deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-24058
Published: 2022-02-18
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Sante DICOM Viewer Pro 11.8.7.0. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of J2K files. Crafted data in a J2K file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15095.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.zerodayinitiative.com/advisories/ZDI-22-250/; https://www.zerodayinitiative.com/advisories/ZDI-22-250/
CVE: CVE-2022-24059
Published: 2022-02-18
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Sante DICOM Viewer Pro 11.8.7.0. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DCM files. Crafted data in a DCM file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process Was ZDI-CAN-15098.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.zerodayinitiative.com/advisories/ZDI-22-251/; https://www.zerodayinitiative.com/advisories/ZDI-22-251/
CVE: CVE-2022-24060
Published: 2022-02-18
Description: This vulnerability allows remote attackers to disclose sensitive information on affected installations of Sante DICOM Viewer Pro 11.8.7.0. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DCM files. Crafted data in a DCM file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-15099.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://www.zerodayinitiative.com/advisories/ZDI-22-252/; https://www.zerodayinitiative.com/advisories/ZDI-22-252/
CVE: CVE-2022-24061
Published: 2022-02-18
Description: This vulnerability allows remote attackers to disclose sensitive information on affected installations of Sante DICOM Viewer Pro 11.8.7.0. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DCM files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-15100.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416
References: https://www.zerodayinitiative.com/advisories/ZDI-22-253/; https://www.zerodayinitiative.com/advisories/ZDI-22-253/
CVE: CVE-2022-24062
Published: 2022-02-18
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Sante DICOM Viewer Pro 13.2.0.21165. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JP2 files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15104.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://www.zerodayinitiative.com/advisories/ZDI-22-254/; https://www.zerodayinitiative.com/advisories/ZDI-22-254/
CVE: CVE-2022-24063
Published: 2022-02-18
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Sante DICOM Viewer Pro 13.2.0.21165. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JP2 files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15105.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-787
References: https://www.zerodayinitiative.com/advisories/ZDI-22-255/; https://www.zerodayinitiative.com/advisories/ZDI-22-255/
CVE: CVE-2022-24064
Published: 2022-02-18
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Sante DICOM Viewer Pro 11.8.8.0. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of J2K images. Crafted data in a J2K file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15161.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.zerodayinitiative.com/advisories/ZDI-22-256/; https://www.zerodayinitiative.com/advisories/ZDI-22-256/
CVE: CVE-2022-24354
Published: 2022-02-18
Description: This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link AC1750 prior to 1.1.4 Build 20211022 rel.59103(5553) routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the NetUSB.ko module. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-15835.
CVSS Score: 8.8 (HIGH)
CWE: CWE-190
References: https://www.zerodayinitiative.com/advisories/ZDI-22-264/; https://www.zerodayinitiative.com/advisories/ZDI-22-264/
CVE: CVE-2022-24355
Published: 2022-02-18
Description: This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link TL-WR940N 3.20.1 Build 200316 Rel.34392n (5553) routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the parsing of file name extensions. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-13910.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://www.zerodayinitiative.com/advisories/ZDI-22-265/; https://www.zerodayinitiative.com/advisories/ZDI-22-265/
CVE: CVE-2022-24356
Published: 2022-02-18
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader Foxit reader 11.0.1.0719 macOS. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the OnMouseExit method. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-14848.
CVSS Score: 8.8 (HIGH)
CWE: CWE-125
References: https://www.foxit.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-22-267/; https://www.foxit.com/support/security-bulletins.html
CVE: CVE-2022-24357
Published: 2022-02-18
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.1.0.52543. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of Annotation objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15743.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://www.foxit.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-22-268/; https://www.foxit.com/support/security-bulletins.html
CVE: CVE-2022-24358
Published: 2022-02-18
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.1.0.52543. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of Doc objects. By performing actions in JavaScript, an attacker can trigger a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15703.
CVSS Score: 8.8 (HIGH)
CWE: CWE-125
References: https://www.foxit.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-22-269/; https://www.foxit.com/support/security-bulletins.html
CVE: CVE-2022-24359
Published: 2022-02-18
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.1.0.52543. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of Doc objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15702.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://www.foxit.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-22-270/; https://www.foxit.com/support/security-bulletins.html
CVE: CVE-2022-24360
Published: 2022-02-18
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.1.0.52543. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of Doc objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15744.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://www.foxit.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-22-271/; https://www.foxit.com/support/security-bulletins.html
CVE: CVE-2022-24361
Published: 2022-02-18
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.1.0.52543. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JPEG2000 images. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15811.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://www.foxit.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-22-272/; https://www.foxit.com/support/security-bulletins.html
CVE: CVE-2022-24362
Published: 2022-02-18
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.1.0.52543. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of AcroForms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15987.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://www.foxit.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-22-273/; https://www.foxit.com/support/security-bulletins.html
CVE: CVE-2022-24363
Published: 2022-02-18
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.1.0.52543. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of Annotation objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15861.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://www.foxit.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-22-274/; https://www.foxit.com/support/security-bulletins.html
CVE: CVE-2022-24364
Published: 2022-02-18
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.1.0.52543. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of Doc objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15851.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://www.foxit.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-22-275/; https://www.foxit.com/support/security-bulletins.html
CVE: CVE-2022-24365
Published: 2022-02-18
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.1.0.52543. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of AcroForms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15852.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://www.foxit.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-22-276/; https://www.foxit.com/support/security-bulletins.html
CVE: CVE-2022-24366
Published: 2022-02-18
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.1.0.52543. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of AcroForms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15853.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://www.foxit.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-22-277/; https://www.foxit.com/support/security-bulletins.html
CVE: CVE-2022-24367
Published: 2022-02-18
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.1.0.52543. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of AcroForms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15877.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://www.foxit.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-22-278/; https://www.foxit.com/support/security-bulletins.html
CVE: CVE-2022-24368
Published: 2022-02-18
Description: This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader 11.1.0.52543. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of Doc objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-16115.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-416
References: https://www.foxit.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-22-279/; https://www.foxit.com/support/security-bulletins.html
CVE: CVE-2022-24369
Published: 2022-02-18
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.1.0.52543. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JP2 images. Crafted data in a JP2 image can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-16087.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://www.foxit.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-22-280/; https://www.foxit.com/support/security-bulletins.html
CVE: CVE-2022-24370
Published: 2022-02-18
Description: This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader Foxit reader 11.0.1.0719 macOS. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of XFA forms. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-14819.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://www.foxit.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-22-266/; https://www.foxit.com/support/security-bulletins.html
CVE: CVE-2022-24971
Published: 2022-02-18
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.1.0.52543. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JPEG2000 images. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15812.
CVSS Score: 8.8 (HIGH)
CWE: CWE-125, CWE-125
References: https://www.foxit.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-22-319/; https://www.foxit.com/support/security-bulletins.html
CVE: CVE-2021-40840
Published: 2022-02-18
Description: A Stored XSS issue exists in the admin/users user administration form in LiveConfig 2.12.2.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.liveconfig.com/en/changelog/; https://www.mgm-sp.com/en/liveconfig-2-12-2-vulnerabilities/; https://www.liveconfig.com/en/changelog/
CVE: CVE-2021-40841
Published: 2022-02-18
Description: A Path Traversal vulnerability for a log file in LiveConfig 2.12.2 allows authenticated attackers to read files on the underlying server.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://www.liveconfig.com/en/changelog/; https://www.mgm-sp.com/en/liveconfig-2-12-2-vulnerabilities/; https://www.liveconfig.com/en/changelog/
CVE: CVE-2021-46110
Published: 2022-02-18
Description: Online Shopping Portal v3.1 was discovered to contain multiple time-based SQL injection vulnerabilities via the email and contactno parameters.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://giant-falcon-36d.notion.site/Online-Shopping-Portal-2924d0ad55e94c4cb2359b0d098c4db6; https://giant-falcon-36d.notion.site/Online-Shopping-Portal-2924d0ad55e94c4cb2359b0d098c4db6
CVE: CVE-2022-23645
Published: 2022-02-18
Description: swtpm is a libtpms-based TPM emulator with socket, character device, and Linux CUSE interface. Versions prior to 0.5.3, 0.6.2, and 0.7.1 are vulnerable to out-of-bounds read. A specially crafted header of swtpm's state, where the blobheader's hdrsize indicator has an invalid value, may cause an out-of-bounds access when the byte array representing the state of the TPM is accessed. This will likely crash swtpm or prevent it from starting since the state cannot be understood. Users should upgrade to swtpm v0.5.3, v0.6.2, or v0.7.1 to receive a patch. There are currently no known workarounds.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-125
References: https://github.com/stefanberger/swtpm/commit/9f740868fc36761de27df3935513bdebf8852d19; https://github.com/stefanberger/swtpm/releases/tag/v0.5.3; https://github.com/stefanberger/swtpm/releases/tag/v0.6.2
CVE: CVE-2021-29655
Published: 2022-02-18
Description: Pexip Infinity Connect before 1.8.0 omits certain provisioning authenticity checks. Thus, untrusted code may execute.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-345
References: https://docs.pexip.com/admin/security_bulletins.htm; https://docs.pexip.com/admin/security_bulletins.htm
CVE: CVE-2021-29656
Published: 2022-02-18
Description: Pexip Infinity Connect before 1.8.0 mishandles TLS certificate validation. The allow list is not properly checked.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-295
References: https://docs.pexip.com/admin/security_bulletins.htm; https://docs.pexip.com/admin/security_bulletins.htm
CVE: CVE-2022-23228
Published: 2022-02-18
Description: Pexip Infinity before 27.0 has improper WebRTC input validation. An unauthenticated remote attacker can use excessive resources, temporarily causing denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://docs.pexip.com/admin/security_bulletins.htm; https://docs.pexip.com/admin/security_bulletins.htm