CVE-2022-47924

MediumCVSS 6.5/10Last modified Oct 23, 2026

Description

An high privileged attacker may pass crafted arguments to the validate function of csaf-validator-lib of a locally installed Secvisogram in versions < 0.1.0 wich can result in arbitrary code execution and DoS once the users triggers the validation.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
Secvisogram	csaf-validator-lib	>= 0.0.0, < 0.1.0

References

https://wid.cert-bund.de/.well-known/csaf/white/2022/bsi-2022-0004.jsonThird Party Advisory
https://wid.cert-bund.de/.well-known/csaf/white/2022/bsi-2022-0004.jsonThird Party Advisory

Timeline

Published: Mar 27, 2023
Last modified: Oct 23, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-479257.5The validate JSON endpoint of the Secvisogram csaf-validator-service in versions < 0.1.0 processes tests with unexpected names. This insuffi CVE-2022-479269.8AyaCMS 3.1.2 is vulnerable to file deletion via /aya/module/admin/fst_del.inc.php CVE-2022-479275.5An issue was discovered in MediaWiki before 1.35.9, 1.36.x through 1.38.x before 1.38.5, and 1.39.x before 1.39.1. When installing with a pr CVE-2022-479286.1In MISP before 2.4.167, there is XSS in the template file uploads in app/View/Templates/upload_file.ctp.CVE-2022-479295.5In the Linux kernel before 6.1.6, a NULL pointer dereference bug in the traffic control subsystem allows an unprivileged user to trigger a d CVE-2022-47935.4The Blog Designer WordPress plugin before 2.4.1 does not validate and escape one of its shortcode attributes, which could allow users with a CVE-2022-479306.8An issue was discovered in IO FinNet tss-lib before 2.0.0. The parameter ssid for defining a session id is not used through the MPC implemen CVE-2022-479319.1IO FinNet tss-lib before 2.0.0 allows a collision of hash values.CVE-2022-479326.5Brave Browser before 1.43.34 allowed a remote attacker to cause a denial of service via a crafted HTML file that mentions an ipfs:// or ipns CVE-2022-479336.5Brave Browser before 1.42.51 allowed a remote attacker to cause a denial of service via a crafted HTML file that references the IPFS scheme.CVE-2022-479346.5Brave Browser before 1.43.88 allowed a remote attacker to cause a denial of service in private and guest windows via a crafted HTML file tha CVE-2022-479357.8A vulnerability has been identified in JT Open (All versions < V11.1.1.0), JT Utilities (All versions < V13.1.1.0), Solid Edge (All versions