deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-47502
Published: 2023-03-24
Description: Apache OpenOffice documents can contain links that call internal macros with arbitrary arguments. Several URI Schemes are defined for this purpose.


Links can be activated by clicks, or by automatic document events.

The execution of such links must be subject to user approval.

In the affected versions of OpenOffice, approval for certain links is not   requested; when activated, such links could therefore result in arbitrary script execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20, CWE-88
References: http://www.openwall.com/lists/oss-security/2023/12/28/3; http://www.openwall.com/lists/oss-security/2024/01/03/3; https://lists.apache.org/thread/xr6tl91jj2jgcq8pdbrc4d8w13s6xn80
CVE: CVE-2023-28152
Published: 2023-03-24
Description: An issue was discovered in Independentsoft JWord before 1.1.110. The API is prone to XML external entity (XXE) injection via a remote DTD in a DOCX file.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-611, CWE-611
References: https://cds.thalesgroup.com/en/tcs-cert/CVE-2023-28152; https://excellium-services.com/cert-xlm-advisory/CVE-2023-28152; https://www.independentsoft.de/jword/index.html
CVE: CVE-2020-36691
Published: 2023-03-24
Description: An issue was discovered in the Linux kernel before 5.8. lib/nlattr.c allows attackers to cause a denial of service (unbounded recursion) via a nested Netlink policy with a back reference.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-674, CWE-674
References: https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.8; https://github.com/torvalds/linux/commit/7690aa1cdf7c4565ad6b013b324c28b685505e24; https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.8
CVE: CVE-2021-3844
Published: 2023-03-24
Description: Rapid7 InsightVM suffers from insufficient session expiration when an administrator performs a security relevant edit on an existing, logged on user. For example, if a user's password is changed by an administrator due to an otherwise unrelated credential leak, that user account's current session is still valid after the password change, potentially allowing the attacker who originally compromised the credential to remain logged in and able to cause further damage.  This vulnerability is mitigated by the use of the Platform Login feature. This issue is related to CVE-2019-5638.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-613, CWE-613
References: https://docs.rapid7.com/insightvm/enable-insightvm-platform-login; https://www.cve.org/cverecord?id=CVE-2019-5638; https://docs.rapid7.com/insightvm/enable-insightvm-platform-login
CVE: CVE-2021-3674
Published: 2023-03-24
Description: A flaw was found in rizin. The create_section_from_phdr function allocates space for ELF section data by processing the headers. Crafted values in the headers can cause out of bounds reads, which can lead to memory corruption and possibly code execution through the binary object's callback function.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-125, CWE-125
References: https://gist.github.com/netspooky/61101e191afee95feda7dbd2f6b061c4; https://github.com/rizinorg/rizin/pull/1313; https://gist.github.com/netspooky/61101e191afee95feda7dbd2f6b061c4
CVE: CVE-2021-3684
Published: 2023-03-24
Description: A vulnerability was found in OpenShift Assisted Installer. During generation of the Discovery ISO, image pull secrets were leaked as plaintext in the installation logs. An authenticated user could exploit this by re-using the image pull secret to pull container images from the registry as the associated user.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-532, CWE-532
References: https://bugzilla.redhat.com/show_bug.cgi?id=1985962; https://github.com/openshift/assisted-installer/commit/2403dad3795406f2c5d923af0894e07bc8b0bdc4; https://github.com/openshift/assisted-installer/commit/f3800cfa3d64ce6dcd6f7b73f0578bb99bfdaf7a
CVE: CVE-2021-43311
Published: 2023-03-24
Description: A heap-based buffer overflow was discovered in upx, during the generic pointer 'p' points to an inaccessible address in func get_le32(). The problem is essentially caused in PackLinuxElf32::elf_lookup() at p_lx_elf.cpp:5382.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119, CWE-787
References: https://github.com/upx/upx/issues/380; https://github.com/upx/upx/issues/380
CVE: CVE-2021-43312
Published: 2023-03-24
Description: A heap-based buffer overflow was discovered in upx, during the variable 'bucket' points to an inaccessible address. The issue is being triggered in the function PackLinuxElf64::invert_pt_dynamic at p_lx_elf.cpp:5239.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119, CWE-787
References: https://github.com/upx/upx/issues/379; https://github.com/upx/upx/issues/379
CVE: CVE-2021-43313
Published: 2023-03-24
Description: A heap-based buffer overflow was discovered in upx, during the variable 'bucket' points to an inaccessible address. The issue is being triggered in the function PackLinuxElf32::invert_pt_dynamic at p_lx_elf.cpp:1688.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119, CWE-787
References: https://github.com/upx/upx/issues/378; https://github.com/upx/upx/issues/378
CVE: CVE-2021-43314
Published: 2023-03-24
Description: A heap-based buffer overflows was discovered in upx, during the generic pointer 'p' points to an inaccessible address in func get_le32(). The problem is essentially caused in PackLinuxElf32::elf_lookup() at p_lx_elf.cpp:5368
CVSS Score: 7.5 (HIGH)
CWE: CWE-119, CWE-787
References: https://github.com/upx/upx/issues/380; https://github.com/upx/upx/issues/380
CVE: CVE-2021-43315
Published: 2023-03-24
Description: A heap-based buffer overflows was discovered in upx, during the generic pointer 'p' points to an inaccessible address in func get_le32(). The problem is essentially caused in PackLinuxElf32::elf_lookup() at p_lx_elf.cpp:5349
CVSS Score: 7.5 (HIGH)
CWE: CWE-119, CWE-787
References: https://github.com/upx/upx/issues/380; https://github.com/upx/upx/issues/380
CVE: CVE-2021-43316
Published: 2023-03-24
Description: A heap-based buffer overflow was discovered in upx, during the generic pointer 'p' points to an inaccessible address in func get_le64().
CVSS Score: 7.5 (HIGH)
CWE: CWE-119, CWE-787
References: https://github.com/upx/upx/issues/381; https://github.com/upx/upx/issues/381
CVE: CVE-2021-43317
Published: 2023-03-24
Description: A heap-based buffer overflows was discovered in upx, during the generic pointer 'p' points to an inaccessible address in func get_le32(). The problem is essentially caused in PackLinuxElf64::elf_lookup() at p_lx_elf.cpp:5404
CVSS Score: 7.5 (HIGH)
CWE: CWE-119, CWE-787
References: https://github.com/upx/upx/issues/380; https://github.com/upx/upx/issues/380
CVE: CVE-2022-20467
Published: 2023-03-24
Description: In isBluetoothShareUri of BluetoothOppUtility.java, there is a possible incorrect file read due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12L Android-13Android ID: A-225880741
CVSS Score: 5.5 (MEDIUM)
References: https://source.android.com/security/bulletin/2023-03-01; https://source.android.com/security/bulletin/2023-03-01
CVE: CVE-2022-20499
Published: 2023-03-24
Description: In validateForCommonR1andR2 of PasspointConfiguration.java, uncaught errors in parsing stored configs could lead to local persistent denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12 Android-12L Android-13Android ID: A-246539931
CVSS Score: 5.5 (MEDIUM)
References: https://source.android.com/security/bulletin/2023-03-01; https://source.android.com/security/bulletin/2023-03-01
CVE: CVE-2022-20532
Published: 2023-03-24
Description: In parseTrackFragmentRun() of MPEG4Extractor.cpp, there is a possible out of bounds read due to an integer overflow. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-232242894
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190, CWE-190
References: https://source.android.com/security/bulletin/pixel/2023-03-01; https://source.android.com/security/bulletin/pixel/2023-03-01
CVE: CVE-2022-20542
Published: 2023-03-24
Description: In parseParamsBlob of types.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-238083570
CVSS Score: 7.8 (HIGH)
CWE: CWE-20, CWE-20
References: https://source.android.com/security/bulletin/pixel/2023-03-01; https://source.android.com/security/bulletin/pixel/2023-03-01
CVE: CVE-2022-40208
Published: 2023-03-24
Description: In Moodle, insufficient limitations in some quiz web services made it possible for students to bypass sequential navigation during a quiz attempt.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-285
References: https://moodle.org/mod/forum/discuss.php?d=438761; https://moodle.org/mod/forum/discuss.php?d=438761
CVE: CVE-2022-42498
Published: 2023-03-24
Description: In Pixel cellular firmware, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-240662453References: N/A
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://source.android.com/security/bulletin/pixel/2023-03-01; https://source.android.com/security/bulletin/pixel/2023-03-01
CVE: CVE-2022-42499
Published: 2023-03-24
Description: In sms_SendMmCpErrMsg of sms_MmConManagement.c, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-242001391References: N/A
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://source.android.com/security/bulletin/pixel/2023-03-01; https://source.android.com/security/bulletin/pixel/2023-03-01
CVE: CVE-2022-42500
Published: 2023-03-24
Description: In OEM_OnRequest of sced.cpp, there is a possible shell command execution due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-239701389References: N/A
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-20
References: https://source.android.com/security/bulletin/pixel/2023-03-01; https://source.android.com/security/bulletin/pixel/2023-03-01
CVE: CVE-2022-42528
Published: 2023-03-24
Description: In ffa_mrd_prot of shared_mem.c, there is a possible ID due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-242203672References: N/A
CVSS Score: 5.5 (MEDIUM)
References: https://source.android.com/security/bulletin/pixel/2023-03-01; https://source.android.com/security/bulletin/pixel/2023-03-01
CVE: CVE-2023-20906
Published: 2023-03-24
Description: In onPackageAddedInternal of PermissionManagerService.java, there is a possible way to silently grant a permission after a Target SDK update due to a permissions bypass. This could lead to local escalation of privilege after updating an app to a higher Target SDK with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12L Android-13Android ID: A-221040577
CVSS Score: 7.8 (HIGH)
References: https://source.android.com/security/bulletin/2023-03-01; https://source.android.com/security/bulletin/2023-03-01
CVE: CVE-2023-20910
Published: 2023-03-24
Description: In add of WifiNetworkSuggestionsManager.java, there is a possible way to trigger permanent DoS due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.


CVSS Score: 5.5 (MEDIUM)
CWE: CWE-400, CWE-400
References: https://android.googlesource.com/platform/packages/modules/Wifi/+/8827591ae680c4d0bd0e373d4ca20cb35f53faa6; https://android.googlesource.com/platform/packages/modules/Wifi/+/d7df9d633c2726fa2bee8739c9ba274f300e1ea9; https://source.android.com/security/bulletin/2023-07-01
CVE: CVE-2023-20911
Published: 2023-03-24
Description: In addPermission of PermissionManagerServiceImpl.java , there is a possible failure to persist permission settings due to resource exhaustion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12L Android-13Android ID: A-242537498
CVSS Score: 7.8 (HIGH)
CWE: CWE-400, CWE-400
References: https://source.android.com/security/bulletin/2023-03-01; https://source.android.com/security/bulletin/2023-03-01
CVE: CVE-2023-20917
Published: 2023-03-24
Description: In onTargetSelected of ResolverActivity.java, there is a possible way to share a wrong file due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12L Android-13Android ID: A-242605257
CVSS Score: 7.8 (HIGH)
References: https://source.android.com/security/bulletin/2023-03-01; https://source.android.com/security/bulletin/2023-03-01
CVE: CVE-2023-20926
Published: 2023-03-24
Description: In onParentVisible of HeaderPrivacyIconsController.kt, there is a possible way to bypass factory reset protections due to a missing permission check. This could lead to local escalation of privilege with physical access to a device that's been factory reset with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12 Android-12L Android-13Android ID: A-253043058
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://source.android.com/security/bulletin/2023-03-01; https://source.android.com/security/bulletin/2023-03-01
CVE: CVE-2023-20929
Published: 2023-03-24
Description: In sendHalfSheetCancelBroadcast of HalfSheetActivity.java, there is a possible way to learn nearby BT MAC addresses due to an unrestricted broadcast intent. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-234442700
CVSS Score: 5.5 (MEDIUM)
References: https://source.android.com/security/bulletin/2023-03-01; https://source.android.com/security/bulletin/2023-03-01
CVE: CVE-2023-20931
Published: 2023-03-24
Description: In avdt_scb_hdl_write_req of avdt_scb_act.cc, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12L Android-13Android ID: A-242535997
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://source.android.com/security/bulletin/2023-03-01; https://source.android.com/security/bulletin/2023-03-01
CVE: CVE-2023-20936
Published: 2023-03-24
Description: In bta_av_rc_disc_done of bta_av_act.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12L Android-13Android ID: A-226927612
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://source.android.com/security/bulletin/2023-03-01; https://source.android.com/security/bulletin/2023-03-01
CVE: CVE-2023-20947
Published: 2023-03-24
Description: In getGroupState of GrantPermissionsViewModel.kt, there is a possible way to keep a one-time permission granted due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12 Android-12L Android-13Android ID: A-237405974
CVSS Score: 7.8 (HIGH)
References: https://source.android.com/security/bulletin/2023-03-01; https://source.android.com/security/bulletin/2023-03-01
CVE: CVE-2023-20951
Published: 2023-03-24
Description: In gatt_process_prep_write_rsp of gatt_cl.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12L Android-13Android ID: A-258652631
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://source.android.com/security/bulletin/2023-03-01; https://source.android.com/security/bulletin/2023-03-01
CVE: CVE-2023-20952
Published: 2023-03-24
Description: In A2DP_BuildCodecHeaderSbc of a2dp_sbc.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12L Android-13Android ID: A-186803518
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://source.android.com/security/bulletin/2023-03-01; https://source.android.com/security/bulletin/2023-03-01
CVE: CVE-2023-20953
Published: 2023-03-24
Description: In onPrimaryClipChanged of ClipboardListener.java, there is a possible way to bypass factory reset protection due to incorrect UI being shown prior to setup completion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-251778420
CVSS Score: 7.8 (HIGH)
References: https://source.android.com/security/bulletin/2023-03-01; https://source.android.com/security/bulletin/2023-03-01
CVE: CVE-2023-20954
Published: 2023-03-24
Description: In SDP_AddAttribute of sdp_db.cc, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12L Android-13Android ID: A-261867748
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://source.android.com/security/bulletin/2023-03-01; https://source.android.com/security/bulletin/2023-03-01
CVE: CVE-2023-20955
Published: 2023-03-24
Description: In onPrepareOptionsMenu of AppInfoDashboardFragment.java, there is a possible way to bypass admin restrictions and uninstall applications for all users due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12L Android-13Android ID: A-258653813
CVSS Score: 7.8 (HIGH)
CWE: CWE-862, CWE-862
References: https://source.android.com/security/bulletin/2023-03-01; https://source.android.com/security/bulletin/2023-03-01
CVE: CVE-2023-20956
Published: 2023-03-24
Description: In Import of C2SurfaceSyncObj.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12 Android-12L Android-13Android ID: A-240140929
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://source.android.com/security/bulletin/2023-03-01; https://source.android.com/security/bulletin/2023-03-01
CVE: CVE-2023-20957
Published: 2023-03-24
Description: In onAttach of SettingsPreferenceFragment.java, there is a possible bypass of Factory Reset Protections due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12LAndroid ID: A-258422561
CVSS Score: 7.8 (HIGH)
CWE: CWE-266
References: https://source.android.com/security/bulletin/2023-03-01; https://source.android.com/security/bulletin/2023-03-01
CVE: CVE-2023-20958
Published: 2023-03-24
Description: In read_paint of ttcolr.c, there is a possible out of bounds read due to a heap buffer overflow. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-254803162
CVSS Score: 7.1 (HIGH)
CWE: CWE-125, CWE-125
References: https://source.android.com/security/bulletin/2023-03-01; https://source.android.com/security/bulletin/2023-03-01
CVE: CVE-2023-20959
Published: 2023-03-24
Description: In AddSupervisedUserActivity, guest users are not prevented from starting the activity due to missing permissions checks. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-249057848
CVSS Score: 7.8 (HIGH)
CWE: CWE-862, CWE-862
References: https://source.android.com/security/bulletin/2023-03-01; https://source.android.com/security/bulletin/2023-03-01
CVE: CVE-2023-20960
Published: 2023-03-24
Description: In launchDeepLinkIntentToRight of SettingsHomepageActivity.java, there is a possible way to launch arbitrary activities due to improper input validation. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12L Android-13Android ID: A-250589026
CVSS Score: 8.8 (HIGH)
CWE: CWE-20, CWE-20
References: https://source.android.com/security/bulletin/2023-03-01; https://source.android.com/security/bulletin/2023-03-01
CVE: CVE-2023-20962
Published: 2023-03-24
Description: In getSliceEndItem of MediaVolumePreferenceController.java, there is a possible way to start foreground activity from the background due to an unsafe PendingIntent. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-256590210
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-926
References: https://source.android.com/security/bulletin/2023-03-01; https://source.android.com/security/bulletin/2023-03-01
CVE: CVE-2023-20963
Published: 2023-03-24
Description: In WorkSource, there is a possible parcel mismatch. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12L Android-13Android ID: A-220302519
CVSS Score: 7.8 (HIGH)
CWE: CWE-295, CWE-295
References: https://source.android.com/security/bulletin/2023-03-01; https://source.android.com/security/bulletin/2023-03-01; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-20963
CVE: CVE-2023-20964
Published: 2023-03-24
Description: In multiple functions of MediaSessionRecord.java, there is a possible Intent rebroadcast due to a confused deputy. This could lead to local denial of service or escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12 Android-12L Android-13Android ID: A-238177121
CVSS Score: 7.8 (HIGH)
CWE: CWE-610
References: https://source.android.com/security/bulletin/2023-03-01; https://source.android.com/security/bulletin/2023-03-01