deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-1570
Published: 2023-03-22
Description: A vulnerability, which was classified as problematic, has been found in syoyo tinydng. Affected by this issue is the function __interceptor_memcpy of the file tiny_dng_loader.h. The manipulation leads to heap-based buffer overflow. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. It is recommended to apply a patch to fix this issue. VDB-223562 is the identifier assigned to this vulnerability.
CVSS Score: 3.3 (LOW)
CWE: CWE-122
References: https://github.com/10cksYiqiyinHangzhouTechnology/tinydngSecurityIssueReport1; https://github.com/syoyo/tinydng/issues/28; https://github.com/syoyo/tinydng/issues/29
CVE: CVE-2023-1571
Published: 2023-03-22
Description: A vulnerability, which was classified as critical, was found in DataGear up to 4.5.0. This affects an unknown part of the file /analysisProject/pagingQueryData. The manipulation of the argument queryOrder leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.5.1 is able to address this issue. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-223563.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/yangyanglo/ForCVE/blob/main/2023-0x01.md; https://vuldb.com/?ctiid.223563; https://vuldb.com/?id.223563
CVE: CVE-2023-26913
Published: 2023-03-22
Description: EVOLUCARE ECSIMAGING (aka ECS Imaging) < 6.21.5 is vulnerable to Cross Site Scripting (XSS) via new_movie. php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wanheiqiyihu.top/2023/02/13/Evolucare-Ecsimaging-new-movie-php%E5%8F%8D%E5%B0%84%E6%80%A7xss/; https://wanheiqiyihu.top/2023/02/13/Evolucare-Ecsimaging-new-movie-php%E5%8F%8D%E5%B0%84%E6%80%A7xss/
CVE: CVE-2023-1573
Published: 2023-03-22
Description: A vulnerability was found in DataGear up to 1.11.1 and classified as problematic. This issue affects some unknown processing of the component Graph Dataset Handler. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.12.0 is able to address this issue. It is recommended to upgrade the affected component. The identifier VDB-223565 was assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/datageartech/datagear/releases/tag/v1.12.0; https://github.com/yangyanglo/ForCVE/blob/main/2023-0x04.md; https://vuldb.com/?ctiid.223565
CVE: CVE-2023-1578
Published: 2023-03-22
Description: SQL Injection in GitHub repository pimcore/pimcore prior to 10.5.19.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/pimcore/pimcore/commit/367b74488808d71ec3f66f4ca9e8df5217c2c8d2; https://huntr.dev/bounties/7e441a14-8e55-4ab4-932c-4dc56bb1bc2e; https://github.com/pimcore/pimcore/commit/367b74488808d71ec3f66f4ca9e8df5217c2c8d2
CVE: CVE-2022-3938
Published: 2023-03-22
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2023-0464
Published: 2023-03-22
Description: A security vulnerability has been identified in all supported versions

of OpenSSL related to the verification of X.509 certificate chains
that include policy constraints.  Attackers may be able to exploit this
vulnerability by creating a malicious certificate chain that triggers
exponential use of computational resources, leading to a denial-of-service
(DoS) attack on affected systems.

Policy processing is disabled by default but can be enabled by passing
the `-policy' argument to the command line utilities or by calling the
`X509_VERIFY_PARAM_set1_policies()' function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-295, CWE-295
References: https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2017771e2db3e2b96f89bbe8766c3209f6a99545; https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2dcd4f1e3115f38cefa43e3efbe9b801c27e642e; https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=879f7080d7e141f415c79eaa3a8ac4a3dad0348b
CVE: CVE-2023-21615
Published: 2023-03-22
Description: Experience Manager versions 6.5.15.0 (and earlier) are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb23-18.html; https://helpx.adobe.com/security/products/experience-manager/apsb23-18.html
CVE: CVE-2023-21616
Published: 2023-03-22
Description: Experience Manager versions 6.5.15.0 (and earlier) are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb23-18.html; https://helpx.adobe.com/security/products/experience-manager/apsb23-18.html
CVE: CVE-2023-22252
Published: 2023-03-22
Description: Experience Manager versions 6.5.15.0 (and earlier) are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb23-18.html; https://helpx.adobe.com/security/products/experience-manager/apsb23-18.html
CVE: CVE-2023-22253
Published: 2023-03-22
Description: Experience Manager versions 6.5.15.0 (and earlier) are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb23-18.html; https://helpx.adobe.com/security/products/experience-manager/apsb23-18.html
CVE: CVE-2023-22254
Published: 2023-03-22
Description: Experience Manager versions 6.5.15.0 (and earlier) are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb23-18.html; https://helpx.adobe.com/security/products/experience-manager/apsb23-18.html
CVE: CVE-2023-22256
Published: 2023-03-22
Description: Experience Manager versions 6.5.15.0 (and earlier) are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. A low-privilege authenticated attacker could leverage this vulnerability to redirect users to malicious websites. Exploitation of this issue requires user interaction.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-601
References: https://helpx.adobe.com/security/products/experience-manager/apsb23-18.html; https://helpx.adobe.com/security/products/experience-manager/apsb23-18.html
CVE: CVE-2023-22257
Published: 2023-03-22
Description: Experience Manager versions 6.5.15.0 (and earlier) are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. A low-privilege authenticated attacker could leverage this vulnerability to redirect users to malicious websites. Exploitation of this issue requires user interaction.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-601
References: https://helpx.adobe.com/security/products/experience-manager/apsb23-18.html; https://helpx.adobe.com/security/products/experience-manager/apsb23-18.html
CVE: CVE-2023-22258
Published: 2023-03-22
Description: Experience Manager versions 6.5.15.0 (and earlier) are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. A low-privilege authenticated attacker could leverage this vulnerability to redirect users to malicious websites. Exploitation of this issue requires user interaction.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-601
References: https://helpx.adobe.com/security/products/experience-manager/apsb23-18.html; https://helpx.adobe.com/security/products/experience-manager/apsb23-18.html
CVE: CVE-2023-22259
Published: 2023-03-22
Description: Experience Manager versions 6.5.15.0 (and earlier) are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. A low-privilege authenticated attacker could leverage this vulnerability to redirect users to malicious websites. Exploitation of this issue requires user interaction.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-601, CWE-601
References: https://helpx.adobe.com/security/products/experience-manager/apsb23-18.html; https://helpx.adobe.com/security/products/experience-manager/apsb23-18.html
CVE: CVE-2023-22260
Published: 2023-03-22
Description: Experience Manager versions 6.5.15.0 (and earlier) are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. A low-privilege authenticated attacker could leverage this vulnerability to redirect users to malicious websites. Exploitation of this issue requires user interaction.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-601, CWE-601
References: https://helpx.adobe.com/security/products/experience-manager/apsb23-18.html; https://helpx.adobe.com/security/products/experience-manager/apsb23-18.html
CVE: CVE-2023-22261
Published: 2023-03-22
Description: Experience Manager versions 6.5.15.0 (and earlier) are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. A low-privilege authenticated attacker could leverage this vulnerability to redirect users to malicious websites. Exploitation of this issue requires user interaction.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-601, CWE-601
References: https://helpx.adobe.com/security/products/experience-manager/apsb23-18.html; https://helpx.adobe.com/security/products/experience-manager/apsb23-18.html
CVE: CVE-2023-22262
Published: 2023-03-22
Description: Experience Manager versions 6.5.15.0 (and earlier) are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. A low-privilege authenticated attacker could leverage this vulnerability to redirect users to malicious websites. Exploitation of this issue requires user interaction.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-601
References: https://helpx.adobe.com/security/products/experience-manager/apsb23-18.html; https://helpx.adobe.com/security/products/experience-manager/apsb23-18.html
CVE: CVE-2023-22263
Published: 2023-03-22
Description: Experience Manager versions 6.5.15.0 (and earlier) are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. A low-privilege authenticated attacker could leverage this vulnerability to redirect users to malicious websites. Exploitation of this issue requires user interaction.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-601
References: https://helpx.adobe.com/security/products/experience-manager/apsb23-18.html; https://helpx.adobe.com/security/products/experience-manager/apsb23-18.html
CVE: CVE-2023-22264
Published: 2023-03-22
Description: Experience Manager versions 6.5.15.0 (and earlier) are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. A low-privilege authenticated attacker could leverage this vulnerability to redirect users to malicious websites. Exploitation of this issue requires user interaction.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-601
References: https://helpx.adobe.com/security/products/experience-manager/apsb23-18.html; https://helpx.adobe.com/security/products/experience-manager/apsb23-18.html
CVE: CVE-2023-22265
Published: 2023-03-22
Description: Experience Manager versions 6.5.15.0 (and earlier) are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. A low-privilege authenticated attacker could leverage this vulnerability to redirect users to malicious websites. Exploitation of this issue requires user interaction.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-601, CWE-601
References: https://helpx.adobe.com/security/products/experience-manager/apsb23-18.html; https://helpx.adobe.com/security/products/experience-manager/apsb23-18.html
CVE: CVE-2023-22266
Published: 2023-03-22
Description: Experience Manager versions 6.5.15.0 (and earlier) are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. A low-privilege authenticated attacker could leverage this vulnerability to redirect users to malicious websites. Exploitation of this issue requires user interaction.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-601
References: https://helpx.adobe.com/security/products/experience-manager/apsb23-18.html; https://helpx.adobe.com/security/products/experience-manager/apsb23-18.html
CVE: CVE-2023-22269
Published: 2023-03-22
Description: Experience Manager versions 6.5.15.0 (and earlier) are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb23-18.html; https://helpx.adobe.com/security/products/experience-manager/apsb23-18.html
CVE: CVE-2023-22271
Published: 2023-03-22
Description: Experience Manager versions 6.5.15.0 (and earlier) are affected by a Weak Cryptography for Passwords vulnerability that can lead to a security feature bypass. A low-privileged attacker can exploit this in order to decrypt a user's password. The attack complexity is high since a successful exploitation requires to already have in possession this encrypted secret.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-261, CWE-326
References: https://helpx.adobe.com/security/products/experience-manager/apsb23-18.html; https://helpx.adobe.com/security/products/experience-manager/apsb23-18.html
CVE: CVE-2023-25859
Published: 2023-03-22
Description: Illustrator version 26.5.2 (and earlier) and 27.2.0 (and earlier) are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://helpx.adobe.com/security/products/illustrator/apsb23-19.html; https://helpx.adobe.com/security/products/illustrator/apsb23-19.html
CVE: CVE-2023-25860
Published: 2023-03-22
Description: Illustrator version 26.5.2 (and earlier) and 27.2.0 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/illustrator/apsb23-19.html; https://helpx.adobe.com/security/products/illustrator/apsb23-19.html
CVE: CVE-2023-25861
Published: 2023-03-22
Description: Illustrator version 26.5.2 (and earlier) and 27.2.0 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/illustrator/apsb23-19.html; https://helpx.adobe.com/security/products/illustrator/apsb23-19.html
CVE: CVE-2023-25862
Published: 2023-03-22
Description: Illustrator version 26.5.2 (and earlier) and 27.2.0 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://helpx.adobe.com/security/products/illustrator/apsb23-19.html; https://helpx.adobe.com/security/products/illustrator/apsb23-19.html
CVE: CVE-2023-26358
Published: 2023-03-22
Description: Creative Cloud version 5.9.1 (and earlier) is affected by an Untrusted Search Path vulnerability that might allow attackers to execute their own programs, access unauthorized data files, or modify configuration in unexpected ways. If the application uses a search path to locate critical resources such as programs, then an attacker could modify that search path to point to a malicious program, which the targeted application would then execute. The problem extends to any type of critical resource that the application trusts.
CVSS Score: 8.6 (HIGH)
CWE: CWE-426
References: https://helpx.adobe.com/security/products/creative-cloud/apsb23-21.html; https://helpx.adobe.com/security/products/creative-cloud/apsb23-21.html
CVE: CVE-2023-26426
Published: 2023-03-22
Description: Illustrator version 26.5.2 (and earlier) and 27.2.0 (and earlier) are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://helpx.adobe.com/security/products/illustrator/apsb23-19.html; https://helpx.adobe.com/security/products/illustrator/apsb23-19.html
CVE: CVE-2023-27754
Published: 2023-03-22
Description: vox2mesh 1.0 has stack-overflow in main.cpp, this is stack-overflow caused by incorrect use of memcpy() funciton. The flow allows an attacker to cause a denial of service (abort) via a crafted file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://github.com/10cksYiqiyinHangzhouTechnology/vox2mesh_poc; https://github.com/10cksYiqiyinHangzhouTechnology/vox2mesh_poc
CVE: CVE-2023-0870
Published: 2023-03-22
Description: A form can be manipulated with cross-site request forgery in multiple versions of OpenNMS Meridian and Horizon. This can potentially allow an attacker to gain access to confidential information and compromise integrity. The solution is to upgrade to Meridian 2023.1.1 or Horizon 31.0.6 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.

CVSS Score: 8.1 (HIGH)
CWE: CWE-352, CWE-352
References: https://docs.opennms.com/meridian/2023/releasenotes/changelog.html#releasenotes-changelog-Meridian-2023.1.1; https://github.com/OpenNMS/opennms/pull/5835/files; https://docs.opennms.com/meridian/2023/releasenotes/changelog.html#releasenotes-changelog-Meridian-2023.1.1
CVE: CVE-2023-25820
Published: 2023-03-22
Description: Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform, and Nextcloud Enterprise Server is the enterprise version of the file server software. In Nextcloud Server versions 25.0.x prior to 25.0.5 and versions 24.0.x prior to 24.0.10 as well as Nextcloud Enterprise Server versions 25.0.x prior to 25.0.4, 24.0.x prior to 24.0.10, 23.0.x prior to 23.0.12.5, 22.x prior to 22.2.0.10, and 21.x prior to 21.0.9.10, when an attacker gets access to an already logged in user session they can then brute force the password on the confirmation endpoint. Nextcloud Server should upgraded to 24.0.10 or 25.0.4 and Nextcloud Enterprise Server should upgraded to 21.0.9.10, 22.2.10.10, 23.0.12.5, 24.0.10, or 25.0.4 to receive a patch. No known workarounds are available.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-307
References: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-36g6-wjx2-333x; https://github.com/nextcloud/server/pull/36489; https://hackerone.com/reports/1842114
CVE: CVE-2023-28114
Published: 2023-03-22
Description: `cilium-cli` is the command line interface to install, manage, and troubleshoot Kubernetes clusters running Cilium. Prior to version 0.13.2,`cilium-cli`, when used to configure cluster mesh functionality, can remove the enforcement of user permissions on the `etcd` store used to mirror local cluster information to remote clusters. Users who have set up cluster meshes using the Cilium Helm chart are not affected by this issue.

Due to an incorrect mount point specification, the settings specified by the `initContainer` that configures `etcd` users and their permissions are overwritten when using `cilium-cli` to configure a cluster mesh. An attacker who has already gained access to a valid key and certificate for an `etcd` cluster compromised in this manner could then modify state in that `etcd` cluster.

This issue is patched in `cilium-cli` 0.13.2. As a workaround, one may use Cilium's Helm charts to create their cluster.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-280, CWE-755
References: https://artifacthub.io/packages/helm/cilium/cilium; https://github.com/cilium/cilium-cli/commit/fb[PII_REDACTED]e1eebc4a7710d902c4f22cae2610; https://github.com/cilium/cilium-cli/releases/tag/v0.13.2
CVE: CVE-2023-27224
Published: 2023-03-22
Description: An issue found in NginxProxyManager v.2.9.19 allows an attacker to execute arbitrary code via a lua script to the configuration file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-77
References: https://github.com/LinuxProgramDevelop/NginxProxyManagerCommandInjectVulnInfo/blob/main/Nginx_proxy_manager_Command_Inject_vulnerability.pdf; https://github.com/NginxProxyManager/nginx-proxy-manager; https://github.com/LinuxProgramDevelop/NginxProxyManagerCommandInjectVulnInfo/blob/main/Nginx_proxy_manager_Command_Inject_vulnerability.pdf
CVE: CVE-2023-28117
Published: 2023-03-22
Description: Sentry SDK is the official Python SDK for Sentry, real-time crash reporting software. When using the Django integration of versions prior to 1.14.0 of the Sentry SDK in a specific configuration it is possible to leak sensitive cookies values, including the session cookie to Sentry. These sensitive cookies could then be used by someone with access to your Sentry issues to impersonate or escalate their privileges within your application.

In order for these sensitive values to be leaked, the Sentry SDK configuration must have `sendDefaultPII` set to `True`; one must use a custom name for either `SESSION_COOKIE_NAME` or `CSRF_COOKIE_NAME` in one's Django settings; and one must not be configured in one's organization or project settings to use Sentry's data scrubbing features to account for the custom cookie names.

As of version 1.14.0, the Django integration of the `sentry-sdk` will detect the custom cookie names based on one's Django settings and will remove the values from the payload before sending the data to Sentry. As a workaround, use the SDK's filtering mechanism to remove the cookies from the payload that is sent to Sentry. For error events, this can be done with the `before_send` callback method and for performance related events (transactions) one can use the `before_send_transaction` callback method. Those who want to handle filtering of these values on the server-side can also use Sentry's advanced data scrubbing feature to account for the custom cookie names. Look for the `$http.cookies`, `$http.headers`, `$request.cookies`, or `$request.headers` fields to target with a scrubbing rule.
CVSS Score: 7.6 (HIGH)
CWE: CWE-201, CWE-209
References: https://github.com/getsentry/sentry-python/pull/1842; https://github.com/getsentry/sentry-python/releases/tag/1.14.0; https://github.com/getsentry/sentry-python/security/advisories/GHSA-29pr-6jr8-q5jm