Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ontainer: References: - https://www.ibm.com/support/pages/node/7155078 - https://exchange.xforce.ibmcloud.com/vulnerabilities/265264
CVE ID: CVE-2023-42006 State: PUBLISHED Published: 2023-12-01T16:58:16.883Z Last Updated: 2024-08-02T19:16:49.490Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: IBM Products: i Problem Types: 256 Plaintext Storage of a Password Description: IBM Administration Runtime Expert for i 7.2, 7.3, 7.4, and 7.5 could allow a local user to obtain sensitive information caused by improper authority checks. IBM X-Force ID: 265266. Additional Analyst Notes: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7085891 - https://exchange.xforce.ibmcloud.com/vulnerabilities/265266
CVE ID: CVE-2023-42007 State: PUBLISHED Published: 2025-04-10T13:24:46.308Z Last Updated: 2025-08-17T00:09:35.887Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: IBM Products: Sterling Control Center Problem Types: CWE-79 Description: IBM Sterling Control Center 6.2.1, 6.3.1, and 6.4.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7230560
CVE ID: CVE-2023-42009 State: PUBLISHED Published: 2023-12-01T20:52:14.326Z Last Updated: 2024-08-02T19:16:49.347Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: IBM Products: InfoSphere Information Server Problem Types: CWE-79 Description: IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 265504. Additional Analyst Notes: - CVE Program Container: References: - https://https://www.ibm.com/support/pages/node/7070755 - https:
al Analyst Notes: - CVE Program Container: References: - https://https://www.ibm.com/support/pages/node/7070755 - https://exchange.xforce.ibmcloud.com/vulnerabilities/265504
CVE ID: CVE-2023-42010 State: PUBLISHED Published: 2024-07-17T17:18:38.043Z Last Updated: 2024-08-02T19:16:49.512Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: IBM Products: Sterling B2B Integrator Standard Edition Problem Types: CWE-497 Description: IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.2.5 and 6.2.0.0 through 6.2.0.2 could disclose sensitive information in the HTTP response using man in the middle techniques. IBM X-Force ID: 265507. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7160433 - https://exchange.xforce.ibmcloud.com/vulnerabilities/265507
CVE ID: CVE-2023-42011 State: PUBLISHED Published: 2024-06-27T17:39:04.750Z Last Updated: 2024-08-02T19:16:49.483Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: IBM Products: Sterling B2B Integrator Standard Edition Problem Types: CWE-1021 Description: IBM Sterling B2B Integrator Standard Edition 6.1 and 6.2 does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain, which can lead to user confusion about which interface the user is interacting with. IBM X-Force ID: 265508. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/
l Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7158657 - https://exchange.xforce.ibmcloud.com/vulnerabilities/265508
CVE ID: CVE-2023-42012 State: PUBLISHED Published: 2023-12-19T23:49:47.333Z Last Updated: 2024-08-02T19:16:49.547Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: IBM Products: UrbanCode Deploy Problem Types: CWE-20 Description: An IBM UrbanCode Deploy Agent 7.2 through 7.2.3.7, and 7.3 through 7.3.2.2 installed as a Windows service in a non-standard location could be subject to a denial of service attack by local accounts. IBM X-Force ID: 265509. Additional Analyst Notes: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7096548 - https://exchange.xforce.ibmcloud.com/vulnerabilities/265509
CVE ID: CVE-2023-42013 State: PUBLISHED Published: 2023-12-19T23:47:11.685Z Last Updated: 2024-08-02T19:16:50.617Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: IBM Products: UrbanCode Deploy Problem Types: CWE-209 Description: IBM UrbanCode Deploy (UCD) 7.1 through 7.1.2.14, 7.2 through 7.2.3.7, and 7.3 through 7.3.2.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 265510. Additional Analyst Notes: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7096547 - http
. Additional Analyst Notes: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7096547 - https://exchange.xforce.ibmcloud.com/vulnerabilities/265510
CVE ID: CVE-2023-42014 State: PUBLISHED Published: 2024-06-27T18:00:42.773Z Last Updated: 2024-08-02T19:16:49.522Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: IBM Products: Sterling B2B Integrator Standard Edition Problem Types: CWE-79 Description: IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.2.0.2 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 265511. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Contai
ithin a trusted session. IBM X-Force ID: 265511. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7158654 - https://exchange.xforce.ibmcloud.com/vulnerabilities/265511
CVE ID: CVE-2023-42015 State: PUBLISHED Published: 2023-12-19T02:12:19.966Z Last Updated: 2024-11-21T19:01:20.125Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: IBM Products: UrbanCode Deploy Problem Types: 80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) Description: IBM UrbanCode Deploy (UCD) 7.1 through 7.1.2.14, 7.2 through 7.2.3.7, and 7.3 through 7.3.2.2 is vulnerable to HTML injection. This vulnerability may allow a user to embed arbitrary HTML tags in the Web UI potentially leading to sensitive information disclosure. IBM X-Force ID: 265512. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment:
rmation disclosure. IBM X-Force ID: 265512. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7096546 - https://exchange.xforce.ibmcloud.com/vulnerabilities/265512
CVE ID: CVE-2023-42016 State: PUBLISHED Published: 2024-02-09T01:01:03.137Z Last Updated: 2024-08-22T15:55:17.947Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: IBM Products: Sterling B2B Integrator Problem Types: CWE-614 Description: IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.8 and 6.1.0.0 through 6.1.2.3 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic
. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 265559. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7116083 - https://exchange.xforce.ibmcloud.com/vulnerabilities/265559
CVE ID: CVE-2023-42017 State: PUBLISHED Published: 2023-12-22T16:02:54.311Z Last Updated: 2024-08-02T19:16:49.662Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: IBM Products: Planning Analytics Problem Types: CWE-434 Description: IBM Planning Analytics Local 2.0 could allow a remote attacker to upload arbitrary files, caused by the improper validation of file extensions. By sending a specially crafted HTTP request, a remote attacker could exploit this vulnerability to upload a malicious script, which could allow the attacker to execute arbitrary code on the vulnerable system. IBM X-Force ID: 265567. Additional Analyst Notes: - CVE Program Container: References
ary code on the vulnerable system. IBM X-Force ID: 265567. Additional Analyst Notes: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7096528 - https://exchange.xforce.ibmcloud.com/vulnerabilities/265567
CVE ID: CVE-2023-42019 State: PUBLISHED Published: 2023-12-01T21:01:45.589Z Last Updated: 2024-08-02T19:16:49.661Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: InfoSphere Information Server Problem Types: CWE-311 Description: IBM InfoSphere Information Server 11.7 could allow a remote attacker to cause a denial of service due to improper input validation. IBM X-Force ID: 265161. Additional Analyst Notes: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7067719 - https://exchange.xforce.ibmcloud.com/vulnerabilities/265569
CVE ID: CVE-2023-42022 State: PUBLISHED Published: 2023-12-01T20:57:15.628Z Last Updated: 2024-08-02T19:16:49.440Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: IBM Products: InfoSphere Information Server Problem Types: CWE-79 Description: IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 265938. Additional Analyst Notes: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7074335 - https://exchan
al Analyst Notes: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7074335 - https://exchange.xforce.ibmcloud.com/vulnerabilities/265938
CVE ID: CVE-2023-42027 State: PUBLISHED Published: 2023-11-02T23:40:55.220Z Last Updated: 2024-09-05T14:34:26.166Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: IBM Products: CICS TX Standard, CICS TX Advanced, TXSeries for Multiplatforms Problem Types: CWE-352 Description: IBM CICS TX Standard 11.1, Advanced 10.1, 11.1, and TXSeries for Multiplatforms 8.1, 8.2, 9.1 are vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 266057. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www
-Force ID: 266057. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7063659 - https://www.ibm.com/support/pages/node/7063664 - https://exchange.xforce.ibmcloud.com/vulnerabilities/266057
CVE ID: CVE-2023-42029 State: PUBLISHED Published: 2023-11-02T23:44:23.058Z Last Updated: 2024-09-05T14:34:08.497Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: IBM Products: CICS TX Standard, CICS TX Advanced, TXSeries for Multiplatforms Problem Types: CWE-79 Description: IBM CICS TX Standard 11.1, Advanced 10.1, 11.1, and TXSeries for Multiplatforms 8.1, 8.2, 9.1 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 266059. Additional Analyst Notes: - CVE Progra
ading to credentials disclosure within a trusted session. IBM X-Force ID: 266059. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7063659 - https://www.ibm.com/support/pages/node/7063663 - https://exchange.xforce.ibmcloud.com/vulnerabilities/266059
CVE ID: CVE-2023-42031 State: PUBLISHED Published: 2023-10-24T17:50:21.960Z Last Updated: 2024-09-11T17:06:41.868Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: IBM Products: TXSeries for Multiplatforms, CICS TX Standard, CICS TX Advanced Problem Types: CWE-400 Description: IBM TXSeries for Multiplatforms, 8.1, 8.2, and 9.1, CICS TX Standard CICS TX Advanced 10.1 and 11.1 could allow a privileged user to cause a denial of service due to uncontrolled resource consumption. IBM X-Force ID: 266016. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7056433 - https://www.ibm.com/suppo
ainer: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7056433 - https://www.ibm.com/support/pages/node/7056429 - https://exchange.xforce.ibmcloud.com/vulnerabilities/266061
CVE ID: CVE-2023-42032 State: PUBLISHED Published: 2024-05-03T02:12:20.797Z Last Updated: 2024-08-02T19:16:49.553Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Visualware Products: MyConnection Server Problem Types: CWE-749 Description: Visualware MyConnection Server doRTAAccessUPass Exposed Dangerous Method Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Visualware MyConnection Server. Authentication is not required to exploit this vulnerability. The specific flaw exists within the doRTAAccessUPass method. The issue results from an exposed dangerous method. An a
y. The specific flaw exists within the doRTAAccessUPass method. The issue results from an exposed dangerous method. An attacker can leverage this vulnerability to disclose information in the context of the application. Was ZDI-CAN-21611. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-23-1398/ - https://myconnectionserver.visualware.com/support/security-advisories
CVE ID: CVE-2023-42033 State: PUBLISHED Published: 2024-05-03T02:12:21.595Z Last Updated: 2024-08-02T19:16:49.648Z Severity: HIGH (CVSS 7.2 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Visualware Products: MyConnection Server Problem Types: CWE-22 Description: Visualware MyConnection Server doPostUploadfiles Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Visualware MyConnection Server. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the doPostUploadfiles method. The issue
isting authentication mechanism can be bypassed. The specific flaw exists within the doPostUploadfiles method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-21612. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-23-1396/ - https://myconnectionserver.visualware.com/support/security-advisories
CVE ID: CVE-2023-42034 State: PUBLISHED Published: 2024-05-03T02:12:22.307Z Last Updated: 2024-08-02T19:16:49.605Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Visualware Products: MyConnection Server Problem Types: CWE-79 Description: Visualware MyConnection Server doRTAAccessCTConfig Cross-Site Scripting Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of Visualware MyConnection Server. Minimal user interaction is required to exploit this vulnerability. The specific flaw exists within the doRTAAccessCTConfig method. The issue results from the lack of proper validation of use
specific flaw exists within the doRTAAccessCTConfig method. The issue results from the lack of proper validation of user-supplied data, which can lead to the injection of an arbitrary script. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-21613. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-23-1399/ - https://myconnectionserver.visualware.com/support/security-advisories
CVE ID: CVE-2023-42035 State: PUBLISHED Published: 2024-05-03T02:12:23.021Z Last Updated: 2024-08-02T19:16:49.679Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L) Vendors: Visualware Products: MyConnection Server Problem Types: CWE-611 Description: Visualware MyConnection Server doIForward XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Visualware MyConnection Server. Authentication is not required to exploit this vulnerability. The specific flaw exists within the doIForward method. Due to the improper restriction of XML External Entity (XXE)
ity. The specific flaw exists within the doIForward method. Due to the improper restriction of XML External Entity (XXE) references, a crafted document specifying a URI causes the XML parser to access the URI and embed the contents back into the XML document for further processing. An attacker can leverage this vulnerability to disclose information in the context of root. Was ZDI-CAN-21774. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-23-1397/ - https://myconnectionserver.visualware.com/support/security-advisories
CVE ID: CVE-2023-42036 State: PUBLISHED Published: 2024-05-03T02:12:23.750Z Last Updated: 2024-09-18T18:30:01.073Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Kofax Products: Power PDF Problem Types: CWE-119 Description: Kofax Power PDF PDF File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Kofax Power PDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. The issue results from the lack of proper validati
cious file. The specific flaw exists within the parsing of PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-21582. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-23-1393/
CVE ID: CVE-2023-42037 State: PUBLISHED Published: 2024-05-03T02:12:24.527Z Last Updated: 2024-09-18T18:30:01.970Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Kofax Products: Power PDF Problem Types: CWE-119 Description: Kofax Power PDF PDF File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Kofax Power PDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. The issue results from the lack of proper validati
cious file. The specific flaw exists within the parsing of PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-21583. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-23-1392/
CVE ID: CVE-2023-42038 State: PUBLISHED Published: 2024-05-03T02:12:25.233Z Last Updated: 2024-09-18T18:30:02.871Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Kofax Products: Power PDF Problem Types: CWE-122 Description: Kofax Power PDF PDF File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Kofax Power PDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. The issue results from the lack of proper
en a malicious file. The specific flaw exists within the parsing of PDF files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-21602. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-23-1394/
CVE ID: CVE-2023-42039 State: PUBLISHED Published: 2024-05-03T02:12:25.922Z Last Updated: 2024-09-18T18:30:03.671Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Kofax Products: Power PDF Problem Types: CWE-122 Description: Kofax Power PDF PDF File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Kofax Power PDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. The issue results from the lack of proper
en a malicious file. The specific flaw exists within the parsing of PDF files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. . Was ZDI-CAN-21603. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-23-1395/
CVE ID: CVE-2023-42040 State: PUBLISHED Published: 2024-05-03T02:12:26.637Z Last Updated: 2024-08-02T19:16:49.698Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: PDF-XChange Products: PDF-XChange Editor Problem Types: CWE-416 Description: PDF-XChange Editor mailForm Use-After-Free Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the mailForm method. The issue results from the lack of validating the ex