deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-2877
Published: 2023-06-27
Description: The Formidable Forms WordPress plugin before 6.3.1 does not adequately authorize the user or validate the plugin URL in its functionality for installing add-ons. This allows a user with a role as low as Subscriber to install and activate arbitrary plugins of arbitrary versions from the WordPress.org plugin repository onto the site, leading to Remote Code Execution.
CVSS Score: 8.8 (HIGH)
References: https://wpscan.com/vulnerability/33765da5-c56e-42c1-83dd-fcaad976b402; https://wpscan.com/vulnerability/33765da5-c56e-42c1-83dd-fcaad976b402
CVE: CVE-2023-2996
Published: 2023-06-27
Description: The Jetpack WordPress plugin before 12.1.1 does not validate uploaded files, allowing users with author roles or above to manipulate existing files on the site, deleting arbitrary files, and in rare cases achieve Remote Code Execution via phar deserialization.
CVSS Score: 8.8 (HIGH)
References: https://jetpack.com/blog/jetpack-12-1-1-critical-security-update/; https://wpscan.com/vulnerability/52d221bd-ae42-435d-a90a-60a5ae530663; https://jetpack.com/blog/jetpack-12-1-1-critical-security-update/
CVE: CVE-2023-2818
Published: 2023-06-27
Description: An insecure filesystem permission in the Insider Threat Management Agent for Windows enables local unprivileged users to disrupt agent monitoring. All versions prior to 7.14.3 are affected. Agents for MacOS and Linux and Cloud are unaffected.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-281, CWE-281
References: https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2023-005; https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2023-005
CVE: CVE-2023-35998
Published: 2023-06-27
Description: A missing authorization check in multiple SOAP endpoints of the Insider Threat Management Server enables an attacker on an adjacent network to read and write unauthorized objects. Successful exploitation requires an attacker to first obtain a valid agent authentication token. All versions before 7.14.3 are affected.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2023-005; https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2023-0004; https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2023-005
CVE: CVE-2023-36000
Published: 2023-06-27
Description: A missing authorization check in the MacOS agent configuration endpoint of the Insider Threat Management Server enables an anonymous attacker on an adjacent network to obtain sensitive information. Successful exploitation requires an attacker to first obtain a valid agent authentication token. All versions before 7.14.3 are affected.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2023-005; https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2023-0004; https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2023-005
CVE: CVE-2023-36002
Published: 2023-06-27
Description: A missing authorization check in multiple URL validation endpoints of the Insider Threat Management Server enables an anonymous attacker on an adjacent network to smuggle content via DNS lookups. All versions before 7.14.3 are affected.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2023-005; https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2023-0004; https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2023-005
CVE: CVE-2023-3405
Published: 2023-06-27
Description: Unchecked parameter value in M-Files Server in versions before 23.6.12695.3 (excluding 23.2 SR2 and newer) allows anonymous user to cause denial of service
CVSS Score: 7.5 (HIGH)
CWE: CWE-248
References: https://empower.m-files.com/security-advisories/CVE-2023-3405; https://product.m-files.com/security-advisories/cve-2023-3405/; https://www.m-files.com/about/trust-center/security-advisories/cve-2023-3405-denial-of-service-in-m-files-server/
CVE: CVE-2023-3431
Published: 2023-06-27
Description: Improper Access Control in GitHub repository plantuml/plantuml prior to 1.2023.9.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-284
References: https://github.com/plantuml/plantuml/commit/fbe7fa3b25b4c887d83927cffb1009ec6cb8ab1e; https://huntr.dev/bounties/fa741f95-b53c-4ed7-b157-e32c5145164c; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FV7XL3CY3K3K5ER3ASMEQA546MIQQ7QM/
CVE: CVE-2023-3432
Published: 2023-06-27
Description: Server-Side Request Forgery (SSRF) in GitHub repository plantuml/plantuml prior to 1.2023.9.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-918
References: https://github.com/plantuml/plantuml/commit/b32500bb61ae617bb312496d6d832e4be8190797; https://huntr.dev/bounties/8ac3316f-431c-468d-87e4-3dafff2ecf51; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FV7XL3CY3K3K5ER3ASMEQA546MIQQ7QM/
CVE: CVE-2023-32339
Published: 2023-06-27
Description: IBM Business Automation Workflow is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.  IBM X-Force ID:  255587.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://https://www.ibm.com/support/pages/node/6998727; https://https://www.ibm.com/support/pages/node/7001291; https://www.ibm.com/support/pages/node/6998727
CVE: CVE-2023-34098
Published: 2023-06-27
Description: Shopware is an open source e-commerce software. Due to an incorrect configuration in the `.htaccess` file, the configuration file of the Javascript could be read in production environments (`themes/package-lock.json`). With this information, the specific Shopware version in a deployment might be determined by an attacker, which could be used for further attacks. Users are advised to update to version 5.7.18. There are no known workarounds for this vulnerability.

CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-06-2023; https://github.com/shopware/shopware/security/advisories/GHSA-q97c-2mh3-pgw9; https://github.com/shopware5/shopware/commit/b3518c8d9562a38615d638f31f79829f6e2f4b6a
CVE: CVE-2023-34099
Published: 2023-06-27
Description: Shopware is an open source e-commerce software. The mail validation in the registration process had some flaws, so it was possible to construct different mail addresses, that in the end result in the same address, which is shared by multiple accounts. This issue has been addressed in version 5.7.18 and users are advised to update. There are no known workarounds for this vulnerability.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-754
References: https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-06-2023; https://github.com/shopware/shopware/security/advisories/GHSA-gh66-fp7j-98v5; https://github.com/shopware5/shopware/commit/39cc714d9a0be33b43877044d0b88ea3c6b43f3d
CVE: CVE-2023-34240
Published: 2023-06-27
Description: Cloudexplorer-lite is an open source cloud software stack. Weak passwords can be easily guessed and are an easy target for brute force attacks. This can lead to an authentication system failure and compromise system security. Versions of cloudexplorer-lite prior to 1.2.0 did not enforce strong passwords. This vulnerability has been fixed in version 1.2.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-521
References: https://github.com/CloudExplorer-Dev/CloudExplorer-Lite/security/advisories/GHSA-px4m-5j22-5mw4; https://github.com/CloudExplorer-Dev/CloudExplorer-Lite/security/advisories/GHSA-px4m-5j22-5mw4
CVE: CVE-2023-34830
Published: 2023-06-27
Description: i-doit Open v24 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the timeout parameter on the login page.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/leekenghwa/CVE-2023-34830---Reflected-XSS-found-in-I-doit-Open-v24-and-below; https://medium.com/%40ray.999/cve-2023-34830-reflected-xss-on-i-doit-open-v24-and-below-ad58036f5407; https://github.com/leekenghwa/CVE-2023-34830---Reflected-XSS-found-in-I-doit-Open-v24-and-below
CVE: CVE-2023-35799
Published: 2023-06-27
Description: Stormshield Endpoint Security Evolution 2.0.0 through 2.3.2 has Insecure Permissions. An interactive user can use the SES Evolution agent to create arbitrary files with local system privileges.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-732
References: https://advisories.stormshield.eu; https://advisories.stormshield.eu/2023-022/; https://advisories.stormshield.eu
CVE: CVE-2023-35800
Published: 2023-06-27
Description: Stormshield Endpoint Security Evolution 2.0.0 through 2.4.2 has Insecure Permissions. An ACL entry on the SES Evolution agent directory that contains the agent logs displayed in the GUI allows interactive users to read data, which could allow access to information reserved to administrators.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-732
References: https://advisories.stormshield.eu; https://advisories.stormshield.eu/2023-021/; https://advisories.stormshield.eu
CVE: CVE-2022-34352
Published: 2023-06-27
Description: 
IBM QRadar SIEM 7.5.0 is vulnerable to information exposure allowing a delegated Admin tenant user with a specific domain security profile assigned to see data from other domains.  IBM X-Force ID:  230403.


CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200, CWE-200
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/230403; https://www.ibm.com/support/pages/node/7006057; https://exchange.xforce.ibmcloud.com/vulnerabilities/230403
CVE: CVE-2023-26273
Published: 2023-06-27
Description: IBM QRadar SIEM 7.5.0 could allow an authenticated user to perform unauthorized actions due to hazardous input validation.  IBM X-Force ID:  248134.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/248134; https://www.ibm.com/support/pages/node/7006083; https://exchange.xforce.ibmcloud.com/vulnerabilities/248134
CVE: CVE-2023-26274
Published: 2023-06-27
Description: 
IBM QRadar SIEM 7.5.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 248144.


CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/248144; https://www.ibm.com/support/pages/node/7006085; https://exchange.xforce.ibmcloud.com/vulnerabilities/248144
CVE: CVE-2023-26276
Published: 2023-06-27
Description: IBM QRadar SIEM 7.5.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.  IBM X-Force ID:  248147.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-327, CWE-327
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/248147; https://www.ibm.com/support/pages/node/7006081; https://exchange.xforce.ibmcloud.com/vulnerabilities/248147
CVE: CVE-2023-28857
Published: 2023-06-27
Description: Apereo CAS is an open source multilingual single sign-on solution for the web. Apereo CAS can be configured to use authentication based on client X509 certificates. These certificates can be provided via TLS handshake or a special HTTP header, such as “ssl_client_cert”. When checking the validity of the provided client certificate, X509CredentialsAuthenticationHandler performs check that this certificate is not revoked. To do so, it fetches URLs provided in the “CRL Distribution Points” extension of the certificate, which are taken from the certificate itself and therefore can be controlled by a malicious user. If the CAS server is configured to use an LDAP server for x509 authentication with a password, for example by setting a “cas.authn.x509.ldap.ldap-url” and “cas.authn.x509.ldap.bind-credential” properties, X509CredentialsAuthenticationHandler fetches revocation URLs from the certificate, which can be LDAP urls. When making requests to this LDAP urls, Apereo CAS uses the same password as for initially configured LDAP server, which can lead to a password leak. An unauthenticated user can leak the password used to LDAP connection configured on server. This issue has been addressed in version 6.6.6. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200, CWE-522
References: https://apereo.github.io/2023/02/20/x509-vuln/; https://github.com/apereo/cas/releases/tag/v6.6.6; https://securitylab.github.com/advisories/GHSL-2023-009_Apereo_CAS/
CVE: CVE-2023-33566
Published: 2023-06-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that there was not reasonable evidence to determine the existence of a vulnerability.
CVE: CVE-2023-33567
Published: 2023-06-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that there was not reasonable evidence to determine the existence of a vulnerability.
CVE: CVE-2023-34835
Published: 2023-06-27
Description: A Cross Site Scripting vulnerability in Microworld Technologies eScan Management console v.14.0.1400.2281 allows a remote attacker to execute arbitrary JavaScript code via a vulnerable delete_file parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/sahiloj/CVE-2023-34835/blob/main/README.md; https://github.com/sahiloj/CVE-2023-34835/blob/main/README.md
CVE: CVE-2023-34836
Published: 2023-06-27
Description: A Cross Site Scripting vulnerability in Microworld Technologies eScan Management console v.14.0.1400.2281 allows a remote attacker to execute arbitrary code via a crafted script to the Dtltyp and ListName parameters.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/sahiloj/CVE-2023-34836/blob/main/README.md; https://github.com/sahiloj/CVE-2023-34836/blob/main/README.md
CVE: CVE-2023-34837
Published: 2023-06-27
Description: A Cross Site Scripting vulnerability in Microworld Technologies eScan Management console v.14.0.1400.2281 allows a remote attacker to execute arbitrary code via a vulnerable parameter GrpPath.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/sahiloj/CVE-2023-34837/blob/main/README.md; https://github.com/sahiloj/CVE-2023-34837/blob/main/README.md
CVE: CVE-2023-34838
Published: 2023-06-27
Description: A Cross Site Scripting vulnerability in Microworld Technologies eScan Management console v.14.0.1400.2281 allows a remote attacker to execute arbitrary code via a crafted script to the Description parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/sahiloj/CVE-2023-34838/blob/main/README.md; https://github.com/sahiloj/CVE-2023-34838/blob/main/README.md
CVE: CVE-2023-34839
Published: 2023-06-27
Description: A Cross Site Request Forgery (CSRF) vulnerability in Issabel issabel-pbx v.4.0.0-6 allows a remote attacker to gain privileges via a Custom CSRF exploit to create new user function in the application.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: https://github.com/sahiloj/CVE-2023-34839/blob/main/README.md; https://github.com/sahiloj/CVE-2023-34839/blob/main/README.md
CVE: CVE-2020-18418
Published: 2023-06-27
Description: A Cross site request forgery (CSRF) vulnerability was discovered in FeiFeiCMS v4.1.190209, which allows attackers to create administrator accounts via /index.php?s=Admin-Admin-Insert.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/GodEpic/Vulnerability-detection/blob/master/feifeicms/FeiFeiCMS_4.1_csrf.doc; https://github.com/GodEpic/Vulnerability-detection/blob/master/feifeicms/poc; https://github.com/GodEpic/Vulnerability-detection/blob/master/feifeicms/FeiFeiCMS_4.1_csrf.doc
CVE: CVE-2023-22593
Published: 2023-06-27
Description: 
IBM Robotic Process Automation for Cloud Pak 21.0.1 through 21.0.7.3 and 23.0.0 through 23.0.3 is vulnerable to security misconfiguration of the Redis container which may provide elevated privileges.  IBM X-Force ID:  244074.


CVSS Score: 4.0 (MEDIUM)
CWE: CWE-863
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/244074; https://www.ibm.com/support/pages/node/7006001; https://exchange.xforce.ibmcloud.com/vulnerabilities/244074
CVE: CVE-2023-23468
Published: 2023-06-27
Description: IBM Robotic Process Automation for Cloud Pak 21.0.1 through 21.0.7.3 and 23.0.0 through 23.0.3 is vulnerable to insufficient security configuration which may allow creation of namespaces within a cluster.  IBM X-Force ID:  244500.
CVSS Score: 5.1 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/244500; https://www.ibm.com/support/pages/node/7005999; https://exchange.xforce.ibmcloud.com/vulnerabilities/244500
CVE: CVE-2023-25004
Published: 2023-06-27
Description: A maliciously crafted pskernel.dll file in Autodesk products is used to trigger integer overflow vulnerabilities. Exploitation of these vulnerabilities may lead to code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2023-0009; https://www.autodesk.com/trust/security-advisories/adsk-sa-2023-0009
CVE: CVE-2023-29068
Published: 2023-06-27
Description: A maliciously crafted file consumed through pskernel.dll file could lead to memory corruption vulnerabilities. These vulnerabilities in conjunction with other vulnerabilities could lead to code execution in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2023-0009; https://www.autodesk.com/trust/security-advisories/adsk-sa-2023-0009
CVE: CVE-2020-18406
Published: 2023-06-27
Description: An issue was discovered in cmseasy v7.0.0 that allows user credentials to be sent in clear text due to no encryption of form data.
CVSS Score: 7.5 (HIGH)
CWE: CWE-522
References: https://github.com/source-hunter/cmseasy/issues/1; https://github.com/source-hunter/cmseasy/issues/1
CVE: CVE-2020-18410
Published: 2023-06-27
Description: A stored cross site scripting (XSS) vulnerability in /index.php?admin-master-article-edit of Chaoji CMS v2.18 that allows attackers to obtain administrator privileges.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/GodEpic/chaojicms/issues/6; https://github.com/GodEpic/chaojicms/issues/6
CVE: CVE-2020-18413
Published: 2023-06-27
Description: Stored cross site scripting (XSS) vulnerability in /index.php?admin-master-navmenu-add of Chaoji CMS v2.18 that allows attackers to execute arbitrary code.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/GodEpic/chaojicms/issues/5; https://github.com/GodEpic/chaojicms/issues/5
CVE: CVE-2020-18416
Published: 2023-06-27
Description: An cross site request forgery (CSRF) vulnerability discovered in Jymusic v2.0.0.,that allows attackers to execute arbitrary code via /admin.php?s=/addons/config.html&id=6 to modify payment information.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: https://github.com/dtorp06/jymusic/issues/1; https://github.com/dtorp06/jymusic/issues/1
CVE: CVE-2020-19902
Published: 2023-06-27
Description: Directory Traversal vulnerability found in Cryptoprof WCMS v.0.3.2 allows a remote attacker to execute arbitrary code via the wex/cssjs.php parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://github.com/vedees/wcms/issues/3; https://github.com/vedees/wcms/issues/3
CVE: CVE-2023-30993
Published: 2023-06-27
Description: IBM Cloud Pak for Security (CP4S) 1.9.0.0 through 1.9.2.0 could allow an attacker with a valid API key for one tenant to access data from another tenant's account.  IBM X-Force ID:  254136.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-200, CWE-200
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/254136; https://www.ibm.com/support/pages/node/6995221; https://exchange.xforce.ibmcloud.com/vulnerabilities/254136
CVE: CVE-2023-36463
Published: 2023-06-27
Description: Meldekarten generator is an open source project to create a program, running locally in the browser without the need for an internet-connection, to create, store and print registration cards for volunteers. All text fields on the webpage are vulnerable to XSS attacks. The user input isn't (fully) sanitized after submission. This issue has been addressed in commit `77e04f4af` which is included in the `1.0.0b1.1.2` release. Users are advised to upgrade. There are no known workarounds for this vulnerability. 
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-79
References: https://github.com/jucktnich/meldekarten-generator/commit/77e04f4af85a6d0b08e616d40eaa81877a108c96; https://github.com/jucktnich/meldekarten-generator/security/advisories/GHSA-f2gp-85cr-vgj7; https://github.com/jucktnich/meldekarten-generator/commit/77e04f4af85a6d0b08e616d40eaa81877a108c96
CVE: CVE-2020-18404
Published: 2023-06-27
Description: An issue was discovered in espcms version P8.18101601. There is a cross site scripting (XSS) vulnerability that allows arbitrary code to be executed via the title parameter.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/source-hunter/espcms/issues/1; https://github.com/source-hunter/espcms/issues/1
CVE: CVE-2020-18409
Published: 2023-06-27
Description: Cross Site Request Forgery (CSRF) vulnerability was discovered in CatfishCMS 4.8.63 that would allow attackers to obtain administrator permissions via /index.php/admin/index/modifymanage.html.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: https://github.com/xwlrbh/Catfish/issues/5; https://github.com/xwlrbh/Catfish/issues/5
CVE: CVE-2020-18414
Published: 2023-06-27
Description: Stored cross site scripting (XSS) vulnerability in Chaoji CMS v2.18 that allows attackers to execute arbitrary code via /index.php?admin-master-webset.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/GodEpic/chaojicms/issues/3; https://github.com/GodEpic/chaojicms/issues/3
CVE: CVE-2023-3436
Published: 2023-06-27
Description: Xpdf 4.04 will deadlock on a PDF object stream whose "Length" field is itself in another object stream.


CVSS Score: 3.3 (LOW)
CWE: CWE-833, CWE-667
References: https://forum.xpdfreader.com/viewtopic.php?t=42618; https://forum.xpdfreader.com/viewtopic.php?t=42618
CVE: CVE-2023-36464
Published: 2023-06-27
Description: pypdf is an open source, pure-python PDF library. In affected versions an attacker may craft a PDF which leads to an infinite loop if `__parse_content_stream` is executed. That is, for example, the case if the user extracted text from such a PDF. This issue was introduced in pull request #969 and resolved in pull request #1828. Users are advised to upgrade. Users unable to upgrade may modify the line `while peek not in (b"\r", b"\n")` in `pypdf/generic/_data_structures.py` to `while peek not in (b"\r", b"\n", b"")`.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-835
References: https://github.com/py-pdf/pypdf/pull/1828; https://github.com/py-pdf/pypdf/pull/969; https://github.com/py-pdf/pypdf/security/advisories/GHSA-4vvm-4w3v-6mr8
CVE: CVE-2023-25001
Published: 2023-06-27
Description: A maliciously crafted SKP file in Autodesk Navisworks 2023 and 2022 be used to trigger use-after-free vulnerability. Exploitation of this vulnerability may lead to code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2023-0002; https://www.autodesk.com/trust/security-advisories/adsk-sa-2023-0002
CVE: CVE-2023-25002
Published: 2023-06-27
Description: A maliciously crafted SKP file in Autodesk products is used to trigger use-after-free vulnerability. Exploitation of this vulnerability may lead to code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2023-0002; https://www.autodesk.com/trust/security-advisories/adsk-sa-2023-0002