deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-46640
Published: 2022-02-18
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.75. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DGN files. Crafted data in a DGN file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15512.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0009; https://www.zerodayinitiative.com/advisories/ZDI-22-227/; https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0009
CVE: CVE-2021-46641
Published: 2022-02-18
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.75. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DGN file. Crafted data in a DNG file can trigger a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15513.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0009; https://www.zerodayinitiative.com/advisories/ZDI-22-228/; https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0009
CVE: CVE-2021-46642
Published: 2022-02-18
Description: This vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley View 10.15.0.75. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DGN files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-15514.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0009; https://www.zerodayinitiative.com/advisories/ZDI-22-229/; https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0009
CVE: CVE-2021-46643
Published: 2022-02-18
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.75. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DGN files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15515.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121
References: https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0009; https://www.zerodayinitiative.com/advisories/ZDI-22-230/; https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0009
CVE: CVE-2021-46644
Published: 2022-02-18
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.0.80. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DGN files. Crafted data in a DGN file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15530.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0009; https://www.zerodayinitiative.com/advisories/ZDI-22-231/; https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0009
CVE: CVE-2021-46645
Published: 2022-02-18
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.0.80. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of BMP images. Crafted data in a BMP image can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15531.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0002; https://www.zerodayinitiative.com/advisories/ZDI-22-232/; https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0002
CVE: CVE-2021-46646
Published: 2022-02-18
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.0.80. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DGN files. Crafted data in a DGN file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15532.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0009; https://www.zerodayinitiative.com/advisories/ZDI-22-233/; https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0009
CVE: CVE-2021-46647
Published: 2022-02-18
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.0.80. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of BMP images. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15533.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0002; https://www.zerodayinitiative.com/advisories/ZDI-22-234/; https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0002
CVE: CVE-2021-46648
Published: 2022-02-18
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.0.80. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DGN files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15534.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122
References: https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0009; https://www.zerodayinitiative.com/advisories/ZDI-22-235/; https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0009
CVE: CVE-2021-46649
Published: 2022-02-18
Description: This vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley MicroStation CONNECT 10.16.0.80. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DGN files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-15535.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0009; https://www.zerodayinitiative.com/advisories/ZDI-22-236/; https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0009
CVE: CVE-2021-46650
Published: 2022-02-18
Description: This vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley MicroStation CONNECT 10.16.0.80. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DGN files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-15536.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0009; https://www.zerodayinitiative.com/advisories/ZDI-22-237/; https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0009
CVE: CVE-2021-46651
Published: 2022-02-18
Description: This vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley MicroStation CONNECT 10.16.0.80. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DGN files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-15537.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0009; https://www.zerodayinitiative.com/advisories/ZDI-22-238/; https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0009
CVE: CVE-2021-46652
Published: 2022-02-18
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.75. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DGN files. Crafted data in a DGN file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15538.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0009; https://www.zerodayinitiative.com/advisories/ZDI-22-239/; https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0009
CVE: CVE-2021-46653
Published: 2022-02-18
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.75. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of BMP images. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15539.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122
References: https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0002; https://www.zerodayinitiative.com/advisories/ZDI-22-240/; https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0002
CVE: CVE-2021-46654
Published: 2022-02-18
Description: This vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley View 10.15.0.75. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DGN files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-15540.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0009; https://www.zerodayinitiative.com/advisories/ZDI-22-241/; https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0009
CVE: CVE-2021-46655
Published: 2022-02-18
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.75. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JT files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15630.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0005; https://www.zerodayinitiative.com/advisories/ZDI-22-242/; https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0005
CVE: CVE-2021-46656
Published: 2022-02-18
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.75. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JT files. Crafted data in a JT file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15631.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0005; https://www.zerodayinitiative.com/advisories/ZDI-22-243/; https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0005
CVE: CVE-2022-0543
Published: 2022-02-18
Description: It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific) Lua sandbox escape, which could result in remote code execution.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-862, CWE-862
References: http://packetstormsecurity.com/files/166885/Redis-Lua-Sandbox-Escape.html; https://bugs.debian.org/1005787; https://lists.debian.org/debian-security-announce/2022/msg00048.html
CVE: CVE-2022-24046
Published: 2022-02-18
Description: This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Sonos One Speaker prior to 3.4.1 (S2 systems) and 11.2.13 build 57923290 (S1 systems). Authentication is not required to exploit this vulnerability. The specific flaw exists within the anacapd daemon. The issue results from the lack of proper validation of user-supplied data, which can result in an integer underflow before writing to memory. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-15828.
CVSS Score: 8.8 (HIGH)
CWE: CWE-191, CWE-191
References: https://www.zerodayinitiative.com/advisories/ZDI-22-260/; https://www.zerodayinitiative.com/advisories/ZDI-22-260/
CVE: CVE-2022-24047
Published: 2022-02-18
Description: This vulnerability allows remote attackers to bypass authentication on affected installations of BMC Track-It! 20.21.01.102. Authentication is not required to exploit this vulnerability. The specific flaw exists within the authorization of HTTP requests. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-14618.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-288, CWE-287
References: https://community.bmc.com/s/article/Security-vulnerabilities-patched-in-Track-It; https://www.zerodayinitiative.com/advisories/ZDI-22-290/; https://community.bmc.com/s/article/Security-vulnerabilities-patched-in-Track-It
CVE: CVE-2022-24048
Published: 2022-02-18
Description: MariaDB CONNECT Storage Engine Stack-based Buffer Overflow Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of MariaDB. Authentication is required to exploit this vulnerability. The specific flaw exists within the processing of SQL queries. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the service account. Was ZDI-CAN-16191.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DKJRBYJAQCOPHSED43A3HUPNKQLDTFGD/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EZFZVMJL5UDTOZMARLXQIMG3BTG6UNYW/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NJ4KDAGF3H4D4BDTHRAM6ZEAJJWWMRUO/
CVE: CVE-2022-24049
Published: 2022-02-18
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Sonos One Speaker prior to 3.4.1 (S2 systems) and 11.2.13 build 57923290 (S1 systems). Authentication is not required to exploit this vulnerability. The specific flaw exists within the ALAC audio codec. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-15798.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-121, CWE-787
References: https://www.zerodayinitiative.com/advisories/ZDI-22-261/; https://www.zerodayinitiative.com/advisories/ZDI-22-261/
CVE: CVE-2022-24050
Published: 2022-02-18
Description: MariaDB CONNECT Storage Engine Use-After-Free Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of MariaDB. Authentication is required to exploit this vulnerability. The specific flaw exists within the processing of SQL queries. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the service account. Was ZDI-CAN-16207.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DKJRBYJAQCOPHSED43A3HUPNKQLDTFGD/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EZFZVMJL5UDTOZMARLXQIMG3BTG6UNYW/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NJ4KDAGF3H4D4BDTHRAM6ZEAJJWWMRUO/
CVE: CVE-2022-24051
Published: 2022-02-18
Description: MariaDB CONNECT Storage Engine Format String Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of MariaDB. Authentication is required to exploit this vulnerability. The specific flaw exists within the processing of SQL queries. The issue results from the lack of proper validation of a user-supplied string before using it as a format specifier. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the service account. Was ZDI-CAN-16193.
CVSS Score: 7.8 (HIGH)
CWE: CWE-134
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DKJRBYJAQCOPHSED43A3HUPNKQLDTFGD/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EZFZVMJL5UDTOZMARLXQIMG3BTG6UNYW/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NJ4KDAGF3H4D4BDTHRAM6ZEAJJWWMRUO/
CVE: CVE-2022-24052
Published: 2022-02-18
Description: MariaDB CONNECT Storage Engine Heap-based Buffer Overflow Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of MariaDB. Authentication is required to exploit this vulnerability. The specific flaw exists within the processing of SQL queries. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the service account. Was ZDI-CAN-16190.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DKJRBYJAQCOPHSED43A3HUPNKQLDTFGD/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EZFZVMJL5UDTOZMARLXQIMG3BTG6UNYW/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NJ4KDAGF3H4D4BDTHRAM6ZEAJJWWMRUO/
CVE: CVE-2022-24055
Published: 2022-02-18
Description: This vulnerability allows remote attackers to disclose sensitive information on affected installations of Sante DICOM Viewer Pro 11.8.7.0. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of GIF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-14972.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://www.zerodayinitiative.com/advisories/ZDI-22-247/; https://www.zerodayinitiative.com/advisories/ZDI-22-247/
CVE: CVE-2022-24056
Published: 2022-02-18
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Sante DICOM Viewer Pro 11.8.7.0. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of J2K files. Crafted data in a J2K file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15076.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.zerodayinitiative.com/advisories/ZDI-22-248/; https://www.zerodayinitiative.com/advisories/ZDI-22-248/
CVE: CVE-2022-24057
Published: 2022-02-18
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Sante DICOM Viewer Pro 11.8.7.0. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of J2K files. Crafted data in a J2K file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15077.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.zerodayinitiative.com/advisories/ZDI-22-249/; https://www.zerodayinitiative.com/advisories/ZDI-22-249/