rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-3397 OMRON CX-Programmer Out-of-bounds Write
OMRON CX-Programmer 9.78 and prior is vulnerable to an Out-of-Bounds Write, which may allow an attacker to execute arbitrary code.
Problem types: cwe_id: CWE-787
description: CWE-787 Out-of-bounds Write
Affected products: vendor: OMRON
product: CX-Programmer
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
Credits: lang: en
value: Xina1i, working with Trend Micro’s Zero Day Initiative reported these vulnerabilities to CISA.
Published: 2022-10-06T16:14:37.846Z
CVE-2022-3398 OMRON CX-Programmer Out-of-bounds Write
OMRON CX-Programmer 9.78 and prior is vulnerable to an Out-of-Bounds Write, which may allow an attacker to execute arbitrary code.
Problem types: cwe_id: CWE-787
description: CWE-787 Out-of-bounds Write
Affected products: vendor: OMRON
product: CX-Programmer
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
Credits: lang: en
value: Xina1i, working with Trend Micro’s Zero Day Initiative reported these vulnerabilities to CISA.
Published: 2022-10-06T16:14:42.036Z
CVE-2022-3399 Cookie Notice & Compliance for GDPR / CCPA <= 2.4.17.1 - Authenticated (Admin+) Stored Cross-Site Scripting
The Cookie Notice & Compliance for GDPR / CCPA plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cookie_notice_options[refuse_code_head]' parameter in versions up to, and including, 2.4.17.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrative privileges and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the injected /wp-admin/admin.php?page=cookie-notice page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: humanityco
product: Cookie Notice & Compliance for GDPR / CCPA
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
baseScore: 4.4
baseSeverity: MEDIUM
Credits: lang: en
value: c3p0d4y
Published: 2024-08-16T02:31:26.402Z
CVE-2022-3400 
The Bricks theme for WordPress is vulnerable to authorization bypass due to a missing capability check on the bricks_save_post AJAX action in versions 1.0 to 1.5.3. This makes it possible for authenticated attackers with minimal permissions, such as a subscriber, to edit any page, post, or template on the vulnerable WordPress website.
Problem types: description: CWE-862 Missing Authorization
Affected products: vendor: Bricks Builder
product: Bricks
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/A:N/I:H/C:N/S:U/UI:N/PR:L/AC:L/AV:N
baseScore: 6.5
baseSeverity: MEDIUM
Published: 2022-10-28T16:57:41.482Z
CVE-2022-3401 
The Bricks theme for WordPress is vulnerable to remote code execution due to the theme allowing site editors to include executable code blocks in website content in versions 1.2 to 1.5.3. This, combined with the missing authorization vulnerability (CVE-2022-3400), makes it possible for authenticated attackers with minimal permissions, such as a subscriber, can edit any page, post, or template on the vulnerable WordPress website and inject a code execution block that can be used to achieve remote code execution.
Problem types: description: CWE-94 Improper Control of Generation of Code ('Code Injection')
Affected products: vendor: Bricks Builder
product: Bricks
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/A:H/I:H/C:H/S:U/UI:N/PR:L/AC:L/AV:N
baseScore: 8.8
baseSeverity: HIGH
Published: 2022-10-28T18:12:10.719Z
CVE-2022-3402 Log HTTP Requests <= 1.3.1 - Stored Cross-Site Scripting
The Log HTTP Requests plugin for WordPress is vulnerable to Stored Cross-Site Scripting via logged HTTP requests in versions up to, and including, 1.3.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers who can trick a site's administrator into performing an action like clicking on a link, or an authenticated user with access to a page that sends a request using user-supplied data via the server, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: mgibbs189
product: Log HTTP Requests
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
baseScore: 6.1
baseSeverity: MEDIUM
Credits: lang: en
value: Etan Imanol Castro Aldrete
Published: 2022-10-28T18:57:41.609Z
CVE-2022-3405 
Code execution and sensitive information disclosure due to excessive privileges assigned to Acronis Agent. The following products are affected: Acronis Cyber Protect 15 (Windows, Linux) before build 29486, Acronis Cyber Backup 12.5 (Windows, Linux) before build 16545.
Problem types: cwe_id: CWE-269
description: CWE-269
Affected products: vendor: Acronis
product: Acronis Cyber Protect 15
default_status: unaffected
vendor: Acronis
product: Acronis Cyber Backup 12.5
default_status: unaffected
Credits: lang: en
value: Sandro Tolksdorf of usd AG (https://herolab.usd.de)
lang: en
value: @boldglum (https://hackerone.com/boldglum)
Published: 2023-05-03T10:49:47.642Z
CVE-2022-3407 
I some cases, when the device is USB-tethered to a host PC, and the device is sharing its mobile network connection with the host PC, if the user originates a call on the device, then the device's modem may reset and cause the phone call to not succeed.  This may block the user from dialing emergency services.  This patch resolves the device's modem reset issue.
Problem types: cwe_id: CWE-404
description: CWE-404 Improper Resource Shutdown or Release
Affected products: vendor: Motorola Mobility
product: Motorola smartphones
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: PHYSICAL
availabilityImpact: HIGH
baseScore: 4.9
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:P/AC:L/PR:L/UI:R/S:C/C:N/I:N/A:H
version: 3.1
Published: 2023-09-01T16:42:00.677Z
CVE-2022-3408 WP Word Count <= 3.2.3 - Admin+ Stored Cross-Site Scripting
The WP Word Count WordPress plugin through 3.2.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: WP Word Count
Credits: lang: en
value: lucy
Published: 2022-10-31T00:00:00.000Z
CVE-2022-3409 Unauthenticated out of bounds stack write in bmcweb
A vulnerability in bmcweb of OpenBMC Project allows user to cause denial of service. This vulnerability was identified during mitigation for CVE-2022-2809. When fuzzing the multipart_parser code using AFL++ with address sanitizer enabled to find smallest memory corruptions possible. It detected problem in how multipart_parser handles unclosed http headers. If long enough http header is passed in the multipart form without colon there is one byte overwrite on heap. It can be conducted multiple times in a loop to cause DoS.
Problem types: cwe_id: CWE-121
description: CWE-121: Stack-based Buffer Overflow
cwe_id: CWE-229
description: CWE-229: Improper Handling of Values
Affected products: vendor: OpenBMC Project
product: OpenBMC
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: LOW
availabilityImpact: HIGH
baseScore: 8.2
baseSeverity: HIGH
Credits: lang: en
value: Finder: Jakub Rozanski, Intel Corporation
lang: en
value: Remediation: Krzysztof Grobelny, Intel Corporation
Published: 2022-10-27T13:09:19.716Z
CVE-2022-3411 
A lack of length validation in GitLab CE/EE affecting all versions from 12.4 before 15.6.7, 15.7 before 15.7.6, and 15.8 before 15.8.1 allows an authenticated attacker to create a large Issue description via GraphQL which, when repeatedly requested, saturates CPU usage.
Problem types: description: Uncontrolled resource consumption in GitLab
Affected products: vendor: GitLab
product: GitLab
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
Credits: lang: en
value: Thanks [cryptopone](https://hackerone.com/cryptopone) for reporting this vulnerability through our HackerOne bug bounty program
Published: 2023-02-13T00:00:00.000Z
CVE-2022-3413 
Incorrect authorization during display of Audit Events in GitLab EE affecting all versions from 14.5 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2, allowed Developers to view the project's Audit Events and Developers or Maintainers to view the group's Audit Events. These should have been restricted to Project Maintainers, Group Owners, and above.
Problem types: description: Incorrect authorization in GitLab
Affected products: vendor: GitLab
product: GitLab
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
Credits: lang: en
value: This vulnerability has been discovered internally by the GitLab team
Published: 2022-11-09T00:00:00.000Z
CVE-2022-3414 SourceCodester Web-Based Student Clearance System POST Parameter login.php sql injection
A vulnerability was found in SourceCodester Web-Based Student Clearance System. It has been classified as critical. Affected is an unknown function of the file /Admin/login.php of the component POST Parameter Handler. The manipulation of the argument txtusername leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-210246 is the identifier assigned to this vulnerability.
Problem types: cwe_id: CWE-707
description: CWE-707 Improper Neutralization -> CWE-74 Injection -> CWE-89 SQL Injection
Affected products: vendor: SourceCodester
product: Web-Based Student Clearance System
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: LOW
baseScore: 5
baseSeverity: MEDIUM
Published: 2022-10-07T00:00:00.000Z
CVE-2022-3415 Chat Bubble < 2.3 - Unauthenticated Stored Cross-Site Scripting
The Chat Bubble WordPress plugin before 2.3 does not sanitise and escape some contact parameters, which could allow unauthenticated attackers to set Stored Cross-Site Scripting payloads in them, which will trigger when an admin view the related contact message
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Chat Bubble – Floating Chat with Contact Chat Icons, Messages, Telegram, Email, SMS, Call me back
Credits: lang: en
value: Juampa Rodríguez
Published: 2022-11-14T00:00:00.000Z
CVE-2022-3416 WPtouch < 4.3.45 - Admin+ Arbitrary File Upload
The WPtouch WordPress plugin before 4.3.45 does not properly validate images to be uploaded, allowing high privilege users such as admin to upload arbitrary files on the server even when they should not be allowed to (for example in multisite setup)
Problem types: description: CWE-434 Unrestricted Upload of File with Dangerous Type
Affected products: vendor: Unknown
product: WPtouch
default_status: unaffected
Credits: lang: en
value: Nguyen Duy Quoc Khanh
lang: en
value: WPScan
Published: 2023-01-09T22:13:28.101Z
CVE-2022-3417 WPtouch < 4.3.45 - Admin+ PHP Object Injection
The WPtouch WordPress plugin before 4.3.45 unserialises the content of an imported settings file, which could lead to PHP object injections issues when an user import (intentionally or not) a malicious settings file and a suitable gadget chain is present on the blog.
Problem types: description: CWE-502 Deserialization of Untrusted Data
Affected products: vendor: Unknown
product: WPtouch
default_status: unaffected
Credits: lang: en
value: Nguyen Duy Quoc Khanh
lang: en
value: WPScan
Published: 2023-01-09T22:13:31.413Z
CVE-2022-3418 WP All Import < 3.6.9 - Admin+ Arbitrary File Upload to RCE
The Import any XML or CSV File to WordPress plugin before 3.6.9 is not properly filtering which file extensions are allowed to be imported on the server, which could allow administrators in multi-site WordPress installations to upload arbitrary files
Problem types: cwe_id: CWE-94
description: CWE-94 Improper Control of Generation of Code ('Code Injection')
Affected products: vendor: Unknown
product: Import any XML or CSV File to WordPress
Credits: lang: en
value: lucy
Published: 2022-11-07T00:00:00.000Z
CVE-2022-3419 Automatic User Roles Switcher < 1.1.2 - Subscriber+ Privilege Escalation
The Automatic User Roles Switcher WordPress plugin before 1.1.2 does not have authorisation and proper CSRF checks, allowing any authenticated users like subscriber to add any role to themselves, such as administrator
Problem types: cwe_id: CWE-269
description: CWE-269 Improper Privilege Management
cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: Automatic User Roles Switcher
Credits: lang: en
value: WPScan
Published: 2022-10-31T00:00:00.000Z
CVE-2022-3420 Official Integration for Billingo < 3.4.0 - ShopManager+ Stored XSS
The Official Integration for Billingo WordPress plugin before 3.4.0 does not sanitise and escape some of its settings, which could allow high privilege users with a role as low as Shop Manager to perform Stored Cross-Site Scripting attacks.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Official Integration for Billingo
Credits: lang: en
value: Lana Codes
Published: 2022-10-31T00:00:00.000Z
CVE-2022-3421 Privilege escalation in Google Drive for Desktop on MacOS
An attacker can pre-create the `/Applications/Google\ Drive.app/Contents/MacOS` directory which is expected to be owned by root to be owned by a non-root user. When the Drive for Desktop installer is run for the first time, it will place a binary in that directory with execute permissions and set its setuid bit. Since the attacker owns the directory, the attacker can replace the binary with a symlink, causing the installer to set the setuid bit on the symlink. When the symlink is executed, it will run with root permissions. We recommend upgrading past version 64.0
Problem types: cwe_id: CWE-264
description: CWE-264 Permissions, Privileges, and Access Controls
Affected products: vendor: Google LLC
product: Drive for Desktop MacOS
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:L
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: HIGH
availabilityImpact: LOW
baseScore: 5.6
baseSeverity: MEDIUM
Published: 2022-10-17T00:00:00.000Z
CVE-2022-3422 Improper Privilege Management in tooljet/tooljet
Account Takeover :: when see the info i can see the hash pass i can creaked it ............... Account Takeover :: when see the info i can see the forgot_password_token the hacker can send the request and changed the pass
Problem types: cwe_id: CWE-269
description: CWE-269 Improper Privilege Management
Affected products: vendor: tooljet
product: tooljet/tooljet
Published: 2022-10-07T00:00:00.000Z
CVE-2022-3423 Allocation of Resources Without Limits or Throttling in nocodb/nocodb
Allocation of Resources Without Limits or Throttling in GitHub repository nocodb/nocodb prior to 0.92.0.
Problem types: cwe_id: CWE-770
description: CWE-770 Allocation of Resources Without Limits or Throttling
Affected products: vendor: nocodb
product: nocodb/nocodb
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.3
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:H
version: 3.1
Published: 2022-10-07T00:00:00.000Z
CVE-2022-3424 
A use-after-free flaw was found in the Linux kernel’s SGI GRU driver in the way the first gru_file_unlocked_ioctl function is called by the user, where a fail pass occurs in the gru_check_chiplet_assignment function. This flaw allows a local user to crash or potentially escalate their privileges on the system.
Problem types: cwe_id: CWE-416
description: CWE-416
Affected products: vendor: n/a
product: kernel
Published: 2023-03-06T00:00:00.000Z
CVE-2022-3425 Google Analyticator < 6.5.6 - Admin+ PHP Object Injection
The Analyticator WordPress plugin before 6.5.6 unserializes user input provided via the settings, which could allow high-privilege users such as admin to perform PHP Object Injection when a suitable gadget is present.
Problem types: description: CWE-502 Deserialization of Untrusted Data
Affected products: vendor: Unknown
product: Analyticator
default_status: unaffected
Credits: lang: en
value: Nguyễn Phạm VIệt Nam
lang: en
value: WPScan
Published: 2023-01-23T14:31:44.767Z
CVE-2022-3426 Advanced WP Columns <= 2.0.6 - Admin+ Stored Cross-Site Scripting
The Advanced WP Columns WordPress plugin through 2.0.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Advanced WP Columns
default_status: affected
Credits: lang: en
value: lucy
Published: 2022-12-05T16:50:34.151Z
CVE-2022-3427 Corner Ad <= 1.0.56 - Cross-Site Request Forgery
The Corner Ad plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.56. This is due to missing or incorrect nonce validation on its corner_ad_settings_page function. This makes it possible for unauthenticated attackers to trigger the deletion of ads via forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: codepeople
product: Corner Ad
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
baseScore: 8.8
baseSeverity: HIGH
Credits: lang: en
value: Marco Wotschka
Published: 2022-12-15T04:02:40.319Z
CVE-2022-3429 
A denial-of-service vulnerability was found in the firmware used in Lenovo printers, where users send illegal or malformed strings to an open port, triggering a denial of service that causes a display error and prevents the printer from functioning properly.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Lenovo
product: Printer GM265DN (production date June 2022 and before)
default_status: unaffected
vendor: Lenovo
product: Printer GM265DN (production date July 2022 and later)
default_status: unaffected
vendor: Lenovo
product: Printer GM266DNS
default_status: unaffected
vendor: Lenovo
product: Printer G263DNS
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2023-10-27T18:57:50.748Z
CVE-2022-3430 
A potential vulnerability in the WMI Setup driver on some consumer Lenovo Notebook devices may allow an attacker with elevated privileges to modify secure boot setting by modifying an NVRAM variable.
Problem types: cwe_id: CWE-276
description: CWE-276 Incorrect Default Permissions
Affected products: vendor: Lenovo
product: BIOS
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.7
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Lenovo thanks Martin Smolár from ESET for reporting these issues.
Published: 2023-01-23T16:11:41.102Z
CVE-2022-3431 
A potential vulnerability in a driver used during manufacturing process on some consumer Lenovo Notebook devices that was mistakenly not deactivated may allow an attacker with elevated privileges to modify secure boot setting by modifying an NVRAM variable.
Problem types: cwe_id: CWE-276
description: CWE-276 Incorrect Default Permissions
Affected products: vendor: Lenovo
product: BIOS
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.7
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Lenovo thanks Martin Smolár from ESET for reporting these issues.
Published: 2023-10-09T18:18:54.016Z
CVE-2022-3432 
A potential vulnerability in a driver used during manufacturing process on the Ideapad Y700-14ISK that was mistakenly not deactivated may allow an attacker with elevated privileges to modify secure boot setting by modifying an NVRAM variable.
Problem types: cwe_id: CWE-276
description: CWE-276 Incorrect Default Permissions
Affected products: vendor: Lenovo
product: BIOS
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.7
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Lenovo thanks Martin Smolár from ESET for reporting these issues.
Published: 2023-01-23T16:27:12.970Z
CVE-2022-3433 
The aeson library is not safe to use to consume untrusted JSON input. A remote user could abuse this flaw to produce a hash collision in the underlying unordered-containers library by sending specially crafted JSON data, resulting in a denial of service.
Problem types: cwe_id: CWE-328
description: CWE-328->CWE-400
Affected products: vendor: n/a
product: aeson
Published: 2022-10-10T00:00:00.000Z