Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-25832 State: PUBLISHED Published: 2023-05-09T00:00:00 Last Updated: 2025-04-10T18:38:43.184Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Esri Products: Portal for ArcGIS Problem Types: CWE-352 Description: There is a cross-site-request forgery vulnerability in Esri Portal for ArcGIS Versions 11.0 and below that may allow an attacker to trick an authorized user into executing unwanted actions. Additional Analyst Notes: - CVE Program Container: References: - https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/portal-for-arcgis-security-2023-update-1-patch-is-now-available/ - https://support.esri.com/en-us/patches-updates/20
ion/portal-for-arcgis-security-2023-update-1-patch-is-now-available/ - https://support.esri.com/en-us/patches-updates/2023/portal-for-arcgis-security-2023-update-1-patch-8095
CVE ID: CVE-2023-25833 State: PUBLISHED Published: 2023-05-10T00:00:00 Last Updated: 2025-04-10T18:40:10.575Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Esri Products: Portal for ArcGIS Problem Types: CWE-80 Description: There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.0 and below that may allow a remote, authenticated attacker to create a crafted link which when clicked could render arbitrary HTML in the victim’s browser (no stateful change made or customer data rendered). Additional Analyst Notes: - CVE Program Container: References: - https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/portal-for-arcgis
Program Container: References: - https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/portal-for-arcgis-security-2023-update-1-patch-is-now-available/ - https://support.esri.com/en-us/patches-updates/2023/portal-for-arcgis-security-2023-update-1-patch-8095
CVE ID: CVE-2023-25834 State: PUBLISHED Published: 2023-05-09T00:00:00.000Z Last Updated: 2025-04-10T18:36:49.951Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: Esri Products: Portal for ArcGIS Problem Types: CWE-269 Description: Changes to user permissions in Portal for ArcGIS 10.9.1 and below are incompletely applied in specific use cases. This issue may allow users to access content that they are no longer privileged to access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/portal-for-arcgis-security-2023-update-1-patch-is-now-available/ - ht
m/arcgis-blog/products/trust-arcgis/administration/portal-for-arcgis-security-2023-update-1-patch-is-now-available/ - https://support.esri.com/en-us/patches-updates/2023/portal-for-arcgis-security-2023-update-1-patch-8095
CVE ID: CVE-2023-25835 State: PUBLISHED Published: 2023-07-20T23:30:50.190Z Last Updated: 2025-04-10T18:41:52.229Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H) Vendors: Esri Products: Portal for ArcGIS Sites Problem Types: CWE-79 Description: There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Sites versions 11.1 and below that may allow a remote, authenticated attacker to create a crafted link that is stored in the site configuration which when clicked could potentially execute arbitrary JavaScript code in the victims browser. The privileges required to execute this attack are high. The impact to Confidentiality, Integrity and Availabilit
owser. The privileges required to execute this attack are high. The impact to Confidentiality, Integrity and Availability are High. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/portal-for-arcgis-enterprise-sites-security-patch-is-now-available/
CVE ID: CVE-2023-25836 State: PUBLISHED Published: 2023-07-21T03:41:09.485Z Last Updated: 2025-04-10T18:41:04.338Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Esri Products: Portal for ArcGIS Sites Problem Types: CWE-79 Description: There is a Cross-site Scripting vulnerability in Esri Portal for ArcGIS Sites in versions 10.9 and below that may allow a remote, authenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the victims browser. The privileges required to execute this attack are low. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://ww
his attack are low. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/portal-for-arcgis-enterprise-sites-security-patch-is-now-available/
CVE ID: CVE-2023-25837 State: PUBLISHED Published: 2023-07-21T03:42:24.610Z Last Updated: 2025-04-10T18:44:50.839Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H) Vendors: Esri Products: Portal for ArcGIS Sites Problem Types: CWE-79 Description: There is a Cross-site Scripting vulnerability in Esri ArcGIS Enterprise Sites versions 10.9 and below that may allow a remote, authenticated attacker to create a crafted link which when clicked by a victim could potentially execute arbitrary JavaScript code in the target's browser. The privileges required to execute this attack are high. The impact to Confidentiality, Integrity and Availability are High. Additional Analyst Note
xecute this attack are high. The impact to Confidentiality, Integrity and Availability are High. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/portal-for-arcgis-enterprise-sites-security-patch-is-now-available/
CVE ID: CVE-2023-25838 State: PUBLISHED Published: 2023-07-19T15:37:14.946Z Last Updated: 2024-10-28T15:14:38.760Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Esri Products: ArcGIS Insights Problem Types: CWE-89 Description: There is SQL injection vulnerability in Esri ArcGIS Insights 2022.1 for ArcGIS Enterprise and that may allow a remote, authorized attacker to execute arbitrary SQL commands against the back-end database. The effort required to generate the crafted input required to exploit this issue is complex and requires significant effort before a successful attack can be expected. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnr
t effort before a successful attack can be expected. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/arcgis-insights-security-patches-for-arcgis-insights-2022-1-are-now-available/
CVE ID: CVE-2023-25839 State: PUBLISHED Published: 2023-07-19T15:45:47.077Z Last Updated: 2024-10-25T18:52:54.067Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Esri Products: ArcGIS Insights Problem Types: CWE-89 Description: There is SQL injection vulnerability in Esri ArcGIS Insights Desktop for Mac and Windows version 2022.1 that may allow a local, authorized attacker to execute arbitrary SQL commands against the back-end database. The effort required to generate the crafted input required to exploit this issue is complex and requires significant effort before a successful attack can be expected. Additional Analyst Notes: - CVE Program Container: - CISA AD
nificant effort before a successful attack can be expected. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/arcgis-insights-security-patches-for-arcgis-insights-2022-1-are-now-available/
CVE ID: CVE-2023-25840 State: PUBLISHED Published: 2023-07-21T18:37:34.431Z Last Updated: 2025-04-10T18:43:16.338Z Severity: LOW (CVSS 3.4 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:L/A:N) Vendors: Esri Products: ArcGIS Enterprise Server Problem Types: CWE-79 Description: There is a Cross-site Scripting vulnerability in ArcGIS Server in versions 11.1 and below that may allow a remote, authenticated attacker to create a crafted link which onmouseover wont execute but could potentially render an image in the victims browser. The privileges required to execute this attack are high. Additional Analyst Notes: - CVE Program Container: References: - https://www.esri.com/arcgis-blog/products/trust-arcgi
. Additional Analyst Notes: - CVE Program Container: References: - https://www.esri.com/arcgis-blog/products/trust-arcgis/announcements/arcgis-server-security-2023-update-1-patch-available/
CVE ID: CVE-2023-25841 State: PUBLISHED Published: 2023-07-21T18:38:24.437Z Last Updated: 2025-04-10T18:43:52.035Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Esri Products: ArcGIS Enterprise Server Problem Types: CWE-79 Description: There is a stored Cross-site Scripting vulnerability in Esri ArcGIS Server versions 11.0 and below on Windows and Linux platforms that may allow a remote, unauthenticated attacker to create crafted content which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. Mitigation: Disable anonymous access to ArcGIS Feature services with edit capabilities. Additional Analyst Notes: - CVE Progra
tion: Disable anonymous access to ArcGIS Feature services with edit capabilities. Additional Analyst Notes: - CVE Program Container: References: - https://www.esri.com/arcgis-blog/products/trust-arcgis/announcements/arcgis-server-security-2023-update-1-patch-available/
CVE ID: CVE-2023-25848 State: PUBLISHED Published: 2023-08-25T18:44:14.016Z Last Updated: 2024-10-08T16:33:52.950Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Esri Products: ArcGIS Enterprise Server Problem Types: CWE-319 Description: ArcGIS Enterprise Server versions 11.0 and below have an information disclosure vulnerability where a remote, unauthorized attacker may submit a crafted query that may result in a low severity information disclosure issue. The information disclosed is limited to a single attribute in a database connection string. No business data is disclosed. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Refer
string. No business data is disclosed. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.esri.com/arcgis-blog/products/trust-arcgis/announcements/arcgis-server-map-and-feature-service-security-2023-update-1-patch/
CVE ID: CVE-2023-25859 State: PUBLISHED Published: 2023-03-22T00:00:00 Last Updated: 2024-08-02T13:11:42.215Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Illustrator Problem Types: CWE-20 Description: Illustrator version 26.5.2 (and earlier) and 27.2.0 (and earlier) are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/illustrato
es: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/illustrator/apsb23-19.html
CVE ID: CVE-2023-25860 State: PUBLISHED Published: 2023-03-22T00:00:00 Last Updated: 2024-08-02T13:12:30.738Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Illustrator Problem Types: CWE-787 Description: Illustrator version 26.5.2 (and earlier) and 27.2.0 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/illustrator/aps
CVE Program Container: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/illustrator/apsb23-19.html
CVE ID: CVE-2023-25861 State: PUBLISHED Published: 2023-03-22T00:00:00 Last Updated: 2024-08-02T13:13:01.467Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Illustrator Problem Types: CWE-787 Description: Illustrator version 26.5.2 (and earlier) and 27.2.0 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/illustrator/aps
CVE ID: CVE-2023-25862 State: PUBLISHED Published: 2023-03-22T00:00:00 Last Updated: 2024-08-02T13:14:07.812Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: Adobe Products: Illustrator Problem Types: CWE-125 Description: Illustrator version 26.5.2 (and earlier) and 27.2.0 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https
t open a malicious file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/illustrator/apsb23-19.html
CVE ID: CVE-2023-25863 State: PUBLISHED Published: 2023-03-27T00:00:00.000Z Last Updated: 2025-03-05T19:21:41.838Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Substance3D - Stager Problem Types: CWE-125 Description: Adobe Substance 3D Stager versions 2.0.0 (and earlier) are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes
ploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/substance3d_stager/apsb23-22.html
CVE ID: CVE-2023-25864 State: PUBLISHED Published: 2023-03-27T00:00:00.000Z Last Updated: 2025-03-05T19:21:34.115Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Substance3D - Stager Problem Types: CWE-122 Description: Adobe Substance 3D Stager versions 2.0.0 (and earlier) are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/substa
Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/substance3d_stager/apsb23-22.html
CVE ID: CVE-2023-25865 State: PUBLISHED Published: 2023-03-27T00:00:00.000Z Last Updated: 2025-03-05T19:21:27.640Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Substance3D - Stager Problem Types: CWE-20 Description: Adobe Substance 3D Stager versions 2.0.0 (and earlier) are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/substan
CVE ID: CVE-2023-25866 State: PUBLISHED Published: 2023-03-27T00:00:00.000Z Last Updated: 2025-03-05T19:21:21.084Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Substance3D - Stager Problem Types: CWE-787 Description: Adobe Substance 3D Stager versions 2.0.0 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/substance3d_
: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/substance3d_stager/apsb23-22.html
CVE ID: CVE-2023-25867 State: PUBLISHED Published: 2023-03-27T00:00:00.000Z Last Updated: 2025-03-05T19:21:13.699Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Substance3D - Stager Problem Types: CWE-20 Description: Adobe Substance 3D Stager versions 2.0.0 (and earlier) are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/substan
CVE ID: CVE-2023-25868 State: PUBLISHED Published: 2023-03-27T00:00:00.000Z Last Updated: 2025-03-05T19:21:06.406Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Substance3D - Stager Problem Types: CWE-122 Description: Adobe Substance 3D Stager versions 2.0.0 (and earlier) are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/substa
CVE ID: CVE-2023-25869 State: PUBLISHED Published: 2023-03-27T00:00:00.000Z Last Updated: 2025-03-05T19:20:57.200Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Substance3D - Stager Problem Types: CWE-125 Description: Adobe Substance 3D Stager versions 2.0.0 (and earlier) are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes
CVE ID: CVE-2023-25870 State: PUBLISHED Published: 2023-03-27T00:00:00.000Z Last Updated: 2025-03-05T19:20:50.271Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Substance3D - Stager Problem Types: CWE-787 Description: Adobe Substance 3D Stager versions 2.0.0 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/substance3d_
CVE ID: CVE-2023-25871 State: PUBLISHED Published: 2023-03-27T00:00:00.000Z Last Updated: 2025-03-05T19:20:43.601Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Substance3D - Stager Problem Types: CWE-416 Description: Adobe Substance 3D Stager versions 2.0.0 (and earlier) are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/substance3d_stager
E Program Container: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/substance3d_stager/apsb23-22.html
CVE ID: CVE-2023-25872 State: PUBLISHED Published: 2023-03-27T00:00:00.000Z Last Updated: 2025-03-05T19:20:36.667Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Substance3D - Stager Problem Types: CWE-122 Description: Adobe Substance 3D Stager versions 2.0.0 (and earlier) are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/substa
CVE ID: CVE-2023-25873 State: PUBLISHED Published: 2023-03-27T00:00:00.000Z Last Updated: 2025-03-05T19:20:30.181Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Substance3D - Stager Problem Types: CWE-125 Description: Adobe Substance 3D Stager versions 2.0.0 (and earlier) are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes
CVE ID: CVE-2023-25874 State: PUBLISHED Published: 2023-03-27T00:00:00.000Z Last Updated: 2025-03-05T19:20:23.661Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Substance3D - Stager Problem Types: CWE-122 Description: Adobe Substance 3D Stager versions 2.0.0 (and earlier) are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/substa
CVE ID: CVE-2023-25875 State: PUBLISHED Published: 2023-03-27T00:00:00.000Z Last Updated: 2025-03-05T19:20:16.276Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: Adobe Products: Substance3D - Stager Problem Types: CWE-125 Description: Adobe Substance 3D Stager versions 2.0.0 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - ht
must open a malicious file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/substance3d_stager/apsb23-22.html