Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-27310 State: PUBLISHED Published: 2024-05-27T17:26:14.229Z Last Updated: 2024-10-07T19:44:05.359Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: ManageEngine Products: ADSelfService Plus Problem Types: CWE-90 Description: Zoho ManageEngine ADSelfService Plus versions below 6401 are vulnerable to the DOS attack due to the malicious LDAP input. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.manageengine.com/products/self-service-password/advisory/CVE-2024-27310.html
CVE ID: CVE-2024-27311 State: PUBLISHED Published: 2024-07-17T10:52:45.823Z Last Updated: 2024-08-02T00:28:00.298Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L) Vendors: ManageEngine Products: DDI Central Problem Types: CWE-434 Description: Zohocorp ManageEngine DDI Central versions 4001 and prior were vulnerable to directory traversal vulnerability which allows the user to upload new files to the server folder. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.manageengine.com/dns-dhcp-ipam/security-updates/cve-2024-27311.html
CVE ID: CVE-2024-27312 State: PUBLISHED Published: 2024-05-20T12:38:26.180Z Last Updated: 2024-10-07T11:45:01.627Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: ManageEngine Products: PAM360 Problem Types: CWE-863 Description: Zohocorp ManageEngine PAM360 version 6601 is vulnerable to authorization vulnerability which allows a low-privileged user to perform admin actions. Note: This vulnerability affects only the PAM360 6600 version. No other versions are applicable to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.manageengine.com/privileged-access-management/advisory/cve-2024-27312.
CVE Program Container: References: - https://www.manageengine.com/privileged-access-management/advisory/cve-2024-27312.html
CVE ID: CVE-2024-27313 State: PUBLISHED Published: 2024-05-29T11:01:21.278Z Last Updated: 2024-08-02T00:27:59.908Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N) Vendors: ManageEngine Products: PAM360 Problem Types: CWE-79 Description: Zoho ManageEngine PAM360 is vulnerable to Stored XSS vulnerability. This vulnerability is applicable only in the version 6610. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.manageengine.com/privileged-access-management/advisory/cve-2024-27313.html
CVE ID: CVE-2024-27314 State: PUBLISHED Published: 2024-05-27T07:03:13.441Z Last Updated: 2024-08-02T00:27:59.873Z Severity: LOW (CVSS 2.4 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N) Vendors: ManageEngine Products: ServiceDesk Plus, ServiceDesk Plus MSP, SupportCenter Plus Problem Types: CWE-79 Description: Zoho ManageEngine ServiceDesk Plus versions below 14730, ServiceDesk Plus MSP below 14720 and SupportCenter Plus below 14720 are vulnerable to stored XSS in the Custom Actions menu on the request details. This vulnerability can be exploited only by the SDAdmin role users. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.manageengine.c
rs. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.manageengine.com/products/service-desk/cve-2024-27314.html
CVE ID: CVE-2024-27315 State: PUBLISHED Published: 2024-02-28T10:06:48.685Z Last Updated: 2024-10-03T12:30:59.889Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Apache Software Foundation Products: Apache Superset Problem Types: CWE-209 Description: An authenticated user with privileges to create Alerts on Alerts & Reports has the capability to generate a specially crafted SQL statement that triggers an error on the database. This error is not properly handled by Apache Superset and may inadvertently surface in the error log of the Alert exposing possibly sensitive data. This issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1. Users are r
exposing possibly sensitive data. This issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1. Users are recommended to upgrade to version 3.1.1 or 3.0.4, which fixes the issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/qcwbx7q2s3ynsd405895bx3wcwq32j7z
CVE ID: CVE-2024-27316 State: PUBLISHED Published: 2024-04-04T19:21:41.984Z Last Updated: 2025-11-04T22:06:02.830Z Vendors: Apache Software Foundation Products: Apache HTTP Server Problem Types: CWE-770 Description: HTTP/2 incoming headers exceeding the limit are temporarily buffered in nghttp2 in order to generate an informative HTTP 413 response. If a client does not stop sending headers, this leads to memory exhaustion. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://httpd.apache.org/security/vulnerabilities_24.html - https://www.openwall.com/lists/oss-security/2024/04/03/16 - http://www.openwall.com/lists/oss-security/2024/04/04/4 - https
ps://www.openwall.com/lists/oss-security/2024/04/03/16 - http://www.openwall.com/lists/oss-security/2024/04/04/4 - https://support.apple.com/kb/HT214119 - http://seclists.org/fulldisclosure/2024/Jul/18
CVE ID: CVE-2024-27317 State: PUBLISHED Published: 2024-03-12T18:18:52.650Z Last Updated: 2025-02-13T17:46:25.167Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L) Vendors: Apache Software Foundation Products: Apache Pulsar Problem Types: CWE-22 Description: In Pulsar Functions Worker, authenticated users can upload functions in jar or nar files. These files, essentially zip files, are extracted by the Functions Worker. However, if a malicious file is uploaded, it could exploit a directory traversal vulnerability. This occurs when the filenames in the zip files, which aren't properly validated, contain special elements like "..", altering the directory path. This could
zip files, which aren't properly validated, contain special elements like "..", altering the directory path. This could allow an attacker to create or modify files outside of the designated extraction directory, potentially influencing system behavior. This vulnerability also applies to the Pulsar Broker when it is configured with "functionsWorkerEnabled=true". This issue affects Apache Pulsar versions from 2.4.0 to 2.10.5, from 2.11.0 to 2.11.3, from 3.0.0 to 3.0.2, from 3.1.0 to 3.1.2, and 3.2.0. 2.10 Pulsar Function Worker users should upgrade to at least 2.10.6. 2.11 Pulsar Function Worker users should upgrade to at least 2.11.4. 3.0 Pulsar Function Worker users should upgrade to at leas
lsar Function Worker users should upgrade to at least 2.11.4. 3.0 Pulsar Function Worker users should upgrade to at least 3.0.3. 3.1 Pulsar Function Worker users should upgrade to at least 3.1.3. 3.2 Pulsar Function Worker users should upgrade to at least 3.2.1. Users operating versions prior to those listed above should upgrade to the aforementioned patched versions or newer versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/ct9xmvlf7lompc1pxvlsb60qstfsm9po - https://pulsar.apache.org/security/CVE-2024-27317/ - http://www.openwall.com/lists/oss-security/2024/03/12/10
CVE ID: CVE-2024-27318 State: PUBLISHED Published: 2024-02-23T17:37:36.715Z Last Updated: 2025-02-13T17:46:25.734Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: onnx Products: onnx Problem Types: CWE-22 Description: Versions of the package onnx before and including 1.15.0 are vulnerable to Directory Traversal as the external_data field of the tensor proto can have a path to the file which is outside the model current directory or user-provided directory. The vulnerability occurs as a bypass for the patch added for CVE-2022-25882. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/onnx/onnx/commit/66b7
Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/onnx/onnx/commit/66b7fb630903fdcf3e83b6b6d56d82e904264a20 - https://security.snyk.io/vuln/SNYK-PYTHON-ONNX-2395479 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFJJID2IZDOLFDMWVYTBDI75ZJQC6JOL/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FGTBH5ZYL2LGYHIJDHN2MAUURIR5E7PY/
CVE ID: CVE-2024-27319 State: PUBLISHED Published: 2024-02-23T17:39:52.870Z Last Updated: 2025-02-13T17:46:26.308Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L) Vendors: onnx Products: onnx Problem Types: CWE-125 Description: Versions of the package onnx before and including 1.15.0 are vulnerable to Out-of-bounds Read as the ONNX_ASSERT and ONNX_ASSERTM functions have an off by one string copy. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/onnx/onnx/commit/08a399ba75a805b7813ab8936b91d0e274b08287 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFJJID2IZDO
0e274b08287 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFJJID2IZDOLFDMWVYTBDI75ZJQC6JOL/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FGTBH5ZYL2LGYHIJDHN2MAUURIR5E7PY/
CVE ID: CVE-2024-27320 State: PUBLISHED Published: 2024-09-12T12:49:43.930Z Last Updated: 2024-09-12T14:48:46.488Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Refuel Products: autolabel Problem Types: CWE-95 Description: An arbitrary code execution vulnerability exists in versions 0.0.8 and newer of the Refuel Autolabel library because of the way its classification tasks handle provided CSV files. If a victim user creates a classification task using a maliciously crafted CSV file containing Python code, the code will be passed to an eval function which executes it. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://hiddenlayer.com/sai
function which executes it. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://hiddenlayer.com/sai-security-advisory/2024-09-autolabel/
CVE ID: CVE-2024-27321 State: PUBLISHED Published: 2024-09-12T12:50:47.730Z Last Updated: 2024-09-12T14:47:11.915Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Refuel Products: autolabel Problem Types: CWE-95 Description: An arbitrary code execution vulnerability exists in versions 0.0.8 and newer of the Refuel Autolabel library because of the way its multilabel classification tasks handle provided CSV files. If a user creates a multilabel classification task using a maliciously crafted CSV file containing Python code, the code will be passed to an eval function which executes it. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://hidd
sed to an eval function which executes it. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://hiddenlayer.com/sai-security-advisory/2024-09-autolabel/
CVE ID: CVE-2024-27322 State: PUBLISHED Published: 2024-04-29T13:02:37.062Z Last Updated: 2025-02-13T17:46:26.987Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: The R Project Products: R Problem Types: CWE-502 Description: Deserialization of untrusted data can occur in the R statistical programming language, on any version starting at 1.4.0 up to and not including 4.4.0, enabling a maliciously crafted RDS (R Data Serialization) formatted file or R package to run arbitrary code on an end user’s system when interacted with. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://hiddenlayer.com/research/r-bitrary-code-
Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://hiddenlayer.com/research/r-bitrary-code-execution/ - https://https://kb.cert.org/vuls/id/238194 - https://www.kb.cert.org/vuls/id/238194 - http://www.openwall.com/lists/oss-security/2024/04/29/3 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JVE5FDLFJGTAMOSJ6DREFAODEUBRFWSG/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7ZLV4OWXZIJ7EFBIWUZADUSHYJTFAQ4D/
CVE ID: CVE-2024-27323 State: PUBLISHED Published: 2024-04-01T21:48:49.889Z Last Updated: 2024-08-02T00:34:51.004Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: PDF-XChange Products: PDF-XChange Editor Problem Types: CWE-295 Description: PDF-XChange Editor Updater Improper Certificate Validation Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is not required to exploit this vulnerability. The specific flaw exists within the update functionality. The issue results from the lack of proper validation of the certificate presented
ists within the update functionality. The issue results from the lack of proper validation of the certificate presented by the server. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-22224. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-198/
CVE ID: CVE-2024-27324 State: PUBLISHED Published: 2024-04-01T21:49:02.786Z Last Updated: 2024-08-02T00:34:50.997Z Severity: LOW (CVSS 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: PDF-XChange Products: PDF-XChange Editor Problem Types: CWE-125 Description: PDF-XChange Editor TIF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of TIF files. The issue results fr
malicious page or open a malicious file. The specific flaw exists within the parsing of TIF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-22270. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-196/
CVE ID: CVE-2024-27325 State: PUBLISHED Published: 2024-04-01T21:49:14.636Z Last Updated: 2024-08-02T00:34:51.003Z Severity: LOW (CVSS 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: PDF-XChange Products: PDF-XChange Editor Problem Types: CWE-125 Description: PDF-XChange Editor EMF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of EMF files. The issue results fr
malicious page or open a malicious file. The specific flaw exists within the parsing of EMF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-22275. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-203/
CVE ID: CVE-2024-27326 State: PUBLISHED Published: 2024-04-01T21:49:28.789Z Last Updated: 2024-08-02T00:34:51.382Z Severity: LOW (CVSS 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: PDF-XChange Products: PDF-XChange Editor Problem Types: CWE-125 Description: PDF-XChange Editor XPS File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of XPS files. The issue results fr
malicious page or open a malicious file. The specific flaw exists within the parsing of XPS files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-22276. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-204/
CVE ID: CVE-2024-27327 State: PUBLISHED Published: 2024-04-01T21:50:07.123Z Last Updated: 2024-08-02T00:34:51.416Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: PDF-XChange Products: PDF-XChange Editor Problem Types: CWE-787 Description: PDF-XChange Editor PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. The issue results from the
ous page or open a malicious file. The specific flaw exists within the parsing of PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22277. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-205/
CVE ID: CVE-2024-27328 State: PUBLISHED Published: 2024-04-01T21:50:17.719Z Last Updated: 2024-08-02T00:34:51.335Z Severity: LOW (CVSS 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: PDF-XChange Products: PDF-XChange Editor Problem Types: CWE-125 Description: PDF-XChange Editor EMF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of EMF files. The issue results f
malicious page or open a malicious file. The specific flaw exists within the handling of EMF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-22280. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-202/
CVE ID: CVE-2024-27329 State: PUBLISHED Published: 2024-04-01T21:50:29.908Z Last Updated: 2025-03-12T16:42:25.359Z Severity: LOW (CVSS 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: PDF-XChange Products: PDF-XChange Editor Problem Types: CWE-125 Description: PDF-XChange Editor XPS File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of XPS files. The issue results fr
malicious page or open a malicious file. The specific flaw exists within the parsing of XPS files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-22285. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-200/
CVE ID: CVE-2024-27330 State: PUBLISHED Published: 2024-04-01T21:50:56.687Z Last Updated: 2024-08-02T00:34:51.378Z Severity: LOW (CVSS 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: PDF-XChange Products: PDF-XChange Editor Problem Types: CWE-125 Description: PDF-XChange Editor EMF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of EMF files. The issue results fr
malicious page or open a malicious file. The specific flaw exists within the parsing of EMF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-22286. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-199/
CVE ID: CVE-2024-27331 State: PUBLISHED Published: 2024-04-01T21:51:10.605Z Last Updated: 2024-09-03T18:00:37.375Z Severity: LOW (CVSS 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: PDF-XChange Products: PDF-XChange Editor Problem Types: CWE-125 Description: PDF-XChange Editor EMF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of EMF files. The issue results fr
malicious page or open a malicious file. The specific flaw exists within the parsing of EMF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-22287. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-201/
CVE ID: CVE-2024-27332 State: PUBLISHED Published: 2024-04-01T21:51:21.781Z Last Updated: 2024-08-21T22:34:34.763Z Severity: LOW (CVSS 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: PDF-XChange Products: PDF-XChange Editor Problem Types: CWE-125 Description: PDF-XChange Editor JPG File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JPG files. The issue results fr