deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-24960
Published: 2023-02-17
Description: IBM InfoSphere Information Server 11.7 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system.  IBM X-Force ID:  246333
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/246333; https://www.ibm.com/support/pages/node/6953521; https://exchange.xforce.ibmcloud.com/vulnerabilities/246333
CVE: CVE-2023-23921
Published: 2023-02-17
Description: The vulnerability was found Moodle which exists due to insufficient sanitization of user-supplied data in some returnurl parameters. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website. This flaw allows a remote attacker to perform cross-site scripting (XSS) attacks.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-76810; https://bugzilla.redhat.com/show_bug.cgi?id=2162526; https://moodle.org/mod/forum/discuss.php?d=443272#p1782021
CVE: CVE-2023-23922
Published: 2023-02-17
Description: The vulnerability was found Moodle which exists due to insufficient sanitization of user-supplied data in blog search. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website. This flaw allows a remote attacker to perform cross-site scripting (XSS) attacks.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-76861; https://bugzilla.redhat.com/show_bug.cgi?id=2162547; https://moodle.org/mod/forum/discuss.php?d=443273#p1782022
CVE: CVE-2023-23923
Published: 2023-02-17
Description: The vulnerability was found Moodle which exists due to insufficient limitations on the "start page" preference. A remote attacker can set that preference for another user. The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.
CVSS Score: 8.2 (HIGH)
CWE: CWE-284, CWE-284
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-76862; https://bugzilla.redhat.com/show_bug.cgi?id=2162549; https://moodle.org/mod/forum/discuss.php?d=443274#p1782023
CVE: CVE-2023-24809
Published: 2023-02-17
Description: NetHack is a single player dungeon exploration game. Starting with version 3.6.2 and prior to version 3.6.7, illegal input to the "C" (call) command can cause a buffer overflow and crash the NetHack process. This vulnerability may be a security issue for systems that have NetHack installed suid/sgid and for shared systems. For all systems, it may result in a process crash. This issue is resolved in NetHack 3.6.7. There are no known workarounds.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-120, CWE-120
References: https://github.com/NetHack/NetHack/security/advisories/GHSA-2cqv-5w4v-mgch; https://nethack.org/security/CVE-2023-24809.html; https://github.com/NetHack/NetHack/security/advisories/GHSA-2cqv-5w4v-mgch
CVE: CVE-2021-26277
Published: 2023-02-17
Description: The framework service handles pendingIntent incorrectly, allowing a malicious application with certain privileges to perform privileged actions.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-94
References: https://www.vivo.com/en/support/security-advisory-detail?id=8; https://www.vivo.com/en/support/security-advisory-detail?id=8
CVE: CVE-2022-40021
Published: 2023-02-17
Description: QVidium Technologies Amino A140 (prior to firmware version 1.0.0-283) was discovered to contain a command injection vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-77
References: https://www.securifera.com/advisories/CVE-2022-40021/; https://www.securifera.com/advisories/CVE-2022-40021/
CVE: CVE-2022-48115
Published: 2023-02-17
Description: The dropdown menu in jspreadsheet before v4.6.0 was discovered to be vulnerable to cross-site scripting (XSS).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/jspreadsheet/ce; https://github.com/jspreadsheet/ce/issues/1587; https://github.com/jspreadsheet/ce
CVE: CVE-2023-0482
Published: 2023-02-17
Description: In RESTEasy the insecure File.createTempFile() is used in the DataSourceProvider, FileProvider and Mime4JWorkaround classes which creates temp files with insecure permissions that could be read by a local user.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-378, CWE-378
References: https://github.com/resteasy/resteasy/pull/3409/commits/807d7456f2137cde8ef7c316707211bf4e542d56; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://github.com/resteasy/resteasy/pull/3409/commits/807d7456f2137cde8ef7c316707211bf4e542d56
CVE: CVE-2023-21574
Published: 2023-02-17
Description: Photoshop version 23.5.3 (and earlier), 24.1 (and earlier) are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://helpx.adobe.com/security/products/photoshop/apsb23-11.html; https://helpx.adobe.com/security/products/photoshop/apsb23-11.html
CVE: CVE-2023-21575
Published: 2023-02-17
Description: Photoshop version 23.5.3 (and earlier), 24.1 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://helpx.adobe.com/security/products/photoshop/apsb23-11.html; https://helpx.adobe.com/security/products/photoshop/apsb23-11.html
CVE: CVE-2023-21576
Published: 2023-02-17
Description: Photoshop version 23.5.3 (and earlier), 24.1 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/photoshop/apsb23-11.html; https://helpx.adobe.com/security/products/photoshop/apsb23-11.html
CVE: CVE-2023-21577
Published: 2023-02-17
Description: Photoshop version 23.5.3 (and earlier), 24.1 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/photoshop/apsb23-11.html; https://helpx.adobe.com/security/products/photoshop/apsb23-11.html
CVE: CVE-2023-21578
Published: 2023-02-17
Description: Photoshop version 23.5.3 (and earlier), 24.1 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/photoshop/apsb23-11.html; https://helpx.adobe.com/security/products/photoshop/apsb23-11.html
CVE: CVE-2023-21583
Published: 2023-02-17
Description: Adobe Bridge versions 12.0.3 (and earlier) and 13.0.1 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/bridge/apsb23-09.html; https://helpx.adobe.com/security/products/bridge/apsb23-09.html
CVE: CVE-2023-21584
Published: 2023-02-17
Description: FrameMaker 2020 Update 4 (and earlier), 2022 (and earlier) are affected by a Use After Free vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416
References: https://helpx.adobe.com/security/products/framemaker/apsb23-06.html; https://helpx.adobe.com/security/products/framemaker/apsb23-06.html
CVE: CVE-2023-21593
Published: 2023-02-17
Description: Adobe InDesign versions ID18.1 (and earlier) and ID17.4 (and earlier) are affected by a NULL Pointer Dereference vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://helpx.adobe.com/security/products/indesign/apsb23-12.html; https://helpx.adobe.com/security/products/indesign/apsb23-12.html
CVE: CVE-2023-21619
Published: 2023-02-17
Description: FrameMaker 2020 Update 4 (and earlier), 2022 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/framemaker/apsb23-06.html; https://helpx.adobe.com/security/products/framemaker/apsb23-06.html
CVE: CVE-2023-21620
Published: 2023-02-17
Description: FrameMaker 2020 Update 4 (and earlier), 2022 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/framemaker/apsb23-06.html; https://helpx.adobe.com/security/products/framemaker/apsb23-06.html
CVE: CVE-2023-21621
Published: 2023-02-17
Description: FrameMaker 2020 Update 4 (and earlier), 2022 (and earlier) are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://helpx.adobe.com/security/products/framemaker/apsb23-06.html; https://helpx.adobe.com/security/products/framemaker/apsb23-06.html
CVE: CVE-2023-21622
Published: 2023-02-17
Description: FrameMaker 2020 Update 4 (and earlier), 2022 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/framemaker/apsb23-06.html; https://helpx.adobe.com/security/products/framemaker/apsb23-06.html
CVE: CVE-2023-22226
Published: 2023-02-17
Description: Adobe Bridge versions 12.0.3 (and earlier) and 13.0.1 (and earlier) are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://helpx.adobe.com/security/products/bridge/apsb23-09.html; https://helpx.adobe.com/security/products/bridge/apsb23-09.html
CVE: CVE-2023-22227
Published: 2023-02-17
Description: Adobe Bridge versions 12.0.3 (and earlier) and 13.0.1 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/bridge/apsb23-09.html; https://helpx.adobe.com/security/products/bridge/apsb23-09.html
CVE: CVE-2023-22228
Published: 2023-02-17
Description: Adobe Bridge versions 12.0.3 (and earlier) and 13.0.1 (and earlier) are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://helpx.adobe.com/security/products/bridge/apsb23-09.html; https://helpx.adobe.com/security/products/bridge/apsb23-09.html
CVE: CVE-2023-22229
Published: 2023-02-17
Description: Adobe Bridge versions 12.0.3 (and earlier) and 13.0.1 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/bridge/apsb23-09.html; https://helpx.adobe.com/security/products/bridge/apsb23-09.html
CVE: CVE-2023-22230
Published: 2023-02-17
Description: Adobe Bridge versions 12.0.3 (and earlier) and 13.0.1 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://helpx.adobe.com/security/products/bridge/apsb23-09.html; https://helpx.adobe.com/security/products/bridge/apsb23-09.html
CVE: CVE-2023-22231
Published: 2023-02-17
Description: Adobe Bridge versions 12.0.3 (and earlier) and 13.0.1 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/bridge/apsb23-09.html; https://helpx.adobe.com/security/products/bridge/apsb23-09.html
CVE: CVE-2023-22232
Published: 2023-02-17
Description: Adobe Connect versions 11.4.5 (and earlier), 12.1.5 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to impact the integrity of a minor feature. Exploitation of this issue does not require user interaction.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-284
References: http://packetstormsecurity.com/files/171390/Adobe-Connect-11.4.5-12.1.5-Local-File-Disclosure.html; https://helpx.adobe.com/security/products/connect/apsb23-05.html; http://packetstormsecurity.com/files/171390/Adobe-Connect-11.4.5-12.1.5-Local-File-Disclosure.html
CVE: CVE-2023-22233
Published: 2023-02-17
Description: After Affects versions 23.1 (and earlier), 22.6.3 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/after_effects/apsb23-02.html; https://helpx.adobe.com/security/products/after_effects/apsb23-02.html
CVE: CVE-2023-22234
Published: 2023-02-17
Description: Adobe Premiere Rush version 2.6 (and earlier) is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://helpx.adobe.com/security/products/premiere_rush/apsb23-14.html; https://helpx.adobe.com/security/products/premiere_rush/apsb23-14.html
CVE: CVE-2023-22236
Published: 2023-02-17
Description: Adobe Animate versions 22.0.8 (and earlier) and 23.0.0 (and earlier) are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://helpx.adobe.com/security/products/animate/apsb23-15.html; https://helpx.adobe.com/security/products/animate/apsb23-15.html
CVE: CVE-2023-22237
Published: 2023-02-17
Description: After Affects versions 23.1 (and earlier), 22.6.3 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/after_effects/apsb23-02.html; https://helpx.adobe.com/security/products/after_effects/apsb23-02.html
CVE: CVE-2023-22238
Published: 2023-02-17
Description: After Affects versions 23.1 (and earlier), 22.6.3 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/after_effects/apsb23-02.html; https://helpx.adobe.com/security/products/after_effects/apsb23-02.html
CVE: CVE-2023-22239
Published: 2023-02-17
Description: After Affects versions 23.1 (and earlier), 22.6.3 (and earlier) are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://helpx.adobe.com/security/products/after_effects/apsb23-02.html; https://helpx.adobe.com/security/products/after_effects/apsb23-02.html
CVE: CVE-2023-22243
Published: 2023-02-17
Description: Adobe Animate versions 22.0.8 (and earlier) and 23.0.0 (and earlier) are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://helpx.adobe.com/security/products/animate/apsb23-15.html; https://helpx.adobe.com/security/products/animate/apsb23-15.html
CVE: CVE-2023-22244
Published: 2023-02-17
Description: Adobe Premiere Rush version 2.6 (and earlier) is affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://helpx.adobe.com/security/products/premiere_rush/apsb23-14.html; https://helpx.adobe.com/security/products/premiere_rush/apsb23-14.html
CVE: CVE-2023-22246
Published: 2023-02-17
Description: Adobe Animate versions 22.0.8 (and earlier) and 23.0.0 (and earlier) are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://helpx.adobe.com/security/products/animate/apsb23-15.html; https://helpx.adobe.com/security/products/animate/apsb23-15.html
CVE: CVE-2023-23064
Published: 2023-02-17
Description: TOTOLINK A720R V4.1.5cu.532_ B20210610 is vulnerable to Incorrect Access Control.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-863, CWE-863
References: https://github.com/shellpei/TOTOLINK-Unauthorized/blob/main/CVE-2023-23064; https://github.com/shellpei/TOTOLINK-Unauthorized/blob/main/CVE-2023-23064
CVE: CVE-2023-24769
Published: 2023-02-17
Description: Changedetection.io before v0.40.1.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the main page. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the URL parameter under the "Add a new change detection watch" function.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/dgtlmoon/changedetection.io/issues/1358; https://www.edoardoottavianelli.it/CVE-2023-24769; https://www.youtube.com/watch?v=TRTpRlkU3Hc
CVE: CVE-2021-32843
Published: 2023-02-17
Description: HyperKit is a toolkit for embedding hypervisor capabilities in an application. In versions 0.20210107 and prior of HyperKit, `virtio.c` has is a call to `vc_cfgread` that does not check for null which when called makes the host crash. This issue may lead to a guest crashing the host causing a denial of service. This issue is fixed in commit df0e46c7dbfd81a957d85e449ba41b52f6f7beb4.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://github.com/moby/hyperkit/commit/df0e46c7dbfd81a957d85e449ba41b52f6f7beb4; https://github.com/moby/hyperkit/pull/313; https://securitylab.github.com/advisories/GHSL-2021-054_057-moby-hyperkit/
CVE: CVE-2021-32844
Published: 2023-02-17
Description: HyperKit is a toolkit for embedding hypervisor capabilities in an application. In versions 0.20210107 and prior of HyperKit, ` vi_pci_write` has is a call to `vc_cfgwrite` that does not check for null which when called makes the host crash. This issue may lead to a guest crashing the host causing a denial of service. This issue is fixed in commit 451558fe8aaa8b24e02e34106e3bb9fe41d7ad13.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://github.com/moby/hyperkit/commit/451558fe8aaa8b24e02e34106e3bb9fe41d7ad13; https://github.com/moby/hyperkit/pull/313; https://securitylab.github.com/advisories/GHSL-2021-054_057-moby-hyperkit/
CVE: CVE-2021-32845
Published: 2023-02-17
Description: HyperKit is a toolkit for embedding hypervisor capabilities in an application. In versions 0.20210107 and prior of HyperKit, the implementation of `qnotify` at `pci_vtrnd_notify` fails to check the return value of `vq_getchain`. This leads to `struct iovec iov;` being uninitialized and used to read memory in `len = (int) read(sc->vrsc_fd, iov.iov_base, iov.iov_len);` when an attacker is able to make `vq_getchain` fail. This issue may lead to a guest crashing the host causing a denial of service and, under certain circumstance, memory corruption. This issue is fixed in commit 41272a980197917df8e58ff90642d14dec8fe948.
CVSS Score: 7.7 (HIGH)
CWE: CWE-908, CWE-252
References: https://github.com/moby/hyperkit/commit/41272a980197917df8e58ff90642d14dec8fe948; https://github.com/moby/hyperkit/pull/313; https://securitylab.github.com/advisories/GHSL-2021-054_057-moby-hyperkit/