deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-42096
Published: 2024-05-03
Description: Foxit PDF Reader PDF File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of PDF files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-21880.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://www.foxit.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-23-1429/; https://www.foxit.com/support/security-bulletins.html
CVE: CVE-2023-42097
Published: 2024-05-03
Description: Foxit PDF Reader Annotation Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the handling of Annotation objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-21902.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://www.foxit.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-23-1430/; https://www.foxit.com/support/security-bulletins.html
CVE: CVE-2023-42098
Published: 2024-05-03
Description: Foxit PDF Reader Annotation Use-After-Free Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the handling of Annotation objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-22037.
CVSS Score: 3.3 (LOW)
CWE: CWE-416
References: https://www.foxit.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-23-1431/; https://www.foxit.com/support/security-bulletins.html
CVE: CVE-2023-42099
Published: 2024-05-03
Description: Intel Driver & Support Assistant Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Intel Driver & Support Assistant. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the DSA Service. By creating a symbolic link, an attacker can abuse the service to delete a file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-21846.
CVSS Score: 7.8 (HIGH)
CWE: CWE-59
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1449/; https://www.zerodayinitiative.com/advisories/ZDI-23-1449/
CVE: CVE-2023-42100
Published: 2024-05-03
Description: Kofax Power PDF PDF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Kofax Power PDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process.
. Was ZDI-CAN-21604.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1455/; https://www.zerodayinitiative.com/advisories/ZDI-23-1455/
CVE: CVE-2023-42101
Published: 2024-05-03
Description: Ashlar-Vellum Cobalt AR File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of AR files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.
. Was ZDI-CAN-20418.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1450/; https://www.zerodayinitiative.com/advisories/ZDI-23-1450/
CVE: CVE-2023-42102
Published: 2024-05-03
Description: Ashlar-Vellum Cobalt AR File Parsing Type Confusion Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of AR files. The issue results from the lack of proper validation of user-supplied data, which can result in a type confusion condition. An attacker can leverage this vulnerability to execute code in the context of the current process.
. Was ZDI-CAN-20409.
CVSS Score: 7.8 (HIGH)
CWE: CWE-843
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1451/; https://www.zerodayinitiative.com/advisories/ZDI-23-1451/
CVE: CVE-2023-42103
Published: 2024-05-03
Description: Ashlar-Vellum Cobalt AR File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of AR files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process.
. Was ZDI-CAN-20660.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1452/; https://www.zerodayinitiative.com/advisories/ZDI-23-1452/
CVE: CVE-2023-42104
Published: 2024-05-03
Description: Ashlar-Vellum Cobalt AR File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of AR files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process.
. Was ZDI-CAN-20630.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1453/; https://www.zerodayinitiative.com/advisories/ZDI-23-1453/
CVE: CVE-2023-42105
Published: 2024-05-03
Description: Ashlar-Vellum Cobalt AR File Parsing Type Confusion Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of AR files. The issue results from the lack of proper validation of user-supplied data, which can result in a type confusion condition. An attacker can leverage this vulnerability to execute code in the context of the current process.
. Was ZDI-CAN-20562.
CVSS Score: 7.8 (HIGH)
CWE: CWE-843
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1454/; https://www.zerodayinitiative.com/advisories/ZDI-23-1454/
CVE: CVE-2023-42106
Published: 2024-05-03
Description: PDF-XChange Editor EMF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of EMF files.
The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-22133.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://www.tracker-software.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-23-1486/; https://www.tracker-software.com/support/security-bulletins.html
CVE: CVE-2023-42107
Published: 2024-05-03
Description: PDF-XChange Editor EMF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of EMF files.
The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-22134.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://www.tracker-software.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-23-1487/; https://www.tracker-software.com/support/security-bulletins.html
CVE: CVE-2023-42108
Published: 2024-05-03
Description: PDF-XChange Editor EMF File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of EMF files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22135.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://www.tracker-software.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-23-1483/; https://www.tracker-software.com/support/security-bulletins.html
CVE: CVE-2023-42109
Published: 2024-05-03
Description: PDF-XChange Editor EMF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of EMF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-22136.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://www.tracker-software.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-23-1484/; https://www.tracker-software.com/support/security-bulletins.html
CVE: CVE-2023-42110
Published: 2024-05-03
Description: PDF-XChange Editor EMF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of EMF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-22137.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://www.tracker-software.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-23-1482/; https://www.tracker-software.com/support/security-bulletins.html
CVE: CVE-2023-42111
Published: 2024-05-03
Description: PDF-XChange Editor JPG File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of JPG files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22138.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-125
References: https://www.tracker-software.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-23-1481/; https://www.tracker-software.com/support/security-bulletins.html
CVE: CVE-2023-42112
Published: 2024-05-03
Description: PDF-XChange Editor EMF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of EMF files.
The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-22146.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://www.tracker-software.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-23-1485/; https://www.tracker-software.com/support/security-bulletins.html
CVE: CVE-2023-42113
Published: 2024-05-03
Description: PDF-XChange Editor EMF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of EMF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-22147.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://www.tracker-software.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-23-1480/; https://www.tracker-software.com/support/security-bulletins.html
CVE: CVE-2023-42114
Published: 2024-05-03
Description: Exim NTLM Challenge Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Exim. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the handling of NTLM challenge requests. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated data structure. An attacker can leverage this vulnerability to disclose information in the context of the service account.
. Was ZDI-CAN-17433.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-125
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1468/; https://lists.debian.org/debian-lts-announce/2023/10/msg00002.html; https://www.zerodayinitiative.com/advisories/ZDI-23-1468/
CVE: CVE-2023-42115
Published: 2024-05-03
Description: Exim AUTH Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Exim. Authentication is not required to exploit this vulnerability. 

The specific flaw exists within the smtp service, which listens on TCP port 25 by default. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of a buffer. An attacker can leverage this vulnerability to execute code in the context of the service account.
. Was ZDI-CAN-17434.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1469/; https://www.zerodayinitiative.com/advisories/ZDI-23-1469/
CVE: CVE-2023-42116
Published: 2024-05-03
Description: Exim SMTP Challenge Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Exim. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the handling of NTLM challenge requests. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the service account.
. Was ZDI-CAN-17515.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-121
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1470/; https://lists.debian.org/debian-lts-announce/2023/10/msg00002.html; https://www.zerodayinitiative.com/advisories/ZDI-23-1470/
CVE: CVE-2023-42117
Published: 2024-05-03
Description: Exim Improper Neutralization of Special Elements Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Exim. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the smtp service, which listens on TCP port 25 by default. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17554.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-138
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1471/; https://lists.debian.org/debian-lts-announce/2024/10/msg00029.html; https://www.zerodayinitiative.com/advisories/ZDI-23-1471/
CVE: CVE-2023-42118
Published: 2024-05-03
Description: Exim libspf2 Integer Underflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Exim libspf2. Authentication is not required to exploit this vulnerability. 

The specific flaw exists within the parsing of SPF macros. When parsing SPF macros, the process does not properly validate user-supplied data, which can result in an integer underflow before writing to memory. An attacker can leverage this vulnerability to execute code in the context of the service account.
. Was ZDI-CAN-17578.
CVSS Score: 8.8 (HIGH)
CWE: CWE-191
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1472/; http://www.openwall.com/lists/oss-security/2025/03/28/1; https://www.zerodayinitiative.com/advisories/ZDI-23-1472/
CVE: CVE-2023-42119
Published: 2024-05-03
Description: Exim dnsdb Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of Exim. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the smtp service, which listens on TCP port 25 by default. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the service account.
. Was ZDI-CAN-17643.
CVSS Score: 3.1 (LOW)
CWE: CWE-125
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1473/; https://lists.debian.org/debian-lts-announce/2024/10/msg00029.html; https://www.zerodayinitiative.com/advisories/ZDI-23-1473/
CVE: CVE-2023-42120
Published: 2024-05-03
Description: Control Web Panel dns_zone_editor Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Control Web Panel. Authentication is required to exploit this vulnerability.

The specific flaw exists within the dns_zone_editor module. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-20581.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1477/; https://www.zerodayinitiative.com/advisories/ZDI-23-1477/
CVE: CVE-2023-42121
Published: 2024-05-03
Description: Control Web Panel Missing Authentication Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Control Web Panel. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the implementation of authentication within the web interface. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to execute code in the context of a valid CWP user. Was ZDI-CAN-20582.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1478/; https://www.zerodayinitiative.com/advisories/ZDI-23-1478/