deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-37371
Published: 2023-03-29
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. Crafted data in a PDF file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17772.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.tracker-software.com/product/pdf-xchange-editor/history; https://www.zerodayinitiative.com/advisories/ZDI-22-1099/; https://www.tracker-software.com/product/pdf-xchange-editor/history
CVE: CVE-2022-37372
Published: 2023-03-29
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. Crafted data in a PDF file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17809.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.tracker-software.com/product/pdf-xchange-editor/history; https://www.zerodayinitiative.com/advisories/ZDI-22-1100/; https://www.tracker-software.com/product/pdf-xchange-editor/history
CVE: CVE-2022-37373
Published: 2023-03-29
Description: This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. Crafted data in a PDF file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-17810.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://www.tracker-software.com/product/pdf-xchange-editor/history; https://www.zerodayinitiative.com/advisories/ZDI-22-1101/; https://www.tracker-software.com/product/pdf-xchange-editor/history
CVE: CVE-2022-37374
Published: 2023-03-29
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PNG files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18068.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://www.tracker-software.com/product/pdf-xchange-editor/history; https://www.zerodayinitiative.com/advisories/ZDI-22-1102/; https://www.tracker-software.com/product/pdf-xchange-editor/history
CVE: CVE-2022-37375
Published: 2023-03-29
Description: This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JPC files. Crafted data in a JPC file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18069.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://www.tracker-software.com/product/pdf-xchange-editor/history; https://www.zerodayinitiative.com/advisories/ZDI-22-1103/; https://www.tracker-software.com/product/pdf-xchange-editor/history
CVE: CVE-2022-37376
Published: 2023-03-29
Description: This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Editor 11.1.1.53537. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of arrays. By performing actions in JavaScript, an attacker can trigger a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-16599.
CVSS Score: 3.3 (LOW)
CWE: CWE-125
References: https://www.foxit.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-22-1048/; https://www.foxit.com/support/security-bulletins.html
CVE: CVE-2022-37377
Published: 2023-03-29
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Editor 11.1.1.53537;. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within JavaScript optimizations. The issue results from an improper optimization, which can result in a type confusion condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-16733.
CVSS Score: 7.8 (HIGH)
CWE: CWE-843
References: https://www.foxit.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-22-1049/; https://www.foxit.com/support/security-bulletins.html
CVE: CVE-2022-37378
Published: 2023-03-29
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Editor 11.1.1.53537. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the optimization of JavaScript functions. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-16867.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://www.foxit.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-22-1050/; https://www.foxit.com/support/security-bulletins.html
CVE: CVE-2022-37379
Published: 2023-03-29
Description: This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader 11.2.1.53537. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of the AFSpecial_KeystrokeEx method. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-17168.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416
References: https://www.foxit.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-22-1051/; https://www.foxit.com/support/security-bulletins.html
CVE: CVE-2022-37380
Published: 2023-03-29
Description: This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader 11.2.1.53537. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of ADBC objects. By performing actions in JavaScript, an attacker can trigger a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-17169.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://www.foxit.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-22-1052/; https://www.foxit.com/support/security-bulletins.html
CVE: CVE-2022-37381
Published: 2023-03-29
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the AFSpecial_KeystrokeEx method. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17110.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://www.foxit.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-22-1053/; https://www.foxit.com/support/security-bulletins.html
CVE: CVE-2022-37382
Published: 2023-03-29
Description: This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader 11.2.1.53537. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the removeIcon method. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-17383.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416
References: https://www.foxit.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-22-1054/; https://www.foxit.com/support/security-bulletins.html
CVE: CVE-2022-37383
Published: 2023-03-29
Description: This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader 11.2.1.53537. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of Doc objects. By performing actions in JavaScript, an attacker can trigger a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-17111.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://www.foxit.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-22-1055/; https://www.foxit.com/support/security-bulletins.html
CVE: CVE-2022-37384
Published: 2023-03-29
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.2.1.53537. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the delay method. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17327.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://www.foxit.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-22-1056/; https://www.foxit.com/support/security-bulletins.html
CVE: CVE-2022-37385
Published: 2023-03-29
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.2.1.53537. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of Doc objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17301.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://www.foxit.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-22-1057/; https://www.foxit.com/support/security-bulletins.html
CVE: CVE-2022-37386
Published: 2023-03-29
Description: This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader 11.2.2.53575. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the resetForm method. By performing actions in JavaScript, an attacker can trigger a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-17550.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://www.foxit.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-22-1058/; https://www.foxit.com/support/security-bulletins.html
CVE: CVE-2022-37387
Published: 2023-03-29
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.2.2.53575. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of AcroForms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17552.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://www.foxit.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-22-1059/; https://www.foxit.com/support/security-bulletins.html
CVE: CVE-2022-37388
Published: 2023-03-29
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.2.2.53575. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. Crafted data in a PDF file can trigger a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17516.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://www.foxit.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-22-1060/; https://www.foxit.com/support/security-bulletins.html
CVE: CVE-2022-37389
Published: 2023-03-29
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.2.2.53575. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of AcroForms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17545.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://www.foxit.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-22-1061/; https://www.foxit.com/support/security-bulletins.html
CVE: CVE-2022-37390
Published: 2023-03-29
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.2.2.53575. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of AcroForms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17551.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://www.foxit.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-22-1062/; https://www.foxit.com/support/security-bulletins.html
CVE: CVE-2022-37391
Published: 2023-03-29
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.2.2.53575. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of AcroForms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17661.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://www.foxit.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-22-1063/; https://www.foxit.com/support/security-bulletins.html
CVE: CVE-2022-3093
Published: 2023-03-29
Description: This vulnerability allows physical attackers to execute arbitrary code on affected Tesla vehicles. Authentication is not required to exploit this vulnerability. The specific flaw exists within the ice_updater update mechanism. The issue results from the lack of proper validation of user-supplied firmware. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-17463.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-367
References: https://www.zerodayinitiative.com/advisories/ZDI-22-1188/; https://www.zerodayinitiative.com/advisories/ZDI-22-1188/
CVE: CVE-2022-3210
Published: 2023-03-29
Description: This vulnerability allows network-adjacent attackers to execute arbitrary commands on affected installations of D-Link DIR-2150 4.0.1 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the xupnpd service, which listens on TCP port 4044 by default. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-15905.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10304; https://www.zerodayinitiative.com/advisories/ZDI-22-1222/; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10304
CVE: CVE-2022-42424
Published: 2023-03-29
Description: This vulnerability allows remote attackers to escalate privileges on affected installations of Centreon. Authentication is required to exploit this vulnerability. The specific flaw exists within the handling of requests to modify poller broker configuration. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to escalate privileges to the level of an administrator. Was ZDI-CAN-18556.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://www.zerodayinitiative.com/advisories/ZDI-22-1395/; https://www.zerodayinitiative.com/advisories/ZDI-22-1395/
CVE: CVE-2022-42425
Published: 2023-03-29
Description: This vulnerability allows remote attackers to escalate privileges on affected installations of Centreon. Authentication is required to exploit this vulnerability. The specific flaw exists within the handling of requests to modify poller broker configuration. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to escalate privileges to the level of an administrator. Was ZDI-CAN-18555.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://www.zerodayinitiative.com/advisories/ZDI-22-1396/; https://www.zerodayinitiative.com/advisories/ZDI-22-1396/
CVE: CVE-2022-42426
Published: 2023-03-29
Description: This vulnerability allows remote attackers to escalate privileges on affected installations of Centreon. Authentication is required to exploit this vulnerability. The specific flaw exists within the handling of requests to modify poller broker configuration. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to escalate privileges to the level of an administrator. Was ZDI-CAN-18554.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://www.zerodayinitiative.com/advisories/ZDI-22-1397/; https://www.zerodayinitiative.com/advisories/ZDI-22-1397/
CVE: CVE-2022-42427
Published: 2023-03-29
Description: This vulnerability allows remote attackers to escalate privileges on affected installations of Centreon. Authentication is required to exploit this vulnerability. The specific flaw exists within the contact groups configuration page. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to escalate privileges to the level of an administrator. Was ZDI-CAN-18541.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://www.zerodayinitiative.com/advisories/ZDI-22-1398/; https://www.zerodayinitiative.com/advisories/ZDI-22-1398/
CVE: CVE-2022-42428
Published: 2023-03-29
Description: This vulnerability allows remote attackers to escalate privileges on affected installations of Centreon. Authentication is required to exploit this vulnerability. The specific flaw exists within the handling of requests to modify poller broker configuration. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to escalate privileges to the level of an administrator. Was ZDI-CAN-18410.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://www.zerodayinitiative.com/advisories/ZDI-22-1399/; https://www.zerodayinitiative.com/advisories/ZDI-22-1399/
CVE: CVE-2022-42429
Published: 2023-03-29
Description: This vulnerability allows remote attackers to escalate privileges on affected installations of Centreon. Authentication is required to exploit this vulnerability. The specific flaw exists within the handling of requests to modify poller broker configuration. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to escalate privileges to the level of an administrator. Was ZDI-CAN-18557.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://www.zerodayinitiative.com/advisories/ZDI-22-1394/; https://www.zerodayinitiative.com/advisories/ZDI-22-1394/
CVE: CVE-2022-42430
Published: 2023-03-29
Description: This vulnerability allows local attackers to escalate privileges on affected Tesla vehicles. An attacker must first obtain the ability to execute privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of the wowlan_config data structure. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of root. Was ZDI-CAN-17543.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://www.zerodayinitiative.com/advisories/ZDI-22-1406/; https://www.zerodayinitiative.com/advisories/ZDI-22-1406/