deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-43018
Published: 2023-09-07
Description: Adobe Photoshop versions 23.0.2 and 22.5.4 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious JPG file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/photoshop/apsb21-113.html; https://helpx.adobe.com/security/products/photoshop/apsb21-113.html
CVE: CVE-2021-43027
Published: 2023-09-07
Description: Adobe After Effects versions 22.0 (and earlier) and 18.4.2 (and earlier) are affected by an out-of-bounds read vulnerability which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/after_effects/apsb21-115.html; https://helpx.adobe.com/security/products/after_effects/apsb21-115.html
CVE: CVE-2021-43751
Published: 2023-09-07
Description: Adobe Premiere Pro versions 22.0 (and earlier) and 15.4.2 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 3.3 (LOW)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/premiere_pro/apsb21-117.html; https://helpx.adobe.com/security/products/premiere_pro/apsb21-117.html
CVE: CVE-2021-43753
Published: 2023-09-07
Description: Adobe Lightroom versions 4.4 (and earlier) are affected by a use-after-free vulnerability in the processing of parsing TIF files that could result in privilege escalation. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://helpx.adobe.com/security/products/lightroom/apsb21-119.html; https://helpx.adobe.com/security/products/lightroom/apsb21-119.html
CVE: CVE-2021-44188
Published: 2023-09-07
Description: Adobe After Effects versions 22.0 (and earlier) and 18.4.2 (and earlier) are affected by an out-of-bounds read vulnerability which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/after_effects/apsb21-115.html; https://helpx.adobe.com/security/products/after_effects/apsb21-115.html
CVE: CVE-2023-36635
Published: 2023-09-07
Description: An improper access control in Fortinet FortiSwitchManager version 7.2.0 through 7.2.2
7.0.0 through 7.0.1 may allow a remote authenticated read-only user to modify the interface settings via the API.
CVSS Score: 7.1 (HIGH)
CWE: CWE-284
References: https://fortiguard.com/psirt/FG-IR-22-174; https://fortiguard.com/psirt/FG-IR-22-174
CVE: CVE-2023-39420
Published: 2023-09-07
Description: The RDPCore.dll component as used in the IRM Next Generation booking engine, allows a remote user to connect to customers with an "admin" account and a corresponding password computed daily by a routine inside the DLL file. Once reverse-engineered, this routine can help an attacker generate the daily password and connect to application customers. Given that this is an administrative account, anyone logging into a customer deployment has full, unrestricted access to the application.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-798
References: https://bitdefender.com/blog/labs/check-out-with-extra-charges-vulnerabilities-in-hotel-booking-engine-explained/; https://bitdefender.com/blog/labs/check-out-with-extra-charges-vulnerabilities-in-hotel-booking-engine-explained/
CVE: CVE-2023-39421
Published: 2023-09-07
Description: The RDPWin.dll component as used in the IRM Next Generation booking engine includes a set of hardcoded API keys for third-party services such as Twilio and Vonage. These keys allow unrestricted interaction with these services.
CVSS Score: 7.7 (HIGH)
CWE: CWE-798
References: https://bitdefender.com/blog/labs/check-out-with-extra-charges-vulnerabilities-in-hotel-booking-engine-explained; https://bitdefender.com/blog/labs/check-out-with-extra-charges-vulnerabilities-in-hotel-booking-engine-explained
CVE: CVE-2023-39422
Published: 2023-09-07
Description: The /irmdata/api/ endpoints exposed by the IRM Next Generation booking engine authenticates requests using HMAC tokens. These tokens are however exposed in a JavaScript file loaded on the client side, thus rendering this extra safety mechanism useless.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-798
References: https://bitdefender.com/blog/labs/check-out-with-extra-charges-vulnerabilities-in-hotel-booking-engine-explained; https://bitdefender.com/blog/labs/check-out-with-extra-charges-vulnerabilities-in-hotel-booking-engine-explained
CVE: CVE-2023-39423
Published: 2023-09-07
Description: The RDPData.dll file exposes the /irmdata/api/common endpoint that handles session IDs,  among other features. By using a UNION SQL operator, an attacker can leak the sessions table, obtain the currently valid sessions and impersonate a currently logged-in user.

CVSS Score: 8.6 (HIGH)
CWE: CWE-89
References: https://bitdefender.com/blog/labs/check-out-with-extra-charges-vulnerabilities-in-hotel-booking-engine-explained; https://bitdefender.com/blog/labs/check-out-with-extra-charges-vulnerabilities-in-hotel-booking-engine-explained
CVE: CVE-2023-39424
Published: 2023-09-07
Description: A vulnerability in RDPngFileUpload.dll, as used in the IRM Next Generation booking system, allows a remote attacker to upload arbitrary content (such as a web shell component) to the SQL database and execute it with SYSTEM privileges. This vulnerability requires authentication to be exploited but can be paired with another vulnerability in the platform (CVE-2023-39420, which grants access to hardcoded credentials) to carry the attack without having assigned credentials. 
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-74, CWE-434
References: https://bitdefender.com/blog/labs/check-out-with-extra-charges-vulnerabilities-in-hotel-booking-engine-explained; https://bitdefender.com/blog/labs/check-out-with-extra-charges-vulnerabilities-in-hotel-booking-engine-explained
CVE: CVE-2023-3747
Published: 2023-09-07
Description: Zero Trust Administrators have the ability to disallow end users from disabling WARP on their devices. Override codes can also be created by the Administrators to allow a device to temporarily be disconnected from WARP, however, due to lack of server side validation, an attacker with local access to the device, could extend the maximum allowed disconnected time of WARP client granted by an override code by changing the date & time on the local device where WARP is running.


CVSS Score: 5.5 (MEDIUM)
CWE: CWE-602, CWE-565
References: https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-settings/#retrieve-the-override-code; https://play.google.com/store/apps/details?id=com.cloudflare.onedotonedotonedotone; https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-settings/#retrieve-the-override-code
CVE: CVE-2021-44189
Published: 2023-09-07
Description: Adobe After Effects versions 22.0 (and earlier) and 18.4.2 (and earlier) are affected by an Use-After-Free vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 3.3 (LOW)
CWE: CWE-416
References: https://helpx.adobe.com/security/products/after_effects/apsb21-115.html; https://helpx.adobe.com/security/products/after_effects/apsb21-115.html
CVE: CVE-2021-44190
Published: 2023-09-07
Description: Adobe After Effects versions 22.0 (and earlier) and 18.4.2 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 3.3 (LOW)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/after_effects/apsb21-115.html; https://helpx.adobe.com/security/products/after_effects/apsb21-115.html
CVE: CVE-2021-44191
Published: 2023-09-07
Description: Adobe After Effects versions 22.0 (and earlier) and 18.4.2 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 3.3 (LOW)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/after_effects/apsb21-115.html; https://helpx.adobe.com/security/products/after_effects/apsb21-115.html
CVE: CVE-2021-44192
Published: 2023-09-07
Description: Adobe After Effects versions 22.0 (and earlier) and 18.4.2 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 3.3 (LOW)
CWE: CWE-125, CWE-125
References: https://helpx.adobe.com/security/products/after_effects/apsb21-115.html; https://helpx.adobe.com/security/products/after_effects/apsb21-115.html
CVE: CVE-2021-44193
Published: 2023-09-07
Description: Adobe After Effects versions 22.0 (and earlier) and 18.4.2 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 3.3 (LOW)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/after_effects/apsb21-115.html; https://helpx.adobe.com/security/products/after_effects/apsb21-115.html
CVE: CVE-2021-44194
Published: 2023-09-07
Description: Adobe After Effects versions 22.0 (and earlier) and 18.4.2 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 3.3 (LOW)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/after_effects/apsb21-115.html; https://helpx.adobe.com/security/products/after_effects/apsb21-115.html
CVE: CVE-2021-44195
Published: 2023-09-07
Description: Adobe After Effects versions 22.0 (and earlier) and 18.4.2 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 3.3 (LOW)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/after_effects/apsb21-115.html; https://helpx.adobe.com/security/products/after_effects/apsb21-115.html
CVE: CVE-2022-30637
Published: 2023-09-07
Description: Adobe Illustrator versions 26.0.2 (and earlier) and 25.4.5 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/illustrator/apsb22-26.html; https://helpx.adobe.com/security/products/illustrator/apsb22-26.html
CVE: CVE-2022-30638
Published: 2023-09-07
Description: Adobe Illustrator versions 26.0.2 (and earlier) and 25.4.5 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/illustrator/apsb22-26.html; https://helpx.adobe.com/security/products/illustrator/apsb22-26.html
CVE: CVE-2022-30639
Published: 2023-09-07
Description: Adobe Illustrator versions 26.0.2 (and earlier) and 25.4.5 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/illustrator/apsb22-26.html; https://helpx.adobe.com/security/products/illustrator/apsb22-26.html
CVE: CVE-2022-30640
Published: 2023-09-07
Description: Adobe Illustrator versions 26.0.2 (and earlier) and 25.4.5 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/illustrator/apsb22-26.html; https://helpx.adobe.com/security/products/illustrator/apsb22-26.html
CVE: CVE-2022-30641
Published: 2023-09-07
Description: Adobe Illustrator versions 26.0.2 (and earlier) and 25.4.5 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://helpx.adobe.com/security/products/illustrator/apsb22-26.html; https://helpx.adobe.com/security/products/illustrator/apsb22-26.html
CVE: CVE-2022-30642
Published: 2023-09-07
Description: Adobe Illustrator versions 26.0.2 (and earlier) and 25.4.5 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/illustrator/apsb22-26.html; https://helpx.adobe.com/security/products/illustrator/apsb22-26.html
CVE: CVE-2022-30643
Published: 2023-09-07
Description: Adobe Illustrator versions 26.0.2 (and earlier) and 25.4.5 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/illustrator/apsb22-26.html; https://helpx.adobe.com/security/products/illustrator/apsb22-26.html
CVE: CVE-2022-30644
Published: 2023-09-07
Description: Adobe Illustrator versions 26.0.2 (and earlier) and 25.4.5 (and earlier) are affected by a Use-After-Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://helpx.adobe.com/security/products/illustrator/apsb22-26.html; https://helpx.adobe.com/security/products/illustrator/apsb22-26.html
CVE: CVE-2022-30645
Published: 2023-09-07
Description: Adobe Illustrator versions 26.0.2 (and earlier) and 25.4.5 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/illustrator/apsb22-26.html; https://helpx.adobe.com/security/products/illustrator/apsb22-26.html
CVE: CVE-2022-30646
Published: 2023-09-07
Description: Adobe Illustrator versions 26.0.2 (and earlier) and 25.4.5 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/illustrator/apsb22-26.html; https://helpx.adobe.com/security/products/illustrator/apsb22-26.html
CVE: CVE-2023-39711
Published: 2023-09-07
Description: Multiple cross-site scripting (XSS) vulnerabilities in Free and Open Source Inventory Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Subtotal and Paidbill parameters under the Add New Put section.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/Arajawat007/1683f9640c0d62337e0bbe23569d1ea5#file-cve-2023-39711; https://www.sourcecodester.com/; https://www.sourcecodester.com/php/16741/free-and-open-source-inventory-management-system-php-source-code.html
CVE: CVE-2023-40942
Published: 2023-09-07
Description: Tenda AC9 V3.0BR_V15.03.06.42_multi_TD01 was discovered stack overflow via parameter 'firewall_value' at url /goform/SetFirewallCfg.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/GleamingEyes/vul/blob/main/tenda_ac9/SetFirewallCfg.md; https://github.com/GleamingEyes/vul/blob/main/tenda_ac9/SetFirewallCfg.md
CVE: CVE-2023-30800
Published: 2023-09-07
Description: The web server used by MikroTik RouterOS version 6 is affected by a heap memory corruption issue. A remote and unauthenticated attacker can corrupt the server's heap memory by sending a crafted HTTP request. As a result, the web interface crashes and is immediately restarted. The issue was fixed in RouterOS 6.49.10 stable. RouterOS version 7 is not affected.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-787
References: https://vulncheck.com/advisories/mikrotik-jsproxy-dos; https://vulncheck.com/advisories/mikrotik-jsproxy-dos
CVE: CVE-2023-40060
Published: 2023-09-07
Description: A vulnerability has been identified within Serv-U 15.4 and 15.4 Hotfix 1 that, if exploited, allows an actor to bypass multi-factor/two-factor authentication. The actor must have administrator-level access to Serv-U to perform this action. 
15.4.  SolarWinds found that the issue was not completely fixed in 15.4 Hotfix 1. 
CVSS Score: 7.2 (HIGH)
CWE: CWE-284
References: https://support.solarwinds.com/SuccessCenter/s/article/Serv-U-15-4-0-Hotfix-2?language=en_US; https://www.solarwinds.com/trust-center/security-advisories/CVE-2023-40060; https://support.solarwinds.com/SuccessCenter/s/article/Serv-U-15-4-0-Hotfix-2?language=en_US
CVE: CVE-2023-41061
Published: 2023-09-07
Description: A validation issue was addressed with improved logic. This issue is fixed in watchOS 9.6.2, iOS 16.6.1 and iPadOS 16.6.1. A maliciously crafted attachment may result in arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://seclists.org/fulldisclosure/2023/Sep/4; http://seclists.org/fulldisclosure/2023/Sep/5; https://support.apple.com/en-us/HT213905
CVE: CVE-2023-41064
Published: 2023-09-07
Description: A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 16.6.1 and iPadOS 16.6.1, macOS Monterey 12.6.9, macOS Ventura 13.5.2, iOS 15.7.9 and iPadOS 15.7.9, macOS Big Sur 11.7.10. Processing a maliciously crafted image may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120, CWE-120
References: http://www.openwall.com/lists/oss-security/2023/09/21/4; https://support.apple.com/en-us/HT213905; https://support.apple.com/en-us/HT213906
CVE: CVE-2023-4528
Published: 2023-09-07
Description: Unsafe deserialization in JSCAPE MFT Server versions prior to 2023.1.9 (Windows, Linux, and MacOS) permits an attacker to run arbitrary Java code (including OS commands) via its management interface

CVSS Score: 7.2 (HIGH)
CWE: CWE-502, CWE-502
References: https://www.jscape.com/blog/binary-management-service-patch-cve-2023-4528; https://www.rapid7.com/blog/post/2023/09/07/cve-2023-4528-java-deserialization-vulnerability-in-jscape-mft-fixed/; https://www.jscape.com/blog/binary-management-service-patch-cve-2023-4528
CVE: CVE-2023-4685
Published: 2023-09-07
Description: Delta Electronics' CNCSoft-B version 1.0.0.4 and DOPSoft versions 4.0.0.82 and prior are vulnerable to stack-based buffer overflow, which could allow an attacker to execute arbitrary code.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-157-01; https://www.cisa.gov/news-events/ics-advisories/icsa-23-157-01
CVE: CVE-2023-37798
Published: 2023-09-07
Description: A stored cross-site scripting (XSS) vulnerability in the new REDCap project creation function of Vanderbilt REDCap 13.1.35 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the project title parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://redcap.com; http://vanderbilt.com; https://www.cyderes.com/blog/cve-2023-37798-stored-cross-site-scripting-in-vanderbilt-redcap/
CVE: CVE-2023-20193
Published: 2023-09-07
Description: A vulnerability in the Embedded Service Router (ESR) of Cisco ISE could allow an authenticated, local attacker to read, write, or delete arbitrary files on the underlying operating system and escalate their privileges to root. To exploit this vulnerability, an attacker must have valid Administrator-level privileges on the affected device. This vulnerability is due to improper privilege management in the ESR console. An attacker could exploit this vulnerability by sending a crafted request to an affected device. A successful exploit could allow the attacker to elevate their privileges to root and read, write, or delete arbitrary files from the underlying operating system of the affected device. Note: The ESR is not enabled by default and must be licensed. To verify the status of the ESR in the Admin GUI, choose Administration > Settings > Protocols > IPSec.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-78, CWE-269
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-priv-esc-KJLp2Aw; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-priv-esc-KJLp2Aw