rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-24931 
Improper access control vulnerability in dynamic receiver in ApkInstaller prior to SMR MAR-2022 Release allows unauthorized attackers to execute arbitrary activity without a proper permission
Problem types: cwe_id: CWE-269
description: CWE-269: Improper Privilege Management
Affected products: vendor: Samsung Mobile
product: Samsung Mobile Devices
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 7.9
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L
version: 3.1
Published: 2022-03-08T13:46:31.000Z
CVE-2022-24932 
Improper Protection of Alternate Path vulnerability in Setup wizard process prior to SMR Mar-2022 Release 1 allows physical attacker package installation before finishing Setup wizard.
Problem types: cwe_id: CWE-424
description: CWE-424: Improper Protection of Alternate Path
Affected products: vendor: Samsung Mobile
product: Samsung Mobile Devices
vendor: Samsung Mobile
product: Samsung Clould
CVSS v3.1: attackComplexity: HIGH
attackVector: PHYSICAL
availabilityImpact: NONE
baseScore: 4.2
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
version: 3.1
Published: 2022-03-08T13:46:36.000Z
CVE-2022-24934 
wpsupdater.exe in Kingsoft WPS Office through 11.2.0.10382 allows remote code execution by modifying HKEY_CURRENT_USER in the registry.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-23T21:19:54.000Z
CVE-2022-24935 
Lexmark products through 2022-02-10 have Incorrect Access Control.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-28T12:42:11.000Z
CVE-2022-24936 Gecko Standalone Bootloader vulnerability may allow bypassing application secure boot in some Series 2 devices
Out-of-Bounds error in GBL parser in Silicon Labs Gecko Bootloader version 4.0.1 and earlier allows attacker to overwrite flash Sign key and OTA decryption key via malicious bootloader upgrade.
Problem types: cwe_id: CWE-119
description: CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
Affected products: vendor: silabs.com
product: Gecko Bootloader
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 8.3
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
version: 3.1
Published: 2022-11-02T17:25:38.758Z
CVE-2022-24937 Malformed Zigbee packet causes Assert in EmberZNet 7.0.0 or earlier
Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Silicon Labs Ember ZNet allows Overflow Buffers.
Problem types: cwe_id: CWE-119
description: CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
Affected products: vendor: Silicon Labs
product: Ember ZNet
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2022-11-14T17:22:55.243Z
CVE-2022-24938 Malformed Zigbee packet causes Assert in EmberZNet 7.0.1 or earlier

A malformed packet causes a stack overflow in the Ember ZNet stack. This causes an assert which leads to a reset, immediately clearing the error.


Problem types: cwe_id: CWE-119
description: CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
Affected products: vendor: silabs.com
product: Ember ZNet
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2022-11-14T17:37:05.048Z
CVE-2022-24939  Malformed Zigbee packet with invalid destination address causes Assert 

 A malformed packet containing an invalid destination address, causes a stack overflow in the Ember ZNet stack. This causes an assert which leads to a reset, immediately clearing the error.


Problem types: cwe_id: CWE-119
description: CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
Affected products: vendor: silabs.com
product: Ember ZNet
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 5.7
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2022-11-17T23:35:55.522Z
CVE-2022-24942 Heap-based buffer overflow in MicriumOS HTTP Server allows potential remote code execution

Heap based buffer overflow in HTTP Server functionality in Micrium uC-HTTP 3.01.01 allows remote code execution via HTTP request.


Problem types: cwe_id: CWE-122
description: CWE-122 Heap-based Buffer Overflow
Affected products: vendor: silabs.com
product: Gecko Platform
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.1
baseSeverity: CRITICAL
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
version: 3.1
Published: 2022-11-02T21:04:45.822Z
CVE-2022-24946 
Improper Resource Locking vulnerability in Mitsubishi Electric MELSEC iQ-R Series R12CCPU-V firmware versions "16" and prior, Mitsubishi Electric MELSEC-Q Series Q03UDECPU the first 5 digits of serial No. "24061" and prior, Mitsubishi Electric MELSEC-Q Series Q04/06/10/13/20/26/50/100UDEHCPU the first 5 digits of serial No. "24061" and prior, Mitsubishi Electric MELSEC-Q Series Q03/04/06/13/26UDVCPU the first 5 digits of serial number "24051" and prior, Mitsubishi Electric MELSEC-Q Series Q04/06/13/26UDPVCPU the first 5 digits of serial number "24051" and prior, Mitsubishi Electric MELSEC-Q Series Q12DCCPU-V all versions, Mitsubishi Electric MELSEC-Q Series Q24DHCCPU-V(G) all versions, Mitsubishi Electric MELSEC-Q Series Q24/26DHCCPU-LS all versions, Mitsubishi Electric MELSEC-L series L02/06/26CPU(-P) the first 5 digits of serial number "24051" and prior, Mitsubishi Electric MELSEC-L series L26CPU-(P)BT the first 5 digits of serial number "24051" and prior and Mitsubishi Electric MELIPC Series MI5122-VW firmware versions "05" and prior allows a remote unauthenticated attacker to cause a denial of service (DoS) condition in Ethernet communications by sending specially crafted packets. A system reset of the products is required for recovery.
Problem types: description: Improper Resource Locking
Affected products: vendor: n/a
product: Mitsubishi Electric MELSEC iQ-R Series R12CCPU-V; Mitsubishi Electric MELSEC-Q Series Q03UDECPU; Mitsubishi Electric MELSEC-Q Series Q04/06/10/13/20/26/50/100UDEHCPU; Mitsubishi Electric MELSEC-Q Series Q03/04/06/13/26UDVCPU; Mitsubishi Electric MELSEC-Q Series Q04/06/13/26UDPVCPU; Mitsubishi Electric MELSEC-Q Series Q12DCCPU-V; Mitsubishi Electric MELSEC-Q Series Q24DHCCPU-V(G); Mitsubishi Electric MELSEC-Q Series Q24/26DHCCPU-LS; Mitsubishi Electric MELSEC-L series L02/06/26CPU(-P); Mitsubishi Electric MELSEC-L series L26CPU-(P)BT; Mitsubishi Electric MELIPC Series MI5122-VW
Published: 2022-06-15T20:18:35.000Z
CVE-2022-24947 Apache JSPWiki CSRF Account Takeover
Apache JSPWiki user preferences form is vulnerable to CSRF attacks, which can lead to account takeover. Apache JSPWiki users should upgrade to 2.11.2 or later.
Problem types: description: CSRF Account Takeover
Affected products: vendor: Apache Software Foundation
product: Apache JSPWiki
Credits: lang: en
value: This issue was discovered initially by Cristian Borlovan from Ounce Labs Security (ref. JSPWIKI-79), and later on and independently from this by Paulos Yibelo, from Octagon Networks.
Published: 2022-02-25T08:30:18.000Z
CVE-2022-24948 Apache JSPWiki Cross-site scripting vulnerability on User Preferences screen
A carefully crafted user preferences for submission could trigger an XSS vulnerability on Apache JSPWiki, related to the user preferences screen, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. Apache JSPWiki users should upgrade to 2.11.2 or later.
Problem types: description: Cross-site scripting vulnerability on User Preferences screen
Affected products: vendor: Apache Software Foundation
product: Apache JSPWiki
Credits: lang: en
value: This issue was discovered by Paulos Yibelo, from Octagon Networks.
Published: 2022-02-25T08:30:19.000Z
CVE-2022-24949 
A privilege escalation to root exists in Eternal Terminal prior to version 6.2.0. This is due to the combination of a race condition, buffer overflow, and logic bug all in PipeSocketHandler::listen().
Problem types: cwe_id: CWE-362
description: Race Condition (CWE-362), Classic Buffer Overflow (CWE-120)
Affected products: vendor: Jason Gauci
product: Eternal Terminal
Published: 2022-08-16T00:30:36.000Z
CVE-2022-24950 
A race condition exists in Eternal Terminal prior to version 6.2.0 that allows an authenticated attacker to hijack other users' SSH authorization socket, enabling the attacker to login to other systems as the targeted users. The bug is in UserTerminalRouter::getInfoForId().
Problem types: cwe_id: CWE-362
description: Race Condition (CWE-362)
Affected products: vendor: Jason Gauci
product: Eternal Terminal
Published: 2022-08-16T00:00:00.000Z
CVE-2022-24951 
A race condition exists in Eternal Terminal prior to version 6.2.0 which allows a local attacker to hijack Eternal Terminal's IPC socket, enabling access to Eternal Terminal clients which attempt to connect in the future.
Problem types: cwe_id: CWE-362
description: Race Condition (CWE-362)
Affected products: vendor: Jason Gauci
product: Eternal Terminal
Published: 2022-08-16T00:00:00.000Z
CVE-2022-24952 
Several denial of service vulnerabilities exist in Eternal Terminal prior to version 6.2.0, including a DoS triggered remotely by an invalid sequence number and a local bug triggered by invalid input sent directly to the IPC socket.
Problem types: cwe_id: CWE-20
description: Improper Input Validation (CWE-20)
Affected products: vendor: Jason Gauci
product: Eternal Terminal
Published: 2022-08-16T00:00:00.000Z
CVE-2022-24953 
The Crypt_GPG extension before 1.6.7 for PHP does not prevent additional options in GPG calls, which presents a risk for certain environments and GPG versions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-17T04:22:05.000Z
CVE-2022-24954 
Foxit PDF Reader before 11.2.1 and Foxit PDF Editor before 11.2.1 have a Stack-Based Buffer Overflow related to XFA, for the 'subform colSpan="-2"' and 'draw colSpan="1"' substrings.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-11T01:40:20.000Z
CVE-2022-24955 
Foxit PDF Reader before 11.2.1 and Foxit PDF Editor before 11.2.1 have an Uncontrolled Search Path Element for DLL files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-11T01:40:02.000Z
CVE-2022-24956 
An issue was discovered in Shopware B2B-Suite through 4.4.1. The sort-by parameter of the search functionality of b2border and b2borderlist allows SQL injection. Possible techniques are boolean-based blind, time-based blind, and potentially stacked queries. The vulnerability allows a remote authenticated attacker to dump the underlying database.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-29T01:08:12.000Z
CVE-2022-24957 
DHC Vision eQMS through 5.4.8.322 has Persistent XSS due to insufficient encoding of untrusted input/output. To exploit the vulnerability, the attacker has to create or edit a new information object and use the XSS payload as the name. Any user that opens the object's version or history tab will be attacked.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-29T01:11:38.000Z
CVE-2022-24958 
drivers/usb/gadget/legacy/inode.c in the Linux kernel through 5.16.8 mishandles dev->buf release.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-11T04:21:36.000Z
CVE-2022-24959 
An issue was discovered in the Linux kernel before 5.16.5. There is a memory leak in yam_siocdevprivate in drivers/net/hamradio/yam.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-11T04:21:16.000Z
CVE-2022-24960 Use after free vulnerability in PDFTron SDK
A use after free vulnerability was discovered in PDFTron SDK version 9.2.0. A crafted PDF can overwrite RIP with data previously allocated on the heap. This issue affects: PDFTron PDFTron SDK 9.2.0 on OSX; 9.2.0 on Linux; 9.2.0 on Windows.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L
version: 3.1
Credits: lang: en
value: Alex Niu, Tofig Suleymanov
Published: 2022-03-09T06:20:50.785Z
CVE-2022-24961 
In Portainer Agent before 2.11.1, an API server can continue running even if not associated with a Portainer instance in the past few days.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-11T04:52:45.000Z
CVE-2022-24963 Apache Portable Runtime (APR): out-of-bound writes in the apr_encode family of functions
Integer Overflow or Wraparound vulnerability in apr_encode functions of Apache Portable Runtime (APR) allows an attacker to write beyond bounds of a buffer.
This issue affects Apache Portable Runtime (APR) version 1.7.0.
Problem types: cwe_id: CWE-190
description: CWE-190 Integer Overflow or Wraparound
Affected products: vendor: Apache Software Foundation
product: Apache Portable Runtime (APR)
default_status: unaffected
Credits: lang: en
value: Ronald Crane (Zippenhop LLC)
Published: 2023-01-31T15:52:09.716Z
CVE-2022-24967 
Black Rainbow NIMBUS before 3.7.0 allows stored Cross-site Scripting (XSS).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AC:L/AV:N/A:L/C:L/I:L/PR:L/S:C/UI:R
version: 3.1
Published: 2022-05-29T17:35:56.000Z
CVE-2022-24968 
In Mellium mellium.im/xmpp through 0.21.0, an attacker capable of spoofing DNS TXT records can redirect a WebSocket connection request to a server under their control without causing TLS certificate verification to fail. This occurs because the wrong host name is selected during this verification.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-11T18:16:54.000Z
CVE-2022-24969 bypass of CVE-2021-25640
bypass CVE-2021-25640 > In Apache Dubbo prior to 2.6.12 and 2.7.15, the usage of parseURL method will lead to the bypass of the white host check which can cause open redirect or SSRF vulnerability.
Problem types: cwe_id: CWE-918
description: bypass CVE-2021-25640 (CWE-918 Server-Side Request Forgery (SSRF))
Affected products: vendor: Apache Software Foundation
product: Apache Dubbo
Published: 2022-06-06T22:00:16.000Z
CVE-2022-24971 
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.1.0.52543. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JPEG2000 images. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15812.
Problem types: cwe_id: CWE-125
description: CWE-125: Out-of-bounds Read
Affected products: vendor: Foxit
product: PDF Reader
Credits: lang: en
value: Anonymous
Published: 2022-02-18T19:52:28.000Z
CVE-2022-24972 
This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of TP-Link TL-WR940N 3.20.1 Build 200316 Rel.34392n (5553) routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the httpd service, which listens on TCP port 80 by default. The issue results from the lack of proper access control. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-13911.
Problem types: cwe_id: CWE-284
description: CWE-284: Improper Access Control
Affected products: vendor: TP-Link
product: TL-WR940N
Credits: lang: en
value: Vadym Kolisnichenko
Published: 2023-03-28T00:00:00.000Z
CVE-2022-24973 
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link TL-WR940N 3.20.1 Build 200316 Rel.34392n (5553) routers. Authentication is required to exploit this vulnerability. The specific flaw exists within the httpd service, which listens on TCP port 80 by default. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-13992.
Problem types: cwe_id: CWE-121
description: CWE-121: Stack-based Buffer Overflow
Affected products: vendor: TP-Link
product: TL-WR940N
Credits: lang: en
value: Vadym Kolisnichenko
Published: 2023-03-28T00:00:00.000Z
CVE-2022-24974 
Links may not be rewritten according to policy in some specially formatted emails.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-02T22:16:19.000Z
CVE-2022-24975 
The --mirror documentation for Git through 2.35.1 does not mention the availability of deleted content, aka the "GitBleed" issue. This could present a security risk if information-disclosure auditing processes rely on a clone operation without the --mirror option. Note: This has been disputed by multiple 3rd parties who believe this is an intended feature of the git binary and does not pose a security risk.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-11T00:00:00.000Z
CVE-2022-24976 
Atheme IRC Services before 7.2.12, when used in conjunction with InspIRCd, allows authentication bypass by ending an IRC handshake at a certain point during a challenge-response login sequence.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-13T06:20:02.000Z
CVE-2022-24977 
ImpressCMS before 1.4.2 allows unauthenticated remote code execution via ...../// directory traversal in origName or imageName, leading to unsafe interaction with the CKEditor processImage.php script. The payload may be placed in PHP_SESSION_UPLOAD_PROGRESS when the PHP installation supports upload_progress.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-13T06:39:33.000Z
CVE-2022-24978 
Zoho ManageEngine ADAudit Plus before 7055 allows authenticated Privilege Escalation on Integrated products. This occurs because a password field is present in a JSON response.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-05T18:24:54.000Z
CVE-2022-24979 
An issue was discovered in the Varnishcache extension before 2.0.1 for TYPO3. The Edge Site Includes (ESI) content element renderer component does not include an access check. This allows an unauthenticated user to render various content elements, resulting in insecure direct object reference (IDOR), with the potential of exposing internal content elements.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-19T03:36:05.000Z
CVE-2022-24980 
An issue was discovered in the Kitodo.Presentation (aka dif) extension before 2.3.2, 3.x before 3.2.3, and 3.3.x before 3.3.4 for TYPO3. A missing access check in an eID script allows an unauthenticated user to submit arbitrary URLs to this component. This results in SSRF, allowing attackers to view the content of any file or webpage the webserver has access to.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-19T03:48:57.000Z
CVE-2022-24981 
A reflected cross-site scripting (XSS) vulnerability in forms generated by JQueryForm.com before 2022-02-05 allows remote attackers to inject arbitrary web script or HTML via the redirect parameter to admin.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-16T21:03:40.000Z
CVE-2022-24982 
Forms generated by JQueryForm.com before 2022-02-05 allows a remote authenticated attacker to access the cleartext credentials of all other form users. admin.php contains a hidden base64-encoded string with these credentials.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-16T21:04:02.000Z
CVE-2022-24983 
Forms generated by JQueryForm.com before 2022-02-05 allow remote attackers to obtain the URI to any uploaded file by capturing the POST response. When chained with CVE-2022-24984, this could lead to unauthenticated remote code execution on the underlying web server. This occurs because the Unique ID field is contained in the POST response upon submitting a form.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-16T21:04:34.000Z
CVE-2022-24984 
Forms generated by JQueryForm.com before 2022-02-05 (if file-upload capability is enabled) allow remote unauthenticated attackers to upload executable files and achieve remote code execution. This occurs because file-extension checks occur on the client side, and because not all executable content (e.g., .phtml or .php.bak) is blocked.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-16T21:05:03.000Z
CVE-2022-24985 
Forms generated by JQueryForm.com before 2022-02-05 allows a remote authenticated attacker to bypass authentication and access the administrative section of other forms hosted on the same web server. This is relevant only when an organization hosts more than one of these forms on their server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-16T21:05:25.000Z
CVE-2022-24986 
KDE KCron through 21.12.2 uses a temporary file in /tmp when saving, but reuses the filename during an editing session. Thus, someone watching it be created the first time could potentially intercept the file the following time, enabling that person to run unauthorized commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-26T04:06:21.000Z
CVE-2022-24988 
In galois_2p8 before 0.1.2, PrimitivePolynomialField::new has an off-by-one buffer overflow for a vector.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-14T19:23:00.000Z