CVE-2022-23082

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

In CureKit versions v1.0.1 through v1.1.3 are vulnerable to path traversal as the function isFileOutsideDir fails to sanitize the user input which may lead to path traversal.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published
May 31, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-230836.1NetMaster 12.2 Network Management for TCP/IP and NetMaster File Transfer Management contain a XSS (Cross-Site Scripting) vulnerability in ReCVE-2022-230847.5The total size of the user-provided nmreq to nmreq_copyin() was first computed and then trusted during the copyin. This time-of-check to tiCVE-2022-230858.2A user-provided integer option was passed to nmreq_copyin() without checking if it would overflow. This insufficient bounds checking could CVE-2022-230867.8Handlers for *_CFG_PAGE read / write ioctls in the mpr, mps, and mpt drivers allocated a buffer of a caller-specified size, but copied to itCVE-2022-230878.8The e1000 network adapters permit a variety of modifications to an Ethernet packet when it is being transmitted. These include the insertioCVE-2022-230889.8The 802.11 beacon handling routine failed to validate the length of an IEEE 802.11s Mesh ID before copying it to a heap-allocated buffer. WCVE-2022-230894.7When dumping core and saving process information, proc_getargv() might return an sbuf which have a sbuf_len() of 0 or -1, which is not propeCVE-2022-23097.5NULL Pointer Dereference allows attackers to cause a denial of service (or application crash). This only applies when lxml is used together CVE-2022-230907.7The aio_aqueue function, used by the lio_listio system call, fails to release a reference to a credential in an error case. An attacker mayCVE-2022-230914.0A particular case of memory sharing is mishandled in the virtual memory system. This is very similar to SA-21:08.vm, but with a different rCVE-2022-230928.8The implementation of lib9p's handling of RWALK messages was missing a bounds check needed when unpacking the message contents. The missingCVE-2022-230936.5ping reads raw IP packets from the network to process responses in the pr_pack() function. As part of processing a response ping has to rec
CVE-2022-23082: High severity, CVSS 7.5 | Vulnix