deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-39488
Published: 2024-05-03
Description: PDF-XChange Editor TIF File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of TIF files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-19487.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1127/; https://www.zerodayinitiative.com/advisories/ZDI-23-1127/
CVE: CVE-2023-39489
Published: 2024-05-03
Description: PDF-XChange Editor TIF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of TIF files. Crafted data in a TIF file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-19488.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1128/; https://www.zerodayinitiative.com/advisories/ZDI-23-1128/
CVE: CVE-2023-39490
Published: 2024-05-03
Description: PDF-XChange Editor PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of PDF files. Crafted data in a PDF file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-19636.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1134/; https://www.zerodayinitiative.com/advisories/ZDI-23-1134/
CVE: CVE-2023-39491
Published: 2024-05-03
Description: PDF-XChange Editor TIF File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of TIF files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-19638.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1132/; https://www.zerodayinitiative.com/advisories/ZDI-23-1132/
CVE: CVE-2023-39492
Published: 2024-05-03
Description: PDF-XChange Editor PDF File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of PDF files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-19640.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1133/; https://www.zerodayinitiative.com/advisories/ZDI-23-1133/
CVE: CVE-2023-39493
Published: 2024-05-03
Description: PDF-XChange Editor exportAsText Exposed Dangerous Method Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the exportAsText method. The application exposes a JavaScript interface that allows writing arbitrary files. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-19649.
CVSS Score: 7.8 (HIGH)
CWE: CWE-749
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1130/; https://www.zerodayinitiative.com/advisories/ZDI-23-1130/
CVE: CVE-2023-39494
Published: 2024-05-03
Description: PDF-XChange Editor OXPS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of OXPS files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-19655.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1131/; https://www.zerodayinitiative.com/advisories/ZDI-23-1131/
CVE: CVE-2023-39495
Published: 2024-05-03
Description: PDF-XChange Editor readFileIntoStream Exposed Dangerous Function Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the readFileIntoStream method. The issue results from the exposure of a dangerous function. An attacker can leverage this vulnerability to disclose information in the context of the current user. Was ZDI-CAN-19657.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-749
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1141/; https://www.zerodayinitiative.com/advisories/ZDI-23-1141/
CVE: CVE-2023-39496
Published: 2024-05-03
Description: PDF-XChange Editor TIF File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of TIF files. Crafted data in a TIF file can trigger a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-19658.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-125
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1129/; https://www.zerodayinitiative.com/advisories/ZDI-23-1129/
CVE: CVE-2023-39497
Published: 2024-05-03
Description: PDF-XChange Editor JPG File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of JPG files. The issue results from the lack of proper validation of user-supplied data, which can result in a write  past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-19947.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1144/; https://www.zerodayinitiative.com/advisories/ZDI-23-1144/
CVE: CVE-2023-39498
Published: 2024-05-03
Description: PDF-XChange Editor JPG File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of JPG files. The issue results from the lack of proper validation of user-supplied data, which can result in a write  past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-19948.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1142/; https://www.zerodayinitiative.com/advisories/ZDI-23-1142/
CVE: CVE-2023-39499
Published: 2024-05-03
Description: PDF-XChange Editor JPG File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of JPG files. The issue results from the lack of proper validation of user-supplied data, which can result in a write  past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-19949.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1139/; https://www.zerodayinitiative.com/advisories/ZDI-23-1139/
CVE: CVE-2023-39500
Published: 2024-05-03
Description: PDF-XChange Editor JPG File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of JPG files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-19950.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1140/; https://www.zerodayinitiative.com/advisories/ZDI-23-1140/
CVE: CVE-2023-39501
Published: 2024-05-03
Description: PDF-XChange Editor OXPS File Parsing Untrusted Pointer Dereference Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of OXPS files. The issue results from the lack of proper validation of a user-supplied value prior to dereferencing it as a pointer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-20034.
CVSS Score: 7.8 (HIGH)
CWE: CWE-822
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1135/; https://www.zerodayinitiative.com/advisories/ZDI-23-1135/
CVE: CVE-2023-39502
Published: 2024-05-03
Description: PDF-XChange Editor OXPS File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of OXPS files. The issue results from the lack of proper validation of user-supplied data, which can result in a write  past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-20035.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1138/; https://www.zerodayinitiative.com/advisories/ZDI-23-1138/
CVE: CVE-2023-39503
Published: 2024-05-03
Description: PDF-XChange Editor OXPS File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of OXPS files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-20036.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1137/; https://www.zerodayinitiative.com/advisories/ZDI-23-1137/
CVE: CVE-2023-39504
Published: 2024-05-03
Description: PDF-XChange Editor OXPS File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of OXPS files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-20037.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1136/; https://www.zerodayinitiative.com/advisories/ZDI-23-1136/
CVE: CVE-2023-39505
Published: 2024-05-03
Description: PDF-XChange Editor Net.HTTP.requests Exposed Dangerous Function Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the Net.HTTP.requests method. The issue results from the exposure of a dangerous function. An attacker can leverage this vulnerability to disclose information in the context of the current user. Was ZDI-CAN-20211.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-749
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1143/; https://www.zerodayinitiative.com/advisories/ZDI-23-1143/
CVE: CVE-2023-39506
Published: 2024-05-03
Description: PDF-XChange Editor createDataObject Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the createDataObject method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-20594.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22, CWE-22
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1147/; https://www.zerodayinitiative.com/advisories/ZDI-23-1147/
CVE: CVE-2023-40468
Published: 2024-05-03
Description: PDF-XChange Editor EMF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of EMF files. Crafted data in an EMF file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-20620.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1145/; https://www.zerodayinitiative.com/advisories/ZDI-23-1145/
CVE: CVE-2023-40469
Published: 2024-05-03
Description: PDF-XChange Editor XPS File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of XPS files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-20621.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1148/; https://www.zerodayinitiative.com/advisories/ZDI-23-1148/
CVE: CVE-2023-40470
Published: 2024-05-03
Description: PDF-XChange Editor JP2 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of JP2 files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-20622.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1146/; https://www.zerodayinitiative.com/advisories/ZDI-23-1146/
CVE: CVE-2023-40471
Published: 2024-05-03
Description: PDF-XChange Editor App Untrusted Pointer Dereference Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the handling of App objects. The issue results from the lack of proper validation of a user-supplied value prior to dereferencing it as a pointer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-20729.
CVSS Score: 7.8 (HIGH)
CWE: CWE-822
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1150/; https://www.zerodayinitiative.com/advisories/ZDI-23-1150/
CVE: CVE-2023-40472
Published: 2024-05-03
Description: PDF-XChange Editor JavaScript String Untrusted Pointer Dereference Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the handling of strings. The issue results from the lack of proper validation of a user-supplied value prior to dereferencing it as a pointer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-20730.
CVSS Score: 7.8 (HIGH)
CWE: CWE-822
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1149/; https://www.zerodayinitiative.com/advisories/ZDI-23-1149/
CVE: CVE-2023-40473
Published: 2024-05-03
Description: PDF-XChange Editor Doc Object Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the handling of Doc objects. By performing actions in JavaScript, an attacker can trigger a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-20891.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1151/; https://www.zerodayinitiative.com/advisories/ZDI-23-1151/
CVE: CVE-2023-40474
Published: 2024-05-03
Description: GStreamer MXF File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.

The specific flaw exists within the parsing of MXF video files. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.
. Was ZDI-CAN-21660.
CVSS Score: 8.8 (HIGH)
CWE: CWE-190
References: https://gstreamer.freedesktop.org/security/sa-2023-0006.html; https://www.zerodayinitiative.com/advisories/ZDI-23-1456/; https://gstreamer.freedesktop.org/security/sa-2023-0006.html
CVE: CVE-2023-40475
Published: 2024-05-03
Description: GStreamer MXF File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.

The specific flaw exists within the parsing of MXF video files. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.
. Was ZDI-CAN-21661.
CVSS Score: 8.8 (HIGH)
CWE: CWE-190
References: https://gstreamer.freedesktop.org/security/sa-2023-0007.html; https://www.zerodayinitiative.com/advisories/ZDI-23-1457/; https://gstreamer.freedesktop.org/security/sa-2023-0007.html