deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-33972
Published: 2023-04-19
Description: Buffer Overflow vulnerability in Qihoo 360 Safe Browser v13.0.2170.0 allows attacker to escalate priveleges.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-120, CWE-120
References: https://MemoryCorruptor.blogspot.com/p/vulnerabilities-disclosures.html; https://pastebin.com/qDedtZf3; https://www.youtube.com/channel/UCLJ6fZxUqbmPe4jiwC6o4hg/
CVE: CVE-2021-33973
Published: 2023-04-19
Description: Buffer Overflow vulnerability in Qihoo 360 Safe guard v12.1.0.1004, v12.1.0.1005, v13.1.0.1001 allows attacker to escalate priveleges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120, CWE-120
References: https://MemoryCorruptor.blogspot.com/p/vulnerabilities-disclosures.html; https://pastebin.com/fsLDebg5; https://www.youtube.com/channel/UCLJ6fZxUqbmPe4jiwC6o4hg/
CVE: CVE-2021-33974
Published: 2023-04-19
Description: Qihoo 360 (https://www.360.cn/) Qihoo 360 Safeguard (https://www.360.cn/) Qihoo 360 Chrome (https://browser.360.cn/ee/) is affected by: Buffer Overflow. The impact is: execute arbitrary code (remote). The component is: This is a set of vulnerabilities affecting popular software, and the installation packages correspond to versions "360 Safeguard(12.1.0.1004,12.1.0.1005,13.1.0.1001)" , "360 Total Security(10.8.0.1060,10.8.0.1213)", "360 Safe Browser & 360 Chrome(12. The attack vector is: On the browser vulnerability, just open a link to complete the vulnerability exploitation remotely; on the client software, you need to locally execute the vulnerability exploitation program, which of course can be achieved with the full chain of browser vulnerability. ¶¶ This is a set of the most serious vulnerabilities that exist on Qihoo 360's PC client multiple popular software, remote vulnerabilities can be accomplished by opening a link to arbitrary code execution on both security browsers, in conjunction with the exploitation of local vulnerabilities that allow spyware to persist without being scanned to permanently reside on the target PC computer (because local vulnerabilities target Qihoo 360 company's antivirus software kernel flaws); this set of remote and local vulnerabilities in perfect coordination, to achieve an information security fallacy, on Qihoo 360's antivirus software vulnerability, not only can not be scanned out of the virus, but will help the virus persistently control the target computer, while Qihoo 360 claims to be a secure browser, which exists in the kernel vulnerability but help the composition of the remote vulnerability.(Security expert "Memory Corruptor" have reported this set of vulnerabilities to the corresponding vendor, all vulnerabilities have been fixed and the vendor rewarded thousands of dollars to this security expert)
CVSS Score: 8.8 (HIGH)
CWE: CWE-120, CWE-120
References: https://MemoryCorruptor.blogspot.com/p/vulnerabilities-disclosures.html; https://pastebin.com/ms1ivjYe; https://MemoryCorruptor.blogspot.com/p/vulnerabilities-disclosures.html
CVE: CVE-2021-33975
Published: 2023-04-19
Description: Buffer Overflow vulnerability in Qihoo 360 Total Security v10.8.0.1060 and v10.8.0.1213 allows attacker to escalate privileges.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-120, CWE-120
References: https://MemoryCorruptor.blogspot.com/p/vulnerabilities-disclosures.html; https://pastebin.com/ivNL7s0n; https://www.youtube.com/channel/UCLJ6fZxUqbmPe4jiwC6o4hg/
CVE: CVE-2021-33970
Published: 2023-04-19
Description: Buffer Overflow vulnerability in Qihoo 360 Chrome v13.0.2170.0 allows attacker to escalate priveleges.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-843, CWE-843
References: https://MemoryCorruptor.blogspot.com/p/vulnerabilities-disclosures.html; https://pastebin.com/Qug7tquW; https://www.youtube.com/channel/UCLJ6fZxUqbmPe4jiwC6o4hg/
CVE: CVE-2021-33971
Published: 2023-04-19
Description: Qihoo 360 (https://www.360.cn/) Qihoo 360 Safeguard (https://www.360.cn/) Qihoo 360 Total Security (http://www.360totalsecurity.com/) is affected by: Buffer Overflow. The impact is: execute arbitrary code (local). The component is: This is a set of vulnerabilities affecting popular software, "360 Safeguard(12.1.0.1004,12.1.0.1005,13.1.0.1001)" , "360 Total Security(10.8.0.1060,10.8.0.1213)", "360 Safe Browser & 360 Chrome(13.0.2170.0)". The attack vector is: On the browser vulnerability, just open a link to complete the vulnerability exploitation remotely; on the client software, you need to locally execute the vulnerability exploitation program, which of course can be achieved with the full chain of browser vulnerability. ¶¶ This is a set of the most serious vulnerabilities that exist on Qihoo 360's PC client a variety of popular software, remote vulnerabilities can be completed by opening a link to arbitrary code execution on both security browsers, with the use of local vulnerabilities, not only help the vulnerability code constitutes an escalation of privileges, er can make the spyware persistent without being scanned permanently resides on the target PC computer (because local vulnerability against Qihoo 360 company's antivirus kernel flaws); this group of remote and local vulnerability of the perfect match, to achieve an information security fallacy, in Qihoo 360's antivirus vulnerability, not only can not be scanned out of the virus, but will help the virus persistently control the target computer, while Qihoo 360 claims to be a safe browser, which exists in the kernel vulnerability but helped the composition of the remote vulnerability. (Security expert "Memory Corruptor" have reported this set of vulnerabilities to the corresponding vendor, all vulnerabilities have been fixed and the vendor rewarded thousands of dollars to the security experts)
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://MemoryCorruptor.blogspot.com/p/vulnerabilities-disclosures.html; https://pastebin.com/31v5JMcG; https://www.youtube.com/channel/UCLJ6fZxUqbmPe4jiwC6o4hg/
CVE: CVE-2021-3429
Published: 2023-04-19
Description: When instructing cloud-init to set a random password for a new user account, versions before 21.2 would write that password to the world-readable log file /var/log/cloud-init-output.log. This could allow a local user to log in as another user.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-532, CWE-532, CWE-532
References: https://github.com/canonical/cloud-init/commit/b794d426b9ab43ea9d[PII_REDACTED]070d86e10668; https://github.com/canonical/cloud-init/commit/b794d426b9ab43ea9d[PII_REDACTED]070d86e10668
CVE: CVE-2022-2084
Published: 2023-04-19
Description: Sensitive data could be exposed in world readable logs of cloud-init before version 22.3 when schema failures are reported. This leak could include hashed passwords.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-532, CWE-532, CWE-532
References: https://github.com/canonical/cloud-init/commit/4d467b14363d800b2185b89790d57871f11ea88c; https://ubuntu.com/security/notices/USN-5496-1; https://github.com/canonical/cloud-init/commit/4d467b14363d800b2185b89790d57871f11ea88c
CVE: CVE-2023-1382
Published: 2023-04-19
Description: A data race flaw was found in the Linux kernel, between where con is allocated and con->sock is set. This issue leads to a NULL pointer dereference when accessing con->sock->sk in net/tipc/topsrv.c in the tipc protocol in the Linux kernel.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://lore.kernel.org/netdev/bc7bd3183f1c275c820690fc65b708238fe9e38e[PII_REDACTED].git.lucien.xin%40gmail.com/T/#u; https://lore.kernel.org/netdev/bc7bd3183f1c275c820690fc65b708238fe9e38e[PII_REDACTED].git.lucien.xin%40gmail.com/T/#u
CVE: CVE-2023-23451
Published: 2023-04-19
Description: The Flexi Classic and Flexi Soft Gateways SICK UE410-EN3 FLEXI ETHERNET GATEW. with serial number <=2311xxxx all Firmware versions, SICK UE410-EN1 FLEXI ETHERNET GATEW. with serial number <=2311xxxx all Firmware versions, SICK UE410-EN3S04 FLEXI ETHERNET GATEW. with serial number <=2311xxxx all Firmware versions, SICK UE410-EN4 FLEXI ETHERNET GATEW. with serial number <=2311xxxx all Firmware versions, SICK FX0-GENT00000 FLEXISOFT EIP GATEW. with serial number <=2311xxxx with Firmware <=V2.11.0, SICK FX0-GMOD00000 FLEXISOFT MOD GATEW. with serial number <=2311xxxx with Firmware <=V2.11.0, SICK FX0-GPNT00000 FLEXISOFT PNET GATEW. with serial number <=2311xxxx with Firmware <=V2.12.0, SICK FX0-GENT00030 FLEXISOFT EIP GATEW.V2 with serial number <=2311xxxx all Firmware versions, SICK FX0-GPNT00030 FLEXISOFT PNET GATEW.V2 with serial number <=2311xxxx all Firmware versions and SICK FX0-GMOD00010 FLEXISOFT MOD GW with serial number <=2311xxxx with Firmware <=V2.11.0 all have Telnet enabled by factory default. No password is set in the default configuration.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-477, CWE-306
References: https://sick.com/psirt; https://sick.com/psirt
CVE: CVE-2023-28327
Published: 2023-04-19
Description: A NULL pointer dereference flaw was found in the UNIX protocol in net/unix/diag.c In unix_diag_get_exact in the Linux Kernel. The newly allocated skb does not have sk, leading to a NULL pointer. This flaw allows a local user to crash or potentially cause a denial of service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://bugzilla.redhat.com/show_bug.cgi?id=2177382; https://bugzilla.redhat.com/show_bug.cgi?id=2177382
CVE: CVE-2023-28328
Published: 2023-04-19
Description: A NULL pointer dereference flaw was found in the az6027 driver in drivers/media/usb/dev-usb/az6027.c in the Linux Kernel. The message from user space is not checked properly before transferring into the device. This flaw allows a local user to crash the system or potentially cause a denial of service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://bugzilla.redhat.com/show_bug.cgi?id=2177389; https://lists.debian.org/debian-lts-announce/2023/05/msg00005.html; https://lists.debian.org/debian-lts-announce/2023/05/msg00006.html
CVE: CVE-2023-2166
Published: 2023-04-19
Description: A null pointer dereference issue was found in can protocol in net/can/af_can.c in the Linux before Linux. ml_priv may not be initialized in the receive path of CAN frames. A local user could use this flaw to crash the system or potentially cause a denial of service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476, CWE-476
References: https://lore.kernel.org/lkml/CAO4mrfcV_07hbj8NUuZrA8FH-kaRsrFy-2metecpTuE5kKHn5w%40mail.gmail.com/; https://lore.kernel.org/lkml/CAO4mrfcV_07hbj8NUuZrA8FH-kaRsrFy-2metecpTuE5kKHn5w%40mail.gmail.com/
CVE: CVE-2023-2191
Published: 2023-04-20
Description: Cross-site Scripting (XSS) - Stored in GitHub repository azuracast/azuracast prior to 0.18.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/azuracast/azuracast/commit/24276cb4166b2057de73569ec33046a80a8bb437; https://huntr.dev/bounties/0814f5f9-8b58-40e5-b08c-7c488947cf31; https://github.com/azuracast/azuracast/commit/24276cb4166b2057de73569ec33046a80a8bb437
CVE: CVE-2014-125099
Published: 2023-04-20
Description: A vulnerability has been found in I Recommend This Plugin up to 3.7.2 on WordPress and classified as critical. Affected by this vulnerability is an unknown functionality of the file dot-irecommendthis.php. The manipulation leads to sql injection. The attack can be launched remotely. Upgrading to version 3.7.3 is able to address this issue. The identifier of the patch is 058b3ef5c7577bf557557904a53ecc8599b13649. It is recommended to upgrade the affected component. The identifier VDB-226309 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/wp-plugins/i-recommend-this/commit/058b3ef5c7577bf557557904a53ecc8599b13649; https://github.com/wp-plugins/i-recommend-this/releases/tag/3.7.3; https://vuldb.com/?ctiid.226309
CVE: CVE-2022-4942
Published: 2023-04-20
Description: A vulnerability was found in mportuga eslint-detailed-reporter up to 0.9.0 and classified as problematic. Affected by this issue is the function renderIssue in the library lib/template-generator.js. The manipulation of the argument message leads to cross site scripting. The attack may be launched remotely. The patch is identified as 505c190efd4905990db6207863bdcbd9b1d7e1bd. It is recommended to apply a patch to fix this issue. VDB-226310 is the identifier assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/mportuga/eslint-detailed-reporter/commit/505c190efd4905990db6207863bdcbd9b1d7e1bd; https://github.com/mportuga/eslint-detailed-reporter/pull/46; https://vuldb.com/?ctiid.226310
CVE: CVE-2023-28047
Published: 2023-04-20
Description: 
Dell Display Manager, versions 2.1.0 and prior, contains an arbitrary file or folder creation vulnerability during installation. A local low privilege attacker could potentially exploit this vulnerability, leading to the execution of arbitrary code on the operating system with high privileges.


CVSS Score: 7.3 (HIGH)
CWE: CWE-272
References: https://www.dell.com/support/kbdoc/en-uk/000211727/dsa-2023; https://www.dell.com/support/kbdoc/en-uk/000211727/dsa-2023
CVE: CVE-2023-0383
Published: 2023-04-20
Description: User-controlled operations could have allowed Denial of Service in M-Files Server before 23.4.12528.1

 due to uncontrolled memory consumption.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770, CWE-400
References: https://empower.m-files.com/security-advisories/CVE-2023-0383; https://product.m-files.com/security-advisories/cve-2023-0383/; https://www.m-files.com/about/trust-center/security-advisories/cve-2023-0383/
CVE: CVE-2023-0384
Published: 2023-04-20
Description: User-controlled operations could have allowed Denial of Service in M-Files Server before 23.4.12528.1

 due to uncontrolled memory consumption for a scheduled job.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400, CWE-400
References: https://empower.m-files.com/security-advisories/CVE-2023-0384; https://product.m-files.com/security-advisories/cve-2023-0384/; https://www.m-files.com/about/trust-center/security-advisories/cve-2023-0384/
CVE: CVE-2023-2112
Published: 2023-04-20
Description: Desktop component service allows lateral movement between sessions in M-Files before 23.4.12455.0.
CVSS Score: 3.6 (LOW)
CWE: CWE-284
References: https://empower.m-files.com/security-advisories/CVE-2023-2112; https://product.m-files.com/security-advisories/cve-2023-2112/; https://www.m-files.com/about/trust-center/security-advisories/cve-2023-2112/
CVE: CVE-2023-2193
Published: 2023-04-20
Description: Mattermost fails to invalidate existing authorization codes when deauthorizing an OAuth2 app, allowing an attacker possessing an authorization code to generate an access token.

CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2023-1767
Published: 2023-04-20
Description: The Snyk Advisor website (https://snyk.io/advisor/) was vulnerable to a stored XSS prior to 28th March 2023. A feature of Snyk Advisor is to display the contents of a scanned package's Readme on its package health page. An attacker could create a package in NPM with an associated markdown README file containing XSS-able HTML tags. Upon Snyk Advisor importing the package, the XSS would run each time an end user browsed to the package's page on Snyk Advisor.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://support.snyk.io/hc/en-us/articles/[PII_REDACTED]405; https://weizman.github.io/2023/04/10/snyk-xss/; https://support.snyk.io/hc/en-us/articles/[PII_REDACTED]405
CVE: CVE-2021-38363
Published: 2023-04-20
Description: An issue was discovered in ONOS 2.5.1. In IntentManager, the install-requested intent (which causes an exception) remains in pendingMap (in memory) forever. Deletion is possible neither by a user nor by the intermittent Intent Cleanup process.
CVSS Score: 7.5 (HIGH)
CWE: CWE-755, CWE-755
References: https://opennetworking.org/onos/; https://www.usenix.org/system/files/sec23fall-prepub-285_kim-jiwon.pdf; https://opennetworking.org/onos/
CVE: CVE-2021-38364
Published: 2023-04-20
Description: An issue was discovered in ONOS 2.5.1. There is an incorrect comparison of flow rules installed by intents. A remote attacker can install or remove a new intent, and consequently modify or delete the existing flow rules related to other intents.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-697, CWE-697
References: https://opennetworking.org/onos/; https://www.usenix.org/system/files/sec23fall-prepub-285_kim-jiwon.pdf; https://opennetworking.org/onos/
CVE: CVE-2022-24035
Published: 2023-04-20
Description: An issue was discovered in ONOS 2.5.1. The purge-requested intent remains on the list, but it does not respond to changes in topology (e.g., link failure). In combination with other applications, it could lead to a failure of network management.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-400
References: https://wiki.onosproject.org/display/ONOS/Intent+Framework; https://www.usenix.org/system/files/sec23fall-prepub-285_kim-jiwon.pdf; https://wiki.onosproject.org/display/ONOS/Intent+Framework
CVE: CVE-2022-24109
Published: 2023-04-20
Description: An issue was discovered in ONOS 2.5.1. To attack an intent installed by a normal user, a remote attacker can install a duplicate intent with a different key, and then remove the duplicate one. This will remove the flow rules of the intent, even though the intent still exists in the controller.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400, CWE-400
References: https://wiki.onosproject.org/display/ONOS/Intent+Framework; https://www.usenix.org/system/files/sec23fall-prepub-285_kim-jiwon.pdf; https://wiki.onosproject.org/display/ONOS/Intent+Framework
CVE: CVE-2022-29604
Published: 2023-04-20
Description: An issue was discovered in ONOS 2.5.1. An intent with an uppercase letter in a device ID shows the CORRUPT state, which is misleading to a network operator. Improper handling of case sensitivity causes inconsistency between intent and flow rules in the network.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-178, CWE-178
References: https://wiki.onosproject.org/display/ONOS/Intent+Framework; https://www.usenix.org/system/files/sec23fall-prepub-285_kim-jiwon.pdf; https://wiki.onosproject.org/display/ONOS/Intent+Framework
CVE: CVE-2022-29605
Published: 2023-04-20
Description: An issue was discovered in ONOS 2.5.1. IntentManager attempts to install the IPv6 flow rules of an intent into an OpenFlow 1.0 switch that does not support IPv6. Improper handling of the difference in capabilities of the intent and switch is misleading to a network operator.
CVSS Score: 7.5 (HIGH)
CWE: CWE-670, CWE-670
References: https://wiki.onosproject.org/display/ONOS/Intent+Framework; https://www.usenix.org/system/files/sec23fall-prepub-285_kim-jiwon.pdf; https://wiki.onosproject.org/display/ONOS/Intent+Framework
CVE: CVE-2022-29606
Published: 2023-04-20
Description: An issue was discovered in ONOS 2.5.1. An intent with a large port number shows the CORRUPT state, which is misleading to a network operator. Improper handling of such port numbers causes inconsistency between intent and flow rules in the network.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20, CWE-20
References: https://wiki.onosproject.org/display/ONOS/Intent+Framework; https://www.usenix.org/system/files/sec23fall-prepub-285_kim-jiwon.pdf; https://wiki.onosproject.org/display/ONOS/Intent+Framework
CVE: CVE-2022-29607
Published: 2023-04-20
Description: An issue was discovered in ONOS 2.5.1. Modification of an existing intent to have the same source and destination shows the INSTALLED state without any flow rule. Improper handling of such an intent is misleading to a network operator.
CVSS Score: 7.5 (HIGH)
CWE: CWE-670, CWE-670
References: https://wiki.onosproject.org/display/ONOS/Intent+Framework; https://www.usenix.org/system/files/sec23fall-prepub-285_kim-jiwon.pdf; https://wiki.onosproject.org/display/ONOS/Intent+Framework
CVE: CVE-2022-29608
Published: 2023-04-20
Description: An issue was discovered in ONOS 2.5.1. An intent with a port that is an intermediate point of its path installs an invalid flow rule, causing a network loop.
CVSS Score: 7.5 (HIGH)
References: https://wiki.onosproject.org/display/ONOS/Intent+Framework; https://www.usenix.org/system/files/sec23fall-prepub-285_kim-jiwon.pdf; https://wiki.onosproject.org/display/ONOS/Intent+Framework
CVE: CVE-2022-29609
Published: 2023-04-20
Description: An issue was discovered in ONOS 2.5.1. An intent with the same source and destination shows the INSTALLING state, indicating that its flow rules are installing. Improper handling of such an intent is misleading to a network operator.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-670, CWE-670
References: https://wiki.onosproject.org/display/ONOS/Intent+Framework; https://www.usenix.org/system/files/sec23fall-prepub-285_kim-jiwon.pdf; https://wiki.onosproject.org/display/ONOS/Intent+Framework
CVE: CVE-2022-29944
Published: 2023-04-20
Description: An issue was discovered in ONOS 2.5.1. There is an incorrect comparison of paths installed by intents. An existing intents does not redirect to a new path, even if a new intent that shares the path with higher priority is installed.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-697, CWE-697
References: https://wiki.onosproject.org/display/ONOS/Intent+Framework; https://www.usenix.org/system/files/sec23fall-prepub-285_kim-jiwon.pdf; https://wiki.onosproject.org/display/ONOS/Intent+Framework
CVE: CVE-2022-46302
Published: 2023-04-20
Description: Broad access controls could allow site users to directly interact with the system Apache installation when providing the reverse proxy configurations for Tribe29's Checkmk <= 2.1.0p6, Checkmk <= 2.0.0p27, and all versions of Checkmk 1.6.0 (EOL) allowing an attacker to perform remote code execution with root privileges on the underlying host.
CVSS Score: 8.8 (HIGH)
CWE: CWE-829, CWE-829
References: https://checkmk.com/werk/14281; https://checkmk.com/werk/14281
CVE: CVE-2023-22309
Published: 2023-04-20
Description: Reflective Cross-Site-Scripting in Webconf in Tribe29 Checkmk Appliance before 1.6.4.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-80, CWE-79
References: https://checkmk.com/werk/9523; https://checkmk.com/werk/9523
CVE: CVE-2023-27652
Published: 2023-04-20
Description: An issue found in Ego Studio SuperClean v.1.1.9 and v.1.1.5 allows an attacker to gain privileges cause a denial of service via the update_info field of the _default_.xml file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-400, CWE-611
References: http://www.egostudiogroup.com/; https://apkpure.com/cn/super-clean-phone-cleaner/com.egostudio.clean/download; https://github.com/LianKee/SODA/blob/main/CVEs/CVE-2023-27652/CVE%20detail.md
CVE: CVE-2023-29926
Published: 2023-04-20
Description: PowerJob V4.3.2 has unauthorized interface that causes remote code execution.
CVSS Score: 9.8 (CRITICAL)
References: https://iotaa.cn/articles/63; https://iotaa.cn/articles/63
CVE: CVE-2022-36788
Published: 2023-04-20
Description: A heap-based buffer overflow vulnerability exists in the TriangleMesh clone functionality of Slic3r libslic3r 1.3.0 and Master Commit b1a5500. A specially-crafted STL file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.
CVSS Score: 8.1 (HIGH)
CWE: CWE-130, CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2022-1593; https://talosintelligence.com/vulnerability_reports/TALOS-2022-1593; https://www.talosintelligence.com/vulnerability_reports/TALOS-2022-1593
CVE: CVE-2023-25601
Published: 2023-04-20
Description: On version 3.0.0 through 3.1.1, Apache DolphinScheduler's python gateway suffered from improper authentication: an attacker could use a socket bytes attack without authentication. This issue has been fixed from version 3.1.2 onwards. For users who use version 3.0.0 to 3.1.1, you can turn off the python-gateway function by changing the value `python-gateway.enabled=false` in configuration file `application.yaml`. If you are using the python gateway, please upgrade to version 3.1.2 or above.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-287
References: http://www.openwall.com/lists/oss-security/2023/04/20/10; https://lists.apache.org/thread/25g77jqczp3t8cz56hk1p65q7m6c64rf; http://www.openwall.com/lists/oss-security/2023/04/20/10