deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-1874
Published: 2023-04-12
Description: The WP Data Access plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.3.7. This is due to a lack of authorization checks on the multiple_roles_update function. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to modify their user role by supplying the 'wpda_role[]' parameter during a profile update. This requires the 'Enable role management' setting to be enabled for the site.
CVSS Score: 7.5 (HIGH)
CWE: CWE-266
References: https://plugins.trac.wordpress.org/browser/wp-data-access/tags/5.3.7/WPDataRoles/WPDA_Roles.php#L50; https://plugins.trac.wordpress.org/browser/wp-data-access/tags/5.3.8/WPDataRoles/WPDA_Roles.php#L23; https://plugins.trac.wordpress.org/browser/wp-data-access/tags/5.3.8/WPDataRoles/WPDA_Roles.php#L50
CVE: CVE-2023-23591
Published: 2023-04-12
Description: The Logback component in Terminalfour before 8.3.14.1 allows OS administrators to obtain sensitive information from application server logs when debug logging is enabled. The fixed versions are 8.2.18.7, 8.2.18.2.2, 8.3.11.1, and 8.3.14.1.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-532
References: https://docs.terminalfour.com/articles/release-notes-highlights/; https://docs.terminalfour.com/release-notes/83/15.html; https://docs.terminalfour.com/articles/release-notes-highlights/
CVE: CVE-2023-27032
Published: 2023-04-12
Description: Prestashop advancedpopupcreator v1.1.21 to v1.1.24 was discovered to contain a SQL injection vulnerability via the component AdvancedPopup::getPopups().
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://addons.prestashop.com/en/pop-up/23773-popup-on-entry-exit-popup-add-product-and-newsletter.html; https://friends-of-presta.github.io/security-advisories/modules/2023/04/11/advancedpopupcreator.html; https://addons.prestashop.com/en/pop-up/23773-popup-on-entry-exit-popup-add-product-and-newsletter.html
CVE: CVE-2023-27704
Published: 2023-04-12
Description: Void Tools Everything lower than v1.4.1.1022 was discovered to contain a Regular Expression Denial of Service (ReDoS).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-1333, CWE-1333
References: https://drive.google.com/drive/folders/1BmHAGSugrFo0whDEmg6nnbaOkvE21X-p?usp=sharing; https://github.com/happy0717/CVE-2023-27704; https://www.voidtools.com/en-us/downloads/
CVE: CVE-2023-27775
Published: 2023-04-12
Description: A stored HTML injection vulnerability in LiveAction LiveSP v21.1.2 allows attackers to execute arbitrary code via a crafted payload.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://liveaction.com; http://livesp.com; https://github.com/marcovntr/CVE/blob/main/2023/CVE-2023-27775/CVE-2023-27775.md
CVE: CVE-2022-47605
Published: 2023-04-12
Description: Auth. SQL Injection') vulnerability in Kunal Nagar Custom 404 Pro plugin <= 3.7.0 versions.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-89
References: https://patchstack.com/database/vulnerability/custom-404-pro/wordpress-custom-404-pro-plugin-3-7-0-admin-sql-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/custom-404-pro/wordpress-custom-404-pro-plugin-3-7-0-admin-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2023-27830
Published: 2023-04-12
Description: TightVNC before v2.8.75 allows attackers to escalate privileges on the host operating system via replacing legitimate files with crafted files when executing a file transfer. This is due to the fact that TightVNC runs in the backend as a high-privileges account.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-269, CWE-269
References: https://medium.com/nestedif/vulnerability-disclosure-privilege-escalation-tightvnc-8165208cce; https://www.tightvnc.com/news.php; https://www.tightvnc.com/whatsnew.php
CVE: CVE-2023-29571
Published: 2023-04-12
Description: Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via gc_sweep at src/mjs_gc.c. This vulnerability can lead to a Denial of Service (DoS).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: https://github.com/cesanta/mjs/issues/241; https://github.com/z1r00/fuzz_vuln/blob/main/mjs/SEGV/mjs_gc/readme.md; https://github.com/cesanta/mjs/issues/241
CVE: CVE-2023-1872
Published: 2023-04-12
Description: A use-after-free vulnerability in the Linux Kernel io_uring system can be exploited to achieve local privilege escalation.

The io_file_get_fixed function lacks the presence of ctx->uring_lock which can lead to a Use-After-Free vulnerability due a race condition with fixed files getting unregistered.

We recommend upgrading past commit da24142b1ef9fd5d36b76e36bab328a5b27523e8.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: http://packetstormsecurity.com/files/173087/Kernel-Live-Patch-Security-Notice-LSN-0095-1.html; https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=linux-5.10.y&id=08681391b84da27133deefaaddefd0acfa90c2be; https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=linux-5.10.y&id=da24142b1ef9fd5d36b76e36bab328a5b27523e8
CVE: CVE-2023-27703
Published: 2023-04-12
Description: The Android version of pikpak v1.29.2 was discovered to contain an information leak via the debug interface.
CVSS Score: 3.3 (LOW)
References: https://drive.google.com/drive/folders/1Szu9pjivVtG93ceECvnoAjeSABVyfDES?usp=sharing; https://github.com/happy0717/CVE-2023-27703; https://drive.google.com/drive/folders/1Szu9pjivVtG93ceECvnoAjeSABVyfDES?usp=sharing
CVE: CVE-2023-28488
Published: 2023-04-12
Description: client.c in gdhcp in ConnMan through 1.41 could be used by network-adjacent attackers (operating a crafted DHCP server) to cause a stack-based buffer overflow and denial of service, terminating the connman process.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: https://github.com/moehw/poc_exploits/tree/master/CVE-2023-28488; https://kernel.googlesource.com/pub/scm/network/connman/connman/+/99e2c16ea1cced34a5dc450d76287a1c3e762138; https://lists.debian.org/debian-lts-announce/2023/04/msg00024.html
CVE: CVE-2023-29581
Published: 2023-04-12
Description: yasm 1.3.0.55.g101bc has a segmentation violation in the function delete_Token at modules/preprocs/nasm/nasm-pp.c. NOTE: although a libyasm application could become unavailable if this were exploited, the vendor's position is that there is no security relevance because there is either supposed to be input validation before data reaches libyasm, or a sandbox in which the application runs.
CVSS Score: 5.5 (MEDIUM)
References: https://bugzilla.redhat.com/show_bug.cgi?id=2186333; https://github.com/yasm/yasm/blob/master/SECURITY.md; https://github.com/yasm/yasm/issues/216
CVE: CVE-2023-0004
Published: 2023-04-12
Description: A local file deletion vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator to delete files from the local file system with elevated privileges.

These files can include logs and system components that impact the integrity and availability of PAN-OS software.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-703
References: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A/; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5/; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU/
CVE: CVE-2023-0005
Published: 2023-04-12
Description: A vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator to expose the plaintext values of secrets stored in the device configuration and encrypted API keys.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-497, CWE-312
References: https://security.paloaltonetworks.com/CVE-2023-0005; https://security.paloaltonetworks.com/CVE-2023-0005
CVE: CVE-2023-0006
Published: 2023-04-12
Description: A local file deletion vulnerability in the Palo Alto Networks GlobalProtect app on Windows devices enables a user to delete system files from the endpoint with elevated privileges through a race condition.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-367, CWE-367
References: https://security.paloaltonetworks.com/CVE-2023-0006; https://security.paloaltonetworks.com/CVE-2023-0006
CVE: CVE-2023-26852
Published: 2023-04-12
Description: An arbitrary file upload vulnerability in the upload plugin of Textpattern v4.8.8 and below allows attackers to execute arbitrary code by uploading a crafted PHP file.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434, CWE-434
References: https://drive.google.com/drive/folders/1x55FGWZydBRxFyTVIAL1ynnk1X7gfIq9?usp=sharing; https://github.com/leekenghwa/CVE-2023-26852-Textpattern-v4.8.8-and-; https://github.com/textpattern/textpattern
CVE: CVE-2023-27216
Published: 2023-04-12
Description: An issue found in D-Link DSL-3782 v.1.03 allows remote authenticated users to execute arbitrary code as root via the network settings page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: http://d-link.com; https://lessonsec.com/cve/cve-2023-27216/; https://www.dlink.com/en/security-bulletin/
CVE: CVE-2023-30513
Published: 2023-04-12
Description: Jenkins Kubernetes Plugin 3909.v1f2c633e8590 and earlier does not properly mask (i.e., replace with asterisks) credentials in the build log when push mode for durable task logging is enabled.
CVSS Score: 7.5 (HIGH)
CWE: CWE-319, CWE-319
References: http://www.openwall.com/lists/oss-security/2023/04/13/3; https://www.jenkins.io/security/advisory/2023-04-12/#SECURITY-3075; http://www.openwall.com/lists/oss-security/2023/04/13/3
CVE: CVE-2023-30514
Published: 2023-04-12
Description: Jenkins Azure Key Vault Plugin 187.va_cd5fecd198a_ and earlier does not properly mask (i.e., replace with asterisks) credentials in the build log when push mode for durable task logging is enabled.
CVSS Score: 7.5 (HIGH)
CWE: CWE-319, CWE-319
References: http://www.openwall.com/lists/oss-security/2023/04/13/3; https://www.jenkins.io/security/advisory/2023-04-12/#SECURITY-3075; http://www.openwall.com/lists/oss-security/2023/04/13/3
CVE: CVE-2023-30515
Published: 2023-04-12
Description: Jenkins Thycotic DevOps Secrets Vault Plugin 1.0.0 and earlier does not properly mask (i.e., replace with asterisks) credentials in the build log when push mode for durable task logging is enabled.
CVSS Score: 7.5 (HIGH)
CWE: CWE-319, CWE-319
References: http://www.openwall.com/lists/oss-security/2023/04/13/3; https://www.jenkins.io/security/advisory/2023-04-12/#SECURITY-3075; http://www.openwall.com/lists/oss-security/2023/04/13/3
CVE: CVE-2023-30516
Published: 2023-04-12
Description: Jenkins Image Tag Parameter Plugin 2.0 improperly introduces an option to opt out of SSL/TLS certificate validation when connecting to Docker registries, resulting in job configurations using Image Tag Parameters that were created before 2.0 having SSL/TLS certificate validation disabled by default.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-295, CWE-295
References: http://www.openwall.com/lists/oss-security/2023/04/13/3; https://www.jenkins.io/security/advisory/2023-04-12/#SECURITY-2840; http://www.openwall.com/lists/oss-security/2023/04/13/3
CVE: CVE-2023-30517
Published: 2023-04-12
Description: Jenkins NeuVector Vulnerability Scanner Plugin 1.22 and earlier unconditionally disables SSL/TLS certificate and hostname validation when connecting to a configured NeuVector Vulnerability Scanner server.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-295, CWE-295
References: http://www.openwall.com/lists/oss-security/2023/04/13/3; https://www.jenkins.io/security/advisory/2023-04-12/#SECURITY-2841; http://www.openwall.com/lists/oss-security/2023/04/13/3
CVE: CVE-2023-30518
Published: 2023-04-12
Description: A missing permission check in Jenkins Thycotic Secret Server Plugin 1.0.2 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862, CWE-862
References: http://www.openwall.com/lists/oss-security/2023/04/13/3; https://www.jenkins.io/security/advisory/2023-04-12/#SECURITY-2837; http://www.openwall.com/lists/oss-security/2023/04/13/3
CVE: CVE-2023-30519
Published: 2023-04-12
Description: A missing permission check in Jenkins Quay.io trigger Plugin 0.1 and earlier allows unauthenticated attackers to trigger builds of jobs corresponding to the attacker-specified repository.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862, CWE-862
References: http://www.openwall.com/lists/oss-security/2023/04/13/3; https://www.jenkins.io/security/advisory/2023-04-12/#SECURITY-2849; http://www.openwall.com/lists/oss-security/2023/04/13/3
CVE: CVE-2023-30520
Published: 2023-04-12
Description: Jenkins Quay.io trigger Plugin 0.1 and earlier does not limit URL schemes for repository homepage URLs submitted via Quay.io trigger webhooks, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to submit crafted Quay.io trigger webhook payloads.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://www.openwall.com/lists/oss-security/2023/04/13/3; https://www.jenkins.io/security/advisory/2023-04-12/#SECURITY-2850; http://www.openwall.com/lists/oss-security/2023/04/13/3
CVE: CVE-2023-30521
Published: 2023-04-12
Description: A missing permission check in Jenkins Assembla merge request builder Plugin 1.1.13 and earlier allows unauthenticated attackers to trigger builds of jobs corresponding to the attacker-specified repository.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862, CWE-862
References: http://www.openwall.com/lists/oss-security/2023/04/13/3; https://www.jenkins.io/security/advisory/2023-04-12/#SECURITY-2872; http://www.openwall.com/lists/oss-security/2023/04/13/3
CVE: CVE-2023-30522
Published: 2023-04-12
Description: A missing permission check in Jenkins Fogbugz Plugin 2.2.17 and earlier allows attackers with Item/Read permission to trigger builds of jobs specified in a 'jobname' request parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862, CWE-862
References: http://www.openwall.com/lists/oss-security/2023/04/13/3; https://www.jenkins.io/security/advisory/2023-04-12/#SECURITY-2873; http://www.openwall.com/lists/oss-security/2023/04/13/3
CVE: CVE-2023-30523
Published: 2023-04-12
Description: Jenkins Report Portal Plugin 0.5 and earlier stores ReportPortal access tokens unencrypted in job config.xml files on the Jenkins controller as part of its configuration where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-312, CWE-311
References: http://www.openwall.com/lists/oss-security/2023/04/13/3; https://www.jenkins.io/security/advisory/2023-04-12/#SECURITY-2945; http://www.openwall.com/lists/oss-security/2023/04/13/3
CVE: CVE-2023-30524
Published: 2023-04-12
Description: Jenkins Report Portal Plugin 0.5 and earlier does not mask ReportPortal access tokens displayed on the configuration form, increasing the potential for attackers to observe and capture them.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-1270
References: http://www.openwall.com/lists/oss-security/2023/04/13/3; https://www.jenkins.io/security/advisory/2023-04-12/#SECURITY-2945; http://www.openwall.com/lists/oss-security/2023/04/13/3
CVE: CVE-2023-30525
Published: 2023-04-12
Description: A cross-site request forgery (CSRF) vulnerability in Jenkins Report Portal Plugin 0.5 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified bearer token authentication.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: http://www.openwall.com/lists/oss-security/2023/04/13/3; https://www.jenkins.io/security/advisory/2023-04-12/#SECURITY-2950; http://www.openwall.com/lists/oss-security/2023/04/13/3
CVE: CVE-2023-30526
Published: 2023-04-12
Description: A missing permission check in Jenkins Report Portal Plugin 0.5 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified bearer token authentication.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862, CWE-862
References: http://www.openwall.com/lists/oss-security/2023/04/13/3; https://www.jenkins.io/security/advisory/2023-04-12/#SECURITY-2950; http://www.openwall.com/lists/oss-security/2023/04/13/3
CVE: CVE-2023-30527
Published: 2023-04-12
Description: Jenkins WSO2 Oauth Plugin 1.0 and earlier stores the WSO2 Oauth client secret unencrypted in the global config.xml file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-312, CWE-312
References: http://www.openwall.com/lists/oss-security/2023/04/13/3; https://www.jenkins.io/security/advisory/2023-04-12/#SECURITY-2992; http://www.openwall.com/lists/oss-security/2023/04/13/3
CVE: CVE-2023-30528
Published: 2023-04-12
Description: Jenkins WSO2 Oauth Plugin 1.0 and earlier does not mask the WSO2 Oauth client secret on the global configuration form, increasing the potential for attackers to observe and capture it.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-312, CWE-312
References: http://www.openwall.com/lists/oss-security/2023/04/13/3; https://www.jenkins.io/security/advisory/2023-04-12/#SECURITY-2992; http://www.openwall.com/lists/oss-security/2023/04/13/3
CVE: CVE-2023-30529
Published: 2023-04-12
Description: Jenkins Lucene-Search Plugin 387.v938a_ecb_f7fe9 and earlier does not require POST requests for an HTTP endpoint, allowing attackers to reindex the database.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: http://www.openwall.com/lists/oss-security/2023/04/13/3; https://www.jenkins.io/security/advisory/2023-04-12/#SECURITY-3013; http://www.openwall.com/lists/oss-security/2023/04/13/3
CVE: CVE-2023-30530
Published: 2023-04-12
Description: Jenkins Consul KV Builder Plugin 2.0.13 and earlier stores the HashiCorp Consul ACL Token unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-312, CWE-312
References: http://www.openwall.com/lists/oss-security/2023/04/13/3; https://www.jenkins.io/security/advisory/2023-04-12/#SECURITY-2944; http://www.openwall.com/lists/oss-security/2023/04/13/3
CVE: CVE-2023-30531
Published: 2023-04-12
Description: Jenkins Consul KV Builder Plugin 2.0.13 and earlier does not mask the HashiCorp Consul ACL Token on the global configuration form, increasing the potential for attackers to observe and capture it.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-312, CWE-312
References: http://www.openwall.com/lists/oss-security/2023/04/13/3; https://www.jenkins.io/security/advisory/2023-04-12/#SECURITY-2944; http://www.openwall.com/lists/oss-security/2023/04/13/3
CVE: CVE-2023-30532
Published: 2023-04-12
Description: A missing permission check in Jenkins TurboScript Plugin 1.3 and earlier allows attackers with Item/Read permission to trigger builds of jobs corresponding to the attacker-specified repository.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862, CWE-862
References: http://www.openwall.com/lists/oss-security/2023/04/13/3; https://www.jenkins.io/security/advisory/2023-04-12/#SECURITY-2851; http://www.openwall.com/lists/oss-security/2023/04/13/3
CVE: CVE-2023-1990
Published: 2023-04-12
Description: A use-after-free flaw was found in ndlc_remove in drivers/nfc/st-nci/ndlc.c in the Linux Kernel. This flaw could allow an attacker to crash the system due to a race problem.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-416, CWE-416
References: https://lists.debian.org/debian-lts-announce/2023/05/msg00005.html; https://lists.debian.org/debian-lts-announce/2023/05/msg00006.html; https://lore.kernel.org/all/[PII_REDACTED]0[PII_REDACTED]-1-zyytlz.wz%40163.com/
CVE: CVE-2023-24513
Published: 2023-04-12
Description: On affected platforms running Arista CloudEOS an issue in the Software Forwarding Engine (Sfe) can lead to a potential denial of service attack by sending malformed packets to the switch. This causes a leak of packet buffers and if enough malformed packets are received, the switch may eventually stop forwarding traffic.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-126, CWE-125
References: https://www.arista.com/en/support/advisories-notices/security-advisory/17240-security-advisory-0085; https://www.arista.com/en/support/advisories-notices/security-advisory/17240-security-advisory-0085
CVE: CVE-2023-26371
Published: 2023-04-12
Description: Adobe Dimension version 3.4.8 (and earlier) is affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-125
References: https://helpx.adobe.com/security/products/dimension/apsb23-27.html; https://helpx.adobe.com/security/products/dimension/apsb23-27.html
CVE: CVE-2023-26372
Published: 2023-04-12
Description: Adobe Dimension version 3.4.8 (and earlier) is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/dimension/apsb23-27.html; https://helpx.adobe.com/security/products/dimension/apsb23-27.html
CVE: CVE-2023-26373
Published: 2023-04-12
Description: Adobe Dimension version 3.4.8 (and earlier) is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/dimension/apsb23-27.html; https://helpx.adobe.com/security/products/dimension/apsb23-27.html
CVE: CVE-2023-26374
Published: 2023-04-12
Description: Adobe Dimension version 3.4.8 (and earlier) is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/dimension/apsb23-27.html; https://helpx.adobe.com/security/products/dimension/apsb23-27.html
CVE: CVE-2023-26375
Published: 2023-04-12
Description: Adobe Dimension version 3.4.8 (and earlier) is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/dimension/apsb23-27.html; https://helpx.adobe.com/security/products/dimension/apsb23-27.html
CVE: CVE-2023-26376
Published: 2023-04-12
Description: Adobe Dimension version 3.4.8 (and earlier) is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/dimension/apsb23-27.html; https://helpx.adobe.com/security/products/dimension/apsb23-27.html
CVE: CVE-2023-26377
Published: 2023-04-12
Description: Adobe Dimension version 3.4.8 (and earlier) is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/dimension/apsb23-27.html; https://helpx.adobe.com/security/products/dimension/apsb23-27.html