Advisory Database Sync

2026-05-22 18:04:22 -07:00 · 2022-12-22 18:31:34 +00:00
parent 9bf00ae4db
commit 9d9c0d3221
48 changed files with 373 additions and 87 deletions
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.3.0",
  "id": "GHSA-4hgp-5v89-5fhw",
-  "modified": "2022-08-26T00:03:35Z",
+  "modified": "2022-12-22T18:30:26Z",
  "published": "2022-08-24T00:00:29Z",
  "aliases": [
    "CVE-2021-3759"
@@ -29,6 +29,10 @@
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1999675"
    },
+    {
+      "type": "WEB",
+      "url": "https://lists.debian.org/debian-lts-announce/2022/12/msg00031.html"
+    },
    {
      "type": "WEB",
      "url": "https://lore.kernel.org/linux-mm/1626333284-1404-1-git-send-email-nglaive@gmail.com/"
@@ -24,6 +24,10 @@
    {
      "type": "WEB",
      "url": "https://bugzilla.kernel.org/show_bug.cgi?id=214771"
+    },
+    {
+      "type": "WEB",
+      "url": "https://lists.debian.org/debian-lts-announce/2022/12/msg00031.html"
    }
  ],
  "database_specific": {
@@ -25,6 +25,10 @@
      "type": "WEB",
      "url": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=ec7eede369fe5b0d085ac51fdbb95184f87bfc6c"
    },
+    {
+      "type": "WEB",
+      "url": "https://lists.debian.org/debian-lts-announce/2022/12/msg00031.html"
+    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?id.211018"
@@ -25,6 +25,10 @@
      "type": "WEB",
      "url": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3c52c6bb831f6335c176a0fc7214e26f43adbd11"
    },
+    {
+      "type": "WEB",
+      "url": "https://lists.debian.org/debian-lts-announce/2022/12/msg00031.html"
+    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?id.211021"
@@ -21,6 +21,10 @@
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3435"
    },
+    {
+      "type": "WEB",
+      "url": "https://lists.debian.org/debian-lts-announce/2022/12/msg00031.html"
+    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GGHENNMLCWIQV2LLA56BJNFIUZ7WB4IY/"
@@ -25,6 +25,10 @@
      "type": "WEB",
      "url": "https://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next.git/commit/?id=89f9f3cb86b1c63badaf392a83dd661d56cc50b1"
    },
+    {
+      "type": "WEB",
+      "url": "https://lists.debian.org/debian-lts-announce/2022/12/msg00031.html"
+    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?id.211087"
@@ -32,6 +36,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
+      "CWE-119",
      "CWE-416"
    ],
    "severity": "HIGH",
@@ -21,6 +21,10 @@
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-41850"
    },
+    {
+      "type": "WEB",
+      "url": "https://lists.debian.org/debian-lts-announce/2022/12/msg00031.html"
+    },
    {
      "type": "WEB",
      "url": "https://lore.kernel.org/all/20220904193115.GA28134@ubuntu/t/#u"
@@ -25,6 +25,10 @@
      "type": "WEB",
      "url": "https://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next.git/commit/?id=42cf46dea905a80f6de218e837ba4d4cc33d6979"
    },
+    {
+      "type": "WEB",
+      "url": "https://lists.debian.org/debian-lts-announce/2022/12/msg00031.html"
+    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DGOIRR72OAFE53XZRUDZDP7INGLIC3E3/"
@@ -21,6 +21,10 @@
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-41849"
    },
+    {
+      "type": "WEB",
+      "url": "https://lists.debian.org/debian-lts-announce/2022/12/msg00031.html"
+    },
    {
      "type": "WEB",
      "url": "https://lore.kernel.org/all/20220925133243.GA383897@ubuntu/T/"
@@ -25,6 +25,10 @@
      "type": "WEB",
      "url": "https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git/commit/?id=93e2be344a7db169b7119de21ac1bf253b8c6907"
    },
+    {
+      "type": "WEB",
+      "url": "https://lists.debian.org/debian-lts-announce/2022/12/msg00031.html"
+    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?id.211363"
@@ -25,6 +25,10 @@
      "type": "WEB",
      "url": "https://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next.git/commit/?id=2568a7e0832ee30b0a351016d03062ab4e0e0a3f"
    },
+    {
+      "type": "WEB",
+      "url": "https://lists.debian.org/debian-lts-announce/2022/12/msg00031.html"
+    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?id.211088"
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.3.0",
  "id": "GHSA-395q-7j8c-c3j7",
-  "modified": "2022-12-18T12:30:20Z",
+  "modified": "2022-12-22T18:30:25Z",
  "published": "2022-12-18T12:30:20Z",
  "aliases": [
    "CVE-2022-4598"
  ],
  "details": "A vulnerability has been found in Shoplazza LifeStyle 1.1 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/api/theme-edit/ of the component Announcement Handler. The manipulation of the argument Text/Mobile Text leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-216193 was assigned to this vulnerability.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
+    }
  ],
  "affected": [

@@ -35,7 +38,7 @@
    "cwe_ids": [
      "CWE-79"
    ],
-    "severity": null,
+    "severity": "MODERATE",
    "github_reviewed": false
  }
 }
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.3.0",
  "id": "GHSA-429v-rpg5-8469",
-  "modified": "2022-12-18T12:30:20Z",
+  "modified": "2022-12-22T18:30:25Z",
  "published": "2022-12-18T12:30:20Z",
  "aliases": [
    "CVE-2022-4601"
  ],
  "details": "A vulnerability was found in Shoplazza LifeStyle 1.1. It has been declared as problematic. This vulnerability affects unknown code of the file /admin/api/theme-edit/ of the component Shipping/Member Discount/Icon. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-216196.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
+    }
  ],
  "affected": [

@@ -35,7 +38,7 @@
    "cwe_ids": [
      "CWE-79"
    ],
-    "severity": null,
+    "severity": "MODERATE",
    "github_reviewed": false
  }
 }
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.3.0",
  "id": "GHSA-44mv-gf6j-pvgx",
-  "modified": "2022-12-18T06:31:09Z",
+  "modified": "2022-12-22T18:30:24Z",
  "published": "2022-12-18T06:31:09Z",
  "aliases": [
    "CVE-2022-47515"
  ],
  "details": "An issue was discovered in drachtio-server before 0.8.20. It allows remote attackers to cause a denial of service (daemon crash) via a long message in a TCP request that leads to std::length_error.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
+    }
  ],
  "affected": [

@@ -31,7 +34,7 @@
    "cwe_ids": [

    ],
-    "severity": null,
+    "severity": "HIGH",
    "github_reviewed": false
  }
 }
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.3.0",
  "id": "GHSA-463f-2q49-4chc",
-  "modified": "2022-12-18T12:30:20Z",
+  "modified": "2022-12-22T18:30:25Z",
  "published": "2022-12-18T12:30:20Z",
  "aliases": [
    "CVE-2022-4602"
  ],
  "details": "A vulnerability was found in Shoplazza LifeStyle 1.1. It has been rated as problematic. This issue affects some unknown processing of the file /admin/api/theme-edit/ of the component Review Flow Handler. The manipulation of the argument Title leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-216197 was assigned to this vulnerability.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
+    }
  ],
  "affected": [

@@ -35,7 +38,7 @@
    "cwe_ids": [
      "CWE-79"
    ],
-    "severity": null,
+    "severity": "MODERATE",
    "github_reviewed": false
  }
 }
@@ -0,0 +1,36 @@
+{
+  "schema_version": "1.3.0",
+  "id": "GHSA-49gf-23c6-vwj7",
+  "modified": "2022-12-22T18:30:25Z",
+  "published": "2022-12-22T18:30:25Z",
+  "aliases": [
+    "CVE-2022-44510"
+  ],
+  "details": "Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-44510"
+    },
+    {
+      "type": "WEB",
+      "url": "https://helpx.adobe.com/security/products/experience-manager/apsb22-59.html"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-79"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false
+  }
+}
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.3.0",
  "id": "GHSA-56mg-c7p2-w99m",
-  "modified": "2022-12-16T21:30:44Z",
+  "modified": "2022-12-22T18:30:24Z",
  "published": "2022-12-16T21:30:44Z",
  "aliases": [
    "CVE-2022-4566"
  ],
  "details": "A vulnerability, which was classified as critical, has been found in y_project RuoYi 4.7.5. This issue affects some unknown processing of the file com/ruoyi/generator/controller/GenController. The manipulation leads to sql injection. The name of the patch is 167970e5c4da7bb46217f576dc50622b83f32b40. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-215975.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
+    }
  ],
  "affected": [

@@ -39,7 +42,7 @@
    "cwe_ids": [
      "CWE-89"
    ],
-    "severity": null,
+    "severity": "CRITICAL",
    "github_reviewed": false
  }
 }
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.3.0",
  "id": "GHSA-664m-3r2m-mxpx",
-  "modified": "2022-12-17T00:30:20Z",
+  "modified": "2022-12-22T18:30:24Z",
  "published": "2022-12-17T00:30:20Z",
  "aliases": [
    "CVE-2022-38756"
  ],
  "details": "A vulnerability has been identified in Micro Focus GroupWise Web in versions prior to 18.4.2. The GW Web component makes a request to the Post Office Agent that contains sensitive information in the query parameters that could be logged by any intervening HTTP proxies.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"
+    }
  ],
  "affected": [

@@ -25,9 +28,9 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-532"
    ],
-    "severity": null,
+    "severity": "MODERATE",
    "github_reviewed": false
  }
 }
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.3.0",
  "id": "GHSA-6gg7-q37j-4gwp",
-  "modified": "2022-12-18T09:31:01Z",
+  "modified": "2022-12-22T18:30:24Z",
  "published": "2022-12-18T09:31:01Z",
  "aliases": [
    "CVE-2022-4594"
  ],
  "details": "A vulnerability was found in drogatkin TJWS2. It has been declared as critical. Affected by this vulnerability is the function deployWar of the file 1.x/src/rogatkin/web/WarRoller.java. The manipulation leads to path traversal. The attack can be launched remotely. The name of the patch is 1bac15c496ec54efe21ad7fab4e17633778582fc. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-216187.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
+    }
  ],
  "affected": [

@@ -31,7 +34,7 @@
    "cwe_ids": [
      "CWE-22"
    ],
-    "severity": null,
+    "severity": "CRITICAL",
    "github_reviewed": false
  }
 }
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.3.0",
  "id": "GHSA-6wmx-298j-589v",
-  "modified": "2022-12-17T00:30:21Z",
+  "modified": "2022-12-22T18:30:25Z",
  "published": "2022-12-17T00:30:21Z",
  "aliases": [
    "CVE-2022-26580"
  ],
  "details": "PAX Technology A930 PayDroid 7.1.1 Virgo V04.4.02 20211201 was discovered to be vulnerable to command injection.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
+    }
  ],
  "affected": [

@@ -25,9 +28,9 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-78"
    ],
-    "severity": null,
+    "severity": "MODERATE",
    "github_reviewed": false
  }
 }
--- a/Show More
+++ b/Show More