rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-35270 
A denial of service vulnerability exists in the web_server hashFirst functionality of Robustel R1510 3.1.16 and 3.3.0. A specially-crafted network request can lead to denial of service. An attacker can send a sequence of requests to trigger this vulnerability.This denial of service is in the `/action/import_wireguard_cert_file/` API.
Problem types: cwe_id: CWE-125
description: CWE-125: Out-of-bounds Read
Affected products: vendor: Robustel
product: R1510
Published: 2022-10-25T16:34:11.273Z
CVE-2022-35271 
A denial of service vulnerability exists in the web_server hashFirst functionality of Robustel R1510 3.1.16 and 3.3.0. A specially-crafted network request can lead to denial of service. An attacker can send a sequence of requests to trigger this vulnerability.This denial of service is in the `/action/import_cert_file/` API.
Problem types: cwe_id: CWE-125
description: CWE-125: Out-of-bounds Read
Affected products: vendor: Robustel
product: R1510
Published: 2022-10-25T16:34:12.271Z
CVE-2022-35272 BIG-IP HTTP MRF vulnerability CVE-2022-35272
In BIG-IP Versions 17.0.x before 17.0.0.1 and 16.1.x before 16.1.3.1, when source-port preserve-strict is configured on an HTTP Message Routing Framework (MRF) virtual server, undisclosed traffic may cause the Traffic Management Microkernel (TMM) to produce a core file and the connection to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Problem types: cwe_id: CWE-404
description: CWE-404 Improper Resource Shutdown or Release
Affected products: vendor: F5
product: BIG-IP
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2022-08-04T17:49:42.631Z
CVE-2022-35273 
OS command injection vulnerability in GUI setting page of CentreCOM AR260S V2 firmware versions prior to Ver.3.3.7 allows a remote authenticated attacker to execute an arbitrary OS command.
Problem types: description: OS Command Injection
Affected products: vendor: Allied Telesis K.K.
product: CentreCOM AR260S V2
Published: 2022-09-08T07:10:43.000Z
CVE-2022-35275 WordPress Advanced Order Export For WooCommerce plugin <= 3.3.1 - Authenticated Reflected Cross-Site Scripting (XSS) vulnerability
Authenticated (shop manager+) Reflected Cross-Site Scripting (XSS) vulnerability in AlgolPlus Advanced Order Export For WooCommerce plugin <= 3.3.1 at WordPress.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: AlgolPlus
product: Advanced Order Export For WooCommerce (WordPress plugin)
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.8
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: Vulnerability discovered by Lucio Sá (Patchstack Alliance)
Published: 2022-09-09T14:39:56.177Z
CVE-2022-35276 
Improper access control in BIOS firmware for some Intel(R) NUC 8 Compute Elements before version CBWHL357.0096 may allow a privileged user to potentially enable escalation of privilege via local access.
Problem types: description: escalation of privilege
Affected products: vendor: n/a
product: Intel(R) NUC 8 Compute Elements
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 7.5
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Published: 2022-11-11T15:48:52.849Z
CVE-2022-35277 WordPress GetResponse plugin <= 5.5.20 - Cross-Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in GetResponse plugin <= 5.5.20 at WordPress.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: GetResponse
product: GetResponse for WordPress (WordPress plugin)
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: Vulnerability discovered by Rasi Afeef (Patchstack Alliance)
Published: 2022-09-09T14:39:55.645Z
CVE-2022-35278 HTML Injection in ActiveMQ Artemis Web Console
In Apache ActiveMQ Artemis prior to 2.24.0, an attacker could show malicious content and/or redirect users to a malicious URL in the web console by using HTML in the name of an address or queue.
Problem types: cwe_id: CWE-80
description: CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Affected products: vendor: Apache Software Foundation
product: Apache ActiveMQ Artemis
Credits: lang: en
value: Apache ActiveMQ would like to thank Yash Pandya (Digital14), Rajatkumar Karmarkar (Digital14), and Likhith Cheekatipalle (Digital14) for reporting this issue.
Published: 2022-08-23T00:00:00.000Z
CVE-2022-35279 
"IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, 19.0.0.1, 19.0.0.2, 19.0.0.3, 20.0.0.1, 20.0.0.2, 21.0.2, 21.0.3, and 22.0.1 could disclose sensitive version information to authenticated users which could be used in further attacks against the system. IBM X-Force ID: 230537."
Problem types: description: Information Disclosure
Affected products: vendor: n/a
product: IBM Business Automation Workflow
Published: 2022-11-03T00:00:00.000Z
CVE-2022-35280 
IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 230634.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Robotic Process Automation
Published: 2022-08-10T16:50:30.987Z
CVE-2022-35281 IBM Maximo Application Suite command injection
IBM Maximo Asset Management 7.6.1.1, 7.6.1.2, 7.6.1.3 and the IBM Maximo Manage 8.3, 8.4 application in IBM Maximo Application Suite are vulnerable to CSV injection.  IBM X-Force ID:  2306335.
Problem types: cwe_id: CWE-1236
description: CWE-1236 Improper Neutralization of Formula Elements in a CSV File
Affected products: vendor: IBM
product: Maximo Asset Management
default_status: unaffected
vendor: IBM
product: Maximo Manage
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
version: 3.1
Published: 2023-01-06T16:50:24.699Z
CVE-2022-35282 
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to server-side request forgery (SSRF). By sending a specially crafted request, an attacker with local network access could exploit this vulnerability to obtain sensitive data.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: WebSphere Application Server
Published: 2022-09-28T15:55:14.406Z
CVE-2022-35283 
IBM Security Verify Information Queue 10.0.2 could allow an authenticated user to cause a denial of service with a specially crafted HTTP request.
Problem types: description: Denial of Service
Affected products: vendor: IBM
product: Security Verify Information Queue
Published: 2022-07-14T16:25:27.157Z
CVE-2022-35284 
IBM Security Verify Information Queue 10.0.2 could disclose sensitive information due to a missing or insecure SameSite attribute for a sensitive cookie. IBM X-Force ID: 230811.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Security Verify Information Queue
Published: 2022-07-25T17:20:20.194Z
CVE-2022-35285 
IBM Security Verify Information Queue 10.0.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 230812.
Problem types: description: Data Manipulation
Affected products: vendor: IBM
product: Security Verify Information Queue
Published: 2022-07-25T17:20:30.678Z
CVE-2022-35286 
IBM Security Verify Information Queue 10.0.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 230814.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: Security Verify Information Queue
Published: 2022-07-26T14:25:28.095Z
CVE-2022-35287 
IBM Security Verify Information Queue 10.0.2 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID: 230817.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Security Verify Information Queue
Published: 2022-07-25T17:20:40.918Z
CVE-2022-35288 
IBM Security Verify Information Queue 10.0.2 could allow a user to obtain sensitive information that could be used in further attacks against the system. IBM X-Force ID: 230818.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Security Verify Information Queue
Published: 2022-07-25T17:20:51.224Z
CVE-2022-35289 
A write-what-where condition in hermes caused by an integer overflow, prior to commit 5b6255ae049fa4641791e47fad994e8e8c4da374 allows attackers to potentially execute arbitrary code via crafted JavaScript. Note that this is only exploitable if the application using Hermes permits evaluation of untrusted JavaScript. Hence, most React Native applications are not affected.
Problem types: cwe_id: CWE-680
description: CWE-680: Integer Overflow to Buffer Overflow
Affected products: vendor: Facebook
product: Hermes
Published: 2022-10-11T00:00:00.000Z
CVE-2022-35290 
Under certain conditions SAP Authenticator for Android allows an attacker to access information which would otherwise be restricted.
Problem types: cwe_id: CWE-200
description: CWE-200
Affected products: vendor: SAP SE
product: SAP Authenticator for Android
Published: 2022-08-09T20:12:47.000Z
CVE-2022-35291 Privilege escalation vulnerability in SAP SuccessFactors attachment API for Mobile Application(Android & iOS)
Due to misconfigured application endpoints, SAP SuccessFactors attachment APIs allow attackers with user privileges to perform activities with admin privileges over the network. These APIs were consumed in the SF Mobile application for Time Off, Time Sheet, EC Workflow, and Benefits. On successful exploitation, the attacker can read/write attachments. Thus, compromising the confidentiality and integrity of the application
Problem types: cwe_id: CWE-269
description: CWE-269 Improper Privilege Management
Affected products: vendor: SAP SuccessFactors
product: SAP SuccessFactors Mobile Application for Android & iOS devices
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
version: 3.1
Published: 2022-07-27T13:30:02.000Z
CVE-2022-35292 
In SAP Business One application when a service is created, the executable path contains spaces and isn’t enclosed within quotes, leading to a vulnerability known as Unquoted Service Path which allows a user to gain SYSTEM privileges. If the service is exploited by adversaries, it can be used to gain privileged permissions on a system or network leading to high impact on Confidentiality, Integrity, and Availability.
Problem types: cwe_id: CWE-428
description: CWE-428
Affected products: vendor: SAP SE
product: SAP Business One
Published: 2022-09-13T15:41:49.000Z
CVE-2022-35293 
Due to insecure session management, SAP Enable Now allows an unauthenticated attacker to gain access to user's account. On successful exploitation, an attacker can view or modify user data causing limited impact on confidentiality and integrity of the application.
Problem types: cwe_id: CWE-862
description: CWE-862
Affected products: vendor: SAP SE
product: SAP Enable Now Manager
Published: 2022-08-09T20:13:16.000Z
CVE-2022-35294 
An attacker with basic business user privileges could craft and upload a malicious file to SAP NetWeaver Application Server ABAP, which is then downloaded and viewed by other users resulting in a stored Cross-Site-Scripting attack. This could lead to information disclosure including stealing authentication information and impersonating the affected user.
Problem types: cwe_id: CWE-79
description: CWE-79
Affected products: vendor: SAP SE
product: SAP NetWeaver AS ABAP
Published: 2022-09-13T15:43:33.000Z
CVE-2022-35295 
In SAP Host Agent (SAPOSCOL) - version 7.22, an attacker may use files created by saposcol to escalate privileges for themselves.
Problem types: cwe_id: CWE-755
description: CWE-755
Affected products: vendor: SAP SE
product: SAP Host Agent (SAPOSCOL)
Published: 2022-09-13T00:00:00.000Z
CVE-2022-35296 
Under certain conditions, the application SAP BusinessObjects Business Intelligence Platform (Version Management System) exposes sensitive information to an actor over the network with high privileges that is not explicitly authorized to have access to that information, leading to a high impact on Confidentiality.
Problem types: cwe_id: CWE-200
description: CWE-200
Affected products: vendor: SAP SE
product: SAP BusinessObjects Business Intelligence Platform (Version Management System)
Published: 2022-10-11T00:00:00.000Z
CVE-2022-35297 
The application SAP Enable Now does not sufficiently encode user-controlled inputs over the network before it is placed in the output being served to other users, thereby expanding the attack scope, resulting in Stored Cross-Site Scripting (XSS) vulnerability leading to limited impact on Confidentiality, Integrity and Availability.
Problem types: cwe_id: CWE-79
description: CWE-79
Affected products: vendor: SAP SE
product: SAP Enable Now
Published: 2022-10-11T00:00:00.000Z
CVE-2022-35298 
SAP NetWeaver Enterprise Portal (KMC) - version 7.50, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting vulnerability. KMC servlet is vulnerable to XSS attack. The execution of script content by a victim registered on the portal could compromise the confidentiality and integrity of victim’s web browser session.
Problem types: cwe_id: CWE-79
description: CWE-79
Affected products: vendor: SAP SE
product: SAP NetWeaver Enterprise Portal (KMC)
Published: 2022-09-13T15:43:36.000Z
CVE-2022-35299 
SAP SQL Anywhere - version 17.0, and SAP IQ - version 16.1, allows an attacker to leverage logical errors in memory management to cause a memory corruption, such as Stack-based buffer overflow.
Problem types: cwe_id: CWE-121
description: CWE-121
Affected products: vendor: SAP SE
product: SAP SQL Anywhere
vendor: SAP SE
product: SAP IQ
Published: 2022-10-11T00:00:00.000Z
CVE-2022-35401 
An authentication bypass vulnerability exists in the get_IFTTTTtoken.cgi functionality of Asus RT-AX82U 3.0.0.4.386_49674-ge182230. A specially-crafted HTTP request can lead to full administrative access to the device. An attacker would need to send a series of HTTP requests to exploit this vulnerability.
Problem types: cwe_id: CWE-324
description: CWE-324: Use of a Key Past its Expiration Date
Affected products: vendor: Asus
product: RT-AX82U
Published: 2023-01-10T20:44:50.554Z
CVE-2022-35403 
Zoho ManageEngine ServiceDesk Plus before 13008, ServiceDesk Plus MSP before 10606, and SupportCenter Plus before 11022 are affected by an unauthenticated local file disclosure vulnerability via ticket-creation email. (This also affects Asset Explorer before 6977 with authentication.)
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-12T21:56:46.000Z
CVE-2022-35404 
ManageEngine Password Manager Pro 12100 and prior and OPManager 126100 and prior are vulnerable to unauthorized file and directory creation on a server machine.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-18T12:25:32.000Z
CVE-2022-35405 
Zoho ManageEngine Password Manager Pro before 12101 and PAM360 before 5510 are vulnerable to unauthenticated remote code execution. (This also affects ManageEngine Access Manager Plus before 4303 with authentication.)
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-19T14:51:47.000Z
CVE-2022-35406 
A URL disclosure issue was discovered in Burp Suite before 2022.6. If a user views a crafted response in the Repeater or Intruder, it may be incorrectly interpreted as a redirect.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-08T15:33:47.000Z
CVE-2022-35407 
An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. A stack buffer overflow leads to arbitrary code execution in the SetupUtility driver on Intel platforms. An attacker can change the values of certain UEFI variables. If the size of the second variable exceeds the size of the first, then the buffer will be overwritten. This issue affects the SetupUtility driver of InsydeH2O.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-22T00:00:00.000Z
CVE-2022-35408 
An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. An SMM callout vulnerability in the SMM driver in UsbLegacyControlSmm leads to possible arbitrary code execution in SMM and escalation of privileges. An attacker could overwrite the function pointers in the EFI_BOOT_SERVICES table before the USB SMI handler triggers. (This is not exploitable from code running in the operating system.)
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-22T15:35:26.000Z
CVE-2022-35409 
An issue was discovered in Mbed TLS before 2.28.1 and 3.x before 3.2.0. In some configurations, an unauthenticated attacker can send an invalid ClientHello message to a DTLS server that causes a heap-based buffer over-read of up to 255 bytes. This can cause a server crash or possibly information disclosure based on error responses. Affected configurations have MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE enabled and MBEDTLS_SSL_IN_CONTENT_LEN less than a threshold that depends on the configuration: 258 bytes if using mbedtls_ssl_cookie_check, and possibly up to 571 bytes with a custom cookie check function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-15T00:00:00.000Z
CVE-2022-35410 
mat2 (aka metadata anonymisation toolkit) before 0.13.0 allows ../ directory traversal during the ZIP archive cleaning process. This primarily affects mat2 web instances, in which clients could obtain sensitive information via a crafted archive.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-08T17:35:23.000Z
CVE-2022-35411 
rpc.py through 0.6.0 allows Remote Code Execution because an unpickle occurs when the "serializer: pickle" HTTP header is sent. In other words, although JSON (not Pickle) is the default data format, an unauthenticated client can cause the data to be processed with unpickle.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-08T18:07:40.000Z
CVE-2022-35412 
Digital Guardian Agent 7.7.4.0042 allows an administrator (who ordinarily does not have a supported way to uninstall the product) to disable some of the agent functionality and then exfiltrate files to an external USB device.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-08T19:03:57.000Z
CVE-2022-35413 
WAPPLES through 6.0 has a hardcoded systemi account. A threat actor could use this account to access the system configuration and confidential information (such as SSL keys) via an HTTPS request to the /webapi/ URI on port 443 or 5001.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-13T22:00:24.000Z
CVE-2022-35414 
softmmu/physmem.c in QEMU through 7.0.0 can perform an uninitialized read on the translate_fail path, leading to an io_readx or io_writex crash. NOTE: a third party states that the Non-virtualization Use Case in the qemu.org reference applies here, i.e., "Bugs affecting the non-virtualization use case are not considered security bugs at this time.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-11T01:48:46.000Z
CVE-2022-35415 
An improper input validation in NI System Configuration Manager before 22.5 may allow a privileged user to potentially enable escalation of privilege via local access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-16T02:21:27.000Z
CVE-2022-35416 
H3C SSL VPN through 2022-07-10 allows wnm/login/login.json svpnlang cookie XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-11T02:58:49.000Z
CVE-2022-35421 
Online Tours And Travels Management System v1.0 was discovered to contain a SQL injection vulnerability via the pname parameter at /admin/operations/packages.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-02T02:54:38.000Z
CVE-2022-35422 
Web Based Quiz System v1.0 was discovered to contain a SQL injection vulnerability via the qid parameter at update.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-02T02:54:23.000Z
CVE-2022-35426 
UCMS 1.6 is vulnerable to arbitrary file upload via ucms/sadmin/file PHP file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-09T16:19:31.000Z
CVE-2022-35433 
ffjpeg commit caade60a69633d74100bd3c2528bddee0b6a1291 was discovered to contain a memory leak via /src/jfif.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-16T20:12:29.000Z
CVE-2022-35434 
jpeg-quantsmooth before commit 8879454 contained a floating point exception (FPE) via /jpeg-quantsmooth/jpegqs+0x4f5d6c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-16T20:12:30.000Z
CVE-2022-35447 
OTFCC v0.10.4 was discovered to contain a heap-buffer overflow via /release-x64/otfccdump+0x6b04de.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-16T20:12:33.000Z
CVE-2022-35448 
OTFCC v0.10.4 was discovered to contain a heap-buffer overflow via /release-x64/otfccdump+0x6b55af.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-16T20:12:35.000Z
CVE-2022-35449 
OTFCC v0.10.4 was discovered to contain a heap-buffer overflow via /release-x64/otfccdump+0x6b0466.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-16T20:12:35.000Z
CVE-2022-35450 
OTFCC v0.10.4 was discovered to contain a heap-buffer overflow via /release-x64/otfccdump+0x6b84b1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-16T20:12:36.000Z
CVE-2022-35451 
OTFCC v0.10.4 was discovered to contain a heap-buffer overflow via /release-x64/otfccdump+0x6b03b5.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-16T20:12:37.000Z
CVE-2022-35452 
OTFCC v0.10.4 was discovered to contain a heap-buffer overflow via /release-x64/otfccdump+0x6b0b2c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-16T20:12:37.000Z
CVE-2022-35453 
OTFCC v0.10.4 was discovered to contain a heap-buffer overflow via /release-x64/otfccdump+0x6c08a6.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-16T20:12:38.000Z