deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-41903
Published: 2023-01-17
Description: Git is distributed revision control system. `git log` can display commits in an arbitrary format using its `--format` specifiers. This functionality is also exposed to `git archive` via the `export-subst` gitattribute. When processing the padding operators, there is a integer overflow in `pretty.c::format_and_pad_commit()` where a `size_t` is stored improperly as an `int`, and then added as an offset to a `memcpy()`. This overflow can be triggered directly by a user running a command which invokes the commit formatting machinery (e.g., `git log --format=...`). It may also be triggered indirectly through git archive via the export-subst mechanism, which expands format specifiers inside of files within the repository during a git archive. This integer overflow can result in arbitrary heap writes, which may result in arbitrary code execution. The problem has been patched in the versions published on 2023-01-17, going back to v2.30.7. Users are advised to upgrade. Users who are unable to upgrade should disable `git archive` in untrusted repositories. If you expose git archive via `git daemon`, disable it by running `git config --global daemon.uploadArch false`.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190
References: https://git-scm.com/book/en/v2/Customizing-Git-Git-Attributes#_export_subst; https://git-scm.com/docs/pretty-formats#Documentation/pretty-formats.txt-emltltNgttruncltruncmtruncem; https://github.com/git/git/commit/508386c6c5857b4faa2c3e491f422c98cc69ae76
CVE: CVE-2010-10006
Published: 2023-01-18
Description: A vulnerability, which was classified as problematic, was found in michaelliao jopenid. Affected is the function getAuthentication of the file JOpenId/src/org/expressme/openid/OpenIdManager.java. The manipulation leads to observable timing discrepancy. The complexity of an attack is rather high. The exploitability is told to be difficult. Upgrading to version 1.08 is able to address this issue. The name of the patch is c9baaa976b684637f0d5a50268e91846a7a719ab. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-218460.
CVSS Score: 2.6 (LOW)
CWE: CWE-208, CWE-203, CWE-203, CWE-208
References: https://github.com/michaelliao/jopenid/commit/c9baaa976b684637f0d5a50268e91846a7a719ab; https://github.com/michaelliao/jopenid/releases/tag/JOpenId-1.08; https://vuldb.com/?ctiid.218460
CVE: CVE-2014-125082
Published: 2023-01-18
Description: A vulnerability was found in nivit redports. It has been declared as critical. This vulnerability affects unknown code of the file redports-trac/redports/model.py. The manipulation leads to sql injection. The name of the patch is fc2c1ea1b8d795094abb15ac73cab90830534e04. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-218464.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/nivit/redports/commit/fc2c1ea1b8d795094abb15ac73cab90830534e04; https://vuldb.com/?ctiid.218464; https://vuldb.com/?id.218464
CVE: CVE-2015-10066
Published: 2023-01-18
Description: A vulnerability was found in tynx wuersch and classified as critical. Affected by this issue is the function packValue/getByCustomQuery of the file backend/base/Store.class.php. The manipulation leads to sql injection. The patch is identified as 66d4718750a741d1053d327a79e285fd50372519. It is recommended to apply a patch to fix this issue. VDB-218462 is the identifier assigned to this vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/tynx/wuersch/commit/66d4718750a741d1053d327a79e285fd50372519; https://vuldb.com/?ctiid.218462; https://vuldb.com/?id.218462
CVE: CVE-2022-38469
Published: 2023-01-18
Description: 



An unauthorized user with network access and the decryption key could decrypt sensitive data, such as usernames and passwords. 

 

 

 

 


CVSS Score: 7.5 (HIGH)
CWE: CWE-261, CWE-522
References: https://digitalsupport.ge.com/s/article/GE-Digital-Product-Security-Advisory-GED-23-01; https://www.cisa.gov/uscert/ics/advisories/icsa-23-017-01; https://digitalsupport.ge.com/s/article/GE-Digital-Product-Security-Advisory-GED-23-01
CVE: CVE-2022-39429
Published: 2023-01-18
Description: Vulnerability in the Java VM component of Oracle Database Server.  Supported versions that are affected are 19c and  21c. Easily exploitable vulnerability allows low privileged attacker having Create Procedure privilege with network access via Oracle Net to compromise Java VM.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java VM. CVSS 3.1 Base Score 4.3 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L).
CVSS Score: 4.3 (MEDIUM)
References: https://www.oracle.com/security-alerts/cpujan2023.html; https://www.oracle.com/security-alerts/cpujan2023.html
CVE: CVE-2022-43494
Published: 2023-01-18
Description: 

An unauthorized user could be able to read any file on the system, potentially exposing sensitive information. 

 

 


CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://digitalsupport.ge.com/s/article/GE-Digital-Product-Security-Advisory-GED-23-01; https://www.cisa.gov/uscert/ics/advisories/icsa-23-017-01; https://digitalsupport.ge.com/s/article/GE-Digital-Product-Security-Advisory-GED-23-01
CVE: CVE-2022-46331
Published: 2023-01-18
Description: 


An unauthorized user could possibly delete any file on the system. 

 

 

 


CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://digitalsupport.ge.com/s/article/GE-Digital-Product-Security-Advisory-GED-23-01; https://www.cisa.gov/uscert/ics/advisories/icsa-23-017-01; https://digitalsupport.ge.com/s/article/GE-Digital-Product-Security-Advisory-GED-23-01
CVE: CVE-2022-46660
Published: 2023-01-18
Description: 
An unauthorized user could alter or write files with full control over the path and content of the file. 

 


CVSS Score: 7.5 (HIGH)
CWE: CWE-434
References: https://digitalsupport.ge.com/s/article/GE-Digital-Product-Security-Advisory-GED-23-01; https://www.cisa.gov/uscert/ics/advisories/icsa-23-017-01; https://digitalsupport.ge.com/s/article/GE-Digital-Product-Security-Advisory-GED-23-01
CVE: CVE-2022-46732
Published: 2023-01-18
Description: Even if the authentication fails for local service authentication, the requested command could still execute regardless of authentication status.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://digitalsupport.ge.com/s/article/GE-Digital-Product-Security-Advisory-GED-23-01; https://www.cisa.gov/uscert/ics/advisories/icsa-23-017-01; https://digitalsupport.ge.com/s/article/GE-Digital-Product-Security-Advisory-GED-23-01
CVE: CVE-2023-21824
Published: 2023-01-18
Description: Vulnerability in the Oracle Communications BRM - Elastic Charging Engine product of Oracle Communications Applications (component: Customer, Config, Pricing Manager).  Supported versions that are affected are 12.0.0.3.0-12.0.0.7.0. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Communications BRM - Elastic Charging Engine executes to compromise Oracle Communications BRM - Elastic Charging Engine.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Communications BRM - Elastic Charging Engine accessible data. CVSS 3.1 Base Score 4.4 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N).
CVSS Score: 4.4 (MEDIUM)
References: https://www.oracle.com/security-alerts/cpujan2023.html; https://www.oracle.com/security-alerts/cpujan2023.html
CVE: CVE-2023-21825
Published: 2023-01-18
Description: Vulnerability in the Oracle iSupplier Portal product of Oracle E-Business Suite (component: Supplier Management).  Supported versions that are affected are 12.2.6-12.2.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle iSupplier Portal.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle iSupplier Portal accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
CVSS Score: 5.3 (MEDIUM)
References: https://www.oracle.com/security-alerts/cpujan2023.html; https://www.oracle.com/security-alerts/cpujan2023.html
CVE: CVE-2023-21826
Published: 2023-01-18
Description: Vulnerability in the Oracle Hospitality Reporting and Analytics product of Oracle Food and Beverage Applications (component: Reporting).   The supported version that is affected is 9.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Hospitality Reporting and Analytics.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Hospitality Reporting and Analytics accessible data as well as  unauthorized update, insert or delete access to some of Oracle Hospitality Reporting and Analytics accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Hospitality Reporting and Analytics. CVSS 3.1 Base Score 7.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:H).
CVSS Score: 7.6 (HIGH)
References: https://www.oracle.com/security-alerts/cpujan2023.html; https://www.oracle.com/security-alerts/cpujan2023.html
CVE: CVE-2023-21827
Published: 2023-01-18
Description: Vulnerability in the Oracle Database Data Redaction component of Oracle Database Server.  Supported versions that are affected are 19c and  21c. Easily exploitable vulnerability allows low privileged attacker having Create Session privilege with network access via Oracle Net to compromise Oracle Database Data Redaction.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle Database Data Redaction accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
CVSS Score: 4.3 (MEDIUM)
References: https://www.oracle.com/security-alerts/cpujan2023.html; https://www.oracle.com/security-alerts/cpujan2023.html
CVE: CVE-2023-21828
Published: 2023-01-18
Description: Vulnerability in the Oracle Hospitality Reporting and Analytics product of Oracle Food and Beverage Applications (component: Reporting).   The supported version that is affected is 9.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Hospitality Reporting and Analytics.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Hospitality Reporting and Analytics accessible data as well as  unauthorized access to critical data or complete access to all Oracle Hospitality Reporting and Analytics accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
CVSS Score: 8.1 (HIGH)
CWE: CWE-284
References: https://www.oracle.com/security-alerts/cpujan2023.html; https://www.oracle.com/security-alerts/cpujan2023.html
CVE: CVE-2023-21829
Published: 2023-01-18
Description: Vulnerability in the Oracle Database RDBMS Security component of Oracle Database Server.  Supported versions that are affected are 19c and  21c. Easily exploitable vulnerability allows low privileged attacker having Create Session privilege with network access via Oracle Net to compromise Oracle Database RDBMS Security.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Database RDBMS Security accessible data as well as  unauthorized read access to a subset of Oracle Database RDBMS Security accessible data. CVSS 3.1 Base Score 6.3 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N).
CVSS Score: 6.3 (MEDIUM)
References: https://www.oracle.com/security-alerts/cpujan2023.html; https://www.oracle.com/security-alerts/cpujan2023.html
CVE: CVE-2023-21830
Published: 2023-01-18
Description: Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Serialization).  Supported versions that are affected are Oracle Java SE: 8u351, 8u351-perf; Oracle GraalVM Enterprise Edition: 20.3.8 and  21.3.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 5.3 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N).
CVSS Score: 5.3 (MEDIUM)
References: https://security.gentoo.org/glsa/202401-25; https://www.oracle.com/security-alerts/cpujan2023.html; https://www.oracle.com/security-alerts/cpujul2023.html
CVE: CVE-2023-21831
Published: 2023-01-18
Description: Vulnerability in the PeopleSoft Enterprise CS Academic Advisement product of Oracle PeopleSoft (component: Advising Notes).   The supported version that is affected is 9.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise CS Academic Advisement.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of PeopleSoft Enterprise CS Academic Advisement accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
CVSS Score: 5.3 (MEDIUM)
References: https://www.oracle.com/security-alerts/cpujan2023.html; https://www.oracle.com/security-alerts/cpujan2023.html
CVE: CVE-2023-21832
Published: 2023-01-18
Description: Vulnerability in the Oracle BI Publisher product of Oracle Fusion Middleware (component: Security).  Supported versions that are affected are 5.9.0.0.0, 6.4.0.0.0 and  12.2.1.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise Oracle BI Publisher.  Successful attacks of this vulnerability can result in takeover of Oracle BI Publisher. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS Score: 8.8 (HIGH)
CWE: CWE-284
References: https://www.oracle.com/security-alerts/cpujan2023.html; https://www.oracle.com/security-alerts/cpujan2023.html
CVE: CVE-2023-21834
Published: 2023-01-18
Description: Vulnerability in the Oracle Self-Service Human Resources product of Oracle E-Business Suite (component: Workflow, Approval, Work Force Management).  Supported versions that are affected are 12.2.3-12.2.12. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Self-Service Human Resources.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Self-Service Human Resources accessible data. CVSS 3.1 Base Score 4.3 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N).
CVSS Score: 4.3 (MEDIUM)
References: https://www.oracle.com/security-alerts/cpujan2023.html; https://www.oracle.com/security-alerts/cpujan2023.html
CVE: CVE-2023-21835
Published: 2023-01-18
Description: Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE).  Supported versions that are affected are Oracle Java SE: 11.0.17, 17.0.5, 19.0.1; Oracle GraalVM Enterprise Edition: 20.3.8, 21.3.4 and  22.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via DTLS to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 5.3 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).
CVSS Score: 5.3 (MEDIUM)
References: https://security.gentoo.org/glsa/202401-25; https://www.oracle.com/security-alerts/cpujan2023.html; https://security.gentoo.org/glsa/202401-25
CVE: CVE-2023-21836
Published: 2023-01-18
Description: Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML).  Supported versions that are affected are 8.0.31 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
CVSS Score: 4.9 (MEDIUM)
References: https://www.oracle.com/security-alerts/cpujan2023.html; https://www.oracle.com/security-alerts/cpujan2023.html
CVE: CVE-2023-21837
Published: 2023-01-18
Description: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).  Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and  14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP to compromise Oracle WebLogic Server.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: https://www.oracle.com/security-alerts/cpujan2023.html; https://www.oracle.com/security-alerts/cpujan2023.html
CVE: CVE-2023-21838
Published: 2023-01-18
Description: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).  Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and  14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle WebLogic Server. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://www.oracle.com/security-alerts/cpujan2023.html; https://www.oracle.com/security-alerts/cpujan2023.html
CVE: CVE-2023-21839
Published: 2023-01-18
Description: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).  Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and  14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
CVSS Score: 7.5 (HIGH)
CWE: CWE-502, CWE-306
References: http://packetstormsecurity.com/files/172882/Oracle-Weblogic-PreAuth-Remote-Command-Execution.html; https://www.oracle.com/security-alerts/cpujan2023.html; http://packetstormsecurity.com/files/172882/Oracle-Weblogic-PreAuth-Remote-Command-Execution.html
CVE: CVE-2023-21840
Published: 2023-01-18
Description: Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: PS).  Supported versions that are affected are 5.7.40 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
CVSS Score: 4.9 (MEDIUM)
References: https://www.oracle.com/security-alerts/cpujan2023.html; https://www.oracle.com/security-alerts/cpujan2023.html
CVE: CVE-2023-21841
Published: 2023-01-18
Description: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).  Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and  14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: https://www.oracle.com/security-alerts/cpujan2023.html; https://www.oracle.com/security-alerts/cpujan2023.html
CVE: CVE-2023-21842
Published: 2023-01-18
Description: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Container).  Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and  14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: https://www.oracle.com/security-alerts/cpujan2023.html; https://www.oracle.com/security-alerts/cpujan2023.html