rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-32143 CODESYS runtime system prone to directory acces
In multiple CODESYS products, file download and upload function allows access to internal files in the working directory e.g. firmware files of the PLC. All requests are processed on the controller only if no level 1 password is configured on the controller or if remote attacker has previously successfully authenticated himself to the controller. A successful Attack may lead to a denial of service, change of local files, or drain of confidential Information. User interaction is not required
Problem types: cwe_id: CWE-552
description: CWE-552 Files or Directories Accessible to External Parties
Affected products: vendor: CODESYS
product: Runtime Toolkit
vendor: CODESYS
product: PLCWinNT
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2022-06-24T07:46:30.133Z
CVE-2022-32144 
There is an insufficient input verification vulnerability in Huawei product. Successful exploitation of this vulnerability may lead to service abnormal. (Vulnerability ID: HWPSIRT-2022-76192)

This vulnerability has been assigned a Common Vulnerabilities and Exposures (CVE) ID: CVE-2022-32144.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Huawei
product: CV81-WDM FW
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.6
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
version: 3.1
Published: 2024-12-20T01:52:28.878Z
CVE-2022-32145 
A vulnerability has been identified in Teamcenter Active Workspace V5.2 (All versions < V5.2.9), Teamcenter Active Workspace V6.0 (All versions < V6.0.3). A reflected cross-site scripting (XSS) vulnerability exists in the web interface of the affected application that could allow an attacker to execute malicious code by tricking users into accessing a malicious link.
Problem types: cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Siemens
product: Teamcenter Active Workspace V5.2
vendor: Siemens
product: Teamcenter Active Workspace V6.0
Published: 2022-06-14T09:21:59.000Z
CVE-2022-32148 Exposure of client IP addresses in net/http
Improper exposure of client IP addresses in net/http before Go 1.17.12 and Go 1.18.4 can be triggered by calling httputil.ReverseProxy.ServeHTTP with a Request.Header map containing a nil value for the X-Forwarded-For header, which causes ReverseProxy to set the client IP as the value of the X-Forwarded-For header.
Problem types: description: CWE-200: Information Exposure
Affected products: vendor: Go standard library
product: net/http
default_status: unaffected
Credits: lang: en
value: Christian Mehlmauer
Published: 2022-08-09T20:18:21.000Z
CVE-2022-32149 Denial of service via crafted Accept-Language header in golang.org/x/text/language
An attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to parse.
Problem types: description: CWE 400: Uncontrolled Resource Consumption
Affected products: vendor: golang.org/x/text
product: golang.org/x/text/language
default_status: unaffected
Credits: lang: en
value: Adam Korczynski (ADA Logics)
lang: en
value: OSS-Fuzz
Published: 2022-10-14T00:00:00.000Z
CVE-2022-32151 Splunk Enterprise disabled TLS validation using the CA certificate stores in Python 3 libraries by default
The httplib and urllib Python libraries that Splunk shipped with Splunk Enterprise did not validate certificates using the certificate authority (CA) certificate stores by default in Splunk Enterprise versions before 9.0 and Splunk Cloud Platform versions before 8.2.2203. Python 3 client libraries now verify server certificates by default and use the appropriate CA certificate stores for each library. Apps and add-ons that include their own HTTP libraries are not affected. For Splunk Enterprise, update to Splunk Enterprise version 9.0 and Configure TLS host name validation for Splunk-to-Splunk communications (https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation) to enable the remediation.
Problem types: cwe_id: CWE-295
description: CWE-295 Improper Certificate Validation
Affected products: vendor: Splunk, Inc
product: Splunk Enterprise
vendor: Splunk, Inc
product: Splunk Cloud Platform
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.4
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
version: 3.1
Credits: lang: en
value: Chris Green at Splunk
Published: 2022-06-15T16:46:07.016Z
CVE-2022-32152 Splunk Enterprise lacked TLS cert validation for Splunk-to-Splunk communication by default
Splunk Enterprise peers in Splunk Enterprise versions before 9.0 and Splunk Cloud Platform versions before 8.2.2203 did not validate the TLS certificates during Splunk-to-Splunk communications by default. Splunk peer communications configured properly with valid certificates were not vulnerable. However, an attacker with administrator credentials could add a peer without a valid certificate and connections from misconfigured nodes without valid certificates did not fail by default. For Splunk Enterprise, update to Splunk Enterprise version 9.0 and Configure TLS host name validation for Splunk-to-Splunk communications (https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation) to enable the remediation.
Problem types: cwe_id: CWE-295
description: CWE-295 Improper Certificate Validation
Affected products: vendor: Splunk
product: Splunk Enterprise
vendor: Splunk
product: Splunk Cloud Platform
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Chris Green at Splunk
Published: 2022-06-15T16:46:29.133Z
CVE-2022-32153 Splunk Enterprise lacked TLS host name validation
Splunk Enterprise peers in Splunk Enterprise versions before 9.0 and Splunk Cloud Platform versions before 8.2.2203 did not validate the TLS certificates during Splunk-to-Splunk communications by default. Splunk peer communications configured properly with valid certificates were not vulnerable. However, an attacker with administrator credentials could add a peer without a valid certificate and connections from misconfigured nodes without valid certificates did not fail by default. For Splunk Enterprise, update to Splunk Enterprise version 9.0 and Configure TLS host name validation for Splunk-to-Splunk communications (https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation) to enable the remediation.
Problem types: cwe_id: CWE-297
description: CWE-297 Improper Validation of Certificate with Host Mismatch
Affected products: vendor: Splunk, Inc
product: Splunk Enterprise
vendor: Splunk, Inc
product: Splunk Cloud Platform
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Chris Green at Splunk
Published: 2022-06-15T16:48:21.566Z
CVE-2022-32154 Risky commands warnings in Splunk Enterprise Dashboards
Dashboards in Splunk Enterprise versions before 9.0 might let an attacker inject risky search commands into a form token when the token is used in a query in a cross-origin request. The result bypasses SPL safeguards for risky commands. See New capabilities can limit access to some custom and potentially risky commands (https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/SPLsafeguards#New_capabilities_can_limit_access_to_some_custom_and_potentially_risky_commands) for more information. Note that the attack is browser-based and an attacker cannot exploit it at will.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Splunk, Inc
product: Splunk Enterprise
vendor: Splunk, Inc
product: Splunk Cloud Platform
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.8
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
version: 3.1
Credits: lang: en
value: Chris Green at Splunk
lang: en
value: Danylo Dmytriiev (DDV_UA)
lang: en
value: Anton (therceman)
Published: 2022-06-15T16:48:46.918Z
CVE-2022-32155 Universal Forwarder management services allows remote login by default
In universal forwarder versions before 9.0, management services are available remotely by default. When not required, it introduces a potential exposure, but it is not a vulnerability. If exposed, we recommend each customer assess the potential severity specific to your environment. In 9.0, the universal forwarder now binds the management port to localhost preventing remote logins by default. If management services are not required in versions before 9.0, set disableDefaultPort = true in server.conf OR allowRemoteLogin = never in server.conf OR mgmtHostPort = localhost in web.conf. See Configure universal forwarder management security (https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation#Configure_universal_forwarder_management_security) for more information on disabling the remote management services.
Affected products: vendor: Splunk, Inc
product: Universal Forwarder
Credits: lang: en
value: Chris Green at Splunk
Published: 2022-06-15T16:49:26.618Z
CVE-2022-32156 Splunk Enterprise and Universal Forwarder CLI connections lacked TLS cert validation
In Splunk Enterprise and Universal Forwarder versions before 9.0, the Splunk command-line interface (CLI) did not validate TLS certificates while connecting to a remote Splunk platform instance by default. After updating to version 9.0, see  Configure TLS host name validation for the Splunk CLI https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation#Configure_TLS_host_name_validation_for_the_Splunk_CLI  to enable the remediation. The vulnerability does not affect the Splunk Cloud Platform. At the time of publishing, we have no evidence of exploitation of this vulnerability by external parties.

The issue requires conditions beyond the control of a potential bad actor such as a machine-in-the-middle attack. Hence, Splunk rates the complexity of the attack as High.
Problem types: cwe_id: CWE-295
description: CWE-295 Improper Certificate Validation
Affected products: vendor: Splunk
product: Splunk Enterprise
default_status: unaffected
vendor: Splunk
product: Universal Forwarder
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Chris Green at Splunk
Published: 2022-06-14T00:00:00.000Z
CVE-2022-32157 Splunk Enterprise deployment servers allow unauthenticated forwarder bundle downloads
Splunk Enterprise deployment servers in versions before 9.0 allow unauthenticated downloading of forwarder bundles. Remediation requires you to update the deployment server to version 9.0 and Configure authentication for deployment servers and clients (https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/ConfigDSDCAuthEnhancements#Configure_authentication_for_deployment_servers_and_clients). Once enabled, deployment servers can manage only Universal Forwarder versions 9.0 and higher. Though the vulnerability does not directly affect Universal Forwarders, remediation requires updating all Universal Forwarders that the deployment server manages to version 9.0 or higher prior to enabling the remediation.
Problem types: cwe_id: CWE-306
description: CWE-306 Missing Authentication for Critical Function
Affected products: vendor: Splunk, Inc
product: Splunk Enterprise
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Nadim Taha at Splunk
Published: 2022-06-15T16:50:14.702Z
CVE-2022-32158 Splunk Enterprise deployment servers allow client publishing of forwarder bundles
Splunk Enterprise deployment servers in versions before 8.1.10.1, 8.2.6.1, and 9.0 let clients deploy forwarder bundles to other deployment clients through the deployment server. An attacker that compromised a Universal Forwarder endpoint could use the vulnerability to execute arbitrary code on all other Universal Forwarder endpoints subscribed to the deployment server.
Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Control
Affected products: vendor: Splunk, Inc
product: Splunk Enterprise
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Nadim Taha at Splunk
Published: 2022-06-15T16:50:43.633Z
CVE-2022-32159 Openlibrary - Stored XSS
In openlibrary versions deploy-2016-07-0 through deploy-2021-12-22 are vulnerable to Stored XSS.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: infogami
product: infogami
Credits: lang: en
value: Mend Vulnerability Research Team (MVR)
Published: 2022-06-22T17:55:10.378Z
CVE-2022-32166 ovs - buffer over-read
In ovs versions v0.90.0 through v2.5.0 are vulnerable to heap buffer over-read in flow.c. An unsafe comparison of “minimasks” function could lead access to an unmapped region of memory. This vulnerability is capable of crashing the software, memory modification, and possible remote execution.
Problem types: cwe_id: CWE-125
description: CWE-125 Out-of-bounds Read
Affected products: vendor: ovs
product: ovs
Credits: lang: en
value: Mend Vulnerability Research Team (MVR)
Published: 2022-09-28T09:30:12.924Z
CVE-2022-32167 Cloudreve - Stored XSS
Cloudreve versions v1.0.0 through v3.5.3 are vulnerable to Stored Cross-Site Scripting (XSS), via the file upload functionality. A low privileged user will be able to share a file with an admin user, which could lead to privilege escalation.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Cloudreve
product: Cloudreve
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: Daniel Elkabes
Published: 2022-09-20T14:45:19.000Z
CVE-2022-32168 notepad-plus-plus - DLL Hijacking
Notepad++ versions 8.4.1 and before are vulnerable to DLL hijacking where an attacker can replace the vulnerable dll (UxTheme.dll) with his own dll and run arbitrary code in the context of Notepad++.
Problem types: cwe_id: CWE-427
description: CWE-427 Uncontrolled Search Path Element
Affected products: vendor: notepad-plus-plus
product: notepad-plus-plus
Credits: lang: en
value: Mend Vulnerability Research Team (MVR)
Published: 2022-09-28T09:00:15.327Z
CVE-2022-32169 bytebase - Improper Authorization
The “Bytebase” application does not restrict low privilege user to access “admin issues“ for which an unauthorized user can view the “OPEN” and “CLOSED” issues by “Admin” and the affected endpoint is “/issue”.
Problem types: cwe_id: CWE-285
description: CWE-285 Improper Authorization
Affected products: vendor: bytebase
product: bytebase
Credits: lang: en
value: Mend Vulnerability Research Team (MVR)
Published: 2022-09-28T09:30:23.675Z
CVE-2022-32170 bytebase - Improper Authorization
The “Bytebase” application does not restrict low privilege user to access admin “projects“ for which an unauthorized user can view the “projects“ created by “Admin” and the affected endpoint is “/api/project?user=${userId}”.
Problem types: cwe_id: CWE-285
description: CWE-285 Improper Authorization
Affected products: vendor: bytebase
product: bytebase
Credits: lang: en
value: Mend Vulnerability Research Team (MVR)
Published: 2022-09-28T09:30:18.081Z
CVE-2022-32171 Zinc - Stored XSS
In Zinc, versions v0.1.9 through v0.3.1 are vulnerable to Stored Cross-Site Scripting when using the delete user functionality. When an authenticated user deletes a user having a XSS payload in the user id field, the javascript payload will be executed and allow an attacker to access the user’s credentials.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: zinc
product: zinc
Credits: lang: en
value: Mend Vulnerability Research Team (MVR)
Published: 2022-10-06T17:14:15.732Z
CVE-2022-32172 Zinc - Cross-Site Scripting
In Zinc, versions v0.1.9 through v0.3.1 are vulnerable to Stored Cross-Site Scripting when using the delete template functionality. When an authenticated user deletes a template with a XSS payload in the name field, the Javascript payload will be executed and allow an attacker to access the user’s credentials.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: zinc
product: zinc
Credits: lang: en
value: Mend Vulnerability Research Team (MVR)
Published: 2022-10-06T17:13:36.407Z
CVE-2022-32173 OrchardCore - HTML Injection
In OrchardCore rc1-11259 to v1.2.2 vulnerable to HTML injection, allow an authenticated user with an editor security role to inject a persistent HTML modal dialog component into the dashboard that will affect admin users.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: OrchardCore
product: OrchardCore
Credits: lang: en
value: Mend Vulnerability Research Team (MVR)
Published: 2022-10-03T12:25:08.390Z
CVE-2022-32174 Gogs - XSS
In Gogs, versions v0.6.5 through v0.12.10 are vulnerable to Stored Cross-Site Scripting (XSS) that leads to an account takeover.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: gogs
product: gogs
Credits: lang: en
value: Mend Vulnerability Research Team (MVR)
Published: 2022-10-11T14:20:16.527Z
CVE-2022-32175 AdGuardHome - CSRF
In AdGuardHome, versions v0.95 through v0.108.0-b.13 are vulnerable to Cross-Site Request Forgery (CSRF), in the custom filtering rules functionality. An attacker can persuade an authorized user to follow a malicious link, resulting in deleting/modifying the custom filtering rules.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: AdguardHome
product: AdguardHome
Credits: lang: en
value: Mend Vulnerability Research Team (MVR)
Published: 2022-10-11T14:20:11.178Z
CVE-2022-32176 Gin-vue-admin - Unrestricted File Upload
In "Gin-Vue-Admin", versions v2.5.1 through v2.5.3b are vulnerable to Unrestricted File Upload that leads to execution of javascript code, through the "Compress Upload" functionality to the Media Library. When an admin user views the uploaded file, a low privilege attacker will get access to the admin's cookie leading to account takeover.
Problem types: cwe_id: CWE-434
description: CWE-434 Unrestricted Upload of File with Dangerous Type
Affected products: vendor: gin-vue-admin
product: gin-vue-admin
Credits: lang: en
value: Mend Vulnerability Research Team (MVR)
Published: 2022-10-17T18:25:09.233Z
CVE-2022-32177 Gin-vue-admin - Unrestricted File Upload
In "Gin-Vue-Admin", versions v2.5.1 through v2.5.3beta are vulnerable to Unrestricted File Upload that leads to execution of javascript code, through the 'Normal Upload' functionality to the Media Library. When an admin user views the uploaded file, a low privilege attacker will get access to the admin’s cookie leading to account takeover.
Problem types: cwe_id: CWE-434
description: CWE-434 Unrestricted Upload of File with Dangerous Type
Affected products: vendor: gin-vue-admin
product: gin-vue-admin
Credits: lang: en
value: Mend Vulnerability Research Team (MVR)
Published: 2022-10-14T07:00:14.339Z
CVE-2022-32189 Panic when decoding Float and Rat types in math/big
A too-short encoded message can cause a panic in Float.GobDecode and Rat GobDecode in math/big in Go before 1.17.13 and 1.18.5, potentially allowing a denial of service.
Problem types: description: CWE 400: Uncontrolled Resource Consumption
Affected products: vendor: Go standard library
product: math/big
default_status: unaffected
Credits: lang: en
value: @catenacyber
Published: 2022-08-09T20:17:59.000Z
CVE-2022-32190 Failure to strip relative path components in net/url
JoinPath and URL.JoinPath do not remove ../ path elements appended to a relative path. For example, JoinPath("https://go.dev", "../go") returns the URL "https://go.dev/../go", despite the JoinPath documentation stating that ../ path elements are removed from the result.
Problem types: description: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Go standard library
product: net/url
default_status: unaffected
Credits: lang: en
value: @q0jt
Published: 2022-09-13T17:08:57.000Z
CVE-2022-32192 
Couchbase Server 5.x through 7.x before 7.0.4 exposes Sensitive Information to an Unauthorized Actor.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-13T22:15:07.000Z
CVE-2022-32193 
Couchbase Server 6.6.x through 7.x before 7.0.4 exposes Sensitive Information to an Unauthorized Actor.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-13T20:45:55.000Z
CVE-2022-32195 
Open edX platform before 2022-06-06 allows XSS via the "next" parameter in the logout URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-09T00:36:32.000Z
CVE-2022-32199 
db_convert.php in ScriptCase through 9.9.008 is vulnerable to Arbitrary File Deletion by an admin via a directory traversal sequence in the file parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-03-27T00:00:00.000Z
CVE-2022-32200 
libdwarf 0.4.0 has a heap-based buffer over-read in _dwarf_check_string_valid in dwarf_util.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-01T05:12:58.000Z
CVE-2022-32201 
In libjpeg 1.63, there is a NULL pointer dereference in Component::SubXOf in component.hpp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-01T05:12:47.000Z
CVE-2022-32202 
In libjpeg 1.63, there is a NULL pointer dereference in LineBuffer::FetchRegion in linebuffer.cpp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-01T05:12:37.000Z