deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-4314
Published: 2023-01-18
Description: It is possible to manipulate the JWT token without the knowledge of the JWT secret and authenticate without valid JWT token as any user. This is happening only in the situation when zOSMF doesn’t have the APAR PH12143 applied. This issue affects: 1.16 versions to 1.19. What happens is that the services using the ZAAS client or the API ML API to query will be deceived into believing the information in the JWT token is valid when it isn’t. It’s possible to use this to persuade the southbound service that different user is authenticated.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-269, CWE-287, CWE-269, CWE-287
References: https://github.com/zowe/api-layer/; https://github.com/zowe/api-layer/
CVE: CVE-2022-46505
Published: 2023-01-18
Description: An issue in MatrixSSL 4.5.1-open and earlier leads to failure to securely check the SessionID field, resulting in the misuse of an all-zero MasterSecret that can decrypt secret data.
CVSS Score: 7.5 (HIGH)
CWE: CWE-665, CWE-665
References: https://github.com/SmallTown123/details-for-CVE-2022-46505; https://smalltown123.notion.site/MatrixSSL-session-resume-bug-a0; https://github.com/SmallTown123/details-for-CVE-2022-46505
CVE: CVE-2022-3100
Published: 2023-01-18
Description: A flaw was found in the openstack-barbican component. This issue allows an access policy bypass via a query string when accessing the API.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-305
References: https://access.redhat.com/security/cve/CVE-2022-3100; https://access.redhat.com/security/cve/CVE-2022-3100
CVE: CVE-2022-47950
Published: 2023-01-18
Description: An issue was discovered in OpenStack Swift before 2.28.1, 2.29.x before 2.29.2, and 2.30.0. By supplying crafted XML files, an authenticated user may coerce the S3 API into returning arbitrary file contents from the host server, resulting in unauthorized read access to potentially sensitive data. This impacts both s3api deployments (Rocky or later), and swift3 deployments (Queens and earlier, no longer actively developed).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-552, CWE-552
References: https://launchpad.net/bugs/1998625; https://lists.debian.org/debian-lts-announce/2023/01/msg00021.html; https://security.openstack.org/ossa/OSSA-2023-001.html
CVE: CVE-2023-22809
Published: 2023-01-18
Description: In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environment variables (SUDO_EDITOR, VISUAL, and EDITOR), allowing a local attacker to append arbitrary entries to the list of files to process. This can lead to privilege escalation. Affected versions are 1.8.0 through 1.9.12.p1. The problem exists because a user-specified editor may contain a "--" argument that defeats a protection mechanism, e.g., an EDITOR='vim -- /path/to/extra/file' value.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269, CWE-269
References: http://packetstormsecurity.com/files/171644/sudo-1.9.12p1-Privilege-Escalation.html; http://packetstormsecurity.com/files/172509/Sudoedit-Extra-Arguments-Privilege-Escalation.html; http://packetstormsecurity.com/files/174234/Cisco-ThousandEyes-Enterprise-Agent-Virtual-Appliance-Arbitrary-File-Modification.html
CVE: CVE-2022-45613
Published: 2023-01-18
Description: Book Store Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability in /bsms_ci/index.php/book. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the publisher parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/lithonn/bug-report/tree/main/vendors/oretnom23/bsms_ci/stored-xss; https://medium.com/%40just0rg/book-store-management-system-1-0-unrestricted-input-leads-to-xss-74506d42492e; https://github.com/lithonn/bug-report/tree/main/vendors/oretnom23/bsms_ci/stored-xss
CVE: CVE-2022-47966
Published: 2023-01-18
Description: Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache Santuario xmlsec (aka XML Security for Java) 1.4.1, because the xmlsec XSLT features, by design in that version, make the application responsible for certain security protections, and the ManageEngine applications did not provide those protections. This affects Access Manager Plus before 4308, Active Directory 360 before 4310, ADAudit Plus before 7081, ADManager Plus before 7162, ADSelfService Plus before 6211, Analytics Plus before 5150, Application Control Plus before 10.1.2220.18, Asset Explorer before 6983, Browser Security Plus before 11.1.2238.6, Device Control Plus before 10.1.2220.18, Endpoint Central before 10.1.2228.11, Endpoint Central MSP before 10.1.2228.11, Endpoint DLP before 10.1.2137.6, Key Manager Plus before 6401, OS Deployer before 1.1.2243.1, PAM 360 before 5713, Password Manager Pro before 12124, Patch Manager Plus before 10.1.2220.18, Remote Access Plus before 10.1.2228.11, Remote Monitoring and Management (RMM) before 10.1.41. ServiceDesk Plus before 14004, ServiceDesk Plus MSP before 13001, SupportCenter Plus before 11026, and Vulnerability Manager Plus before 10.1.2220.18. Exploitation is only possible if SAML SSO has ever been configured for a product (for some products, exploitation requires that SAML SSO is currently active).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: http://packetstormsecurity.com/files/170882/Zoho-ManageEngine-ServiceDesk-Plus-14003-Remote-Code-Execution.html; http://packetstormsecurity.com/files/170925/ManageEngine-ADSelfService-Plus-Unauthenticated-SAML-Remote-Code-Execution.html; http://packetstormsecurity.com/files/170943/Zoho-ManageEngine-Endpoint-Central-MSP-10.1.2228.10-Remote-Code-Execution.html
CVE: CVE-2023-21601
Published: 2023-01-18
Description: Adobe Dimension version 3.4.6 (and earlier) are affected by a Use After Free vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416
References: https://helpx.adobe.com/security/products/dimension/apsb23-10.html; https://helpx.adobe.com/security/products/dimension/apsb23-10.html
CVE: CVE-2023-21603
Published: 2023-01-18
Description: Adobe Dimension version 3.4.6 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/dimension/apsb23-10.html; https://helpx.adobe.com/security/products/dimension/apsb23-10.html
CVE: CVE-2020-35326
Published: 2023-01-18
Description: SQL Injection vulnerability in file /inxedu/demo_inxedu_open/src/main/resources/mybatis/inxedu/website/WebsiteImagesMapper.xml in inxedu 2.0.6 via the id value.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://gitee.com/inxeduopen/inxedu/issues/I14DNJ; https://github.com/876054426/vul/blob/master/inxedu%20through%202018-12-24%20has%20a%20SQL%20Injection%20vulnerability.md; https://gitee.com/inxeduopen/inxedu/issues/I14DNJ
CVE: CVE-2022-47990
Published: 2023-01-18
Description: 
IBM AIX 7.1, 7.2, 7.3 and VIOS , 3.1 could allow a non-privileged local user to exploit a vulnerability in X11 to cause a buffer overflow that could result in a denial of service or arbitrary code execution. IBM X-Force ID: 243556.

 
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-120
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/243556; https://www.ibm.com/support/pages/node/6855827; https://exchange.xforce.ibmcloud.com/vulnerabilities/243556
CVE: CVE-2023-0040
Published: 2023-01-18
Description: Versions of Async HTTP Client prior to 1.13.2 are vulnerable to a form of targeted request manipulation called CRLF injection. This vulnerability was the result of insufficient validation of HTTP header field values before sending them to the network. Users are vulnerable if they pass untrusted data into HTTP header field values without prior sanitisation. Common use-cases here might be to place usernames from a database into HTTP header fields. This vulnerability allows attackers to inject new HTTP header fields, or entirely new requests, into the data stream. This can cause requests to be understood very differently by the remote server than was intended. In general, this is unlikely to result in data disclosure, but it can result in a number of logical errors and other misbehaviours.
CVSS Score: 7.5 (HIGH)
CWE: CWE-93, CWE-74, CWE-74
References: https://github.com/swift-server/async-http-client/security/advisories/GHSA-v3r5-pjpm-mwgq; https://github.com/swift-server/async-http-client/security/advisories/GHSA-v3r5-pjpm-mwgq
CVE: CVE-2023-21579
Published: 2023-01-18
Description: Adobe Acrobat Reader versions 22.003.20282 (and earlier), 22.003.20281 (and earlier) and 20.005.30418 (and earlier) are affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: https://helpx.adobe.com/security/products/acrobat/apsb23-01.html; https://helpx.adobe.com/security/products/acrobat/apsb23-01.html
CVE: CVE-2023-21581
Published: 2023-01-18
Description: Adobe Acrobat Reader versions 22.003.20282 (and earlier), 22.003.20281 (and earlier) and 20.005.30418 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/acrobat/apsb23-01.html; https://helpx.adobe.com/security/products/acrobat/apsb23-01.html
CVE: CVE-2023-21585
Published: 2023-01-18
Description: Adobe Acrobat Reader versions 22.003.20282 (and earlier), 22.003.20281 (and earlier) and 20.005.30418 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/acrobat/apsb23-01.html; https://helpx.adobe.com/security/products/acrobat/apsb23-01.html
CVE: CVE-2023-21604
Published: 2023-01-18
Description: Adobe Acrobat Reader versions 22.003.20282 (and earlier), 22.003.20281 (and earlier) and 20.005.30418 (and earlier) are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121
References: https://helpx.adobe.com/security/products/acrobat/apsb23-01.html; https://helpx.adobe.com/security/products/acrobat/apsb23-01.html
CVE: CVE-2023-21605
Published: 2023-01-18
Description: Adobe Acrobat Reader versions 22.003.20282 (and earlier), 22.003.20281 (and earlier) and 20.005.30418 (and earlier) are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122
References: https://helpx.adobe.com/security/products/acrobat/apsb23-01.html; https://helpx.adobe.com/security/products/acrobat/apsb23-01.html
CVE: CVE-2023-21606
Published: 2023-01-18
Description: Adobe Acrobat Reader versions 22.003.20282 (and earlier), 22.003.20281 (and earlier) and 20.005.30418 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/acrobat/apsb23-01.html; https://helpx.adobe.com/security/products/acrobat/apsb23-01.html
CVE: CVE-2023-21607
Published: 2023-01-18
Description: Adobe Acrobat Reader versions 22.003.20282 (and earlier), 22.003.20281 (and earlier) and 20.005.30418 (and earlier) are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://helpx.adobe.com/security/products/acrobat/apsb23-01.html; https://helpx.adobe.com/security/products/acrobat/apsb23-01.html
CVE: CVE-2023-21608
Published: 2023-01-18
Description: Adobe Acrobat Reader versions 22.003.20282 (and earlier), 22.003.20281 (and earlier) and 20.005.30418 (and earlier) are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://helpx.adobe.com/security/products/acrobat/apsb23-01.html; https://helpx.adobe.com/security/products/acrobat/apsb23-01.html; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-21608
CVE: CVE-2023-21609
Published: 2023-01-18
Description: Adobe Acrobat Reader versions 22.003.20282 (and earlier), 22.003.20281 (and earlier) and 20.005.30418 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/acrobat/apsb23-01.html; https://helpx.adobe.com/security/products/acrobat/apsb23-01.html
CVE: CVE-2023-21610
Published: 2023-01-18
Description: Adobe Acrobat Reader versions 22.003.20282 (and earlier), 22.003.20281 (and earlier) and 20.005.30418 (and earlier) are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121
References: https://helpx.adobe.com/security/products/acrobat/apsb23-01.html; https://helpx.adobe.com/security/products/acrobat/apsb23-01.html
CVE: CVE-2023-21611
Published: 2023-01-18
Description: Adobe Acrobat Reader versions 22.003.20282 (and earlier), 22.003.20281 (and earlier) and 20.005.30418 (and earlier) are affected by a Creation of Temporary File in Directory with Incorrect Permissions vulnerability that could result in privilege escalation in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-379, CWE-668
References: https://helpx.adobe.com/security/products/acrobat/apsb23-01.html; https://helpx.adobe.com/security/products/acrobat/apsb23-01.html
CVE: CVE-2023-21612
Published: 2023-01-18
Description: Adobe Acrobat Reader versions 22.003.20282 (and earlier), 22.003.20281 (and earlier) and 20.005.30418 (and earlier) are affected by a Creation of Temporary File in Directory with Incorrect Permissions vulnerability that could result in privilege escalation in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-379
References: https://helpx.adobe.com/security/products/acrobat/apsb23-01.html; https://helpx.adobe.com/security/products/acrobat/apsb23-01.html
CVE: CVE-2023-21613
Published: 2023-01-18
Description: Adobe Acrobat Reader versions 22.003.20282 (and earlier), 22.003.20281 (and earlier) and 20.005.30418 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/acrobat/apsb23-01.html; https://helpx.adobe.com/security/products/acrobat/apsb23-01.html
CVE: CVE-2023-21614
Published: 2023-01-18
Description: Adobe Acrobat Reader versions 22.003.20282 (and earlier), 22.003.20281 (and earlier) and 20.005.30418 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/acrobat/apsb23-01.html; https://helpx.adobe.com/security/products/acrobat/apsb23-01.html
CVE: CVE-2023-22592
Published: 2023-01-18
Description: 
IBM Robotic Process Automation for Cloud Pak 21.0.1 through 21.0.4 could allow a local user to perform unauthorized actions due to insufficient permission settings. IBM X-Force ID: 244073.


CVSS Score: 4.0 (MEDIUM)
CWE: CWE-732
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/244073; https://www.ibm.com/support/pages/node/6855839; https://exchange.xforce.ibmcloud.com/vulnerabilities/244073
CVE: CVE-2023-22594
Published: 2023-01-18
Description: IBM Robotic Process Automation for Cloud Pak 20.12.0 through 21.0.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.  IBM X-Force ID:  244075.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/244075; https://www.ibm.com/support/pages/node/6855835; https://exchange.xforce.ibmcloud.com/vulnerabilities/244075
CVE: CVE-2023-22863
Published: 2023-01-18
Description: IBM Robotic Process Automation 20.12.0 through 21.0.2 defaults to HTTP in some RPA commands when the prefix is not explicitly specified in the URL.  This could allow an attacker to obtain sensitive information using man in the middle techniques.  IBM X-Force ID:  244109.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-319
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/244109; https://www.ibm.com/support/pages/node/6855837; https://exchange.xforce.ibmcloud.com/vulnerabilities/244109
CVE: CVE-2010-10009
Published: 2023-01-18
Description: A vulnerability was found in frioux ptome. It has been rated as critical. This issue affects some unknown processing. The manipulation leads to sql injection. The patch is named 26829bba67858ca0bd4ce49ad50e7ce653914276. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-218519.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/frioux/ptome/commit/26829bba67858ca0bd4ce49ad50e7ce653914276; https://vuldb.com/?ctiid.218519; https://vuldb.com/?id.218519
CVE: CVE-2022-45922
Published: 2023-01-18
Description: An issue was discovered in OpenText Content Suite Platform 22.1 (16.2.19.1803). The request handler for ll.KeepAliveSession sets a valid AdminPwd cookie even when the Web Admin password was not entered. This allows access to endpoints, which require a valid AdminPwd cookie, without knowing the password.
CVSS Score: 8.8 (HIGH)
CWE: CWE-287
References: http://packetstormsecurity.com/files/170615/OpenText-Extended-ECM-22.3-File-Deletion-LFI-Privilege-Escsalation.html; http://seclists.org/fulldisclosure/2023/Jan/14; https://sec-consult.com/vulnerability-lab/advisory/multiple-post-authentication-vulnerabilities-including-rce-opentexttm-extended-ecm/
CVE: CVE-2022-45924
Published: 2023-01-18
Description: An issue was discovered in OpenText Content Suite Platform 22.1 (16.2.19.1803). The endpoint itemtemplate.createtemplate2 allows a low-privilege user to delete arbitrary files on the server's local filesystem.
CVSS Score: 8.1 (HIGH)
CWE: CWE-276
References: http://packetstormsecurity.com/files/170615/OpenText-Extended-ECM-22.3-File-Deletion-LFI-Privilege-Escsalation.html; http://seclists.org/fulldisclosure/2023/Jan/14; https://sec-consult.com/vulnerability-lab/advisory/multiple-post-authentication-vulnerabilities-including-rce-opentexttm-extended-ecm/
CVE: CVE-2022-45925
Published: 2023-01-18
Description: An issue was discovered in OpenText Content Suite Platform 22.1 (16.2.19.1803). The action xmlexport accepts the parameter requestContext. If this parameter is present, the response includes most of the HTTP headers sent to the server and some of the CGI variables like remote_adde and server_name, which is an information disclosure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://packetstormsecurity.com/files/170615/OpenText-Extended-ECM-22.3-File-Deletion-LFI-Privilege-Escsalation.html; http://seclists.org/fulldisclosure/2023/Jan/14; https://sec-consult.com/vulnerability-lab/advisory/multiple-post-authentication-vulnerabilities-including-rce-opentexttm-extended-ecm/
CVE: CVE-2022-45926
Published: 2023-01-18
Description: An issue was discovered in OpenText Content Suite Platform 22.1 (16.2.19.1803). The endpoint notify.localizeEmailTemplate allows a low-privilege user to evaluate webreports.
CVSS Score: 8.8 (HIGH)
CWE: CWE-918, CWE-918
References: http://packetstormsecurity.com/files/170615/OpenText-Extended-ECM-22.3-File-Deletion-LFI-Privilege-Escsalation.html; http://seclists.org/fulldisclosure/2023/Jan/14; https://sec-consult.com/vulnerability-lab/advisory/multiple-post-authentication-vulnerabilities-including-rce-opentexttm-extended-ecm/
CVE: CVE-2022-45928
Published: 2023-01-18
Description: A remote OScript execution issue was discovered in OpenText Content Suite Platform 22.1 (16.2.19.1803). Multiple endpoints allow the user to pass the parameter htmlFile, which is included in the HTML output rendering pipeline of a request. Because the Content Server evaluates and executes Oscript code in HTML files, it is possible for an attacker to execute Oscript code. The Oscript scripting language allows the attacker (for example) to manipulate files on the filesystem, create new network connections, or execute OS commands.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: http://packetstormsecurity.com/files/170615/OpenText-Extended-ECM-22.3-File-Deletion-LFI-Privilege-Escsalation.html; http://seclists.org/fulldisclosure/2023/Jan/14; https://sec-consult.com/vulnerability-lab/advisory/multiple-post-authentication-vulnerabilities-including-rce-opentexttm-extended-ecm/