayWithOverLay via the id parameter, and under /oms1350/pages/otn/mainOtn via all parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-25T00:00:00.000Z
CVE-2022-43677 
In free5GC 3.2.1, a malformed NGAP message can crash the AMF and NGAP decoders via an index-out-of-range panic in aper.GetBitString.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-24T00:00:00.000Z
CVE-2022-43679 
The Docker image of ownCloud Server through 10.11 contains a misconfiguration that renders the trusted_domains config useless. This could be abused to spoof the URL in password-reset e-mail messages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AC:H/AV:N/A:N/C:L/I:L/PR:N/S:U/UI:R
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 4.2
baseSeverity: MEDIUM
Published: 2022-11-10T00:00:00.000Z
CVE-2022-43680 
In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate in out-of-memory situations.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-24T00:00:00.000Z
CVE-2022-43681 
An out-of-bounds read exists in the BGP daemon of FRRouting FRR through 8.4. When sending a malformed BGP OPEN message that ends with the option length octet (or the option length word, in case of an extended OPEN message), the FRR code reads of out of the bounds of the packet, throwing a SIGABRT signal and exiting. This results in a bgpd daemon restart, causing a Denial-of-Service condition.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-03T00:00:00.000Z
CVE-2022-43684 ACL bypass in Reporting functionality
ServiceNow has released patches and an upgrade that address an Access Control List (ACL) bypass issue in ServiceNow Core functionality.



Additional Details

This issue is present in the following supported ServiceNow releases: 



  *  Quebec prior to Patch 10 Hot Fix 8b
  *  Rome prior to Patch 10 Hot Fix 1
  *  San Diego prior to Patch 7
  *  Tokyo prior to Tokyo Patch 1; and 
  *  Utah prior to Utah General Availability 




If this ACL bypass issue were to be successfully exploited, it potentially could allow an authenticated user to obtain sensitive information from tables missing authorization controls.
Problem types: cwe_id: CWE-200
description: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: ServiceNow
product: Now Platform
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.9
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Luke Symons
lang: en
value: Tony Wu
lang: en
value: Eldar Marcussen
lang: en
value: Gareth Phillips
lang: en
value: Jeff Thomas
lang: en
value: Nadeem Salim
lang: en
value: Stephen Bradshaw
Published: 2023-06-13T18:51:39.984Z
CVE-2022-43685 
CKAN through 2.9.6 account takeovers by unauthenticated users when an existing user id is sent via an HTTP POST request. This allows a user to take over an existing account including superuser accounts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-22T00:00:00.000Z
CVE-2022-43686 
In Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2, the authTypeConcreteCookieMap table can be filled up causing a denial of service (high load).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-14T00:00:00.000Z
CVE-2022-43687 
Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 does not issue a new session ID upon successful OAuth authentication. Remediate by updating to Concrete CMS 9.1.3+ or 8.5.10+.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-14T00:00:00.000Z
CVE-2022-43688 
Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to Stored Cross-Site Scripting (XSS) in icons since the Microsoft application tile color is not sanitized. Remediate by updating to Concrete CMS 9.1.3+ or 8.5.10+.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-14T00:00:00.000Z
CVE-2022-43689 
Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to XXE based DNS requests leading to IP disclosure.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-14T00:00:00.000Z
CVE-2022-43690 
Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 did not use strict comparison for the legacy_salt so that limited authentication bypass could occur if using this functionality. Remediate by updating to Concrete CMS 9.1.3+ or 8.5.10+.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-14T00:00:00.000Z
CVE-2022-43691 
Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 inadvertently disclose server-side sensitive information (secrets in environment variables and server information) when Debug Mode is left on in production.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-14T00:00:00.000Z
CVE-2022-43692 
Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to Reflected XSS - user can cause an administrator to trigger reflected XSS with a url if the targeted administrator is using an old browser that lacks XSS protection. Remediate by updating to Concrete CMS 9.1.3+ or 8.5.10+.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-14T00:00:00.000Z
CVE-2022-43693 
Concrete CMS is vulnerable to CSRF due to the lack of "State" parameter for external Concrete authentication service for users of Concrete who use the "out of the box" core OAuth.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-14T00:00:00.000Z
CVE-2022-43694 
Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to Reflected XSS in the image manipulation library due to un-sanitized output.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-14T00:00:00.000Z
CVE-2022-43695 
Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to Stored Cross-Site Scripting (XSS) in dashboard/system/express/entities/associations because Concrete CMS allows association with an entity name that doesn’t exist or, if it does exist, contains XSS since it was not properly sanitized. Remediate by updating to Concrete CMS 9.1.3+ or 8.5.10+.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-14T00:00:00.000Z
CVE-2022-43696 
OX App Suite before 7.10.6-rev20 allows XSS via upsell ads.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-15T00:00:00.000Z
CVE-2022-43697 
OX App Suite before 7.10.6-rev30 allows XSS via an activity tracking adapter defined by jslob.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-15T00:00:00.000Z
CVE-2022-43698 
OX App Suite before 7.10.6-rev30 allows SSRF because changing a POP3 account disregards the deny-list.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-15T00:00:00.000Z
CVE-2022-43699 
OX App Suite before 7.10.6-rev30 allows SSRF because e-mail account discovery disregards the deny-list and thus can be attacked by an adversary who controls the DNS records of an external domain (found in the host part of an e-mail address).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-15T00:00:00.000Z
CVE-2022-43701 Insecure directory permissions on  installer files
When the installation directory does not have sufficiently restrictive file permissions, an attacker can modify files in the installation directory to cause execution of malicious code.
Problem types: cwe_id: CWE-276
description: CWE-276 Incorrect Default Permissions
Affected products: vendor: Arm Ltd
product: Arm Compiler 5 (AC5), Arm Compiler for Embedded 6 (AC6), Fast Models (FM), Arm Compiler for Embedded FuSA (ACEF), Arm Development Studio (ADS), Arm Forge (AF), Arm Mobile Studio (AMS), DS-5 Development Studio, Fast Models (FM), GNU Toolchain (GT), Keil MDK (KMDK), Mbed Studio (MS)
default_status: affected
Credits: lang: en
value: FalconCorruption
lang: en
value: Intel
Published: 2023-07-27T21:28:08.461Z
CVE-2022-43702 Incomplete verification of installation file signature
When the directory containing the installer does not have sufficiently restrictive file permissions, an attacker can modify (or replace) the installer to execute malicious code.
Problem types: cwe_id: CWE-284
description: CWE-284 Improper access control
Affected products: vendor: Arm Ltd
product: Arm Compiler 5 (AC5), Arm Compiler for Embedded 6 (AC6), Fast Models (FM), Arm Compiler for Embedded FuSA (ACEF), Arm Development Studio (ADS), Arm Forge (AF), Arm Mobile Studio (AMS), DS-5 Development Studio, Fast Models (FM), GNU Toolchain (GT), Keil MDK (KMDK), Mbed Studio (MS)
default_status: affected
Credits: lang: en
value: FalconCorruption
lang: en
value: Intel
Published: 2023-07-27T21:47:25.882Z
CVE-2022-43703 Incomplete verification of installation file signature
An installer that loads or executes files using an unconstrained search path may be vulnerable to substitute files under control of an attacker being loaded or executed instead of the intended files.
Problem types: cwe_id: CWE-427
description: CWE-427 Uncontrolled Search Path Element
Affected products: vendor: Arm Ltd
product: Arm Compiler 5 (AC5), Arm Compiler for Embedded 6 (AC6), Fast Models (FM), Arm Compiler for Embedded FuSA (ACEF), Arm Development Studio (ADS), Arm Forge (AF), Arm Mobile Studio (AMS), DS-5 Development Studio, Fast Models (FM), GNU Toolchain (GT), Keil MDK (KMDK), Mbed Studio (MS)
default_status: affected
Credits: lang: en
value: FalconCorruption
lang: en
value: Intel
Published: 2023-07-27T21:52:29.229Z
CVE-2022-43704 
The Sinilink XY-WFT1 WiFi Remote Thermostat, running firmware 1.3.6, allows an attacker to bypass the intended requirement to communicate using MQTT. It is possible to replay Sinilink aka SINILINK521 protocol (udp/1024) commands interfacing directly with the target device. This, in turn, allows for an attack to control the onboard relay without requiring authentication via the mobile application. This might result in an unacceptable temperature within the target device's physical environment.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-01-20T00:00:00.000Z
CVE-2022-43705 
In Botan before 2.19.3, it is possible to forge OCSP responses due to a certificate verification error. This issue was introduced in Botan 1.11.34 (November 2016).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-27T00:00:00.000Z
CVE-2022-43706 
Cross-site scripting (XSS) vulnerability in the Web UI of StackStorm versions prior to 3.8.0 allowed logged in users with write access to pack rules to inject arbitrary script or HTML that may be executed in Web UI for other logged in users.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-05T00:00:00.000Z
CVE-2022-43707 
MyBB 1.8.31 has a Cross-site scripting (XSS) vulnerability in the visual MyCode editor (SCEditor) allows remote attackers to inject HTML via user input or stored data
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-21T00:00:00.000Z
CVE-2022-43708 
MyBB 1.8.31 has a (issue 2 of 2) cross-site scripting (XSS) vulnerabilities in the post Attachments interface allow attackers to inject HTML by persuading the user to upload a file with specially crafted name
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-21T00:00:00.000Z
CVE-2022-43709 
MyBB 1.8.31 has a SQL injection vulnerability in the Admin CP's Users module allows remote authenticated users to modify the query string via direct user input or stored search filter settings.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-21T00:00:00.000Z
CVE-2022-43710 
Interactive Forms (IAF) in GX Software XperienCentral versions 10.31.0 until 10.33.0 was vulnerable to cross site request forgery (CSRF) because the unique token could be deduced using the names of all input fields.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-07-26T00:00:00.000Z
CVE-2022-43711 
Interactive Forms (IAF) in GX Software XperienCentral versions 10.29.1 until 10.33.0 was vulnerable to cross site scripting attacks (XSS) because the CSP header uses eval() in the script-src.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-07-26T00:00:00.000Z
CVE-2022-43712 
POST requests to /web/mvc in GX Software XperienCentral version 10.36.0 and earlier were not blocked for uses that are not logged in. If an unauthorized user is able to bypass other security filters they are able to post unauthorized data to the server because of CVE-2022-22965.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-07-26T00:00:00.000Z
CVE-2022-43713 
Interactive Forms (IAF) in GX Software XperienCentral versions 10.33.1 until 10.35.0 was vulnerable to invalid data input because form validation could be bypassed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-07-26T00:00:00.000Z
CVE-2022-43717 Apache Superset: Cross-Site Scripting on dashboards
Dashboard rendering does not sufficiently sanitize the content of markdown components leading to possible XSS attack vectors that can be performed by authenticated users with create dashboard permissions. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Apache Software Foundation
product: Apache Superset
default_status: unaffected
Credits: lang: en
value: Vladimir Razov (Positive Technologies)
Published: 2023-01-16T10:08:04.670Z
CVE-2022-43718 Apache Superset: Cross-Site Scripting vulnerability on upload forms
Upload data forms do not correctly render user input leading to possible XSS attack vectors that can be performed by authenticated users with database connection update permissions. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.

Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Apache Software Foundation
product: Apache Superset
default_status: unaffected
Credits: lang: en
value: Vladimir Razov (Positive Technologies)
Published: 2023-01-16T10:10:04.630Z
CVE-2022-43719 Apache Superset: Cross Site Request Forgery (CSRF) on accept, request access API
Two legacy REST API endpoints for approval and request access are vulnerable to cross site request forgery. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.



Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Apache Software Foundation
product: Apache Superset
default_status: unaffected
Credits: lang: en
value: Vladimir Razov (Positive Technologies)
Published: 2023-01-16T10:10:27.487Z
CVE-2022-43720 Apache Superset: Improper rendering of user input
An authenticated attacker with write CSS template permissions can create a record with specific HTML tags that will not get properly escaped by the toast message displayed when a user deletes that specific CSS template record. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.

Problem types: cwe_id: CWE-74
description: CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Affected products: vendor: Apache Software Foundation
product: Apache Superset
default_status: unaffected
Credits: lang: en
value: Anton Vaychikauskas (Positive Technologies)
Published: 2023-01-16T10:10:41.565Z
CVE-2022-43721 Apache Superset: Open Redirect Vulnerability
An authenticated attacker with update datasets permission could change a dataset link to an untrusted site, users could be redirected to this site when clicking on that specific dataset. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.

Problem types: cwe_id: CWE-601
description: CWE-601 URL Redirection to Untrusted Site ('Open Redirect')
Affected products: vendor: Apache Software Foundation
product: Apache Superset
default_status: unaffected
Credits: lang: en
value: Vladimir Razov (Positive Technologies)
Published: 2023-01-16T10:10:52.583Z
CVE-2022-43722 
A vulnerability has been identified in SICAM PAS/PQS (All versions < V7.0). Affected software does not properly secure a folder containing library files. This could allow an attacker to place a custom malicious DLL in this folder which is then run with SYSTEM rights when a service is started that requires this DLL. At the time of assigning the CVE, the affected firmware version of the component has already been superseded by succeeding mainline versions.
Problem types: cwe_id: CWE-427
description: CWE-427: Uncontrolled Search Path Element
Affected products: vendor: Siemens
product: SICAM PAS/PQS
Published: 2022-12-13T00:00:00.000Z
CVE-2022-43723 
A vulnerability has been identified in SICAM PAS/PQS (All versions < V7.0), SICAM PAS/PQS (All versions >= 7.0 < V8.06). Affected software does not properly validate the input for a certain parameter in the s7ontcp.dll. This could allow an unauthenticated remote attacker to send messages and create a denial of service condition as the application crashes. At the time of assigning the CVE, the affected firmware version of the component has already been superseded by succeeding mainline versions.
Problem types: cwe_id: CWE-1287
description: CWE-1287: Improper Validation of Specified Type of Input
Affected products: vendor: Siemens
product: SICAM PAS/PQS
vendor: Siemens
product: SICAM PAS/PQS
Published: 2022-12-13T00:00:00.000Z
CVE-2022-43724 
A vulnerability has been identified in SICAM PAS/PQS (All versions < V7.0). Affected software transmits the database credentials for the inbuilt SQL server in cleartext. In combination with the by default enabled xp_cmdshell feature unauthenticated remote attackers could execute custom OS commands. At the time of assigning the CVE, the affected firmware version of the component has already been superseded by succeeding mainline versions.
Problem types: cwe_id: CWE-319
description: CWE-319: Cleartext Transmission of Sensitive Information
Affected products: vendor: Siemens
product: SICAM PAS/PQS
Published: 2022-12-13T00:00:00.000Z
CVE-2022-43740 IBM Security Verify Access denial of service
IBM Security Verify Access OIDC Provider could allow a remote user to cause a denial of service due to uncontrolled resource consumption.  IBM X-Force ID:  238921.
Problem types: cwe_id: CWE-400
description: CWE-400 Uncontrolled Resource Consumption
Affected products: vendor: IBM
product: Security Verify Access
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2023-10-14T15:13:27.562Z
CVE-2022-43747 
baramundi Management Agent (bMA) in baramundi Management Suite (bMS) 2021 R1 and R2 and 2022 R1 allows remote code execution. This is fixed in security update S-2022-01, which contains fixed bMA setup files for these versions. This also is fixed in baramundi Management Suite 2022 R2.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AC:H/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:R
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
Published: 2022-10-26T00:00:00.000Z
CVE-2022-43748 
Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in file operation management in Synology Presto File Server before 2.1.2-1601 allows remote attackers to write arbitrary files via unspecified vectors.
Problem types: cwe_id: CWE-22
description: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Synology
product: Presto File Server
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: CHANGED
confidentialityImpact: NONE
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 5.8
baseSeverity: MEDIUM
Published: 2022-10-26T10:05:13.540Z
CVE-2022-43749 
Improper privilege management vulnerability in summary report management in Synology Presto File Server before 2.1.2-1601 allows remote authenticated users to bypass security constraint via unspecified vectors.
Problem types: cwe_id: CWE-269
description: CWE-269: Improper Privilege Management
Affected products: vendor: Synology
product: Presto File Server
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
Published: 2022-10-26T10:05:08.833Z
CVE-2022-43750 
drivers/usb/mon/mon_bin.c in usbmon in the Linux kernel before 5.19.15 and 6.x before 6.0.1 allows a user-space client to corrupt the monitor's internal memory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-26T00:00:00.000Z
CVE-2022-43751 
McAfee Total Protection prior to version 16.0.49 contains an uncontrolled search path element vulnerability due to the use of a variable pointing to a subdirectory that may be controllable by an unprivileged user. This may have allowed the unprivileged user to execute arbitrary code with system privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-22T00:00:00.000Z
CVE-2022-43752 
Oracle Solaris version 10 1/13, when using the Common Desktop Environment (CDE), is vulnerable to a privilege escalation vulnerability. A low privileged user can escalate to root by crafting a malicious printer and double clicking on the the crafted printer's icon.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-31T00:00:00.000Z