CVE: CVE-2022-2210

[{'lang': 'en', 'value': 'Out-of-bounds Write in GitHub repository vim/vim prior to 8.2.'}]

Fix commit: patch 8.2.5164: invalid memory access after diff buffer manipulations

Problem:    Invalid memory access after diff buffer manipulations.
Solution:   Use zero offset when change removes all lines in a diff block.


CVE: CVE-2022-22107

[{'lang': 'en', 'value': 'In Daybyday CRM, versions 2.0.0 through 2.2.0 are vulnerable to Missing Authorization. An attacker that has the lowest privileges account (employee type user), can view the appointments of all users in the system including administrators. However, this type of user is not authorized to view the calendar at all.'}]

Fix commit: password change requires 6 on update, and only allowed users can see calendar


CVE: CVE-2022-22108

[{'lang': 'en', 'value': 'In Daybyday CRM, versions 2.0.0 through 2.2.0 are vulnerable to Missing Authorization. An attacker that has the lowest privileges account (employee type user), can view the absences of all users in the system including administrators. This type of user is not authorized to view this kind of information.'}]

Fix commit: ensure only admin and owner can change role, and password, unless it is yourself


CVE: CVE-2022-22109

[{'lang': 'en', 'value': 'In Daybyday CRM, version 2.2.0 is vulnerable to Stored Cross-Site Scripting (XSS) vulnerability that allows low privileged application users to store malicious scripts in the title field of new tasks. These scripts are executed in a victim’s browser when they open the “/tasks” page to view all the tasks.'}]

Fix commit: fix xss for tasks index


CVE: CVE-2022-22110

[{'lang': 'en', 'value': 'In Daybyday CRM, versions 1.1 through 2.2.0 enforce weak password requirements in the user update functionality. A user with privileges to update his password could change it to a weak password, such as those with a length of a single character. This may allow an attacker to brute-force users’ passwords with minimal to no computational effort.'}]

Fix commit: password change requires 6 on update, and only allowed users can see calendar


CVE: CVE-2022-22111

[{'lang': 'en', 'value': 'In DayByDay CRM, version 2.2.0 is vulnerable to missing authorization. Any application user in the application who has update user permission enabled is able to change the password of other users, including the administrator’s. This allows the attacker to gain access to the highest privileged user in the application.'}]

Fix commit: ensure only admin and owner can change role, and password, unless it is yourself


CVE: CVE-2022-22114

[{'lang': 'en', 'value': 'In Teedy, versions v1.5 through v1.9 are vulnerable to Reflected Cross-Site Scripting (XSS). The “search term" search functionality is not sufficiently sanitized while displaying the results of the search, which can be leveraged to inject arbitrary scripts. These scripts are executed in a victim’s browser when they enter the crafted URL. In the worst case, the victim who inadvertently triggers the attack is a highly privileged administrator. The inj


CVE: CVE-2022-22115

[{'lang': 'en', 'value': 'In Teedy, versions v1.5 through v1.9 are vulnerable to Stored Cross-Site Scripting (XSS) in the name of a created Tag. Since the Tag name is not being sanitized properly in the edit tag page, a low privileged attacker can store malicious scripts in the name of the Tag. In the worst case, the victim who inadvertently triggers the attack is a highly privileged administrator. The injected scripts can extract the Session ID, which can lead to full Accou


CVE: CVE-2022-22116

[{'lang': 'en', 'value': 'In Directus, versions 9.0.0-alpha.4 through 9.4.1 are vulnerable to stored Cross-Site Scripting (XSS) vulnerability via SVG file upload in media upload functionality. A low privileged attacker can inject arbitrary javascript code which will be executed in a victim’s browser when they open the image URL.'}]

Fix commit: Add Content-Security-Policy header by default (#10776)


CVE: CVE-2022-22117

[{'lang': 'en', 'value': 'In Directus, versions 9.0.0-alpha.4 through 9.4.1 allow unrestricted file upload of .html files in the media upload functionality, which leads to Cross-Site Scripting vulnerability. A low privileged attacker can upload a crafted HTML file as a profile avatar, and when an admin or another user opens it, the XSS payload gets triggered.'}]

Fix commit: Add Content-Security-Policy header by default (#10776)


CVE: CVE-2022-22143

[{'lang': 'en', 'value': 'The package convict before 6.2.2 are vulnerable to Prototype Pollution via the convict function due to missing validation of parentKey. **Note:** This vulnerability derives from an incomplete fix of another [vulnerability](https://security.snyk.io/vuln/SNYK-JS-CONVICT-1062508)'}]

Fix commit: More complete fix against prototype pollution

first addressed in https://github.com/mozilla/node-convict/pull/384


CVE: CVE-2022-2216

[{'lang': 'en', 'value': 'Server-Side Request Forgery (SSRF) in GitHub repository ionicabizau/parse-url prior to 7.0.0.'}]

Fix commit: Refactor codebase, upgrade dependencies


CVE: CVE-2022-2217

[{'lang': 'en', 'value': 'Cross-site Scripting (XSS) - Generic in GitHub repository ionicabizau/parse-url prior to 7.0.0.'}]

Fix commit: Refactor codebase, upgrade dependencies


CVE: CVE-2022-2218

[{'lang': 'en', 'value': 'Cross-site Scripting (XSS) - Stored in GitHub repository ionicabizau/parse-url prior to 7.0.0.'}]

Fix commit: Refactor codebase, upgrade dependencies


CVE: CVE-2022-2231

[{'lang': 'en', 'value': 'NULL Pointer Dereference in GitHub repository vim/vim prior to 8.2.'}]

Fix commit: patch 8.2.5169: nested :source may use NULL pointer

Problem:    Nested :source may use NULL pointer.
Solution:   Do not use the NULL pointer.


CVE: CVE-2022-2252

[{'lang': 'en', 'value': 'Open Redirect in GitHub repository microweber/microweber prior to 1.2.19.'}]

Fix commit: update


CVE: CVE-2022-2257

[{'lang': 'en', 'value': 'Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.'}]

Fix commit: patch 9.0.0009: going past the end of a menu item with only modifier

Problem:    Going past the end of a menu item with only modifier.
Solution:   Check for NUL.


CVE: CVE-2022-2264

[{'lang': 'en', 'value': 'Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.'}]

Fix commit: patch 9.0.0011: reading beyond the end of the line with put command

Problem:    Reading beyond the end of the line with put command.
Solution:   Adjust the end mark position.


CVE: CVE-2022-2279

[{'lang': 'en', 'value': 'NULL Pointer Dereference in GitHub repository bfabiszewski/libmobi prior to 0.11.'}]

Fix commit: Fix undefined behavior when passing null to strdup


CVE: CVE-2022-2280

[{'lang': 'en', 'value': 'Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.2.19.'}]

Fix commit: update


CVE: CVE-2022-2284

[{'lang': 'en', 'value': 'Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.'}]

Fix commit: patch 9.0.0017: accessing memory beyond the end of the line

Problem:    Accessing memory beyond the end of the line.
Solution:   Stop Visual mode when closing a window.


CVE: CVE-2022-22845

[{'lang': 'en', 'value': "QXIP SIPCAPTURE homer-app before 1.4.28 for HOMER 7.x has the same 167f0db2-f83e-4baa-9736-d56064a5b415 JWT secret key across different customers' installations."}]

Fix commit: added jwt generator.

Many thanks to Omri Baso and Fabien Aunay for the report! Great job guys!


CVE: CVE-2022-2285

[{'lang': 'en', 'value': 'Integer Overflow or Wraparound in GitHub repository vim/vim prior to 9.0.'}]

Fix commit: patch 9.0.0018: going over the end of the typahead

Problem:    Going over the end of the typahead.
Solution:   Put a NUL after the typeahead.


CVE: CVE-2022-22851

[{'lang': 'en', 'value': "A Stored Cross Site Scripting (XSS) vulnerability exists in Sourcecodtester Hospital's Patient Records Management System 1.0 via the specialization parameter in doctors.php"}]

Fix commit: Create CVE-2022-22851.md


CVE: CVE-2022-2286

[{'lang': 'en', 'value': 'Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.'}]

Fix commit: patch 9.0.0020: with some completion reading past end of string

Problem:    With some completion reading past end of string.
Solution:   Check the length of the string.


CVE: CVE-2022-2287

[{'lang': 'en', 'value': 'Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.'}]

Fix commit: patch 9.0.0021: invalid memory access when adding word to spell word list

Problem:    Invalid memory access when adding word with a control character to
            the internal spell word list.
Solution:   Disallow adding a word with control characters or a trailing
            slash.


CVE: CVE-2022-2288

[{'lang': 'en', 'value': 'Out-of-bounds Write in GitHub repository vim/vim prior to 9.0.'}]

Fix commit: patch 9.0.0025: accessing beyond allocated memory with the cmdline window

Problem:    Accessing beyond allocated memory when using the cmdline window in
            Ex mode.
Solution:   Use "*" instead of "'<,'>" for Visual mode.


CVE: CVE-2022-2289

[{'lang': 'en', 'value': 'Use After Free in GitHub repository vim/vim prior to 9.0.'}]

Fix commit: patch 9.0.0026: accessing freed memory with diff put

Problem:    Accessing freed memory with diff put.
Solution:   Bail out when diff pointer is no longer valid.


CVE: CVE-2022-2290

[{'lang': 'en', 'value': 'Cross-site Scripting (XSS) - Reflected in GitHub repository zadam/trilium prior to 0.52.4, 0.53.1-beta.'}]

Fix commit: set correct content type for error messages


CVE: CVE-2022-2300

[{'lang': 'en', 'value': 'Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.2.19.'}]

Fix commit: update


CVE: CVE-2022-2301

[{'lang': 'en', 'value': 'Buffer Over-read in GitHub repository hpjansson/chafa prior to 1.10.3.'}]

Fix commit: XwdLoader: Fix buffer over-read and improve general robustness

This commit fixes a buffer over-read that could occur due to g_ntohl()
evaluating its argument more than once if at least one of the following
is true:

* Build target is not x86.
* __OPTIMIZE__ is not set during compilation (e.g. -O0 was used).

It also improves robustness more generally and fixes an


CVE: CVE-2022-2304

[{'lang': 'en', 'value': 'Stack-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.'}]

Fix commit: patch 9.0.0035: spell dump may go beyond end of an array

Problem:    Spell dump may go beyond end of an array.
Solution:   Limit the word length.


CVE: CVE-2022-23057

[{'lang': 'en', 'value': 'In ERPNext, versions v12.0.9--v13.0.3 are vulnerable to Stored Cross-Site-Scripting (XSS), due to user input not being validated properly. A low privileged attacker could inject arbitrary code into input fields when editing his profile.'}]

Fix commit: feat: frappe.whitelist for class methods


CVE: CVE-2022-23058

[{'lang': 'en', 'value': 'ERPNext in versions v12.0.9-v13.0.3 are affected by a stored XSS vulnerability that allows low privileged users to store malicious scripts in the ‘username’ field in ‘my settings’ which can lead to full account takeover.'}]

Fix commit: feat: frappe.whitelist for class methods


CVE: CVE-2022-23059

[{'lang': 'en', 'value': 'A Stored Cross Site Scripting (XSS) vulnerability exists in Shopizer versions 2.0 through 2.17.0 via the “Manage Images” tab, which allows an attacker to upload a SVG file containing malicious JavaScript code.'}]

Fix commit: working version 3.0.alpha


CVE: CVE-2022-2306

[{'lang': 'en', 'value': 'Old session tokens can be used to authenticate to the application and send authenticated requests.'}]

Fix commit: Correctly console session token on all logouts. (#875)


CVE: CVE-2022-23060

[{'lang': 'en', 'value': 'A Stored Cross Site Scripting (XSS) vulnerability exists in Shopizer versions 2.0 through 2.17.0, where a privileged user (attacker) can inject malicious JavaScript in the filename under the “Manage files” tab'}]

Fix commit: working version 3.0.alpha


CVE: CVE-2022-23061

[{'lang': 'en', 'value': 'In Shopizer versions 2.0 to 2.17.0 a regular admin can permanently delete a superadmin (although this cannot happen according to the documentation) via Insecure Direct Object Reference (IDOR) vulnerability.'}]

Fix commit: working version 3.0.alpha


CVE: CVE-2022-23064

[{'lang': 'en', 'value': 'In Snipe-IT, versions v3.0-alpha to v5.3.7 are vulnerable to Host Header Injection. By sending a specially crafted host header in the reset password request, it is possible to send password reset links to users which once clicked lead to an attacker controlled server and thus leading to password reset token leak. This leads to account take over.'}]

Fix commit: Force UrlGenerator's Root URL to be the base of APP_URL unless overriden
(For v5)


CVE: CVE-2022-23065

[{'lang': 'en', 'value': 'In Vendure versions 0.1.0-alpha.2 to 1.5.1 are affected by Stored XSS vulnerability, where an attacker having catalog permission can upload a SVG file that contains malicious JavaScript into the “Assets” tab. The uploaded file will affect administrators as well as regular users.'}]

Fix commit: fix(asset-server-plugin): Fix svg XSS vulnerability

It was discovered that a malicious SVG file containing javascript could be executed when opening the
sou


CVE: CVE-2022-23066

[{'lang': 'en', 'value': 'In Solana rBPF versions 0.2.26 and 0.2.27 are affected by Incorrect Calculation which is caused by improper implementation of sdiv instruction. This can lead to the wrong execution path, resulting in huge loss in specific cases. For example, the result of a sdiv instruction may decide whether to transfer tokens or not. The vulnerability affects both integrity and may cause serious availability problems.'}]

Fix commit: jit: sign-extend the quotient


CVE: CVE-2022-23067

[{'lang': 'en', 'value': 'ToolJet versions v0.5.0 to v1.2.2 are vulnerable to token leakage via Referer header that leads to account takeover . If the user opens the invite link/signup link and then clicks on any external links within the page, it leaks the password set token/signup token in the referer header. Using these tokens the attacker can access the user’s account.'}]

Fix commit: Fix token present in referrer header (#2413)


CVE: CVE-2022-23068

[{'lang': 'en', 'value': 'ToolJet versions v0.6.0 to v1.10.2 are vulnerable to HTML injection where an attacker can inject malicious code inside the first name and last name field while inviting a new user which will be reflected in the invitational e-mail.'}]

Fix commit: Feature: Add data transfer object layer to validate and sanitize user inputs (#2694)

* add sanitize-html to be used with dto

* add dto for controllers

* add vaalidation to check token not empty

*


CVE: CVE-2022-23071

[{'lang': 'en', 'value': 'In Recipes, versions 0.9.1 through 1.2.5 are vulnerable to Server Side Request Forgery (SSRF), in the “Import Recipe” functionality. When an attacker enters the localhost URL, a low privileged attacker can access/read the internal file system to access sensitive information.'}]

Fix commit: added url validation to all server requests


CVE: CVE-2022-23072

[{'lang': 'en', 'value': "In Recipes, versions 1.0.5 through 1.2.5 are vulnerable to Stored Cross-Site Scripting (XSS), in “Add to Cart” functionality. When a victim accesses the food list page, then adds a new Food with a malicious javascript payload in the ‘Name’ parameter and clicks on the Add to Shopping Cart icon, an XSS payload will trigger. A low privileged attacker will have the victim's API key and can lead to admin's account takeover."}]

Fix commit: improved outpu


CVE: CVE-2022-23073

[{'lang': 'en', 'value': "In Recipes, versions 1.0.5 through 1.2.5 are vulnerable to Stored Cross-Site Scripting (XSS), in copy to clipboard functionality. When a victim accesses the food list page, then adds a new Food with a malicious javascript payload in the ‘Name’ parameter and clicks on the clipboard icon, an XSS payload will trigger. A low privileged attacker will have the victim's API key and can lead to admin's account takeover."}]

Fix commit: improved output sanit


CVE: CVE-2022-23074

[{'lang': 'en', 'value': "In Recipes, versions 0.17.0 through 1.2.5 are vulnerable to Stored Cross-Site Scripting (XSS), in the ‘Name’ field of Keyword, Food and Unit components. When a victim accesses the Keyword/Food/Unit endpoints, the XSS payload will trigger. A low privileged attacker will have the victim's API key and can lead to admin's account takeover."}]

Fix commit: improved output sanitization of several views


CVE: CVE-2022-23077

[{'lang': 'en', 'value': 'In habitica versions v4.119.0 through v4.232.2 are vulnerable to DOM XSS via the login page.'}]

Fix commit: fix(login): catch double-slash exploit


CVE: CVE-2022-23078

[{'lang': 'en', 'value': 'In habitica versions v4.119.0 through v4.232.2 are vulnerable to open redirect via the login page.'}]

Fix commit: fix(login): catch double-slash exploit


CVE: CVE-2022-23079

[{'lang': 'en', 'value': 'In motor-admin versions 0.0.1 through 0.2.56 are vulnerable to host header injection in the password reset functionality where malicious actor can send fake password reset email to arbitrary victim.'}]

Fix commit: do not use request host in for devise


CVE: CVE-2022-23080

[{'lang': 'en', 'value': 'In directus versions v9.0.0-beta.2 through 9.6.0 are vulnerable to server-side request forgery (SSRF) in the media upload functionality which allows a low privileged user to perform internal network port scans.'}]

Fix commit: Add support for import ip deny list (#12025)

* Add support for import ip deny list

* Fix typo


CVE: CVE-2022-23082

[{'lang': 'en', 'value': 'In CureKit versions v1.0.1 through v1.1.3 are vulnerable to path traversal as the function isFileOutsideDir fails to sanitize the user input which may lead to path traversal.'}]

Fix commit: Merge pull request from GHSA-fvf5-grm7-538p

CureKit-ghsa-fvf5-grm7-538p adding trailing separator to base dir if …


CVE: CVE-2022-2309

[{'lang': 'en', 'value': "NULL Pointer Dereference allows attackers to cause a denial of service (or application crash). This only applies when lxml is used together with libxml2 2.9.10 through 2.9.14. libxml2 2.9.9 and earlier are not affected. It allows triggering crashes through forged input data, given a vulnerable code sequence in the application. The vulnerability is caused by the iterwalk function (also used by the canonicalize function). Such code shouldn't be in wide


CVE: CVE-2022-23126

[{'lang': 'en', 'value': 'TeslaMate before 1.25.1 (when using the default Docker configuration) allows attackers to open doors of Tesla vehicles, start Keyless Driving, and interfere with vehicle operation en route. This occurs because an attacker can leverage Grafana login access to obtain a token for Tesla API calls.'}]

Fix commit: Disable anonymous login to Grafana


CVE: CVE-2022-2318

[{'lang': 'en', 'value': 'There are use-after-free vulnerabilities caused by timer handler in net/rose/rose_timer.c of linux that allow attackers to crash linux kernel without any privileges.'}]

Fix commit: net: rose: fix UAF bugs caused by timer handler

There are UAF bugs in rose_heartbeat_expiry(), rose_timer_expiry()
and rose_idletimer_expiry(). The root cause is that del_timer()
could not stop the timer handler that is running and the refcount
of sock is not managed pro


CVE: CVE-2022-2321

[{'lang': 'en', 'value': 'Improper Restriction of Excessive Authentication Attempts in GitHub repository heroiclabs/nakama prior to 3.13.0. This results in login brute-force attacks.'}]

Fix commit: Better limit for unsuccessful login attempts on the devconsole. (#878)


CVE: CVE-2022-23220

[{'lang': 'en', 'value': 'USBView 2.1 before 2.2 allows some local users (e.g., ones logged in via SSH) to execute arbitrary code as root because certain Polkit settings (e.g., allow_any=yes) for pkexec disable the authentication requirement. Code execution can, for example, use the --gtk-module option. This affects Ubuntu, Debian, and Gentoo.'}]

Fix commit: org.freedesktop.pkexec.usbview.policy: fix a local root privilege escalation issue via pkexec (CVE-2022-23220).

The


CVE: CVE-2022-23308

[{'lang': 'en', 'value': 'valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes.'}]

Fix commit: [CVE-2022-23308] Use-after-free of ID and IDREF attributes

If a document is parsed with XML_PARSE_DTDVALID and without
XML_PARSE_NOENT, the value of ID attributes has to be normalized after
potentially expanding entities in xmlRemoveID. Otherwise, later calls
to xmlGetID can return a pointer to previously freed memory.

ID attributes which are empty or


CVE: CVE-2022-2339

[{'lang': 'en', 'value': "With this SSRF vulnerability, an attacker can reach internal addresses to make a request as the server and read it's contents. This attack can lead to leak of sensitive information."}]

Fix commit: Merge pull request #2495 from nocodb/develop

Pre-release 0.92.0


CVE: CVE-2022-2342

[{'lang': 'en', 'value': 'Cross-site Scripting (XSS) - Stored in GitHub repository outline/outline prior to v0.64.4.'}]

Fix commit: 0.64.4


CVE: CVE-2022-2343

[{'lang': 'en', 'value': 'Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0044.'}]

Fix commit: patch 9.0.0045: reading past end of completion with a long line

Problem:    Reading past end of completion with a long line and 'infercase'
            set.
Solution:   Allocate the string if needed.


CVE: CVE-2022-2344

[{'lang': 'en', 'value': 'Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0045.'}]

Fix commit: patch 9.0.0046: reading past end of completion with duplicate match

Problem:    Reading past end of completion with duplicate match.
Solution:   Check string length


CVE: CVE-2022-2345

[{'lang': 'en', 'value': 'Use After Free in GitHub repository vim/vim prior to 9.0.0046.'}]

Fix commit: patch 9.0.0047: using freed memory with recursive substitute

Problem:    Using freed memory with recursive substitute.
Solution:   Always make a copy for reg_prev_sub.


CVE: CVE-2022-2353

[{'lang': 'en', 'value': 'Prior to microweber/microweber v1.2.20, due to improper neutralization of input, an attacker can steal tokens to perform cross-site request forgery, fetch contents from same-site and redirect a user.'}]

Fix commit: update


CVE: CVE-2022-23557

[{'lang': 'en', 'value': 'Tensorflow is an Open Source Machine Learning Framework. An attacker can craft a TFLite model that would trigger a division by zero in `BiasAndClamp` implementation. There is no check that the `bias_size` is non zero. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.'}]

Fix commit: [lite] Add check fo


CVE: CVE-2022-23558

[{'lang': 'en', 'value': 'Tensorflow is an Open Source Machine Learning Framework. An attacker can craft a TFLite model that would cause an integer overflow in `TfLiteIntArrayCreate`. The `TfLiteIntArrayGetSizeInBytes` returns an `int` instead of a `size_t. An attacker can control model inputs such that `computed_size` overflows the size of `int` datatype. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3,


CVE: CVE-2022-23559

[{'lang': 'en', 'value': 'Tensorflow is an Open Source Machine Learning Framework. An attacker can craft a TFLite model that would cause an integer overflow in embedding lookup operations. Both `embedding_size` and `lookup_size` are products of values provided by the user. Hence, a malicious user could trigger overflows in the multiplication. In certain scenarios, this can then result in heap OOB read/write. Users are advised to upgrade to a patched version.'}]

Fix commit:


CVE: CVE-2022-23560

[{'lang': 'en', 'value': 'Tensorflow is an Open Source Machine Learning Framework. An attacker can craft a TFLite model that would allow limited reads and writes outside of arrays in TFLite. This exploits missing validation in the conversion from sparse tensors to dense tensors. The fix is included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range. User


CVE: CVE-2022-23561

[{'lang': 'en', 'value': 'Tensorflow is an Open Source Machine Learning Framework. An attacker can craft a TFLite model that would cause a write outside of bounds of an array in TFLite. In fact, the attacker can override the linked list used by the memory allocator. This can be leveraged for an arbitrary write primitive under certain conditions. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and Tensor


CVE: CVE-2022-23562

[{'lang': 'en', 'value': 'Tensorflow is an Open Source Machine Learning Framework. The implementation of `Range` suffers from integer overflows. These can trigger undefined behavior or, in some scenarios, extremely large allocations. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.'}]

Fix commit: Merge pull request #52707 fro


CVE: CVE-2022-23564

[{'lang': 'en', 'value': 'Tensorflow is an Open Source Machine Learning Framework. When decoding a resource handle tensor from protobuf, a TensorFlow process can encounter cases where a `CHECK` assertion is invalidated based on user controlled arguments. This allows attackers to cause denial of services in TensorFlow processes. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as the


CVE: CVE-2022-23565

[{'lang': 'en', 'value': 'Tensorflow is an Open Source Machine Learning Framework. An attacker can trigger denial of service via assertion failure by altering a `SavedModel` on disk such that `AttrDef`s of some operation are duplicated. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.'}]

Fix commit: Remove a `DCHECK`-fail, lo


CVE: CVE-2022-23566

[{'lang': 'en', 'value': 'Tensorflow is an Open Source Machine Learning Framework. TensorFlow is vulnerable to a heap OOB write in `Grappler`. The `set_output` function writes to an array at the specified index. Hence, this gives a malicious user a write primitive. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.'}]

Fix commi


CVE: CVE-2022-23567

[{'lang': 'en', 'value': 'Tensorflow is an Open Source Machine Learning Framework. The implementations of `Sparse*Cwise*` ops are vulnerable to integer overflows. These can be used to trigger large allocations (so, OOM based denial of service) or `CHECK`-fails when building new `TensorShape` objects (so, assert failures based denial of service). We are missing some validation on the shapes of the input tensors as well as directly constructing a large `TensorShape` with user-


CVE: CVE-2022-23568

[{'lang': 'en', 'value': 'Tensorflow is an Open Source Machine Learning Framework. The implementation of `AddManySparseToTensorsMap` is vulnerable to an integer overflow which results in a `CHECK`-fail when building new `TensorShape` objects (so, an assert failure based denial of service). We are missing some validation on the shapes of the input tensors as well as directly constructing a large `TensorShape` with user-provided dimensions. The fix will be included in TensorFl


CVE: CVE-2022-23570

[{'lang': 'en', 'value': 'Tensorflow is an Open Source Machine Learning Framework. When decoding a tensor from protobuf, TensorFlow might do a null-dereference if attributes of some mutable arguments to some operations are missing from the proto. This is guarded by a `DCHECK`. However, `DCHECK` is a no-op in production builds and an assertion failure in debug builds. In the first case execution proceeds to the dereferencing of the null pointer, whereas in the second case it


CVE: CVE-2022-23571

[{'lang': 'en', 'value': 'Tensorflow is an Open Source Machine Learning Framework. When decoding a tensor from protobuf, a TensorFlow process can encounter cases where a `CHECK` assertion is invalidated based on user controlled arguments, if the tensors have an invalid `dtype` and 0 elements or an invalid shape. This allows attackers to cause denial of services in TensorFlow processes. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on Tenso


CVE: CVE-2022-23572

[{'lang': 'en', 'value': 'Tensorflow is an Open Source Machine Learning Framework. Under certain scenarios, TensorFlow can fail to specialize a type during shape inference. This case is covered by the `DCHECK` function however, `DCHECK` is a no-op in production builds and an assertion failure in debug builds. In the first case execution proceeds to the `ValueOrDie` line. This results in an assertion failure as `ret` contains an error `Status`, not a value. In the second case


CVE: CVE-2022-23573

[{'lang': 'en', 'value': 'Tensorflow is an Open Source Machine Learning Framework. The implementation of `AssignOp` can result in copying uninitialized data to a new tensor. This later results in undefined behavior. The implementation has a check that the left hand side of the assignment is initialized (to minimize number of allocations), but does not check that the right hand side is also initialized. The fix will be included in TensorFlow 2.8.0. We will also cherrypick thi


CVE: CVE-2022-23574

[{'lang': 'en', 'value': "Tensorflow is an Open Source Machine Learning Framework. There is a typo in TensorFlow's `SpecializeType` which results in heap OOB read/write. Due to a typo, `arg` is initialized to the `i`th mutable argument in a loop where the loop index is `j`. Hence it is possible to assign to `arg` from outside the vector of arguments. Since this is a mutable proto value, it allows both read and write to outside of bounds data. The fix will be included in Tens


CVE: CVE-2022-23575

[{'lang': 'en', 'value': 'Tensorflow is an Open Source Machine Learning Framework. The implementation of `OpLevelCostEstimator::CalculateTensorSize` is vulnerable to an integer overflow if an attacker can create an operation which would involve a tensor with large enough number of elements. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supp


CVE: CVE-2022-23576

[{'lang': 'en', 'value': 'Tensorflow is an Open Source Machine Learning Framework. The implementation of `OpLevelCostEstimator::CalculateOutputSize` is vulnerable to an integer overflow if an attacker can create an operation which would involve tensors with large enough number of elements. We can have a large enough number of dimensions in `output_shape.dim()` or just a small number of dimensions being large enough to cause an overflow in the multiplication. The fix will be


CVE: CVE-2022-23577

[{'lang': 'en', 'value': 'Tensorflow is an Open Source Machine Learning Framework. The implementation of `GetInitOp` is vulnerable to a crash caused by dereferencing a null pointer. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.'}]

Fix commit: Prevent null dereference read in `GetInitOp`.

We have a map of maps. We test tha


CVE: CVE-2022-23578

[{'lang': 'en', 'value': 'Tensorflow is an Open Source Machine Learning Framework. If a graph node is invalid, TensorFlow can leak memory in the implementation of `ImmutableExecutorState::Initialize`. Here, we set `item->kernel` to `nullptr` but it is a simple `OpKernel*` pointer so the memory that was previously allocated to it would leak. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow


CVE: CVE-2022-23579

[{'lang': 'en', 'value': 'Tensorflow is an Open Source Machine Learning Framework. The Grappler optimizer in TensorFlow can be used to cause a denial of service by altering a `SavedModel` such that `SafeToRemoveIdentity` would trigger `CHECK` failures. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.'}]

Fix commit: Prevent a


CVE: CVE-2022-23580

[{'lang': 'en', 'value': 'Tensorflow is an Open Source Machine Learning Framework. During shape inference, TensorFlow can allocate a large vector based on a value from a tensor controlled by the user. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.'}]

Fix commit: Fix abort caused by allocating a too large vector.

We need to


CVE: CVE-2022-23581

[{'lang': 'en', 'value': 'Tensorflow is an Open Source Machine Learning Framework. The Grappler optimizer in TensorFlow can be used to cause a denial of service by altering a `SavedModel` such that `IsSimplifiableReshape` would trigger `CHECK` failures. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.'}]

Fix commit: Remove `C


CVE: CVE-2022-23581

[{'lang': 'en', 'value': 'Tensorflow is an Open Source Machine Learning Framework. The Grappler optimizer in TensorFlow can be used to cause a denial of service by altering a `SavedModel` such that `IsSimplifiableReshape` would trigger `CHECK` failures. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.'}]

Fix commit: Eliminate


CVE: CVE-2022-23581

[{'lang': 'en', 'value': 'Tensorflow is an Open Source Machine Learning Framework. The Grappler optimizer in TensorFlow can be used to cause a denial of service by altering a `SavedModel` such that `IsSimplifiableReshape` would trigger `CHECK` failures. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.'}]

Fix commit: Make `IsS


CVE: CVE-2022-23582

[{'lang': 'en', 'value': 'Tensorflow is an Open Source Machine Learning Framework. A malicious user can cause a denial of service by altering a `SavedModel` such that `TensorByteSize` would trigger `CHECK` failures. `TensorShape` constructor throws a `CHECK`-fail if shape is partial or has a number of elements that would overflow the size of an `int`. The `PartialTensorShape` constructor instead does not cause a `CHECK`-abort if the shape is partial, which is exactly what th


CVE: CVE-2022-23583

[{'lang': 'en', 'value': "Tensorflow is an Open Source Machine Learning Framework. A malicious user can cause a denial of service by altering a `SavedModel` such that any binary op would trigger `CHECK` failures. This occurs when the protobuf part corresponding to the tensor arguments is modified such that the `dtype` no longer matches the `dtype` expected by the op. In that case, calling the templated binary operator for the binary op would receive corrupted data, due to th


CVE: CVE-2022-23584

[{'lang': 'en', 'value': 'Tensorflow is an Open Source Machine Learning Framework. A malicious user can cause a use after free behavior when decoding PNG images. After `png::CommonFreeDecode(&decode)` gets called, the values of `decode.width` and `decode.height` are in an unspecified state. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supp


CVE: CVE-2022-23585

[{'lang': 'en', 'value': 'Tensorflow is an Open Source Machine Learning Framework. When decoding PNG images TensorFlow can produce a memory leak if the image is invalid. After calling `png::CommonInitDecode(..., &decode)`, the `decode` value contains allocated buffers which can only be freed by calling `png::CommonFreeDecode(&decode)`. However, several error case in the function implementation invoke the `OP_REQUIRES` macro which immediately terminates the execution of the f


CVE: CVE-2022-23586

[{'lang': 'en', 'value': 'Tensorflow is an Open Source Machine Learning Framework. A malicious user can cause a denial of service by altering a `SavedModel` such that assertions in `function.cc` would be falsified and crash the Python interpreter. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.'}]

Fix commit: Eliminate `CHEC


CVE: CVE-2022-23586

[{'lang': 'en', 'value': 'Tensorflow is an Open Source Machine Learning Framework. A malicious user can cause a denial of service by altering a `SavedModel` such that assertions in `function.cc` would be falsified and crash the Python interpreter. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.'}]

Fix commit: Eliminate debug


CVE: CVE-2022-23587

[{'lang': 'en', 'value': 'Tensorflow is an Open Source Machine Learning Framework. Under certain scenarios, Grappler component of TensorFlow is vulnerable to an integer overflow during cost estimation for crop and resize. Since the cropping parameters are user controlled, a malicious person can trigger undefined behavior. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are


CVE: CVE-2022-23588

[{'lang': 'en', 'value': 'Tensorflow is an Open Source Machine Learning Framework. A malicious user can cause a denial of service by altering a `SavedModel` such that Grappler optimizer would attempt to build a tensor using a reference `dtype`. This would result in a crash due to a `CHECK`-fail in the `Tensor` constructor as reference types are not allowed. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3


CVE: CVE-2022-23589

[{'lang': 'en', 'value': 'Tensorflow is an Open Source Machine Learning Framework. Under certain scenarios, Grappler component of TensorFlow can trigger a null pointer dereference. There are 2 places where this can occur, for the same malicious alteration of a `SavedModel` file (fixing the first one would trigger the same dereference in the second place). First, during constant folding, the `GraphDef` might not have the required nodes for the binary operation. If a node is m


CVE: CVE-2022-23590

[{'lang': 'en', 'value': 'Tensorflow is an Open Source Machine Learning Framework. A `GraphDef` from a TensorFlow `SavedModel` can be maliciously altered to cause a TensorFlow process to crash due to encountering a `StatusOr` value that is an error and forcibly extracting the value from it. We have patched the issue in multiple GitHub commits and these will be included in TensorFlow 2.8.0 and TensorFlow 2.7.1, as both are affected.'}]

Fix commit: Check for type inference er


CVE: CVE-2022-23591

[{'lang': 'en', 'value': 'Tensorflow is an Open Source Machine Learning Framework. The `GraphDef` format in TensorFlow does not allow self recursive functions. The runtime assumes that this invariant is satisfied. However, a `GraphDef` containing a fragment such as the following can be consumed when loading a `SavedModel`. This would result in a stack overflow during execution as resolving each `NodeDef` means resolving the function itself and its nodes. The fix will be incl


CVE: CVE-2022-23592

[{'lang': 'en', 'value': "Tensorflow is an Open Source Machine Learning Framework. TensorFlow's type inference can cause a heap out of bounds read as the bounds checking is done in a `DCHECK` (which is a no-op during production). An attacker can control the `input_idx` variable such that `ix` would be larger than the number of values in `node_t.args`. The fix will be included in TensorFlow 2.8.0. This is the only affected version."}]

Fix commit: Handle invalid inputs instea


CVE: CVE-2022-23593

[{'lang': 'en', 'value': 'Tensorflow is an Open Source Machine Learning Framework. The `simplifyBroadcast` function in the MLIR-TFRT infrastructure in TensorFlow is vulnerable to a segfault (hence, denial of service), if called with scalar shapes. If all shapes are scalar, then `maxRank` is 0, so we build an empty `SmallVector`. The fix will be included in TensorFlow 2.8.0. This is the only affected version.'}]

Fix commit: Avoid Segfault for scalar shapes.

Calling tensor::


CVE: CVE-2022-23595

[{'lang': 'en', 'value': 'Tensorflow is an Open Source Machine Learning Framework. When building an XLA compilation cache, if default settings are used, TensorFlow triggers a null pointer dereference. In the default scenario, all devices are allowed, so `flr->config_proto` is `nullptr`. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supporte


CVE: CVE-2022-23596

[{'lang': 'en', 'value': 'Junrar is an open source java RAR archive library. In affected versions A carefully crafted RAR archive can trigger an infinite loop while extracting said archive. The impact depends solely on how the application uses the library, and whether files can be provided by malignant users. The problem is patched in 7.4.1. There are no known workarounds and users are advised to upgrade as soon as possible.'}]

Fix commit: fix: invalid subheader type would


CVE: CVE-2022-23597

[{'lang': 'en', 'value': "Element Desktop is a Matrix client for desktop platforms with Element Web at its core. Element Desktop before 1.9.7 is vulnerable to a remote program execution bug with user interaction. The exploit is non-trivial and requires clicking on a malicious link, followed by another button click. To the best of our knowledge, the vulnerability has never been exploited in the wild. If you are using Element Desktop < 1.9.7, we recommend upgrading at your ear


CVE: CVE-2022-23598

[{'lang': 'en', 'value': 'laminas-form is a package for validating and displaying simple and complex forms. When rendering validation error messages via the `formElementErrors()` view helper shipped with laminas-form, many messages will contain the submitted value. However, in laminas-form prior to version 3.1.1, the value was not being escaped for HTML contexts, which could potentially lead to a reflected cross-site scripting attack. Versions 3.1.1 and above contain a patch


CVE: CVE-2022-23599

[{'lang': 'en', 'value': "Products.ATContentTypes are the core content types for Plone 2.1 - 4.3. Versions of Plone that are dependent on Products.ATContentTypes prior to version 3.0.6 are vulnerable to reflected cross site scripting and open redirect when an attacker can get a compromised version of the image_view_fullscreen page in a cache, for example in Varnish. The technique is known as cache poisoning. Any later visitor can get redirected when clicking on a link on thi


CVE: CVE-2022-23601

[{'lang': 'en', 'value': 'Symfony is a PHP framework for web and console applications and a set of reusable PHP components. The Symfony form component provides a CSRF protection mechanism by using a random token injected in the form and using the session to store and control the token submitted by the user. When using the FrameworkBundle, this protection can be enabled or disabled with the configuration. If the configuration is not specified, by default, the mechanism is ena


CVE: CVE-2022-23602

[{'lang': 'en', 'value': 'Nimforum is a lightweight alternative to Discourse written in Nim. In versions prior to 2.2.0 any forum user can create a new thread/post with an include referencing a file local to the host operating system. Nimforum will render the file if able. This can also be done silently by using NimForum\'s post "preview" endpoint. Even if NimForum is running as a non-critical user, the forum.json secrets can be stolen. Version 2.2.0 of NimForum includes pat


CVE: CVE-2022-23603

[{'lang': 'en', 'value': 'iTunesRPC-Remastered is a discord rich presence application for use with iTunes & Apple Music. In code before commit 24f43aa user input is not properly sanitized and code injection is possible. Users are advised to upgrade as soon as is possible. There are no known workarounds for this issue.'}]

Fix commit: Merge pull request from GHSA-3xpp-rhqx-cw96

sec fix


CVE: CVE-2022-23603

[{'lang': 'en', 'value': 'iTunesRPC-Remastered is a discord rich presence application for use with iTunes & Apple Music. In code before commit 24f43aa user input is not properly sanitized and code injection is possible. Users are advised to upgrade as soon as is possible. There are no known workarounds for this issue.'}]

Fix commit: Merge pull request from GHSA-3xpp-rhqx-cw96

sec fix 2


CVE: CVE-2022-23604

[{'lang': 'en', 'value': 'x26-Cogs is a repository of cogs made by Twentysix for the Red Discord bot. Among these cogs is the Defender cog, a tool for Discord server moderation. A vulnerability in the Defender cog prior to version 1.10.0 allows users with admin privileges to issue commands as other users who share the same server. If a bot owner shares the same server as the attacker, it is possible for the attacker to issue bot-owner restricted commands. The issue has been


CVE: CVE-2022-23605

[{'lang': 'en', 'value': 'Wire webapp is a web client for the wire messaging protocol. In versions prior to 2022-01-27-production.0 expired ephemeral messages were not reliably removed from local chat history of Wire Webapp. In versions before 2022-01-27-production.0 ephemeral messages and assets might still be accessible through the local search functionality. Any attempt to view one of these message in the chat view will then trigger the deletion. This issue only affects l


CVE: CVE-2022-23606

[{'lang': 'en', 'value': 'Envoy is an open source edge and service proxy, designed for cloud-native applications. When a cluster is deleted via Cluster Discovery Service (CDS) all idle connections established to endpoints in that cluster are disconnected. A recursion was introduced in the procedure of disconnecting idle connections that can lead to stack exhaustion and abnormal process termination when a cluster has a large number of idle connections. This infinite recursion


CVE: CVE-2022-23608

[{'lang': 'en', 'value': 'PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In versions up to and including 2.11.1 when in a dialog set (or forking) scenario, a hash key shared by multiple UAC dialogs can potentially be prematurely freed when one of the dialogs is destroyed . The issue may cause a dialog set to be registered in the hash table multiple times


CVE: CVE-2022-23609

[{'lang': 'en', 'value': 'iTunesRPC-Remastered is a Discord Rich Presence for iTunes on Windows utility. In affected versions iTunesRPC-Remastered did not properly sanitize user input used to remove files leading to file deletion only limited by the process permissions. Users are advised to upgrade as soon as possible.'}]

Fix commit: quick security fix


CVE: CVE-2022-23611

[{'lang': 'en', 'value': 'iTunesRPC-Remastered is a Discord Rich Presence for iTunes on Windows utility. In affected versions iTunesRPC-Remastered did not properly sanitize image file paths leading to OS level command injection. This issue has been patched in commit cdcd48b. Users are advised to upgrade.'}]

Fix commit: small fix


CVE: CVE-2022-23612

[{'lang': 'en', 'value': "OpenMRS is a patient-based medical record system focusing on giving providers a free customizable electronic medical record system. Affected versions are subject to arbitrary file exfiltration due to failure to sanitize request when satisfying GET requests for `/images` & `/initfilter/scripts`. This can allow an attacker to access any file on a system running OpenMRS that is accessible to the user id OpenMRS is running under. Affected implementation


CVE: CVE-2022-23613

[{'lang': 'en', 'value': 'xrdp is an open source remote desktop protocol (RDP) server. In affected versions an integer underflow leading to a heap overflow in the sesman server allows any unauthenticated attacker which is able to locally access a sesman server to execute code as root. This vulnerability has been patched in version 0.9.18.1 and above. Users are advised to upgrade. There are no known workarounds.'}]

Fix commit: Merge pull request from GHSA-8h98-h426-xf32

Add


CVE: CVE-2022-23614

[{'lang': 'en', 'value': 'Twig is an open source template language for PHP. When in a sandbox mode, the `arrow` parameter of the `sort` filter must be a closure to avoid attackers being able to run arbitrary PHP functions. In affected versions this constraint was not properly enforced and could lead to code injection of arbitrary PHP code. Patched versions now disallow calling non Closure in the `sort` filter as is the case for some other filters. Users are advised to upgrad


CVE: CVE-2022-23615

[{'lang': 'en', 'value': 'XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions any user with SCRIPT right can save a document with the right of the current user which allow accessing API requiring programming right if the current user has programming right. This has been patched in XWiki 13.0. Users are advised to update to resolve this issue. The only known workaround is to limit SCRIPT access.'}]

Fix


CVE: CVE-2022-23617

[{'lang': 'en', 'value': 'XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions any user with edit right can copy the content of a page it does not have access to by using it as template of a new page. This issue has been patched in XWiki 13.2CR1 and 12.10.6. Users are advised to update. There are no known workarounds for this issue.'}]

Fix commit: XWIKI-18430: Wrong handling of template documents
* imp


CVE: CVE-2022-23617

[{'lang': 'en', 'value': 'XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions any user with edit right can copy the content of a page it does not have access to by using it as template of a new page. This issue has been patched in XWiki 13.2CR1 and 12.10.6. Users are advised to update. There are no known workarounds for this issue.'}]

Fix commit: XWIKI-18430: Page content is revealed to users that don


CVE: CVE-2022-23618

[{'lang': 'en', 'value': 'XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions there is no protection against URL redirection to untrusted sites, in particular some well known parameters (xredirect) can be used to perform url redirections. This problem has been patched in XWiki 12.10.7 and XWiki 13.3RC1. Users are advised to update. There are no known workarounds for this issue.'}]

Fix commit: XWIKI-10


CVE: CVE-2022-23619

[{'lang': 'en', 'value': 'XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions it\'s possible to guess if a user has an account on the wiki by using the "Forgot your password" form, even if the wiki is closed to guest users. This problem has been patched on XWiki 12.10.9, 13.4.1 and 13.6RC1. Users are advised yo update. There are no known workarounds for this issue.'}]

Fix commit: XWIKI-18787: Authenti


CVE: CVE-2022-23620

[{'lang': 'en', 'value': 'XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions AbstractSxExportURLFactoryActionHandler#processSx does not escape anything from SSX document references when serializing it on filesystem, it is possible to for the HTML export process to contain reference elements containing filesystem syntax like "../", "./". or "/" in general. The referenced elements are not properly escap


CVE: CVE-2022-23621

[{'lang': 'en', 'value': 'XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions any user with SCRIPT right can read any file located in the XWiki WAR (for example xwiki.cfg and xwiki.properties) through XWiki#invokeServletAndReturnAsString as `$xwiki.invokeServletAndReturnAsString("/WEB-INF/xwiki.cfg")`. This issue has been patched in XWiki versions 12.10.9, 13.4.3 and 13.7-rc-1. Users are advised to upd


CVE: CVE-2022-23622

[{'lang': 'en', 'value': 'XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions there is a cross site scripting (XSS) vector in the `registerinline.vm` template related to the `xredirect` hidden field. This template is only used in the following conditions: 1. The wiki must be open to registration for anyone. 2. The wiki must be closed to view for Guest users or more specifically the XWiki.Registration p


CVE: CVE-2022-23623

[{'lang': 'en', 'value': 'Frourio is a full stack framework, for TypeScript. Frourio users who uses frourio version prior to v0.26.0 and integration with class-validator through `validators/` folder are subject to a input validation vulnerability. Validators do not work properly for request bodies and queries in specific situations and some input is not validated at all. Users are advised to update frourio to v0.26.0 or later and to install `class-transformer` and `reflect-m


CVE: CVE-2022-23624

[{'lang': 'en', 'value': 'Frourio-express is a minimal full stack framework, for TypeScript. Frourio-express users who uses frourio-express version prior to v0.26.0 and integration with class-validator through `validators/` folder are subject to a input validation vulnerability. Validators do not work properly for request bodies and queries in specific situations and some input is not validated at all. Users are advised to update frourio to v0.26.0 or later and to install `c


CVE: CVE-2022-23625

[{'lang': 'en', 'value': "Wire-ios is a messaging application using the wire protocol on apple's ios platform. In versions prior to 3.95 malformed resource identifiers may render the iOS Wire Client completely unusable by causing it to repeatedly crash on launch. These malformed resource identifiers can be generated and sent between Wire users. The root cause lies in [wireapp/wire-ios-transport](https://github.com/wireapp/wire-ios-transport), where code responsible for remov


CVE: CVE-2022-23626

[{'lang': 'en', 'value': 'm1k1o/blog is a lightweight self-hosted facebook-styled PHP blog. Errors from functions `imagecreatefrom*` and `image*` have not been checked properly. Although PHP issued warnings and the upload function returned `false`, the original file (that could contain a malicious payload) was kept on the disk. Users are advised to upgrade as soon as possible. There are no known workarounds for this issue.'}]

Fix commit: check image create errors.


CVE: CVE-2022-23627

[{'lang': 'en', 'value': "ArchiSteamFarm (ASF) is a C# application with primary purpose of idling Steam cards from multiple accounts simultaneously. Due to a bug in ASF code, introduced in version V5.2.2.2, the program didn't adequately verify effective access of the user sending proxy (i.e. `[Bots]`) commands. In particular, a proxy-like command sent to bot `A` targeting bot `B` has incorrectly verified user's access against bot `A` - instead of bot `B`, to which the comman


CVE: CVE-2022-23628

[{'lang': 'en', 'value': "OPA is an open source, general-purpose policy engine. Under certain conditions, pretty-printing an abstract syntax tree (AST) that contains synthetic nodes could change the logic of some statements by reordering array literals. Example of policies impacted are those that parse and compare web paths. **All of these** three conditions have to be met to create an adverse effect: 1. An AST of Rego had to be **created programmatically** such that it ends


CVE: CVE-2022-23630

[{'lang': 'en', 'value': 'Gradle is a build tool with a focus on build automation and support for multi-language development. In some cases, Gradle may skip that verification and accept a dependency that would otherwise fail the build as an untrusted external artifact. This occurs when dependency verification is disabled on one or more configurations and those configurations have common dependencies with other configurations that have dependency verification enabled. If the


CVE: CVE-2022-23633

[{'lang': 'en', 'value': 'Action Pack is a framework for handling and responding to web requests. Under certain circumstances response bodies will not be closed. In the event a response is *not* notified of a `close`, `ActionDispatch::Executor` will not know to reset thread local state for the next request. This can lead to data being leaked to subsequent requests.This has been fixed in Rails 7.0.2.1, 6.1.4.5, 6.0.4.5, and 5.2.6.1. Upgrading is highly recommended, but to wor


CVE: CVE-2022-23634

[{'lang': 'en', 'value': "Puma is a Ruby/Rack web server built for parallelism. Prior to `puma` version `5.6.2`, `puma` may not always call `close` on the response body. Rails, prior to version `7.0.2.2`, depended on the response body being closed in order for its `CurrentAttributes` implementation to work correctly. The combination of these two behaviors (Puma not closing the body + Rails' Executor implementation) causes information leakage. This problem is fixed in Puma ve


CVE: CVE-2022-23637

[{'lang': 'en', 'value': 'K-Box is a web-based application to manage documents, images, videos and geodata. Prior to version 0.33.1, a stored Cross-Site-Scripting (XSS) vulnerability is present in the markdown editor used by the document abstract and markdown file preview. A specifically crafted anchor link can, if clicked, execute untrusted javascript actions, like retrieving user cookies. Version 0.33.1 includes a patch that allows discarding unsafe links.'}]

Fix commit:


CVE: CVE-2022-23638

[{'lang': 'en', 'value': 'svg-sanitizer is a SVG/XML sanitizer written in PHP. A cross-site scripting vulnerability impacts all users of the `svg-sanitizer` library prior to version 0.15.0. This issue is fixed in version 0.15.0. There is currently no workaround available.'}]

Fix commit: Merge pull request from GHSA-fqx8-v33p-4qcc

Advisory fix 1


CVE: CVE-2022-23640

[{'lang': 'en', 'value': 'Excel-Streaming-Reader is an easy-to-use implementation of a streaming Excel reader using Apache POI. Prior to xlsx-streamer 2.1.0, the XML parser that was used did apply all the necessary settings to prevent XML Entity Expansion issues. Upgrade to version 2.1.0 to receive a patch. There is no known workaround.'}]

Fix commit: Updating readme for security release


CVE: CVE-2022-23641

[{'lang': 'en', 'value': 'Discourse is an open source discussion platform. In versions prior to 2.8.1 in the `stable` branch, 2.9.0.beta2 in the `beta` branch, and 2.9.0.beta2 in the `tests-passed` branch, users can trigger a Denial of Service attack by posting a streaming URL. Parsing Oneboxes in the background job trigger an infinite loop, which cause memory leaks. This issue is patched in version 2.8.1 of the `stable` branch, 2.9.0.beta2 of the `beta` branch, and 2.9.0.be


CVE: CVE-2022-23645

[{'lang': 'en', 'value': "swtpm is a libtpms-based TPM emulator with socket, character device, and Linux CUSE interface. Versions prior to 0.5.3, 0.6.2, and 0.7.1 are vulnerable to out-of-bounds read. A specially crafted header of swtpm's state, where the blobheader's hdrsize indicator has an invalid value, may cause an out-of-bounds access when the byte array representing the state of the TPM is accessed. This will likely crash swtpm or prevent it from starting since the st


CVE: CVE-2022-23647

[{'lang': 'en', 'value': "Prism is a syntax highlighting library. Starting with version 1.14.0 and prior to version 1.27.0, Prism's command line plugin can be used by attackers to achieve a cross-site scripting attack. The command line plugin did not properly escape its output, leading to the input text being inserted into the DOM as HTML code. Server-side usage of Prism is not impacted. Websites that do not use the Command Line plugin are also not impacted. This bug has bee


CVE: CVE-2022-23649

[{'lang': 'en', 'value': 'Cosign provides container signing, verification, and storage in an OCI registry for the sigstore project. Prior to version 1.5.2, Cosign can be manipulated to claim that an entry for a signature exists in the Rekor transparency log even if it doesn\'t. This requires the attacker to have pull and push permissions for the signature in OCI. This can happen with both standard signing with a keypair and "keyless signing" with Fulcio. If an attacker has a


CVE: CVE-2022-2365

[{'lang': 'en', 'value': 'Cross-site Scripting (XSS) - Stored in GitHub repository zadam/trilium prior to 0.53.3.'}]

Fix commit: fix note title escaping in export dialog


CVE: CVE-2022-23650

[{'lang': 'en', 'value': 'Netmaker is a platform for creating and managing virtual overlay networks using WireGuard. Prior to versions 0.8.5, 0.9.4, and 010.0, there is a hard-coded cryptographic key in the code base which can be exploited to run admin commands on a remote server if the exploiter know the address and username of the admin. This effects the server (netmaker) component, and not clients. This has been patched in Netmaker v0.8.5, v0.9.4, and v0.10.0. There are c


CVE: CVE-2022-23651

[{'lang': 'en', 'value': 'b2-sdk-python is a python library to access cloud storage provided by backblaze. Linux and Mac releases of the SDK version 1.14.0 and below contain a key disclosure vulnerability that, in certain conditions, can be exploited by local attackers through a time-of-check-time-of-use (TOCTOU) race condition. SDK users of the SqliteAccountInfo format are vulnerable while users of the InMemoryAccountInfo format are safe. The SqliteAccountInfo saves API key


CVE: CVE-2022-23652

[{'lang': 'en', 'value': 'capsule-proxy is a reverse proxy for Capsule Operator which provides multi-tenancy in Kubernetes. In versions prior to 0.2.1 an attacker with a proper authentication mechanism may use a malicious `Connection` header to start a privilege escalation attack towards the Kubernetes API Server. This vulnerability allows for an exploit of the `cluster-admin` Role bound to `capsule-proxy`. There are no known workarounds for this issue.'}]

Fix commit: bug:


CVE: CVE-2022-23653

[{'lang': 'en', 'value': 'B2 Command Line Tool is the official command line tool for the backblaze cloud storage service. Linux and Mac releases of the B2 command-line tool version 3.2.0 and below contain a key disclosure vulnerability that, in certain conditions, can be exploited by local attackers through a time-of-check-time-of-use (TOCTOU) race condition. The command line tool saves API keys (and bucket name-to-id mapping) in a local database file (`$XDG_CONFIG_HOME/b2/a


CVE: CVE-2022-23654

[{'lang': 'en', 'value': 'Wiki.js is a wiki app built on Node.js. In affected versions an authenticated user with write access on a restricted set of paths can update a page outside the allowed paths by specifying a different target page ID while keeping the path intact. The access control incorrectly check the path access against the user-provided values instead of the actual path associated to the page ID. Commit https://github.com/Requarks/wiki/commit/411802ec2f654bb5ed11


CVE: CVE-2022-23656

[{'lang': 'en', 'value': 'Zulip is an open source team chat app. The `main` development branch of Zulip Server from June 2021 and later is vulnerable to a cross-site scripting vulnerability on the recent topics page. An attacker could maliciously craft a full name for their account and send messages to a topic with several participants; a victim who then opens an overflow tooltip including this full name on the recent topics page could trigger execution of JavaScript code co


CVE: CVE-2022-2368

[{'lang': 'en', 'value': 'Business Logic Errors in GitHub repository microweber/microweber prior to 1.2.20.'}]

Fix commit: update


CVE: CVE-2022-23812

[{'lang': 'en', 'value': 'This affects the package node-ipc from 10.1.1 and before 10.1.3. This package contains malicious code, that targets users with IP located in Russia or Belarus, and overwrites their files with a heart emoji. **Note**: from versions 11.0.0 onwards, instead of having malicious code directly in the source of this package, node-ipc imports the peacenotwar package that includes potentially undesired behavior. Malicious Code: **Note:** Don\'t run it! js im


CVE: CVE-2022-23837

[{'lang': 'en', 'value': 'In api.rb in Sidekiq before 5.2.10 and 6.4.0, there is no limit on the number of days when requesting stats for the graph. This overloads the system, affecting the Web UI, and makes it unavailable to users.'}]

Fix commit: Validate `days` parameter to avoid possible DoS in Web UI

Thank you to Sergey Shpakov of http://tutum.space for reporting.


CVE: CVE-2022-23857

[{'lang': 'en', 'value': "model/criteria/criteria.go in Navidrome before 0.47.5 is vulnerable to SQL injection attacks when processing crafted Smart Playlists. An authenticated user could abuse this to extract arbitrary data from the database, including the user table (which contains sensitive information such as the users' encrypted passwords)."}]

Fix commit: Fix potential SQL injection in Smart Playlists


CVE: CVE-2022-23935

[{'lang': 'en', 'value': 'lib/Image/ExifTool.pm in ExifTool before 12.38 mishandles a $file =~ /\\|$/ check, leading to command injection.'}]

Fix commit: Update to 12.38


CVE: CVE-2022-23993

[{'lang': 'en', 'value': "/usr/local/www/pkg.php in pfSense CE before 2.6.0 and pfSense Plus before 22.01 uses $_REQUEST['pkg_filter'] in a PHP echo call, causing XSS."}]

Fix commit: Clean up pkg filter text before use. Fixes #12725

Also remove unnecessary echos of the value.


CVE: CVE-2022-2400

[{'lang': 'en', 'value': 'External Control of File Name or Path in GitHub repository dompdf/dompdf prior to 2.0.0.'}]

Fix commit: Update resource URI validation and handling

URI scheme (protocol) validation rules are now specified through the Options class. By default file and http(s) URIs are allowed and validation rules defined. Validation rules for PHAR URIs are defined but the scheme is not enabled by default.

Resource retrieval has been updated to use file_get_content


CVE: CVE-2022-24065

[{'lang': 'en', 'value': 'The package cookiecutter before 2.1.1 are vulnerable to Command Injection via hg argument injection. When calling the cookiecutter function from Python code with the checkout parameter, it is passed to the hg checkout command in a way that additional flags can be set. The additional flags can be used to perform a command injection.'}]

Fix commit: Merge pull request #1689 from cookiecutter/sanitize-mercurial-checkout

Sanitize Mercurial branch infor


CVE: CVE-2022-24066

[{'lang': 'en', 'value': "The package simple-git before 3.5.0 are vulnerable to Command Injection due to an incomplete fix of [CVE-2022-24433](https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-2421199) which only patches against the git fetch attack vector. A similar use of the --upload-pack feature of git is also supported for git clone, which the prior fix didn't cover."}]

Fix commit: Prevent use of `--upload-pack` as a command in `git.clone` to avoid potential accidental c


CVE: CVE-2022-24122

[{'lang': 'en', 'value': 'kernel/ucount.c in the Linux kernel 5.14 through 5.16.4, when unprivileged user namespaces are enabled, allows a use-after-free and privilege escalation because a ucounts object can outlive its namespace.'}]

Fix commit: ucount:  Make get_ucount a safe get_user replacement

When the ucount code was refactored to create get_ucount it was missed
that some of the contexts in which a rlimit is kept elevated can be
the only reference to the user/ucount i


CVE: CVE-2022-24193

[{'lang': 'en', 'value': 'CasaOS before v0.2.7 was discovered to contain a command injection vulnerability.'}]

Fix commit: Apply multilingual support


CVE: CVE-2022-24278

[{'lang': 'en', 'value': 'The package convert-svg-core before 0.6.4 are vulnerable to Directory Traversal due to improper sanitization of SVG tags. Exploiting this vulnerability is possible by using a specially crafted SVG file.'}]

Fix commit: Convert only first SVG element from input

If the input to be converted contains multiple SVG elements, only the first SVG element should be converted. Currently, and undesirably, all SVG elements were being inserted into the page wit


CVE: CVE-2022-24279

[{'lang': 'en', 'value': 'The package madlib-object-utils before 0.1.8 are vulnerable to Prototype Pollution via the setValue method, as it allows an attacker to merge object prototypes into it. *Note:* This vulnerability derives from an incomplete fix of [CVE-2020-7701](https://security.snyk.io/vuln/SNYK-JS-MADLIBOBJECTUTILS-598676)'}]

Fix commit: fix(set-value): prototype pollution


CVE: CVE-2022-24300

[{'lang': 'en', 'value': 'Minetest before 5.4.0 allows attackers to add or modify arbitrary meta fields of the same item stack as saved user input, aka ItemStack meta injection.'}]

Fix commit: Sanitize ItemStack meta text


CVE: CVE-2022-24301

[{'lang': 'en', 'value': "In Minetest before 5.4.0, players can add or subtract items from a different player's inventory."}]

Fix commit: Prevent players accessing inventories of other players (#10341)


CVE: CVE-2022-24304

[{'lang': 'en', 'value': 'Schema in lib/schema.js in Mongoose before 6.4.6 is vulnerable to prototype pollution.'}]

Fix commit: fix(schema): disallow setting __proto__ when creating schema with dotted properties

Fix #12085


CVE: CVE-2022-24375

[{'lang': 'en', 'value': 'The package node-opcua before 2.74.0 are vulnerable to Denial of Service (DoS) when bypassing the limitations for excessive memory consumption by sending multiple CloseSession requests with the deleteSubscription parameter equal to False.'}]

Fix commit: server: fix Subscription.modify assert


CVE: CVE-2022-24375

[{'lang': 'en', 'value': 'The package node-opcua before 2.74.0 are vulnerable to Denial of Service (DoS) when bypassing the limitations for excessive memory consumption by sending multiple CloseSession requests with the deleteSubscription parameter equal to False.'}]

Fix commit: server: use ServiceFault on request error


CVE: CVE-2022-24429

[{'lang': 'en', 'value': 'The package convert-svg-core before 0.6.3 are vulnerable to Arbitrary Code Injection when using a specially crafted SVG file. An attacker can read arbitrary files from the file system and then show the file content as a converted PNG file.'}]

Fix commit: Remove all disallowed SVG element attributes

In a further attempt to reduce remote code injection attack vectors, all attributes except for a set of allowed standard attributes are removed from th


CVE: CVE-2022-24437

[{'lang': 'en', 'value': 'The package git-pull-or-clone before 2.0.2 are vulnerable to Command Injection due to the use of the --upload-pack feature of git which is also supported for git clone. The source includes the use of the secure child process API spawn(). However, the outpath parameter passed to it may be a command-line argument to the git clone command and result in arbitrary command injection.'}]

Fix commit: fix: fix command injection vector


CVE: CVE-2022-24448

[{'lang': 'en', 'value': 'An issue was discovered in fs/nfs/dir.c in the Linux kernel before 5.16.5. If an application sets the O_DIRECTORY flag, and tries to open a regular file, nfs_atomic_open() performs a regular lookup. If a regular file is found, ENOTDIR should occur, but the server instead returns uninitialized data in the file descriptor.'}]

Fix commit: NFSv4: Handle case where the lookup of a directory fails

If the application sets the O_DIRECTORY flag, and tries


CVE: CVE-2022-24448

[{'lang': 'en', 'value': 'An issue was discovered in fs/nfs/dir.c in the Linux kernel before 5.16.5. If an application sets the O_DIRECTORY flag, and tries to open a regular file, nfs_atomic_open() performs a regular lookup. If a regular file is found, ENOTDIR should occur, but the server instead returns uninitialized data in the file descriptor.'}]

Fix commit: Revert "NFSv4: Handle the special Linux file open access mode"

This reverts commit 44942b4e457beda00981f616402a1a


CVE: CVE-2022-2453

[{'lang': 'en', 'value': 'Use After Free in GitHub repository gpac/gpac prior to 2.1-DEV.'}]

Fix commit: fixed #2212


CVE: CVE-2022-2454

[{'lang': 'en', 'value': 'Integer Overflow or Wraparound in GitHub repository gpac/gpac prior to 2.1-DEV.'}]

Fix commit: fixed #2213


CVE: CVE-2022-2470

[{'lang': 'en', 'value': 'Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 1.2.21.'}]

Fix commit: update


CVE: CVE-2022-24707

[{'lang': 'en', 'value': 'Anuko Time Tracker is an open source, web-based time tracking application written in PHP. UNION SQL injection and time-based blind injection vulnerabilities existed in Time Tracker Puncher plugin in versions of anuko timetracker prior to 1.20.0.5642. This was happening because the Puncher plugin was reusing code from other places and was relying on an unsanitized date parameter in POST requests. Because the parameter was not checked, it was possible


CVE: CVE-2022-24708

[{'lang': 'en', 'value': 'Anuko Time Tracker is an open source, web-based time tracking application written in PHP. ttUser.class.php in Time Tracker versions prior to 1.20.0.5646 was not escaping primary group name for display. Because of that, it was possible for a logged in user to modify primary group name with elements of JavaScript. Such script could then be executed in user browser on subsequent requests on pages where primary group name was displayed. This is vulnerab


CVE: CVE-2022-24710

[{'lang': 'en', 'value': 'Weblate is a copyleft software web-based continuous localization system. Versions prior to 4.11 do not properly neutralize user input used in user name and language fields. Due to this improper neutralization it is possible to perform cross-site scripting via these fields. The issues were fixed in the 4.11 release. Users unable to upgrade are advised to add their own neutralize logic.'}]

Fix commit: translate: Add missing escaping to language name


CVE: CVE-2022-24710

[{'lang': 'en', 'value': 'Weblate is a copyleft software web-based continuous localization system. Versions prior to 4.11 do not properly neutralize user input used in user name and language fields. Due to this improper neutralization it is possible to perform cross-site scripting via these fields. The issues were fixed in the 4.11 release. Users unable to upgrade are advised to add their own neutralize logic.'}]

Fix commit: js: Add missing escaping to username completion


CVE: CVE-2022-24710

[{'lang': 'en', 'value': 'Weblate is a copyleft software web-based continuous localization system. Versions prior to 4.11 do not properly neutralize user input used in user name and language fields. Due to this improper neutralization it is possible to perform cross-site scripting via these fields. The issues were fixed in the 4.11 release. Users unable to upgrade are advised to add their own neutralize logic.'}]

Fix commit: reports: Escape user names in generated reports


CVE: CVE-2022-24711

[{'lang': 'en', 'value': 'CodeIgniter4 is the 4.x branch of CodeIgniter, a PHP full-stack web framework. Prior to version 4.1.9, an improper input validation vulnerability allows attackers to execute CLI routes via HTTP request. Version 4.1.9 contains a patch. There are currently no known workarounds for this vulnerability.'}]

Fix commit: Merge pull request from GHSA-xjp4-6w75-qrj7

Hotfix 4.1.9


CVE: CVE-2022-24713

[{'lang': 'en', 'value': "regex is an implementation of regular expressions for the Rust language. The regex crate features built-in mitigations to prevent denial of service attacks caused by untrusted regexes, or untrusted input matched by trusted regexes. Those (tunable) mitigations already provide sane defaults to prevent attacks. This guarantee is documented and it's considered part of the crate's API. Unfortunately a bug was discovered in the mitigations designed to pre


CVE: CVE-2022-24717

[{'lang': 'en', 'value': 'ssr-pages is an HTML page builder for the purpose of server-side rendering (SSR). In versions prior to 0.1.5, a cross site scripting (XSS) issue can occur when providing untrusted input to the `redirect.link` property as an argument to the `build(MessagePageOptions)` function. While there is no known workaround at this time, there is a patch in version 0.1.5.'}]

Fix commit: fix string encoder


CVE: CVE-2022-24719

[{'lang': 'en', 'value': 'Fluture-Node is a FP-style HTTP and streaming utils for Node based on Fluture. Using `followRedirects` or `followRedirectsWith` with any of the redirection strategies built into fluture-node 4.0.0 or 4.0.1, paired with a request that includes confidential headers such as Authorization or Cookie, exposes you to a vulnerability where, if the destination server were to redirect the request to a server on a third-party domain, or the same domain over un


CVE: CVE-2022-24720

[{'lang': 'en', 'value': 'image_processing is an image processing wrapper for libvips and ImageMagick/GraphicsMagick. Prior to version 1.12.2, using the `#apply` method from image_processing to apply a series of operations that are coming from unsanitized user input allows the attacker to execute shell commands. This method is called internally by Active Storage variants, so Active Storage is vulnerable as well. The vulnerability has been fixed in version 1.12.2 of image_pro


CVE: CVE-2022-24722

[{'lang': 'en', 'value': 'VIewComponent is a framework for building view components in Ruby on Rails. Versions prior to 2.31.2 and 2.49.1 contain a cross-site scripting vulnerability that has the potential to impact anyone using translations with the view_component gem. Data received via user input and passed as an interpolation argument to the `translate` method is not properly sanitized before display. Versions 2.31.2 and 2.49.1 have been released and fully mitigate the vu


CVE: CVE-2022-24723

[{'lang': 'en', 'value': 'URI.js is a Javascript URL mutation library. Before version 1.19.9, whitespace characters are not removed from the beginning of the protocol, so URLs are not parsed properly. This issue has been patched in version 1.19.9. Removing leading whitespace from values before passing them to URI.parse can be used as a workaround.'}]

Fix commit: fix(parse): remove leading whitespace

reported by @p0cas via huntr.dev


CVE: CVE-2022-24728

[{'lang': 'en', 'value': 'CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A vulnerability has been discovered in the core HTML processing module and may affect all plugins used by CKEditor 4 prior to version 4.18.0. The vulnerability allows someone to inject malformed HTML bypassing content sanitization, which could result in executing JavaScript code. This problem has been patched in version 4.18.0. There are currently no known workarounds.'}]

Fix com


CVE: CVE-2022-24732

[{'lang': 'en', 'value': 'Maddy Mail Server is an open source SMTP compatible email server. Versions of maddy prior to 0.5.4 do not implement password expiry or account expiry checking when authenticating using PAM. Users are advised to upgrade. Users unable to upgrade should manually remove expired accounts via existing filtering mechanisms.'}]

Fix commit: auth/pam: Check for account/password expiry

See GHSA-6cp7-g972-w9m9. Thanks Youssef Rebahi-Gilbert (ysf) for
reportin


CVE: CVE-2022-24734

[{'lang': 'en', 'value': "MyBB is a free and open source forum software. In affected versions the Admin CP's Settings management module does not validate setting types correctly on insertion and update, making it possible to add settings of supported type `php` with PHP code, executed on on _Change Settings_ pages. This results in a Remote Code Execution (RCE) vulnerability. The vulnerable module requires Admin CP access with the `Can manage settings?` permission. MyBB's Set


CVE: CVE-2022-24737

[{'lang': 'en', 'value': 'HTTPie is a command-line HTTP client. HTTPie has the practical concept of sessions, which help users to persistently store some of the state that belongs to the outgoing requests and incoming responses on the disk for further usage. Before 3.1.0, HTTPie didn‘t distinguish between cookies and hosts they belonged. This behavior resulted in the exposure of some cookies when there are redirects originating from the actual host to a third party website.


CVE: CVE-2022-24738

[{'lang': 'en', 'value': 'Evmos is the Ethereum Virtual Machine (EVM) Hub on the Cosmos Network. In versions of evmos prior to 2.0.1 attackers are able to drain unclaimed funds from user addresses. To do this an attacker must create a new chain which does not enforce signature verification and connects it to the target evmos instance. The attacker can use this joined chain to transfer unclaimed funds. Users are advised to upgrade. There are no known workarounds for this issu


CVE: CVE-2022-24739

[{'lang': 'en', 'value': 'alltube is an html front end for youtube-dl. On releases prior to 3.0.3, an attacker could craft a special HTML page to trigger either an open redirect attack or a Server-Side Request Forgery attack (depending on how AllTube is configured). The impact is mitigated by the fact the SSRF attack is only possible when the `stream` option is enabled in the configuration. (This option is disabled by default.) 3.0.3 contains a fix for this vulnerability.'}]


CVE: CVE-2022-24746

[{'lang': 'en', 'value': 'Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In affected versions it is possible to inject code via the voucher code form. This issue has been patched in version 6.4.8.1. There are no known workarounds for this issue.'}]

Fix commit: NEXT-19276 - Add filtering to promotion and product codes


CVE: CVE-2022-24747

[{'lang': 'en', 'value': 'Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. Affected versions of shopware do no properly set sensitive HTTP headers to be non-cacheable. If there is an HTTP cache between the server and client then headers may be exposed via HTTP caches. This issue has been resolved in version 6.4.8.2. There are no known workarounds.'}]

Fix commit: NEXT-20309 - Fix cache control


CVE: CVE-2022-24748

[{'lang': 'en', 'value': 'Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In versions prior to 6.4.8.2 it is possible to modify customers and to create orders without App Permission. This issue is a result of improper api route checking. Users are advised to upgrade to version 6.4.8.2. There are no known workarounds.'}]

Fix commit: NEXT-20305 - Secure proxy route to switch customer with ACL


CVE: CVE-2022-24750

[{'lang': 'en', 'value': 'UltraVNC is a free and open source remote pc access software. A vulnerability has been found in versions prior to 1.3.8.0 in which the DSM plugin module, which allows a local authenticated user to achieve local privilege escalation (LPE) on a vulnerable system. The vulnerability has been fixed to allow loading of plugins from the installed directory. Affected users should upgrade their UltraVNC to 1.3.8.0. Users unable to upgrade should not install


CVE: CVE-2022-24751

[{'lang': 'en', 'value': 'Zulip is an open source group chat application. Starting with version 4.0 and prior to version 4.11, Zulip is vulnerable to a race condition during account deactivation, where a simultaneous access by the user being deactivated may, in rare cases, allow continued access by the deactivated user. A patch is available in version 4.11 on the 4.x branch and version 5.0-rc1 on the 5.x branch. Upgrading to a fixed version will, as a side effect, deactivate


CVE: CVE-2022-24752

[{'lang': 'en', 'value': 'SyliusGridBundle is a package of generic data grids for Symfony applications. Prior to versions 1.10.1 and 1.11-rc2, values added at the end of query sorting were passed directly to the database. The maintainers do not know if this could lead to direct SQL injections but took steps to remediate the vulnerability. The issue is fixed in versions 1.10.1 and 1.11-rc2. As a workaround, overwrite the`Sylius\\Component\\Grid\\Sorting\\Sorter.php` class and


CVE: CVE-2022-24753

[{'lang': 'en', 'value': 'Stripe CLI is a command-line tool for the Stripe eCommerce platform. A vulnerability in Stripe CLI exists on Windows when certain commands are run in a directory where an attacker has planted files. The commands are `stripe login`, `stripe config -e`, `stripe community`, and `stripe open`. MacOS and Linux are unaffected. An attacker who successfully exploits the vulnerability can run arbitrary code in the context of the current user. The update addr


CVE: CVE-2022-24754

[{'lang': 'en', 'value': 'PJSIP is a free and open source multimedia communication library written in C language. In versions prior to and including 2.12 PJSIP there is a stack-buffer overflow vulnerability which only impacts PJSIP users who accept hashed digest credentials (credentials with data_type `PJSIP_CRED_DATA_DIGEST`). This issue has been patched in the master branch of the PJSIP repository and will be included with the next release. Users unable to upgrade need to


CVE: CVE-2022-24757

[{'lang': 'en', 'value': 'The Jupyter Server provides the backend (i.e. the core services, APIs, and REST endpoints) for Jupyter web applications. Prior to version 1.15.4, unauthorized actors can access sensitive information from server logs. Anytime a 5xx error is triggered, the auth cookie and other header values are recorded in Jupyter Server logs by default. Considering these logs do not require root access, an attacker can monitor these logs, steal sensitive auth/cookie


CVE: CVE-2022-24761

[{'lang': 'en', 'value': "Waitress is a Web Server Gateway Interface server for Python 2 and 3. When using Waitress versions 2.1.0 and prior behind a proxy that does not properly validate the incoming HTTP request matches the RFC7230 standard, Waitress and the frontend proxy may disagree on where one request starts and where it ends. This would allow requests to be smuggled via the front-end proxy to waitress and later behavior. There are two classes of vulnerability that ma


CVE: CVE-2022-24762

[{'lang': 'en', 'value': 'sysend.js is a library that allows a user to send messages between pages that are open in the same browser. Users that use cross-origin communication may have their communications intercepted. Impact is limited by the communication occurring in the same browser. This issue has been patched in sysend.js version 1.10.0. The only currently known workaround is to avoid sending communications that a user does not want to have intercepted via sysend messa


CVE: CVE-2022-24763

[{'lang': 'en', 'value': "PJSIP is a free and open source multimedia communication library written in the C language. Versions 2.12 and prior contain a denial-of-service vulnerability that affects PJSIP users that consume PJSIP's XML parsing in their apps. Users are advised to update. There are no known workarounds."}]

Fix commit: Merge pull request from GHSA-5x45-qp78-g4p4

* Prevent infinite loop in scanning xml content

* Simplify scanning method

* Optimization


CVE: CVE-2022-24764

[{'lang': 'en', 'value': 'PJSIP is a free and open source multimedia communication library written in C. Versions 2.12 and prior contain a stack buffer overflow vulnerability that affects PJSUA2 users or users that call the API `pjmedia_sdp_print(), pjmedia_sdp_media_print()`. Applications that do not use PJSUA2 and do not directly call `pjmedia_sdp_print()` or `pjmedia_sdp_media_print()` should not be affected. A patch is available on the `master` branch of the `pjsip/pjpro


CVE: CVE-2022-24766

[{'lang': 'en', 'value': "mitmproxy is an interactive, SSL/TLS-capable intercepting proxy. In mitmproxy 7.0.4 and below, a malicious client or server is able to perform HTTP request smuggling attacks through mitmproxy. This means that a malicious client/server could smuggle a request/response through mitmproxy as part of another request/response's HTTP message body. While mitmproxy would only see one request, the target server would see multiple requests. A smuggled request


CVE: CVE-2022-24768

[{'lang': 'en', 'value': "Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All unpatched versions of Argo CD starting with 1.0.0 are vulnerable to an improper access control bug, allowing a malicious user to potentially escalate their privileges to admin-level. Versions starting with 0.8.0 and 0.5.0 contain limited versions of this issue. To perform exploits, an authorized Argo CD user must have push access to an Application's source git or Helm repo


CVE: CVE-2022-24769

[{'lang': 'en', 'value': "Moby is an open-source project created by Docker to enable and accelerate software containerization. A bug was found in Moby (Docker Engine) prior to version 20.10.14 where containers were incorrectly started with non-empty inheritable Linux process capabilities, creating an atypical Linux environment and enabling programs with inheritable file capabilities to elevate those capabilities to the permitted set during `execve(2)`. Normally, when executa


CVE: CVE-2022-24770

[{'lang': 'en', 'value': "`gradio` is an open source framework for building interactive machine learning models and demos. Prior to version 2.8.11, `gradio` suffers from Improper Neutralization of Formula Elements in a CSV File. The `gradio` library has a flagging functionality which saves input/output data into a CSV file on the developer's computer. This can allow a user to save arbitrary text into the CSV file, such as commands. If a program like MS Excel opens such a fil


CVE: CVE-2022-24771

[{'lang': 'en', 'value': 'Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code is lenient in checking the digest algorithm structure. This can allow a crafted structure that steals padding bytes and uses unchecked portion of the PKCS#1 encoded message to forge a signature when a low public exponent is being used. The issue has been addressed in `node-forge` v


CVE: CVE-2022-24772

[{'lang': 'en', 'value': 'Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code does not check for tailing garbage bytes after decoding a `DigestInfo` ASN.1 structure. This can allow padding bytes to be removed and garbage data added to forge a signature when a low public exponent is being used. The issue has been addressed in `node-forge` version 1.3.0. There


CVE: CVE-2022-24773

[{'lang': 'en', 'value': 'Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code does not properly check `DigestInfo` for a proper ASN.1 structure. This can lead to successful verification with signatures that contain invalid structures but a valid digest. The issue has been addressed in `node-forge` version 1.3.0. There are currently no known workarounds.'}]


CVE: CVE-2022-24774

[{'lang': 'en', 'value': 'CycloneDX BOM Repository Server is a bill of materials (BOM) repository server for distributing CycloneDX BOMs. CycloneDX BOM Repository Server before version 2.0.1 has an improper input validation vulnerability leading to path traversal. A malicious user may potentially exploit this vulnerability to create arbitrary directories or a denial of service by deleting arbitrary directories. The vulnerability is resolved in version 2.0.1. The vulnerabilit


CVE: CVE-2022-24777

[{'lang': 'en', 'value': 'grpc-swift is the Swift language implementation of gRPC, a remote procedure call (RPC) framework. Prior to version 1.7.2, a grpc-swift server is vulnerable to a denial of service attack via a reachable assertion. This is due to incorrect logic when handling GOAWAY frames. The attack is low-effort: it takes very little resources to construct and send the required sequence of frames. The impact on availability is high as the server will crash, droppin


CVE: CVE-2022-24778

[{'lang': 'en', 'value': 'The imgcrypt library provides API exensions for containerd to support encrypted container images and implements the ctd-decoder command line tool for use by containerd to decrypt encrypted container images. The imgcrypt function `CheckAuthorization` is supposed to check whether the current used is authorized to access an encrypted image and prevent the user from running an image that another user previously decrypted on the same system. In versions


CVE: CVE-2022-24780

[{'lang': 'en', 'value': 'Combodo iTop is a web based IT Service Management tool. In versions prior to 2.7.6 and 3.0.0, users of the iTop user portal can send TWIG code to the server by forging specific http queries, and execute arbitrary code on the server using http server user privileges. This issue is fixed in versions 2.7.6 and 3.0.0. There are currently no known workarounds.'}]

Fix commit: N°4384 Security hardening


CVE: CVE-2022-24780

[{'lang': 'en', 'value': 'Combodo iTop is a web based IT Service Management tool. In versions prior to 2.7.6 and 3.0.0, users of the iTop user portal can send TWIG code to the server by forging specific http queries, and execute arbitrary code on the server using http server user privileges. This issue is fixed in versions 2.7.6 and 3.0.0. There are currently no known workarounds.'}]

Fix commit: N°4384 Fix PHP warning when decoding formmanager_data when it is already in a P


CVE: CVE-2022-24780

[{'lang': 'en', 'value': 'Combodo iTop is a web based IT Service Management tool. In versions prior to 2.7.6 and 3.0.0, users of the iTop user portal can send TWIG code to the server by forging specific http queries, and execute arbitrary code on the server using http server user privileges. This issue is fixed in versions 2.7.6 and 3.0.0. There are currently no known workarounds.'}]

Fix commit: N°4384 Security hardening
Module parameter flag for extensions


CVE: CVE-2022-24781

[{'lang': 'en', 'value': 'Geon is a board game based on solving questions about the Pythagorean Theorem. Malicious users can obtain the uuid from other users, spoof that uuid through the browser console and become co-owners of the target session. This issue is patched in version 1.1.0. No known workaround exists.'}]

Fix commit: Corrigido saida de usuarios crash do backend se o client manda algo que não seja do tipo string e implementação inicial de contador de usuarios cone


CVE: CVE-2022-24782

[{'lang': 'en', 'value': "Discourse is an open source discussion platform. Versions 2.8.2 and prior in the `stable` branch, 2.9.0.beta3 and prior in the `beta` branch, and 2.9.0.beta3 and prior in the `tests-passed` branch are vulnerable to a data leak. Users can request an export of their own activity. Sometimes, due to category settings, they may have category membership for a secure category. The name of this secure category is shown to the user in the export. The same th


CVE: CVE-2022-24785

[{'lang': 'en', 'value': 'Moment.js is a JavaScript date library for parsing, validating, manipulating, and formatting dates. A path traversal vulnerability impacts npm (server) users of Moment.js between versions 1.0.1 and 2.29.1, especially if a user-provided locale string is directly used to switch moment locale. This problem is patched in 2.29.2, and the patch can be applied to all affected versions. As a workaround, sanitize the user-provided locale name before passing


CVE: CVE-2022-24786

[{'lang': 'en', 'value': 'PJSIP is a free and open source multimedia communication library written in C. PJSIP versions 2.12 and prior do not parse incoming RTCP feedback RPSI (Reference Picture Selection Indication) packet, but any app that directly uses pjmedia_rtcp_fb_parse_rpsi() will be affected. A patch is available in the `master` branch of the `pjsip/pjproject` GitHub repository. There are currently no known workarounds.'}]

Fix commit: Merge pull request from GHSA-v


CVE: CVE-2022-24787

[{'lang': 'en', 'value': 'Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine. In version 0.3.1 and prior, bytestrings can have dirty bytes in them, resulting in the word-for-word comparisons giving incorrect results. Even without dirty nonzero bytes, two bytestrings can compare to equal if one ends with `"\\x00"` because there is no comparison of the length. A patch is available and expected to be part of the 0.3.2 release. There are currently no kn


CVE: CVE-2022-24788

[{'lang': 'en', 'value': 'Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. Versions of vyper prior to 0.3.2 suffer from a potential buffer overrun. Importing a function from a JSON interface which returns `bytes` generates bytecode which does not clamp bytes length, potentially resulting in a buffer overrun. Users are advised to upgrade. There are no known workarounds for this issue.'}]

Fix commit: Merge pull request from GHSA-j2x6-9323-fp7h

Th


CVE: CVE-2022-24791

[{'lang': 'en', 'value': 'Wasmtime is a standalone JIT-style runtime for WebAssembly, using Cranelift. There is a use after free vulnerability in Wasmtime when both running Wasm that uses externrefs and enabling epoch interruption in Wasmtime. If you are not explicitly enabling epoch interruption (it is disabled by default) then you are not affected. If you are explicitly disabling the Wasm reference types proposal (it is enabled by default) then you are also not affected. T


CVE: CVE-2022-24792

[{'lang': 'en', 'value': 'PJSIP is a free and open source multimedia communication library written in C. A denial-of-service vulnerability affects applications on a 32-bit systems that use PJSIP versions 2.12 and prior to play/read invalid WAV files. The vulnerability occurs when reading WAV file data chunks with length greater than 31-bit integers. The vulnerability does not affect 64-bit apps and should not affect apps that only plays trusted WAV files. A patch is availabl