deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-20065
Published: 2023-03-23
Description: A vulnerability in the Cisco IOx application hosting subsystem of Cisco IOS XE Software could allow an authenticated, local attacker to elevate privileges to root on an affected device. 
 This vulnerability is due to insufficient restrictions on the hosted application. An attacker could exploit this vulnerability by logging in to and then escaping the Cisco IOx application container. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with root privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-284
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iox-priv-escalate-Xg8zkyPk; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iox-priv-escalate-Xg8zkyPk
CVE: CVE-2023-20066
Published: 2023-03-23
Description: A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated, remote attacker to perform a directory traversal and access resources that are outside the filesystem mountpoint of the web UI. This vulnerability is due to an insufficient security configuration. An attacker could exploit this vulnerability by sending a crafted request to the web UI. A successful exploit could allow the attacker to gain read access to files that are outside the filesystem mountpoint of the web UI. Note: These files are located on a restricted filesystem that is maintained for the web UI. There is no ability to write to any files on this filesystem.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-23, CWE-22
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webui-pthtrv-es7GSb9V; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webui-pthtrv-es7GSb9V
CVE: CVE-2023-20067
Published: 2023-03-23
Description: A vulnerability in the HTTP-based client profiling feature of Cisco IOS XE Software for Wireless LAN Controllers (WLCs) could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to insufficient input validation of received traffic. An attacker could exploit this vulnerability by sending crafted traffic through a wireless access point. A successful exploit could allow the attacker to cause CPU utilization to increase, which could result in a DoS condition on an affected device and could cause new wireless client associations to fail. Once the offending traffic stops, the affected system will return to an operational state and new client associations will succeed.
CVSS Score: 7.4 (HIGH)
CWE: CWE-770, CWE-770
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ewlc-dos-wFujBHKw; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ewlc-dos-wFujBHKw
CVE: CVE-2023-20072
Published: 2023-03-23
Description: A vulnerability in the fragmentation handling code of tunnel protocol packets in Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected system to reload, resulting in a denial of service (DoS) condition. This vulnerability is due to the improper handling of large fragmented tunnel protocol packets. One example of a tunnel protocol is Generic Routing Encapsulation (GRE). An attacker could exploit this vulnerability by sending crafted fragmented packets to an affected system. A successful exploit could allow the attacker to cause the affected system to reload, resulting in a DoS condition. Note: Only traffic directed to the affected system can be used to exploit this vulnerability.
CVSS Score: 8.6 (HIGH)
CWE: CWE-20
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-gre-crash-p6nE5Sq5; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-gre-crash-p6nE5Sq5
CVE: CVE-2023-20080
Published: 2023-03-23
Description: A vulnerability in the IPv6 DHCP version 6 (DHCPv6) relay and server features of Cisco IOS and IOS XE Software could allow an unauthenticated, remote attacker to trigger a denial of service (DoS) condition. This vulnerability is due to insufficient validation of data boundaries. An attacker could exploit this vulnerability by sending crafted DHCPv6 messages to an affected device. A successful exploit could allow the attacker to cause the device to reload unexpectedly.
CVSS Score: 8.6 (HIGH)
CWE: CWE-129, CWE-129
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-dhcpv6-dos-44cMvdDK; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-dhcpv6-dos-44cMvdDK
CVE: CVE-2023-20081
Published: 2023-03-23
Description: A vulnerability in the IPv6 DHCP (DHCPv6) client module of Cisco Adaptive Security Appliance (ASA) Software, Cisco Firepower Threat Defense (FTD) Software, Cisco IOS Software, and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to insufficient validation of DHCPv6 messages. An attacker could exploit this vulnerability by sending crafted DHCPv6 messages to an affected device. A successful exploit could allow the attacker to cause the device to reload, resulting in a DoS condition. Note: To successfully exploit this vulnerability, the attacker would need to either control the DHCPv6 server or be in a man-in-the-middle position.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-122, CWE-787
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftdios-dhcpv6-cli-Zf3zTv; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftdios-dhcpv6-cli-Zf3zTv
CVE: CVE-2023-20082
Published: 2023-03-23
Description: A vulnerability in Cisco IOS XE Software for Cisco Catalyst 9300 Series Switches could allow an authenticated, local attacker with level-15 privileges or an unauthenticated attacker with physical access to the device to execute persistent code at boot time and break the chain of trust. This vulnerability is due to errors that occur when retrieving the public release key that is used for image signature verification. An attacker could exploit this vulnerability by modifying specific variables in the Serial Peripheral Interface (SPI) flash memory of an affected device. A successful exploit could allow the attacker to execute persistent code on the underlying operating system. Note: In Cisco IOS XE Software releases 16.11.1 and later, the complexity of an attack using this vulnerability is high. However, an attacker with level-15 privileges could easily downgrade the Cisco IOS XE Software on a device to a release that would lower the attack complexity.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-78
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-c9300-spi-ace-yejYgnNQ; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-c9300-spi-ace-yejYgnNQ
CVE: CVE-2023-20097
Published: 2023-03-23
Description: A vulnerability in Cisco access points (AP) software could allow an authenticated, local attacker to inject arbitrary commands and execute them with root privileges. This vulnerability is due to improper input validation of commands that are issued from a wireless controller to an AP. An attacker with Administrator access to the CLI of the controller could exploit this vulnerability by issuing a command with crafted arguments. A successful exploit could allow the attacker to gain full root access on the AP.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-77, CWE-77
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-aironetap-cmdinj-6bjT4FL8; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-aironetap-cmdinj-6bjT4FL8
CVE: CVE-2023-20100
Published: 2023-03-23
Description: A vulnerability in the access point (AP) joining process of the Control and Provisioning of Wireless Access Points (CAPWAP) protocol of Cisco IOS XE Software for Wireless LAN Controllers (WLCs) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to a logic error that occurs when certain conditions are met during the AP joining process. An attacker could exploit this vulnerability by adding an AP that is under their control to the network. The attacker then must ensure that the AP successfully joins an affected wireless controller under certain conditions. Additionally, the attacker would need the ability to restart a valid AP that was previously connected to the controller. A successful exploit could allow the attacker to cause the affected device to restart unexpectedly, resulting in a DoS condition.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-694
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-c9800-apjoin-dos-nXRHkt5; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-c9800-apjoin-dos-nXRHkt5
CVE: CVE-2023-20107
Published: 2023-03-23
Description: A vulnerability in the deterministic random bit generator (DRBG), also known as pseudorandom number generator (PRNG), in Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software for Cisco ASA 5506-X, ASA 5508-X, and ASA 5516-X Firewalls could allow an unauthenticated, remote attacker to cause a cryptographic collision, enabling the attacker to discover the private key of an affected device. This vulnerability is due to insufficient entropy in the DRBG for the affected hardware platforms when generating cryptographic keys. An attacker could exploit this vulnerability by generating a large number of cryptographic keys on an affected device and looking for collisions with target devices. A successful exploit could allow the attacker to impersonate an affected target device or to decrypt traffic secured by an affected key that is sent to or from an affected target device.
CVSS Score: 7.5 (HIGH)
CWE: CWE-332, CWE-331
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asa5500x-entropy-6v9bHVYP; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asa5500x-entropy-6v9bHVYP
CVE: CVE-2023-20112
Published: 2023-03-23
Description: A vulnerability in Cisco access point (AP) software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to insufficient validation of certain parameters within 802.11 frames. An attacker could exploit this vulnerability by sending a wireless 802.11 association request frame with crafted parameters to an affected device. A successful exploit could allow the attacker to cause an unexpected reload of an affected device, resulting in a DoS condition.
CVSS Score: 7.4 (HIGH)
CWE: CWE-126, CWE-125
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ap-assoc-dos-D2SunWK2; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ap-assoc-dos-D2SunWK2
CVE: CVE-2023-20113
Published: 2023-03-23
Description: A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system. This vulnerability is due to insufficient CSRF protections for the web-based management interface on an affected system. An attacker could exploit this vulnerability by persuading a user of the interface to click a malicious link. A successful exploit could allow the attacker to perform arbitrary actions with the privilege level of the affected user. These actions could include modifying the system configuration and deleting accounts.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vman-csrf-76RDbLEh; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vman-csrf-76RDbLEh
CVE: CVE-2023-23707
Published: 2023-03-23
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), Unrestricted Upload of File with Dangerous Type vulnerability in Awsm Innovations Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files allows Stored XSS via upload of SVG and HTML files. This issue affects Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files plugin <= 2.7.1 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79, CWE-434
References: https://patchstack.com/database/vulnerability/embed-any-document/wordpress-embed-any-document-embed-pdf-word-powerpoint-and-excel-files-plugin-2-7-1-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/embed-any-document/wordpress-embed-any-document-embed-pdf-word-powerpoint-and-excel-files-plugin-2-7-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-25456
Published: 2023-03-23
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Klaviyo, Inc. Klaviyo plugin <= 3.0.7 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/klaviyo/wordpress-klaviyo-plugin-3-0-7-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/klaviyo/wordpress-klaviyo-plugin-3-0-7-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-25992
Published: 2023-03-23
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in CreativeMindsSolutions CM Answers plugin <= 3.1.9 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/cm-answers/wordpress-cm-answers-plugin-3-1-9-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/cm-answers/wordpress-cm-answers-plugin-3-1-9-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-26008
Published: 2023-03-23
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Ajay D'Souza Top 10 – Popular posts plugin for WordPress plugin <= 3.2.4 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/top-10/wordpress-top-10-plugin-3-2-4-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/top-10/wordpress-top-10-plugin-3-2-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-27094
Published: 2023-03-23
Description: An issue found in OpenGoofy Hippo4j v.1.4.3 allows attackers to escalate privileges via the ThreadPoolController of the tenant Management module.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269
References: https://github.com/opengoofy/hippo4j/issues/1059; https://github.com/opengoofy/hippo4j/issues/1059
CVE: CVE-2023-1605
Published: 2023-03-23
Description: Denial of Service in GitHub repository radareorg/radare2 prior to 5.8.6.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://github.com/radareorg/radare2/commit/508a[PII_REDACTED]defd1bef0999a1f[PII_REDACTED]f; https://huntr.dev/bounties/9dddcf5b-7dd4-46cc-abf9-172dce20bab2; https://github.com/radareorg/radare2/commit/508a[PII_REDACTED]defd1bef0999a1f[PII_REDACTED]f
CVE: CVE-2023-1606
Published: 2023-03-23
Description: A vulnerability was found in novel-plus 3.6.2 and classified as critical. Affected by this issue is some unknown functionality of the file DictController.java. The manipulation of the argument orderby leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-223736.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://github.com/OYyunshen/Poc/blob/main/Novel-PlusSqli1.pdf; https://vuldb.com/?ctiid.223736; https://vuldb.com/?id.223736
CVE: CVE-2020-19786
Published: 2023-03-23
Description: File upload vulnerability in CSKaza CSZ CMS v.1.2.2 fixed in v1.2.4 allows attacker to execute aritrary commands and code via crafted PHP file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434, CWE-434
References: https://github.com/cskaza/cszcms/issues/20; https://github.com/cskaza/cszcms/issues/20
CVE: CVE-2022-36413
Published: 2023-03-23
Description: Zoho ManageEngine ADSelfService Plus through 6203 is vulnerable to a brute-force attack that leads to a password reset on IDM applications.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-307
References: https://www.manageengine.com/products/self-service-password/advisory/CVE-2022-36413.html; https://www.manageengine.com/products/self-service-password/advisory/CVE-2022-36413.html
CVE: CVE-2023-1289
Published: 2023-03-23
Description: A vulnerability was discovered in ImageMagick where a specially created SVG file loads itself and causes a segmentation fault. This flaw allows a remote attacker to pass a specially crafted SVG file that leads to a segmentation fault, generating many trash files in "/tmp," resulting in a denial of service. When ImageMagick crashes, it generates a lot of trash files. These trash files can be large if the SVG file contains many render actions. In a denial of service attack, if a remote attacker uploads an SVG file of size t, ImageMagick generates files of size 103*t. If an attacker uploads a 100M SVG, the server will generate about 10G.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://bugzilla.redhat.com/show_bug.cgi?id=2176858; https://github.com/ImageMagick/ImageMagick/commit/c5b23cbf[PII_REDACTED]e6dc81f4deb25798ead6a4; https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-j96m-mjp6-99xr
CVE: CVE-2023-1544
Published: 2023-03-23
Description: A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device. This flaw allows a crafted guest driver to allocate and initialize a huge number of page tables to be used as a ring of descriptors for CQ and async events, potentially leading to an out-of-bounds read and crash of QEMU.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-125, CWE-770
References: https://access.redhat.com/security/cve/CVE-2023-1544; https://bugzilla.redhat.com/show_bug.cgi?id=2180364; https://lists.nongnu.org/archive/html/qemu-devel/2023-03/msg00206.html
CVE: CVE-2023-1607
Published: 2023-03-23
Description: A vulnerability was found in novel-plus 3.6.2. It has been classified as critical. This affects an unknown part of the file /common/sysFile/list. The manipulation of the argument sort leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-223737 was assigned to this vulnerability.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://github.com/[PII_REDACTED]/novel-plus-v3.6.2----SQL-Injection-Vulnerability-/blob/main/novel-plus%20v3.6.2%20--%20%20SQL%20Injection%20Vulnerability%20.md; https://vuldb.com/?ctiid.223737; https://vuldb.com/?id.223737
CVE: CVE-2023-1608
Published: 2023-03-23
Description: A vulnerability was found in Zhong Bang CRMEB Java up to 1.3.4. It has been declared as critical. This vulnerability affects the function getAdminList of the file /api/admin/store/product/list. The manipulation of the argument cateId leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-223738 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://github.com/crmeb/crmeb_java/issues/11; https://vuldb.com/?ctiid.223738; https://vuldb.com/?id.223738
CVE: CVE-2023-1609
Published: 2023-03-23
Description: A vulnerability was found in Zhong Bang CRMEB Java up to 1.3.4. It has been rated as problematic. This issue affects the function save of the file /api/admin/store/product/save. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-223739.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-79
References: https://github.com/crmeb/crmeb_java/issues/12; https://vuldb.com/?ctiid.223739; https://vuldb.com/?id.223739
CVE: CVE-2023-1610
Published: 2023-03-23
Description: A vulnerability, which was classified as critical, has been found in Rebuild up to 3.2.3. Affected by this issue is some unknown functionality of the file /project/tasks/list. The manipulation leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. VDB-223742 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://github.com/getrebuild/rebuild/issues/597; https://vuldb.com/?ctiid.223742; https://vuldb.com/?id.223742
CVE: CVE-2023-25654
Published: 2023-03-23
Description: baserCMS is a Content Management system. Prior to version 4.7.5, there is a Remote Code Execution (RCE) Vulnerability in the management system of baserCMS. Version 4.7.5 contains a patch.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/baserproject/basercms/commit/002886be0998c74c386e04f0b43688a8a45d7a96; https://github.com/baserproject/basercms/commit/08247f0a633d8e836ce2e5cd2d53aa19901a1359; https://github.com/baserproject/basercms/commit/60f83054d8131b0ace60716cec7e629b5eb3a8f0
CVE: CVE-2023-25655
Published: 2023-03-23
Description: baserCMS is a Content Management system. Prior to version 4.7.5, any file may be uploaded on the management system of baserCMS. Version 4.7.5 contains a patch.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434, CWE-434
References: https://github.com/baserproject/basercms/commit/922025a98b0e697ab78f6a785a004e0729aa9100; https://github.com/baserproject/basercms/commit/[PII_REDACTED]ed908c7f51bf61a0231dde91404ebd; https://github.com/baserproject/basercms/releases/tag/basercms-4.7.5
CVE: CVE-2023-26359
Published: 2023-03-23
Description: Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://helpx.adobe.com/security/products/coldfusion/apsb23-25.html; https://helpx.adobe.com/security/products/coldfusion/apsb23-25.html; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-26359
CVE: CVE-2023-26360
Published: 2023-03-23
Description: Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by an Improper Access Control vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction.
CVSS Score: 8.6 (HIGH)
CWE: CWE-284
References: http://packetstormsecurity.com/files/172079/Adobe-ColdFusion-Unauthenticated-Remote-Code-Execution.html; https://helpx.adobe.com/security/products/coldfusion/apsb23-25.html; http://packetstormsecurity.com/files/172079/Adobe-ColdFusion-Unauthenticated-Remote-Code-Execution.html
CVE: CVE-2023-26361
Published: 2023-03-23
Description: Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in Arbitrary file system read. Exploitation of this issue does not require user interaction, but does require administrator privileges.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-22
References: https://helpx.adobe.com/security/products/coldfusion/apsb23-25.html; https://helpx.adobe.com/security/products/coldfusion/apsb23-25.html