Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-17393 State: PUBLISHED Published: 2020-08-25T20:20:51 Last Updated: 2024-08-04T13:53:16.561Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: Parallels Products: Desktop Problem Types: CWE-20 Description: This vulnerability allows local attackers to disclose information on affected installations of Parallels Desktop 15.1.3-47255. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the prl_hypervisor kext. The issue results from the lack of proper validation of user-supplied data, which can result a pointer to be leaked after the h
ue results from the lack of proper validation of user-supplied data, which can result a pointer to be leaked after the handler is done. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the kernel. Was ZDI-CAN-10520. Additional Analyst Notes: - CVE Program Container: References: - https://kb.parallels.com/en/125013 - https://www.zerodayinitiative.com/advisories/ZDI-20-1011/
CVE ID: CVE-2020-17394 State: PUBLISHED Published: 2020-08-25T20:20:51 Last Updated: 2024-08-04T13:53:16.962Z Severity: MEDIUM (CVSS 6 CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N) Vendors: Parallels Products: Desktop Problem Types: CWE-129 Description: This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 15.1.4. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the OEMNet component. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of a
The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to escalate privileges and execute code in the context of the hypervisor. Was ZDI-CAN-11132. Additional Analyst Notes: - CVE Program Container: References: - https://kb.parallels.com/en/125013 - https://www.zerodayinitiative.com/advisories/ZDI-20-1012/
CVE ID: CVE-2020-17395 State: PUBLISHED Published: 2020-08-25T20:20:52 Last Updated: 2024-08-04T13:53:17.015Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Parallels Products: Desktop Problem Types: CWE-191 Description: This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.4. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the prl_naptd process. The issue results from the lack of proper validation of user-supplied data, which can result in an integer underflow before writin
results from the lack of proper validation of user-supplied data, which can result in an integer underflow before writing to memory. An attacker can leverage this vulnerability to escalate privileges and execute code in the context of the hypervisor. Was ZDI-CAN-11134. Additional Analyst Notes: - CVE Program Container: References: - https://kb.parallels.com/en/125013 - https://www.zerodayinitiative.com/advisories/ZDI-20-1013/
CVE ID: CVE-2020-17396 State: PUBLISHED Published: 2020-08-25T20:20:52 Last Updated: 2024-08-04T13:53:17.056Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Parallels Products: Desktop Problem Types: CWE-190 Description: This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.4. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the prl_hypervisor module. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating
ults from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to escalate privileges and execute code in the context of the kernel. Was ZDI-CAN-11217. Additional Analyst Notes: - CVE Program Container: References: - https://kb.parallels.com/en/125013 - https://www.zerodayinitiative.com/advisories/ZDI-20-1014/
CVE ID: CVE-2020-17397 State: PUBLISHED Published: 2020-08-25T20:20:53 Last Updated: 2024-08-04T13:53:17.327Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Parallels Products: Desktop Problem Types: CWE-119 Description: This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.4. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the handling of network packets. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption cond
The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to escalate privileges and execute code in the context of the hypervisor. Was ZDI-CAN-11253. Additional Analyst Notes: - CVE Program Container: References: - https://kb.parallels.com/en/125013 - https://www.zerodayinitiative.com/advisories/ZDI-20-1015/
CVE ID: CVE-2020-17398 State: PUBLISHED Published: 2020-08-25T20:20:53 Last Updated: 2024-08-04T13:53:16.541Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: Parallels Products: Desktop Problem Types: CWE-129 Description: This vulnerability allows local attackers to disclose information on affected installations of Parallels Desktop 15.1.4. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the prl_hypervisor kext. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated
sults from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the kernel. Was ZDI-CAN-11302. Additional Analyst Notes: - CVE Program Container: References: - https://kb.parallels.com/en/125013 - https://www.zerodayinitiative.com/advisories/ZDI-20-1016/
CVE ID: CVE-2020-17399 State: PUBLISHED Published: 2020-08-25T20:20:54 Last Updated: 2024-08-04T13:53:17.053Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Parallels Products: Desktop Problem Types: CWE-129 Description: This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.4. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the prl_hypervisor kext. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated bu
ts from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to escalate privileges and execute code in the context of the kernel. Was ZDI-CAN-11303. Additional Analyst Notes: - CVE Program Container: References: - https://kb.parallels.com/en/125013 - https://www.zerodayinitiative.com/advisories/ZDI-20-1017/
CVE ID: CVE-2020-17400 State: PUBLISHED Published: 2020-08-25T20:20:54 Last Updated: 2024-08-04T13:53:16.542Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Parallels Products: Desktop Problem Types: CWE-129 Description: This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.4. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the prl_hypervisor kext. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buf
ts from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to escalate privileges and execute code in the context of the hypervisor. Was ZDI-CAN-11304. Additional Analyst Notes: - CVE Program Container: References: - https://kb.parallels.com/en/125013 - https://www.zerodayinitiative.com/advisories/ZDI-20-1018/
CVE ID: CVE-2020-17401 State: PUBLISHED Published: 2020-08-25T20:20:54 Last Updated: 2024-08-04T13:53:17.427Z Severity: MEDIUM (CVSS 6 CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N) Vendors: Parallels Products: Desktop Problem Types: CWE-129 Description: This vulnerability allows local attackers to disclose sensitive informations on affected installations of Parallels Desktop 15.1.4. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the VGA virtual device. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end o
e. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated array. An attacker can leverage this in conjunction with other vulnerabilities to escalate privileges and execute code in the context of the hypervisor. Was ZDI-CAN-11363. Additional Analyst Notes: - CVE Program Container: References: - https://kb.parallels.com/en/125013 - https://www.zerodayinitiative.com/advisories/ZDI-20-1019/
CVE ID: CVE-2020-17402 State: PUBLISHED Published: 2020-08-25T20:20:55 Last Updated: 2024-08-04T13:53:17.371Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: Parallels Products: Desktop Problem Types: CWE-732 Description: This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 15.1.4 (47270). An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the prl_hypervisor kext. By examining a log file, an attacker can disclose a memory address. An attacker can leverage this in conjunction w
kext. By examining a log file, an attacker can disclose a memory address. An attacker can leverage this in conjunction with other vulnerabilities to escalate privileges and execute code in the context of the kernel. Was ZDI-CAN-11063. Additional Analyst Notes: - CVE Program Container: References: - https://kb.parallels.com/en/125013 - https://www.zerodayinitiative.com/advisories/ZDI-20-1020/
CVE ID: CVE-2020-17403 State: PUBLISHED Published: 2020-08-25T20:25:15 Last Updated: 2024-08-04T13:53:16.760Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Foxit Products: Studio Photo Problem Types: CWE-787 Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.922. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of PSD files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an all
sue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-11003. Additional Analyst Notes: - CVE Program Container: References: - https://www.foxitsoftware.com/support/security-bulletins.html - https://www.zerodayinitiative.com/advisories/ZDI-20-1078/
CVE ID: CVE-2020-17404 State: PUBLISHED Published: 2020-08-25T20:25:16 Last Updated: 2024-08-04T13:53:16.964Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Foxit Products: Studio Photo Problem Types: CWE-787 Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.922. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of PSD files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an all
sue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-11191. Additional Analyst Notes: - CVE Program Container: References: - https://www.foxitsoftware.com/support/security-bulletins.html - https://www.zerodayinitiative.com/advisories/ZDI-20-1079/
CVE ID: CVE-2020-17405 State: PUBLISHED Published: 2020-09-01T18:00:16 Last Updated: 2024-08-04T13:53:17.121Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Senstar Products: Symphony Problem Types: CWE-502 Description: This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Senstar Symphony 7.3.2.2. Authentication is not required to exploit this vulnerability. The specific flaw exists within the SSOAuth process. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the
ich can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-10980. Additional Analyst Notes: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-20-1080/
CVE ID: CVE-2020-17406 State: PUBLISHED Published: 2020-10-13T17:10:43 Last Updated: 2024-08-04T13:53:16.722Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Microhard Products: Bullet-LTE Problem Types: CWE-78 Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microhard Bullet-LTE prior to v1.2.0-r1112. Authentication is required to exploit this vulnerability. The specific flaw exists within the handling of the ping parameter provided to tools.sh. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vuln
proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-10595. Additional Analyst Notes: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-20-1205/
CVE ID: CVE-2020-17407 State: PUBLISHED Published: 2020-10-13T17:10:43 Last Updated: 2024-08-04T13:53:17.052Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Microhard Products: Bullet-LTE Problem Types: CWE-121 Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microhard Bullet-LTE prior to v1.2.0-r1112. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of authentication headers. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can
alidation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-10596. Additional Analyst Notes: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-20-1206/
CVE ID: CVE-2020-17408 State: PUBLISHED Published: 2020-09-10T16:35:18 Last Updated: 2024-08-04T13:53:16.975Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: NEC Products: ExpressCluster Problem Types: CWE-611 Description: This vulnerability allows remote attackers to disclose sensitive information on affected installations of NEC ExpressCluster 4.1. Authentication is not required to exploit this vulnerability. The specific flaw exists within the clpwebmc executable. Due to the improper restriction of XML External Entity (XXE) references, a specially-crafted document specifying a URI causes the XML parser to access the URI and embed the contents back into the
pecially-crafted document specifying a URI causes the XML parser to access the URI and embed the contents back into the XML document for further processing. An attacker can leverage this vulnerability to disclose information in the context of SYSTEM. Was ZDI-CAN-10801. Additional Analyst Notes: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-20-1102/ - https://www.support.nec.co.jp/en/View.aspx?id=9510100319
CVE ID: CVE-2020-17409 State: PUBLISHED Published: 2020-10-13T17:10:43 Last Updated: 2024-08-04T13:53:17.042Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: NETGEAR Products: Multiple Routers Problem Types: CWE-288 Description: This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of NETGEAR R6120, R6080, R6260, R6220, R6020, JNR3210, and WNR2020 routers with firmware 1.0.66. Authentication is not required to exploit this vulnerability. The specific flaw exists within the mini_httpd service, which listens on TCP port 80 by default. The issue results from incorrect string matching logic when accessin
d service, which listens on TCP port 80 by default. The issue results from incorrect string matching logic when accessing protected pages. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-10754. Additional Analyst Notes: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-20-1176/ - https://kb.netgear.com/000062304/Security-Advisory-for-Authentication-Bypass-on-Some-Routers-PSV-2020-0258
CVE ID: CVE-2020-17410 State: PUBLISHED Published: 2020-10-13T17:10:44 Last Updated: 2024-08-04T13:53:17.384Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Foxit Products: PhantomPDF Problem Types: CWE-416 Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 10.0.0.35798. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of GIF files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attack
e results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-11135. Additional Analyst Notes: - CVE Program Container: References: - https://www.foxitsoftware.com/support/security-bulletins.php - https://www.zerodayinitiative.com/advisories/ZDI-20-1228/
CVE ID: CVE-2020-17411 State: PUBLISHED Published: 2020-10-13T17:10:45 Last Updated: 2024-08-04T13:53:16.743Z Severity: LOW (CVSS 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: Foxit Products: PhantomPDF Problem Types: CWE-125 Description: This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PhantomPDF 10.0.0.35798. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of U3D objects embedded in PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in
embedded in PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-11190. Additional Analyst Notes: - CVE Program Container: References: - https://www.foxitsoftware.com/support/security-bulletins.php - https://www.zerodayinitiative.com/advisories/ZDI-20-1229/
CVE ID: CVE-2020-17412 State: PUBLISHED Published: 2020-10-13T17:10:46 Last Updated: 2024-08-04T13:53:16.972Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Foxit Products: PhantomPDF Problem Types: CWE-787 Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 10.0.0.35798. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of U3D objects embedded in PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a write
ed in PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-11224. Additional Analyst Notes: - CVE Program Container: References: - https://www.foxitsoftware.com/support/security-bulletins.php - https://www.zerodayinitiative.com/advisories/ZDI-20-1230/
CVE ID: CVE-2020-17413 State: PUBLISHED Published: 2020-10-13T17:10:46 Last Updated: 2024-08-04T13:53:17.458Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Foxit Products: PhantomPDF Problem Types: CWE-121 Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 10.0.0.35798. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of U3D objects embedded in PDF files. The issue results from the lack of proper validation of the length of user-supplied data prior to copyi
ed in PDF files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-11226. Additional Analyst Notes: - CVE Program Container: References: - https://www.foxitsoftware.com/support/security-bulletins.php - https://www.zerodayinitiative.com/advisories/ZDI-20-1235/
CVE ID: CVE-2020-17414 State: PUBLISHED Published: 2020-10-13T17:10:47 Last Updated: 2024-08-04T13:53:17.395Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Foxit Products: Reader Problem Types: CWE-732 Description: This vulnerability allows local attackers to escalate privileges on affected installations of Foxit Reader 10.0.0.35798. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of the configuration files used by the Foxit Reader Update Service. The issue results from incorrect permissions set on a resource used by the service.