rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-3079 Festo: CPX-CEC-C1 and CMXX, Missing Authentication for Critical Webpage Function
Festo control block CPX-CEC-C1 and CPX-CMXX in multiple versions allow unauthenticated, remote access to critical webpage functions which may cause a denial of service.
Problem types: cwe_id: CWE-269
description: CWE-269 Improper Privilege Management
Affected products: vendor: FESTO
product: Control block CPX-CEC-C1 (no. 567347)
vendor: FESTO
product: Control block CPX-CMXX (no. 555667)
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: Daniel dos Santos and Rob Hulsebos from Forescout reported to Festo
Published: 2022-09-20T10:10:17.000Z
CVE-2022-3080 BIND 9 resolvers configured to answer from stale cache with zero stale-answer-client-timeout may terminate unexpectedly
By sending specific queries to the resolver, an attacker can cause named to crash.
Problem types: description: In BIND 9.16.14 -> 9.16.32, 9.18.0 -> 9.18.6, versions 9.16.14-S1 -> 9.16.32-S1 of the BIND Supported Preview Edition, and versions 9.19.0 -> 9.19.4 of the BIND 9.19 development branch, a BIND 9 resolver can crash when stale cache and stale answers are enabled, option stale-answer-client-timeout is set to 0 and there is a stale CNAME in the cache for an incoming query.
Affected products: vendor: ISC
product: BIND9
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
Credits: lang: en
value: ISC would like to thank Maksym Odinintsev for bringing this vulnerability to our attention.
Published: 2022-09-21T10:15:29.861Z
CVE-2022-3082 miniOrange Discord Integration < 2.1.6 - Subscriber+ App Disabling
The miniOrange Discord Integration WordPress plugin before 2.1.6 does not have authorisation and CSRF in some of its AJAX actions, allowing any logged in users, such as subscriber to call them, and disable the app for example
Problem types: description: CWE-862 Missing Authorization
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: miniOrange Discord Integration
default_status: unaffected
Credits: lang: en
value: Lana Codes
lang: en
value: WPScan
Published: 2022-10-17T00:00:00.000Z
CVE-2022-3083 
All versions of Landis+Gyr E850 (ZMQ200) are vulnerable to CWE-784: Reliance on Cookies Without Validation and Integrity. The device's web application navigation depends on the value of the session cookie. The web application could become inaccessible for the user if an attacker changes the cookie values.


Problem types: cwe_id: CWE-784
description: CWE-784 Reliance on Cookies Without Validation and Integrity
Affected products: vendor: Landis+Gyr
product: E850 (ZMQ200)
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 3.9
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L
version: 3.1
Credits: lang: en
value: Aarón Flecha Menéndez
lang: en
value: Gabriel Vía Echezarreta
lang: en
value: S21Sec
Published: 2023-02-01T20:51:54.498Z
CVE-2022-3084 GE CIMPLICITY Access of Uninitialized Pointer
GE CIMPICITY versions 2022 and prior is vulnerable when data from a faulting address controls code flow starting at gmmiObj!CGmmiRootOptionTable, which could allow an attacker to execute arbitrary code. 


Problem types: cwe_id: CWE-824
description: CWE-824 Access of Uninitialized Pointer
Affected products: vendor: GE
product: CIMPLICITY
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Kimiya working with Trend micro Zero Day Initiative reported these vulnerabilities to CISA.
Published: 2022-12-07T23:00:22.514Z
CVE-2022-3085 

Fuji Electric Tellus Lite V-Simulator versions 4.0.12.0 and prior are vulnerable to a stack-based buffer overflow which may allow an attacker to execute arbitrary code.


Problem types: cwe_id: CWE-121
description: CWE-121 Stack-Based Buffer Overflow
Affected products: vendor: Fuji Electric
product: Tellus Lite V-Simulator
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Kimiya
lang: en
value: Trend Micro Zero Day Initiative
Published: 2023-01-18T23:22:02.789Z
CVE-2022-3086 Cradlepoint IBR600 Command Injection
Cradlepoint IBR600 NCOS versions 6.5.0.160bc2e and prior are vulnerable 
to shell escape, which enables local attackers with non-superuser 
credentials to gain full, unrestrictive shell access which may allow an 
attacker to execute arbitrary code.


Problem types: cwe_id: CWE-77
description: CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
Affected products: vendor: Cradlepoint
product: IBR600 
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
version: 3.1
Credits: lang: en
value: Uri Katz of Claroty Research reported these vulnerabilities to CISA.
Published: 2022-11-29T00:00:00.000Z
CVE-2022-3087 

Fuji Electric Tellus Lite V-Simulator versions 4.0.12.0 and prior are vulnerable to an out-of-bounds write which may allow an attacker to execute arbitrary code.



Problem types: cwe_id: CWE-787
description: CWE-787 Out-of-bounds Write
Affected products: vendor: Fuji Electric
product: Tellus Lite V-Simulator
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Kimiya
lang: en
value: Trend Micro Zero Day Initiative
Published: 2023-01-16T23:46:24.860Z
CVE-2022-3088 
UC-8100A-ME-T System Image: Versions v1.0 to v1.6, UC-2100 System Image: Versions v1.0 to v1.12, UC-2100-W System Image: Versions v1.0 to v 1.12,&nbsp;UC-3100 System Image: Versions v1.0 to v1.6,&nbsp;UC-5100 System Image: Versions v1.0 to v1.4, UC-8100 System Image: Versions v3.0 to v3.5, UC-8100-ME-T System Image: Versions v3.0 and v3.1, UC-8200 System Image: v1.0 to v1.5, AIG-300 System Image: v1.0 to v1.4, UC-8410A with Debian 9 System Image: Versions v4.0.2 and v4.1.2, UC-8580 with Debian 9 System Image: Versions v2.0 and v2.1, UC-8540 with Debian 9 System Image: Versions v2.0 and v2.1, and DA-662C-16-LX (GLB) System Image: Versions v1.0.2 to v1.1.2 of Moxa's ARM-based computers have an execution with unnecessary privileges vulnerability, which could allow an attacker with user-level privileges to gain root privileges.
Problem types: cwe_id: CWE-250
description: CWE-250 Execution with Unnecessary Privileges
Affected products: vendor: Moxa
product: UC-8100A-ME-T System Imaage
vendor: Moxa
product: UC-2100 System Image
vendor: Moxa
product: UC-2100-W System Image
vendor: Moxa
product: UC-3100 System Image
vendor: Moxa
product: UC-5100 System Image
vendor: Moxa
product: UC-8100 System Image
vendor: Moxa
product: UC-8100-ME-T System Image
vendor: Moxa
product: UC-8200 System Image
vendor: Moxa
product: AIG-300 System Image
vendor: Moxa
product: UC-8410A with Debian 9 System Image
vendor: Moxa
product: UC-8580 with Debian 9 System Image
vendor: Moxa
product: UC-8540 with Debian 9 System Image
vendor: Moxa
product: DA-662C-16-LX (GLB) System Image
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
Credits: lang: en
value: En Garde ICSRange research team reported this vulnerability to CISA. 
Published: 2022-11-22T00:00:00.000Z
CVE-2022-3089 EnOcean SmartServer Hard-coded credentials





Echelon SmartServer 2.2 with i.LON Vision 2.2 stores cleartext credentials in a file, which could allow an attacker to obtain cleartext usernames and passwords of the SmartServer. If the attacker obtains the file, then the credentials could be used to control the web user interface and file transfer protocol (FTP) server. 

 


Problem types: cwe_id: CWE-798
description: CWE-798 Use of Hard-coded Credentials
Affected products: vendor: EnOcean
product: Smartserver
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.3
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:H
version: 3.1
Credits: lang: en
value: Chizuru Toyama of Trend Micro reported this vulnerability to CISA.
Published: 2023-02-13T16:28:57.920Z
CVE-2022-3090 
Red Lion Controls Crimson 3.0 versions 707.000 and prior, Crimson 3.1 versions 3126.001 and prior, and Crimson 3.2 versions 3.2.0044.0 and prior are vulnerable to path traversal. When attempting to open a file using a specific path, the user's password hash is sent to an arbitrary host. This could allow an attacker to obtain user credential hashes.
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Red Lion Controls
product: Crimson 3.0
vendor: Red Lion Controls
product: Crimson 3.1
vendor: Red Lion Controls
product: Crimson 3.2
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
Credits: lang: en
value: Dragos reported this vulnerability to Red Lion Controls, who reported this vulnerability to CISA
Published: 2022-11-17T21:55:37.791Z
CVE-2022-3091 
RONDS EPM version 1.19.5 has a vulnerability in which a function could 
allow unauthenticated users to leak credentials. In some circumstances, 
an attacker can exploit this vulnerability to execute operating system 
(OS) commands. 




Problem types: cwe_id: CWE-200
description: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: RONDS
product: Equipment Predictive Maintenance Solution
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: TsungShu Chiu of CHT Security reported these vulnerabilities to CISA. 
Published: 2023-01-17T16:21:57.537Z
CVE-2022-3092 GE CIMPLICITY Out-of-bounds Write
GE CIMPICITY versions 2022 and prior is 





vulnerable to an out-of-bounds write, which could allow an attacker to execute arbitrary code. 

 

 

 


Problem types: cwe_id: CWE-787
description: CWE-787 Out-of-bounds Write
Affected products: vendor: GE
product: CIMPLICITY
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Kimiya working with Trend micro Zero Day Initiative reported these vulnerabilities to CISA.
Published: 2022-12-07T23:01:34.391Z
CVE-2022-3093 
This vulnerability allows physical attackers to execute arbitrary code on affected Tesla vehicles. Authentication is not required to exploit this vulnerability. The specific flaw exists within the ice_updater update mechanism. The issue results from the lack of proper validation of user-supplied firmware. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-17463.
Problem types: cwe_id: CWE-367
description: CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition
Affected products: vendor: Tesla
product: Model 3
Credits: lang: en
value: @Jedar_LZ
Published: 2023-03-29T00:00:00.000Z
CVE-2022-3094 An UPDATE message flood may cause named to exhaust all available memory
Sending a flood of dynamic DNS updates may cause `named` to allocate large amounts of memory. This, in turn, may cause `named` to exit due to a lack of free memory. We are not aware of any cases where this has been exploited.

Memory is allocated prior to the checking of access permissions (ACLs) and is retained during the processing of a dynamic update from a client whose access credentials are accepted. Memory allocated to clients that are not permitted to send updates is released immediately upon rejection. The scope of this vulnerability is limited therefore to trusted clients who are permitted to make dynamic zone changes.

If a dynamic update is REFUSED, memory will be released again very quickly. Therefore it is only likely to be possible to degrade or stop `named` by sending a flood of unaccepted dynamic updates comparable in magnitude to a query flood intended to achieve the same detrimental outcome.

BIND 9.11 and earlier branches are also affected, but through exhaustion of internal resources rather than memory constraints. This may reduce performance but should not be a significant problem for most servers. Therefore we don't intend to address this for BIND versions prior to BIND 9.16.
This issue affects BIND 9 versions 9.16.0 through 9.16.36, 9.18.0 through 9.18.10, 9.19.0 through 9.19.8, and 9.16.8-S1 through 9.16.36-S1.
Problem types: description: n/a
Affected products: vendor: ISC
product: BIND 9
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
baseScore: 7.5
baseSeverity: HIGH
Credits: lang: en
value: ISC would like to thank Rob Schulhof from Infoblox for bringing this vulnerability to our attention.
Published: 2023-01-25T21:34:52.983Z
CVE-2022-3095 Incorrect parsing of the backslash characters in Dart library
The implementation of backslash parsing in the Dart URI class for versions prior to 2.18 and Flutter versions prior to 3.30 differs from the WhatWG URL standards. Dart uses the RFC 3986 syntax, which creates incompatibilities with the '\' characters in URIs, which can lead to auth bypass in webapps interpreting URIs. We recommend updating Dart or Flutter to mitigate the issue.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Google LLC
product: Dart
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
Credits: lang: en
value: Sohom Datta, Cryptonite, MIT Manipal
Published: 2022-10-27T00:00:00.000Z
CVE-2022-3096 WP Total Hacks <= 4.7.2 - Subscriber+ Arbitrary Options Update to Stored XSS
The WP Total Hacks WordPress plugin through 4.7.2 does not prevent low privilege users from modifying the plugin's settings. This could allow users such as subscribers to perform Stored Cross-Site Scripting attacks against other users, like administrators, due to the lack of sanitisation and escaping as well.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
cwe_id: CWE-79
description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: WP Total Hacks
Credits: lang: en
value: Daniel Ruf
Published: 2022-10-31T00:00:00.000Z
CVE-2022-3097 LBStopAttack < 1.1.3 - Arbitrary Settings Update via CSRF
The Plugin LBstopattack WordPress plugin before 1.1.3 does not use nonces when saving its settings, making it possible for attackers to conduct CSRF attacks. This could allow attackers to disable the plugin's protections.
Problem types: description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: Plugin LBstopattack
default_status: unaffected
Credits: lang: en
value: Daniel Ruf
Published: 2022-10-25T00:00:00.000Z
CVE-2022-3098 Login Block IPs <= 1.0.0 - Arbitrary Setting Update via CSRF
The Login Block IPs WordPress plugin through 1.0.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: Login Block IPs
Credits: lang: en
value: Daniel Ruf
Published: 2022-09-26T12:35:43.000Z
CVE-2022-3099 Use After Free in vim/vim
Use After Free in GitHub repository vim/vim prior to 9.0.0360.
Problem types: cwe_id: CWE-416
description: CWE-416 Use After Free
Affected products: vendor: vim
product: vim/vim
Published: 2022-09-03T00:00:00.000Z
CVE-2022-3100 
A flaw was found in the openstack-barbican component. This issue allows an access policy bypass via a query string when accessing the API.
Problem types: cwe_id: CWE-305
description: CWE-305
Affected products: vendor: n/a
product: Red Hat OpenStack Platform
Published: 2023-01-18T00:00:00.000Z
CVE-2022-3101 
A flaw was found in tripleo-ansible. Due to an insecure default configuration, the permissions of a sensitive file are not sufficiently restricted. This flaw allows a local attacker to use brute force to explore the relevant directory and discover the file, leading to information disclosure of important configuration details from the OpenStack deployment.
Problem types: cwe_id: CWE-22
description: CWE-22->CWE-276->CWE-732
Affected products: vendor: n/a
product: tripleo-ansible
Published: 2023-03-23T00:00:00.000Z
CVE-2022-3103 
off-by-one in io_uring module.
Problem types: cwe_id: CWE-193
description: CWE-193
Affected products: vendor: n/a
product: Linux
Published: 2022-09-26T14:51:24.000Z
CVE-2022-3104 
An issue was discovered in the Linux kernel through 5.16-rc6. lkdtm_ARRAY_BOUNDS in drivers/misc/lkdtm/bugs.c lacks check of the return value of kmalloc() and will cause the null pointer dereference.
Problem types: cwe_id: CWE-476
description: CWE-476
Affected products: vendor: n/a
product: Kernel
Published: 2022-12-14T00:00:00.000Z
CVE-2022-3105 
An issue was discovered in the Linux kernel through 5.16-rc6. uapi_finalize in drivers/infiniband/core/uverbs_uapi.c lacks check of kmalloc_array().
Problem types: cwe_id: CWE-476
description: CWE-476
Affected products: vendor: n/a
product: Kernel
Published: 2022-12-14T00:00:00.000Z
CVE-2022-3106 
An issue was discovered in the Linux kernel through 5.16-rc6. ef100_update_stats in drivers/net/ethernet/sfc/ef100_nic.c lacks check of the return value of kmalloc().
Problem types: cwe_id: CWE-476
description: CWE-476
Affected products: vendor: n/a
product: Kernel
Published: 2022-12-14T00:00:00.000Z
CVE-2022-3107 
An issue was discovered in the Linux kernel through 5.16-rc6. netvsc_get_ethtool_stats in drivers/net/hyperv/netvsc_drv.c lacks check of the return value of kvmalloc_array() and will cause the null pointer dereference.
Problem types: cwe_id: CWE-476
description: CWE-476
Affected products: vendor: n/a
product: Kernel
Published: 2022-12-14T00:00:00.000Z
CVE-2022-3108 
An issue was discovered in the Linux kernel through 5.16-rc6. kfd_parse_subtype_iolink in drivers/gpu/drm/amd/amdkfd/kfd_crat.c lacks check of the return value of kmemdup().
Problem types: cwe_id: CWE-252
description: CWE-252
Affected products: vendor: n/a
product: Kernel
Published: 2022-12-14T00:00:00.000Z
CVE-2022-3109 
An issue was discovered in the FFmpeg package, where vp3_decode_frame in libavcodec/vp3.c lacks check of the return value of av_malloc() and will cause a null pointer dereference, impacting availability.
Problem types: cwe_id: CWE-476
description: CWE-476
Affected products: vendor: n/a
product: FFmpeg
Published: 2022-12-16T00:00:00.000Z
CVE-2022-3110 
An issue was discovered in the Linux kernel through 5.16-rc6. _rtw_init_xmit_priv in drivers/staging/r8188eu/core/rtw_xmit.c lacks check of the return value of rtw_alloc_hwxmits() and will cause the null pointer dereference.
Problem types: cwe_id: CWE-476
description: CWE-476
Affected products: vendor: n/a
product: Kernel
Published: 2022-12-14T00:00:00.000Z
CVE-2022-3111 
An issue was discovered in the Linux kernel through 5.16-rc6. free_charger_irq() in drivers/power/supply/wm8350_power.c lacks free of WM8350_IRQ_CHG_FAST_RDY, which is registered in wm8350_init_charger().
Problem types: cwe_id: CWE-476
description: CWE-476
Affected products: vendor: n/a
product: Kernel
Published: 2022-12-14T00:00:00.000Z
CVE-2022-3112 
An issue was discovered in the Linux kernel through 5.16-rc6. amvdec_set_canvases in drivers/staging/media/meson/vdec/vdec_helpers.c lacks check of the return value of kzalloc() and will cause the null pointer dereference.
Problem types: cwe_id: CWE-476
description: CWE-476
Affected products: vendor: n/a
product: Kernel
Published: 2022-12-14T00:00:00.000Z
CVE-2022-3113 
An issue was discovered in the Linux kernel through 5.16-rc6. mtk_vcodec_fw_vpu_init in drivers/media/platform/mtk-vcodec/mtk_vcodec_fw_vpu.c lacks check of the return value of devm_kzalloc() and will cause the null pointer dereference.
Problem types: cwe_id: CWE-476
description: CWE-476
Affected products: vendor: n/a
product: Kernel
Published: 2022-12-14T00:00:00.000Z
CVE-2022-3114 
An issue was discovered in the Linux kernel through 5.16-rc6. imx_register_uart_clocks in drivers/clk/imx/clk.c lacks check of the return value of kcalloc() and will cause the null pointer dereference.
Problem types: cwe_id: CWE-476
description: CWE-476
Affected products: vendor: n/a
product: Kernel
Published: 2022-12-14T00:00:00.000Z
CVE-2022-3115 
An issue was discovered in the Linux kernel through 5.16-rc6. malidp_crtc_reset in drivers/gpu/drm/arm/malidp_crtc.c lacks check of the return value of kzalloc() and will cause the null pointer dereference.
Problem types: cwe_id: CWE-476
description: CWE-476
Affected products: vendor: n/a
product: Kernel
Published: 2022-12-14T00:00:00.000Z
CVE-2022-3116 
The Heimdal Software Kerberos 5 implementation is vulnerable to a null pointer dereferance. An attacker with network access to an application that depends on the vulnerable code path can cause the application to crash.
Problem types: cwe_id: CWE-476
description: CWE-476
Affected products: vendor: n/a
product: Heimdal Software Kerberos
Published: 2023-03-27T00:00:00.000Z