rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-23083 
NetMaster 12.2 Network Management for TCP/IP and NetMaster File Transfer Management contain a XSS (Cross-Site Scripting) vulnerability in ReportCenter UI due to insufficient input validation that could potentially allow an attacker to execute code on the affected machine.
Problem types: description: Cross-Site Scripting
Affected products: vendor: n/a
product: NetMaster Network Management for TCP/IP and NetMaster File Transfer Management
Published: 2022-01-18T16:52:35.000Z
CVE-2022-23084 Potential jail escape vulnerabilities in netmap
The total size of the user-provided nmreq to nmreq_copyin() was first computed and then trusted during the copyin.  This time-of-check to time-of-use bug could lead to kernel memory corruption.

On systems configured to include netmap in their devfs_ruleset, a privileged process running in a jail can affect the host environment.
Affected products: vendor: FreeBSD
product: FreeBSD
default_status: unknown
Credits: lang: en
value: Reno Robert
lang: en
value: Lucas Leong (@_wmliang_)
lang: en
value: Trend Micro Zero Day Initiative
Published: 2024-02-15T04:52:09.645Z
CVE-2022-23085 Potential jail escape vulnerabilities in netmap
A user-provided integer option was passed to nmreq_copyin() without checking if it would overflow.  This insufficient bounds checking could lead to kernel memory corruption.

On systems configured to include netmap in their devfs_ruleset, a privileged process running in a jail can affect the host environment.
Affected products: vendor: FreeBSD
product: FreeBSD
default_status: unknown
Credits: lang: en
value: Reno Robert
lang: en
value: Lucas Leong (@_wmliang_)
lang: en
value: Trend Micro Zero Day Initiative
Published: 2024-02-15T04:52:17.556Z
CVE-2022-23086 mpr/mps/mpt driver ioctl heap out-of-bounds write
Handlers for *_CFG_PAGE read / write ioctls in the mpr, mps, and mpt drivers allocated a buffer of a caller-specified size, but copied to it a fixed size header.  Other heap content would be overwritten if the specified size was too small.

Users with access to the mpr, mps or mpt device node may overwrite heap data, potentially resulting in privilege escalation.  Note that the device node is only accessible to root and members of the operator group.
Affected products: vendor: FreeBSD
product: FreeBSD
default_status: unknown
Credits: lang: en
value: Lucas Leong (@_wmliang_)
lang: en
value: Trend Micro Zero Day Initiative
Published: 2024-02-15T04:57:19.622Z
CVE-2022-23087 Bhyve e82545 device emulation out-of-bounds write
The e1000 network adapters permit a variety of modifications to an Ethernet packet when it is being transmitted.  These include the insertion of IP and TCP checksums, insertion of an Ethernet VLAN header, and TCP segmentation offload ("TSO").  The e1000 device model uses an on-stack buffer to generate the modified packet header when simulating these modifications on transmitted packets.

When checksum offload is requested for a transmitted packet, the e1000 device model used a guest-provided value to specify the checksum offset in the on-stack buffer.  The offset was not validated for certain packet types.

A misbehaving bhyve guest could overwrite memory in the bhyve process on the host, possibly leading to code execution in the host context.

The bhyve process runs in a Capsicum sandbox, which (depending on the FreeBSD version and bhyve configuration) limits the impact of exploiting this issue.
Affected products: vendor: FreeBSD
product: FreeBSD
default_status: unknown
Credits: lang: en
value: Mehdi Talbi
lang: en
value: Synacktiv
Published: 2024-02-15T05:01:00.770Z
CVE-2022-23088 802.11 heap buffer overflow
The 802.11 beacon handling routine failed to validate the length of an IEEE 802.11s Mesh ID before copying it to a heap-allocated buffer.

While a FreeBSD Wi-Fi client is in scanning mode (i.e., not associated with a SSID) a malicious beacon frame may overwrite kernel memory, leading to remote code execution.
Affected products: vendor: FreeBSD
product: FreeBSD
default_status: unknown
Credits: lang: en
value: m00nbsd
lang: en
value: Trend Micro Zero Day Initiative
Published: 2024-02-15T05:03:38.536Z
CVE-2022-23089 Out of bound read in elf_note_prpsinfo()
When dumping core and saving process information, proc_getargv() might return an sbuf which have a sbuf_len() of 0 or -1, which is not properly handled.

An out-of-bound read can happen when user constructs a specially crafted ps_string, which in turn can cause the kernel to crash.
Affected products: vendor: FreeBSD
product: FreeBSD
default_status: unknown
Credits: lang: en
value: Josef 'Jeff' Sipek
Published: 2024-02-15T05:07:13.996Z
CVE-2022-23090 AIO credential reference count leak
The aio_aqueue function, used by the lio_listio system call, fails to release a reference to a credential in an error case.

An attacker may cause the reference count to overflow, leading to a use after free (UAF).
Affected products: vendor: FreeBSD
product: FreeBSD
default_status: unknown
Credits: lang: en
value: Chris J-D <chris@accessvector.net>
Published: 2024-02-15T05:09:27.389Z
CVE-2022-23091 Memory disclosure by stale virtual memory mapping
A particular case of memory sharing is mishandled in the virtual memory system.  This is very similar to SA-21:08.vm, but with a different root cause.

An unprivileged local user process can maintain a mapping of a page after it is freed, allowing that process to read private data belonging to other processes or the kernel.
Affected products: vendor: FreeBSD
product: FreeBSD
default_status: unknown
Credits: lang: en
value: Mark Johnston
Published: 2024-02-15T05:11:35.101Z
CVE-2022-23092 Missing bounds check in 9p message handling
The implementation of lib9p's handling of RWALK messages was missing a bounds check needed when unpacking the message contents.  The missing check means that the receipt of a specially crafted message will cause lib9p to overwrite unrelated memory.

The bug can be triggered by a malicious bhyve guest kernel to overwrite memory in the bhyve(8) process.  This could potentially lead to user-mode code execution on the host, subject to bhyve's Capsicum sandbox.
Affected products: vendor: FreeBSD
product: FreeBSD
default_status: unknown
Credits: lang: en
value: Robert Morris
Published: 2024-02-15T05:13:50.356Z
CVE-2022-23093 Stack overflow in ping(8)
ping reads raw IP packets from the network to process responses in the pr_pack() function.  As part of processing a response ping has to reconstruct the IP header, the ICMP header and if present a "quoted packet," which represents the packet that generated an ICMP error.  The quoted packet again has an IP header and an ICMP header.

The pr_pack() copies received IP and ICMP headers into stack buffers for further processing.  In so doing, it fails to take into account the possible presence of IP option headers following the IP header in either the response or the quoted packet.  When IP options are present, pr_pack() overflows the destination buffer by up to 40 bytes.

The memory safety bugs described above can be triggered by a remote host, causing the ping program to crash.

The ping process runs in a capability mode sandbox on all affected versions of FreeBSD and is thus very constrained in how it can interact with the rest of the system at the point where the bug can occur.
Affected products: vendor: FreeBSD
product: FreeBSD
default_status: unknown
Credits: lang: en
value: NetApp, Inc.
Published: 2024-02-15T05:18:44.628Z
CVE-2022-23094 
Libreswan 4.2 through 4.5 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted IKEv1 packet because pluto/ikev1.c wrongly expects that a state object exists. This is fixed in 4.6.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-15T01:37:32.000Z
CVE-2022-23095 
Open Design Alliance Drawings SDK before 2022.12.1 mishandles the loading of JPG files. Unchecked input data from a crafted JPG file leads to memory corruption. An attacker can leverage this vulnerability to execute code in the context of the current process.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-15T14:36:32.000Z
CVE-2022-23096 
An issue was discovered in the DNS proxy in Connman through 1.40. The TCP server reply implementation lacks a check for the presence of sufficient Header Data, leading to an out-of-bounds read.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-28T00:00:00.000Z
CVE-2022-23097 
An issue was discovered in the DNS proxy in Connman through 1.40. forward_dns_reply mishandles a strnlen call, leading to an out-of-bounds read.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-28T00:00:00.000Z
CVE-2022-23098 
An issue was discovered in the DNS proxy in Connman through 1.40. The TCP server reply implementation has an infinite loop if no data is received.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-28T00:00:00.000Z
CVE-2022-23099 
OX App Suite through 7.10.6 allows XSS by forcing block-wise read.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-27T13:25:54.000Z
CVE-2022-23100 
OX App Suite through 7.10.6 allows OS Command Injection via Documentconverter (e.g., through an email attachment).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-27T13:23:24.000Z
CVE-2022-23101 
OX App Suite through 7.10.6 allows XSS via appHandler in a deep link in an e-mail message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-27T13:30:51.000Z
CVE-2022-23102 
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V2.0). Affected products contain an open redirect vulnerability. An attacker could trick a valid authenticated user to the device into clicking a malicious link there by leading to phishing attacks.
Problem types: cwe_id: CWE-601
description: CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
Affected products: vendor: Siemens
product: SINEMA Remote Connect Server
Published: 2022-02-09T15:17:29.000Z
CVE-2022-23103 
A stack-based buffer overflow vulnerability exists in the confsrv confctl_set_app_language functionality of TCL LinkHub Mesh Wi-Fi MS1G_00_01.00_14. A specially-crafted network packet can lead to stack-based buffer overflow. An attacker can send a malicious packet to trigger this vulnerability.
Problem types: cwe_id: CWE-121
description: CWE-121: Stack-based Buffer Overflow
Affected products: vendor: TCL
product: LinkHub Mesh Wifi
Published: 2022-08-05T21:12:03.828Z
CVE-2022-23104 WIN-911 2021 Incorrect Default Permissions
WIN-911 2021 R1 and R2 are vulnerable to a permissions misconfiguration that may allow an attacker to locally write files to the program Operator Workspace directory, which holds DLL files and executables. A low-privilege attacker could write a malicious DLL file to the Operator Workspace directory to achieve privilege escalation and the permissions of the user running the program.
Problem types: cwe_id: CWE-276
description: CWE-276 Incorrect Default Permissions
Affected products: vendor: WIN-911
product: WIN-911
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 5.6
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:L
version: 3.1
Credits: lang: en
value: Noam Moshe of Claroty reported these vulnerabilities to CISA.
Published: 2022-02-24T18:26:59.219Z
CVE-2022-23105 
Jenkins Active Directory Plugin 2.25 and earlier does not encrypt the transmission of data between the Jenkins controller and Active Directory servers in most configurations.
Affected products: vendor: Jenkins project
product: Jenkins Active Directory Plugin
Published: 2022-01-12T19:06:02.000Z
CVE-2022-23106 
Jenkins Configuration as Code Plugin 1.55 and earlier used a non-constant time comparison function when validating an authentication token allowing attackers to use statistical methods to obtain a valid authentication token.
Affected products: vendor: Jenkins project
product: Jenkins Configuration as Code Plugin
Published: 2022-01-12T00:00:00.000Z
CVE-2022-23107 
Jenkins Warnings Next Generation Plugin 9.10.2 and earlier does not restrict the name of a file when configuring custom ID, allowing attackers with Item/Configure permission to write and read specific files with a hard-coded suffix on the Jenkins controller file system.
Affected products: vendor: Jenkins project
product: Jenkins Warnings Next Generation Plugin
Published: 2022-01-12T19:06:06.000Z
CVE-2022-23108 
Jenkins Badge Plugin 1.9 and earlier does not escape the description and does not check for allowed protocols when creating a badge, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
Affected products: vendor: Jenkins project
product: Jenkins Badge Plugin
Published: 2022-01-12T19:06:08.000Z
CVE-2022-23109 
Jenkins HashiCorp Vault Plugin 3.7.0 and earlier does not mask Vault credentials in Pipeline build logs or in Pipeline step descriptions when Pipeline: Groovy Plugin 2.85 or later is installed.
Affected products: vendor: Jenkins project
product: Jenkins HashiCorp Vault Plugin
Published: 2022-01-12T19:06:09.000Z
CVE-2022-23110 
Jenkins Publish Over SSH Plugin 1.22 and earlier does not escape the SSH server name, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Overall/Administer permission.
Affected products: vendor: Jenkins project
product: Jenkins Publish Over SSH Plugin
Published: 2022-01-12T19:06:11.000Z
CVE-2022-23111 
A cross-site request forgery (CSRF) vulnerability in Jenkins Publish Over SSH Plugin 1.22 and earlier allows attackers to connect to an attacker-specified SSH server using attacker-specified credentials.
Affected products: vendor: Jenkins project
product: Jenkins Publish Over SSH Plugin
Published: 2022-01-12T19:06:13.000Z
CVE-2022-23112 
A missing permission check in Jenkins Publish Over SSH Plugin 1.22 and earlier allows attackers with Overall/Read access to connect to an attacker-specified SSH server using attacker-specified credentials.
Affected products: vendor: Jenkins project
product: Jenkins Publish Over SSH Plugin
Published: 2022-01-12T19:06:15.000Z
CVE-2022-23113 
Jenkins Publish Over SSH Plugin 1.22 and earlier performs a validation of the file name specifying whether it is present or not, resulting in a path traversal vulnerability allowing attackers with Item/Configure permission to discover the name of the Jenkins controller files.
Affected products: vendor: Jenkins project
product: Jenkins Publish Over SSH Plugin
Published: 2022-01-12T19:06:17.000Z
CVE-2022-23114 
Jenkins Publish Over SSH Plugin 1.22 and earlier stores password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.
Affected products: vendor: Jenkins project
product: Jenkins Publish Over SSH Plugin
Published: 2022-01-12T19:06:19.000Z
CVE-2022-23115 
Cross-site request forgery (CSRF) vulnerabilities in Jenkins batch task Plugin 1.19 and earlier allows attackers with Overall/Read access to retrieve logs, build or delete a batch task.
Affected products: vendor: Jenkins project
product: Jenkins batch task Plugin
Published: 2022-01-12T19:06:21.000Z
CVE-2022-23116 
Jenkins Conjur Secrets Plugin 1.0.9 and earlier implements functionality that allows attackers able to control agent processes to decrypt secrets stored in Jenkins obtained through another method.
Affected products: vendor: Jenkins project
product: Jenkins Conjur Secrets Plugin
Published: 2022-01-12T19:06:23.000Z
CVE-2022-23117 
Jenkins Conjur Secrets Plugin 1.0.9 and earlier implements functionality that allows attackers able to control agent processes to retrieve all username/password credentials stored on the Jenkins controller.
Affected products: vendor: Jenkins project
product: Jenkins Conjur Secrets Plugin
Published: 2022-01-12T19:06:25.000Z
CVE-2022-23118 
Jenkins Debian Package Builder Plugin 1.6.11 and earlier implements functionality that allows agents to invoke command-line `git` at an attacker-specified path on the controller, allowing attackers able to control agent processes to invoke arbitrary OS commands on the controller.
Affected products: vendor: Jenkins project
product: Jenkins Debian Package Builder Plugin
Published: 2022-01-12T19:06:27.000Z
CVE-2022-23119 
A directory traversal vulnerability in Trend Micro Deep Security and Cloud One - Workload Security Agent for Linux version 20 and below could allow an attacker to read arbitrary files from the file system. Please note: an attacker must first obtain compromised access to the target Deep Security Manager (DSM) or the target agent must be not yet activated or configured in order to exploit this vulnerability.
Problem types: description: Directory Traversal
Affected products: vendor: Trend Micro
product: Trend Micro Deep Security Agent for Linux
Published: 2022-01-20T18:11:17.000Z
CVE-2022-23120 
A code injection vulnerability in Trend Micro Deep Security and Cloud One - Workload Security Agent for Linux version 20 and below could allow an attacker to escalate privileges and run arbitrary code in the context of root. Please note: an attacker must first obtain access to the target agent in an un-activated and unconfigured state in order to exploit this vulnerability.
Problem types: description: Code Injection LPE
Affected products: vendor: Trend Micro
product: Trend Micro Deep Security Agent for Linux
Published: 2022-01-20T18:11:18.000Z
CVE-2022-23121 
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Netatalk. Authentication is not required to exploit this vulnerability. The specific flaw exists within the parse_entries function. The issue results from the lack of proper error handling when parsing AppleDouble entries. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-15819.
Problem types: cwe_id: CWE-755
description: CWE-755: Improper Handling of Exceptional Conditions
Affected products: vendor: Netatalk
product: Netatalk
Credits: lang: en
value: NCC Group EDG (Alex Plaskett, Cedric Halbronn, Aaron Adams) 
Published: 2023-03-28T00:00:00.000Z
CVE-2022-23122 
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Netatalk. Authentication is not required to exploit this vulnerability. The specific flaw exists within the setfilparams function. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-15837.
Problem types: cwe_id: CWE-121
description: CWE-121: Stack-based Buffer Overflow
Affected products: vendor: Netatalk
product: Netatalk
Credits: lang: en
value: Orange Tsai (@orange_8361) from DEVCORE Research Team
Published: 2023-03-28T00:00:00.000Z
CVE-2022-23123 
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Netatalk. Authentication is not required to exploit this vulnerability. The specific flaw exists within the getdirparams method. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-15830.
Problem types: cwe_id: CWE-125
description: CWE-125: Out-of-bounds Read
Affected products: vendor: Netatalk
product: Netatalk
Credits: lang: en
value: Orange Tsai (@orange_8361) from DEVCORE Research Team
Published: 2023-03-28T00:00:00.000Z
CVE-2022-23124 
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Netatalk. Authentication is not required to exploit this vulnerability. The specific flaw exists within the get_finderinfo method. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-15870.
Problem types: cwe_id: CWE-125
description: CWE-125: Out-of-bounds Read
Affected products: vendor: Netatalk
product: Netatalk
Credits: lang: en
value: Theori (@theori_io)
Published: 2023-03-28T00:00:00.000Z
CVE-2022-23125 
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Netatalk. Authentication is not required to exploit this vulnerability. The specific flaw exists within the copyapplfile function. When parsing the len element, the process does not properly validate the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-15869.
Problem types: cwe_id: CWE-121
description: CWE-121: Stack-based Buffer Overflow
Affected products: vendor: Netatalk
product: Netatalk
Credits: lang: en
value: Theori (@theori_io)
Published: 2023-03-28T00:00:00.000Z
CVE-2022-23126 
TeslaMate before 1.25.1 (when using the default Docker configuration) allows attackers to open doors of Tesla vehicles, start Keyless Driving, and interfere with vehicle operation en route. This occurs because an attacker can leverage Grafana login access to obtain a token for Tesla API calls.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-24T18:07:18.000Z
CVE-2022-23127 
Cross-site Scripting vulnerability in Mitsubishi Electric MC Works64 versions 4.04E (10.95.210.01) and prior and ICONICS MobileHMI versions 10.96.2 and prior allows a remote unauthenticated attacker to gain authentication information of an MC Works64 or MobileHMI and perform any operation using the acquired authentication information, by injecting a malicious script in the URL of a monitoring screen delivered from the MC Works64 server or MobileHMI server to an application for mobile devices and leading a legitimate user to access this URL.
Problem types: description: Cross-site Scripting
Affected products: vendor: n/a
product: Mitsubishi Electric MC Works64; ICONICS MobileHMI
Published: 2022-01-21T18:17:32.000Z
CVE-2022-23128 
Incomplete List of Disallowed Inputs vulnerability in Mitsubishi Electric MC Works64 versions 4.00A (10.95.201.23) to 4.04E (10.95.210.01), ICONICS GENESIS64 versions 10.95.3 to 10.97, ICONICS Hyper Historian versions 10.95.3 to 10.97, ICONICS AnalytiX versions 10.95.3 to 10.97 and ICONICS MobileHMI versions 10.95.3 to 10.97 allows a remote unauthenticated attacker to bypass the authentication of MC Works64, GENESIS64, Hyper Historian, AnalytiX and MobileHMI, and gain unauthorized access to the products, by sending specially crafted WebSocket packets to FrameWorX server, one of the functions of the products.
Problem types: description: Incomplete List of Disallowed Inputs
Affected products: vendor: n/a
product: Mitsubishi Electric MC Works64; ICONICS GENESIS64; ICONICS Hyper Historian; ICONICS AnalytiX; ICONICS MobileHMI
Published: 2022-01-21T18:17:33.000Z
CVE-2022-23129 
Plaintext Storage of a Password vulnerability in Mitsubishi Electric MC Works64 versions 4.04E (10.95.210.01) and prior and ICONICS GENESIS64 versions 10.90 to 10.97 allows a local authenticated attacker to gain authentication information and to access the database illegally. This is because when configuration information of GridWorX, a database linkage function of GENESIS64 and MC Works64, is exported to a CSV file, the authentication information is saved in plaintext, and an attacker who can access this CSV file can gain the authentication information.
Problem types: description: Plaintext Storage of a Password
Affected products: vendor: n/a
product: Mitsubishi Electric MC Works64; ICONICS GENESIS64
Published: 2022-01-21T18:17:31.000Z