deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-25141
Published: 2021-02-09
Description: A security vulnerability has been identified in in certain HPE and Aruba L2/L3 switch firmware. A data processing error due to improper handling of an unexpected data type in user supplied information to the switch's management interface has been identified. The data processing error could be exploited to cause a crash or reboot in the switch management interface and/or possibly the switch itself leading to local denial of service (DoS). The user must have administrator privileges to exploit this vulnerability.
CVSS Score: 4.4 (MEDIUM)
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbnw04082en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbnw04082en_us
CVE: CVE-2020-16144
Published: 2021-02-09
Description: When using an object storage like S3 as the file store, when a user creates a public link to a folder where anonymous users can upload files, and another user uploads a virus the files antivirus app would detect the virus but fails to delete it due to permission issues. This affects the files_antivirus component versions before 0.15.2 for ownCloud.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-276
References: https://owncloud.com/security-advisories/files-antivirus-doesnt-delete-virus-if-uploaded-through-public-link/; https://owncloud.com/security-advisories/files-antivirus-doesnt-delete-virus-if-uploaded-through-public-link/
CVE: CVE-2020-17418
Published: 2021-02-09
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.922. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of EZIX files. A crafted id in a channel element can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-11197.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.foxitsoftware.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-20-1329/; https://www.foxitsoftware.com/support/security-bulletins.html
CVE: CVE-2020-17419
Published: 2021-02-09
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.922. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of NEF files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-11192.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.foxitsoftware.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-20-1330/; https://www.foxitsoftware.com/support/security-bulletins.html
CVE: CVE-2020-17420
Published: 2021-02-09
Description: This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Studio Photo 3.6.6.922. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of NEF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated structure. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-11193.
CVSS Score: 3.3 (LOW)
CWE: CWE-125, CWE-125
References: https://www.foxitsoftware.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-20-1331/; https://www.foxitsoftware.com/support/security-bulletins.html
CVE: CVE-2020-17421
Published: 2021-02-09
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.922. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of NEF files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-11194.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.foxitsoftware.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-20-1332/; https://www.foxitsoftware.com/support/security-bulletins.html
CVE: CVE-2020-17422
Published: 2021-02-09
Description: This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Studio Photo 3.6.6.922. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of EPS files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated structure. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-11195.
CVSS Score: 3.3 (LOW)
CWE: CWE-125, CWE-125
References: https://www.foxitsoftware.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-20-1333/; https://www.foxitsoftware.com/support/security-bulletins.html
CVE: CVE-2020-17423
Published: 2021-02-09
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.922. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of ARW files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-11196.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://www.foxitsoftware.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-20-1334/; https://www.foxitsoftware.com/support/security-bulletins.html
CVE: CVE-2020-17424
Published: 2021-02-09
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.922. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of EZI files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-11247.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.foxitsoftware.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-20-1335/; https://www.foxitsoftware.com/support/security-bulletins.html
CVE: CVE-2020-17425
Published: 2021-02-09
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.922. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of EPS files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-11259.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.foxitsoftware.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-20-1336/; https://www.foxitsoftware.com/support/security-bulletins.html
CVE: CVE-2020-17426
Published: 2021-02-09
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.922. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of CR2 files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-11230.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-119
References: https://www.foxitsoftware.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-20-1337/; https://www.foxitsoftware.com/support/security-bulletins.html
CVE: CVE-2020-17427
Published: 2021-02-09
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.922. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of NEF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-11334.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-125
References: https://www.foxitsoftware.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-20-1338/; https://www.foxitsoftware.com/support/security-bulletins.html
CVE: CVE-2020-17428
Published: 2021-02-09
Description: This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Studio Photo 3.6.6.922. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of CMP files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated structure. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-11336.
CVSS Score: 3.3 (LOW)
CWE: CWE-125, CWE-125
References: https://www.foxitsoftware.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-20-1339/; https://www.foxitsoftware.com/support/security-bulletins.html
CVE: CVE-2020-17429
Published: 2021-02-09
Description: This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Studio Photo 3.6.6.922. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of CMP files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated structure. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-11337.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-125
References: https://www.foxitsoftware.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-20-1340/; https://www.foxitsoftware.com/support/security-bulletins.html
CVE: CVE-2020-17430
Published: 2021-02-09
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.922. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of CR2 files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-11332.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.foxitsoftware.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-20-1341/; https://www.foxitsoftware.com/support/security-bulletins.html
CVE: CVE-2020-17431
Published: 2021-02-09
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.922. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of CR2 files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-11333.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.foxitsoftware.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-20-1342/; https://www.foxitsoftware.com/support/security-bulletins.html
CVE: CVE-2020-17432
Published: 2021-02-09
Description: This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Studio Photo 3.6.6.922. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of CR2 files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated structure. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-11335.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-125
References: https://www.foxitsoftware.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-20-1343/; https://www.foxitsoftware.com/support/security-bulletins.html
CVE: CVE-2020-17433
Published: 2021-02-09
Description: This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Studio Photo 3.6.6.922. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of CMP files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated structure. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-11356.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-125
References: https://www.foxitsoftware.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-20-1344/; https://www.foxitsoftware.com/support/security-bulletins.html
CVE: CVE-2020-17434
Published: 2021-02-09
Description: This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Studio Photo 3.6.6.922. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of ARW files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated structure. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-11357.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-125
References: https://www.foxitsoftware.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-20-1345/; https://www.foxitsoftware.com/support/security-bulletins.html
CVE: CVE-2020-17435
Published: 2021-02-09
Description: This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Studio Photo 3.6.6.922. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of CR2 files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated structure. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-11358.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-125
References: https://www.foxitsoftware.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-20-1346/; https://www.foxitsoftware.com/support/security-bulletins.html
CVE: CVE-2020-17436
Published: 2021-02-09
Description: This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Studio Photo 3.6.6.922. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of CMP files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated structure. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-11432.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-125
References: https://www.foxitsoftware.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-20-1347/; https://www.foxitsoftware.com/support/security-bulletins.html
CVE: CVE-2020-27855
Published: 2021-02-09
Description: This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Studio Photo 3.6.6.922. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of SR2 files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated structure. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-11433.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-125
References: https://www.foxitsoftware.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-20-1348/; https://www.foxitsoftware.com/support/security-bulletins.html
CVE: CVE-2020-27856
Published: 2021-02-09
Description: This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Studio Photo 3.6.6.922. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of CR2 files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated structure. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-11434.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-125
References: https://www.foxitsoftware.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-20-1349/; https://www.foxitsoftware.com/support/security-bulletins.html
CVE: CVE-2020-27857
Published: 2021-02-09
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.922. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of NEF files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-11488.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.foxitsoftware.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-20-1350/; https://www.foxitsoftware.com/support/security-bulletins.html
CVE: CVE-2020-28388
Published: 2021-02-09
Description: A vulnerability has been identified in APOGEE PXC Compact (BACnet) (All versions < V3.5.5), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.20), APOGEE PXC Modular (BACnet) (All versions < V3.5.5), APOGEE PXC Modular (P2 Ethernet) (All versions < V2.8.20), Nucleus NET (All versions < V5.2), Nucleus ReadyStart V3 (All versions < V2012.12), Nucleus Source Code (All versions), PLUSCONTROL 1st Gen (All versions), TALON TC Compact (BACnet) (All versions < V3.5.5), TALON TC Modular (BACnet) (All versions < V3.5.5). Initial Sequence Numbers (ISNs) for TCP connections are derived from an insufficiently random source. As a result, the ISN of current and future TCP connections could be predictable. An attacker could hijack existing sessions or spoof future ones.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-342
References: https://cert-portal.siemens.com/productcert/pdf/ssa-180579.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-344238.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-362164.pdf
CVE: CVE-2020-28392
Published: 2021-02-09
Description: A vulnerability has been identified in SIMARIS configuration (All versions < V4.0.1). During installation to default target folder, incorrect permissions are configured for the application folder and subfolders which could allow an attacker to gain persistence or potentially escalate privileges should a user with elevated credentials log onto the machine.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276, CWE-276
References: https://cert-portal.siemens.com/productcert/pdf/ssa-794542.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-794542.pdf
CVE: CVE-2020-28394
Published: 2021-02-09
Description: A vulnerability has been identified in JT2Go (All versions < V13.1.0.1), Teamcenter Visualization (All versions < V13.1.0.1). Affected applications lack proper validation of user-supplied data when parsing of RAS files. This could result in a memory access past the end of an allocated buffer. An attacker could leverage this vulnerability to access data in the context of the current process. (ZDI-CAN-12283)
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://cert-portal.siemens.com/productcert/pdf/ssa-663999.pdf; https://www.zerodayinitiative.com/advisories/ZDI-21-236/; https://cert-portal.siemens.com/productcert/pdf/ssa-663999.pdf
CVE: CVE-2020-35572
Published: 2021-02-09
Description: Adminer through 4.7.8 allows XSS via the history parameter to the default URI.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://sourceforge.net/p/adminer/bugs-and-features/775/; https://sourceforge.net/p/adminer/news/; https://sourceforge.net/p/adminer/bugs-and-features/775/
CVE: CVE-2020-35942
Published: 2021-02-09
Description: A Cross-Site Request Forgery (CSRF) issue in the NextGEN Gallery plugin before 3.5.0 for WordPress allows File Upload and Local File Inclusion via settings modification, leading to Remote Code Execution and XSS. (It is possible to bypass CSRF protection by simply not including a nonce parameter.)
CVSS Score: 8.8 (HIGH)
CWE: CWE-79, CWE-352
References: https://www.wordfence.com/blog/2021/02/severe-vulnerabilities-patched-in-nextgen-gallery-affect-over-800000-wordpress-sites/; https://www.wordfence.com/blog/2021/02/severe-vulnerabilities-patched-in-nextgen-gallery-affect-over-800000-wordpress-sites/