deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-4877
Published: 2023-09-10
Description: Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository hamza417/inure prior to build92.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://github.com/hamza417/inure/commit/09762e8c059be5983ca55e6424b2b5992fa740e7; https://huntr.dev/bounties/168e9299-f8ff-40d6-9def-d097b38bad84; https://github.com/hamza417/inure/commit/09762e8c059be5983ca55e6424b2b5992fa740e7
CVE: CVE-2023-4870
Published: 2023-09-10
Description: A vulnerability classified as problematic has been found in SourceCodester Contact Manager App 1.0. This affects an unknown part of the file index.php of the component Contact Information Handler. The manipulation of the argument contactID with the input "><sCrIpT>alert(1)</ScRiPt> leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-239355.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://skypoc.wordpress.com/2023/09/05/vuln1/; https://vuldb.com/?ctiid.239355; https://vuldb.com/?id.239355
CVE: CVE-2023-4871
Published: 2023-09-10
Description: A vulnerability classified as critical was found in SourceCodester Contact Manager App 1.0. This vulnerability affects unknown code of the file delete.php. The manipulation of the argument contact/contactName leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-239356.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://skypoc.wordpress.com/2023/09/05/vuln1/; https://vuldb.com/?ctiid.239356; https://vuldb.com/?id.239356
CVE: CVE-2023-4872
Published: 2023-09-10
Description: A vulnerability, which was classified as critical, has been found in SourceCodester Contact Manager App 1.0. This issue affects some unknown processing of the file add.php. The manipulation of the argument contact/contactName leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-239357 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://skypoc.wordpress.com/2023/09/05/vuln1/; https://vuldb.com/?ctiid.239357; https://vuldb.com/?id.239357
CVE: CVE-2023-4873
Published: 2023-09-10
Description: A vulnerability, which was classified as critical, was found in Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform up to 20230906. Affected is an unknown function of the file /importexport.php. The manipulation of the argument sql leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-239358 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-78
References: https://github.com/cugerQDHJ/cve/blob/main/rce.md; https://vuldb.com/?ctiid.239358; https://vuldb.com/?id.239358
CVE: CVE-2023-4878
Published: 2023-09-10
Description: Server-Side Request Forgery (SSRF) in GitHub repository instantsoft/icms2 prior to 2.16.1-git.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-918
References: https://github.com/instantsoft/icms2/commit/d0aeeaf5979fbdbf80dc3a3227d6c58442ab7487; https://huntr.dev/bounties/655c4f77-04b2-4220-bfaf-a4d99fe86703; https://github.com/instantsoft/icms2/commit/d0aeeaf5979fbdbf80dc3a3227d6c58442ab7487
CVE: CVE-2023-4879
Published: 2023-09-10
Description: Cross-site Scripting (XSS) - Stored in GitHub repository instantsoft/icms2 prior to 2.16.1.-git.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/instantsoft/icms2/commit/d0aeeaf5979fbdbf80dc3a3227d6c58442ab7487; https://huntr.dev/bounties/7df6b167-3c39-4563-9b8a-33613e25cf27; https://github.com/instantsoft/icms2/commit/d0aeeaf5979fbdbf80dc3a3227d6c58442ab7487
CVE: CVE-2023-42467
Published: 2023-09-11
Description: QEMU through 8.0.0 could trigger a division by zero in scsi_disk_reset in hw/scsi/scsi-disk.c because scsi_disk_emulate_mode_select does not prevent s->qdev.blocksize from being 256. This stops QEMU and the guest immediately.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-369
References: https://gitlab.com/qemu-project/qemu/-/commit/7cfcc79b0ab[PII_REDACTED]38aff9419f53fc68c9c; https://gitlab.com/qemu-project/qemu/-/issues/1813; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2023-40040
Published: 2023-09-11
Description: An issue was discovered in the MyCrops HiGrade "THC Testing & Cannabi" application 1.0.337 for Android. A remote attacker can start the camera feed via the com.cordovaplugincamerapreview.CameraActivity component in some situations. NOTE: this is only exploitable on Android versions that lack runtime permission checks, and of those only Android SDK 5.1.1 API 22 is consistent with the manifest. Thus, this applies only to Android Lollipop, affecting less than five percent of Android devices as of 2023.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://github.com/actuator/cve/blob/main/CVE-2023-40040; https://github.com/actuator/cve/blob/main/CVE-2023-40040
CVE: CVE-2023-40039
Published: 2023-09-11
Description: An issue was discovered on ARRIS TG852G, TG862G, and TG1672G devices. A remote attacker (in proximity to a Wi-Fi network) can derive the default WPA2-PSK value by observing a beacon frame.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: https://github.com/actuator/cve/blob/main/Arris/CVE-2023-40039; https://i.ebayimg.com/images/g/-UcAAOSwDe1kyD-Z/s-l1600.png; https://i.ebayimg.com/images/g/4P0AAOSwdhxkrZtt/s-l1600.jpg
CVE: CVE-2023-35845
Published: 2023-09-11
Description: Anaconda 3 2023.03-1-Linux allows local users to disrupt TLS certificate validation by modifying the cacert.pem file used by the installed pip program. This occurs because many files are installed as world-writable on Linux, ignoring umask, even when these files are installed as root. Miniconda is also affected.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-295
References: https://uponfurtherinvestigation.blogspot.com/2023/06/cve-2023-35845-anaconda3-creates.html; https://uponfurtherinvestigation.blogspot.com/2023/06/cve-2023-35845-anaconda3-creates.html
CVE: CVE-2023-42470
Published: 2023-09-11
Description: The Imou Life com.mm.android.smartlifeiot application through 6.8.0 for Android allows Remote Code Execution via a crafted intent to an exported component. This relates to the com.mm.android.easy4ip.MainActivity activity. JavaScript execution is enabled in the WebView, and direct web content loading occurs.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://github.com/actuator/cve/blob/main/CVE-2023-42470; https://github.com/actuator/imou/blob/main/imou-life-6.8.0.md; https://github.com/actuator/imou/blob/main/poc.apk
CVE: CVE-2023-42471
Published: 2023-09-11
Description: The wave.ai.browser application through 1.0.35 for Android allows a remote attacker to execute arbitrary JavaScript code via a crafted intent. It contains a manifest entry that exports the wave.ai.browser.ui.splash.SplashScreen activity. This activity uses a WebView component to display web content and doesn't adequately validate or sanitize the URI or any extra data passed in the intent by a third party application (with no permissions).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://github.com/actuator/cve/blob/main/CVE-2023-42471; https://github.com/actuator/wave.ai.browser/blob/main/CWE-94.md; https://github.com/actuator/wave.ai.browser/blob/main/poc.apk
CVE: CVE-2023-4573
Published: 2023-09-11
Description: When receiving rendering data over IPC `mStream` could have been destroyed when initialized, which could have led to a use-after-free causing a potentially exploitable crash. This vulnerability affects Firefox < 117, Firefox ESR < 102.15, Firefox ESR < 115.2, Thunderbird < 102.15, and Thunderbird < 115.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-416
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1846687; https://www.mozilla.org/security/advisories/mfsa2023-34/; https://www.mozilla.org/security/advisories/mfsa2023-35/
CVE: CVE-2023-4816
Published: 2023-09-11
Description: A vulnerability exists in the Equipment Tag Out authentication, when configured with Single Sign-On (SSO) with password validation in T214. This vulnerability can be exploited by an authenticated user per-forming an Equipment Tag Out holder action (Accept, Release, and Clear) for another user and entering an arbitrary password in the holder action confirmation dialog box. Despite entering an arbitrary password in the confirmation box, the system will execute the selected holder action.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-287, CWE-287
References: https://images.go.hitachienergy.com/Web/ABBEnterpriseSoftware/%7B70b3d323-4866-42e1-8a75-58996729c1d4%7D_8DBD000172-VU-2023-23_Asset_Suite_Tagout_vulnerability_Rev1.pdf; https://images.go.hitachienergy.com/Web/ABBEnterpriseSoftware/%7B70b3d323-4866-42e1-8a75-58996729c1d4%7D_8DBD000172-VU-2023-23_Asset_Suite_Tagout_vulnerability_Rev1.pdf
CVE: CVE-2023-4104
Published: 2023-09-11
Description: An invalid Polkit Authentication check and missing authentication requirements for D-Bus methods allowed any local user to configure arbitrary VPN setups.
*This bug only affects Mozilla VPN on Linux. Other operating systems are unaffected.* This vulnerability affects Mozilla VPN 2.16.1 < (Linux).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1831318; https://github.com/mozilla-mobile/mozilla-vpn-client/pull/7055; https://github.com/mozilla-mobile/mozilla-vpn-client/pull/7110
CVE: CVE-2023-4574
Published: 2023-09-11
Description: When creating a callback over IPC for showing the Color Picker window, multiple of the same callbacks could have been created at a time and eventually all simultaneously destroyed as soon as one of the callbacks finished. This could have led to a use-after-free causing a potentially exploitable crash. This vulnerability affects Firefox < 117, Firefox ESR < 102.15, Firefox ESR < 115.2, Thunderbird < 102.15, and Thunderbird < 115.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-416
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1846688; https://www.mozilla.org/security/advisories/mfsa2023-34/; https://www.mozilla.org/security/advisories/mfsa2023-35/
CVE: CVE-2023-4575
Published: 2023-09-11
Description: When creating a callback over IPC for showing the File Picker window, multiple of the same callbacks could have been created at a time and eventually all simultaneously destroyed as soon as one of the callbacks finished. This could have led to a use-after-free causing a potentially exploitable crash. This vulnerability affects Firefox < 117, Firefox ESR < 102.15, Firefox ESR < 115.2, Thunderbird < 102.15, and Thunderbird < 115.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-416
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1846689; https://www.mozilla.org/security/advisories/mfsa2023-34/; https://www.mozilla.org/security/advisories/mfsa2023-35/
CVE: CVE-2023-4576
Published: 2023-09-11
Description: On Windows, an integer overflow could occur in `RecordedSourceSurfaceCreation` which resulted in a heap buffer overflow potentially leaking sensitive data that could have led to a sandbox escape.
*This bug only affects Firefox on Windows. Other operating systems are unaffected.* This vulnerability affects Firefox < 117, Firefox ESR < 102.15, Firefox ESR < 115.2, Thunderbird < 102.15, and Thunderbird < 115.2.
CVSS Score: 8.6 (HIGH)
CWE: CWE-190
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1846694; https://www.mozilla.org/security/advisories/mfsa2023-34/; https://www.mozilla.org/security/advisories/mfsa2023-35/
CVE: CVE-2023-4577
Published: 2023-09-11
Description: When `UpdateRegExpStatics` attempted to access `initialStringHeap` it could already have been garbage collected prior to entering the function, which could potentially have led to an exploitable crash. This vulnerability affects Firefox < 117, Firefox ESR < 115.2, and Thunderbird < 115.2.
CVSS Score: 6.5 (MEDIUM)
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1847397; https://www.mozilla.org/security/advisories/mfsa2023-34/; https://www.mozilla.org/security/advisories/mfsa2023-36/
CVE: CVE-2023-4578
Published: 2023-09-11
Description: When calling `JS::CheckRegExpSyntax` a Syntax Error could have been set which would end in calling `convertToRuntimeErrorAndClear`. A path in the function could attempt to allocate memory when none is available which would have caused a newly created Out of Memory exception to be mishandled as a Syntax Error. This vulnerability affects Firefox < 117, Firefox ESR < 115.2, and Thunderbird < 115.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-770
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1839007; https://www.mozilla.org/security/advisories/mfsa2023-34/; https://www.mozilla.org/security/advisories/mfsa2023-36/
CVE: CVE-2023-4579
Published: 2023-09-11
Description: Search queries in the default search engine could appear to have been the currently navigated URL if the search query itself was a well formed URL. This could have led to a site spoofing another if it had been maliciously set as the default search engine. This vulnerability affects Firefox < 117.
CVSS Score: 3.1 (LOW)
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1842766; https://security.gentoo.org/glsa/202401-10; https://www.mozilla.org/security/advisories/mfsa2023-34/
CVE: CVE-2023-4580
Published: 2023-09-11
Description: Push notifications stored on disk in private browsing mode were not being encrypted potentially allowing the leak of sensitive information. This vulnerability affects Firefox < 117, Firefox ESR < 115.2, and Thunderbird < 115.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-311
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1843046; https://www.mozilla.org/security/advisories/mfsa2023-34/; https://www.mozilla.org/security/advisories/mfsa2023-36/
CVE: CVE-2023-4581
Published: 2023-09-11
Description: Excel `.xll` add-in files did not have a blocklist entry in Firefox's executable blocklist which allowed them to be downloaded without any warning of their potential harm. This vulnerability affects Firefox < 117, Firefox ESR < 102.15, Firefox ESR < 115.2, Thunderbird < 102.15, and Thunderbird < 115.2.
CVSS Score: 4.3 (MEDIUM)
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1843758; https://www.mozilla.org/security/advisories/mfsa2023-34/; https://www.mozilla.org/security/advisories/mfsa2023-35/
CVE: CVE-2023-4582
Published: 2023-09-11
Description: Due to large allocation checks in Angle for glsl shaders being too lenient a buffer overflow could have occurred when allocating too much private shader memory on mac OS. 
*This bug only affects Firefox on macOS. Other operating systems are unaffected.* This vulnerability affects Firefox < 117, Firefox ESR < 115.2, and Thunderbird < 115.2.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120, CWE-120
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1773874; https://www.mozilla.org/security/advisories/mfsa2023-34/; https://www.mozilla.org/security/advisories/mfsa2023-36/
CVE: CVE-2023-4583
Published: 2023-09-11
Description: When checking if the Browsing Context had been discarded in `HttpBaseChannel`, if the load group was not available then it was assumed to have already been discarded which was not always the case for private channels after the private session had ended. This vulnerability affects Firefox < 117, Firefox ESR < 115.2, and Thunderbird < 115.2.
CVSS Score: 7.5 (HIGH)
CWE: CWE-754
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1842030; https://www.mozilla.org/security/advisories/mfsa2023-34/; https://www.mozilla.org/security/advisories/mfsa2023-36/
CVE: CVE-2023-4584
Published: 2023-09-11
Description: Memory safety bugs present in Firefox 116, Firefox ESR 102.14, Firefox ESR 115.1, Thunderbird 102.14, and Thunderbird 115.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 117, Firefox ESR < 102.15, Firefox ESR < 115.2, Thunderbird < 102.15, and Thunderbird < 115.2.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://bugzilla.mozilla.org/buglist.cgi?bug_id=1843968%2C1845205%2C1846080%2C1846526%2C1847529; https://www.mozilla.org/security/advisories/mfsa2023-34/; https://www.mozilla.org/security/advisories/mfsa2023-35/
CVE: CVE-2023-4585
Published: 2023-09-11
Description: Memory safety bugs present in Firefox 116, Firefox ESR 115.1, and Thunderbird 115.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 117, Firefox ESR < 115.2, and Thunderbird < 115.2.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://bugzilla.mozilla.org/buglist.cgi?bug_id=1751583%2C1841082%2C1847904%2C1848999; https://www.mozilla.org/security/advisories/mfsa2023-34/; https://www.mozilla.org/security/advisories/mfsa2023-36/
CVE: CVE-2023-3612
Published: 2023-09-11
Description: Govee Home app has unprotected access to WebView component which can be opened by any app on the device. By sending an URL to a specially crafted site, the attacker can execute JavaScript in context of WebView or steal sensitive user data by displaying phishing content. 
CVSS Score: 8.2 (HIGH)
CWE: CWE-749
References: https://www.sk-cert.sk/threat/sk-cert-bezpecnostne-varovanie-v20230811-10; https://www.sk-cert.sk/threat/sk-cert-bezpecnostne-varovanie-v20230811-10
CVE: CVE-2023-36161
Published: 2023-09-11
Description: An issue was discovered in Qubo Smart Plug 10A version HSP02_01_01_14_SYSTEM-10A, allows attackers to cause a denial of service (DoS) via Wi-Fi deauthentication.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://github.com/Yashodhanvivek/Qubo_smart_switch_security_assessment/blob/main/Qubo_Smart_Plug_10A_Security_Assessment.pdf; https://github.com/Yashodhanvivek/Qubo_smart_switch_security_assessment/blob/main/Qubo_Smart_Plug_10A_Security_Assessment.pdf
CVE: CVE-2019-16470
Published: 2023-09-11
Description: Adobe Acrobat Reader versions 2[PII_REDACTED]6 and earlier are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://helpx.adobe.com/security/products/acrobat/apsb19-55.html; https://helpx.adobe.com/security/products/acrobat/apsb19-55.html
CVE: CVE-2019-16471
Published: 2023-09-11
Description: Adobe Acrobat Reader versions 2[PII_REDACTED]6 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://helpx.adobe.com/security/products/acrobat/apsb19-55.html; https://helpx.adobe.com/security/products/acrobat/apsb19-55.html
CVE: CVE-2019-7819
Published: 2023-09-11
Description: Adobe Acrobat Reader versions 2[PII_REDACTED]8 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/acrobat/apsb19-17.html; https://helpx.adobe.com/security/products/acrobat/apsb19-17.html
CVE: CVE-2022-28831
Published: 2023-09-11
Description: Adobe InDesign versions 17.1 (and earlier) and 16.4.1 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/indesign/apsb22-23.html; https://helpx.adobe.com/security/products/indesign/apsb22-23.html
CVE: CVE-2022-28832
Published: 2023-09-11
Description: Adobe InDesign versions 17.1 (and earlier) and 16.4.1 (and earlier) are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/indesign/apsb22-23.html; https://helpx.adobe.com/security/products/indesign/apsb22-23.html
CVE: CVE-2022-28833
Published: 2023-09-11
Description: Adobe InDesign versions 17.1 (and earlier) and 16.4.1 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/indesign/apsb22-23.html; https://helpx.adobe.com/security/products/indesign/apsb22-23.html
CVE: CVE-2022-28834
Published: 2023-09-11
Description: Adobe InCopy versions 17.1 (and earlier) and 16.4.1 (and earlier)  are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/incopy/apsb22-28.html; https://helpx.adobe.com/security/products/incopy/apsb22-28.html
CVE: CVE-2022-28835
Published: 2023-09-11
Description: Adobe InCopy versions 17.1 (and earlier) and 16.4.1 (and earlier)  are affected by an Use-After-Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://helpx.adobe.com/security/products/incopy/apsb22-28.html; https://helpx.adobe.com/security/products/incopy/apsb22-28.html
CVE: CVE-2022-28836
Published: 2023-09-11
Description: Adobe InCopy versions 17.1 (and earlier) and 16.4.1 (and earlier)  are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/incopy/apsb22-28.html; https://helpx.adobe.com/security/products/incopy/apsb22-28.html
CVE: CVE-2022-34224
Published: 2023-09-11
Description: Adobe Acrobat Reader versions 22.001.20142 (and earlier), 20.005.30334 (and earlier) and 17.012.30229 (and earlier) are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://helpx.adobe.com/security/products/acrobat/apsb22-32.html; https://helpx.adobe.com/security/products/acrobat/apsb22-32.html
CVE: CVE-2022-34227
Published: 2023-09-11
Description: Adobe Acrobat Reader versions 22.001.20142 (and earlier), 20.005.30334 (and earlier) and 17.012.30229 (and earlier) are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://helpx.adobe.com/security/products/acrobat/apsb22-32.html; https://helpx.adobe.com/security/products/acrobat/apsb22-32.html