deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-25836
Published: 2023-07-21
Description: There is a Cross-site Scripting vulnerability in Esri Portal for ArcGIS Sites in versions 10.9 and below that may allow a remote, authenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the victims browser.  The privileges required to execute this attack are low.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/portal-for-arcgis-enterprise-sites-security-patch-is-now-available/; https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/portal-for-arcgis-enterprise-sites-security-patch-is-now-available/
CVE: CVE-2023-25837
Published: 2023-07-21
Description: There is a Cross‑Site Scripting (XSS) vulnerability in Esri ArcGIS Enterprise Sites versions 10.9 and below that may allow a remote, authenticated attacker to create a crafted link which, when clicked by a victim, could result in the execution of arbitrary JavaScript code in the target’s browser. Exploitation requires high‑privileged authenticated access. Successful exploitation may allow the attacker to access sensitive session data, manipulate trusted content, and disrupt normal application functionality, resulting in a high impact to confidentiality, integrity, and availability.
CVSS Score: 8.4 (HIGH)
CWE: CWE-79
References: https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/portal-for-arcgis-enterprise-sites-security-patch-is-now-available/; https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/portal-for-arcgis-enterprise-sites-security-patch-is-now-available/
CVE: CVE-2023-37291
Published: 2023-07-21
Description: Galaxy Software Services Vitals ESP is vulnerable to using a hard-coded encryption key. An unauthenticated remote attacker can generate a valid token parameter and exploit this vulnerability to access system to operate processes and access data.



This issue affects Vitals ESP: from 3.0.8 through 6.2.0.
CVSS Score: 8.6 (HIGH)
CWE: CWE-321
References: https://www.twcert.org.tw/tw/cp-132-7224-4fe1f-1.html; https://www.twcert.org.tw/tw/cp-132-7224-4fe1f-1.html
CVE: CVE-2023-3809
Published: 2023-07-21
Description: A vulnerability was found in Hospital Management System 1.0. It has been classified as critical. This affects an unknown part of the file patient.php. The manipulation of the argument address leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-235077 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/GZRsecurity/Cve-System/blob/main/Hospital%20Management%20System%20patient.php%20has%20Sqlinjection.pdf; https://vuldb.com/?ctiid.235077; https://vuldb.com/?id.235077
CVE: CVE-2023-3810
Published: 2023-07-21
Description: A vulnerability was found in Hospital Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file patientappointment.php. The manipulation of the argument loginid/password/mobileno/appointmentdate/appointmenttime/patiente/dob/doct/city leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-235078 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/GZRsecurity/Cve-System/blob/main/Hospital%20Management%20System%20patientappointment.php%20has%20Sqlinjection.pdf; https://vuldb.com/?ctiid.235078; https://vuldb.com/?id.235078
CVE: CVE-2023-37292
Published: 2023-07-21
Description: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in HGiga iSherlock 4.5 (iSherlock-user modules), HGiga iSherlock 5.5 (iSherlock-user modules) allows OS Command Injection.This issue affects iSherlock 4.5: before iSherlock-user-4.5-174; iSherlock 5.5: before iSherlock-user-5.5-174.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://www.twcert.org.tw/tw/cp-132-7239-8fc29-1.html; https://www.twcert.org.tw/tw/cp-132-7239-8fc29-1.html
CVE: CVE-2023-3811
Published: 2023-07-21
Description: A vulnerability was found in Hospital Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file patientprofile.php. The manipulation of the argument address leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-235079.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/GZRsecurity/Cve-System/blob/main/Hospital%20Management%20System%20patientprofile.php%20has%20Sqlinjection.pdf; https://vuldb.com/?ctiid.235079; https://vuldb.com/?id.235079
CVE: CVE-2023-3815
Published: 2023-07-21
Description: A vulnerability, which was classified as problematic, has been found in y_project RuoYi up to 4.7.7. Affected by this issue is the function uploadFilesPath of the component File Upload. The manipulation of the argument originalFilenames leads to cross site scripting. The attack may be launched remotely. VDB-235118 is the identifier assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://gitee.com/y_project/RuoYi/issues/I7IL85; https://vuldb.com/?ctiid.235118; https://vuldb.com/?id.235118
CVE: CVE-2023-32478
Published: 2023-07-21
Description: 
Dell PowerStore versions prior to 3.5.0.1 contain an insertion of sensitive information into log file vulnerability. A high privileged malicious user could potentially exploit this vulnerability, leading to sensitive information disclosure.


CVSS Score: 9.0 (CRITICAL)
CWE: CWE-532
References: https://www.dell.com/support/kbdoc/en-us/000215171/dsa-2023-173-dell-powerstore-family-security-update-for-multiple-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000215171/dsa-2023-173-dell-powerstore-family-security-update-for-multiple-vulnerabilities
CVE: CVE-2023-28728
Published: 2023-07-21
Description: A stack-based buffer overflow in Panasonic Control FPWIN Pro versions 7.6.0.3 and all previous versions may allow arbitrary code execution when opening specially crafted project files.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://industry.panasonic.eu/factory-automation/programmable-logic-controllers-plc/plc-software/programming-software-control-fpwin-pro; https://industry.panasonic.eu/factory-automation/programmable-logic-controllers-plc/plc-software/programming-software-control-fpwin-pro
CVE: CVE-2023-28729
Published: 2023-07-21
Description: A type confusion vulnerability in Panasonic Control FPWIN Pro versions 7.6.0.3 and all previous versions may allow arbitrary code execution when opening specially crafted project files.
CVSS Score: 7.8 (HIGH)
CWE: CWE-843, CWE-843
References: https://industry.panasonic.eu/factory-automation/programmable-logic-controllers-plc/plc-software/programming-software-control-fpwin-pro; https://industry.panasonic.eu/factory-automation/programmable-logic-controllers-plc/plc-software/programming-software-control-fpwin-pro
CVE: CVE-2023-28730
Published: 2023-07-21
Description: A memory corruption vulnerability Panasonic Control FPWIN Pro versions 7.6.0.3 and all previous versions may allow arbitrary code execution when opening specially crafted project files.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-787
References: https://industry.panasonic.eu/factory-automation/programmable-logic-controllers-plc/plc-software/programming-software-control-fpwin-pro; https://industry.panasonic.eu/factory-automation/programmable-logic-controllers-plc/plc-software/programming-software-control-fpwin-pro
CVE: CVE-2023-35086
Published: 2023-07-21
Description: 
It is identified a format string vulnerability in ASUS RT-AX56U V2 & RT-AC86U. This vulnerability is caused by directly using input as a format string when calling syslog in logmessage_normal function, in the do_detwan_cgi module of httpd. A remote attacker with administrator privilege can exploit this vulnerability to perform remote arbitrary code execution, arbitrary system operation or disrupt service.

This issue affects RT-AX56U V2: 3.0.0.4.386_50460; RT-AC86U: 3.0.0.4_386_51529.


CVSS Score: 7.2 (HIGH)
CWE: CWE-134
References: https://www.twcert.org.tw/tw/cp-132-7240-a5f96-1.html; https://www.twcert.org.tw/tw/cp-132-7240-a5f96-1.html
CVE: CVE-2023-35087
Published: 2023-07-21
Description: 
It is identified a format string vulnerability in ASUS RT-AX56U V2 & RT-AC86U. This vulnerability is caused by lacking validation for a specific value when calling cm_processChangedConfigMsg in ccm_processREQ_CHANGED_CONFIG function in AiMesh system. An unauthenticated remote attacker can exploit this vulnerability without privilege to perform remote arbitrary code execution, arbitrary system operation or disrupt service.
This issue affects RT-AX56U V2: 3.0.0.4.386_50460; RT-AC86U: 3.0.0.4_386_51529.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-134, CWE-134
References: https://www.twcert.org.tw/tw/cp-132-7249-ab2d1-1.html; https://www.twcert.org.tw/tw/cp-132-7249-ab2d1-1.html
CVE: CVE-2023-3484
Published: 2023-07-21
Description: An issue has been discovered in GitLab EE affecting all versions starting from 12.8 before 15.11.11, all versions starting from 16.0 before 16.0.7, all versions starting from 16.1 before 16.1.2. An attacker could change the name or path of a public top-level group in certain situations.
CVSS Score: 8.0 (HIGH)
CWE: CWE-863
References: https://gitlab.com/gitlab-org/gitlab/-/issues/416773; https://hackerone.com/reports/2035687; https://about.gitlab.com/releases/2023/07/05/security-release-gitlab-16-1-2-released/
CVE: CVE-2023-38646
Published: 2023-07-21
Description: Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary commands on the server, at the server's privilege level. Authentication is not required for exploitation. The other fixed versions are 0.45.4.1, 1.45.4.1, 0.44.7.1, 1.44.7.1, 0.43.7.2, and 1.43.7.2.
CVSS Score: 9.8 (CRITICAL)
References: http://packetstormsecurity.com/files/174091/Metabase-Remote-Code-Execution.html; http://packetstormsecurity.com/files/177138/Metabase-0.46.6-Remote-Code-Execution.html; https://github.com/metabase/metabase/issues/32552
CVE: CVE-2023-3819
Published: 2023-07-21
Description: Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository pimcore/pimcore prior to 10.6.4.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://github.com/pimcore/pimcore/commit/0237527b3244d251fa5ecd4912dfe4f8b2125c54; https://huntr.dev/bounties/be5e4d4c-1b0b-4c01-a1fc[PII_REDACTED]7c; https://github.com/pimcore/pimcore/commit/0237527b3244d251fa5ecd4912dfe4f8b2125c54
CVE: CVE-2023-3820
Published: 2023-07-21
Description:  SQL Injection in GitHub repository pimcore/pimcore prior to 10.6.4.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/pimcore/pimcore/commit/e641968979d4a2377bbea5e2a76bdede040d0b97; https://huntr.dev/bounties/b00a38b6-d040-494d-bf46-38f46ac1a1db; https://github.com/pimcore/pimcore/commit/e641968979d4a2377bbea5e2a76bdede040d0b97
CVE: CVE-2023-3821
Published: 2023-07-21
Description: Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.6.4.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/pimcore/pimcore/commit/92811f07d39e4ad95c92003868f5f7309489d79c; https://huntr.dev/bounties/599ba4f6-c900-4161-9127-f1e6a6e29aaa; https://github.com/pimcore/pimcore/commit/92811f07d39e4ad95c92003868f5f7309489d79c
CVE: CVE-2023-3822
Published: 2023-07-21
Description: Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.6.4.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/pimcore/pimcore/commit/d75888a9b14baaad591548463cca09dfd1395236; https://huntr.dev/bounties/2a3a13fe-2a9a-4d1a-8814-fd8ed1e3b1d5; https://github.com/pimcore/pimcore/commit/d75888a9b14baaad591548463cca09dfd1395236
CVE: CVE-2023-37742
Published: 2023-07-21
Description: WebBoss.io CMS before v3.7.0.1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://webboss.feedbear.com/updates; https://webboss.io/page/bughunter-acknowledgments.html; https://www.realinfosec.net/advisories/WEBBOSS-XSS-2022-0xd3fcf.html
CVE: CVE-2023-3102
Published: 2023-07-21
Description: A sensitive information leak issue has been discovered in GitLab EE affecting all versions starting from 16.0 before 16.0.6, all versions starting from 16.1 before 16.1.1, which allows access to titles of private issue and MR.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-201
References: https://gitlab.com/gitlab-org/gitlab/-/issues/414269; https://hackerone.com/reports/2012073; https://gitlab.com/gitlab-org/gitlab/-/issues/414269
CVE: CVE-2023-26301
Published: 2023-07-21
Description: Certain HP LaserJet Pro print products are potentially vulnerable to an Elevation of Privilege and/or Information Disclosure related to a lack of authentication with certain endpoints.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-862
References: https://support.hp.com/us-en/document/ish_8[PII_REDACTED]795-16/hpsbpi03855; https://support.hp.com/us-en/document/ish_8[PII_REDACTED]795-16/hpsbpi03855
CVE: CVE-2023-35392
Published: 2023-07-21
Description: Microsoft Edge (Chromium-based) Spoofing Vulnerability
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-290
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-35392; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-35392
CVE: CVE-2023-38173
Published: 2023-07-21
Description: Microsoft Edge for Android Spoofing Vulnerability
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-290
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38173; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38173
CVE: CVE-2023-38187
Published: 2023-07-21
Description: Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-269
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38187; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38187
CVE: CVE-2023-25840
Published: 2023-07-21
Description: There is a Cross-site Scripting vulnerability in ArcGIS Server in versions 11.1 and below that may allow a remote, authenticated attacker to create a crafted link which onmouseover wont execute but could potentially render an image in the victims browser.  The privileges required to execute this attack are high.
CVSS Score: 3.4 (LOW)
CWE: CWE-79
References: https://www.esri.com/arcgis-blog/products/trust-arcgis/announcements/arcgis-server-security-2023-update-1-patch-available/; https://www.esri.com/arcgis-blog/products/trust-arcgis/announcements/arcgis-server-security-2023-update-1-patch-available/
CVE: CVE-2023-25841
Published: 2023-07-21
Description: There is a stored Cross-site Scripting vulnerability in Esri ArcGIS Server versions 11.0 and below on Windows and Linux platforms that may allow a remote, unauthenticated attacker to create crafted content which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser.

Mitigation: Disable anonymous access to ArcGIS Feature services with edit capabilities.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.esri.com/arcgis-blog/products/trust-arcgis/announcements/arcgis-server-security-2023-update-1-patch-available/; https://www.esri.com/arcgis-blog/products/trust-arcgis/announcements/arcgis-server-security-2023-update-1-patch-available/
CVE: CVE-2023-37901
Published: 2023-07-21
Description: Indico is an open source a general-purpose, web based event management tool. There is a Cross-Site-Scripting vulnerability in confirmation prompts commonly used when deleting content from Indico. Exploitation requires someone with at least submission privileges (such as a speaker) and then someone else to attempt to delete this content. Considering that event organizers may want to delete suspicious-looking content when spotting it, there is a non-negligible risk of such an attack to succeed. The risk of this could be further increased when combined with some some social engineering pointing the victim towards this content. Users need to update to Indico 3.2.6 as soon as possible. See the docs for instructions on how to update. Users who cannot upgrade should only let trustworthy users manage categories, create events or upload materials ("submission" privileges on a contribution/event). This should already be the case in a properly-configured setup when it comes to category/event management. Note that a conference doing a Call for Abstracts actively invites external speakers (who the organizers may not know and thus cannot fully trust) to submit content, hence the need to update to a a fixed version ASAP in particular when using such workflows.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://docs.getindico.io/en/stable/installation/upgrade/; https://github.com/indico/indico/commit/2ee636d318653fb1ab193803dafbfe3e371d4130; https://github.com/indico/indico/releases/tag/v3.2.6
CVE: CVE-2021-35391
Published: 2023-07-21
Description: Server Side Request Forgery vulnerability found in Deskpro Support Desk v2021.21.6 allows attackers to execute arbitrary code via a crafted URL.
CVSS Score: 7.2 (HIGH)
CWE: CWE-918
References: http://deskpro.com; https://sayaanalam.github.io/CVE-2021-35391.html; http://deskpro.com
CVE: CVE-2023-36339
Published: 2023-07-21
Description: An access control issue in WebBoss.io CMS v3.7.0.1 allows attackers to access the Website Backup Tool via a crafted GET request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-863
References: https://webboss.feedbear.com/updates; https://www.realinfosec.net/advisories/WEBBOSS-CMS-IDOR-2023-0xv3jsv.html; https://webboss.feedbear.com/updates
CVE: CVE-2023-37903
Published: 2023-07-21
Description: vm2 is an open source vm/sandbox for Node.js. In vm2 for versions up to and including 3.9.19, Node.js custom inspect function allows attackers to escape the sandbox and run arbitrary code. This may result in Remote Code Execution, assuming the attacker has arbitrary code execution primitive inside the context of vm2 sandbox. There are no patches and no known workarounds. Users are advised to find an alternative software.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://github.com/patriksimek/vm2/security/advisories/GHSA-g644-9gfx-q4q4; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://github.com/patriksimek/vm2/security/advisories/GHSA-g644-9gfx-q4q4
CVE: CVE-2023-37905
Published: 2023-07-21
Description: ckeditor-wordcount-plugin is an open source WordCount Plugin for CKEditor. It has been discovered that the `ckeditor-wordcount-plugin` plugin for CKEditor4 is susceptible to cross-site scripting when switching to the source code mode. This issue has been addressed in version 1.17.12 of the `ckeditor-wordcount-plugin` plugin and users are advised to upgrade. There are no known workarounds for this vulnerability.


CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/TYPO3/typo3/security/advisories/GHSA-m8fw-p3cr-6jqc; https://github.com/w8tcha/CKEditor-WordCount-Plugin/commit/0f03b3e5b7c1409998a13aba3a95396e6fa349d8; https://github.com/w8tcha/CKEditor-WordCount-Plugin/commit/a4b154bdf35b[PII_REDACTED]fcb078f196b437c2f1
CVE: CVE-2023-3603
Published: 2023-07-21
Description: A missing allocation check in sftp server processing read requests may cause a NULL dereference on low-memory conditions. The malicious client can request up to 4GB SFTP reads, causing allocation of up to 4GB buffers, which was not being checked for failure. This will likely crash the authenticated user's sftp server connection (if implemented as forking as recommended). For thread-based servers, this might also cause DoS for legitimate users.

Given this code is not in any released versions, no security releases have been issued.
CVSS Score: 3.1 (LOW)
CWE: CWE-476, CWE-476
References: https://access.redhat.com/security/cve/CVE-2023-3603; https://bugzilla.redhat.com/show_bug.cgi?id=2221791; https://access.redhat.com/security/cve/CVE-2023-3603
CVE: CVE-2022-37331
Published: 2023-07-21
Description: An out-of-bounds write vulnerability exists in the Gaussian format orientation functionality of Open Babel 3.1.1 and master commit 530dbfa3. A specially crafted malformed file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.
CVSS Score: 7.3 (HIGH)
CWE: CWE-119, CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2022-1672; https://talosintelligence.com/vulnerability_reports/TALOS-2022-1672; https://www.talosintelligence.com/vulnerability_reports/TALOS-2022-1672
CVE: CVE-2022-41793
Published: 2023-07-21
Description: An out-of-bounds write vulnerability exists in the CSR format title functionality of Open Babel 3.1.1 and master commit 530dbfa3. A specially crafted malformed file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120, CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2022-1667; https://talosintelligence.com/vulnerability_reports/TALOS-2022-1667; https://www.talosintelligence.com/vulnerability_reports/TALOS-2022-1667
CVE: CVE-2022-42885
Published: 2023-07-21
Description: A use of uninitialized pointer vulnerability exists in the GRO format res functionality of Open Babel 3.1.1 and master commit 530dbfa3. A specially crafted malformed file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-824
References: https://talosintelligence.com/vulnerability_reports/TALOS-2022-1668; https://talosintelligence.com/vulnerability_reports/TALOS-2022-1668; https://www.talosintelligence.com/vulnerability_reports/TALOS-2022-1668
CVE: CVE-2022-43467
Published: 2023-07-21
Description: An out-of-bounds write vulnerability exists in the PQS format coord_file functionality of Open Babel 3.1.1 and master commit 530dbfa3. A specially crafted malformed file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119, CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2022-1671; https://talosintelligence.com/vulnerability_reports/TALOS-2022-1671; https://www.talosintelligence.com/vulnerability_reports/TALOS-2022-1671
CVE: CVE-2022-43607
Published: 2023-07-21
Description: An out-of-bounds write vulnerability exists in the MOL2 format attribute and value functionality of Open Babel 3.1.1 and master commit 530dbfa3. A specially crafted malformed file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.
CVSS Score: 8.1 (HIGH)
CWE: CWE-119, CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2022-1664; https://talosintelligence.com/vulnerability_reports/TALOS-2022-1664; https://www.talosintelligence.com/vulnerability_reports/TALOS-2022-1664
CVE: CVE-2022-44451
Published: 2023-07-21
Description: A use of uninitialized pointer vulnerability exists in the MSI format atom functionality of Open Babel 3.1.1 and master commit 530dbfa3. A specially crafted malformed file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-824
References: https://talosintelligence.com/vulnerability_reports/TALOS-2022-1669; https://talosintelligence.com/vulnerability_reports/TALOS-2022-1669; https://www.talosintelligence.com/vulnerability_reports/TALOS-2022-1669