deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-8842
Published: 2024-11-22
Description: PDF-XChange Editor RTF File Parsing Uninitialized Variable Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of RTF files. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24481.
CVSS Score: 7.8 (HIGH)
CWE: CWE-457, CWE-908
References: https://www.zerodayinitiative.com/advisories/ZDI-24-1265/
CVE: CVE-2024-8843
Published: 2024-11-22
Description: PDF-XChange Editor JB2 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of JB2 files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-24495.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://www.zerodayinitiative.com/advisories/ZDI-24-1266/
CVE: CVE-2024-8844
Published: 2024-11-22
Description: PDF-XChange Editor PDF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-24550.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://www.zerodayinitiative.com/advisories/ZDI-24-1267/
CVE: CVE-2024-8845
Published: 2024-11-22
Description: PDF-XChange Editor PDF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-24553.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://www.zerodayinitiative.com/advisories/ZDI-24-1268/
CVE: CVE-2024-8846
Published: 2024-11-22
Description: PDF-XChange Editor TIF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of TIF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-24835.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://www.zerodayinitiative.com/advisories/ZDI-24-1269/
CVE: CVE-2024-8847
Published: 2024-11-22
Description: PDF-XChange Editor Doc Object Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the handling of Doc objects. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25198.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://www.zerodayinitiative.com/advisories/ZDI-24-1270/
CVE: CVE-2024-8848
Published: 2024-11-22
Description: PDF-XChange Editor AcroForm Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the handling of AcroForms. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-25268.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://www.zerodayinitiative.com/advisories/ZDI-24-1271/
CVE: CVE-2024-8849
Published: 2024-11-22
Description: PDF-XChange Editor AcroForm Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the handling of AcroForms. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-25269.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://www.zerodayinitiative.com/advisories/ZDI-24-1272/
CVE: CVE-2024-9257
Published: 2024-11-22
Description: Logsign Unified SecOps Platform delete_gsuite_key_file Input Validation Arbitrary File Deletion Vulnerability. This vulnerability allows remote attackers to delete arbitrary files within sensitive directories on affected installations of Logsign Unified SecOps Platform. Authentication is required to exploit this vulnerability.

The specific flaw exists within the delete_gsuite_key_file endpoint. The issue results from the lack of proper validation of a user-supplied filename prior to using it in file operations. An attacker can leverage this vulnerability to delete critical files on the system. Was ZDI-CAN-25265.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://support.logsign.net/hc/en-us/articles/[PII_REDACTED]3762-30-08-2024-Version-6-4-26-Release-Notes; https://www.zerodayinitiative.com/advisories/ZDI-24-1295/
CVE: CVE-2024-9665
Published: 2024-11-22
Description: Zimbra GraphQL Cross-Site Request Forgery Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Zimbra. User interaction is required to exploit this vulnerability in that the target must open a malicious email message.

The specific flaw exists within the implementation of the graphql endpoint. The issue results from the lack of proper protections against cross-site request forgery (CSRF) attacks. An attacker can leverage this vulnerability to disclose information in the context of the target email account. Was ZDI-CAN-23939.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://blog.zimbra.com/2024/10/new-patch-release-reminders-for-missing-attachments-out-of-office-notifications-traffic-light-protocol-tlp-and-mailto-links/; https://www.zerodayinitiative.com/advisories/ZDI-24-1369/
CVE: CVE-2024-9710
Published: 2024-11-22
Description: PostHog database_schema Server-Side Request Forgery Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PostHog. Authentication is required to exploit this vulnerability.

The specific flaw exists within the implementation of the database_schema method. The issue results from the lack of proper validation of a URI prior to accessing resources. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-25351.
CVSS Score: 8.3 (HIGH)
CWE: CWE-918
References: https://github.com/PostHog/posthog/pull/25388; https://www.zerodayinitiative.com/advisories/ZDI-24-1383/
CVE: CVE-2024-9712
Published: 2024-11-22
Description: Trimble SketchUp SKP File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trimble SketchUp. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of SKP files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-23530.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://www.zerodayinitiative.com/advisories/ZDI-24-1473/
CVE: CVE-2024-9713
Published: 2024-11-22
Description: Trimble SketchUp Pro SKP File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trimble SketchUp Pro. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of SKP files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-23885.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://www.zerodayinitiative.com/advisories/ZDI-24-1474/
CVE: CVE-2024-9714
Published: 2024-11-22
Description: Trimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trimble SketchUp Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of SKP files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24097.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://www.zerodayinitiative.com/advisories/ZDI-24-1483/
CVE: CVE-2024-9715
Published: 2024-11-22
Description: Trimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trimble SketchUp Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of SKP files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24098.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://www.zerodayinitiative.com/advisories/ZDI-24-1376/
CVE: CVE-2024-9716
Published: 2024-11-22
Description: Trimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trimble SketchUp Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of SKP files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24100.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://www.zerodayinitiative.com/advisories/ZDI-24-1375/
CVE: CVE-2024-9717
Published: 2024-11-22
Description: Trimble SketchUp Viewer SKP File Parsing Uninitialized Variable Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trimble SketchUp Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of SKP files. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24101.
CVSS Score: 7.8 (HIGH)
CWE: CWE-457, CWE-908
References: https://www.zerodayinitiative.com/advisories/ZDI-24-1377/
CVE: CVE-2024-9718
Published: 2024-11-22
Description: Trimble SketchUp Viewer SKP File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trimble SketchUp Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of SKP files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24102.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://www.zerodayinitiative.com/advisories/ZDI-24-1378/
CVE: CVE-2024-9719
Published: 2024-11-22
Description: Trimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trimble SketchUp Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of SKP files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24103.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://www.zerodayinitiative.com/advisories/ZDI-24-1379/
CVE: CVE-2024-9720
Published: 2024-11-22
Description: Trimble SketchUp Viewer SKP File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trimble SketchUp Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of SKP files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24104.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://www.zerodayinitiative.com/advisories/ZDI-24-1477/
CVE: CVE-2024-9721
Published: 2024-11-22
Description: Trimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trimble SketchUp Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of SKP files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24105.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://www.zerodayinitiative.com/advisories/ZDI-24-1482/
CVE: CVE-2024-9722
Published: 2024-11-22
Description: Trimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trimble SketchUp Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of SKP files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24106.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://www.zerodayinitiative.com/advisories/ZDI-24-1481/
CVE: CVE-2024-9723
Published: 2024-11-22
Description: Trimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trimble SketchUp Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of SKP files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24107.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://www.zerodayinitiative.com/advisories/ZDI-24-1480/
CVE: CVE-2024-9724
Published: 2024-11-22
Description: Trimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trimble SketchUp Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of SKP files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24108.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://www.zerodayinitiative.com/advisories/ZDI-24-1479/
CVE: CVE-2024-9725
Published: 2024-11-22
Description: Trimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trimble SketchUp Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of SKP files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24109.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://www.zerodayinitiative.com/advisories/ZDI-24-1478/
CVE: CVE-2024-9726
Published: 2024-11-22
Description: Trimble SketchUp Viewer SKP File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trimble SketchUp Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of SKP files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24110.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://www.zerodayinitiative.com/advisories/ZDI-24-1475/
CVE: CVE-2024-9727
Published: 2024-11-22
Description: Trimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trimble SketchUp Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of SKP files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24111.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://www.zerodayinitiative.com/advisories/ZDI-24-1476/
CVE: CVE-2024-9728
Published: 2024-11-22
Description: Trimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trimble SketchUp Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of SKP files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24112.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://www.zerodayinitiative.com/advisories/ZDI-24-1484/
CVE: CVE-2024-9729
Published: 2024-11-22
Description: Trimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trimble SketchUp Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of SKP files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24144.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://www.zerodayinitiative.com/advisories/ZDI-24-1380/