Security Vulnerabilities - CVEs Published In 2022
The package org.yaml:snakeyaml from 0 and before 1.31 are vulnerable to Denial of Service (DoS) due missing to nested depth limitation for collections.
CVSS Score
7.5
EPSS Score
0.029
Published
2022-08-30
The package sanitize-html before 2.7.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to insecure global regular expression replacement logic of HTML comment removal.
CVSS Score
5.3
EPSS Score
0.016
Published
2022-08-30
Realtek Linux/Android Bluetooth Mesh SDK has a buffer overflow vulnerability due to insufficient validation for the size of segmented packets’ reference parameter. An unauthenticated attacker in the adjacent network can exploit this vulnerability to cause buffer overflow and disrupt service.
CVSS Score
6.5
EPSS Score
0.005
Published
2022-08-30
Realtek Linux/Android Bluetooth Mesh SDK has a buffer overflow vulnerability due to insufficient validation for the length of segmented packets’ shift parameter. An unauthenticated attacker in the adjacent network can exploit this vulnerability to cause buffer overflow and disrupt service.
CVSS Score
6.5
EPSS Score
0.005
Published
2022-08-30
Realtek Linux/Android Bluetooth Mesh SDK has a buffer overflow vulnerability due to insufficient validation for segmented packets’ link parameter. An unauthenticated attacker in the adjacent network can exploit this vulnerability to cause buffer overflow and disrupt service.
CVSS Score
6.5
EPSS Score
0.005
Published
2022-08-30
Le-yan Personnel and Salary Management System has hard-coded database account and password within the website source code. An unauthenticated remote attacker can access, modify system data or disrupt service.
CVSS Score
9.8
EPSS Score
0.012
Published
2022-08-30
In Xpdf prior to 4.04, the DCT (JPEG) decoder was incorrectly allowing the 'interleaved' flag to be changed after the first scan of the image, leading to an unknown integer-related vulnerability in Stream.cc.
CVSS Score
7.8
EPSS Score
0.003
Published
2022-08-30
Xpdf prior to 4.04 lacked an integer overflow check in JPXStream.cc.
CVSS Score
7.8
EPSS Score
0.003
Published
2022-08-30
Poppler prior to and including 22.08.0 contains an integer overflow in the JBIG2 decoder (JBIG2Stream::readTextRegionSeg() in JBIGStream.cc). Processing a specially crafted PDF file or JBIG2 image could lead to a crash or the execution of arbitrary code. This is similar to the vulnerability described by CVE-2022-38171 in Xpdf.
CVSS Score
7.8
EPSS Score
0.006
Published
2022-08-30
Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /staff/edit_book_details.php.
CVSS Score
9.8
EPSS Score
0.009
Published
2022-08-30