rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-4143 
An issue has been discovered in GitLab affecting all versions starting from 15.7 before 15.8.5, from 15.9 before 15.9.4, and from 15.10 before 15.10.1 that allows for crafted, unapproved MRs to be introduced and merged without authorization
Problem types: description: Time-of-check time-of-use (toctou) race condition in GitLab
Affected products: vendor: GitLab
product: GitLab
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: NONE
baseScore: 6.4
baseSeverity: MEDIUM
Credits: lang: en
value: Thanks [zzyzxd](https://hackerone.com/zzyzxd) for reporting this vulnerability through our HackerOne bug bounty program
Published: 2023-06-28T00:00:00.000Z
CVE-2022-4144 
An out-of-bounds read flaw was found in the QXL display device emulation in QEMU. The qxl_phys2virt() function does not check the size of the structure pointed to by the guest physical address, potentially reading past the end of the bar space into adjacent pages. A malicious guest user could use this flaw to crash the QEMU process on the host causing a denial of service condition.
Problem types: cwe_id: CWE-125
description: CWE-125
Affected products: vendor: n/a
product: QEMU (QXL device)
Published: 2022-11-29T00:00:00.000Z
CVE-2022-4145 Content spoofing
A content spoofing flaw was found in OpenShift's OAuth endpoint. This flaw allows a remote, unauthenticated attacker to inject text into a webpage, enabling the obfuscation of a phishing operation.
Problem types: cwe_id: CWE-74
description: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Affected products: vendor: n/a
product: openshift
default_status: affected
vendor: Red Hat
product: Red Hat OpenShift Container Platform 4
cpes: cpe:/a:redhat:openshift:4
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: This issue was discovered by John Mazzitelli (Red Hat).
Published: 2023-10-05T12:34:57.523Z
CVE-2022-4146 EL Injection Vulnerability in Hitachi Replication Manager
Expression Language Injection vulnerability in Hitachi Replication Manager on Windows, Linux, Solaris allows Code Injection.This issue affects Hitachi Replication Manager: before 8.8.5-02.


Problem types: cwe_id: CWE-917
description: CWE-917 Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')
Affected products: vendor: Hitachi
product: Hitachi Replication Manager
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.3
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
version: 3.1
Published: 2023-07-18T02:01:04.391Z
CVE-2022-4147 
Quarkus CORS filter allows simple GET and POST requests with invalid Origin to proceed. Simple GET or POST requests made with XMLHttpRequest are the ones which have no event listeners registered on the object returned by the XMLHttpRequest upload property and have no ReadableStream object used in the request.
Problem types: cwe_id: CWE-1026
description: CWE-1026
Affected products: vendor: n/a
product: quarkus-2
Published: 2022-12-06T00:00:00.000Z
CVE-2022-4148 WP OAuth Server < 4.3.0 - Subscriber+ Arbitrary Client Deletion
The WP OAuth Server (OAuth Authentication) WordPress plugin before 4.3.0 has a flawed CSRF and authorisation check when deleting a client, which could allow any authenticated users, such as subscriber to delete arbitrary client.
Problem types: description: CWE-862 Missing Authorization
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: WP OAuth Server (OAuth Authentication)
default_status: unaffected
Credits: lang: en
value: Lana Codes
lang: en
value: WPScan
Published: 2023-03-20T15:52:20.188Z
CVE-2022-4149 Local privilege escalation using log file
The Netskope client service (prior to R96) on Windows runs as NT AUTHORITY\SYSTEM which writes log files to a writable directory (C:\Users\Public\netSkope) for a standard user. The files are created and written with a SYSTEM account except one file (logplaceholder) which inherits permission giving all users full access control list. Netskope client restricts access to this file by allowing only read permissions as a standard user. Whenever the Netskope client service restarts, it deletes the logplaceholder and recreates, creating a race condition, which can be exploited by a malicious local user to create the file and set ACL permissions on the file. Once the file is created by a malicious user with proper ACL permissions, all files within C:\Users\Public\netSkope\ becomes modifiable by the unprivileged user. By using Windows pseudo-symlink, these files can be pointed to other places in the system and thus malicious users will be able to elevate privileges.

Problem types: cwe_id: CWE-367
description: CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition
Affected products: vendor: Netskope
product: Netskope Client
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Netskope credits Dawson Medin from Mandiant for reporting this flaw.
Published: 2023-06-15T06:44:25.434Z
CVE-2022-4150 Contest Gallery < 19.1.5 - Author+ SQL Injection
The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the option_id POST parameter before concatenating it to an SQL query in order-custom-fields-with-and-without-search.php. This may allow malicious users with at least author privilege to leak sensitive information from the site's database.
Problem types: description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Contest Gallery
default_status: unaffected
vendor: Unknown
product: Contest Gallery Pro
default_status: unaffected
Credits: lang: en
value: Kunal Sharma (University of Kaiserslautern)
lang: en
value: Daniel Krohmer (Fraunhofer IESE)
lang: en
value: WPScan
Published: 2022-12-26T12:28:03.526Z
CVE-2022-4151 Contest Gallery < 19.1.5 - Admin+ SQL Injection
The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the option_id GET parameter before concatenating it to an SQL query in export-images-data.php. This may allow malicious users with at least author privilege to leak sensitive information from the site's database.
Problem types: description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Contest Gallery
default_status: unaffected
vendor: Unknown
product: Contest Gallery Pro
default_status: unaffected
Credits: lang: en
value: Kunal Sharma (University of Kaiserslautern)
lang: en
value: Daniel Krohmer (Fraunhofer IESE)
lang: en
value: WPScan
Published: 2022-12-26T12:28:16.819Z
CVE-2022-4152 Contest Gallery < 19.1.5 - Author+ SQL Injection
The Contest Gallery WordPress plugin before 19.1.5, Contest Gallery Pro WordPress plugin before 19.1.5 do not escape the option_id POST parameter before concatenating it to an SQL query in edit-options.php. This may allow malicious users with at least author privilege to leak sensitive information from the site's database.
Problem types: description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Contest Gallery
default_status: unaffected
vendor: Unknown
product: Contest Gallery Pro
default_status: unaffected
Credits: lang: en
value: Kunal Sharma (University of Kaiserslautern)
lang: en
value: Daniel Krohmer (Fraunhofer IESE)
lang: en
value: WPScan
Published: 2022-12-26T12:28:15.254Z
CVE-2022-4153 Contest Gallery < 19.1.5.1 - Author+ SQL Injection
The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the upload[] POST parameter before concatenating it to an SQL query in get-data-create-upload-v10.php. This may allow malicious users with at least author privilege to leak sensitive information from the site's database.
Problem types: description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Contest Gallery
default_status: unaffected
vendor: Unknown
product: Contest Gallery Pro
default_status: unaffected
Credits: lang: en
value: Kunal Sharma (University of Kaiserslautern)
lang: en
value: Daniel Krohmer (Fraunhofer IESE)
lang: en
value: WPScan
Published: 2022-12-26T12:27:56.990Z
CVE-2022-4154 Contest Gallery Pro < 19.1.5 - Admin+ SQL Injection
The Contest Gallery Pro WordPress plugin before 19.1.5 does not escape the wp_user_id GET parameter before concatenating it to an SQL query in management-show-user.php. This may allow malicious users with at administrator privileges (i.e. on multisite WordPress configurations) to leak sensitive information from the site's database.
Problem types: description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Contest Gallery Pro
default_status: unaffected
Credits: lang: en
value: Kunal Sharma (University of Kaiserslautern)
lang: en
value: Daniel Krohmer (Fraunhofer IESE)
lang: en
value: WPScan
Published: 2022-12-26T12:28:05.877Z
CVE-2022-4155 Contest Gallery < 19.1.5 - Admin+ SQL Injection
The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the wp_user_id GET parameter before concatenating it to an SQL query in management-show-user.php. This may allow malicious users with administrator privileges (i.e. on multisite WordPress configurations) to leak sensitive information from the site's database.
Problem types: description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Contest Gallery
default_status: unaffected
vendor: Unknown
product: Contest Gallery Pro
default_status: unaffected
Credits: lang: en
value: Kunal Sharma (University of Kaiserslautern)
lang: en
value: Daniel Krohmer (Fraunhofer IESE)
lang: en
value: WPScan
Published: 2022-12-26T12:27:58.593Z
CVE-2022-4156 Contest Gallery < 19.1.5.1 - Unauthenticated SQL Injection
The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the user_id POST parameter before concatenating it to an SQL query in ajax-functions-backend.php. This may allow malicious users with at least author privilege to leak sensitive information from the site's database.
Problem types: description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Contest Gallery
default_status: unaffected
vendor: Unknown
product: Contest Gallery Pro
default_status: unaffected
Credits: lang: en
value: Kunal Sharma (University of Kaiserslautern)
lang: en
value: Daniel Krohmer (Fraunhofer IESE)
lang: en
value: WPScan
Published: 2022-12-26T12:28:07.463Z
CVE-2022-4157 Contest Gallery < 19.1.5 - Admin+ SQL Injection
The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the cg_option_id POST parameter before concatenating it to an SQL query in export-votes-all.php. This may allow malicious users with administrator privileges (i.e. on multisite WordPress configurations) to leak sensitive information from the site's database.
Problem types: description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Contest Gallery
default_status: unaffected
vendor: Unknown
product: Contest Gallery Pro
default_status: unaffected
Credits: lang: en
value: Kunal Sharma (University of Kaiserslautern)
lang: en
value: Daniel Krohmer (Fraunhofer IESE)
lang: en
value: WPScan
Published: 2022-12-26T12:27:57.791Z
CVE-2022-4158 Contest Gallery < 19.1.5 - Unauthenticated SQL Injection
The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the cg_Fields POST parameter before concatenating it to an SQL query in users-registry-check-registering-and-login.php. This may allow malicious visitors to leak sensitive information from the site's database.
Problem types: description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Contest Gallery
default_status: unaffected
vendor: Unknown
product: Contest Gallery Pro
default_status: unaffected
Credits: lang: en
value: Kunal Sharma (University of Kaiserslautern)
lang: en
value: Daniel Krohmer (Fraunhofer IESE)
lang: en
value: WPScan
Published: 2022-12-26T12:28:02.718Z
CVE-2022-4159 Contest Gallery < 19.1.5.1 - Author+ SQL Injection
The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the cg_id POST parameter before concatenating it to an SQL query in 0_change-gallery.php. This may allow malicious users with at least author privilege to leak sensitive information from the site's database.
Problem types: description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Contest Gallery
default_status: unaffected
vendor: Unknown
product: Contest Gallery Pro
default_status: unaffected
Credits: lang: en
value: Kunal Sharma (University of Kaiserslautern)
lang: en
value: Daniel Krohmer (Fraunhofer IESE)
lang: en
value: WPScan
Published: 2022-12-26T12:28:16.037Z
CVE-2022-4160 Contest Gallery < 19.1.5 - Author+ SQL Injection
The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the cg_copy_id POST parameter before concatenating it to an SQL query in  cg-copy-comments.php and cg-copy-rating.php. This may allow malicious users with at least author privilege to leak sensitive information from the site's database.
Problem types: description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Contest Gallery
default_status: unaffected
vendor: Unknown
product: Contest Gallery Pro
default_status: unaffected
Credits: lang: en
value: Kunal Sharma (University of Kaiserslautern)
lang: en
value: Daniel Krohmer (Fraunhofer IESE)
lang: en
value: WPScan
Published: 2022-12-26T12:28:17.582Z
CVE-2022-4161 Contest Gallery < 19.1.5 - Author+ SQL Injection
The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the cg_copy_start POST parameter before concatenating it to an SQL query in copy-gallery-images.php. This may allow malicious users with at least author privilege to leak sensitive information from the site's database.
Problem types: description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Contest Gallery
default_status: unaffected
vendor: Unknown
product: Contest Gallery Pro
default_status: unaffected
Credits: lang: en
value: Kunal Sharma (University of Kaiserslautern)
lang: en
value: Daniel Krohmer (Fraunhofer IESE)
lang: en
value: WPScan
Published: 2022-12-26T12:27:55.419Z
CVE-2022-4162 Contest Gallery < 19.1.5 - Author+ SQL Injection
The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the cg_row POST parameter before concatenating it to an SQL query in 3_row-order.php. This may allow malicious users with at least author privilege to leak sensitive information from the site's database.
Problem types: description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Contest Gallery
default_status: unaffected
vendor: Unknown
product: Contest Gallery Pro
default_status: unaffected
Credits: lang: en
value: Kunal Sharma (University of Kaiserslautern)
lang: en
value: Daniel Krohmer (Fraunhofer IESE)
lang: en
value: WPScan
Published: 2022-12-26T12:28:10.597Z
CVE-2022-4163 Contest Gallery < 19.1.5 - Author+ SQL Injection
The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the cg_deactivate and cg_activate POST parameters before concatenating it to an SQL query in  2_deactivate.php and 4_activate.php, respectively. This may allow malicious users with at least author privilege to leak sensitive information from the site's database.
Problem types: description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Contest Gallery
default_status: unaffected
vendor: Unknown
product: Contest Gallery Pro
default_status: unaffected
Credits: lang: en
value: Kunal Sharma (University of Kaiserslautern)
lang: en
value: Daniel Krohmer (Fraunhofer IESE)
lang: en
value: WPScan
Published: 2022-12-26T12:28:05.085Z
CVE-2022-4164 Contest Gallery < 19.1.5 - Author+ SQL Injection
The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the cg_multiple_files_for_post POST parameter before concatenating it to an SQL query in 0_change-gallery.php. This may allow malicious users with at least author privilege to leak sensitive information from the site's database.
Problem types: description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Contest Gallery
default_status: unaffected
vendor: Unknown
product: Contest Gallery Pro
default_status: unaffected
Credits: lang: en
value: Kunal Sharma (University of Kaiserslautern)
lang: en
value: Daniel Krohmer (Fraunhofer IESE)
lang: en
value: WPScan
Published: 2022-12-26T12:28:09.824Z
CVE-2022-4165 Contest Gallery < 19.1.5 - Author+ SQL Injection
The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the cg_order POST parameter before concatenating it to an SQL query in order-custom-fields-with-and-without-search.php. This may allow malicious users with at least author privilege to leak sensitive information from the site's database.
Problem types: description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Contest Gallery
default_status: unaffected
vendor: Unknown
product: Contest Gallery Pro
default_status: unaffected
Credits: lang: en
value: Kunal Sharma (University of Kaiserslautern)
lang: en
value: Daniel Krohmer (Fraunhofer IESE)
lang: en
value: WPScan
Published: 2022-12-26T12:28:01.816Z
CVE-2022-4166 Contest Gallery < 19.1.5 - Author+ SQL Injection
The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the addCountS POST parameter before concatenating it to an SQL query in 4_activate.php. This may allow malicious users with at least author privilege to leak sensitive information from the site's database.
Problem types: description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Contest Gallery
default_status: unaffected
vendor: Unknown
product: Contest Gallery Pro
default_status: unaffected
Credits: lang: en
value: Kunal Sharma (University of Kaiserslautern)
lang: en
value: Daniel Krohmer (Fraunhofer IESE)
lang: en
value: WPScan
Published: 2022-12-26T12:28:04.308Z
CVE-2022-4167 
Incorrect Authorization check affecting all versions of GitLab EE from 13.11 prior to 15.5.7, 15.6 prior to 15.6.4, and 15.7 prior to 15.7.2 allows group access tokens to continue working even after the group owner loses the ability to revoke them.
Problem types: description: Improper authorization in GitLab
Affected products: vendor: GitLab
product: GitLab
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
Credits: lang: en
value: This vulnerability was reported to us by a customer
Published: 2023-01-12T00:00:00.000Z
CVE-2022-4169 Theme and plugin translation for Polylang <= 3.2.16 - Missing Authorization
The Theme and plugin translation for Polylang is vulnerable to authorization bypass in versions up to, and including, 3.2.16 due to missing capability checks in the process_polylang_theme_translation_wp_loaded() function. This makes it possible for unauthenticated attackers to update plugin and theme translation settings and to import translation strings.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: marcinkazmierski
product: Theme and plugin translation for Polylang (TTfP)
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
baseScore: 6.5
baseSeverity: MEDIUM
Credits: lang: en
value: Florent BESNARD
Published: 2022-11-28T17:33:31.980Z
CVE-2022-4170 
The rxvt-unicode package is vulnerable to a remote code execution, in the Perl background extension, when an attacker can control the data written to the user's terminal and certain options are set.
Problem types: cwe_id: CWE-74
description: CWE-74
Affected products: vendor: n/a
product: rxvt-unicode
Published: 2022-12-09T00:00:00.000Z
CVE-2022-4171 demon image annotation <= 5.0 - Improper Input Restriction Validation
The demon image annotation plugin for WordPress is vulnerable to improper input validation in versions up to, and including 5.0. This is due to the plugin improperly validating the number of characters supplied during an annotation despite there being a setting to limit the number characters input. This means that unauthenticated attackers can bypass the length restrictions and input more characters than allowed via the settings.
Problem types: cwe_id: CWE-1284
description: CWE-1284 Improper Validation of Specified Quantity in Input
Affected products: vendor: demonisblack
product: demon image annotation
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
baseScore: 6.5
baseSeverity: MEDIUM
Credits: lang: en
value: Ori Gabriel
Published: 2022-12-13T20:16:52.649Z
CVE-2022-4172 
An integer overflow and buffer overflow issues were found in the ACPI Error Record Serialization Table (ERST) device of QEMU in the read_erst_record() and write_erst_record() functions. Both issues may allow the guest to overrun the host buffer allocated for the ERST memory device. A malicious guest could use these flaws to crash the QEMU process on the host.
Problem types: cwe_id: CWE-120
description: CWE-120, CWE-190
Affected products: vendor: n/a
product: QEMU (ACPI ERST)
Published: 2022-11-29T00:00:00.000Z
CVE-2022-4173 Avast and AVG Antivirus for Windows vulnerable to Privilege Escalation
A vulnerability within the malware removal functionality of Avast and AVG Antivirus allowed an attacker with write access to the filesystem, to escalate his privileges in certain scenarios. The issue was fixed with Avast and AVG Antivirus version 22.10.

Problem types: cwe_id: CWE-269
description: CWE-269 Improper Privilege Management
Affected products: vendor: NortonLifeLock
product: Avast and AVG Antivirus
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.3
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Published: 2022-12-05T23:15:33.724Z
CVE-2022-4174 
Type confusion in V8 in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Problem types: description: Type Confusion
Affected products: vendor: Google
product: Chrome
Published: 2022-11-29T00:00:00.000Z
CVE-2022-4175 
Use after free in Camera Capture in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Problem types: description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2022-11-29T00:00:00.000Z