deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-42411
Published: 2023-01-26
Description: This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JPC files. Crafted data in a JPC file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18306.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://www.tracker-software.com/product/pdf-xchange-editor/history; https://www.zerodayinitiative.com/advisories/ZDI-22-1338/; https://www.tracker-software.com/product/pdf-xchange-editor/history
CVE: CVE-2022-42412
Published: 2023-01-26
Description: This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. Crafted data in a PDF file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18324.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://www.tracker-software.com/product/pdf-xchange-editor/history; https://www.zerodayinitiative.com/advisories/ZDI-22-1341/; https://www.tracker-software.com/product/pdf-xchange-editor/history
CVE: CVE-2022-42413
Published: 2023-01-26
Description: This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JP2 files. Crafted data in a JP2 file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18368.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://www.tracker-software.com/product/pdf-xchange-editor/history; https://www.zerodayinitiative.com/advisories/ZDI-22-1358/; https://www.tracker-software.com/product/pdf-xchange-editor/history
CVE: CVE-2022-42414
Published: 2023-01-26
Description: This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18326.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416, CWE-416
References: https://www.tracker-software.com/product/pdf-xchange-editor/history; https://www.zerodayinitiative.com/advisories/ZDI-22-1342/; https://www.tracker-software.com/product/pdf-xchange-editor/history
CVE: CVE-2022-42415
Published: 2023-01-26
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JP2 files. Crafted data in a JP2 file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18366.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.tracker-software.com/product/pdf-xchange-editor/history; https://www.zerodayinitiative.com/advisories/ZDI-22-1356/; https://www.tracker-software.com/product/pdf-xchange-editor/history
CVE: CVE-2022-42416
Published: 2023-01-26
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of TIF files. Crafted data in a TIF file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18673.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.tracker-software.com/product/pdf-xchange-editor/history; https://www.zerodayinitiative.com/advisories/ZDI-22-1385/; https://www.tracker-software.com/product/pdf-xchange-editor/history
CVE: CVE-2022-42417
Published: 2023-01-26
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of TIF files. Crafted data in a TIF file can trigger a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18676.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-125
References: https://www.tracker-software.com/product/pdf-xchange-editor/history; https://www.zerodayinitiative.com/advisories/ZDI-22-1386/; https://www.tracker-software.com/product/pdf-xchange-editor/history
CVE: CVE-2022-42418
Published: 2023-01-26
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of TIF files. The issue results from the lack of proper validation of a user-supplied value prior to dereferencing it as a pointer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18677.
CVSS Score: 7.8 (HIGH)
CWE: CWE-822, CWE-119
References: https://www.tracker-software.com/product/pdf-xchange-editor/history; https://www.zerodayinitiative.com/advisories/ZDI-22-1387/; https://www.tracker-software.com/product/pdf-xchange-editor/history
CVE: CVE-2022-42419
Published: 2023-01-26
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of TIF files. Crafted data in a TIF file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18700.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.tracker-software.com/product/pdf-xchange-editor/history; https://www.zerodayinitiative.com/advisories/ZDI-22-1389/; https://www.tracker-software.com/product/pdf-xchange-editor/history
CVE: CVE-2022-42420
Published: 2023-01-26
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of TIF files. Crafted data in a TIF file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18686.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.tracker-software.com/product/pdf-xchange-editor/history; https://www.zerodayinitiative.com/advisories/ZDI-22-1388/; https://www.tracker-software.com/product/pdf-xchange-editor/history
CVE: CVE-2022-42421
Published: 2023-01-26
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of TIF files. Crafted data in a TIF file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18703.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.tracker-software.com/product/pdf-xchange-editor/history; https://www.zerodayinitiative.com/advisories/ZDI-22-1393/; https://www.tracker-software.com/product/pdf-xchange-editor/history
CVE: CVE-2022-42423
Published: 2023-01-26
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of TIF files. Crafted data in a TIF file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18716.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.tracker-software.com/product/pdf-xchange-editor/history; https://www.zerodayinitiative.com/advisories/ZDI-22-1390/; https://www.tracker-software.com/product/pdf-xchange-editor/history
CVE: CVE-2018-25078
Published: 2023-01-26
Description: man-db before 2.8.5 on Gentoo allows local users (with access to the man user account) to gain root privileges because /usr/bin/mandb is executed by root but not owned by root. (Also, the owner can strip the setuid and setgid bits.)
CVSS Score: 7.8 (HIGH)
CWE: CWE-250
References: https://bugs.gentoo.org/662438; https://security.gentoo.org/glsa/202310-08; https://bugs.gentoo.org/662438
CVE: CVE-2020-18329
Published: 2023-01-26
Description: An issue was discovered in Rehau devices that use a pCOWeb card BIOS v6.27, BOOT v5.00, web version v2.2, allows attackers to gain full unauthenticated access to the configuration and service interface.
CVSS Score: 7.5 (HIGH)
CWE: CWE-281, CWE-281
References: https://github.com/cybertoxin/CVEs/blob/main/CVE_2020_18329.md; https://medium.com/%40SergiuSechel/insecure-permissions-in-rehau-group-unlimited-polymer-solutions-implementation-of-carel-pcoweb-514c148ae694; https://github.com/cybertoxin/CVEs/blob/main/CVE_2020_18329.md
CVE: CVE-2020-18330
Published: 2023-01-26
Description: An issue was discovered in the default configuration of ChinaMobile PLC Wireless Router model GPN2.4P21-C-CN running the firmware version W2000EN-01(hardware platform Gpn2.4P21-C_WIFI-V0.05), allows attackers to gain access to the configuration interface.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-22, CWE-22
References: https://github.com/cybertoxin/CVEs/blob/main/CVE_2020_18330.md; https://medium.com/%40SergiuSechel/insecure-permissions-and-multiple-vulnerabilities-in-chinamobile-plc-wireless-routers-leaves-more-d3eb9ff70d24; https://github.com/cybertoxin/CVEs/blob/main/CVE_2020_18330.md
CVE: CVE-2020-18331
Published: 2023-01-26
Description: Directory traversal vulnerability in ChinaMobile PLC Wireless Router model GPN2.4P21-C-CN running the firmware version W2000EN-01(hardware platform Gpn2.4P21-C_WIFI-V0.05), via the getpage parameter to /cgi-bin/webproc.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-22, CWE-22
References: https://github.com/cybertoxin/CVEs/blob/main/CVE_2020_18331.md; https://medium.com/%40SergiuSechel/insecure-permissions-and-multiple-vulnerabilities-in-chinamobile-plc-wireless-routers-leaves-more-d3eb9ff70d24; https://github.com/cybertoxin/CVEs/blob/main/CVE_2020_18331.md
CVE: CVE-2020-22327
Published: 2023-01-26
Description: An issue was discovered in HFish 0.5.1. When a payload is inserted where the name is entered, XSS code is triggered when the administrator views the information.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/hacklcx/HFish/issues/61; https://github.com/hacklcx/HFish/issues/61
CVE: CVE-2020-22452
Published: 2023-01-26
Description: SQL Injection vulnerability in function getTableCreationQuery in CreateAddField.php in phpMyAdmin 5.x before 5.2.0 via the tbl_storage_engine or tbl_collation parameters to tbl_create.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: http://phpmyadmin.com; https://github.com/phpmyadmin/phpmyadmin/blob/master/ChangeLog; https://github.com/phpmyadmin/phpmyadmin/issues/15898
CVE: CVE-2020-36657
Published: 2023-01-26
Description: uptimed before 0.4.6-r1 on Gentoo allows local users (with access to the uptimed user account) to gain root privileges by creating a hard link within the /var/spool/uptimed directory, because there is an unsafe chown -R call.
CVSS Score: 7.8 (HIGH)
CWE: CWE-59
References: https://bugs.gentoo.org/630810; https://security.gentoo.org/glsa/202305-14; https://bugs.gentoo.org/630810
CVE: CVE-2021-28510
Published: 2023-01-26
Description: For certain systems running EOS, a Precision Time Protocol (PTP) packet of a management/signaling message with an invalid Type-Length-Value (TLV) causes the PTP agent to restart. Repeated restarts of the service will make the service unavailable.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-400, CWE-1284
References: https://www.arista.com/en/support/advisories-notices/security-advisory/15439-security-advisory-0076; https://www.arista.com/en/support/advisories-notices/security-advisory/15439-security-advisory-0076
CVE: CVE-2021-36539
Published: 2023-01-26
Description: Instructure Canvas LMS didn't properly deny access to locked/unpublished files when the unprivileged user access the DocViewer based file preview URL (canvadoc_session_url).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-639
References: https://github.com/gaukas/instructure-canvas-file-oracle; https://github.com/instructure/canvas-lms/issues/1905; https://github.com/gaukas/instructure-canvas-file-oracle
CVE: CVE-2021-36686
Published: 2023-01-26
Description: Cross Site Scripting (XSS) vulnerability in yapi 1.9.1 allows attackers to execute arbitrary code via the /interface/api edit page.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/YMFE/yapi/issues/2190; https://github.com/YMFE/yapi/issues/2240; https://github.com/YMFE/yapi/issues/2190
CVE: CVE-2021-41988
Published: 2023-01-26
Description: Qlik NPrinting Designer through 21.14.3.0 creates a Temporary File in a Directory with Insecure Permissions.
CVSS Score: 7.8 (HIGH)
CWE: CWE-668, CWE-668
References: https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2023/MNDT-2023-0002.md; https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2023/MNDT-2023-0002.md
CVE: CVE-2021-41989
Published: 2023-01-26
Description: Qlik QlikView through 12.60.20100.0 creates a Temporary File in a Directory with Insecure Permissions.
CVSS Score: 7.8 (HIGH)
CWE: CWE-668, CWE-668
References: https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2023/MNDT-2023-0001.md; https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2023/MNDT-2023-0001.md
CVE: CVE-2022-1890
Published: 2023-01-26
Description: A buffer overflow in the ReadyBootDxe driver in some Lenovo Notebook products may allow an attacker with local privileges to execute arbitrary code.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-122, CWE-787
References: https://support.lenovo.com/us/en/product_security/LEN-91369; https://support.lenovo.com/us/en/product_security/LEN-91369
CVE: CVE-2022-1891
Published: 2023-01-26
Description: A buffer overflow in the SystemLoadDefaultDxe driver in some Lenovo Notebook products may allow an attacker with local privileges to execute arbitrary code.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-122, CWE-120
References: https://support.lenovo.com/us/en/product_security/LEN-91369; https://support.lenovo.com/us/en/product_security/LEN-91369
CVE: CVE-2022-1892
Published: 2023-01-26
Description: A buffer overflow in the SystemBootManagerDxe driver in some Lenovo Notebook products may allow an attacker with local privileges to execute arbitrary code.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-122, CWE-120
References: https://support.lenovo.com/us/en/product_security/LEN-91369; https://support.lenovo.com/us/en/product_security/LEN-91369
CVE: CVE-2022-20213
Published: 2023-01-26
Description: In ApplicationsDetailsActivity of AndroidManifest.xml, there is a possible DoS due to a tapjacking/overlay attack. This could lead to local denial of service with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12Android ID: A-183410508
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-1021, CWE-1021
References: https://source.android.com/security/bulletin/aaos/2023-01-01; https://source.android.com/security/bulletin/aaos/2023-01-01
CVE: CVE-2022-20214
Published: 2023-01-26
Description: In Car Settings app, the toggle button in Modify system settings is vulnerable to tapjacking attack. Attackers can overlay the toggle button to enable apps to modify system settings without user consent.Product: AndroidVersions: Android-10 Android-11 Android-12Android ID: A-183411210
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-1021, CWE-1021
References: https://source.android.com/security/bulletin/aaos/2023-01-01; https://source.android.com/security/bulletin/aaos/2023-01-01
CVE: CVE-2022-20215
Published: 2023-01-26
Description: In onCreate of MasterClearConfirmFragment.java, there is a possible factory reset due to a tapjacking/overlay attack. This could lead to local denial of service with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12Android ID: A-183794206
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-1021, CWE-1021
References: https://source.android.com/security/bulletin/aaos/2023-01-01; https://source.android.com/security/bulletin/aaos/2023-01-01
CVE: CVE-2022-20235
Published: 2023-01-26
Description: The PowerVR GPU kernel driver maintains an "Information Page" used by its cache subsystem. This page can only be written by the GPU driver itself, but prior to DDK 1.18 however, a user-space program could write arbitrary data to the page, leading to memory corruption issues.Product: AndroidVersions: Android SoCAndroid ID: A-259967780
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://source.android.com/security/bulletin/2023-01-01; https://source.android.com/security/bulletin/2023-01-01
CVE: CVE-2022-20456
Published: 2023-01-26
Description: In AutomaticZenRule of AutomaticZenRule.java, there is a possible failure to persist permissions settings due to resource exhaustion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-242703780
CVSS Score: 7.8 (HIGH)
CWE: CWE-770, CWE-276
References: https://source.android.com/security/bulletin/2023-01-01; https://source.android.com/security/bulletin/2023-01-01
CVE: CVE-2022-20458
Published: 2023-01-26
Description: The logs of sensitive information (PII) or hardware identifier should only be printed in Android "userdebug" or "eng" build. StatusBarNotification.getKey() could contain sensitive information. However, CarNotificationListener.java, it prints out the StatusBarNotification.getKey() directly in logs, which could contain user's account name (i.e. PII), in Android "user" build.Product: AndroidVersions: Android-12LAndroid ID: A-205567776
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-532, CWE-532
References: https://source.android.com/security/bulletin/aaos/2023-01-01; https://source.android.com/security/bulletin/aaos/2023-01-01
CVE: CVE-2022-20461
Published: 2023-01-26
Description: In pinReplyNative of com_android_bluetooth_btservice_AdapterService.cpp, there is a possible out of bounds read due to type confusion. This could lead to local escalation of privilege of BLE with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-228602963
CVSS Score: 7.8 (HIGH)
CWE: CWE-843, CWE-843
References: https://source.android.com/security/bulletin/2023-01-01; https://source.android.com/security/bulletin/2023-01-01
CVE: CVE-2022-20489
Published: 2023-01-26
Description: In many functions of AutomaticZenRule.java, there is a possible failure to persist permissions settings due to resource exhaustion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-242703460
CVSS Score: 7.8 (HIGH)
CWE: CWE-770, CWE-770
References: https://source.android.com/security/bulletin/2023-01-01; https://source.android.com/security/bulletin/2023-01-01
CVE: CVE-2022-20490
Published: 2023-01-26
Description: In multiple functions of AutomaticZenRule.java, there is a possible failure to persist permissions settings due to resource exhaustion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-242703505
CVSS Score: 7.8 (HIGH)
CWE: CWE-770, CWE-770
References: https://source.android.com/security/bulletin/2023-01-01; https://source.android.com/security/bulletin/2023-01-01
CVE: CVE-2022-20492
Published: 2023-01-26
Description: In many functions of AutomaticZenRule.java, there is a possible failure to persist permissions settings due to resource exhaustion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-242704043
CVSS Score: 7.8 (HIGH)
CWE: CWE-770, CWE-770
References: https://source.android.com/security/bulletin/2023-01-01; https://source.android.com/security/bulletin/2023-01-01
CVE: CVE-2022-20493
Published: 2023-01-26
Description: In Condition of Condition.java, there is a possible way to grant notification access due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-242846316
CVSS Score: 7.8 (HIGH)
CWE: CWE-1284, CWE-1284
References: https://source.android.com/security/bulletin/2023-01-01; https://source.android.com/security/bulletin/2023-01-01
CVE: CVE-2022-20494
Published: 2023-01-26
Description: In AutomaticZenRule of AutomaticZenRule.java, there is a possible persistent DoS due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-243794204
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-770, CWE-770
References: https://source.android.com/security/bulletin/2023-01-01; https://source.android.com/security/bulletin/2023-01-01