CVE: CVE-2022-24793

[{'lang': 'en', 'value': "PJSIP is a free and open source multimedia communication library written in C. A buffer overflow vulnerability in versions 2.12 and prior affects applications that uses PJSIP DNS resolution. It doesn't affect PJSIP users who utilize an external resolver. A patch is available in the `master` branch of the `pjsip/pjproject` GitHub repository. A workaround is to disable DNS resolution in PJSIP config (by setting `nameserver_count` to zero) or use an ex


CVE: CVE-2022-24794

[{'lang': 'en', 'value': 'Express OpenID Connect is an Express JS middleware implementing sign on for Express web apps using OpenID Connect. Users of the `requiresAuth` middleware, either directly or through the default `authRequired` option, are vulnerable to an Open Redirect when the middleware is applied to a catch all route. If all routes under `example.com` are protected with the `requiresAuth` middleware, a visit to `http://example.com//google.com` will be redirected t


CVE: CVE-2022-24795

[{'lang': 'en', 'value': 'yajl-ruby is a C binding to the YAJL JSON parsing and generation library. The 1.x branch and the 2.x branch of `yajl` contain an integer overflow which leads to subsequent heap memory corruption when dealing with large (~2GB) inputs. The reallocation logic at `yajl_buf.c#L64` may result in the `need` 32bit integer wrapping to 0 when `need` approaches a value of 0x80000000 (i.e. ~2GB of data), which results in a reallocation of buf->alloc into a smal


CVE: CVE-2022-24796

[{'lang': 'en', 'value': 'RaspberryMatic is a free and open-source operating system for running a cloud-free smart-home using the homematicIP / HomeMatic hardware line of IoT devices. A Remote Code Execution (RCE) vulnerability in the file upload facility of the WebUI interface of RaspberryMatic exists. Missing input validation/sanitization in the file upload mechanism allows remote, unauthenticated attackers with network access to the WebUI interface to achieve arbitrary op


CVE: CVE-2022-24797

[{'lang': 'en', 'value': "Pomerium is an identity-aware access proxy. In distributed service mode, Pomerium's Authenticate service exposes pprof debug and prometheus metrics handlers to untrusted traffic. This can leak potentially sensitive environmental information or lead to limited denial of service conditions. This issue is patched in version v0.17.1 Workarounds: Block access to `/debug` and `/metrics` paths on the authenticate service. This can be done with any L7 proxy


CVE: CVE-2022-24798

[{'lang': 'en', 'value': 'Internet Routing Registry daemon version 4 is an IRR database server, processing IRR objects in the RPSL format. IRRd did not always filter password hashes in query responses relating to `mntner` objects and database exports. This may have allowed adversaries to retrieve some of these hashes, perform a brute-force search for the clear-text passphrase, and use these to make unauthorised changes to affected IRR objects. This issue only affected instan


CVE: CVE-2022-24799

[{'lang': 'en', 'value': 'wire-webapp is the web application interface for the wire messaging service. Insufficient escaping in markdown “code highlighting” in the wire-webapp resulted in the possibility of injecting and executing arbitrary HTML code and thus also JavaScript. If a user receives and views such a malicious message, arbitrary code is injected and executed in the context of the victim. This allows the attacker to fully control the user account. Wire-desktop clie


CVE: CVE-2022-24800

[{'lang': 'en', 'value': 'October/System is the system module for October CMS, a self-hosted CMS platform based on the Laravel PHP Framework. Prior to versions 1.0.476, 1.1.12, and 2.2.15, when the developer allows the user to specify their own filename in the `fromData` method, an unauthenticated user can perform remote code execution (RCE) by exploiting a race condition in the temporary storage directory. This vulnerability affects plugins that expose the `October\\Rain\\D


CVE: CVE-2022-24801

[{'lang': 'en', 'value': "Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to version 22.4.0rc1, the Twisted Web HTTP 1.1 server, located in the `twisted.web.http` module, parsed several HTTP request constructs more leniently than permitted by RFC 7230. This non-conformant parsing can lead to desync if requests pass through multiple HTTP parsers, potentially resulting in HTTP request smuggling. Users who may be affected use Twisted


CVE: CVE-2022-24802

[{'lang': 'en', 'value': 'deepmerge-ts is a typescript library providing functionality to deep merging of javascript objects. deepmerge-ts is vulnerable to Prototype Pollution via file deepmerge.ts, function defaultMergeRecords(). This issue has been patched in version 4.0.2. There are no known workarounds for this issue.'}]

Fix commit: fix: protect against prototype pollution


CVE: CVE-2022-24802

[{'lang': 'en', 'value': 'deepmerge-ts is a typescript library providing functionality to deep merging of javascript objects. deepmerge-ts is vulnerable to Prototype Pollution via file deepmerge.ts, function defaultMergeRecords(). This issue has been patched in version 4.0.2. There are no known workarounds for this issue.'}]

Fix commit: Merge pull request #86 from RebeccaStevens/security/prototype-pollution


CVE: CVE-2022-24803

[{'lang': 'en', 'value': 'Asciidoctor-include-ext is Asciidoctor’s standard include processor reimplemented as an extension. Versions prior to 0.4.0, when used to render user-supplied input in AsciiDoc markup, may allow an attacker to execute arbitrary system commands on the host operating system. This attack is possible even when `allow-uri-read` is disabled! The problem has been patched in the referenced commits.'}]

Fix commit: Make #read_lines code more robust, avoid usi


CVE: CVE-2022-24803

[{'lang': 'en', 'value': 'Asciidoctor-include-ext is Asciidoctor’s standard include processor reimplemented as an extension. Versions prior to 0.4.0, when used to render user-supplied input in AsciiDoc markup, may allow an attacker to execute arbitrary system commands on the host operating system. This attack is possible even when `allow-uri-read` is disabled! The problem has been patched in the referenced commits.'}]

Fix commit: Fix command injection vulnerability

Reporte


CVE: CVE-2022-24804

[{'lang': 'en', 'value': "Discourse is an open source platform for community discussion. In stable versions prior to 2.8.3 and beta versions prior 2.9.0.beta4 erroneously expose groups. When a group with restricted visibility has been used to set the permissions of a category, the name of the group is leaked to any user that is able to see the category. To workaround the problem, a site administrator can remove groups with restricted visibility from any category's permission


CVE: CVE-2022-24811

[{'lang': 'en', 'value': 'Combodi iTop is a web based IT Service Management tool. Prior to versions 2.7.6 and 3.0.0, cross-site scripting is possible for scripts outside of script tags when displaying HTML attachments. This issue is fixed in versions 2.7.6 and 3.0.0. There are currently no known workarounds.'}]

Fix commit: N°4129 - Security hardening


CVE: CVE-2022-24813

[{'lang': 'en', 'value': "CreateWiki is Miraheze's MediaWiki extension for requesting & creating wikis. Without the patch for this issue, anonymous comments can be made using Special:RequestWikiQueue when sent directly via POST. A patch for this issue is available in the `master` branch of CreateWiki's GitHub repository."}]

Fix commit: T9018: Add submission check for anonymous users POSTing


CVE: CVE-2022-24815

[{'lang': 'en', 'value': 'JHipster is a development platform to quickly generate, develop, & deploy modern web applications & microservice architectures. SQL Injection vulnerability in entities for applications generated with the option "reactive with Spring WebFlux" enabled and an SQL database using r2dbc. Applications created without "reactive with Spring WebFlux" and applications with NoSQL databases are not affected. Users who have generated a microservice Gateway using


CVE: CVE-2022-24816

[{'lang': 'en', 'value': 'JAI-EXT is an open-source project which aims to extend the Java Advanced Imaging (JAI) API. Programs allowing Jiffle script to be provided via network request can lead to a Remote Code Execution as the Jiffle script is compiled into Java code via Janino, and executed. In particular, this affects the downstream GeoServer project. Version 1.2.22 will contain a patch that disables the ability to inject malicious code into the resulting script. Users un


CVE: CVE-2022-24818

[{'lang': 'en', 'value': 'GeoTools is an open source Java library that provides tools for geospatial data. The GeoTools library has a number of data sources that can perform unchecked JNDI lookups, which in turn can be used to perform class deserialization and result in arbitrary code execution. Similar to the Log4J case, the vulnerability can be triggered if the JNDI names are user-provided, but requires admin-level login to be triggered. The lookups are now restricted in G


CVE: CVE-2022-24822

[{'lang': 'en', 'value': 'Podium is a library for building micro frontends. @podium/layout is a module for building a Podium layout server, and @podium/proxy is a module for proxying HTTP requests from a layout server to a podlet server. In @podium/layout prior to version 4.6.110 and @podium/proxy prior to version 4.2.74, an attacker using the `Trailer` header as part of the request against proxy endpoints has the ability to take down the server. All Podium layouts that incl


CVE: CVE-2022-24823

[{'lang': 'en', 'value': "Netty is an open-source, asynchronous event-driven network application framework. The package `io.netty:netty-codec-http` prior to version 4.1.77.Final contains an insufficient fix for CVE-2021-21290. When Netty's multipart decoders are used local information disclosure can occur via the local system temporary directory if temporary storing uploads on the disk is enabled. This only impacts applications running on Java version 6 and lower. Additional


CVE: CVE-2022-24828

[{'lang': 'en', 'value': "Composer is a dependency manager for the PHP programming language. Integrators using Composer code to call `VcsDriver::getFileContent` can have a code injection vulnerability if the user can control the `$file` or `$identifier` argument. This leads to a vulnerability on packagist.org for example where the composer.json's `readme` field can be used as a vector for injecting parameters into hg/Mercurial via the `$file` argument, or git via the `$ident


CVE: CVE-2022-24829

[{'lang': 'en', 'value': 'Garden is an automation platform for Kubernetes development and testing. In versions prior to 0.12.39 multiple endpoints did not require authentication. In some operating modes this allows for an attacker to gain access to the application erroneously. The configuration is leaked through the /api endpoint on the local server that is responsible for serving the Garden dashboard. At the moment, this server is accessible to 0.0.0.0 which makes it access


CVE: CVE-2022-24830

[{'lang': 'en', 'value': 'OpenClinica is an open source software for Electronic Data Capture (EDC) and Clinical Data Management (CDM). OpenClinica prior to version 3.16 is vulnerable to path traversal in multiple endpoints, leading to arbitrary file read/write, and potential remote code execution. There are no known workarounds. This issue has been patched and users are recommended to upgrade.'}]

Fix commit: OC-17139: code  changes after code review


CVE: CVE-2022-24832

[{'lang': 'en', 'value': 'GoCD is an open source a continuous delivery server. The bundled gocd-ldap-authentication-plugin included with the GoCD Server fails to correctly escape special characters when using the username to construct LDAP queries. While this does not directly allow arbitrary LDAP data exfiltration, it can allow an existing LDAP-authenticated GoCD user with malicious intent to construct and execute malicious queries, allowing them to deduce facts about other


CVE: CVE-2022-24833

[{'lang': 'en', 'value': "PrivateBin is minimalist, open source online pastebin clone where the server has zero knowledge of pasted data. In PrivateBin < v1.4.0 a cross-site scripting (XSS) vulnerability was found. The vulnerability is present in all versions from v0.21 of the project, which was at the time still called ZeroBin. The issue is caused by the fact that SVGs can contain JavaScript. This can allow an attacker to execute code, if the user opens a paste with a speci


CVE: CVE-2022-24838

[{'lang': 'en', 'value': "Nextcloud Calendar is a calendar application for the nextcloud framework. SMTP Command Injection in Appointment Emails via Newlines: as newlines and special characters are not sanitized in the email value in the JSON request, a malicious attacker can inject newlines to break out of the `RCPT TO:<BOOKING USER'S EMAIL> ` SMTP command and begin injecting arbitrary SMTP commands. It is recommended that Calendar is upgraded to 3.2.2. There are no workaro


CVE: CVE-2022-24839

[{'lang': 'en', 'value': 'org.cyberneko.html is an html parser written in Java. The fork of `org.cyberneko.html` used by Nokogiri (Rubygem) raises a `java.lang.OutOfMemoryError` exception when parsing ill-formed HTML markup. Users are advised to upgrade to `>= 1.9.22.noko2`. Note: The upstream library `org.cyberneko.html` is no longer maintained. Nokogiri uses its own fork of this library located at https://github.com/sparklemotion/nekohtml and this CVE applies only to that


CVE: CVE-2022-24840

[{'lang': 'en', 'value': 'django-s3file is a lightweight file upload input for Django and Amazon S3 . In versions prior to 5.5.1 it was possible to traverse the entire AWS S3 bucket and in most cases to access or delete files. If the `AWS_LOCATION` setting was set, traversal was limited to that location only. The issue was discovered by the maintainer. There were no reports of the vulnerability being known to or exploited by a third party, prior to the release of the patch.


CVE: CVE-2022-24841

[{'lang': 'en', 'value': 'fleetdm/fleet is an open source device management, built on osquery. All versions of fleet making use of the teams feature are affected by this authorization bypass issue. Fleet instances without teams, or with teams but without restricted team accounts are not affected. In affected versions a team admin can erroneously add themselves as admin, maintainer or observer on other teams. Users are advised to upgrade to version 4.13. There are no known wo


CVE: CVE-2022-24842

[{'lang': 'en', 'value': 'MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. A security issue was found where an non-admin user is able to create service accounts for root or other admin users and then is able to assume their access policies via the generated credentials. This in turn allows the user to escalate privilege to that of the root user. This vulnerability has been resolved in pull request #14729 and is included in `RE


CVE: CVE-2022-24845

[{'lang': 'en', 'value': 'Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. In affected versions, the return of `<iface>.returns_int128()` is not validated to fall within the bounds of `int128`. This issue can result in a misinterpretation of the integer value and lead to incorrect behavior. As of v0.3.0, `<iface>.returns_int128()` is validated in simple expressions, but not complex expressions. Users are advised to upgrade. There is no known work


CVE: CVE-2022-24851

[{'lang': 'en', 'value': 'LDAP Account Manager (LAM) is an open source web frontend for managing entries stored in an LDAP directory. The profile editor tool has an edit profile functionality, the parameters on this page are not properly sanitized and hence leads to stored XSS attacks. An authenticated user can store XSS payloads in the profiles, which gets triggered when any other user try to access the edit profile page. The pdf editor tool has an edit pdf profile function


CVE: CVE-2022-24856

[{'lang': 'en', 'value': 'FlyteConsole is the web user interface for the Flyte platform. FlyteConsole prior to version 0.52.0 is vulnerable to server-side request forgery (SSRF) when FlyteConsole is open to the general internet. An attacker can exploit any user of a vulnerable instance to access the internal metadata server or other unauthenticated URLs. Passing of headers to an unauthorized actor may occur. The patch for this issue deletes the entire `cors_proxy`, as this i


CVE: CVE-2022-24857

[{'lang': 'en', 'value': "django-mfa3 is a library that implements multi factor authentication for the django web framework. It achieves this by modifying the regular login view. Django however has a second login view for its admin area. This second login view was not modified, so the multi factor authentication can be bypassed. Users are affected if they have activated both django-mfa3 (< 0.5.0) and django.contrib.admin and have not taken any other measures to prevent users


CVE: CVE-2022-24861

[{'lang': 'en', 'value': 'Databasir is a team-oriented relational database model document management platform. Databasir 1.01 has remote code execution vulnerability. JDBC drivers are not validated prior to use and may be provided by users of the system. This can lead to code execution by any basic user who has access to the system. Users are advised to upgrade. There are no known workarounds to this issue.'}]

Fix commit: fix some security bug (#103)

* fix: use hard-code s


CVE: CVE-2022-24863

[{'lang': 'en', 'value': 'http-swagger is an open source wrapper to automatically generate RESTful API documentation with Swagger 2.0. In versions of http-swagger prior to 1.2.6 an attacker may perform a denial of service attack consisting of memory exhaustion on the host system. The cause of the memory exhaustion is down to improper handling of http methods. Users are advised to upgrade. Users unable to upgrade may to restrict the path prefix to the "GET" method as a workar


CVE: CVE-2022-24865

[{'lang': 'en', 'value': "HumHub is an Open Source Enterprise Social Network. In affected versions users who are forced to change their password by an administrator may retrieve other users' data. This issue has been resolved by commit `eb83de20`. It is recommended that the HumHub is upgraded to 1.11.0, 1.10.4 or 1.9.4. There are no known workarounds for this issue."}]

Fix commit: Fix must change password (#5638)

* Fix must change password

* Update CHANGELOG.md (#5638)


CVE: CVE-2022-24867

[{'lang': 'en', 'value': 'GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. When you pass the config to the javascript, some entries are filtered out. The variable ldap_pass is not filtered and when you look at the source code of the rendered page, we can see the password for the root dn. Users are advised to upgrade. There is no known workaround for this issue.'}]

Fix commit: Do not e


CVE: CVE-2022-24868

[{'lang': 'en', 'value': 'GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In versions prior to 10.0.0 one can exploit a lack of sanitization on SVG file uploads and inject javascript into their user avatar. As a result any user viewing the avatar will be subject to a cross site scripting attack. Users of GLPI are advised to upgrade. Users unable to upgrade should disallow SVG avatars.


CVE: CVE-2022-24869

[{'lang': 'en', 'value': "GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In versions prior to 10.0.0 one can use ticket's followups or setup login messages with a stylesheet link. This may allow for a cross site scripting attack vector. This issue is partially mitigated by cors security of browsers, though users are still advised to upgrade."}]

Fix commit: Merge pull request from GH


CVE: CVE-2022-24871

[{'lang': 'en', 'value': 'Shopware is an open commerce platform based on Symfony Framework and Vue. In affected versions an attacker can abuse the Admin SDK functionality on the server to read or update internal resources. Users are advised to update to the current version 6.4.10.1. For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. There are no known workarounds for this issue.'}]

Fix commit: NEXT-21034 - Dont restore


CVE: CVE-2022-24872

[{'lang': 'en', 'value': 'Shopware is an open commerce platform based on Symfony Framework and Vue. Permissions set to sales channel context by admin-api are still usable within normal user session. Users are advised to update to the current version 6.4.10.1. For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. There are no known workarounds for this issue.'}]

Fix commit: NEXT-21034 - Dont restore permissions


CVE: CVE-2022-24875

[{'lang': 'en', 'value': 'The CVEProject/cve-services is an open source project used to operate the CVE services api. In versions up to and including 1.1.1 the `org.conroller.js` code would erroneously log user secrets. This has been resolved in commit `46d98f2b` and should be available in subsequent versions of the software. Users of the software are advised to manually apply the `46d98f2b` commit or to update when a new version becomes available. As a workaround users shou


CVE: CVE-2022-24876

[{'lang': 'en', 'value': 'GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. Kanban is a GLPI view to display Projects, Tickets, Changes or Problems on a task board. In versions prior to 10.0.1 a user can exploit a cross site scripting vulnerability in Kanban by injecting HTML code in its user name. Users are advised to upgrade. There are no known workarounds for this issue.'}]

Fix comm


CVE: CVE-2022-24880

[{'lang': 'en', 'value': 'flask-session-captcha is a package which allows users to extend Flask by adding an image based captcha stored in a server side session. In versions prior to 1.2.1, he `captcha.validate()` function would return `None` if passed no value (e.g. by submitting an having an empty form). If implementing users were checking the return value to be **False**, the captcha verification check could be bypassed. Version 1.2.1 fixes the issue. Users can workaround


CVE: CVE-2022-24881

[{'lang': 'en', 'value': 'Ballcat Codegen provides the function of online editing code to generate templates. In versions prior to 1.0.0.beta.2, attackers can implement remote code execution through malicious code injection of the template engine. This happens because Velocity and freemarker templates are introduced but input verification is not done. The fault is rectified in version 1.0.0.beta.2.'}]

Fix commit: :lock: 修改模板引擎的默认安全策略，以防止RCE


CVE: CVE-2022-24884

[{'lang': 'en', 'value': 'ecdsautils is a tiny collection of programs used for ECDSA (keygen, sign, verify). `ecdsa_verify_[prepare_]legacy()` does not check whether the signature values `r` and `s` are non-zero. A signature consisting only of zeroes is always considered valid, making it trivial to forge signatures. Requiring multiple signatures from different public keys does not mitigate the issue: `ecdsa_verify_list_legacy()` will accept an arbitrary number of such forged


CVE: CVE-2022-24896

[{'lang': 'en', 'value': 'Tuleap is a Free & Open Source Suite to manage software developments and collaboration. In versions prior to 13.7.99.239 Tuleap does not properly verify authorizations when displaying the content of tracker report renderer and chart widgets. Malicious users could use this vulnerability to retrieve the name of a tracker they cannot access as well as the name of the fields used in reports.'}]

Fix commit: request #26729 Tracker report renderer and cha


CVE: CVE-2022-24897

[{'lang': 'en', 'value': 'APIs to evaluate content with Velocity is a package for APIs to evaluate content with Velocity. Starting with version 2.3 and prior to 12.6.7, 12.10.3, and 13.0, the velocity scripts are not properly sandboxed against using the Java File API to perform read or write operations on the filesystem. Writing an attacking script in Velocity requires the Script rights in XWiki so not all users can use it, and it also requires finding an XWiki API which ret


CVE: CVE-2022-24898

[{'lang': 'en', 'value': 'org.xwiki.commons:xwiki-commons-xml is a common module used by other XWiki top level projects. Starting in version 2.7 and prior to versions 12.10.10, 13.4.4, and 13.8-rc-1, it is possible for a script to access any file accessing to the user running XWiki application server with XML External Entity Injection through the XML script service. The problem has been patched in versions 12.10.10, 13.4.4, and 13.8-rc-1. There is no easy workaround for fixi


CVE: CVE-2022-24899

[{'lang': 'en', 'value': 'Contao is a powerful open source CMS that allows you to create professional websites and scalable web applications. In versions of Contao prior to 4.13.3 it is possible to inject code into the canonical tag. As a workaround users may disable canonical tags in the root page settings.'}]

Fix commit: Merge pull request from GHSA-m8x6-6r63-qvj2


CVE: CVE-2022-24900

[{'lang': 'en', 'value': 'Piano LED Visualizer is software that allows LED lights to light up as a person plays a piano connected to a computer. Version 1.3 and prior are vulnerable to a path traversal attack. The `os.path.join` call is unsafe for use with untrusted input. When the `os.path.join` call encounters an absolute path, it ignores all the parameters it has encountered till that point and starts working with the new absolute path. Since the "malicious" parameter rep


CVE: CVE-2022-24903

[{'lang': 'en', 'value': 'Rsyslog is a rocket-fast system for log processing. Modules for TCP syslog reception have a potential heap buffer overflow when octet-counted framing is used. This can result in a segfault or some other malfunction. As of our understanding, this vulnerability can not be used for remote code execution. But there may still be a slight chance for experts to do that. The bug occurs when the octet count is read. While there is a check for the maximum num


CVE: CVE-2022-24912

[{'lang': 'en', 'value': 'The package github.com/runatlantis/atlantis/server/controllers/events before 0.19.7 are vulnerable to Timing Attack in the webhook event validator code, which does not use a constant-time comparison function to validate the webhook secret. It can allow an attacker to recover this secret as an attacker and then forge webhook events.'}]

Fix commit: fix: use constant time comparison of webhook secret in gitlab event validator (#2392)


CVE: CVE-2022-2493

[{'lang': 'en', 'value': 'Data Access from Outside Expected Data Manager Component in GitHub repository openemr/openemr prior to 7.0.0.'}]

Fix commit: bug fixes b1 (#5280)


CVE: CVE-2022-2494

[{'lang': 'en', 'value': 'Cross-site Scripting (XSS) - Stored in GitHub repository openemr/openemr prior to 7.0.0.'}]

Fix commit: bug fix d (#5368)


CVE: CVE-2022-24949

[{'lang': 'en', 'value': 'A privilege escalation to root exists in Eternal Terminal prior to version 6.2.0. This is due to the combination of a race condition, buffer overflow, and logic bug all in PipeSocketHandler::listen().'}]

Fix commit: red fixes (#468)

* red fixes

* remove magic number


CVE: CVE-2022-2495

[{'lang': 'en', 'value': 'Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.2.21.'}]

Fix commit: update


CVE: CVE-2022-24950

[{'lang': 'en', 'value': "A race condition exists in Eternal Terminal prior to version 6.2.0 that allows an authenticated attacker to hijack other users' SSH authorization socket, enabling the attacker to login to other systems as the targeted users. The bug is in UserTerminalRouter::getInfoForId()."}]

Fix commit: red fixes (#468)

* red fixes

* remove magic number


CVE: CVE-2022-24953

[{'lang': 'en', 'value': 'The Crypt_GPG extension before 1.6.7 for PHP does not prevent additional options in GPG calls, which presents a risk for certain environments and GPG versions.'}]

Fix commit: Insert the end-of-options marker before operation arguments.

This marker stops the parsing of additional options during external
calls to GPG. This behavior is unintended but its security impact is
dependent on the environment and the GPG version in use.


CVE: CVE-2022-24958

[{'lang': 'en', 'value': 'drivers/usb/gadget/legacy/inode.c in the Linux kernel through 5.16.8 mishandles dev->buf release.'}]

Fix commit: usb: gadget: clear related members when goto fail

dev->config and dev->hs_config and dev->dev need to be cleaned if
dev_config fails to avoid UAF.

Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Hangyu Hua <hbh25y@gmail.com>
Link: https://lore.kernel.org/r/20211231172138.7993-3-hbh25y@gmail.com
Signed-off-by: Greg Kroah


CVE: CVE-2022-24958

[{'lang': 'en', 'value': 'drivers/usb/gadget/legacy/inode.c in the Linux kernel through 5.16.8 mishandles dev->buf release.'}]

Fix commit: usb: gadget: don't release an existing dev->buf

dev->buf does not need to be released if it already exists before
executing dev_config.

Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Hangyu Hua <hbh25y@gmail.com>
Link: https://lore.kernel.org/r/20211231172138.7993-2-hbh25y@gmail.com
Signed-off-by: Greg Kroah-Hartman <g


CVE: CVE-2022-24959

[{'lang': 'en', 'value': 'An issue was discovered in the Linux kernel before 5.16.5. There is a memory leak in yam_siocdevprivate in drivers/net/hamradio/yam.c.'}]

Fix commit: yam: fix a memory leak in yam_siocdevprivate()

ym needs to be free when ym->cmd != SIOCYAMSMCS.

Fixes: 0781168e23a2 ("yam: fix a missing-check bug")
Signed-off-by: Hangyu Hua <hbh25y@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>


CVE: CVE-2022-24976

[{'lang': 'en', 'value': 'Atheme IRC Services before 7.2.12, when used in conjunction with InspIRCd, allows authentication bypass by ending an IRC handshake at a certain point during a challenge-response login sequence.'}]

Fix commit: saslserv/main: Track EID we're pending login to

The existing model does not remember that we've sent a SVSLOGIN for a
given SASL session, and simply assumes that if a client is introduced
with a SASL session open, that session must have succe


CVE: CVE-2022-24977

[{'lang': 'en', 'value': 'ImpressCMS before 1.4.2 allows unauthenticated remote code execution via ...../// directory traversal in origName or imageName, leading to unsafe interaction with the CKEditor processImage.php script. The payload may be placed in PHP_SESSION_UPLOAD_PROGRESS when the PHP installation supports upload_progress.'}]

Fix commit: Prevents using submitted filenames with ../ for controller (#812)

* Prevents using submitted filenames with ../ for controller


CVE: CVE-2022-25044

[{'lang': 'en', 'value': 'Espruino 2v11.251 was discovered to contain a stack buffer overflow via src/jsvar.c in jsvNewFromString.'}]

Fix commit: Fix potential corruption issue caused by `delete [].__proto__` (fix #2142)


CVE: CVE-2022-25050

[{'lang': 'en', 'value': 'rtl_433 21.12 was discovered to contain a stack overflow in the function somfy_iohc_decode(). This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted file.'}]

Fix commit: minor: Fix overflow in Clipsal-CMR113 and Somfy-IOHC reported by aug5t7


CVE: CVE-2022-25051

[{'lang': 'en', 'value': 'An Off-by-one Error occurs in cmr113_decode of rtl_433 21.12 when decoding a crafted file.'}]

Fix commit: minor: Fix overflow in Clipsal-CMR113 and Somfy-IOHC reported by aug5t7


CVE: CVE-2022-25139

[{'lang': 'en', 'value': 'njs through 0.7.0, used in NGINX, was discovered to contain a heap use-after-free in njs_await_fulfilled.'}]

Fix commit: Fixed recursive async function calls.

Previously, PromiseCapability record was stored (function->context)
directly in function object during a function invocation.  This is
not correct, because PromiseCapability record should be linked to
current execution context.  As a result, function->context is
overwritten with consecutive


CVE: CVE-2022-2514

[{'lang': 'en', 'value': 'The time and filter parameters in Fava prior to v1.22 are vulnerable to reflected XSS due to the lack of escaping of error messages which contained the parameters in verbatim.'}]

Fix commit: avoid use of |safe filter in templates

Explicitly mark those few places where we need to pass in data that
should not be escaped on the Python side.


CVE: CVE-2022-2522

[{'lang': 'en', 'value': 'Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0061.'}]

Fix commit: patch 9.0.0061: ml_get error with nested autocommand

Problem:    ml_get error with nested autocommand.
Solution:   Also check line numbers for a nested autocommand. (closes #10761)


CVE: CVE-2022-2522

[{'lang': 'en', 'value': 'Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0061.'}]

Fix commit: patch 9.0.0060: accessing uninitialized memory when completing long line

Problem:    Accessing uninitialized memory when completing long line.
Solution:   Terminate string with NUL.


CVE: CVE-2022-2523

[{'lang': 'en', 'value': 'Cross-site Scripting (XSS) - Reflected in GitHub repository beancount/fava prior to 1.22.2.'}]

Fix commit: fix xss issue in query filter


CVE: CVE-2022-25231

[{'lang': 'en', 'value': 'The package node-opcua before 2.74.0 are vulnerable to Denial of Service (DoS) by sending a specifically crafted OPC UA message with a special OPC UA NodeID, when the requested memory allocation exceeds the v8’s memory limit.'}]

Fix commit: server: use ServiceFault on request error


CVE: CVE-2022-25258

[{'lang': 'en', 'value': 'An issue was discovered in drivers/usb/gadget/composite.c in the Linux kernel before 5.16.10. The USB Gadget subsystem lacks certain validation of interface OS descriptor requests (ones with a large array index and ones associated with NULL function pointer retrieval). Memory corruption might occur.'}]

Fix commit: USB: gadget: validate interface OS descriptor requests

Stall the control endpoint in case provided index exceeds array size of
MAX_CONF


CVE: CVE-2022-25297

[{'lang': 'en', 'value': 'This affects the package drogonframework/drogon before 1.7.5. The unsafe handling of file names during upload using HttpFile::save() method may enable attackers to write files to arbitrary locations outside the designated target folder.'}]

Fix commit: Prevent malformed upload path causing arbitrary write (#1174)


CVE: CVE-2022-25298

[{'lang': 'en', 'value': 'This affects the package sprinfall/webcc before 0.3.0. It is possible to traverse directories to fetch arbitrary files from the server.'}]

Fix commit: fix static file serving security issue; fix url path encoding issue


CVE: CVE-2022-25299

[{'lang': 'en', 'value': 'This affects the package cesanta/mongoose before 7.6. The unsafe handling of file names during upload using mg_http_upload() method may enable attackers to write files to arbitrary locations outside the designated target folder.'}]

Fix commit: Protect against the directory traversal in mg_upload()


CVE: CVE-2022-25303

[{'lang': 'en', 'value': 'The package whoogle-search before 0.7.2 are vulnerable to Cross-site Scripting (XSS) via the query string parameter q. In the case where it does not contain the http string, it is used to build the error_message that is then rendered in the error.html template, using the [flask.render_template](https://flask.palletsprojects.com/en/2.1.x/api/flask.render_template) function. However, the error_message is rendered using the [| safe filter](https://jinj


CVE: CVE-2022-25317

[{'lang': 'en', 'value': 'An issue was discovered in Cerebrate through 1.4. genericForm allows reflected XSS in form descriptions via a user-controlled description.'}]

Fix commit: fix: [security] genericForm reflected XSS in form descriptions for user controlled descriptions

- accessible via the MISP local tool setting change
- sanitise the description

- as reported by Dawid Czarnecki from Zigrin Security


CVE: CVE-2022-25318

[{'lang': 'en', 'value': 'An issue was discovered in Cerebrate through 1.4. An incorrect sharing group ACL allowed an unprivileged user to edit and modify sharing groups.'}]

Fix commit: fix: [security] Sharing group ACL fixes

- added indirect object reference protection
- added correct ACL functionalities to delete, addOrg, removeOrg

- as reported by Dawid Czarnecki from Zigrin Security


CVE: CVE-2022-25319

[{'lang': 'en', 'value': 'An issue was discovered in Cerebrate through 1.4. Endpoints could be open even when not enabled.'}]

Fix commit: fix: [security] open endpoints should only be open when enabled

- as reported by Dawid Czarnecki from Zigrin Security


CVE: CVE-2022-25320

[{'lang': 'en', 'value': 'An issue was discovered in Cerebrate through 1.4. Username enumeration could occur.'}]

Fix commit: fix: [security] user settings allow enumeration of usernames

- as reported by Dawid Czarnecki from Zigrin Security


CVE: CVE-2022-25321

[{'lang': 'en', 'value': 'An issue was discovered in Cerebrate through 1.4. XSS could occur in the bookmarks component.'}]

Fix commit: fix: [settings:settingField] Enforce sanitization of input fields

- As reported by Dawid Czarnecki from Zigrin Security


CVE: CVE-2022-25321

[{'lang': 'en', 'value': 'An issue was discovered in Cerebrate through 1.4. XSS could occur in the bookmarks component.'}]

Fix commit: fix: [userSettings] Perform URI validation for bookmarks

- As reported by Dawid Czarnecki from Zigrin Security


CVE: CVE-2022-25352

[{'lang': 'en', 'value': 'The package libnested before 1.5.2 are vulnerable to Prototype Pollution via the set function in index.js. **Note:** This vulnerability derives from an incomplete fix for [CVE-2020-28283](https://security.snyk.io/vuln/SNYK-JS-LIBNESTED-1054930)'}]

Fix commit: better fix for prototype pollution vulnerability

cheers Idan Digmi of Snyk Security


CVE: CVE-2022-25354

[{'lang': 'en', 'value': 'The package set-in before 2.0.3 are vulnerable to Prototype Pollution via the setIn method, as it allows an attacker to merge object prototypes into it. **Note:** This vulnerability derives from an incomplete fix of [CVE-2020-28273](https://security.snyk.io/vuln/SNYK-JS-SETIN-1048049)'}]

Fix commit: better fix for prototype pollution vulnerability

cheers Idan Digmi of Snyk Security


CVE: CVE-2022-25358

[{'lang': 'en', 'value': 'A ..%2F path traversal vulnerability exists in the path handler of awful-salmonella-tar before 0.0.4. Attackers can only list directories (not read files). This occurs because the safe-path? Scheme predicate is not used for directories.'}]

Fix commit: Fix path traversal vulnerability

This change fixes a path traversal vulnerability that would allow
attackers to navigate through the filesystem of the server (provided
execute access to directories f


CVE: CVE-2022-25372

[{'lang': 'en', 'value': 'Pritunl Client through 1.2.3019.52 on Windows allows local privilege escalation, related to an ACL entry for CREATOR OWNER in platform_windows.go.'}]

Fix commit: Update acl in service platform windows


CVE: CVE-2022-25375

[{'lang': 'en', 'value': 'An issue was discovered in drivers/usb/gadget/function/rndis.c in the Linux kernel before 5.16.10. The RNDIS USB gadget lacks validation of the size of the RNDIS_MSG_SET command. Attackers can obtain sensitive information from kernel memory.'}]

Fix commit: usb: gadget: rndis: check size of RNDIS_MSG_SET command

Check the size of the RNDIS_MSG_SET command given to us before
attempting to respond to an invalid message size.

Reported-by: Szymon Heid


CVE: CVE-2022-2549

[{'lang': 'en', 'value': 'NULL Pointer Dereference in GitHub repository gpac/gpac prior to v2.1.0-DEV.'}]

Fix commit: fixed #2232


CVE: CVE-2022-2550

[{'lang': 'en', 'value': 'OS Command Injection in GitHub repository hestiacp/hestiacp prior to 1.6.5.'}]

Fix commit: fix DokuWiki shell issue

UNTESTED as of writing; reported by https://huntr.dev/users/redstarp2/


CVE: CVE-2022-2553

[{'lang': 'en', 'value': 'The authfile directive in the booth config file is ignored, preventing use of authentication in communications from node to node. As a result, nodes that do not have the correct authentication key are not prevented from communicating with other nodes in the cluster.'}]

Fix commit: Revert "Refactor: main: substitute is_auth_req macro"

This reverts commit da79b8ba28ad4837a0fee13e5f8fb6f89fe0e24c.

authfile != authkey

Signed-off-by: Jan Friesse <jfri


CVE: CVE-2022-2564

[{'lang': 'en', 'value': 'Prototype Pollution in GitHub repository automattic/mongoose prior to 6.4.6.'}]

Fix commit: fix(schema): disallow setting __proto__ when creating schema with dotted properties

Fix #12085


CVE: CVE-2022-2571

[{'lang': 'en', 'value': 'Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0101.'}]

Fix commit: patch 9.0.0102: reading past end of line with insert mode completion

Problem:    Reading past end of line with insert mode completion.
Solution:   Check text length.


CVE: CVE-2022-25759

[{'lang': 'en', 'value': 'The package convert-svg-core before 0.6.2 are vulnerable to Remote Code Injection via sending an SVG file containing the payload.'}]

Fix commit: Strip onload attribute from SVG input

In order to prevent a remote code injection, the `onload` attribute needs to be removed from the SVG input as Puppeteer/Chromium will execute any code within it which could potentially be malicious.

Fixes #81


CVE: CVE-2022-25761

[{'lang': 'en', 'value': 'The package open62541/open62541 before 1.2.5, from 1.3-rc1 and before 1.3.1 are vulnerable to Denial of Service (DoS) due to a missing limitation on the number of received chunks - per single session or in total for all concurrent sessions. An attacker can exploit this vulnerability by sending an unlimited number of huge chunks (e.g. 2GB each) without sending the Final closing chunk.'}]

Fix commit: fix(plugin): Add default limits for chunks and mes


CVE: CVE-2022-2580

[{'lang': 'en', 'value': 'Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0102.'}]

Fix commit: patch 9.0.0104: going beyond allocated memory when evaluating string constant

Problem:    Going beyond allocated memory when evaluating string constant.
Solution:   Properly skip over <Key> form.


CVE: CVE-2022-2581

[{'lang': 'en', 'value': 'Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.0104.'}]

Fix commit: patch 9.0.0105: illegal memory access when pattern starts with illegal byte

Problem:    Illegal memory access when pattern starts with illegal byte.
Solution:   Do not match a character with an illegal byte.


CVE: CVE-2022-25839

[{'lang': 'en', 'value': 'The package url-js before 2.1.0 are vulnerable to Improper Input Validation due to improper parsing, which makes it is possible for the hostname to be spoofed. http://\\\\\\\\\\\\\\\\localhost and http://localhost are the same URL. However, the hostname is not parsed as localhost, and the backslash is reflected as it is.'}]

Fix commit: Fix potential vulnerability for "http://\\\\localhost"


CVE: CVE-2022-25850

[{'lang': 'en', 'value': 'The package github.com/hoppscotch/proxyscotch before 1.0.0 are vulnerable to Server-side Request Forgery (SSRF) when interceptor mode is set to proxy. It occurs when an HTTP request is made by a backend server to an untrusted URL submitted by a user. It leads to a leakage of sensitive information from the server.'}]

Fix commit: feat: ability to have a blacklist of target urls for proxy to make calls to


CVE: CVE-2022-25851

[{'lang': 'en', 'value': 'The package jpeg-js before 0.4.4 are vulnerable to Denial of Service (DoS) where a particular piece of input will cause to enter an infinite loop and never return.'}]

Fix commit: fix: validate sampling factors (#106)


CVE: CVE-2022-25854

[{'lang': 'en', 'value': 'This affects the package @yaireo/tagify before 4.9.8. The package is used for rendering UI components inside the input or text fields, and an attacker can pass a malicious placeholder value to it to fire the XSS payload.'}]

Fix commit: fixes #989 - fix XSS


CVE: CVE-2022-25858

[{'lang': 'en', 'value': 'The package terser before 4.8.1, from 5.0.0 and before 5.14.2 are vulnerable to Regular Expression Denial of Service (ReDoS) due to insecure usage of regular expressions.'}]

Fix commit: fix potential regexp DDOS


CVE: CVE-2022-25865

[{'lang': 'en', 'value': 'The package workspace-tools before 0.18.4 are vulnerable to Command Injection via git argument injection. When calling the fetchRemoteBranch(remote: string, remoteBranch: string, cwd: string) function, both the remote and remoteBranch parameters are passed to the git fetch subcommand in a way that additional flags can be set. The additional flags can be used to perform a command injection.'}]

Fix commit: Fix git fetch - addresses a potential securi


CVE: CVE-2022-25866

[{'lang': 'en', 'value': 'The package czproject/git-php before 4.0.3 are vulnerable to Command Injection via git argument injection. When calling the isRemoteUrlReadable($url, array $refs = NULL) function, both the url and refs parameters are passed to the git ls-remote subcommand in a way that additional flags can be set. The additional flags can be used to perform a command injection.'}]

Fix commit: Uses --end-of-options after command options (for security reasons)


CVE: CVE-2022-25867

[{'lang': 'en', 'value': 'The package io.socket:socket.io-client before 2.0.1 are vulnerable to NULL Pointer Dereference when parsing a packet with with invalid payload format.'}]

Fix commit: fix: ensure the payload format is valid

This commit should prevent some NPE issues encountered after the
parsing of the packet.

Related:

- https://github.com/socketio/socket.io-client-java/issues/642
- https://github.com/socketio/socket.io-client-java/issues/609
- https://github.com


CVE: CVE-2022-25875

[{'lang': 'en', 'value': 'The package svelte before 3.49.0 are vulnerable to Cross-site Scripting (XSS) due to improper input sanitization and to improper escape of attributes when using objects during SSR (Server-Side Rendering). Exploiting this vulnerability is possible via objects with a custom toString() function.'}]

Fix commit: [fix] harden attribute escaping during ssr (#7530)


CVE: CVE-2022-25878

[{'lang': 'en', 'value': 'The package protobufjs before 6.11.3 are vulnerable to Prototype Pollution which can allow an attacker to add/modify properties of the Object.prototype. This vulnerability can occur in multiple ways: 1. by providing untrusted user input to util.setProperty or to ReflectionObject.setParsedOption functions 2. by parsing/loading .proto files'}]

Fix commit: fix: do not let setProperty change the prototype (#1731)


CVE: CVE-2022-2589

[{'lang': 'en', 'value': 'Cross-site Scripting (XSS) - Reflected in GitHub repository beancount/fava prior to 1.22.3.'}]

Fix commit: create tooltip contents in a xss-safe way


CVE: CVE-2022-25891

[{'lang': 'en', 'value': 'The package github.com/containrrr/shoutrrr/pkg/util before 0.6.0 are vulnerable to Denial of Service (DoS) via the util.PartitionMessage function. Exploiting this vulnerability is possible by sending exactly 2000, 4000, or 6000 characters messages.'}]

Fix commit: fix(discord): message size fixes (#242)

* fix(discord): handle empty messages without panic
* fix: off by one error when partitioning messages
* test(discord): add tests for Send failur


CVE: CVE-2022-25896

[{'lang': 'en', 'value': 'This affects the package passport before 0.6.0. When a user logs in or logs out, the session is regenerated instead of being closed.'}]

Fix commit: Regenerate session on login.


CVE: CVE-2022-25898

[{'lang': 'en', 'value': 'The package jsrsasign before 10.5.25 are vulnerable to Improper Verification of Cryptographic Signature when JWS or JWT signature with non Base64URL encoding special characters or number escaped characters may be validated as valid by mistake. Workaround: Validate JWS or JWT signature if it has Base64URL and dot safe string before executing JWS.verify() or JWS.verifyJWT() method.'}]

Fix commit: CVE-2022-25898 Security fix in JWS and JWT validation


CVE: CVE-2022-25907

[{'lang': 'en', 'value': 'The package ts-deepmerge before 2.0.2 are vulnerable to Prototype Pollution due to missing sanitization of the merge function.'}]

Fix commit: prevent against prototype pollution


CVE: CVE-2022-2595

[{'lang': 'en', 'value': 'Improper Authorization in GitHub repository kromitgmbh/titra prior to 0.79.1.'}]

Fix commit: 🐛 fixed a bug in the oidc configuration preventing saving changes
🔒 fixed admin authorization validation for all administration pages
🔒 fixed a stored XSS vulnerability in the task functionality


CVE: CVE-2022-2596

[{'lang': 'en', 'value': 'Denial of Service in GitHub repository node-fetch/node-fetch prior to 3.2.10.'}]

Fix commit: fix: ReDoS referrer (#1611)

* fix ReDoS referrer

* Update src/utils/referrer.js

Eliminate regex and use string matcher

Co-authored-by: Linus Unnebäck <linus@folkdatorn.se>

Co-authored-by: Khang. Võ Vĩ <khangvv@vng.com.vn>
Co-authored-by: Linus Unnebäck <linus@folkdatorn.se>


CVE: CVE-2022-2598

[{'lang': 'en', 'value': 'Undefined Behavior for Input to API in GitHub repository vim/vim prior to 9.0.0100.'}]

Fix commit: patch 9.0.0101: invalid memory access in diff mode with "dp" and undo

Problem:    Invalid memory access in diff mode with "dp" and undo.
Solution:   Make sure the line number does not go below one.


CVE: CVE-2022-26183

[{'lang': 'en', 'value': 'PNPM v6.15.1 and below was discovered to contain an untrusted search path which causes the application to behave in unexpected ways when users execute PNPM commands in a directory containing malicious content. This vulnerability occurs when the application is ran on Windows OS.'}]

Fix commit: fix: prevent binary planting attacks on Windows


CVE: CVE-2022-2626

[{'lang': 'en', 'value': 'Incorrect Privilege Assignment in GitHub repository hestiacp/hestiacp prior to 1.6.6.'}]

Fix commit: Fix security issues in v-add-web-domain-redirect + Sync up main with release (#2814)

* Fix v-add-web-domain-redirect

* Remove sudo permission admin group on new setups

We delete the group before install anyway

* Block "sudo" from

* Add missing slash

* Update changelog

* Update versions


CVE: CVE-2022-2636

[{'lang': 'en', 'value': 'Improper Input Validation in GitHub repository hestiacp/hestiacp prior to 1.6.6.'}]

Fix commit: Fix security issues in v-add-web-domain-redirect + Sync up main with release (#2814)

* Fix v-add-web-domain-redirect

* Remove sudo permission admin group on new setups

We delete the group before install anyway

* Block "sudo" from

* Add missing slash

* Update changelog

* Update versions


CVE: CVE-2022-26490

[{'lang': 'en', 'value': 'st21nfca_connectivity_event_received in drivers/nfc/st21nfca/se.c in the Linux kernel through 5.16.12 has EVT_TRANSACTION buffer overflows because of untrusted length parameters.'}]

Fix commit: nfc: st21nfca: Fix potential buffer overflows in EVT_TRANSACTION

It appears that there are some buffer overflows in EVT_TRANSACTION.
This happens because the length parameters that are passed to memcpy
come directly from skb->data and are not guarded in any


CVE: CVE-2022-2651

[{'lang': 'en', 'value': 'Authentication Bypass by Primary Weakness in GitHub repository bookwyrm-social/bookwyrm prior to 0.4.5.'}]

Fix commit: Merge pull request #2230 from bookwyrm-social/nginx-rate-limit

Adds rate limiting to some views in nginx


CVE: CVE-2022-2652

[{'lang': 'en', 'value': "Depending on the way the format strings in the card label are crafted it's possible to leak kernel stack memory. There is also the possibility for DoS due to the v4l2loopback kernel module crashing when providing the card label on request (reproduce e.g. with many %s modifiers in a row)."}]

Fix commit: add explicit format specifier to printf() invocations

CWE-134


CVE: CVE-2022-2653

[{'lang': 'en', 'value': 'With this vulnerability an attacker can read many sensitive files like configuration files, or the /proc/self/environ file, that contains the environment variable used by the web server that includes database credentials. If the web server user is root, an attacker will be able to read any file in the system.'}]

Fix commit: fix: Fix path traversal vulnerability


CVE: CVE-2022-26530

[{'lang': 'en', 'value': 'swaylock before 1.6 allows attackers to trigger a crash and achieve unlocked access to a Wayland compositor.'}]

Fix commit: Add support for ext-session-lock-v1

This is a new protocol to lock the session [1]. It should be more
reliable than layer-shell + input-inhibitor.

[1]: https://gitlab.freedesktop.org/wayland/wayland-protocols/-/merge_requests/131


CVE: CVE-2022-26691

[{'lang': 'en', 'value': 'A logic issue was addressed with improved state management. This issue is fixed in Security Update 2022-003 Catalina, macOS Monterey 12.3, macOS Big Sur 11.6.5. An application may be able to gain elevated privileges.'}]

Fix commit: scheduler/cert.c: Fix string comparison (fixes CVE-2022-26691)

The previous algorithm didn't expect the strings can have a different
length, so one string can be a substring of the other and such substring
was reported


CVE: CVE-2022-26874

[{'lang': 'en', 'value': 'lib/Horde/Mime/Viewer/Ooo.php in Horde Mime_Viewer before 2.2.4 allows XSS via an OpenOffice document, leading to account takeover in Horde Groupware Webmail Edition. This occurs after XSLT rendering.'}]

Fix commit: [jan] Fix XSS vulnerability in Open Document mime viewer with different code path (Reported by: Mahdi Pasche <pasche@b1-systems.de>).


CVE: CVE-2022-26960

[{'lang': 'en', 'value': 'connector.minimal.php in std42 elFinder through 2.1.60 is affected by path traversal. This allows unauthenticated remote attackers to read, write, and browse files outside the configured document root. This is due to improper handling of absolute file paths.'}]

Fix commit: [security:CVE-2022-26960] fix a path traversal issue

Fixed a paste traversal vulnerability. The problem was getting out of
the configured directory and allowing the hosting serv


CVE: CVE-2022-27007

[{'lang': 'en', 'value': 'nginx njs 0.7.2 is affected suffers from Use-after-free in njs_function_frame_alloc() when it try to invoke from a restored frame saved with njs_function_frame_save().'}]

Fix commit: Fixed frame allocation from an awaited frame.

njs_function_frame_save() is used to save the awaited frame when "await"
instruction is encountered. The saving was done as a memcpy() of
existing runtime frame.

njs_function_frame_alloc() is used to alloc a new function


CVE: CVE-2022-27008

[{'lang': 'en', 'value': 'nginx njs 0.7.2 is vulnerable to Buffer Overflow. Type confused in Array.prototype.concat() when a slow array appended element is fast array.'}]

Fix commit: Fixed Array.prototype.concat() when "this" is a slow array.

Previously, when the current appended element is fast array the "this"
array was expected to always be a fast array also.  This may not be the
case when the previous appended element was not fast thus converting
the "this" array to a


CVE: CVE-2022-27114

[{'lang': 'en', 'value': "There is a vulnerability in htmldoc 1.9.16. In image_load_jpeg function image.cxx when it calls malloc,'img->width' and 'img->height' they are large enough to cause an integer overflow. So, the malloc function may return a heap blosmaller than the expected size, and it will cause a buffer overflow/Address boundary error in the jpeg_read_scanlines function."}]

Fix commit: Fix a potential integer overflow bug in the JPEG and PNG loaders (Issue #471)


CVE: CVE-2022-2713

[{'lang': 'en', 'value': 'Insufficient Session Expiration in GitHub repository cockpit-hq/cockpit prior to 2.2.0.'}]

Fix commit: Stop execution of code after redirecting


CVE: CVE-2022-27157

[{'lang': 'en', 'value': 'pearweb < 1.32 is suffers from a Weak Password Recovery Mechanism via include/users/passwordmanage.php.'}]

Fix commit: Be cautious about what can be unserialized


CVE: CVE-2022-27158

[{'lang': 'en', 'value': 'pearweb < 1.32 suffers from Deserialization of Untrusted Data.'}]

Fix commit: Be cautious about what can be unserialized


CVE: CVE-2022-27168

[{'lang': 'en', 'value': 'Cross-site scripting vulnerability in LiteCart versions prior to 2.4.2 allows a remote attacker to inject an arbitrary script via unspecified vectors.'}]

Fix commit: * Escape HTML characters


CVE: CVE-2022-27223

[{'lang': 'en', 'value': 'In drivers/usb/gadget/udc/udc-xilinx.c in the Linux kernel before 5.16.12, the endpoint index is not validated and might be manipulated by the host for out-of-array access.'}]

Fix commit: USB: gadget: validate endpoint index for xilinx udc

Assure that host may not manipulate the index to point
past endpoint array.

Signed-off-by: Szymon Heidrich <szymon.heidrich@gmail.com>
Cc: stable <stable@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@li


CVE: CVE-2022-27243

[{'lang': 'en', 'value': 'An issue was discovered in MISP before 2.4.156. app/View/Users/terms.ctp allows Local File Inclusion via the custom terms file setting.'}]

Fix commit: fix: [security] lfi via custom terms file setting, as reported by Ianis BERNARD - NATO Cyber Security Centre


CVE: CVE-2022-27244

[{'lang': 'en', 'value': 'An issue was discovered in MISP before 2.4.156. A malicious site administrator could store an XSS payload in the custom auth name. This would be executed each time the administrator modifies a user.'}]

Fix commit: fix: [security] stored XSS in the user add/edit forms

- a malicious site administrator could store an XSS payload in the custom auth name which would be executed each time the administrator modifies a user

- as reported by Ianis BERNARD


CVE: CVE-2022-27245

[{'lang': 'en', 'value': 'An issue was discovered in MISP before 2.4.156. app/Model/Server.php does not restrict generateServerSettings to the CLI. This could lead to SSRF.'}]

Fix commit: fix: [security] restrict setting to cli only. enabling this setting could allow potential ssrf attacks, as reported by Ianis BERNARD - NATO Cyber Security Centre


CVE: CVE-2022-27246

[{'lang': 'en', 'value': 'An issue was discovered in MISP before 2.4.156. An SVG org logo (which may contain JavaScript) is not forbidden by default.'}]

Fix commit: new: add setting for allowing svg org logos


CVE: CVE-2022-27311

[{'lang': 'en', 'value': 'Gibbon v3.4.4 and below allows attackers to execute a Server-Side Request Forgery (SSRF) via a crafted URL.'}]

Fix commit: Ensure we raise if the root domain changed and it was not an expected behavior


CVE: CVE-2022-27311

[{'lang': 'en', 'value': 'Gibbon v3.4.4 and below allows attackers to execute a Server-Side Request Forgery (SSRF) via a crafted URL.'}]

Fix commit: bump version, handle invalid API key DC


CVE: CVE-2022-27462

[{'lang': 'en', 'value': 'Cross Site Scripting (XSS) vulnerability in objects/function.php in function getDeviceID in WWBN AVideo through 11.6, via the yptDevice parameter to view/include/head.php.'}]

Fix commit: XSS vulnerability fix , thanks Max Boll


CVE: CVE-2022-27463

[{'lang': 'en', 'value': 'Open redirect vulnerability in objects/login.json.php in WWBN AVideo through 11.6, allows attackers to arbitrarily redirect users from a crafted url to the login page.'}]

Fix commit: Open Redirect fix, thanks Max Boll


CVE: CVE-2022-27470

[{'lang': 'en', 'value': 'SDL_ttf v2.0.18 and below was discovered to contain an arbitrary memory write via the function TTF_RenderText_Solid(). This vulnerability is triggered via a crafted TTF file.'}]

Fix commit: More integer overflow (see bug #187)
Make sure that 'width + alignment' doesn't overflow, otherwise
it could create a SDL_Surface of 'width' but with wrong 'pitch'


CVE: CVE-2022-27475

[{'lang': 'en', 'value': 'Cross site scripting (XSS) vulnerability in tramyardg hotel-mgmt-system, allows attackers to execute arbitrary code when when /admin.php is loaded.'}]

Fix commit: + sanitize xss function


CVE: CVE-2022-2756

[{'lang': 'en', 'value': 'Server-Side Request Forgery (SSRF) in GitHub repository kareadita/kavita prior to 0.5.4.1.'}]

Fix commit: v0.5.4.1 - Security Hotfix (#1414)

* Updated our security file with our Huntr.

* Fixed a security vulnerability where through the API, an unauthorized user could delete/modify reading lists that did not belong to them.

Fixed a bug where when creating a reading list with the name of another users, the API would throw an exception (but read


CVE: CVE-2022-27649

[{'lang': 'en', 'value': 'A flaw was found in Podman, where containers were started incorrectly with non-empty default permissions. A vulnerability was found in Moby (Docker Engine), where containers were started incorrectly with non-empty inheritable Linux process capabilities. This flaw allows an attacker with access to programs with inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs.'}]

Fix commit: do not set the inherita


CVE: CVE-2022-27650

[{'lang': 'en', 'value': 'A flaw was found in crun where containers were incorrectly started with non-empty default permissions. A vulnerability was found in Moby (Docker Engine) where containers were started incorrectly with non-empty inheritable Linux process capabilities. This flaw allows an attacker with access to programs with inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs.'}]

Fix commit: exec: --cap do not set inhe


CVE: CVE-2022-27651

[{'lang': 'en', 'value': 'A flaw was found in buildah where containers were incorrectly started with non-empty default permissions. A bug was found in Moby (Docker Engine) where containers were incorrectly started with non-empty inheritable Linux process capabilities, enabling an attacker with access to programs with inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs. This has the potential to impact confidentiality and integ


CVE: CVE-2022-27666

[{'lang': 'en', 'value': 'A heap buffer overflow flaw was found in IPsec ESP transformation code in net/ipv4/esp4.c and net/ipv6/esp6.c. This flaw allows a local attacker with a normal user privilege to overwrite kernel heap objects and may cause a local privilege escalation threat.'}]

Fix commit: esp: Fix possible buffer overflow in ESP transformation

The maximum message size that can be send is bigger than
the  maximum site that skb_page_frag_refill can allocate.
So it i


CVE: CVE-2022-2777

[{'lang': 'en', 'value': 'Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.3.1.'}]

Fix commit: update


CVE: CVE-2022-27815

[{'lang': 'en', 'value': 'SWHKD 1.1.5 unsafely uses the /tmp/swhkd.pid pathname. There can be an information leak or denial of service.'}]

Fix commit: [patch] CVE-2022-27815


CVE: CVE-2022-27816

[{'lang': 'en', 'value': 'SWHKD 1.1.5 unsafely uses the /tmp/swhks.pid pathname. There can be data loss or a denial of service.'}]

Fix commit: [patch] CVE-2022-27816


CVE: CVE-2022-27818

[{'lang': 'en', 'value': 'SWHKD 1.1.5 unsafely uses the /tmp/swhkd.sock pathname. There can be an information leak or denial of service.'}]

Fix commit: [patch] CVE-2022-27818


CVE: CVE-2022-27819

[{'lang': 'en', 'value': 'SWHKD 1.1.5 allows unsafe parsing via the -c option. An information leak might occur but there is a simple denial of service (memory exhaustion) upon an attempt to parse a large or infinite file (such as a block or character device).'}]

Fix commit: [patch] CVE-2022-27819


CVE: CVE-2022-27950

[{'lang': 'en', 'value': 'In drivers/hid/hid-elo.c in the Linux kernel before 5.16.11, a memory leak exists for a certain hid_parse error condition.'}]

Fix commit: HID: elo: fix memory leak in elo_probe

When hid_parse() in elo_probe() fails, it forgets to call usb_put_dev to
decrease the refcount.

Fix this by adding usb_put_dev() in the error handling code of elo_probe().

Fixes: fbf42729d0e9 ("HID: elo: update the reference count of the usb device structure")
Reported-by


CVE: CVE-2022-2796

[{'lang': 'en', 'value': 'Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.4.'}]

Fix commit: [Admin] Translations - properly escape key on roweditor


CVE: CVE-2022-28044

[{'lang': 'en', 'value': 'Irzip v0.640 was discovered to contain a heap memory corruption via the component lrzip.c:initialise_control.'}]

Fix commit: Fix control->suffix being deallocated as heap memory as reported by Pietro Borrello.


CVE: CVE-2022-28049

[{'lang': 'en', 'value': 'NGINX NJS 0.7.2 was discovered to contain a NULL pointer dereference via the component njs_vmcode_array at /src/njs_vmcode.c.'}]

Fix commit: Fixed allocation of large array literals.

Previously, allocation of large array literals may result in
null-pointer dereference. The reason is that njs_array_alloc() may
return a slow array when size is large enough, but the instruction
code assumes that array is always flat.

The fix is to check fast_array f


CVE: CVE-2022-28055

[{'lang': 'en', 'value': 'Fusionpbx v4.4 and below contains a command injection vulnerability via the download email logs function.'}]

Fix commit: Remove email_logs download. (#6331)

* Remove email_logs download.

This feature has a security risk that is being eliminated by removing the download feature.

* Update email_logs.php


CVE: CVE-2022-28085

[{'lang': 'en', 'value': 'A flaw was found in htmldoc commit 31f7804. A heap buffer overflow in the function pdf_write_names in ps-pdf.cxx may lead to arbitrary code execution and Denial of Service (DoS).'}]

Fix commit: Call check_pages when writing links (Issue #480)


CVE: CVE-2022-2816

[{'lang': 'en', 'value': 'Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.0212.'}]

Fix commit: patch 9.0.0212: invalid memory access when compiling :unlet

Problem:    Invalid memory access when compiling :unlet.
Solution:   Don't read past the end of the line.


CVE: CVE-2022-2817

[{'lang': 'en', 'value': 'Use After Free in GitHub repository vim/vim prior to 9.0.0213.'}]

Fix commit: patch 9.0.0213: using freed memory with error in assert argument

Problem:    Using freed memory with error in assert argument.
Solution:   Make a copy of the error.


CVE: CVE-2022-2818

[{'lang': 'en', 'value': 'Authentication Bypass by Primary Weakness in GitHub repository cockpit-hq/cockpit prior to 2.2.2.'}]

Fix commit: Fix exposing 2FA secret in JWT token on login


CVE: CVE-2022-2819

[{'lang': 'en', 'value': 'Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0211.'}]

Fix commit: patch 9.0.0211: invalid memory access when compiling :lockvar

Problem:    Invalid memory access when compiling :lockvar.
Solution:   Don't read past the end of the line.


CVE: CVE-2022-2820

[{'lang': 'en', 'value': 'Improper Access Control in GitHub repository namelessmc/nameless prior to v2.0.2.'}]

Fix commit: Rework user sessions system (#3000)

Co-authored-by: samerton <samerton@users.noreply.github.com>


CVE: CVE-2022-2821

[{'lang': 'en', 'value': 'Missing Critical Step in Authentication in GitHub repository namelessmc/nameless prior to v2.0.2.'}]

Fix commit: Add ability to rate limit via Validate class (#2998)


CVE: CVE-2022-2824

[{'lang': 'en', 'value': 'Improper Access Control in GitHub repository openemr/openemr prior to 7.0.0.1.'}]

Fix commit: bug fix and php8.1 fixes (#5664)

* bug fix and php8.1 fixes

* styling


CVE: CVE-2022-28356

[{'lang': 'en', 'value': 'In the Linux kernel before 5.17.1, a refcount leak bug was found in net/llc/af_llc.c.'}]

Fix commit: llc: fix netdevice reference leaks in llc_ui_bind()

Whenever llc_ui_bind() and/or llc_ui_autobind()
took a reference on a netdevice but subsequently fail,
they must properly release their reference
or risk the infamous message from unregister_netdevice()
at device dismantle.

unregister_netdevice: waiting for eth0 to become free. Usage count = 3

F


CVE: CVE-2022-28367

[{'lang': 'en', 'value': 'OWASP AntiSamy before 1.6.6 allows XSS via HTML tag smuggling on STYLE content with crafted input. The output serializer does not properly encode the supposed Cascading Style Sheets (CSS) content.'}]

Fix commit: Support multiple children handling on style tags


CVE: CVE-2022-28368

[{'lang': 'en', 'value': 'Dompdf 1.2.1 allows remote code execution via a .php file in the src:url field of an @font-face Cascading Style Sheets (CSS) statement (within an HTML input file).'}]

Fix commit: Match installed font filename extension to type

fixes #2598


CVE: CVE-2022-28388

[{'lang': 'en', 'value': 'usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c in the Linux kernel through 5.17.1 has a double free.'}]

Fix commit: can: usb_8dev: usb_8dev_start_xmit(): fix double dev_kfree_skb() in error path

There is no need to call dev_kfree_skb() when usb_submit_urb() fails
because can_put_echo_skb() deletes original skb and
can_free_echo_skb() deletes the cloned skb.

Fixes: 0024d8ad1639 ("can: usb_8dev: Add support for USB2CAN interface from 8 devic


CVE: CVE-2022-28389

[{'lang': 'en', 'value': 'mcba_usb_start_xmit in drivers/net/can/usb/mcba_usb.c in the Linux kernel through 5.17.1 has a double free.'}]

Fix commit: can: mcba_usb: mcba_usb_start_xmit(): fix double dev_kfree_skb in error path

There is no need to call dev_kfree_skb() when usb_submit_urb() fails
because can_put_echo_skb() deletes original skb and
can_free_echo_skb() deletes the cloned skb.

Fixes: 51f3baad7de9 ("can: mcba_usb: Add support for Microchip CAN BUS Analyzer")
Lin


CVE: CVE-2022-28390

[{'lang': 'en', 'value': 'ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c in the Linux kernel through 5.17.1 has a double free.'}]

Fix commit: can: ems_usb: ems_usb_start_xmit(): fix double dev_kfree_skb() in error path

There is no need to call dev_kfree_skb() when usb_submit_urb() fails
beacause can_put_echo_skb() deletes the original skb and
can_free_echo_skb() deletes the cloned skb.

Link: https://lore.kernel.org/all/20220228083639.38183-1-hbh25y@gmail.com
Fixes: 7


CVE: CVE-2022-2845

[{'lang': 'en', 'value': 'Buffer Over-read in GitHub repository vim/vim prior to 9.0.0218.'}]

Fix commit: patch 9.0.0218: reading before the start of the line

Problem:    Reading before the start of the line.
Solution:   When displaying "$" check the column is not negative.


CVE: CVE-2022-28451

[{'lang': 'en', 'value': 'nopCommerce 4.50.1 is vulnerable to Directory Traversal via the backup file in the Maintenance feature.'}]

Fix commit: Fixed a possible issue with database backup filenames


CVE: CVE-2022-28463

[{'lang': 'en', 'value': 'ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.'}]

Fix commit: https://github.com/ImageMagick/ImageMagick/issues/4988


CVE: CVE-2022-2849

[{'lang': 'en', 'value': 'Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0220.'}]

Fix commit: patch 9.0.0220: invalid memory access with for loop over NULL string

Problem:    Invalid memory access with for loop over NULL string.
Solution:   Make sure mb_ptr2len() consistently returns zero for NUL.


CVE: CVE-2022-28545

[{'lang': 'en', 'value': 'FUDforum 3.1.1 is vulnerable to Stored XSS.'}]

Fix commit: Fix XSS vulnerability reported by ptsecurity.com (attacker tries to send mail to an administrator
on a server that does not have a mail server configured).


CVE: CVE-2022-28545

[{'lang': 'en', 'value': 'FUDforum 3.1.1 is vulnerable to Stored XSS.'}]

Fix commit: Fix stored XSS vulnerability reported by ptsecurity.com


CVE: CVE-2022-2862

[{'lang': 'en', 'value': 'Use After Free in GitHub repository vim/vim prior to 9.0.0221.'}]

Fix commit: patch 9.0.0221: accessing freed memory if compiling nested function fails

Problem:    Accessing freed memory if compiling nested function fails.
Solution:   Mess up the variable name so that it won't be found.


CVE: CVE-2022-2871

[{'lang': 'en', 'value': 'Cross-site Scripting (XSS) - Stored in GitHub repository notrinos/notrinoserp prior to 0.7.'}]

Fix commit: Prevent cross-site scripting(XSS) vulnerabilities.


CVE: CVE-2022-2874

[{'lang': 'en', 'value': 'NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0224.'}]

Fix commit: patch 9.0.0224: Using NULL pointer when skipping compiled code

Problem:    Using NULL pointer when skipping compiled code.
Solution:   Check for skipping.


CVE: CVE-2022-28796

[{'lang': 'en', 'value': 'jbd2_journal_wait_updates in fs/jbd2/transaction.c in the Linux kernel before 5.17.1 has a use-after-free caused by a transaction_t race condition.'}]

Fix commit: jbd2: fix use-after-free of transaction_t race

jbd2_journal_wait_updates() is called with j_state_lock held. But if
there is a commit in progress, then this transaction might get committed
and freed via jbd2_journal_commit_transaction() ->
jbd2_journal_free_transaction(), when we release


CVE: CVE-2022-28805

[{'lang': 'en', 'value': 'singlevar in lparser.c in Lua from (including) 5.4.0 up to (excluding) 5.4.4 lacks a certain luaK_exp2anyregup call, leading to a heap-based buffer over-read that might affect a system that compiles untrusted Lua code.'}]

Fix commit: Bug: Lua can generate wrong code when _ENV is <const>


CVE: CVE-2022-2885

[{'lang': 'en', 'value': 'Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0.'}]

Fix commit: Improved input data cleanup


CVE: CVE-2022-2889

[{'lang': 'en', 'value': 'Use After Free in GitHub repository vim/vim prior to 9.0.0225.'}]

Fix commit: patch 9.0.0225: using freed memory with multiple line breaks in expression

Problem:    Using freed memory with multiple line breaks in expression.
Solution:   Free eval_tofree later.


CVE: CVE-2022-28927

[{'lang': 'en', 'value': 'A remote code execution (RCE) vulnerability in Subconverter v0.7.2 allows attackers to execute arbitrary code via crafted config and url parameters.'}]

Fix commit: Enhancements

Add authorization check before loading scripts.
Add detailed logs when loading preference settings.


CVE: CVE-2022-28946

[{'lang': 'en', 'value': 'An issue in the component ast/parser.go of Open Policy Agent v0.39.0 causes the application to incorrectly interpret every expression, causing a Denial of Service (DoS) via triggering out-of-range memory access.'}]

Fix commit: ast/parser: guard against invalid domains for "some" and "every" (#4548)

These would cause a runtime exception when attempting to parse

    some internal.member_2()

This is due to a technicality in how

    some x in


CVE: CVE-2022-28959

[{'lang': 'en', 'value': 'Multiple cross-site scripting (XSS) vulnerabilities in the component /spip.php of Spip Web Framework v3.1.13 and below allows attackers to execute arbitrary web scripts or HTML.'}]

Fix commit: Divers petites sanitization et une balise manquante #4494


CVE: CVE-2022-28959

[{'lang': 'en', 'value': 'Multiple cross-site scripting (XSS) vulnerabilities in the component /spip.php of Spip Web Framework v3.1.13 and below allows attackers to execute arbitrary web scripts or HTML.'}]

Fix commit: _oups donc (aka un base64_encode ca fait pas de mal)


CVE: CVE-2022-28960

[{'lang': 'en', 'value': 'A PHP injection vulnerability in Spip before v3.2.8 allows attackers to execute arbitrary PHP code via the _oups parameter at /ecrire.'}]

Fix commit: Divers petites sanitization et une balise manquante #4494


CVE: CVE-2022-28960

[{'lang': 'en', 'value': 'A PHP injection vulnerability in Spip before v3.2.8 allows attackers to execute arbitrary PHP code via the _oups parameter at /ecrire.'}]

Fix commit: _oups donc (aka un base64_encode ca fait pas de mal)


CVE: CVE-2022-28961

[{'lang': 'en', 'value': 'Spip Web Framework v3.1.13 and below was discovered to contain multiple SQL injection vulnerabilities at /ecrire via the lier_trad and where parameters.'}]

Fix commit: Divers petites sanitization et une balise manquante #4494


CVE: CVE-2022-28961

[{'lang': 'en', 'value': 'Spip Web Framework v3.1.13 and below was discovered to contain multiple SQL injection vulnerabilities at /ecrire via the lier_trad and where parameters.'}]

Fix commit: _oups donc (aka un base64_encode ca fait pas de mal)


CVE: CVE-2022-29156

[{'lang': 'en', 'value': 'drivers/infiniband/ulp/rtrs/rtrs-clt.c in the Linux kernel before 5.16.12 has a double free related to rtrs_clt_dev_release.'}]

Fix commit: RDMA/rtrs-clt: Fix possible double free in error case

Callback function rtrs_clt_dev_release() for put_device() calls kfree(clt)
to free memory. We shouldn't call kfree(clt) again, and we can't use the
clt after kfree too.

Replace device_register() with device_initialize() and device_add() so that
dev_set_nam


CVE: CVE-2022-29161

[{'lang': 'en', 'value': 'XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The XWiki Crypto API will generate X509 certificates signed by default using SHA1 with RSA, which is not considered safe anymore for use in certificate signatures, due to the risk of collisions with SHA1. The problem has been patched in XWiki version 13.10.6, 14.3.1 and 14.4-rc-1. Since then, the Crypto API will generate X509 certificates signed


CVE: CVE-2022-29162

[{'lang': 'en', 'value': "runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. A bug was found in runc prior to version 1.1.2 where `runc exec --cap` created processes with non-empty inheritable Linux process capabilities, creating an atypical Linux environment and enabling programs with inheritable file capabilities to elevate those capabilities to the permitted set during execve(2). This bug did not affect the container securi


CVE: CVE-2022-29164

[{'lang': 'en', 'value': 'Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. In affected versions an attacker can create a workflow which produces a HTML artifact containing an HTML file that contains a script which uses XHR calls to interact with the Argo Server API. The attacker emails the deep-link to the artifact to their victim. The victim opens the link, the script starts running. As the script has access to


CVE: CVE-2022-29172

[{'lang': 'en', 'value': "Auth0 is an authentication broker that supports both social and enterprise identity providers, including Active Directory, LDAP, Google Apps, and Salesforce. In versions before `11.33.0`, when the â€œadditional signup fieldsâ€? feature [is configured](https://github.com/auth0/lock#additional-sign-up-fields), a malicious actor can inject invalidated HTML code into these additional fields, which is then stored in the service `user_metdata` payload (us


CVE: CVE-2022-29173

[{'lang': 'en', 'value': 'go-tuf is a Go implementation of The Update Framework (TUF). go-tuf does not correctly implement the client workflow for updating the metadata files for roles other than the root role. Specifically, checks for rollback attacks are not implemented correctly meaning an attacker can cause clients to install software that is older than the software which the client previously knew to be available, and may include software with known vulnerabilities. In


CVE: CVE-2022-29174

[{'lang': 'en', 'value': 'countly-server is the server-side part of Countly, a product analytics solution. Prior to versions 22.03.7 and 21.11.4, a malicious actor who knows an account email address/username and full name specified in the database is capable of guessing the password reset token. The actor may use this information to reset the password and take over the account. The problem has been patched in Countly Server version 22.03.7 for servers using the new user inte


CVE: CVE-2022-29180

[{'lang': 'en', 'value': "A vulnerability in which attackers could forge HTTP requests to manipulate the `charm` data directory to access or delete anything on the server. This has been patched and is available in release [v0.12.1](https://github.com/charmbracelet/charm/releases/tag/v0.12.1). We recommend that all users running self-hosted `charm` instances update immediately. This vulnerability was found in-house and we haven't been notified of any potential exploiters. ###


CVE: CVE-2022-29181

[{'lang': 'en', 'value': 'Nokogiri is an open source XML and HTML library for Ruby. Nokogiri prior to version 1.13.6 does not type-check all inputs into the XML and HTML4 SAX parsers, allowing specially crafted untrusted inputs to cause illegal memory access errors (segfault) or reads from unrelated memory. Version 1.13.6 contains a patch for this issue. As a workaround, ensure the untrusted input is a `String` by calling `#to_s` or equivalent.'}]

Fix commit: fix: {HTML4,XM


CVE: CVE-2022-29184

[{'lang': 'en', 'value': 'GoCD is a continuous delivery server. In GoCD versions prior to 22.1.0, it is possible for existing authenticated users who have permissions to edit or create pipeline materials or pipeline configuration repositories to get remote code execution capability on the GoCD server via configuring a malicious branch name which abuses Mercurial hooks/aliases to exploit a command injection weakness. An attacker would require access to an account with existin


CVE: CVE-2022-29186

[{'lang': 'en', 'value': "Rundeck is an open source automation service with a web console, command line tools and a WebAPI. Rundeck community and rundeck-enterprise docker images contained a pre-generated SSH keypair. If the id_rsa.pub public key of the keypair was copied to authorized_keys files on remote host, those hosts would allow access to anyone with the exposed private credentials. This misconfiguration only impacts Rundeck Docker instances of PagerDutyÂ® Process Aut


CVE: CVE-2022-29188

[{'lang': 'en', 'value': 'Smokescreen is an HTTP proxy. The primary use case for Smokescreen is to prevent server-side request forgery (SSRF) attacks in which external attackers leverage the behavior of applications to connect to or scan internal infrastructure. Smokescreen also offers an option to deny access to additional (e.g., external) URLs by way of a deny list. There was an issue in Smokescreen that made it possible to bypass the deny list feature by surrounding the h


CVE: CVE-2022-29189

[{'lang': 'en', 'value': 'Pion DTLS is a Go implementation of Datagram Transport Layer Security. Prior to version 2.1.4, a buffer that was used for inbound network traffic had no upper limit. Pion DTLS would buffer all network traffic from the remote user until the handshake completes or timed out. An attacker could exploit this to cause excessive memory usage. Version 2.1.4 contains a patch for this issue. There are currently no known workarounds available.'}]

Fix commit:


CVE: CVE-2022-29190

[{'lang': 'en', 'value': 'Pion DTLS is a Go implementation of Datagram Transport Layer Security. Prior to version 2.1.4, an attacker can send packets that sends Pion DTLS into an infinite loop when processing. Version 2.1.4 contains a patch for this issue. There are currently no known workarounds available.'}]

Fix commit: Don't attempt to append zero length fragments

Before the fragmentBuffer would process zero length fragments. Since
they are zero length the append would


CVE: CVE-2022-29191

[{'lang': 'en', 'value': 'TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.GetSessionTensor` does not fully validate the input arguments. This results in a `CHECK`-failure which can be used to trigger a denial of service attack. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.'}]

Fix commit: Fix tf.raw_ops.GetSessionTensor vulnerability with invalid handle.


CVE: CVE-2022-29192

[{'lang': 'en', 'value': 'TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.QuantizeAndDequantizeV4Grad` does not fully validate the input arguments. This results in a `CHECK`-failure which can be used to trigger a denial of service attack. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.'}]

Fix commit: Fix tf.raw_ops.QuantizeAndDequantizeV4Grad vulnerability


CVE: CVE-2022-29193

[{'lang': 'en', 'value': 'TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.TensorSummaryV2` does not fully validate the input arguments. This results in a `CHECK`-failure which can be used to trigger a denial of service attack. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.'}]

Fix commit: Fix tf.raw_ops.TensorSummaryV2 vulnerability with invalid serialized


CVE: CVE-2022-29194

[{'lang': 'en', 'value': 'TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.DeleteSessionTensor` does not fully validate the input arguments. This results in a `CHECK`-failure which can be used to trigger a denial of service attack. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.'}]

Fix commit: Fix tf.raw_ops.DeleteSessionTensor vulnerability with invalid `h


CVE: CVE-2022-29195

[{'lang': 'en', 'value': 'TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.StagePeek` does not fully validate the input arguments. This results in a `CHECK`-failure which can be used to trigger a denial of service attack. The code assumes `index` is a scalar but there is no validation for this before accessing its value. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for t


CVE: CVE-2022-29196

[{'lang': 'en', 'value': 'TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.Conv3DBackpropFilterV2` does not fully validate the input arguments. This results in a `CHECK`-failure which can be used to trigger a denial of service attack. The code does not validate that the `filter_sizes` argument is a vector. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.'}]


CVE: CVE-2022-29197

[{'lang': 'en', 'value': 'TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.UnsortedSegmentJoin` does not fully validate the input arguments. This results in a `CHECK`-failure which can be used to trigger a denial of service attack. The code assumes `num_segments` is a scalar but there is no validation for this before accessing its value. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 cont


CVE: CVE-2022-29198

[{'lang': 'en', 'value': 'TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.SparseTensorToCSRSparseMatrix` does not fully validate the input arguments. This results in a `CHECK`-failure which can be used to trigger a denial of service attack. The code assumes `dense_shape` is a vector and `indices` is a matrix (as part of requirements for sparse tensors) but there is no validation f


CVE: CVE-2022-29199

[{'lang': 'en', 'value': 'TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.LoadAndRemapMatrix does not fully validate the input arguments. This results in a `CHECK`-failure which can be used to trigger a denial of service attack. The code assumes `initializing_values` is a vector but there is no validation for this before accessing its value. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4


CVE: CVE-2022-29200

[{'lang': 'en', 'value': 'TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.LSTMBlockCell` does not fully validate the input arguments. This results in a `CHECK`-failure which can be used to trigger a denial of service attack. The code does not validate the ranks of any of the arguments to this API call. This results in `CHECK`-failures when the elements of the tensor are accessed.


CVE: CVE-2022-29201

[{'lang': 'en', 'value': 'TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.QuantizedConv2D` does not fully validate the input arguments. In this case, references get bound to `nullptr` for each argument that is empty. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.'}]

Fix commit: Fix undefined behavior in QuantizedConv2D

Added more input validation and tes


CVE: CVE-2022-29202

[{'lang': 'en', 'value': 'TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.ragged.constant` does not fully validate the input arguments. This results in a denial of service by consuming all available memory. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.'}]

Fix commit: Prevent denial of service in `tf.ragged.constant`

Fixes #55199

PiperOrigin-RevId: 442029525


CVE: CVE-2022-29203

[{'lang': 'en', 'value': 'TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.SpaceToBatchND` (in all backends such as XLA and handwritten kernels) is vulnerable to an integer overflow: The result of this integer overflow is used to allocate the output tensor, hence we get a denial of service via a `CHECK`-failure (assertion failure), as in TFSA-2021-198. Versions 2.9.0, 2.8.1, 2.7.2,


CVE: CVE-2022-29204

[{'lang': 'en', 'value': 'TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.UnsortedSegmentJoin` does not fully validate the input arguments. This results in a `CHECK`-failure which can be used to trigger a denial of service attack. The code assumes `num_segments` is a positive scalar but there is no validation. Since this value is used to allocate the output tensor, a negative valu


CVE: CVE-2022-29205

[{'lang': 'en', 'value': "TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, there is a potential for segfault / denial of service in TensorFlow by calling `tf.compat.v1.*` ops which don't yet have support for quantized types, which was added after migration to TensorFlow 2.x. In these scenarios, since the kernel is missing, a `nullptr` value is passed to `ParseDimensionValue` for the `py_value` argument. Then, this


CVE: CVE-2022-29206

[{'lang': 'en', 'value': 'TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.SparseTensorDenseAdd` does not fully validate the input arguments. In this case, a reference gets bound to a `nullptr` during kernel execution. This is undefined behavior. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.'}]

Fix commit: Fix UB in SparseTensorDenseAdd

Added more input


CVE: CVE-2022-29207

[{'lang': 'en', 'value': 'TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, multiple TensorFlow operations misbehave in eager mode when the resource handle provided to them is invalid. In graph mode, it would have been impossible to perform these API calls, but migration to TF 2.x eager mode opened up this vulnerability. If the resource handle is empty, then a reference is bound to a null pointer inside TensorFlow c


CVE: CVE-2022-29208

[{'lang': 'en', 'value': 'TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.EditDistance` has incomplete validation. Users can pass negative values to cause a segmentation fault based denial of service. In multiple places throughout the code, one may compute an index for a write operation. However, the existing validation only checks against the upper bound of the array. Hence, it i


CVE: CVE-2022-29209

[{'lang': 'en', 'value': 'TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the macros that TensorFlow uses for writing assertions (e.g., `CHECK_LT`, `CHECK_GT`, etc.) have an incorrect logic when comparing `size_t` and `int` values. Due to type conversion rules, several of the macros would trigger incorrectly. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.'}]

Fix commit: Merge pull request


CVE: CVE-2022-2921

[{'lang': 'en', 'value': 'Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository notrinos/notrinoserp prior to v0.7. This results in privilege escalation to a system administrator account. An attacker can gain access to protected functionality such as create/update companies, install/update languages, install/activate extensions, install/activate themes and other permissive actions.'}]

Fix commit: changed password hash method from md5 to bcryp


CVE: CVE-2022-29210

[{'lang': 'en', 'value': 'TensorFlow is an open source platform for machine learning. In version 2.8.0, the `TensorKey` hash function used total estimated `AllocatedBytes()`, which (a) is an estimate per tensor, and (b) is a very poor hash function for constants (e.g. `int32_t`). It also tried to access individual tensor bytes through `tensor.data()` of size `AllocatedBytes()`. This led to ASAN failures because the `AllocatedBytes()` is an estimate of total bytes allocated b


CVE: CVE-2022-29211

[{'lang': 'en', 'value': 'TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.histogram_fixed_width` is vulnerable to a crash when the values array contain `Not a Number` (`NaN`) elements. The implementation assumes that all floating point operations are defined and then converts a floating point result to an integer index. If `values` contains `NaN` then the result of the division is still `


CVE: CVE-2022-29212

[{'lang': 'en', 'value': 'TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, certain TFLite models that were created using TFLite model converter would crash when loaded in the TFLite interpreter. The culprit is that during quantization the scale of values could be greater than 1 but code was always assuming sub-unit scaling. Thus, since code was calling `QuantizeMultiplierSmallerThanOneExp`, the `TFLITE_CHECK_LT` as


CVE: CVE-2022-29213

[{'lang': 'en', 'value': 'TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the `tf.compat.v1.signal.rfft2d` and `tf.compat.v1.signal.rfft3d` lack input validation and under certain condition can result in crashes (due to `CHECK`-failures). Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.'}]

Fix commit: Merge pull request #55274 from yongtang:55263-tf.signal.rfft2d

PiperOrigin-RevId: 4367366


CVE: CVE-2022-29215

[{'lang': 'en', 'value': 'RegionProtect is a plugin that allows users to manage certain events in certain regions of the world. Versions prior to 1.1.0 contain a YAML injection vulnerability that can cause an instant server crash if the passed arguments are not matched. Version 1.1.0 contains a patch for this issue. As a workaround, restrict operator permissions to untrusted people and avoid entering arguments likely to cause a crash.'}]

Fix commit: Patch the hole

Thanks t


CVE: CVE-2022-29216

[{'lang': 'en', 'value': "TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, TensorFlow's `saved_model_cli` tool is vulnerable to a code injection. This can be used to open a reverse shell. This code path was maintained for compatibility reasons as the maintainers had several test cases where numpy expressions were used as arguments. However, given that the tool is always run manually, the impact of this is still not


CVE: CVE-2022-29217

[{'lang': 'en', 'value': 'PyJWT is a Python implementation of RFC 7519. PyJWT supports multiple different JWT signing algorithms. With JWT, an attacker submitting the JWT token can choose the used signing algorithm. The PyJWT library requires that the application chooses what algorithms are supported. The application can specify `jwt.algorithms.get_default_algorithms()` to get support for all algorithms, or specify a single algorithm. The issue is not that big as `algorithms


CVE: CVE-2022-29220

[{'lang': 'en', 'value': 'github-action-merge-dependabot is an action that automatically approves and merges dependabot pull requests (PRs). Prior to version 3.2.0, github-action-merge-dependabot does not check if a commit created by dependabot is verified with the proper GPG key. There is just a check if the actor is set to `dependabot[bot]` to determine if the PR is a legit PR. Theoretically, an owner of a seemingly valid and legit action in the pipeline can check if the P


CVE: CVE-2022-29221

[{'lang': 'en', 'value': 'Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prior to versions 3.1.45 and 4.1.1, template authors could inject php code by choosing a malicious {block} name or {include} file name. Sites that cannot fully trust template authors should upgrade to versions 3.1.45 or 4.1.1 to receive a patch for this issue. There are currently no known workarounds.'}]

Fix commit: Merge branch 'secu


CVE: CVE-2022-29222

[{'lang': 'en', 'value': "Pion DTLS is a Go implementation of Datagram Transport Layer Security. Prior to version 2.1.5, a DTLS Client could provide a Certificate that it doesn't posses the private key for and Pion DTLS wouldn't reject it. This issue affects users that are using Client certificates only. The connection itself is still secure. The Certificate provided by clients can't be trusted when using a Pion DTLS server prior to version 2.1.5. Users should upgrade to ver


CVE: CVE-2022-2923

[{'lang': 'en', 'value': 'NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0240.'}]

Fix commit: patch 9.0.0240: crash when using ":mkspell" with an empty .dic file

Problem:    Crash when using ":mkspell" with an empty .dic file.
Solution:   Check for an empty word tree.


CVE: CVE-2022-29237

[{'lang': 'en', 'value': "Opencast is a free and open source solution for automated video capture and distribution at scale. Prior to Opencast 10.14 and 11.7, users could pass along URLs for files belonging to organizations other than the user's own, which Opencast would then import into the current organization, bypassing organizational barriers. Attackers must have full access to Opencast's ingest REST interface, and also know internal links to resources in another organiz