rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-35599 
A SQL injection vulnerability in Stocks.java in sazanrjb InventoryManagementSystem 1.0 allows attackers to execute arbitrary SQL commands via parameter productcode.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-18T01:18:41.000Z
CVE-2022-35601 
A SQL injection vulnerability in SupplierDAO.java in sazanrjb InventoryManagementSystem 1.0 allows attackers to execute arbitrary SQL commands via parameter searchTxt.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-18T01:21:48.000Z
CVE-2022-35602 
A SQL injection vulnerability in UserDAO.java in sazanrjb InventoryManagementSystem 1.0 allows attackers to execute arbitrary SQL commands via parameter user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-18T01:23:28.000Z
CVE-2022-35603 
A SQL injection vulnerability in CustomerDAO.java in sazanrjb InventoryManagementSystem 1.0 allows attackers to execute arbitrary SQL commands via parameter searchTxt.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-18T01:24:18.000Z
CVE-2022-35605 
A SQL injection vulnerability in UserDAO.java in sazanrjb InventoryManagementSystem 1.0 allows attackers to execute arbitrary SQL commands via the parameters such as 'users', 'pass', etc.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-18T01:26:27.000Z
CVE-2022-35606 
A SQL injection vulnerability in CustomerDAO.java in sazanrjb InventoryManagementSystem 1.0 allows attackers to execute arbitrary SQL commands via the parameter 'customerCode.'
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-18T01:29:16.000Z
CVE-2022-35611 
A Cross-Site Request Forgery (CSRF) in MQTTRoute v3.3 and below allows attackers to create and remove dashboards.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-13T00:00:00.000Z
CVE-2022-35612 
A cross-site scripting (XSS) vulnerability in MQTTRoute v3.3 and below allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the dashboard name text field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-13T00:00:00.000Z
CVE-2022-35613 
Konker v2.3.9 was to discovered to contain a Cross-Site Request Forgery (CSRF).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-14T00:00:00.000Z
CVE-2022-35619 
D-LINK DIR-818LW A1:DIR818L_FW105b01 was discovered to contain a remote code execution (RCE) vulnerability via the function ssdpcgi_main.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-03T14:06:32.000Z
CVE-2022-35620 
D-LINK DIR-818LW A1:DIR818L_FW105b01 was discovered to contain a remote code execution (RCE) vulnerability via the function binary.soapcgi_main.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-03T14:06:43.000Z
CVE-2022-35621 
Access control vulnerability in Evoh NFT EvohClaimable contract with sha256 hash code fa2084d5abca91a62ed1d2f1cad3ec318e6a9a2d7f1510a00d898737b05f48ae allows remote attackers to execute fraudulent NFT transfers.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-21T18:14:11.000Z
CVE-2022-35623 
In Nordic nRF5 SDK for Mesh 5.0, a heap overflow vulnerability can be triggered by sending a series of segmented control packets and access packets with the same SeqAuth
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: LOW
baseScore: 8.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AC:L/AV:A/A:L/C:H/I:L/PR:L/S:C/UI:N
version: 3.1
Published: 2022-08-15T16:09:15.000Z
CVE-2022-35624 
In Nordic nRF5 SDK for Mesh 5.0, a heap overflow vulnerability can be triggered by sending a series of segmented packets with SegO > SegN
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: LOW
baseScore: 8.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AC:L/AV:A/A:L/C:H/I:L/PR:L/S:C/UI:N
version: 3.1
Published: 2022-08-15T16:10:32.000Z
CVE-2022-35628 
A SQL injection issue was discovered in the lux extension before 17.6.1, and 18.x through 24.x before 24.0.2, for TYPO3.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-12T22:01:37.000Z
CVE-2022-35629 Velociraptor Client ID Spoofing
Due to a bug in the handling of the communication between the client and server, it was possible for one client, already registered with their own client ID, to send messages to the server claiming to come from another client ID. This issue was resolved in Velociraptor 0.6.5-2.
Problem types: cwe_id: CWE-287
description: CWE-287 Improper Authentication
Affected products: vendor: Rapid7
product: Velociraptor
Credits: lang: en
value: Issue identified and disclosed by Tim Goddard of CyberCX during a security code review
Published: 2022-07-29T17:00:21.251Z
CVE-2022-35630 Unsafe HTML Injection in Artifact Collection Report
A cross-site scripting (XSS) issue in generating a collection report made it possible for malicious clients to inject JavaScript code into the static HTML file. This issue was resolved in Velociraptor 0.6.5-2.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Rapid7
product: Velociraptor
Credits: lang: en
value: Issue identified and disclosed by Tim Goddard of CyberCX during a security code review
Published: 2022-07-29T17:00:33.544Z
CVE-2022-35631 Filesystem race on temporary files
On MacOS and Linux, it may be possible to perform a symlink attack by replacing this predictable file name with a symlink to another file and have the Velociraptor client overwrite the other file. This issue was resolved in Velociraptor 0.6.5-2.
Problem types: cwe_id: CWE-377
description: CWE-377 Insecure Temporary File
Affected products: vendor: Rapid7
product: Velociraptor
Credits: lang: en
value: Issue identified and disclosed by Tim Goddard of CyberCX during a security code review
Published: 2022-07-29T17:00:46.360Z
CVE-2022-35632 XSS in User Interface
The Velociraptor GUI contains an editor suggestion feature that can display the description field of a VQL function, plugin or artifact. This field was not properly sanitized and can lead to cross-site scripting (XSS). This issue was resolved in Velociraptor 0.6.5-2.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Rapid7
product: Velociraptor
Credits: lang: en
value: Issue identified and disclosed by Tim Goddard of CyberCX during a security code review
Published: 2022-07-29T17:01:01.834Z
CVE-2022-35637 
IBM Db2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, 11.1, and 11.5 is vulnerable to a denial of service after entering a malformed SQL statement into the Db2expln tool. IBM X-Force ID: 230823.
Problem types: description: Denial of Service
Affected products: vendor: IBM
product: DB2 for Linux, UNIX and Windows
Published: 2022-09-13T20:45:27.233Z
CVE-2022-35638 IBM Sterling B2B Integrator cross-site request forgery
IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.8 and 6.1.0.0 through 6.1.2.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.  IBM X-Force ID:  230824.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: IBM
product: Sterling B2B Integrator
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
version: 3.1
Published: 2023-11-22T04:00:15.625Z
CVE-2022-35639 
IBM Sterling Partner Engagement Manager 6.1, 6.2, and Cloud 22.2 do not limit the length of a connection which could cause the server to become unresponsive. IBM X-Force ID: 230932.
Problem types: description: Denial of Service
Affected products: vendor: IBM
product: Sterling Partner Engagement Manager
vendor: IBM
product: Sterling Partner Engagement Manager on Cloud
Published: 2022-07-26T14:25:39.449Z
CVE-2022-35640 IBM Sterling Partner Engagement Manager information disclosure
IBM Sterling Partner Engagement Manager 6.2.2 could allow a local attacker to obtain sensitive information when a detailed technical error message is returned. IBM X-Force ID: 230933.
Problem types: cwe_id: CWE-209
description: CWE-209 Generation of Error Message Containing Sensitive Information
Affected products: vendor: IBM
product: Sterling Partner Engagement Manager
cpes: cpe:2.3:a:ibm:sterling_partner_engagement_manager:6.2.2:*:*:*:standard:*:*:*
cpe:2.3:a:ibm:sterling_partner_engagement_manager:6.2.2:*:*:*:essentials:*:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Published: 2024-07-16T23:05:39.388Z
CVE-2022-35642 
"IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 227592."
Problem types: description: Cross-Site Scripting
Affected products: vendor: n/a
product: IBM InfoSphere Information Server
Published: 2022-11-03T00:00:00.000Z
CVE-2022-35643 
IBM PowerVM VIOS 3.1 could allow a remote attacker to tamper with system configuration or cause a denial of service. IBM X-Force ID: 230956.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: PowerVM VIOS
Published: 2022-07-29T14:05:11.503Z
CVE-2022-35645 IBM Maximo Asset Management cross-site scripting
IBM Maximo Asset Management 7.6.1.1, 7.6.1.2, 7.6.1.3 and IBM Maximo Application Suite 8.8 and 8.9 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.  IBM X-Force ID:  230958.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: IBM
product: Maximo Asset Management
default_status: unaffected
vendor: IBM
product: Maximo Application Suite
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
version: 3.1
Published: 2023-03-02T20:14:56.934Z
CVE-2022-35646 IBM Security Verify Governance, Identity Manager security bypass

IBM Security Verify Governance, Identity Manager 10.0.1 software component could allow an authenticated user to modify or cancel any other user's access request using man-in-the-middle techniques. IBM X-Force ID: 231096.

 
Problem types: cwe_id: CWE-287
description: CWE-287 Improper Authentication
Affected products: vendor: IBM
product: Security Verify Governance, Identity Manager
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N
version: 3.1
Published: 2022-12-22T19:08:08.335Z
CVE-2022-35648 
Nautilus treadmills T616 S/N 100672PRO21140001 through 100672PRO21171980 and T618 S/N 100647PRO21130111 through 100647PRO21183960 with software before 2022-06-09 allow physically proximate attackers to cause a denial of service (fall) by connecting the power cord to a 120V circuit (which may lead to self-starting at an inopportune time).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: PHYSICAL
availabilityImpact: LOW
baseScore: 2.6
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AC:L/AV:P/A:L/C:N/I:N/PR:N/S:C/UI:N
version: 3.1
Published: 2022-07-12T03:30:39.000Z
CVE-2022-35649 
The vulnerability was found in Moodle, occurs due to improper input validation when parsing PostScript code. An omitted execution parameter results in a remote code execution risk for sites running GhostScript versions older than 9.50. Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Problem types: cwe_id: CWE-94
description: CWE-94 - Improper Control of Generation of Code ('Code Injection')
Affected products: vendor: n/a
product: Moodle
Published: 2022-07-25T15:27:27.000Z
CVE-2022-35650 
The vulnerability was found in Moodle, occurs due to input validation error when importing lesson questions. This insufficient path checks results in arbitrary file read risk. This vulnerability allows a remote attacker to perform directory traversal attacks. The capability to access this feature is only available to teachers, managers and admins by default.
Problem types: cwe_id: CWE-22
description: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: n/a
product: Moodle
Published: 2022-07-25T15:29:06.000Z
CVE-2022-35651 
A stored XSS and blind SSRF vulnerability was found in Moodle, occurs due to insufficient sanitization of user-supplied data in the SCORM track details. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website to steal potentially sensitive information, change appearance of the web page, can perform phishing and drive-by-download attacks.
Problem types: cwe_id: CWE-79
description: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: n/a
product: Moodle
Published: 2022-07-25T15:30:22.000Z
CVE-2022-35652 
An open redirect issue was found in Moodle due to improper sanitization of user-supplied data in mobile auto-login feature. A remote attacker can create a link that leads to a trusted website, however, when clicked, it redirects the victims to arbitrary URL/domain. Successful exploitation of this vulnerability may allow a remote attacker to perform a phishing attack and steal potentially sensitive information.
Problem types: cwe_id: CWE-601
description: CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')
Affected products: vendor: n/a
product: Moodle
Published: 2022-07-25T15:31:36.000Z
CVE-2022-35653 
A reflected XSS issue was identified in the LTI module of Moodle. The vulnerability exists due to insufficient sanitization of user-supplied data in the LTI module. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website to steal potentially sensitive information, change appearance of the web page, can perform phishing and drive-by-download attacks. This vulnerability does not impact authenticated users.
Problem types: cwe_id: CWE-79
description: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: n/a
product: Moodle
Published: 2022-07-25T15:33:11.000Z
CVE-2022-35654 
Pega Platform from 8.5.4 to 8.7.3 is affected by an XSS issue with an unauthenticated user and the redirect parameter.
Problem types: cwe_id: CWE-79
description: CWE-79: Cross-Site Scripting
Affected products: vendor: Pegasystems
product: Pega Infinity
Credits: lang: en
value: Kane Gamble from Blackfoot UK
Published: 2022-08-22T14:46:53.000Z
CVE-2022-35655 
Pega Platform from 7.3 to 8.7.3 is affected by an XSS issue due to a misconfiguration of a datapage setting.
Problem types: cwe_id: CWE-79
description: CWE-79: Cross-Site Scripting
Affected products: vendor: Pegasystems
product: Pega Infinity
Credits: lang: en
value: Kane Gamble from Blackfoot UK
Published: 2022-08-22T14:47:36.000Z
CVE-2022-35656 
Pega Platform from 8.3 to 8.7.3 vulnerability may allow authenticated security administrators to alter CSRF settings directly.
Problem types: cwe_id: CWE-352
description: CWE-352: Cross-Site Request Forgery
Affected products: vendor: Pegasystems
product: Pega Infinity
Credits: lang: en
value: Kane Gamble from Blackfoot UK
Published: 2022-08-22T14:47:57.000Z
CVE-2022-35664 AEM Reflected XSS Arbitrary code execution
Adobe Experience Manager versions 6.5.13.0 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser. Exploitation of this issue requires low-privilege access to AEM.
Problem types: cwe_id: CWE-79
description: Cross-site Scripting (Reflected XSS) (CWE-79)
Affected products: vendor: Adobe
product: Experience Manager
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Published: 2022-09-16T17:45:46.124Z
CVE-2022-35665 Adobe Acrobat Reader Use-After-Free Arbitrary Code Execution
Adobe Acrobat Reader versions 22.001.20169 (and earlier), 20.005.30362 (and earlier) and 17.012.30249 (and earlier) are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Problem types: cwe_id: CWE-416
description: Use After Free (CWE-416)
Affected products: vendor: Adobe
product: Acrobat Reader
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Published: 2022-08-11T14:43:59.645Z
CVE-2022-35666 Adobe Acrobat Reader Improper Input Validation Remote Code Execution Vulnerability
Adobe Acrobat Reader versions 22.001.20169 (and earlier), 20.005.30362 (and earlier) and 17.012.30249 (and earlier) are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Problem types: cwe_id: CWE-20
description: Improper Input Validation (CWE-20)
Affected products: vendor: Adobe
product: Acrobat Reader
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Published: 2022-08-11T14:45:10.393Z
CVE-2022-35667 Adobe Acrobat Reader DC Font  Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
Adobe Acrobat Reader versions 22.001.20169 (and earlier), 20.005.30362 (and earlier) and 17.012.30249 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Problem types: cwe_id: CWE-787
description: Out-of-bounds Write (CWE-787)
Affected products: vendor: Adobe
product: Acrobat Reader
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Published: 2022-08-11T14:44:15.237Z
CVE-2022-35668 Adobe Acrobat Reader Improper Input Validation Memory leak
Adobe Acrobat Reader versions 22.001.20169 (and earlier), 20.005.30362 (and earlier) and 17.012.30249 (and earlier) are affected by an Improper Input Validation vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Problem types: cwe_id: CWE-20
description: Improper Input Validation (CWE-20)
Affected products: vendor: Adobe
product: Acrobat Reader
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
version: 3.1
Published: 2022-08-11T14:44:40.972Z
CVE-2022-35669 Adobe Acrobat Reader DC Font Parsing Out-Of-Bounds Read Information Disclosure Vulnerability
Acrobat Reader versions 22.001.20142 (and earlier), 20.005.30334 (and earlier) and 20.005.30334 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Problem types: cwe_id: CWE-125
description: Out-of-bounds Read (CWE-125)
Affected products: vendor: Adobe
product: Acrobat Reader
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
version: 3.1
Published: 2022-07-27T16:19:06.796Z
CVE-2022-35670 Adobe Acrobat Reader Use-After-Free Memory leak
Adobe Acrobat Reader versions 22.001.20169 (and earlier), 20.005.30362 (and earlier) and 17.012.30249 (and earlier) are affected by a Use After Free vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Problem types: cwe_id: CWE-416
description: Use After Free (CWE-416)
Affected products: vendor: Adobe
product: Acrobat Reader
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
version: 3.1
Published: 2022-08-11T14:43:46.054Z