deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-21701
Published: 2023-02-14
Description: Microsoft Protected Extensible Authentication Protocol (PEAP) Denial of Service Vulnerability
CVSS Score: 7.5 (HIGH)
CWE: CWE-126
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21701; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21701
CVE: CVE-2023-21702
Published: 2023-02-14
Description: Windows iSCSI Service Denial of Service Vulnerability
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21702; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21702
CVE: CVE-2023-21703
Published: 2023-02-14
Description: Azure Data Box Gateway Remote Code Execution Vulnerability
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-502
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21703; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21703
CVE: CVE-2023-21704
Published: 2023-02-14
Description: Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21704; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21704
CVE: CVE-2023-21705
Published: 2023-02-14
Description: Microsoft SQL Server Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
CWE: CWE-321
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21705; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21705
CVE: CVE-2023-21706
Published: 2023-02-14
Description: Microsoft Exchange Server Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
CWE: CWE-502
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21706; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21706
CVE: CVE-2023-21707
Published: 2023-02-14
Description: Microsoft Exchange Server Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
CWE: CWE-502
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21707; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21707
CVE: CVE-2023-21710
Published: 2023-02-14
Description: Microsoft Exchange Server Remote Code Execution Vulnerability
CVSS Score: 7.2 (HIGH)
CWE: CWE-502
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21710; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21710
CVE: CVE-2023-21713
Published: 2023-02-14
Description: Microsoft SQL Server Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
CWE: CWE-502
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21713; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21713
CVE: CVE-2023-21714
Published: 2023-02-14
Description: Microsoft Office Information Disclosure Vulnerability
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-668
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21714; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21714
CVE: CVE-2023-21715
Published: 2023-02-14
Description: Microsoft Publisher Security Feature Bypass Vulnerability
CVSS Score: 7.3 (HIGH)
CWE: CWE-863, CWE-863
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21715; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21715; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-21715
CVE: CVE-2023-21716
Published: 2023-02-14
Description: Microsoft Word Remote Code Execution Vulnerability
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21716; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21716
CVE: CVE-2023-21717
Published: 2023-02-14
Description: Microsoft SharePoint Server Elevation of Privilege Vulnerability
CVSS Score: 8.8 (HIGH)
CWE: CWE-284
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21717; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21717
CVE: CVE-2023-21718
Published: 2023-02-14
Description: Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-191
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21718; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21718
CVE: CVE-2023-21720
Published: 2023-02-14
Description: Microsoft Edge (Chromium-based) Tampering Vulnerability
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-126
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21720; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21720; https://security.gentoo.org/glsa/202309-17
CVE: CVE-2023-21721
Published: 2023-02-14
Description: Microsoft OneNote Elevation of Privilege Vulnerability
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-287
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21721; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21721
CVE: CVE-2023-21722
Published: 2023-02-14
Description: .NET Framework Denial of Service Vulnerability
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-59
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21722; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21722
CVE: CVE-2023-21777
Published: 2023-02-14
Description: Azure App Service on Azure Stack Hub Elevation of Privilege Vulnerability
CVSS Score: 8.7 (HIGH)
CWE: CWE-284, CWE-269
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21777; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21777
CVE: CVE-2023-21794
Published: 2023-02-14
Description: Microsoft Edge (Chromium-based) Spoofing Vulnerability
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-290, CWE-290
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21794; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21794; https://security.gentoo.org/glsa/202309-17
CVE: CVE-2023-21797
Published: 2023-02-14
Description: Microsoft ODBC Driver Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
CWE: CWE-190
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21797; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21797
CVE: CVE-2023-21798
Published: 2023-02-14
Description: Microsoft ODBC Driver Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
CWE: CWE-125
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21798; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21798
CVE: CVE-2023-21799
Published: 2023-02-14
Description: Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21799; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21799
CVE: CVE-2023-21800
Published: 2023-02-14
Description: Windows Installer Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-73
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21800; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21800
CVE: CVE-2023-21801
Published: 2023-02-14
Description: Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21801; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21801
CVE: CVE-2023-21802
Published: 2023-02-14
Description: Windows Media Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21802; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21802
CVE: CVE-2023-21803
Published: 2023-02-14
Description: Windows iSCSI Discovery Service Remote Code Execution Vulnerability
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21803; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21803
CVE: CVE-2023-21804
Published: 2023-02-14
Description: Windows Graphics Component Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21804; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21804
CVE: CVE-2023-21805
Published: 2023-02-14
Description: Windows MSHTML Platform Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-77
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21805; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21805
CVE: CVE-2023-21806
Published: 2023-02-14
Description: Power BI Report Server Spoofing Vulnerability
CVSS Score: 8.2 (HIGH)
CWE: CWE-79
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21806; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21806
CVE: CVE-2023-21807
Published: 2023-02-14
Description: Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21807; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21807
CVE: CVE-2023-21809
Published: 2023-02-14
Description: Microsoft Defender for Endpoint Security Feature Bypass Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21809; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21809
CVE: CVE-2023-21811
Published: 2023-02-14
Description: Windows iSCSI Service Denial of Service Vulnerability
CVSS Score: 7.5 (HIGH)
CWE: CWE-126
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21811; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21811
CVE: CVE-2023-21812
Published: 2023-02-14
Description: Windows Common Log File System Driver Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21812; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21812
CVE: CVE-2023-21813
Published: 2023-02-14
Description: Windows Secure Channel Denial of Service Vulnerability
CVSS Score: 7.5 (HIGH)
CWE: CWE-126
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21813; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21813
CVE: CVE-2023-21816
Published: 2023-02-14
Description: Windows Active Directory Domain Services API Denial of Service Vulnerability
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21816; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21816
CVE: CVE-2023-21817
Published: 2023-02-14
Description: Windows Kerberos Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-287
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21817; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21817
CVE: CVE-2023-21818
Published: 2023-02-14
Description: Windows Secure Channel Denial of Service Vulnerability
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21818; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21818
CVE: CVE-2023-21819
Published: 2023-02-14
Description: Windows Secure Channel Denial of Service Vulnerability
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21819; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21819
CVE: CVE-2023-21820
Published: 2023-02-14
Description: Windows Distributed File System (DFS) Remote Code Execution Vulnerability
CVSS Score: 7.4 (HIGH)
CWE: CWE-126
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21820; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21820
CVE: CVE-2023-21822
Published: 2023-02-14
Description: Windows Graphics Component Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21822; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21822
CVE: CVE-2023-22490
Published: 2023-02-14
Description: Git is a revision control system. Using a specially-crafted repository, Git prior to versions 2.39.2, 2.38.4, 2.37.6, 2.36.5, 2.35.7, 2.34.7, 2.33.7, 2.32.6, 2.31.7, and 2.30.8 can be tricked into using its local clone optimization even when using a non-local transport. Though Git will abort local clones whose source `$GIT_DIR/objects` directory contains symbolic links, the `objects` directory itself may still be a symbolic link. These two may be combined to include arbitrary files based on known paths on the victim's filesystem within the malicious repository's working copy, allowing for data exfiltration in a similar manner as CVE-2022-39253.

A fix has been prepared and will appear in v2.39.2 v2.38.4 v2.37.6 v2.36.5 v2.35.7 v2.34.7 v2.33.7 v2.32.6, v2.31.7 and v2.30.8. If upgrading is impractical, two short-term workarounds are available. Avoid cloning repositories from untrusted sources with `--recurse-submodules`. Instead, consider cloning repositories without recursively cloning their submodules, and instead run `git submodule update` at each layer. Before doing so, inspect each new `.gitmodules` file to ensure that it does not contain suspicious module URLs.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-59, CWE-59
References: https://github.com/git/git/commit/c867e4fa180bec4750e9b54eb10f459030dbebfd; https://github.com/git/git/security/advisories/GHSA-3wp6-j8xr-qw85; https://github.com/git/git/security/advisories/GHSA-gw92-x3fm-3g3q
CVE: CVE-2023-22629
Published: 2023-02-14
Description: An issue was discovered in TitanFTP through 1.94.1205. The move-file function has a path traversal vulnerability in the newPath parameter. An authenticated attacker can upload any file and then move it anywhere on the server's filesystem.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22, CWE-22
References: http://packetstormsecurity.com/files/171737/Titan-FTP-Path-Traversal.html; https://f20.be/cves/titan-ftp-vulnerabilities; https://titanftp.com
CVE: CVE-2023-23374
Published: 2023-02-14
Description: Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
CVSS Score: 8.3 (HIGH)
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23374; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23374; https://security.gentoo.org/glsa/202309-17
CVE: CVE-2023-23376
Published: 2023-02-14
Description: Windows Common Log File System Driver Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23376; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23376; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-23376
CVE: CVE-2023-23377
Published: 2023-02-14
Description: 3D Builder Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23377; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23377
CVE: CVE-2023-23378
Published: 2023-02-14
Description: Print 3D Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23378; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23378
CVE: CVE-2023-23379
Published: 2023-02-14
Description: Microsoft Defender for IoT Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-23
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23379; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23379
CVE: CVE-2023-23382
Published: 2023-02-14
Description: Azure Machine Learning Compute Instance Information Disclosure Vulnerability
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-257
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23382; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23382
CVE: CVE-2023-23390
Published: 2023-02-14
Description: 3D Builder Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23390; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23390
CVE: CVE-2023-23934
Published: 2023-02-14
Description: Werkzeug is a comprehensive WSGI web application library. Browsers may allow "nameless" cookies that look like `=value` instead of `key=value`. A vulnerable browser may allow a compromised application on an adjacent subdomain to exploit this to set a cookie like `=__Host-test=bad` for another subdomain. Werkzeug prior to 2.2.3 will parse the cookie `=__Host-test=bad` as __Host-test=bad`. If a Werkzeug application is running next to a vulnerable or malicious subdomain which sets such a cookie using a vulnerable browser, the Werkzeug application will see the bad cookie value but the valid cookie key. The issue is fixed in Werkzeug 2.2.3.
CVSS Score: 2.6 (LOW)
CWE: CWE-20
References: https://github.com/pallets/werkzeug/commit/cf275f42acad1b5950c50ffe8ef58fe62cdce028; https://github.com/pallets/werkzeug/releases/tag/2.2.3; https://github.com/pallets/werkzeug/security/advisories/GHSA-px8h-6qxv-m22q
CVE: CVE-2023-23946
Published: 2023-02-14
Description: Git, a revision control system, is vulnerable to path traversal prior to versions 2.39.2, 2.38.4, 2.37.6, 2.36.5, 2.35.7, 2.34.7, 2.33.7, 2.32.6, 2.31.7, and 2.30.8. By feeding a crafted input to `git apply`, a path outside the working tree can be overwritten as the user who is running `git apply`. A fix has been prepared and will appear in v2.39.2, v2.38.4, v2.37.6, v2.36.5, v2.35.7, v2.34.7, v2.33.7, v2.32.6, v2.31.7, and v2.30.8. As a workaround, use `git apply --stat` to inspect a patch before applying; avoid applying one that creates a symbolic link and then creates a file beyond the symbolic link.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://github.com/git/git/commit/c867e4fa180bec4750e9b54eb10f459030dbebfd; https://github.com/git/git/security/advisories/GHSA-r87m-v37r-cwfh; https://security.gentoo.org/glsa/202312-15
CVE: CVE-2023-25577
Published: 2023-02-14
Description: Werkzeug is a comprehensive WSGI web application library. Prior to version 2.2.3, Werkzeug's multipart form data parser will parse an unlimited number of parts, including file parts. Parts can be a small amount of bytes, but each requires CPU time to parse and may use more memory as Python data. If a request can be made to an endpoint that accesses `request.data`, `request.form`, `request.files`, or `request.get_data(parse_form_data=False)`, it can cause unexpectedly high resource usage. This allows an attacker to cause a denial of service by sending crafted multipart data to an endpoint that will parse it. The amount of CPU time required can block worker processes from handling legitimate requests. The amount of RAM required can trigger an out of memory kill of the process. Unlimited file parts can use up memory and file handles. If many concurrent requests are sent continuously, this can exhaust or kill all available workers. Version 2.2.3 contains a patch for this issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770, CWE-770
References: https://github.com/pallets/werkzeug/commit/517cac5a804e8c4dc4ed038bb20dacd038e7a9f1; https://github.com/pallets/werkzeug/releases/tag/2.2.3; https://github.com/pallets/werkzeug/security/advisories/GHSA-xg9f-g7g7-2323
CVE: CVE-2023-21553
Published: 2023-02-14
Description: Azure DevOps Server Remote Code Execution Vulnerability
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21553; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21553
CVE: CVE-2023-21566
Published: 2023-02-14
Description: Visual Studio Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-73
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21566; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21566
CVE: CVE-2023-21567
Published: 2023-02-14
Description: Visual Studio Denial of Service Vulnerability
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-59
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21567; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21567
CVE: CVE-2023-21778
Published: 2023-02-14
Description: Microsoft Dynamics Unified Service Desk Remote Code Execution Vulnerability
CVSS Score: 8.0 (HIGH)
CWE: CWE-77
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21778; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21778
CVE: CVE-2023-21808
Published: 2023-02-14
Description: .NET and Visual Studio Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21808; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21808
CVE: CVE-2023-21815
Published: 2023-02-14
Description: Visual Studio Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-191
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21815; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21815
CVE: CVE-2023-21823
Published: 2023-02-14
Description: Windows Graphics Component Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-190, CWE-190
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21823; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21823; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-21823
CVE: CVE-2023-22743
Published: 2023-02-14
Description: Git for Windows is the Windows port of the revision control system Git. Prior to Git for Windows version 2.39.2, by carefully crafting DLL and putting into a subdirectory of a specific name living next to the Git for Windows installer, Windows can be tricked into side-loading said DLL. This potentially allows users with local write access to place malicious payloads in a location where automated upgrades might run the Git for Windows installer with elevation. Version 2.39.2 contains a patch for this issue. Some workarounds are available. Never leave untrusted files in the Downloads folder or its sub-folders before executing the Git for Windows installer, or move the installer into a different directory before executing it.
CVSS Score: 7.2 (HIGH)
CWE: CWE-426, CWE-426
References: https://attack.mitre.org/techniques/T1574/002/; https://github.com/git-for-windows/git/releases/tag/v2.39.2.windows.1; https://github.com/git-for-windows/git/security/advisories/GHSA-gf48-x3vr-j5c3
CVE: CVE-2023-23381
Published: 2023-02-14
Description: Visual Studio Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23381; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23381
CVE: CVE-2023-23618
Published: 2023-02-14
Description: Git for Windows is the Windows port of the revision control system Git. Prior to Git for Windows version 2.39.2, when `gitk` is run on Windows, it potentially runs executables from the current directory inadvertently, which can be exploited with some social engineering to trick users into running untrusted code. A patch is available in version 2.39.2. As a workaround, avoid using `gitk` (or Git GUI's "Visualize History" functionality) in clones of untrusted repositories.

CVSS Score: 8.6 (HIGH)
CWE: CWE-426, CWE-426
References: https://github.com/git-for-windows/git/commit/49a8ec9dac3cec6602f05fed1b3f80a549c8c05c; https://github.com/git-for-windows/git/releases/tag/v2.39.2.windows.1; https://github.com/git-for-windows/git/security/advisories/GHSA-wxwv-49qw-35pm
CVE: CVE-2023-25723
Published: 2023-02-14
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.