deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-21587
Published: 2023-01-13
Description: Adobe InDesign version 18.0 (and earlier), 17.4 (and earlier) are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122
References: https://helpx.adobe.com/security/products/indesign/apsb23-07.html; https://helpx.adobe.com/security/products/indesign/apsb23-07.html
CVE: CVE-2023-21588
Published: 2023-01-13
Description: Adobe InDesign version 18.0 (and earlier), 17.4 (and earlier) are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://helpx.adobe.com/security/products/indesign/apsb23-07.html; https://helpx.adobe.com/security/products/indesign/apsb23-07.html
CVE: CVE-2023-21589
Published: 2023-01-13
Description: Adobe InDesign version 18.0 (and earlier), 17.4 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/indesign/apsb23-07.html; https://helpx.adobe.com/security/products/indesign/apsb23-07.html
CVE: CVE-2023-21590
Published: 2023-01-13
Description: Adobe InDesign version 18.0 (and earlier), 17.4 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/indesign/apsb23-07.html; https://helpx.adobe.com/security/products/indesign/apsb23-07.html
CVE: CVE-2023-21591
Published: 2023-01-13
Description: Adobe InDesign version 18.0 (and earlier), 17.4 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/indesign/apsb23-07.html; https://helpx.adobe.com/security/products/indesign/apsb23-07.html
CVE: CVE-2023-21592
Published: 2023-01-13
Description: Adobe InDesign version 18.0 (and earlier), 17.4 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/indesign/apsb23-07.html; https://helpx.adobe.com/security/products/indesign/apsb23-07.html
CVE: CVE-2015-10042
Published: 2023-01-13
Description: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as critical was found in Dovgalyuk AIBattle. Affected by this vulnerability is the function registerUser of the file site/procedures.php. The manipulation of the argument postLogin leads to sql injection. The identifier of the patch is 448e9880aac18ae7832f8d065e03e46ce0f1d3e3. It is recommended to apply a patch to fix this issue. The identifier VDB-218305 was assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/Dovgalyuk/AIBattle-disabled-/commit/448e9880aac18ae7832f8d065e03e46ce0f1d3e3; https://vuldb.com/?ctiid.218305; https://vuldb.com/?id.218305
CVE: CVE-2017-20169
Published: 2023-01-13
Description: A vulnerability, which was classified as critical, has been found in GGGGGGGG ToN-MasterServer. Affected by this issue is some unknown functionality of the file public_html/irc_updater/svr_request_pub.php. The manipulation leads to sql injection. The patch is identified as 3a4c7e6d51bf95760820e3245e06c6e321a7168a. It is recommended to apply a patch to fix this issue. VDB-218306 is the identifier assigned to this vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://github.com/GGGGGGGG/ToN-MasterServer/commit/3a4c7e6d51bf95760820e3245e06c6e321a7168a; https://vuldb.com/?ctiid.218306; https://vuldb.com/?id.218306
CVE: CVE-2021-36204
Published: 2023-01-13
Description: Under some circumstances an Insufficiently Protected Credentials vulnerability in Johnson Controls Metasys ADS/ADX/OAS 10 versions prior to 10.1.6 and 11 versions prior to 11.0.3 allows API calls to expose credentials in plain text.
CVSS Score: 7.8 (HIGH)
CWE: CWE-522, CWE-522
References: https://www.cisa.gov/uscert/ics/advisories/icsa-23-012-06; https://www.johnsoncontrols.com/cyber-solutions/security-advisories; https://www.cisa.gov/uscert/ics/advisories/icsa-23-012-06
CVE: CVE-2022-42136
Published: 2023-01-13
Description: Authenticated mail users, under specific circumstances, could add files with unsanitized content in public folders where the IIS user had permission to access. That action, could lead an attacker to store arbitrary code on that files and execute RCE commands.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22, CWE-22
References: https://pastebin.com/ahLNMf5n; https://www.mailenable.com/kb/content/article.asp?ID=ME020737; https://pastebin.com/ahLNMf5n
CVE: CVE-2022-45299
Published: 2023-01-13
Description: An issue in the IpFile argument of rust-lang webbrowser-rs v0.8.2 allows attackers to access arbitrary files via supplying a crafted URL.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22, CWE-22
References: https://github.com/offalltn/CVE-2022-45299; https://github.com/offalltn/CVE-2022-45299
CVE: CVE-2023-21594
Published: 2023-01-13
Description: Adobe InCopy versions 18.0 (and earlier), 17.4 (and earlier) are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122
References: https://helpx.adobe.com/security/products/incopy/apsb23-08.html; https://helpx.adobe.com/security/products/incopy/apsb23-08.html
CVE: CVE-2023-21595
Published: 2023-01-13
Description: Adobe InCopy versions 18.0 (and earlier), 17.4 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://helpx.adobe.com/security/products/incopy/apsb23-08.html; https://helpx.adobe.com/security/products/incopy/apsb23-08.html
CVE: CVE-2023-21596
Published: 2023-01-13
Description: Adobe InCopy versions 18.0 (and earlier), 17.4 (and earlier) are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://helpx.adobe.com/security/products/incopy/apsb23-08.html; https://helpx.adobe.com/security/products/incopy/apsb23-08.html
CVE: CVE-2023-21597
Published: 2023-01-13
Description: Adobe InCopy versions 18.0 (and earlier), 17.4 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/incopy/apsb23-08.html; https://helpx.adobe.com/security/products/incopy/apsb23-08.html
CVE: CVE-2023-21598
Published: 2023-01-13
Description: Adobe InCopy versions 18.0 (and earlier), 17.4 (and earlier) are affected by a Use After Free vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416, CWE-416
References: https://helpx.adobe.com/security/products/incopy/apsb23-08.html; https://helpx.adobe.com/security/products/incopy/apsb23-08.html
CVE: CVE-2023-21599
Published: 2023-01-13
Description: Adobe InCopy versions 18.0 (and earlier), 17.4 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/incopy/apsb23-08.html; https://helpx.adobe.com/security/products/incopy/apsb23-08.html
CVE: CVE-2022-46093
Published: 2023-01-13
Description: Hospital Management System v1.0 is vulnerable to SQL Injection. Attackers can gain administrator privileges without the need for a password.
CVSS Score: 8.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/Frank-Z7/z-vulnerabilitys/blob/main/Hospital-Management-System/Hospital-Management-System.md; https://github.com/Frank-Z7/z-vulnerabilitys/blob/main/Hospital-Management-System/Hospital-Management-System.md
CVE: CVE-2022-41721
Published: 2023-01-13
Description: A request smuggling attack is possible when using MaxBytesHandler. When using MaxBytesHandler, the body of an HTTP request is not fully consumed. When the server attempts to read HTTP2 frames from the connection, it will instead be reading the body of the HTTP request, which could be attacker-manipulated to represent arbitrary HTTP2 requests.
CVSS Score: 7.5 (HIGH)
CWE: CWE-444
References: https://go.dev/cl/447396; https://go.dev/issue/56352; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X3H3EWQXM2XL5AGBX6UL443JEJ3GQXJN/
CVE: CVE-2022-23532
Published: 2023-01-14
Description: APOC (Awesome Procedures on Cypher) is an add-on library for Neo4j that provides hundreds of procedures and functions. A path traversal vulnerability found in the apoc.export.* procedures of apoc plugins in Neo4j Graph database. The issue allows a malicious actor to potentially break out of the expected directory. The vulnerability is such that files could only be created but not overwritten. For the vulnerability to be exploited, an attacker would need access to execute an arbitrary query, either by having access to an authenticated Neo4j client, or a Cypher injection vulnerability in an application. The minimum versions containing patch for this vulnerability are 4.4.0.12 and 4.3.0.12 and 5.3.1. As a workaround, you can control the allowlist of the procedures that can be used in your system, and/or turn off local file access by setting apoc.export.file.enabled=false.
CVSS Score: 7.1 (HIGH)
CWE: CWE-22
References: https://github.com/neo4j-contrib/neo4j-apoc-procedures/commit/01e63ed2d187cd2a8aa1d78bf831ef0fdd69b522; https://github.com/neo4j-contrib/neo4j-apoc-procedures/security/advisories/GHSA-5v8v-gwmw-qw97; https://github.com/neo4j-contrib/neo4j-apoc-procedures/commit/01e63ed2d187cd2a8aa1d78bf831ef0fdd69b522
CVE: CVE-2022-41955
Published: 2023-01-14
Description: Autolab is a course management service, initially developed by a team of students at Carnegie Mellon University, that enables instructors to offer autograded programming assignments to their students over the Web. A remote code execution vulnerability was discovered in Autolab's MOSS functionality, whereby an instructor with access to the feature might be able to execute code on the server hosting Autolab. This vulnerability has been patched in version 2.10.0. As a workaround, disable the MOSS feature if it is unneeded by replacing the body of `run_moss` in `app/controllers/courses_controller.rb` with `render(plain: "Feature disabled", status: :bad_request) && return`.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-77
References: https://github.com/autolab/Autolab/security/advisories/GHSA-x5r3-vf3p-3269; https://securitylab.github.com/advisories/GHSL-2022-100_Autolab/; https://github.com/autolab/Autolab/security/advisories/GHSA-x5r3-vf3p-3269
CVE: CVE-2022-41956
Published: 2023-01-14
Description: Autolab is a course management service, initially developed by a team of students at Carnegie Mellon University, that enables instructors to offer autograded programming assignments to their students over the Web. A file disclosure vulnerability was discovered in Autolab's remote handin feature, whereby users are able to hand-in assignments using paths outside their submission directory. Users can then view the submission to view the file's contents. The vulnerability has been patched in version 2.10.0. As a workaround, ensure that the field for the remote handin feature is empty (Edit Assessment > Advanced > Remote handin path), and that you are not running Autolab as `root` (or any user that has write access to `/`). Alternatively, disable the remote handin feature if it is unneeded by replacing the body of `local_submit` in `app/controllers/assessment/handin.rb` with `render(plain: "Feature disabled", status: :bad_request) && return`.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://github.com/autolab/Autolab/security/advisories/GHSA-g7x7-mgrv-f24x; https://securitylab.github.com/advisories/GHSL-2022-100_Autolab/; https://www.stackhawk.com/blog/rails-path-traversal-guide-examples-and-prevention/
CVE: CVE-2023-22470
Published: 2023-01-14
Description: Nextcloud Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. A database error can be generated potentially causing a DoS when performed multiple times. There are currently no known workarounds. It is recommended that the Nextcloud Server is upgraded to 1.6.5 or 1.7.3 or 1.8.2.
CVSS Score: 3.5 (LOW)
CWE: CWE-400, CWE-20
References: https://github.com/nextcloud/deck/pull/4059; https://github.com/nextcloud/security-advisories/security/advisories/GHSA-93j5-wx4c-6g88; https://github.com/nextcloud/deck/pull/4059
CVE: CVE-2023-22471
Published: 2023-01-14
Description: Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. Broken access control allows a user to delete attachments of other users. There are currently no known workarounds. It is recommended that the Nextcloud Deck app is upgraded to 1.6.5 or 1.7.3 or 1.8.2.
CVSS Score: 3.5 (LOW)
CWE: CWE-639, CWE-639
References: https://github.com/nextcloud/deck/pull/4173; https://github.com/nextcloud/security-advisories/security/advisories/GHSA-2vw5-pfg6-3wm6; https://github.com/nextcloud/deck/pull/4173
CVE: CVE-2023-22478
Published: 2023-01-14
Description: KubePi is a modern Kubernetes panel. The API interfaces with unauthorized entities and may leak sensitive information. This issue has been patched in version 1.6.4. There are currently no known workarounds.
CVSS Score: 7.3 (HIGH)
CWE: CWE-862
References: https://github.com/KubeOperator/KubePi/commit/0c6774bf5d9003ae4d60257a3f207c131ff4a6d6; https://github.com/KubeOperator/KubePi/releases/tag/v1.6.4; https://github.com/KubeOperator/KubePi/security/advisories/GHSA-gqx8-hxmv-c4v4
CVE: CVE-2023-22480
Published: 2023-01-14
Description: KubeOperator is an open source Kubernetes distribution focused on helping enterprises plan, deploy and operate production-level K8s clusters. In KubeOperator versions 3.16.3 and below, API interfaces with unauthorized entities and can leak sensitive information. This vulnerability could be used to take over the cluster under certain conditions. This issue has been patched in version 3.16.4.

CVSS Score: 7.3 (HIGH)
CWE: CWE-285, CWE-863
References: https://github.com/KubeOperator/KubeOperator/commit/7ef42bf1c16900d13e6376f8be5ecdbfdfb44aaf; https://github.com/KubeOperator/KubeOperator/releases/tag/v3.16.4; https://github.com/KubeOperator/KubeOperator/security/advisories/GHSA-jxgp-jgh3-8jc8
CVE: CVE-2023-22495
Published: 2023-01-14
Description: Izanami is a shared configuration service well-suited for micro-service architecture implementation. Attackers can bypass the authentication in this application when deployed using the official Docker image. Because a hard coded secret is used to sign the authentication token (JWT), an attacker could compromise another instance of Izanami. This issue has been patched in version 1.11.0.

CVSS Score: 9.8 (CRITICAL)
CWE: CWE-288, CWE-798
References: https://github.com/MAIF/izanami/releases/tag/v1.11.0; https://github.com/MAIF/izanami/security/advisories/GHSA-9r7j-m337-792c; https://github.com/MAIF/izanami/releases/tag/v1.11.0
CVE: CVE-2023-22496
Published: 2023-01-14
Description: Netdata is an open source option for real-time infrastructure monitoring and troubleshooting. An attacker with the ability to establish a streaming connection can execute arbitrary commands on the targeted Netdata agent. When an alert is triggered, the function `health_alarm_execute` is called. This function performs different checks and then enqueues a command by calling `spawn_enq_cmd`. This command is populated with several arguments that are not sanitized. One of them is the `registry_hostname` of the node for which the alert is raised. By providing a specially crafted `registry_hostname` as part of the health data that is streamed to a Netdata (parent) agent, an attacker can execute arbitrary commands at the remote host as a side-effect of the raised alert. Note that the commands are executed as the user running the Netdata Agent. This user is usually named `netdata`. The ability to run arbitrary commands may allow an attacker to escalate privileges by escalating other vulnerabilities in the system, as that user. The problem has been fixed in: Netdata agent v1.37 (stable) and Netdata agent v1.36.0-409 (nightly). As a workaround, streaming is not enabled by default. If you have previously enabled this, it can be disabled. Limiting access to the port on the recipient Agent to trusted child connections may mitigate the impact of this vulnerability.
CVSS Score: 8.1 (HIGH)
CWE: CWE-20, CWE-77, CWE-77
References: https://github.com/netdata/netdata/security/advisories/GHSA-xg38-3vmw-2978; https://github.com/netdata/netdata/security/advisories/GHSA-xg38-3vmw-2978
CVE: CVE-2023-22852
Published: 2023-01-14
Description: Tiki through 25.0 allows CSRF attacks that are related to tiki-importer.php and tiki-import_sheet.php.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://karmainsecurity.com/KIS-2023-01; https://tiki.org/articles; https://karmainsecurity.com/KIS-2023-01
CVE: CVE-2023-22853
Published: 2023-01-14
Description: Tiki before 24.1, when feature_create_webhelp is enabled, allows lib/structures/structlib.php PHP Object Injection because of an eval.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94, CWE-94
References: https://karmainsecurity.com/KIS-2023-02; https://tiki.org/articles; https://karmainsecurity.com/KIS-2023-02
CVE: CVE-2023-23589
Published: 2023-01-14
Description: The SafeSocks option in Tor before 0.4.7.13 has a logic error in which the unsafe SOCKS4 protocol can be used but not the safe SOCKS4a protocol, aka TROVE-2022-002.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-693
References: https://gitlab.torproject.org/tpo/core/tor/-/commit/a282145b3634547ab84ccd959d0537c021ff7ffc; https://gitlab.torproject.org/tpo/core/tor/-/issues/40730; https://gitlab.torproject.org/tpo/core/tor/-/raw/release-0.4.7/ReleaseNotes
CVE: CVE-2022-38287
Published: 2023-01-14
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2023-22497
Published: 2023-01-14
Description: Netdata is an open source option for real-time infrastructure monitoring and troubleshooting. Each Netdata Agent has an automatically generated MACHINE GUID. It is generated when the agent first starts and it is saved to disk, so that it will persist across restarts and reboots. Anyone who has access to a Netdata Agent has access to its MACHINE_GUID. Streaming is a feature that allows a Netdata Agent to act as parent for other Netdata Agents (children), offloading children from various functions (increased data retention, ML, health monitoring, etc) that can now be handled by the parent Agent. Configuration is done via `stream.conf`. On the parent side, users configure in `stream.conf` an API key (any random UUID can do) to provide common configuration for all children using this API key and per MACHINE GUID configuration to customize the configuration for each child. The way this was implemented, allowed an attacker to use a valid MACHINE_GUID as an API key. This affects all users who expose their Netdata Agents (children) to non-trusted users and they also expose to the same users Netdata Agent parents that aggregate data from all these children. The problem has been fixed in: Netdata agent v1.37 (stable) and Netdata agent v1.36.0-409 (nightly). As a workaround, do not enable streaming by default. If you have previously enabled this, it can be disabled. Limiting access to the port on the recipient Agent to trusted child connections may mitigate the impact of this vulnerability.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-287, CWE-668
References: https://github.com/netdata/netdata/releases/tag/v1.37.0; https://github.com/netdata/netdata/security/advisories/GHSA-jx85-39cw-66f2; https://github.com/netdata/netdata/releases/tag/v1.37.0
CVE: CVE-2023-22850
Published: 2023-01-14
Description: Tiki before 24.1, when the Spreadsheets feature is enabled, allows lib/sheet/grid.php PHP Object Injection because of an unserialize call.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502, CWE-502
References: https://karmainsecurity.com/KIS-2023-03; https://tiki.org/articles; https://karmainsecurity.com/KIS-2023-03
CVE: CVE-2023-22851
Published: 2023-01-14
Description: Tiki before 24.2 allows lib/importer/tikiimporter_blog_wordpress.php PHP Object Injection by an admin because of an unserialize call.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434, CWE-434
References: https://karmainsecurity.com/KIS-2023-04; https://tiki.org/articles; https://karmainsecurity.com/KIS-2023-04
CVE: CVE-2023-0297
Published: 2023-01-14
Description: Code Injection in GitHub repository pyload/pyload prior to 0.5.0b3.dev31.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: http://packetstormsecurity.com/files/171096/pyLoad-js2py-Python-Execution.html; http://packetstormsecurity.com/files/172914/PyLoad-0.5.0-Remote-Code-Execution.html; https://github.com/pyload/pyload/commit/7d73ba7919e594d783b3411d7ddb87885aea782d
CVE: CVE-2023-0298
Published: 2023-01-14
Description: Incorrect Authorization in GitHub repository firefly-iii/firefly-iii prior to 5.8.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-863, CWE-863
References: https://github.com/firefly-iii/firefly-iii/commit/db0500dcf0d4f1990fc7a377ef0d56c3884fcaa4; https://huntr.dev/bounties/9689052c-c1d7-4aae-aa08-346c9b6e04ed; https://github.com/firefly-iii/firefly-iii/commit/db0500dcf0d4f1990fc7a377ef0d56c3884fcaa4