rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-26661 
An XXE issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform (Command Line Client (proteus)) 5.x through 5.0.11, 6.x through 6.0.4, and 6.1.x and 6.2.x through 6.2.1. An authenticated user can make the server parse a crafted XML SEPA file to access arbitrary files on the system.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-07T22:40:11.000Z
CVE-2022-26662 
An XML Entity Expansion (XEE) issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform (Command Line Client (proteus)) 5.x through 5.0.11, 6.x through 6.0.4, and 6.1.x and 6.2.x through 6.2.1. An unauthenticated user can send a crafted XML-RPC message to consume all the resources of the server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-07T22:40:00.000Z
CVE-2022-26665 
An Insecure Direct Object Reference issue exists in the Tyler Odyssey Portal platform before 17.1.20. This may allow an external party to access sensitive case records.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-18T14:37:48.000Z
CVE-2022-26666 Delta Electronics DIAEnergie SQL Injection in HandlerDialogECC.ashx
Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in HandlerECC.ashx. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system commands.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Delta Electronics
product: DIAEnergie
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Michael Heinzl and Dusan Stevanovic of Trend Micro’s Zero Day Initiative reported these vulnerabilities to CISA.
Published: 2022-03-29T16:37:11.423Z
CVE-2022-26667 Delta Electronics DIAEnergie SQL Injection in GetDemandAnalysisData
Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability that exists in GetDemandAnalysisData. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system commands.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Delta Electronics
product: DIAEnergie
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Michael Heinzl and Dusan Stevanovic of Trend Micro’s Zero Day Initiative reported these vulnerabilities to CISA.
Published: 2022-03-29T16:37:13.735Z
CVE-2022-26668 ASUS Control Center - Broken Access Control
ASUS Control Center API has a broken access control vulnerability. An unauthenticated remote attacker can call privileged API functions to perform partial system operations or cause partial disrupt of service.
Problem types: cwe_id: CWE-269
description: CWE-269 Improper Privilege Management
Affected products: vendor: ASUS
product: Control Center
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.3
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
version: 3.1
Published: 2022-06-20T05:30:29.581Z
CVE-2022-26669 ASUS Control Center - SQL Injection
ASUS Control Center is vulnerable to SQL injection. An authenticated remote attacker with general user privilege can inject SQL command to specific API parameters to acquire database schema or access data.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: ASUS
product: Control Center
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2022-06-20T05:30:31.029Z
CVE-2022-26670 D-Link DIR-878 - Command Injection
D-Link DIR-878 has inadequate filtering for special characters in the webpage input field. An unauthenticated LAN attacker can perform command injection attack to execute arbitrary system commands to control the system or disrupt service.
Problem types: cwe_id: CWE-78
description: CWE-78 OS Command Injection
Affected products: vendor: D-Link
product: DIR-878
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2022-04-07T18:22:39.276Z
CVE-2022-26671 TAIWAN SECOM CO., LTD., a xDoor Access Control and Personnel Attendance Management system - Hard-coded Credentials
Taiwan Secom Dr.ID Access Control system’s login page has a hard-coded credential in the source code. An unauthenticated remote attacker can use the hard-coded credential to acquire partial system information and modify system setting to cause partial disrupt of service.
Problem types: cwe_id: CWE-798
description: CWE-798 Use of Hard-coded Credentials
Affected products: vendor: TAIWAN SECOM CO., LTD.,
product: Personnel Attendance Management system
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.3
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
version: 3.1
Published: 2022-04-07T18:22:40.988Z
CVE-2022-26672 ASUS WebStorage - Use of Hard-coded Credentials
ASUS WebStorage has a hardcoded API Token in the APP source code. An unauthenticated remote attacker can use this token to establish connections with the server and carry out login attempts to general user accounts. A successful login to a general user account allows the attacker to access, modify or delete this user account information.
Problem types: cwe_id: CWE-798
description: CWE-798 Use of Hard-coded Credentials
Affected products: vendor: ASUS
product: WebStorage
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.3
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
version: 3.1
Published: 2022-04-22T06:50:16.927Z
CVE-2022-26673 ASUS RT-AX88U - Stored XSS
ASUS RT-AX88U has insufficient filtering for special characters in the HTTP header parameter. A remote attacker with general user privilege can exploit this vulnerability to inject JavaScript and perform Stored Cross-Site Scripting (XSS) attacks.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: ASUS
product: RT-AX88U
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Published: 2022-04-22T06:50:18.452Z
CVE-2022-26674 ASUS RT-AX88U - Format String
ASUS RT-AX88U has a Format String vulnerability, which allows an unauthenticated remote attacker to write to arbitrary memory address and perform remote arbitrary code execution, arbitrary system operation or disrupt service.
Problem types: cwe_id: CWE-134
description: CWE-134 Use of Externally-Controlled Format String
Affected products: vendor: ASUS
product: RT-AX88U
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2022-04-22T06:50:19.853Z
CVE-2022-26675 aEnrich a+HRD - Path Traversal
aEnrich a+HRD has inadequate filtering for special characters in URLs. An unauthenticated remote attacker can bypass authentication and perform path traversal attacks to access arbitrary files under website root directory.
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: aEnrich
product: a+HRD
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2022-04-07T18:22:42.703Z
CVE-2022-26676 aEnrich a+HRD - Broken Access Control
aEnrich a+HRD has inadequate privilege restrictions, an unauthenticated remote attacker can use the API function to upload and execute malicious scripts to control the system or disrupt service.
Problem types: cwe_id: CWE-269
description: CWE-269 Improper Privilege Management
Affected products: vendor: aEnrich
product: a+HRD
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2022-04-07T18:22:44.359Z
CVE-2022-26688 
An issue in the handling of symlinks was addressed with improved validation. This issue is fixed in Security Update 2022-003 Catalina, macOS Monterey 12.3, macOS Big Sur 11.6.5. A malicious app with root privileges may be able to modify the contents of system files.
Problem types: description: A malicious app with root privileges may be able to modify the contents of system files
Affected products: vendor: Apple
product: macOS
vendor: Apple
product: macOS
vendor: Apple
product: macOS
Published: 2022-05-26T17:46:24.000Z
CVE-2022-26690 
Description: A race condition was addressed with additional validation. This issue is fixed in macOS Monterey 12.3. A malicious application may be able to modify protected parts of the file system.
Problem types: description: A malicious application may be able to modify protected parts of the file system
Affected products: vendor: Apple
product: macOS
Published: 2022-05-26T17:47:10.000Z
CVE-2022-26691 
A logic issue was addressed with improved state management. This issue is fixed in Security Update 2022-003 Catalina, macOS Monterey 12.3, macOS Big Sur 11.6.5. An application may be able to gain elevated privileges.
Problem types: description: An application may be able to gain elevated privileges
Affected products: vendor: Apple
product: macOS
vendor: Apple
product: macOS
vendor: Apple
product: macOS
Published: 2022-05-26T17:47:59.000Z
CVE-2022-26693 
This issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.4. A plug-in may be able to inherit the application's permissions and access user data.
Problem types: description: A plug-in may be able to inherit the application's permissions and access user data
Affected products: vendor: Apple
product: macOS
Published: 2022-05-26T18:36:42.000Z
CVE-2022-26694 
This issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.4. A plug-in may be able to inherit the application's permissions and access user data.
Problem types: description: A plug-in may be able to inherit the application's permissions and access user data
Affected products: vendor: Apple
product: macOS
Published: 2022-05-26T18:37:54.000Z
CVE-2022-26696 
This issue was addressed with improved environment sanitization. This issue is fixed in macOS Monterey 12.4. A sandboxed process may be able to circumvent sandbox restrictions.
Problem types: description: A sandboxed process may be able to circumvent sandbox restrictions
Affected products: vendor: Apple
product: macOS
Published: 2022-09-20T20:19:08.000Z
CVE-2022-26697 
An out-of-bounds read issue was addressed with improved input validation. This issue is fixed in Security Update 2022-004 Catalina, macOS Monterey 12.4, macOS Big Sur 11.6.6. Processing a maliciously crafted AppleScript binary may result in unexpected application termination or disclosure of process memory.
Problem types: description: Processing a maliciously crafted AppleScript binary may result in unexpected application termination or disclosure of process memory
Affected products: vendor: Apple
product: Security Update - Catalina
vendor: Apple
product: macOS
vendor: Apple
product: macOS
Published: 2022-05-26T18:39:10.000Z
CVE-2022-26698 
An out-of-bounds read issue was addressed with improved bounds checking. This issue is fixed in Security Update 2022-004 Catalina, macOS Monterey 12.4, macOS Big Sur 11.6.6. Processing a maliciously crafted AppleScript binary may result in unexpected application termination or disclosure of process memory.
Problem types: description: Processing a maliciously crafted AppleScript binary may result in unexpected application termination or disclosure of process memory
Affected products: vendor: Apple
product: Security Update - Catalina
vendor: Apple
product: macOS
vendor: Apple
product: macOS
Published: 2022-05-26T18:40:02.000Z
CVE-2022-26699 
A logic issue was addressed with improved state management. This issue is fixed in macOS Ventura 13. An app may be able to cause a denial-of-service to Endpoint Security clients.
Problem types: description: An app may be able to cause a denial-of-service to Endpoint Security clients
Affected products: vendor: Apple
product: macOS
Published: 2023-08-14T22:40:34.820Z
CVE-2022-26700 
A memory corruption issue was addressed with improved state management. This issue is fixed in tvOS 15.5, watchOS 8.6, iOS 15.5 and iPadOS 15.5, macOS Monterey 12.4, Safari 15.5. Processing maliciously crafted web content may lead to code execution.
Problem types: description: Processing maliciously crafted web content may lead to code execution
Affected products: vendor: Apple
product: macOS
vendor: Apple
product: macOS
vendor: Apple
product: watchOS
vendor: Apple
product: watchOS
vendor: Apple
product: watchOS
Published: 2022-09-23T18:58:31.000Z
CVE-2022-26701 
A race condition was addressed with improved locking. This issue is fixed in tvOS 15.5, macOS Monterey 12.4, iOS 15.5 and iPadOS 15.5. An application may be able to execute arbitrary code with kernel privileges.
Problem types: description: An application may be able to execute arbitrary code with kernel privileges
Affected products: vendor: Apple
product: tvOS
vendor: Apple
product: tvOS
vendor: Apple
product: tvOS
Published: 2022-05-26T18:40:52.000Z
CVE-2022-26702 
A use after free issue was addressed with improved memory management. This issue is fixed in watchOS 8.6, tvOS 15.5, iOS 15.5 and iPadOS 15.5. An application may be able to execute arbitrary code with kernel privileges.
Problem types: description: An application may be able to execute arbitrary code with kernel privileges
Affected products: vendor: Apple
product: watchOS
vendor: Apple
product: watchOS
vendor: Apple
product: watchOS
Published: 2022-05-26T00:00:00.000Z
CVE-2022-26703 
An authorization issue was addressed with improved state management. This issue is fixed in iOS 15.5 and iPadOS 15.5. A person with physical access to an iOS device may be able to access photos from the lock screen.
Problem types: description: A person with physical access to an iOS device may be able to access photos from the lock screen
Affected products: vendor: Apple
product: iOS and iPadOS
Published: 2022-05-26T18:42:42.000Z
CVE-2022-26704 
A validation issue existed in the handling of symlinks and was addressed with improved validation of symlinks. This issue is fixed in macOS Monterey 12.4. An app may be able to gain elevated privileges.
Problem types: description: An app may be able to gain elevated privileges
Affected products: vendor: Apple
product: macOS
Published: 2022-05-26T18:43:32.000Z
CVE-2022-26706 
An access issue was addressed with additional sandbox restrictions on third-party applications. This issue is fixed in tvOS 15.5, iOS 15.5 and iPadOS 15.5, watchOS 8.6, macOS Big Sur 11.6.6, macOS Monterey 12.4. A sandboxed process may be able to circumvent sandbox restrictions.
Problem types: description: A sandboxed process may be able to circumvent sandbox restrictions
Affected products: vendor: Apple
product: watchOS
vendor: Apple
product: watchOS
vendor: Apple
product: watchOS
vendor: Apple
product: watchOS
vendor: Apple
product: watchOS
Published: 2022-05-26T18:44:31.000Z
CVE-2022-26707 
An issue in the handling of environment variables was addressed with improved validation. This issue is fixed in macOS Monterey 12.4. A user may be able to view sensitive user information.
Problem types: description: A user may be able to view sensitive user information
Affected products: vendor: Apple
product: macOS
Published: 2022-09-23T18:58:30.000Z
CVE-2022-26708 
This issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.4. An attacker may be able to cause unexpected application termination or arbitrary code execution.
Problem types: description: An attacker may be able to cause unexpected application termination or arbitrary code execution
Affected products: vendor: Apple
product: macOS
Published: 2022-05-26T18:46:04.000Z
CVE-2022-26709 
A use after free issue was addressed with improved memory management. This issue is fixed in tvOS 15.5, iOS 15.5 and iPadOS 15.5, watchOS 8.6, macOS Monterey 12.4, Safari 15.5. Processing maliciously crafted web content may lead to arbitrary code execution.
Problem types: description: Processing maliciously crafted web content may lead to arbitrary code execution
Affected products: vendor: Apple
product: macOS
vendor: Apple
product: macOS
vendor: Apple
product: watchOS
vendor: Apple
product: watchOS
vendor: Apple
product: watchOS
Published: 2022-11-01T00:00:00.000Z
CVE-2022-26710 
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 15.5 and iPadOS 15.5, macOS Monterey 12.4, tvOS 15.5, watchOS 8.6. Processing maliciously crafted web content may lead to arbitrary code execution.
Problem types: description: Processing maliciously crafted web content may lead to arbitrary code execution
Affected products: vendor: Apple
product: macOS
vendor: Apple
product: watchOS
vendor: Apple
product: watchOS
vendor: Apple
product: watchOS
Published: 2022-11-01T00:00:00.000Z
CVE-2022-26711 
An integer overflow issue was addressed with improved input validation. This issue is fixed in tvOS 15.5, iTunes 12.12.4 for Windows, iOS 15.5 and iPadOS 15.5, watchOS 8.6, macOS Monterey 12.4. A remote attacker may be able to cause unexpected application termination or arbitrary code execution.
Problem types: description: A remote attacker may be able to cause unexpected application termination or arbitrary code execution
Affected products: vendor: Apple
product: watchOS
vendor: Apple
product: watchOS
vendor: Apple
product: watchOS
vendor: Apple
product: watchOS
vendor: Apple
product: watchOS
Published: 2022-05-26T18:46:55.000Z
CVE-2022-26712 
This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Monterey 12.4, macOS Big Sur 11.6.6. A malicious application may be able to modify protected parts of the file system.
Problem types: description: A malicious application may be able to modify protected parts of the file system
Affected products: vendor: Apple
product: macOS
vendor: Apple
product: macOS
Published: 2022-05-26T18:48:02.000Z
CVE-2022-26714 
A memory corruption issue was addressed with improved validation. This issue is fixed in tvOS 15.5, iOS 15.5 and iPadOS 15.5, Security Update 2022-004 Catalina, watchOS 8.6, macOS Big Sur 11.6.6, macOS Monterey 12.4. An application may be able to execute arbitrary code with kernel privileges.
Problem types: description: An application may be able to execute arbitrary code with kernel privileges
Affected products: vendor: Apple
product: watchOS
vendor: Apple
product: watchOS
vendor: Apple
product: watchOS
vendor: Apple
product: watchOS
vendor: Apple
product: watchOS
vendor: Apple
product: watchOS
Published: 2022-05-26T18:49:17.000Z
CVE-2022-26715 
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in Security Update 2022-004 Catalina, macOS Monterey 12.4, macOS Big Sur 11.6.6. An application may be able to gain elevated privileges.
Problem types: description: An application may be able to gain elevated privileges
Affected products: vendor: Apple
product: Security Update - Catalina
vendor: Apple
product: macOS
vendor: Apple
product: macOS
Published: 2022-05-26T18:50:16.000Z
CVE-2022-26716 
A memory corruption issue was addressed with improved state management. This issue is fixed in tvOS 15.5, iOS 15.5 and iPadOS 15.5, watchOS 8.6, macOS Monterey 12.4, Safari 15.5. Processing maliciously crafted web content may lead to arbitrary code execution.
Problem types: description: Processing maliciously crafted web content may lead to arbitrary code execution
Affected products: vendor: Apple
product: macOS
vendor: Apple
product: macOS
vendor: Apple
product: watchOS
vendor: Apple
product: watchOS
vendor: Apple
product: watchOS
Published: 2022-11-01T00:00:00.000Z
CVE-2022-26717 
A use after free issue was addressed with improved memory management. This issue is fixed in tvOS 15.5, watchOS 8.6, iOS 15.5 and iPadOS 15.5, macOS Monterey 12.4, Safari 15.5, iTunes 12.12.4 for Windows. Processing maliciously crafted web content may lead to arbitrary code execution.
Problem types: description: Processing maliciously crafted web content may lead to arbitrary code execution
Affected products: vendor: Apple
product: macOS
vendor: Apple
product: macOS
vendor: Apple
product: watchOS
vendor: Apple
product: watchOS
vendor: Apple
product: watchOS
vendor: Apple
product: watchOS
Published: 2022-11-01T00:00:00.000Z
CVE-2022-26718 
An out-of-bounds read issue was addressed with improved input validation. This issue is fixed in macOS Monterey 12.4, macOS Big Sur 11.6.6. An application may be able to gain elevated privileges.
Problem types: description: An application may be able to gain elevated privileges
Affected products: vendor: Apple
product: macOS
vendor: Apple
product: macOS
Published: 2022-05-26T18:51:00.000Z
CVE-2022-26719 
A memory corruption issue was addressed with improved state management. This issue is fixed in tvOS 15.5, iOS 15.5 and iPadOS 15.5, watchOS 8.6, macOS Monterey 12.4, Safari 15.5. Processing maliciously crafted web content may lead to arbitrary code execution.
Problem types: description: Processing maliciously crafted web content may lead to arbitrary code execution
Affected products: vendor: Apple
product: macOS
vendor: Apple
product: macOS
vendor: Apple
product: watchOS
vendor: Apple
product: watchOS
vendor: Apple
product: watchOS
Published: 2022-11-01T00:00:00.000Z
CVE-2022-26720 
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in Security Update 2022-004 Catalina, macOS Monterey 12.4, macOS Big Sur 11.6.6. A malicious application may be able to execute arbitrary code with kernel privileges.
Problem types: description: A malicious application may be able to execute arbitrary code with kernel privileges
Affected products: vendor: Apple
product: Security Update - Catalina
vendor: Apple
product: macOS
vendor: Apple
product: macOS
Published: 2022-05-26T18:51:47.000Z