deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-36979
Published: 2023-03-29
Description: This vulnerability allows remote attackers to bypass authentication on affected installations of Ivanti Avalanche 6.3.2.3490. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the AvalancheDaoSupport class. A crafted request can trigger execution of SQL queries composed from a user-supplied string. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-15493.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://download.wavelink.com/Files/avalanche_v6.3.4_release_notes.txt; https://www.zerodayinitiative.com/advisories/ZDI-22-784/; https://download.wavelink.com/Files/avalanche_v6.3.4_release_notes.txt
CVE: CVE-2022-36980
Published: 2023-03-29
Description: This vulnerability allows remote attackers to bypass authentication on affected installations of Ivanti Avalanche 6.3.2.3490. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the EnterpriseServer service. The issue results from the lack of proper locking when performing operations during authentication. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-15528.
CVSS Score: 8.1 (HIGH)
CWE: CWE-367, CWE-367
References: https://download.wavelink.com/Files/avalanche_v6.3.4_release_notes.txt; https://www.zerodayinitiative.com/advisories/ZDI-22-785/; https://download.wavelink.com/Files/avalanche_v6.3.4_release_notes.txt
CVE: CVE-2022-36981
Published: 2023-03-29
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Avalanche 6.3.3.101. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the DeviceLogResource class. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-15966.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://download.wavelink.com/Files/avalanche_v6.3.4_release_notes.txt; https://www.zerodayinitiative.com/advisories/ZDI-22-786/; https://download.wavelink.com/Files/avalanche_v6.3.4_release_notes.txt
CVE: CVE-2022-36982
Published: 2023-03-29
Description: This vulnerability allows remote attackers to read arbitrary files on affected installations of Ivanti Avalanche 6.3.3.101. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the AgentTaskHandler class. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose stored session cookies, leading to further compromise. Was ZDI-CAN-15967.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://download.wavelink.com/Files/avalanche_v6.3.4_release_notes.txt; https://www.zerodayinitiative.com/advisories/ZDI-22-787/; https://download.wavelink.com/Files/avalanche_v6.3.4_release_notes.txt
CVE: CVE-2022-36983
Published: 2023-03-29
Description: This vulnerability allows remote attackers to bypass authentication on affected installations of Ivanti Avalanche. Authentication is not required to exploit this vulnerability. The specific flaw exists within the SetSettings class. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-15919.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306, CWE-306
References: https://download.wavelink.com/Files/avalanche_v6.3.4_release_notes.txt; https://www.zerodayinitiative.com/advisories/ZDI-22-788/; https://download.wavelink.com/Files/avalanche_v6.3.4_release_notes.txt
CVE: CVE-2022-37012
Published: 2023-03-29
Description: This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Unified Automation OPC UA C++ Demo Server 1.7.6-537. Authentication is not required to exploit this vulnerability. The specific flaw exists within the OpcUa_SecureListener_ProcessSessionCallRequest method. A crafted OPC UA message can force the server to incorrectly update a reference count. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-16927.
CVSS Score: 7.5 (HIGH)
CWE: CWE-911
References: https://documentation.unified-automation.com/uasdkcpp/1.7.7/CHANGELOG.txt; https://www.zerodayinitiative.com/advisories/ZDI-22-1030/; https://documentation.unified-automation.com/uasdkcpp/1.7.7/CHANGELOG.txt
CVE: CVE-2022-37013
Published: 2023-03-29
Description: This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Unified Automation OPC UA C++ Demo Server 1.7.6-537 [with vendor rollup]. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of certificates. A crafted certificate can force the server into an infinite loop. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-17203.
CVSS Score: 7.5 (HIGH)
CWE: CWE-835
References: https://documentation.unified-automation.com/uasdkcpp/1.7.7/CHANGELOG.txt; https://www.zerodayinitiative.com/advisories/ZDI-22-1029/; https://documentation.unified-automation.com/uasdkcpp/1.7.7/CHANGELOG.txt
CVE: CVE-2022-37349
Published: 2023-03-29
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the submitForm method. By performing actions in JavaScript, an attacker can trigger a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17142.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://www.tracker-software.com/product/pdf-xchange-editor/history; https://www.zerodayinitiative.com/advisories/ZDI-22-1076/; https://www.tracker-software.com/product/pdf-xchange-editor/history
CVE: CVE-2022-37350
Published: 2023-03-29
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of Collab objects. By performing actions in JavaScript, an attacker can trigger a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17144.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://www.tracker-software.com/product/pdf-xchange-editor/history; https://www.zerodayinitiative.com/advisories/ZDI-22-1078/; https://www.tracker-software.com/product/pdf-xchange-editor/history
CVE: CVE-2022-37351
Published: 2023-03-29
Description: This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of J2K files. Crafted data in a J2K file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-17636.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://www.tracker-software.com/product/pdf-xchange-editor/history; https://www.zerodayinitiative.com/advisories/ZDI-22-1079/; https://www.tracker-software.com/product/pdf-xchange-editor/history
CVE: CVE-2022-37352
Published: 2023-03-29
Description: This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of WMF files. Crafted data in a WMF file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-17638.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://www.tracker-software.com/product/pdf-xchange-editor/history; https://www.zerodayinitiative.com/advisories/ZDI-22-1080/; https://www.tracker-software.com/product/pdf-xchange-editor/history
CVE: CVE-2022-37353
Published: 2023-03-29
Description: This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of EMF files. Crafted data in an EMF file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-17637.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://www.tracker-software.com/product/pdf-xchange-editor/history; https://www.zerodayinitiative.com/advisories/ZDI-22-1081/; https://www.tracker-software.com/product/pdf-xchange-editor/history
CVE: CVE-2022-37354
Published: 2023-03-29
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of J2K files. Crafted data in a J2K file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17628.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.tracker-software.com/product/pdf-xchange-editor/history; https://www.zerodayinitiative.com/advisories/ZDI-22-1082/; https://www.tracker-software.com/product/pdf-xchange-editor/history
CVE: CVE-2022-37355
Published: 2023-03-29
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JPG files. Crafted data in a JPG file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17629.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.tracker-software.com/product/pdf-xchange-editor/history; https://www.zerodayinitiative.com/advisories/ZDI-22-1083/; https://www.tracker-software.com/product/pdf-xchange-editor/history
CVE: CVE-2022-37356
Published: 2023-03-29
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JPG files. Crafted data in a JPG file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17630.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.tracker-software.com/product/pdf-xchange-editor/history; https://www.zerodayinitiative.com/advisories/ZDI-22-1084/; https://www.tracker-software.com/product/pdf-xchange-editor/history
CVE: CVE-2022-37357
Published: 2023-03-29
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of ICO files. Crafted data in an ICO file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17631.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.tracker-software.com/product/pdf-xchange-editor/history; https://www.zerodayinitiative.com/advisories/ZDI-22-1085/; https://www.tracker-software.com/product/pdf-xchange-editor/history
CVE: CVE-2022-37358
Published: 2023-03-29
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JPG files. Crafted data in a JPG file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17632.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.tracker-software.com/product/pdf-xchange-editor/history; https://www.zerodayinitiative.com/advisories/ZDI-22-1086/; https://www.tracker-software.com/product/pdf-xchange-editor/history
CVE: CVE-2022-37359
Published: 2023-03-29
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of J2K files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17633.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://www.tracker-software.com/product/pdf-xchange-editor/history; https://www.zerodayinitiative.com/advisories/ZDI-22-1087/; https://www.tracker-software.com/product/pdf-xchange-editor/history
CVE: CVE-2022-37360
Published: 2023-03-29
Description: This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of EMF files. Crafted data in an EMF file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-17635.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://www.tracker-software.com/product/pdf-xchange-editor/history; https://www.zerodayinitiative.com/advisories/ZDI-22-1088/; https://www.tracker-software.com/product/pdf-xchange-editor/history
CVE: CVE-2022-37361
Published: 2023-03-29
Description: This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JP2 files. Crafted data in a JP2 file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-17674.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://www.tracker-software.com/product/pdf-xchange-editor/history; https://www.zerodayinitiative.com/advisories/ZDI-22-1089/; https://www.tracker-software.com/product/pdf-xchange-editor/history
CVE: CVE-2022-37362
Published: 2023-03-29
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PNG files. Crafted data in a PNG file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17660.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.tracker-software.com/product/pdf-xchange-editor/history; https://www.zerodayinitiative.com/advisories/ZDI-22-1090/; https://www.tracker-software.com/product/pdf-xchange-editor/history
CVE: CVE-2022-37363
Published: 2023-03-29
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of EMF files. Crafted data in an EMF file can trigger a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17673.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://www.tracker-software.com/product/pdf-xchange-editor/history; https://www.zerodayinitiative.com/advisories/ZDI-22-1091/; https://www.tracker-software.com/product/pdf-xchange-editor/history
CVE: CVE-2022-37364
Published: 2023-03-29
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of EMF files. Crafted data in an EMF file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17634.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.tracker-software.com/product/pdf-xchange-editor/history; https://www.zerodayinitiative.com/advisories/ZDI-22-1092/; https://www.tracker-software.com/product/pdf-xchange-editor/history
CVE: CVE-2022-37365
Published: 2023-03-29
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the saveAs method. The application exposes a JavaScript interface that allows the attacker to write arbitrary files. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-17527.
CVSS Score: 7.8 (HIGH)
CWE: CWE-749
References: https://www.tracker-software.com/product/pdf-xchange-editor/history; https://www.zerodayinitiative.com/advisories/ZDI-22-1093/; https://www.tracker-software.com/product/pdf-xchange-editor/history
CVE: CVE-2022-37366
Published: 2023-03-29
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of Doc objects. By performing actions in JavaScript, an attacker can trigger a read past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17727.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://www.tracker-software.com/product/pdf-xchange-editor/history; https://www.zerodayinitiative.com/advisories/ZDI-22-1094/; https://www.tracker-software.com/product/pdf-xchange-editor/history
CVE: CVE-2022-37367
Published: 2023-03-29
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of AcroForms. Crafted data in an AcroForm can trigger a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17726.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://www.tracker-software.com/product/pdf-xchange-editor/history; https://www.zerodayinitiative.com/advisories/ZDI-22-1095/; https://www.tracker-software.com/product/pdf-xchange-editor/history
CVE: CVE-2022-37368
Published: 2023-03-29
Description: This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of Doc objects. By performing actions in JavaScript, an attacker can trigger a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-17728.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://www.tracker-software.com/product/pdf-xchange-editor/history; https://www.zerodayinitiative.com/advisories/ZDI-22-1096/; https://www.tracker-software.com/product/pdf-xchange-editor/history
CVE: CVE-2022-37369
Published: 2023-03-29
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. Crafted data in a PDF file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17724.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.tracker-software.com/product/pdf-xchange-editor/history; https://www.zerodayinitiative.com/advisories/ZDI-22-1097/; https://www.tracker-software.com/product/pdf-xchange-editor/history
CVE: CVE-2022-37370
Published: 2023-03-29
Description: This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. Crafted data in a PDF file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-17725.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://www.tracker-software.com/product/pdf-xchange-editor/history; https://www.zerodayinitiative.com/advisories/ZDI-22-1098/; https://www.tracker-software.com/product/pdf-xchange-editor/history