CVSS: 9.1EPSS: 0%CPEs: 3EXPL: 2CVE-2022-37032 – frr: out-of-bounds read in the BGP daemon may lead to information disclosure or denial of service
https://notcve.org/view.php?id=CVE-2022-37032
An out-of-bounds read in the BGP daemon of FRRouting FRR before 8.4 may lead to a segmentation fault and denial of service. This occurs in bgp_capability_msg_parse in bgpd/bgp_packet.c. Una lectura fuera de límites en el demonio BGP de FRRouting FRR versiones anteriores a 8.4, puede conllevar a un fallo de segmentación y una denegación de servicio. Esto ocurre en la función bgp_capability_msg_parse en el archivo bgpd/bgp_packet.c A vulnerability was found in FRRouting. This issue occurs in bgp_capability_msg_parse in bgpd/bgp_packet.c. • https://github.com/spwpun/CVE-2022-37032 https://bugzilla.suse.com/show_bug.cgi?id=1202023 https://github.com/FRRouting/frr/commit/6d58272b4cf96f0daa846210dd2104877900f921 https://github.com/FRRouting/frr/commit/ff6db1027f8f36df657ff2e5ea167773752537ed https://lists.debian.org/debian-lts-announce/2022/11/msg00039.html https://www.debian.org/security/2023/dsa-5362 https://access.redhat.com/security/cve/CVE-2022-37032 https://bugzilla.redhat.com/show_bug.cgi?id=2128713 • CWE-125: Out-of-bounds Read •
CVSS: 4.4EPSS: 0%CPEs: 5EXPL: 1CVE-2022-28201
https://notcve.org/view.php?id=CVE-2022-28201
An issue was discovered in MediaWiki before 1.35.6, 1.36.x before 1.36.4, and 1.37.x before 1.37.2. Users with the editinterface permission can trigger infinite recursion, because a bare local interwiki is mishandled for the mainpage message. Se ha detectado un problema en MediaWiki versiones anteriores a 1.35.6, 1.36.x anteriores a 1.36.4 y 1.37.x anteriores a 1.37.2. Los usuarios con el permiso editinterface pueden desencadenar una recursión infinita, porque un interwiki local desnudo es manejado inapropiadamente para el mensaje de la página principal • https://blog.legoktm.com/2022/07/03/a-belated-writeup-of-cve-2022-28201-in-mediawiki.html https://lists.debian.org/debian-lts-announce/2022/09/msg00027.html https://phabricator.wikimedia.org/T297571 https://www.debian.org/security/2022/dsa-5246 • CWE-674: Uncontrolled Recursion •
CVSS: 7.8EPSS: 0%CPEs: 5EXPL: 1CVE-2022-3235 – Use After Free in vim/vim
https://notcve.org/view.php?id=CVE-2022-3235
Use After Free in GitHub repository vim/vim prior to 9.0.0490. Un Uso de Memoria Previamente Liberada en el repositorio GitHub vim/vim versiones anteriores a 9.0.0490 • https://github.com/vim/vim/commit/1c3dd8ddcba63c1af5112e567215b3cec2de11d0 https://huntr.dev/bounties/96d5f7a0-a834-4571-b73b-0fe523b941af https://lists.debian.org/debian-lts-announce/2022/11/msg00032.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4QI7AETXBHPC7SGA77Q7O5IEGULWYET7 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GTBVD4J2SKVSWK4VBN5JP5OEVK6GDS3N https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/messa • CWE-416: Use After Free •
CVSS: 5.5EPSS: 0%CPEs: 5EXPL: 0CVE-2022-40768
https://notcve.org/view.php?id=CVE-2022-40768
drivers/scsi/stex.c in the Linux kernel through 5.19.9 allows local users to obtain sensitive information from kernel memory because stex_queuecommand_lck lacks a memset for the PASSTHRU_CMD case. El archivo drivers/scsi/stex.c en el kernel de Linux versiones hasta 5.19.9, permite a usuarios locales obtener información confidencial de la memoria del kernel porque stex_queuecommand_lck carece de memset para el caso PASSTHRU_CMD • http://www.openwall.com/lists/oss-security/2022/09/19/1 https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=6022f210461fef67e6e676fd8544ca02d1bcfa7a https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/log/drivers/scsi/stex.c https://lists.debian.org/debian-lts-announce/2022/12/msg00034.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GGHENNMLCWIQV2LLA56BJNFIUZ7WB4IY https://lists.fedoraproject.org/archives/list/packa • CWE-908: Use of Uninitialized Resource •
CVSS: 7.8EPSS: 0%CPEs: 5EXPL: 1CVE-2022-3234 – Heap-based Buffer Overflow in vim/vim
https://notcve.org/view.php?id=CVE-2022-3234
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0483. Desbordamiento de búfer basado en Heap en el repositorio de GitHub vim/vim anterior a la versión 9.0.0483 • https://github.com/vim/vim/commit/c249913edc35c0e666d783bfc21595cf9f7d9e0d https://huntr.dev/bounties/90fdf374-bf04-4386-8a23-38c83b88f0da https://lists.debian.org/debian-lts-announce/2022/11/msg00009.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4QI7AETXBHPC7SGA77Q7O5IEGULWYET7 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GTBVD4J2SKVSWK4VBN5JP5OEVK6GDS3N https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/messa • CWE-122: Heap-based Buffer Overflow CWE-787: Out-of-bounds Write •