deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-2929
Published: 2023-05-30
Description: Out of bounds write in Swiftshader in Google Chrome prior to 114.0.5735.90 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop_30.html; https://crbug.com/1410191; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2LE64KGGOISKPKMYROSDT4K6QFVDIRF6/
CVE: CVE-2023-2930
Published: 2023-05-30
Description: Use after free in Extensions in Google Chrome prior to 114.0.5735.90 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop_30.html; https://crbug.com/1443401; https://security.gentoo.org/glsa/202311-11
CVE: CVE-2023-2931
Published: 2023-05-30
Description: Use after free in PDF in Google Chrome prior to 114.0.5735.90 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop_30.html; https://crbug.com/1444238; https://security.gentoo.org/glsa/202311-11
CVE: CVE-2023-2932
Published: 2023-05-30
Description: Use after free in PDF in Google Chrome prior to 114.0.5735.90 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop_30.html; https://crbug.com/1444581; https://security.gentoo.org/glsa/202311-11
CVE: CVE-2023-2933
Published: 2023-05-30
Description: Use after free in PDF in Google Chrome prior to 114.0.5735.90 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop_30.html; https://crbug.com/1445426; https://security.gentoo.org/glsa/202311-11
CVE: CVE-2023-2934
Published: 2023-05-30
Description: Out of bounds memory access in Mojo in Google Chrome prior to 114.0.5735.90 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: http://packetstormsecurity.com/files/173259/Chrome-Mojo-Message-Validation-Bypass.html; https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop_30.html; https://crbug.com/1429720
CVE: CVE-2023-2935
Published: 2023-05-30
Description: Type Confusion in V8 in Google Chrome prior to 114.0.5735.90 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-843, CWE-843
References: http://packetstormsecurity.com/files/173196/Chrome-v8-internal-Object-SetPropertyWithAccessor-Type-Confusion.html; https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop_30.html; https://crbug.com/1440695
CVE: CVE-2023-2936
Published: 2023-05-30
Description: Type Confusion in V8 in Google Chrome prior to 114.0.5735.90 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-843, CWE-843
References: http://packetstormsecurity.com/files/173197/Chrome-V8-Type-Confusion.html; https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop_30.html; https://crbug.com/1443452
CVE: CVE-2023-2937
Published: 2023-05-30
Description: Inappropriate implementation in Picture In Picture in Google Chrome prior to 114.0.5735.90 allowed a remote attacker who had compromised the renderer process to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-451
References: https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop_30.html; https://crbug.com/1413813; https://security.gentoo.org/glsa/202311-11
CVE: CVE-2023-2938
Published: 2023-05-30
Description: Inappropriate implementation in Picture In Picture in Google Chrome prior to 114.0.5735.90 allowed a remote attacker who had compromised the renderer process to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-451
References: https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop_30.html; https://crbug.com/1416350; https://security.gentoo.org/glsa/202311-11
CVE: CVE-2023-2939
Published: 2023-05-30
Description: Insufficient data validation in Installer in Google Chrome on Windows prior to 114.0.5735.90 allowed a local attacker to perform privilege escalation via crafted symbolic link. (Chromium security severity: Medium)
CVSS Score: 7.8 (HIGH)
CWE: CWE-59, CWE-59
References: https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop_30.html; https://crbug.com/1427431; https://security.gentoo.org/glsa/202311-11
CVE: CVE-2023-2940
Published: 2023-05-30
Description: Inappropriate implementation in Downloads in Google Chrome prior to 114.0.5735.90 allowed an attacker who convinced a user to install a malicious extension to bypass file access restrictions via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop_30.html; https://crbug.com/1426807; https://security.gentoo.org/glsa/202311-11
CVE: CVE-2023-2941
Published: 2023-05-30
Description: Inappropriate implementation in Extensions API in Google Chrome prior to 114.0.5735.90 allowed an attacker who convinced a user to install a malicious extension to spoof the contents of the UI via a crafted Chrome Extension. (Chromium security severity: Low)
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-451
References: https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop_30.html; https://crbug.com/1430269; https://security.gentoo.org/glsa/202311-11
CVE: CVE-2023-2953
Published: 2023-05-30
Description: A vulnerability was found in openldap. This security flaw causes a null pointer dereference in ber_memalloc_x() function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476, CWE-476, CWE-476
References: http://seclists.org/fulldisclosure/2023/Jul/47; http://seclists.org/fulldisclosure/2023/Jul/48; http://seclists.org/fulldisclosure/2023/Jul/52
CVE: CVE-2023-32342
Published: 2023-05-30
Description: IBM GSKit could allow a remote attacker to obtain sensitive information, caused by a timing-based side channel in the RSA Decryption implementation. By sending an overly large number of trial messages for decryption, an attacker could exploit this vulnerability to obtain sensitive information.  IBM X-Force ID:  255828.
CVSS Score: 7.5 (HIGH)
CWE: CWE-203
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/255828; https://exchange.xforce.ibmcloud.com/vulnerabilities/255828
CVE: CVE-2023-33734
Published: 2023-05-30
Description: BlueCMS v1.6 was discovered to contain a SQL injection vulnerability via the keywords parameter at search.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/Peanuts-s/BlueCms; https://github.com/Peanuts-s/BlueCms
CVE: CVE-2023-33740
Published: 2023-05-30
Description: Incorrect access control in luowice v3.5.18 allows attackers to access cloud source code information via modification fo the Verify parameter in a warning message.
CVSS Score: 7.5 (HIGH)
CWE: CWE-346
References: https://github.com/zzh-newlearner/record/blob/main/luowice_warning.md; https://github.com/zzh-newlearner/record/blob/main/luowice_warning.md
CVE: CVE-2023-33741
Published: 2023-05-30
Description: Macrovideo v380pro v1.4.97 shares the device id and password when sharing the device.
CVSS Score: 7.5 (HIGH)
CWE: CWE-203
References: https://github.com/zzh-newlearner/record/blob/main/macrovideo_share.md; https://github.com/zzh-newlearner/record/blob/main/macrovideo_share.md
CVE: CVE-2023-33961
Published: 2023-05-30
Description: Leantime is a lean open source project management system. Starting in version 2.3.21, an authenticated user with commenting privileges can inject malicious Javascript into a comment. Once the malicious comment is loaded in the browser by a user, the malicious Javascript code executes. As of time of publication, a patch does not exist.
CVSS Score: 8.9 (HIGH)
CWE: CWE-79, CWE-79
References: https://github.com/Leantime/leantime/security/advisories/GHSA-359m-fp6q-65r7; https://github.com/Leantime/leantime/security/advisories/GHSA-359m-fp6q-65r7
CVE: CVE-2023-33962
Published: 2023-05-30
Description: JStachio is a  type-safe Java Mustache templating engine. Prior to version 1.0.1, JStachio fails to escape single quotes `'` in HTML, allowing an attacker to inject malicious code. This vulnerability can be exploited by an attacker to execute arbitrary JavaScript code in the context of other users visiting pages that use this template engine. This can lead to various consequences, including session hijacking, defacement of web pages, theft of sensitive information, or even the propagation of malware.

Version 1.0.1 contains a patch for this issue. To mitigate this vulnerability, the template engine should properly escape special characters, including single quotes. Common practice is to escape `'` as `&#39`. As a workaround, users can avoid this issue by using only double quotes `"` for HTML attributes.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/jstachio/jstachio/commit/7b2f78377d1284df14c580be762a25af5f8dcd66; https://github.com/jstachio/jstachio/issues/157; https://github.com/jstachio/jstachio/pull/158
CVE: CVE-2023-34151
Published: 2023-05-30
Description: A vulnerability was found in ImageMagick. This security flaw ouccers as an undefined behaviors of casting double to size_t in svg, mvg and other coders (recurring bugs of CVE-2022-32546).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-190, CWE-190
References: https://access.redhat.com/security/cve/CVE-2023-34151; https://bugzilla.redhat.com/show_bug.cgi?id=2210657; https://github.com/ImageMagick/ImageMagick/issues/6341
CVE: CVE-2023-34152
Published: 2023-05-30
Description: A vulnerability was found in ImageMagick. This security flaw cause a remote code execution vulnerability in OpenBlob with --enable-pipes configured.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20, CWE-78
References: https://access.redhat.com/security/cve/CVE-2023-34152; https://bugzilla.redhat.com/show_bug.cgi?id=2210659; https://github.com/ImageMagick/ImageMagick/issues/6339
CVE: CVE-2023-34153
Published: 2023-05-30
Description: A vulnerability was found in ImageMagick. This security flaw causes a shell command injection vulnerability via video:vsync or video:pixel-format options in VIDEO encoding/decoding.
CVSS Score: 7.8 (HIGH)
CWE: CWE-77, CWE-77
References: https://access.redhat.com/security/cve/CVE-2023-34153; https://bugzilla.redhat.com/show_bug.cgi?id=2210660; https://github.com/ImageMagick/ImageMagick/issues/6338
CVE: CVE-2022-39071
Published: 2023-05-30
Description: There is an unauthorized access vulnerability in some ZTE mobile phones. If a malicious application is installed on the phone, it could overwrite some system configuration files and user installers without user permission.
CVSS Score: 7.1 (HIGH)
References: https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1030664; https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1030664
CVE: CVE-2022-39074
Published: 2023-05-30
Description: There is an unauthorized access vulnerability in some ZTE mobile phones. If a malicious application is installed on the phone, it could start a non-public interface of an application without user permission.
CVSS Score: 3.3 (LOW)
References: https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1030664; https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1030664
CVE: CVE-2022-39075
Published: 2023-05-30
Description: There is an unauthorized access vulnerability in some ZTE mobile phones. If a malicious application is installed on the phone, it could delete some system files without user permission.
CVSS Score: 7.1 (HIGH)
References: https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1030664; https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1030664
CVE: CVE-2023-29726
Published: 2023-05-30
Description: The Call Blocker application 6.6.3 for Android incorrectly opens a key component that an attacker can use to inject large amounts of dirty data into the application's database. When the application starts, it loads the data from the database into memory. Once the attacker injects too much data, the application triggers an OOM error and crashes, resulting in a persistent denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-404, CWE-404
References: https://github.com/LianKee/SO-CVEs/blob/main/CVEs/CVE-2023-29726/CVE%20detail.md; https://play.google.com/store/apps/details?id=com.cuiet.blockCalls; https://www.call-blocker.info/
CVE: CVE-2023-29727
Published: 2023-05-30
Description: The Call Blocker application 6.6.3 for Android allows unauthorized applications to use exposed components to delete data stored in its database that is related to user privacy settings and affects the implementation of the normal functionality of the application. An attacker can use this to cause an escalation of privilege attack.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-922
References: https://github.com/LianKee/SO-CVEs/blob/main/CVEs/CVE-2023-29727/CVE%20detail.md; https://play.google.com/store/apps/details?id=com.cuiet.blockCalls; https://www.call-blocker.info/
CVE: CVE-2023-29728
Published: 2023-05-30
Description: The Call Blocker application 6.6.3 for Android allows attackers to tamper with feature-related data, resulting in a severe elevation of privilege attack.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-346
References: https://github.com/LianKee/SO-CVEs/blob/main/CVEs/CVE-2023-29728/CVE%20detail.md; https://play.google.com/store/apps/details?id=com.cuiet.blockCalls; https://www.call-blocker.info/
CVE: CVE-2023-29738
Published: 2023-05-30
Description: An issue found in Wave Animated Keyboard Emoji v.1.70.7 for Android allows a local attacker to cause code execution and escalation of Privileges via the database files.
CVSS Score: 7.8 (HIGH)
References: http://www.wavekeyboard.com/; https://github.com/LianKee/SO-CVEs/blob/main/CVEs/CVE-2023-29738/CVE%20detail.md; https://play.google.com/store/apps/details?id=com.amdroidalarmclock.amdroid
CVE: CVE-2023-29739
Published: 2023-05-30
Description: An issue found in Alarm Clock for Heavy Sleepers v.5.3.2 for Android allows unauthorized apps to cause escalation of privilege attacks by manipulating the component.
CVSS Score: 9.8 (CRITICAL)
References: http://amdroidapp.com/; https://github.com/LianKee/SO-CVEs/blob/main/CVEs/CVE-2023-29739/CVE%20detail.md; https://play.google.com/store/apps/details?id=com.amdroidalarmclock.amdroid
CVE: CVE-2023-29740
Published: 2023-05-30
Description: An issue found in Alarm Clock for Heavy Sleepers v.5.3.2 for Android allows unauthorized apps to cause a denial of service attack by manipulating the database.
CVSS Score: 7.5 (HIGH)
References: http://amdroidapp.com/; https://github.com/LianKee/SO-CVEs/blob/main/CVEs/CVE-2023-29740/CVE%20detail.md; https://play.google.com/store/apps/details?id=com.amdroidalarmclock.amdroid
CVE: CVE-2023-29741
Published: 2023-05-30
Description: An issue found in BestWeather v.7.3.1 for Android allows unauthorized apps to cause an escalation of privileges attack by manipulating the database.
CVSS Score: 9.8 (CRITICAL)
References: http://www.zmtqsh.com/; https://github.com/LianKee/SO-CVEs/blob/main/CVEs/CVE-2023-29741/CVE%20detail.md; https://play.google.com/store/apps/details?id=com.icoolme.android.weather
CVE: CVE-2023-29743
Published: 2023-05-30
Description: An issue found in BestWeather v.7.3.1 for Android allows unauthorized apps to cause a persistent denial of service attack by manipulating the database.
CVSS Score: 7.5 (HIGH)
CWE: CWE-346
References: http://www.zmtqsh.com/; https://github.com/LianKee/SO-CVEs/blob/main/CVEs/CVE-2023-29743/CVE%20detail.md; https://play.google.com/store/apps/details?id=com.icoolme.android.weather
CVE: CVE-2023-2952
Published: 2023-05-30
Description: XRA dissector infinite loop in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via packet injection or crafted capture file
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-835, CWE-835
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-2952.json; https://gitlab.com/wireshark/wireshark/-/issues/19100; https://lists.debian.org/debian-lts-announce/2023/06/msg00004.html
CVE: CVE-2012-10015
Published: 2023-05-31
Description: A vulnerability was found in BestWebSoft Twitter Plugin up to 2.14 on WordPress. It has been classified as problematic. Affected is the function twttr_settings_page of the file twitter.php of the component Settings Page. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. Upgrading to version 2.15 is able to address this issue. The patch is identified as a6d4659cbb2cbf18ccb0fb43549d5113d74e0146. It is recommended to upgrade the affected component. VDB-230154 is the identifier assigned to this vulnerability.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://github.com/wp-plugins/twitter-plugin/commit/a6d4659cbb2cbf18ccb0fb43549d5113d74e0146; https://vuldb.com/?ctiid.230154; https://vuldb.com/?id.230154
CVE: CVE-2022-47525
Published: 2023-05-31
Description: Fox-IT DataDiode (aka Fox DataDiode) 3.4.3 suffers from a Divide-by-Zero vulnerability in the packet parser. A remote attacker could leverage this vulnerability to cause a denial-of-service. Exploitation of this issue does not require user interaction.
CVSS Score: 7.5 (HIGH)
CWE: CWE-369, CWE-369
References: https://www.fox-it.com/nl-en/fox-crypto/fox-datadiode/; https://www.fox-it.com/nl-en/software-vulnerability-report/; https://www.fox-it.com/nl-en/fox-crypto/fox-datadiode/
CVE: CVE-2022-47526
Published: 2023-05-31
Description: Fox-IT DataDiode (aka Fox DataDiode) 3.4.3 suffers from a path traversal vulnerability with resultant arbitrary writing of files. A remote attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the downstream node user. Exploitation of this issue does not require user interaction.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22, CWE-22
References: https://www.fox-it.com/nl-en/fox-crypto/fox-datadiode/; https://www.fox-it.com/nl-en/software-vulnerability-report/; https://www.fox-it.com/nl-en/fox-crypto/fox-datadiode/
CVE: CVE-2023-28344
Published: 2023-05-31
Description: An issue was discovered in Faronics Insight 10.0.19045 on Windows. The Insight Teacher Console application allows unauthenticated attackers to view constantly updated screenshots of student desktops and to submit falsified screenshots on behalf of students. Attackers are able to view screenshots of student desktops without their consent. These screenshots may potentially contain sensitive/personal data. Attackers can also rapidly submit falsified images, hiding the actual contents of student desktops from the Teacher Console.
CVSS Score: 7.1 (HIGH)
CWE: CWE-668, CWE-22
References: https://research.nccgroup.com/2023/05/30/technical-advisory-multiple-vulnerabilities-in-faronics-insight/; https://research.nccgroup.com/?research=Technical%20advisories; https://research.nccgroup.com/2023/05/30/technical-advisory-multiple-vulnerabilities-in-faronics-insight/
CVE: CVE-2023-28345
Published: 2023-05-31
Description: An issue was discovered in Faronics Insight 10.0.19045 on Windows. The Insight Teacher Console application exposes the teacher's Console password in cleartext via an API endpoint accessible from localhost. Attackers with physical access to the Teacher Console can open a web browser, navigate to the affected endpoint and obtain the teacher's password. This enables them to log into the Teacher Console and begin trivially attacking student machines.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-312, CWE-312
References: https://research.nccgroup.com/2023/05/30/technical-advisory-multiple-vulnerabilities-in-faronics-insight/; https://research.nccgroup.com/?research=Technical%20advisories; https://research.nccgroup.com/2023/05/30/technical-advisory-multiple-vulnerabilities-in-faronics-insight/
CVE: CVE-2023-28346
Published: 2023-05-31
Description: An issue was discovered in Faronics Insight 10.0.19045 on Windows. It is possible for a remote attacker to communicate with the private API endpoints exposed at /login, /consoleSettings, /console, etc. despite Virtual Host Routing being used to block this access. Remote attackers can interact with private pages on the web server, enabling them to perform privileged actions such as logging into the console and changing console settings if they have valid credentials.
CVSS Score: 7.3 (HIGH)
CWE: CWE-732, CWE-732
References: https://research.nccgroup.com/2023/05/30/technical-advisory-multiple-vulnerabilities-in-faronics-insight/; https://research.nccgroup.com/?research=Technical%20advisories; https://research.nccgroup.com/2023/05/30/technical-advisory-multiple-vulnerabilities-in-faronics-insight/
CVE: CVE-2023-28347
Published: 2023-05-31
Description: An issue was discovered in Faronics Insight 10.0.19045 on Windows. It is possible for an attacker to create a proof-of-concept script that functions similarly to a Student Console, providing unauthenticated attackers with the ability to exploit XSS vulnerabilities within the Teacher Console application and achieve remote code execution as NT AUTHORITY/SYSTEM on all connected Student Consoles and the Teacher Console in a Zero Click manner.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-79, CWE-79
References: https://research.nccgroup.com/2023/05/30/technical-advisory-multiple-vulnerabilities-in-faronics-insight/; https://research.nccgroup.com/?research=Technical%20advisories; https://research.nccgroup.com/2023/05/30/technical-advisory-multiple-vulnerabilities-in-faronics-insight/
CVE: CVE-2023-28348
Published: 2023-05-31
Description: An issue was discovered in Faronics Insight 10.0.19045 on Windows. A suitably positioned attacker could perform a man-in-the-middle attack on either a connected student or teacher, enabling them to intercept student keystrokes or modify executable files being sent from teachers to students.
CVSS Score: 7.4 (HIGH)
CWE: CWE-319, CWE-319
References: https://research.nccgroup.com/2023/05/30/technical-advisory-multiple-vulnerabilities-in-faronics-insight/; https://research.nccgroup.com/?research=Technical%20advisories; https://research.nccgroup.com/2023/05/30/technical-advisory-multiple-vulnerabilities-in-faronics-insight/
CVE: CVE-2023-28349
Published: 2023-05-31
Description: An issue was discovered in Faronics Insight 10.0.19045 on Windows. It is possible for an attacker to create a crafted program that functions similarly to the Teacher Console. This can compel Student Consoles to connect and put themselves at risk automatically. Connected Student Consoles can be compelled to write arbitrary files to arbitrary locations on disk with NT AUTHORITY/SYSTEM level permissions, enabling remote code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-346, CWE-346
References: https://research.nccgroup.com/2023/05/30/technical-advisory-multiple-vulnerabilities-in-faronics-insight/; https://research.nccgroup.com/?research=Technical%20advisories; https://research.nccgroup.com/2023/05/30/technical-advisory-multiple-vulnerabilities-in-faronics-insight/