rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-36109 Moby vulnerability relating to supplementary group permissions
Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker Engine) where supplementary groups are not set up properly. If an attacker has direct access to a container and manipulates their supplementary group access, they may be able to use supplementary group access to bypass primary group restrictions in some cases, potentially gaining access to sensitive information or gaining the ability to execute code in that container.  This bug is fixed in Moby (Docker Engine) 20.10.18. Running containers should be stopped and restarted for the permissions to be fixed. For users unable to upgrade, this problem can be worked around by not using the `"USER $USERNAME"` Dockerfile instruction. Instead by calling `ENTRYPOINT ["su", "-", "user"]` the supplementary groups will be set up properly.
Problem types: cwe_id: CWE-863
description: CWE-863: Incorrect Authorization
Affected products: vendor: moby
product: moby
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
version: 3.1
Published: 2022-09-09T17:20:11.000Z
CVE-2022-36110 Netmaker vulnerable to Insufficient Granularity of Access Control
Netmaker makes networks with WireGuard. Prior to version 0.15.1, Improper Authorization functions lead to non-privileged users running privileged API calls. If someone adds users to the Netmaker platform who do not have admin privileges, they can use their auth tokens to run admin-level functions via the API. This problem has been patched in v0.15.1.
Problem types: cwe_id: CWE-1220
description: CWE-1220: Insufficient Granularity of Access Control
cwe_id: CWE-285
description: CWE-285: Improper Authorization
Affected products: vendor: gravitl
product: netmaker
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2022-09-09T19:15:12.000Z
CVE-2022-36111 immundb has insufficient verification of data authenticity
immudb is a database with built-in cryptographic proof and verification. In versions prior to 1.4.1, a malicious immudb server can provide a falsified proof that will be accepted by the client SDK signing a falsified transaction replacing the genuine one. This situation can not be triggered by a genuine immudb server and requires the client to perform a specific list of verified operations resulting in acceptance of an invalid state value. This vulnerability only affects immudb client SDKs, the immudb server itself is not affected by this vulnerability. This issue has been patched in version 1.4.1.
Problem types: cwe_id: CWE-345
description: CWE-345: Insufficient Verification of Data Authenticity
Affected products: vendor: codenotary
product: immudb
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:N/I:H/A:N
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: HIGH
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: NONE
integrityImpact: HIGH
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
Published: 2022-11-23T00:00:00.000Z
CVE-2022-36112 Blind Server-Side Request Forgery (SSRF) in GLPI
GLPI stands for Gestionnaire Libre de Parc Informatique and is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. Usage of RSS feeds or extenal calendar in planning is subject to SSRF exploit. Server-side requests can be used to scan server port or services opened on GLPI server or its private network. Queries responses are not exposed to end-user (blind SSRF). Users are advised to upgrade to version 10.0.3 to resolve this issue. There are no known workarounds.
Problem types: cwe_id: CWE-918
description: CWE-918: Server-Side Request Forgery (SSRF)
Affected products: vendor: glpi-project
product: glpi
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 3.5
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N
version: 3.1
Published: 2022-09-14T17:45:18.000Z
CVE-2022-36113 Extracting malicious crates can corrupt arbitrary files
Cargo is a package manager for the rust programming language. After a package is downloaded, Cargo extracts its source code in the ~/.cargo folder on disk, making it available to the Rust projects it builds. To record when an extraction is successful, Cargo writes "ok" to the .cargo-ok file at the root of the extracted source code once it extracted all the files. It was discovered that Cargo allowed packages to contain a .cargo-ok symbolic link, which Cargo would extract. Then, when Cargo attempted to write "ok" into .cargo-ok, it would actually replace the first two bytes of the file the symlink pointed to with ok. This would allow an attacker to corrupt one file on the machine using Cargo to extract the package. Note that by design Cargo allows code execution at build time, due to build scripts and procedural macros. The vulnerabilities in this advisory allow performing a subset of the possible damage in a harder to track down way. Your dependencies must still be trusted if you want to be protected from attacks, as it's possible to perform the same attacks with build scripts and procedural macros. The vulnerability is present in all versions of Cargo. Rust 1.64, to be released on September 22nd, will include a fix for it. Since the vulnerability is just a more limited way to accomplish what a malicious build scripts or procedural macros can do, we decided not to publish Rust point releases backporting the security fix. Patch files are available for Rust 1.63.0 are available in the wg-security-response repository for people building their own toolchain.
Mitigations We recommend users of alternate registries to exercise care in which package they download, by only including trusted dependencies in their projects. Please note that even with these vulnerabilities fixed, by design Cargo allows arbitrary code execution at build time thanks to build scripts and procedural macros: a malicious dependency will be able to cause damage regardless of these vulnerabilities. crates.io implemented server-side checks to reject these kinds of packages years ago, and there are no packages on crates.io exploiting these vulnerabilities. crates.io users still need to exercise care in choosing their dependencies though, as remote code execution is allowed by design there as well.
Problem types: cwe_id: CWE-22
description: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: rust-lang
product: cargo
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 4.6
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L
version: 3.1
Published: 2022-09-14T00:00:00.000Z
CVE-2022-36114 Extracting malicious crates can fill the file system
Cargo is a package manager for the rust programming language. It was discovered that Cargo did not limit the amount of data extracted from compressed archives. An attacker could upload to an alternate registry a specially crafted package that extracts way more data than its size (also known as a "zip bomb"), exhausting the disk space on the machine using Cargo to download the package. Note that by design Cargo allows code execution at build time, due to build scripts and procedural macros. The vulnerabilities in this advisory allow performing a subset of the possible damage in a harder to track down way. Your dependencies must still be trusted if you want to be protected from attacks, as it's possible to perform the same attacks with build scripts and procedural macros. The vulnerability is present in all versions of Cargo. Rust 1.64, to be released on September 22nd, will include a fix for it. Since the vulnerability is just a more limited way to accomplish what a malicious build scripts or procedural macros can do, we decided not to publish Rust point releases backporting the security fix. Patch files are available for Rust 1.63.0 are available in the wg-security-response repository for people building their own toolchain. We recommend users of alternate registries to excercise care in which package they download, by only including trusted dependencies in their projects. Please note that even with these vulnerabilities fixed, by design Cargo allows arbitrary code execution at build time thanks to build scripts and procedural macros: a malicious dependency will be able to cause damage regardless of these vulnerabilities. crates.io implemented server-side checks to reject these kinds of packages years ago, and there are no packages on crates.io exploiting these vulnerabilities. crates.io users still need to excercise care in choosing their dependencies though, as the same concerns about build scripts and procedural macros apply here.
Problem types: cwe_id: CWE-400
description: CWE-400: Uncontrolled Resource Consumption
Affected products: vendor: rust-lang
product: cargo
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 4.8
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H
version: 3.1
Published: 2022-09-14T00:00:00.000Z
CVE-2022-36115 
An issue was discovered in Blue Prism Enterprise 6.0 through 7.01. In a misconfigured environment that exposes the Blue Prism Application server, it is possible for an authenticated user to reverse engineer the Blue Prism software and circumvent access controls for unintended functionality. An attacker can abuse the CreateProcessAutosave() method to inject their own functionality into a development process. If (upon a warning) a user decides to recover unsaved work by using the last saved version, the malicious code could enter the workflow. Should the process action stages not be fully reviewed before publishing, this could result in the malicious code being run in a production environment.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-25T22:54:40.000Z
CVE-2022-36116 
An issue was discovered in Blue Prism Enterprise 6.0 through 7.01. In a misconfigured environment that exposes the Blue Prism Application server, it is possible for an authenticated user to reverse engineer the Blue Prism software and circumvent access controls for the setValidationInfo administrative function. Removing the validation applied to newly designed processes increases the chance of successfully hiding malicious code that could be executed in a production environment.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-25T22:56:14.000Z
CVE-2022-36117 
An issue was discovered in Blue Prism Enterprise 6.0 through 7.01. In a misconfigured environment that exposes the Blue Prism Application server, it is possible for an authenticated user to reverse engineer the Blue Prism software and circumvent access controls for an administrative function. If credential access is configured to be accessible by a machine or the runtime resource security group, using further reverse engineering, an attacker can spoof a known machine and request known encrypted credentials to decrypt later.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-25T22:57:41.000Z
CVE-2022-36118 
An issue was discovered in Blue Prism Enterprise 6.0 through 7.01. In a misconfigured environment that exposes the Blue Prism Application server, it is possible for an authenticated user to reverse engineer the Blue Prism software and circumvent access controls for the SetProcessAttributes administrative function. Abusing this function will allow any Blue Prism user to publish, unpublish, or retire processes. Using this function, any logged-in user can change the status of a process, an action allowed only intended for users with the Edit Process permission.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-25T22:58:58.000Z
CVE-2022-36119 
An issue was discovered in Blue Prism Enterprise 6.0 through 7.01. In a misconfigured environment that exposes the Blue Prism Application server, it is possible for a domain authenticated user to send a crafted message to the Blue Prism Server and accomplish a remote code execution attack that is possible because of insecure deserialization. Exploitation of this vulnerability allows for code to be executed in the context of the Blue Prism Server service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-25T23:00:13.000Z
CVE-2022-36120 
An issue was discovered in Blue Prism Enterprise 6.0 through 7.01. In a misconfigured environment that exposes the Blue Prism Application server, it is possible for an authenticated user to reverse engineer the Blue Prism software and circumvent access controls for the getChartData administrative function. Using a low/no privilege Blue Prism user account, the attacker can alter the server's settings by abusing the getChartData method, allowing the Blue Prism server to execute any MSSQL stored procedure by name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-25T23:01:22.000Z
CVE-2022-36121 
An issue was discovered in Blue Prism Enterprise 6.0 through 7.01. In a misconfigured environment that exposes the Blue Prism Application server, it is possible for an authenticated user to reverse engineer the Blue Prism software and circumvent access controls for the UpdateOfflineHelpData administrative function. Abusing this function will allow any Blue Prism user to change the offline help URL to one of their choice, opening the possibility of spoofing the help page or executing a local file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-25T23:02:37.000Z
CVE-2022-36122 
The Automox Agent before 40 on Windows incorrectly sets permissions on key files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-21T00:00:00.000Z
CVE-2022-36123 
The Linux kernel before 5.18.13 lacks a certain clear operation for the block starting symbol (.bss). This allows Xen PV guest OS users to cause a denial of service or gain privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-29T13:43:38.000Z
CVE-2022-36124 Memory overconsumption in Avro Rust SDK
It is possible for a Reader to consume memory beyond the allowed constraints and thus lead to out of memory on the system. This issue affects Rust applications using Apache Avro Rust SDK prior to 0.14.0 (previously known as avro-rs). Users should update to apache-avro version 0.14.0 which addresses this issue.
Problem types: cwe_id: CWE-770
description: CWE-770 Allocation of Resources Without Limits or Throttling
Affected products: vendor: Apache Software Foundation
product: Apache Avro
Credits: lang: en
value: This issue was reported to the Apache Avro team by Evan Richter at ForAllSecure and found with Mayhem.
Published: 2022-08-09T06:50:32.000Z
CVE-2022-36125 Integer overflow when reading corrupted .avro file in Avro Rust SDK
It is possible to crash (panic) an application by providing a corrupted data to be read. This issue affects Rust applications using Apache Avro Rust SDK prior to 0.14.0 (previously known as avro-rs). Users should update to apache-avro version 0.14.0 which addresses this issue.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Apache Software Foundation
product: Apache Avro
Credits: lang: en
value: This issue was reported to the Apache Avro team by Evan Richter at ForAllSecure and found with Mayhem.
Published: 2022-08-09T06:50:40.000Z
CVE-2022-36126 
An issue was discovered in Inductive Automation Ignition before 7.9.20 and 8.x before 8.1.17. The ScriptInvoke function allows remote attackers to execute arbitrary code by supplying a Python script.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:H/S:U/UI:N
version: 3.1
Published: 2022-07-16T18:59:46.000Z
CVE-2022-36127 Service unavailability impact in NodeJS agent(version <= 0.5.0)
A vulnerability in Apache SkyWalking NodeJS Agent prior to 0.5.1. The vulnerability will cause NodeJS services that has this agent installed to be unavailable if the OAP is unhealthy and NodeJS agent can't establish the connection.
Problem types: description: Denial of Service
Affected products: vendor: Apache Software Foundation
product: Apache SkyWalking NodeJS Agent
Published: 2022-07-18T11:30:13.000Z
CVE-2022-36129 
HashiCorp Vault Enterprise 1.7.0 through 1.9.7, 1.10.4, and 1.11.0 clusters using Integrated Storage expose an unauthenticated API endpoint that could be abused to override the voter status of a node within a Vault HA cluster, introducing potential for future data loss or catastrophic failure. Fixed in Vault Enterprise 1.9.8, 1.10.5, and 1.11.1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-26T22:21:51.000Z
CVE-2022-36130 
HashiCorp Boundary up to 0.10.1 did not properly perform data integrity checks to ensure the resources were associated with the correct scopes, allowing potential privilege escalation for authorized users of another scope. Fixed in Boundary 0.10.2.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-01T01:45:00.000Z
CVE-2022-36131 
The Better PDF Exporter add-on 10.0.0 for Atlassian Jira is prone to stored XSS via a crafted description to the PDF Templates overview page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-22T12:36:36.000Z
CVE-2022-36133 
The WebConfig functionality of Epson TM-C3500 and TM-C7500 devices with firmware version WAM31500 allows authentication bypass.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-25T00:00:00.000Z
CVE-2022-36136 
ChurchCRM Version 4.4.5 has XSS vulnerabilities that allow attackers to store XSS via location input Deposit Comment.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-29T00:00:00.000Z
CVE-2022-36137 
ChurchCRM Version 4.4.5 has XSS vulnerabilities that allow attackers to store XSS via location input sHeader.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-29T00:00:00.000Z
CVE-2022-36139 
SWFMill commit 53d7690 was discovered to contain a heap-buffer overflow via SWF::Writer::writeByte(unsigned char).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-16T20:13:24.000Z
CVE-2022-36140 
SWFMill commit 53d7690 was discovered to contain a segmentation violation via SWF::DeclareFunction2::write(SWF::Writer*, SWF::Context*).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-16T20:13:25.000Z
CVE-2022-36141 
SWFMill commit 53d7690 was discovered to contain a segmentation violation via SWF::MethodBody::write(SWF::Writer*, SWF::Context*).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-16T20:13:26.000Z
CVE-2022-36142 
SWFMill commit 53d7690 was discovered to contain a heap-buffer overflow via SWF::Reader::getU30().
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-16T20:13:34.000Z
CVE-2022-36143 
SWFMill commit 53d7690 was discovered to contain a heap-buffer overflow via __interceptor_strlen.part at /sanitizer_common/sanitizer_common_interceptors.inc.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-16T20:13:35.000Z
CVE-2022-36144 
SWFMill commit 53d7690 was discovered to contain a heap-buffer overflow via base64_encode.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-16T20:13:36.000Z
CVE-2022-36145 
SWFMill commit 53d7690 was discovered to contain a segmentation violation via SWF::Reader::getWord().
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-16T20:13:36.000Z
CVE-2022-36146 
SWFMill commit 53d7690 was discovered to contain a memory allocation issue via operator new[](unsigned long) at asan_new_delete.cpp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-16T20:13:37.000Z
CVE-2022-36148 
fdkaac commit 53fe239 was discovered to contain a floating point exception (FPE) via wav_open at /src/wav_reader.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-16T20:02:23.000Z
CVE-2022-36149 
tifig v0.2.2 was discovered to contain a heap-use-after-free via temInfoEntry().
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-16T20:13:39.000Z
CVE-2022-36150 
tifig v0.2.2 was discovered to contain a heap-buffer overflow via __asan_memmove at /asan/asan_interceptors_memintrinsics.cpp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-16T20:13:40.000Z
CVE-2022-36151 
tifig v0.2.2 was discovered to contain a segmentation violation via getType() at /common/bbox.cpp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-16T20:13:41.000Z
CVE-2022-36152 
tifig v0.2.2 was discovered to contain a memory leak via operator new[](unsigned long) at /asan/asan_new_delete.cpp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-16T20:02:26.000Z
CVE-2022-36153 
tifig v0.2.2 was discovered to contain a segmentation violation via std::vector<unsigned int, std::allocator<unsigned int> >::size() const at /bits/stl_vector.h.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-16T20:13:42.000Z
CVE-2022-36155 
tifig v0.2.2 was discovered to contain a resource allocation issue via operator new(unsigned long) at asan_new_delete.cpp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-16T20:02:29.000Z
CVE-2022-36157 
XXL-JOB all versions as of 11 July 2022 are vulnerable to Insecure Permissions resulting in the ability to execute admin function with low Privilege account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-19T21:05:20.000Z
CVE-2022-36158 
Contec FXA3200 version 1.13.00 and under suffers from Insecure Permissions in the Wireless LAN Manager interface which allows malicious actors to execute Linux commands with root privilege via a hidden web page (/usr/www/ja/mnt_cmd.cgi).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-26T10:07:23.000Z
CVE-2022-36159 
Contec FXA3200 version 1.13 and under were discovered to contain a hard coded hash password for root stored in the component /etc/shadow. As the password strength is weak, it can be cracked in few minutes. Through this credential, a malicious actor can access the Wireless LAN Manager interface and open the telnet port then sniff the traffic or inject any malware.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-26T10:07:27.000Z