deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-48427
Published: 2023-03-27
Description: In JetBrains TeamCity before 2022.10.3 stored XSS on “Pending changes” and “Changes” tabs was possible
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.jetbrains.com/privacy-security/issues-fixed/; https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2022-48428
Published: 2023-03-27
Description: In JetBrains TeamCity before 2022.10.3 stored XSS on the SSH keys page was possible
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.jetbrains.com/privacy-security/issues-fixed/; https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2023-25828
Published: 2023-03-27
Description: 
Pluck CMS is vulnerable to an authenticated remote code execution (RCE) vulnerability through its “albums” module. Albums are used to create collections of images that can be inserted into web pages across the site. Albums allow the upload of various filetypes, which undergo a normalization process before being available on the site. Due to lack of file extension validation, it is possible to upload a crafted JPEG payload containing an embedded PHP web-shell. An attacker may navigate to it directly to achieve RCE on the underlying web server. Administrator credentials for the Pluck CMS web interface are required to access the albums module feature, and are thus required to exploit this vulnerability. CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C (8.2 High)




CVSS Score: 7.2 (HIGH)
CWE: CWE-434, CWE-434
References: https://www.synopsys.com/blogs/software-security/pluck-cms-vulnerability/; https://www.synopsys.com/blogs/software-security/pluck-cms-vulnerability/
CVE: CVE-2023-27241
Published: 2023-03-27
Description: SourceCodester Water Billing System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the lastname text box under the Add Client module.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/kaikai-11/WaterBilling-System; https://github.com/kaikai-11/WaterBilling-System/blob/main/README.md; https://github.com/kaikai-11/WaterBilling-System
CVE: CVE-2023-27245
Published: 2023-03-27
Description: A cross-site scripting (XSS) vulnerability in File Management Project 1.0.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field under the Edit User module.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/flyasolo/File-Management-System; https://github.com/flyasolo/File-Management-System
CVE: CVE-2023-22300
Published: 2023-03-27
Description: An unauthenticated remote attacker could force all authenticated users, such as administrative users, to perform unauthorized actions by viewing the logs. This action would also grant the attacker privilege escalation.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-082-03; https://www.cisa.gov/news-events/ics-advisories/icsa-23-082-03
CVE: CVE-2023-25661
Published: 2023-03-27
Description: TensorFlow is an Open Source Machine Learning Framework. In versions prior to 2.11.1 a malicious invalid input crashes a tensorflow model (Check Failed) and can be used to trigger a denial of service attack. A proof of concept can be constructed with the `Convolution3DTranspose` function. This Convolution3DTranspose layer is a very common API in modern neural networks. The ML models containing such vulnerable components could be deployed in ML applications or as cloud services. This failure could be potentially used to trigger a denial of service attack on ML cloud services. An attacker must have privilege to provide input to a `Convolution3DTranspose` call. This issue has been patched and users are advised to upgrade to version 2.11.1. There are no known workarounds for this vulnerability.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://github.com/tensorflow/tensorflow/commit/948fe6369a5711d4b4568ea9bbf6015c6dfb77e2; https://github.com/tensorflow/tensorflow/security/advisories/GHSA-fxgc-95xx-grvq; https://github.com/tensorflow/tensorflow/commit/948fe6369a5711d4b4568ea9bbf6015c6dfb77e2
CVE: CVE-2023-25818
Published: 2023-03-27
Description: Nextcloud server is an open source, personal cloud implementation. In affected versions a malicious user could try to reset the password of another user and then brute force the 62^21 combinations for the password reset token. As of commit `704eb3aa` password reset attempts are now throttled. Note that 62^21 combinations would significant compute resources to brute force. None the less it is recommended that the Nextcloud Server is upgraded to 24.0.10 or 25.0.4. There are no known workarounds for this vulnerability.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-307, CWE-307
References: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-v243-x6jc-42mp; https://github.com/nextcloud/server/pull/36489; https://github.com/nextcloud/server/pull/36489/commits/704eb3aa6cecc0a646f5cca4290b595f493f9ed3
CVE: CVE-2023-27927
Published: 2023-03-27
Description: An authenticated malicious user could acquire the simple mail transfer protocol (SMTP) Password in cleartext format, despite it being protected and hidden behind asterisks. The attacker could then perform further attacks using the SMTP credentials.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-319
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-082-03; https://www.cisa.gov/news-events/ics-advisories/icsa-23-082-03
CVE: CVE-2023-28650
Published: 2023-03-27
Description: An unauthenticated remote attacker could provide a malicious link and trick an unsuspecting user into clicking on it. If clicked, the attacker could execute the malicious JavaScript (JS) payload in the target’s security context.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-082-03; https://www.cisa.gov/news-events/ics-advisories/icsa-23-082-03
CVE: CVE-2023-28652
Published: 2023-03-27
Description: An authenticated malicious user could successfully upload a malicious image could lead to a denial-of-service condition.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-434
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-082-03; https://www.cisa.gov/news-events/ics-advisories/icsa-23-082-03
CVE: CVE-2023-28655
Published: 2023-03-27
Description: A malicious user could leverage this vulnerability to escalate privileges or perform unauthorized actions in the context of the targeted privileged users.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-082-03; https://www.cisa.gov/news-events/ics-advisories/icsa-23-082-03
CVE: CVE-2021-3923
Published: 2023-03-27
Description: A flaw was found in the Linux kernel's implementation of RDMA over infiniband. An attacker with a privileged local account can leak kernel stack information when issuing commands to the /dev/infiniband/rdma_cm device node. While this access is unlikely to leak sensitive user information, it can be further used to defeat existing kernel protection mechanisms.
CVSS Score: 2.3 (LOW)
CWE: CWE-200
References: https://bugzilla.redhat.com/show_bug.cgi?id=2019643; https://lore.kernel.org/all/[PII_REDACTED]0036.GA12348%40kili/; https://bugzilla.redhat.com/show_bug.cgi?id=2019643
CVE: CVE-2022-46415
Published: 2023-03-27
Description: DJI Spark 01.00.0900 allows remote attackers to prevent legitimate terminal connections by exhausting the DHCP IP address pool. To accomplish this, the attacker would first need to connect to the device's internal Wi-Fi network (e.g., by guessing the password). Then, the attacker would need to send many DHCP request packets.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-291
References: https://github.com/bosslabdcu/Vulnerability-Reporting/security/advisories/GHSA-54q2-3r2m-9pgm; https://smartstore.naver.com/chachablues/products/[PII_REDACTED]; https://smartstore.naver.com/hancomawesome-tech/products/[PII_REDACTED]
CVE: CVE-2022-46416
Published: 2023-03-27
Description: Parrot Bebop 4.7.1. allows remote attackers to prevent legitimate terminal connections by exhausting the DHCP IP address pool. To accomplish this, the attacker would first need to connect to the device's internal Wi-Fi network (e.g., by guessing the password). Then, the attacker would need to send many DHCP request packets.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-770
References: https://github.com/bosslabdcu/Vulnerability-Reporting/security/advisories/GHSA-4xx4-r27p-wcrv; https://smartstore.naver.com/chachablues/products/[PII_REDACTED]; https://smartstore.naver.com/hancomawesome-tech/products/[PII_REDACTED]
CVE: CVE-2023-0241
Published: 2023-03-27
Description: pgAdmin 4 versions prior to v6.19 contains a directory traversal vulnerability. A user of the product may change another user's settings or alter the database.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://github.com/pgadmin-org/pgadmin4/issues/5734; https://jvn.jp/en/jp/JVN01398015/; https://github.com/pgadmin-org/pgadmin4/issues/5734
CVE: CVE-2023-0494
Published: 2023-03-27
Description: A vulnerability was found in X.Org. This issue occurs due to a dangling pointer in DeepCopyPointerClasses that can be exploited by ProcXkbSetDeviceInfo() and ProcXkbGetDeviceInfo() to read and write into freed memory. This can lead to local privilege elevation on systems where the X server runs privileged and remote code execution for ssh X forwarding sessions.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://bugzilla.redhat.com/show_bug.cgi?id=2165995; https://gitlab.freedesktop.org/xorg/xserver/-/commit/0ba6d8c37071131a49790243cdac55392ecf71ec; https://lists.x.org/archives/xorg-announce/2023-February/003320.html
CVE: CVE-2023-0778
Published: 2023-03-27
Description: A Time-of-check Time-of-use (TOCTOU) flaw was found in podman. This issue may allow a malicious user to replace a normal file in a volume with a symlink while exporting the volume, allowing for access to arbitrary files on the host file system.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-367, CWE-367
References: https://bugzilla.redhat.com/show_bug.cgi?id=2168256; https://bugzilla.redhat.com/show_bug.cgi?id=2168256
CVE: CVE-2023-1073
Published: 2023-03-27
Description: A memory corruption flaw was found in the Linux kernel’s human interface device (HID) subsystem in how a user inserts a malicious USB device. This flaw allows a local user to crash or potentially escalate their privileges on the system.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-119, CWE-787
References: http://www.openwall.com/lists/oss-security/2023/11/05/2; http://www.openwall.com/lists/oss-security/2023/11/05/3; https://bugzilla.redhat.com/show_bug.cgi?id=2173403
CVE: CVE-2023-1074
Published: 2023-03-27
Description: A memory leak flaw was found in the Linux kernel's Stream Control Transmission Protocol. This issue may occur when a user starts a malicious networking service and someone connects to this service. This could allow a local user to starve resources, causing a denial of service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401, CWE-401
References: http://www.openwall.com/lists/oss-security/2023/11/05/4; https://bugzilla.redhat.com/show_bug.cgi?id=2173430; https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit/?id=458e279f861d3f61796894cd158b780765a1569f
CVE: CVE-2023-1075
Published: 2023-03-27
Description: A flaw was found in the Linux Kernel. The tls_is_tx_ready() incorrectly checks for list emptiness, potentially accessing a type confused entry to the list_head, leaking the last byte of the confused field that overlaps with rec->tx_ready.
CVSS Score: 3.3 (LOW)
CWE: CWE-200, CWE-843
References: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit/?id=ffe2a[PII_REDACTED]0b05bdfeb999c03e810d84cbb; https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit/?id=ffe2a[PII_REDACTED]0b05bdfeb999c03e810d84cbb
CVE: CVE-2023-1076
Published: 2023-03-27
Description: A flaw was found in the Linux Kernel. The tun/tap sockets have their socket UID hardcoded to 0 due to a type confusion in their initialization function. While it will be often correct, as tuntap devices require CAP_NET_ADMIN, it may not always be the case, e.g., a non-root user only having that capability. This would make tun/tap sockets being incorrectly treated in filtering/routing decisions, possibly bypassing network filters.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-791, CWE-843
References: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit/?id=66b2c338adce580dfce2199591e65e2bab889cff; https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit/?id=a096ccca6e503a5c575717ff8a36ace27510ab0a; https://lists.debian.org/debian-lts-announce/2023/05/msg00005.html
CVE: CVE-2023-1077
Published: 2023-03-27
Description: In the Linux kernel, pick_next_rt_entity() may return a type confused entry, not detected by the BUG_ON condition, as the confused entry will not be NULL, but list_head.The buggy error condition would lead to a type confused entry with the list head,which would then be used as a type confused sched_rt_entity,causing memory corruption.
CVSS Score: 7.0 (HIGH)
CWE: CWE-843, CWE-843
References: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit/?id=7c4a5b89a0b5a57a64b601775b296abf77a9fe97; https://lists.debian.org/debian-lts-announce/2023/05/msg00005.html; https://lists.debian.org/debian-lts-announce/2024/01/msg00004.html
CVE: CVE-2023-1078
Published: 2023-03-27
Description: A flaw was found in the Linux Kernel in RDS (Reliable Datagram Sockets) protocol. The rds_rm_zerocopy_callback() uses list_entry() on the head of a list causing a type confusion. Local user can trigger this with rds_message_put(). Type confusion leads to `struct rds_msg_zcopy_info *info` actually points to something else that is potentially controlled by local user. It is known how to trigger this, which causes an out of bounds access, and a lock corruption.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-843
References: http://www.openwall.com/lists/oss-security/2023/11/05/1; https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit/?id=f753a68980cf4b59a80fe677619da2b1804f526d; https://lists.debian.org/debian-lts-announce/2023/05/msg00005.html
CVE: CVE-2023-1079
Published: 2023-03-27
Description: A flaw was found in the Linux kernel. A use-after-free may be triggered in asus_kbd_backlight_set when plugging/disconnecting in a malicious USB device, which advertises itself as an Asus device. Similarly to the previous known CVE-2023-25012, but in asus devices, the work_struct may be scheduled by the LED controller while the device is disconnecting, triggering a use-after-free on the struct asus_kbd_leds *led structure. A malicious USB device may exploit the issue to cause memory corruption with controlled data.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-416, CWE-416, CWE-416
References: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit/?id=4ab3a086d10eeec1424f2e8a968827a6336203df; https://lists.debian.org/debian-lts-announce/2023/05/msg00005.html; https://lists.debian.org/debian-lts-announce/2023/05/msg00006.html
CVE: CVE-2023-1380
Published: 2023-03-27
Description: A slab-out-of-bound read problem was found in brcmf_get_assoc_ies in drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c in the Linux Kernel. This issue could occur when assoc_info->req_len data is bigger than the size of the buffer, defined as WL_EXTRA_BUF_MAX, leading to a denial of service.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125, CWE-125
References: http://packetstormsecurity.com/files/173087/Kernel-Live-Patch-Security-Notice-LSN-0095-1.html; http://packetstormsecurity.com/files/173757/Kernel-Live-Patch-Security-Notice-LSN-0096-1.html; https://bugzilla.redhat.com/show_bug.cgi?id=2177883
CVE: CVE-2023-1666
Published: 2023-03-27
Description: A vulnerability has been found in SourceCodester Automatic Question Paper Generator System 1.0 and classified as critical. This vulnerability affects unknown code of the file users/classes/view_class.php of the component GET Parameter Handler. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-224104.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://github.com/si-xiao-kai/bug_report/blob/main/SQLi-1.md; https://vuldb.com/?ctiid.224104; https://vuldb.com/?id.224104
CVE: CVE-2023-22247
Published: 2023-03-27
Description: Adobe Commerce versions 2.4.4-p2 (and earlier) and 2.4.5-p1 (and earlier) are affected by an XML Injection vulnerability that could lead to arbitrary file system read. An unauthenticated attacker can force the application to make arbitrary requests via injection of arbitrary URLs. Exploitation of this issue does not require user interaction.
CVSS Score: 7.5 (HIGH)
CWE: CWE-91
References: https://helpx.adobe.com/security/products/magento/apsb23-17.html; https://helpx.adobe.com/security/products/magento/apsb23-17.html
CVE: CVE-2023-22249
Published: 2023-03-27
Description: Adobe Commerce versions 2.4.4-p2 (and earlier) and 2.4.5-p1 (and earlier) are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/magento/apsb23-17.html; https://helpx.adobe.com/security/products/magento/apsb23-17.html
CVE: CVE-2023-22250
Published: 2023-03-27
Description: Adobe Commerce versions 2.4.4-p2 (and earlier) and 2.4.5-p1 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to impact the availability of a user's minor feature. Exploitation of this issue does not require user interaction.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-284
References: https://helpx.adobe.com/security/products/magento/apsb23-17.html; https://helpx.adobe.com/security/products/magento/apsb23-17.html
CVE: CVE-2023-22251
Published: 2023-03-27
Description: Adobe Commerce versions 2.4.4-p2 (and earlier) and 2.4.5-p1 (and earlier) are affected by an Incorrect Authorization vulnerability. A low-privileged authenticated attacker could leverage this vulnerability to achieve minor information disclosure.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863
References: https://helpx.adobe.com/security/products/magento/apsb23-17.html; https://helpx.adobe.com/security/products/magento/apsb23-17.html
CVE: CVE-2023-22608
Published: 2023-03-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2023-24366
Published: 2023-03-27
Description: An arbitrary file download vulnerability in rConfig v6.8.0 allows attackers to download sensitive files via a crafted HTTP request.
CVSS Score: 6.5 (MEDIUM)
References: https://github.com/mrojz/rconfig-exploit/blob/main/CVE-2023-24366.md; https://github.com/mrojz/rconfig-exploit/blob/main/rconfigV6_Local_File_Disclosure.md; https://github.com/mrojz/rconfig-exploit/blob/main/CVE-2023-24366.md
CVE: CVE-2023-25261
Published: 2023-03-27
Description: Certain Stimulsoft GmbH products are affected by: Remote Code Execution. This affects Stimulsoft Designer (Desktop) 2023.1.4 and Stimulsoft Designer (Web) 2023.1.3 and Stimulsoft Viewer (Web) 2023.1.3. Access to the local file system is not prohibited in any way. Therefore, an attacker may include source code which reads or writes local directories and files. It is also possible for the attacker to prepare a report which has a variable that holds the gathered data and render it in the report.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: http://stimulsoft.com; https://cloud-trustit.spp.at/s/Rskwb3jKXQQsJy2; https://cves.at/posts/cve-2023-25261/writeup/
CVE: CVE-2023-25263
Published: 2023-03-27
Description: In Stimulsoft Designer (Desktop) 2023.1.5, and 2023.1.4, once an attacker decompiles the Stimulsoft.report.dll the attacker is able to decrypt any connectionstring stored in .mrt files since a static secret is used. The secret does not differ between the tested versions and different operating systems.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-312
References: http://stimulsoft.com; https://cloud-trustit.spp.at/s/Db8ZfNq2WYiNCHa; https://cves.at/posts/cve-2023-25263/writeup/
CVE: CVE-2023-25817
Published: 2023-03-27
Description: Nextcloud server is an open source, personal cloud implementation. In versions from 24.0.0 and before 24.0.9 a user could escalate their permissions to delete files they were not supposed to deletable but only viewed or downloaded. This issue has been addressed andit is recommended that the Nextcloud Server is upgraded to 24.0.9. There are no known workarounds for this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-281, CWE-732
References: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-8v5c-f752-fgpv; https://github.com/nextcloud/server/pull/33941; https://github.com/nextcloud/security-advisories/security/advisories/GHSA-8v5c-f752-fgpv
CVE: CVE-2023-25863
Published: 2023-03-27
Description: Adobe Substance 3D Stager versions 2.0.0 (and earlier) are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/substance3d_stager/apsb23-22.html; https://helpx.adobe.com/security/products/substance3d_stager/apsb23-22.html
CVE: CVE-2023-25864
Published: 2023-03-27
Description: Adobe Substance 3D Stager versions 2.0.0 (and earlier) are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://helpx.adobe.com/security/products/substance3d_stager/apsb23-22.html; https://helpx.adobe.com/security/products/substance3d_stager/apsb23-22.html
CVE: CVE-2023-25865
Published: 2023-03-27
Description: Adobe Substance 3D Stager versions 2.0.0 (and earlier) are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://helpx.adobe.com/security/products/substance3d_stager/apsb23-22.html; https://helpx.adobe.com/security/products/substance3d_stager/apsb23-22.html
CVE: CVE-2023-25866
Published: 2023-03-27
Description: Adobe Substance 3D Stager versions 2.0.0 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/substance3d_stager/apsb23-22.html; https://helpx.adobe.com/security/products/substance3d_stager/apsb23-22.html
CVE: CVE-2023-25867
Published: 2023-03-27
Description: Adobe Substance 3D Stager versions 2.0.0 (and earlier) are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://helpx.adobe.com/security/products/substance3d_stager/apsb23-22.html; https://helpx.adobe.com/security/products/substance3d_stager/apsb23-22.html