deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-34420
Published: 2023-06-26
Description: A valid, authenticated LXCA user with elevated privileges may be able to execute command injections through crafted calls to a specific web API.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78, CWE-78
References: https://support.lenovo.com/us/en/product_security/LEN-98715; https://support.lenovo.com/us/en/product_security/LEN-98715
CVE: CVE-2023-34421
Published: 2023-06-26
Description: A valid, authenticated LXCA user with elevated privileges may be able to replace filesystem data through a specifically crafted web API call due to insufficient input validation.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://support.lenovo.com/us/en/product_security/LEN-98715; https://support.lenovo.com/us/en/product_security/LEN-98715
CVE: CVE-2023-34422
Published: 2023-06-26
Description: A valid, authenticated LXCA user with elevated privileges may be able to delete folders in the LXCA filesystem through a specifically crafted web API call due to insufficient input validation.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://support.lenovo.com/us/en/product_security/LEN-98715; https://support.lenovo.com/us/en/product_security/LEN-98715
CVE: CVE-2023-35170
Published: 2023-06-26
Description: Rejected reason: This CVE is a duplicate of another CVE.
CVE: CVE-2023-35930
Published: 2023-06-26
Description: SpiceDB is an open source, Google Zanzibar-inspired, database system for creating and managing security-critical application permissions. Any user making a negative authorization decision based on the results of a `LookupResources` request with 1.22.0 is affected. For example, using `LookupResources` to find a list of resources to allow access to be okay: some subjects that should have access to a resource may not. But if using `LookupResources` to find a list of banned resources instead, then some users that shouldn't have access may. Generally, `LookupResources` is not and should not be to gate access in this way - that's what the `Check` API is for. Additionally, version 1.22.0 has included a warning about this bug since its initial release. Users are advised to upgrade to version 1.22.2. Users unable to upgrade should avoid using `LookupResources` for negative authorization decisions.
CVSS Score: 3.7 (LOW)
CWE: CWE-913, CWE-913
References: https://github.com/authzed/spicedb/pull/1397; https://github.com/authzed/spicedb/security/advisories/GHSA-m54h-5x5f-5m6r; https://github.com/authzed/spicedb/pull/1397
CVE: CVE-2023-35933
Published: 2023-06-26
Description: OPenFGA is an open source authorization/permission engine built for developers. OpenFGA versions v1.1.0 and prior are vulnerable to a DoS attack when Check and ListObjects calls are executed against authorization models that contain circular relationship definitions. Users are affected by this vulnerability if they are using OpenFGA v1.1.0 or earlier, and if you are executing `Check` or `ListObjects` calls against a vulnerable authorization model. Users are advised to upgrade to version 1.1.1. There are no known workarounds for this vulnerability. Users that do not have circular relationships in their models are not affected.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-835
References: https://github.com/openfga/openfga/commit/087ce392595f3c319ab3028b5089118ea4063452; https://github.com/openfga/openfga/security/advisories/GHSA-hr9r-8phq-5x8j; https://openfga.dev/api/service#/Relationship%20Queries/Check
CVE: CVE-2023-3113
Published: 2023-06-26
Description: An unauthenticated XML external entity injection (XXE) vulnerability exists in LXCA's Common Information Model (CIM) server that could result in read-only access to specific files.
CVSS Score: 8.2 (HIGH)
CWE: CWE-611, CWE-611
References: https://support.lenovo.com/us/en/product_security/LEN-98715; https://support.lenovo.com/us/en/product_security/LEN-98715
CVE: CVE-2023-34463
Published: 2023-06-26
Description: DataEase is an open source data visualization analysis tool to analyze data and gain insight into business trends. In affected versions Unauthorized users can delete an application erroneously. This vulnerability has been fixed in version 1.18.8. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 8.1 (HIGH)
CWE: CWE-862
References: https://github.com/dataease/dataease/security/advisories/GHSA-4c4p-qfwq-85fj; https://github.com/dataease/dataease/security/advisories/GHSA-4c4p-qfwq-85fj
CVE: CVE-2023-34924
Published: 2023-06-26
Description: H3C Magic B1STW B1STV100R012 was discovered to contain a stack overflow via the function SetAPInfoById. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://github.com/ChrisL0tus/CVE-2023-34924; https://github.com/ChrisL0tus/CVE-2023-34924
CVE: CVE-2023-35168
Published: 2023-06-26
Description: DataEase is an open source data visualization analysis tool to analyze data and gain insight into business trends. Affected versions of DataEase has a privilege bypass vulnerability where ordinary users can gain access to the user database. Exposed information includes md5 hashes of passwords, username, email, and phone number. The vulnerability has been fixed in v1.18.8. Users are advised to upgrade. There are no known workarounds for the vulnerability.

CVSS Score: 6.5 (MEDIUM)
CWE: CWE-732
References: https://github.com/dataease/dataease/security/advisories/GHSA-c2r2-68p6-73xv; https://github.com/dataease/dataease/security/advisories/GHSA-c2r2-68p6-73xv
CVE: CVE-2023-3420
Published: 2023-06-26
Description: Type Confusion in V8 in Google Chrome prior to 114.0.5735.198 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-843, CWE-843
References: https://chromereleases.googleblog.com/2023/06/stable-channel-update-for-desktop_26.html; https://crbug.com/1452137; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KREKCQTJDVI2AEBG5ECZPSOQXIC2L5XL/
CVE: CVE-2023-3421
Published: 2023-06-26
Description: Use after free in Media in Google Chrome prior to 114.0.5735.198 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://chromereleases.googleblog.com/2023/06/stable-channel-update-for-desktop_26.html; https://crbug.com/1447568; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KREKCQTJDVI2AEBG5ECZPSOQXIC2L5XL/
CVE: CVE-2023-3422
Published: 2023-06-26
Description: Use after free in Guest View in Google Chrome prior to 114.0.5735.198 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2023/06/stable-channel-update-for-desktop_26.html; https://crbug.com/1450397; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KREKCQTJDVI2AEBG5ECZPSOQXIC2L5XL/
CVE: CVE-2023-28929
Published: 2023-06-26
Description: Trend Micro Security 2021, 2022, and 2023 (Consumer) are vulnerable to a DLL Hijacking vulnerability which could allow an attacker to use a specific executable file as an execution and/or persistence mechanism which could execute a malicious program each time the executable file is started.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://helpcenter.trendmicro.com/en-us/article/tmka-19062; https://helpcenter.trendmicro.com/en-us/article/tmka-19062
CVE: CVE-2023-30902
Published: 2023-06-26
Description: A privilege escalation vulnerability in the Trend Micro Apex One and Apex One as a Service agent could allow a local attacker to unintentionally delete privileged Trend Micro registry keys including its own protected registry keys on affected installations.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-276
References: https://success.trendmicro.com/dcx/s/solution/000293108?language=en_US; https://success.trendmicro.com/dcx/s/solution/000293108?language=en_US
CVE: CVE-2023-32521
Published: 2023-06-26
Description: A path traversal exists in a specific service dll of Trend Micro Mobile Security (Enterprise) 9.8 SP5 which could allow an unauthenticated remote attacker to delete arbitrary files.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-22
References: https://success.trendmicro.com/dcx/s/solution/000293106?language=en_US; https://www.tenable.com/security/research/tra-2023-17; https://success.trendmicro.com/dcx/s/solution/000293106?language=en_US
CVE: CVE-2023-32522
Published: 2023-06-26
Description: A path traversal exists in a specific dll of Trend Micro Mobile Security (Enterprise) 9.8 SP5 which could allow an authenticated remote attacker to delete arbitrary files.

Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
CVSS Score: 8.1 (HIGH)
CWE: CWE-22
References: https://success.trendmicro.com/dcx/s/solution/000293106?language=en_US; https://www.tenable.com/security/research/tra-2023-17; https://success.trendmicro.com/dcx/s/solution/000293106?language=en_US
CVE: CVE-2023-32523
Published: 2023-06-26
Description: Affected versions of Trend Micro Mobile Security (Enterprise) 9.8 SP5 contain some widgets that would allow a remote user to bypass authentication and potentially chain with other vulnerabilities.

Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit these vulnerabilities.

This is similar to, but not identical to CVE-2023-32524.
CVSS Score: 8.8 (HIGH)
CWE: CWE-287
References: https://success.trendmicro.com/dcx/s/solution/000293106?language=en_US; https://www.zerodayinitiative.com/advisories/ZDI-23-587/; https://success.trendmicro.com/dcx/s/solution/000293106?language=en_US
CVE: CVE-2023-32524
Published: 2023-06-26
Description: Affected versions of Trend Micro Mobile Security (Enterprise) 9.8 SP5 contain some widgets that would allow a remote user to bypass authentication and potentially chain with other vulnerabilities.

Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit these vulnerabilities.

This is similar to, but not identical to CVE-2023-32523.
CVSS Score: 8.8 (HIGH)
CWE: CWE-287
References: https://success.trendmicro.com/dcx/s/solution/000293106?language=en_US; https://www.zerodayinitiative.com/advisories/ZDI-23-588/; https://success.trendmicro.com/dcx/s/solution/000293106?language=en_US
CVE: CVE-2023-32525
Published: 2023-06-26
Description: Trend Micro Mobile Security (Enterprise) 9.8 SP5 contains widget vulnerabilities that could allow a remote attacker to create arbitrary files on affected installations.  

Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

This is similar to, but not identical to CVE-2023-32526.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-434
References: https://success.trendmicro.com/dcx/s/solution/000293106?language=en_US; https://www.zerodayinitiative.com/advisories/ZDI-23-589/; https://success.trendmicro.com/dcx/s/solution/000293106?language=en_US
CVE: CVE-2023-32526
Published: 2023-06-26
Description: Trend Micro Mobile Security (Enterprise) 9.8 SP5 contains widget vulnerabilities that could allow a remote attacker to create arbitrary files on affected installations.  

Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

This is similar to, but not identical to CVE-2023-32525.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-434
References: https://success.trendmicro.com/dcx/s/solution/000293106?language=en_US; https://www.zerodayinitiative.com/advisories/ZDI-23-586/; https://success.trendmicro.com/dcx/s/solution/000293106?language=en_US
CVE: CVE-2023-32527
Published: 2023-06-26
Description: Trend Micro Mobile Security (Enterprise) 9.8 SP5 contains vulnerable .php files that could allow a remote attacker to execute arbitrary code on affected installations.

Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

This is similar to, but not identical to CVE-2023-32528.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: https://success.trendmicro.com/dcx/s/solution/000293106?language=en_US; https://www.zerodayinitiative.com/advisories/ZDI-23-590/; https://success.trendmicro.com/dcx/s/solution/000293106?language=en_US
CVE: CVE-2023-32528
Published: 2023-06-26
Description: Trend Micro Mobile Security (Enterprise) 9.8 SP5 contains vulnerable .php files that could allow a remote attacker to execute arbitrary code on affected installations.

Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

This is similar to, but not identical to CVE-2023-32527.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: https://success.trendmicro.com/dcx/s/solution/000293106?language=en_US; https://www.zerodayinitiative.com/advisories/ZDI-23-591/; https://success.trendmicro.com/dcx/s/solution/000293106?language=en_US
CVE: CVE-2023-32529
Published: 2023-06-26
Description: Vulnerable modules of Trend Micro Apex Central (on-premise) contain vulnerabilities which would allow authenticated users to perform a SQL injection that could lead to remote code execution.

Please note: an attacker must first obtain authentication on the target system in order to exploit these vulnerabilities.

This is similar to, but not identical to CVE-2023-32530.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://success.trendmicro.com/dcx/s/solution/000293107?language=en_US; https://www.zerodayinitiative.com/advisories/ZDI-23-652/; https://success.trendmicro.com/dcx/s/solution/000293107?language=en_US
CVE: CVE-2023-32530
Published: 2023-06-26
Description: Vulnerable modules of Trend Micro Apex Central (on-premise) contain vulnerabilities which would allow authenticated users to perform a SQL injection that could lead to remote code execution.

Please note: an attacker must first obtain authentication on the target system in order to exploit these vulnerabilities.

This is similar to, but not identical to CVE-2023-32529.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://success.trendmicro.com/dcx/s/solution/000293107?language=en_US; https://www.zerodayinitiative.com/advisories/ZDI-23-654/; https://success.trendmicro.com/dcx/s/solution/000293107?language=en_US
CVE: CVE-2023-32531
Published: 2023-06-26
Description: Certain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks that may allow an attacker to achieve remote code execution on affected servers.

This is similar to, but not identical to CVE-2023-32532 through 32535.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://success.trendmicro.com/dcx/s/solution/000293107?language=en_US; https://www.zerodayinitiative.com/advisories/ZDI-23-724/; https://success.trendmicro.com/dcx/s/solution/000293107?language=en_US
CVE: CVE-2023-32532
Published: 2023-06-26
Description: Certain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks that may allow an attacker to achieve remote code execution on affected servers.

This is similar to, but not identical to CVE-2023-32531 through 32535.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://success.trendmicro.com/dcx/s/solution/000293107?language=en_US; https://www.zerodayinitiative.com/advisories/ZDI-23-723/; https://success.trendmicro.com/dcx/s/solution/000293107?language=en_US
CVE: CVE-2023-32533
Published: 2023-06-26
Description: Certain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks that may allow an attacker to achieve remote code execution on affected servers.

This is similar to, but not identical to CVE-2023-32531 through 32535.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://success.trendmicro.com/dcx/s/solution/000293107?language=en_US; https://www.zerodayinitiative.com/advisories/ZDI-23-726/; https://success.trendmicro.com/dcx/s/solution/000293107?language=en_US
CVE: CVE-2023-32534
Published: 2023-06-26
Description: Certain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks that may allow an attacker to achieve remote code execution on affected servers.

This is similar to, but not identical to CVE-2023-32531 through 32535.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://success.trendmicro.com/dcx/s/solution/000293107?language=en_US; https://www.zerodayinitiative.com/advisories/ZDI-23-725/; https://success.trendmicro.com/dcx/s/solution/000293107?language=en_US
CVE: CVE-2023-32535
Published: 2023-06-26
Description: Certain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks that may allow an attacker to achieve remote code execution on affected servers.

This is similar to, but not identical to CVE-2023-32531 through 32534.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://success.trendmicro.com/dcx/s/solution/000293107?language=en_US; https://www.zerodayinitiative.com/advisories/ZDI-23-857/; https://success.trendmicro.com/dcx/s/solution/000293107?language=en_US
CVE: CVE-2023-32536
Published: 2023-06-26
Description: Affected versions Trend Micro Apex Central (on-premise) are vulnerable to potential authenticated reflected cross-site scripting (XSS) attacks due to user input validation and sanitization issues. 

Please note: an attacker must first obtain authentication to Apex Central on the target system in order to exploit this vulnerability.

This is similar to, but not identical to CVE-2023-32537.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://success.trendmicro.com/dcx/s/solution/000293107?language=en_US; https://success.trendmicro.com/dcx/s/solution/000293107?language=en_US
CVE: CVE-2023-32537
Published: 2023-06-26
Description: Affected versions Trend Micro Apex Central (on-premise) are vulnerable to potential authenticated reflected cross-site scripting (XSS) attacks due to user input validation and sanitization issues. 

Please note: an attacker must first obtain authentication to Apex Central on the target system in order to exploit this vulnerability.

This is similar to, but not identical to CVE-2023-32536.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://success.trendmicro.com/dcx/s/solution/000293107?language=en_US; https://success.trendmicro.com/dcx/s/solution/000293107?language=en_US
CVE: CVE-2023-32552
Published: 2023-06-26
Description: An Improper access control vulnerability in Trend Micro Apex One and Apex One as a Service could allow an unauthenticated user under certain circumstances to disclose sensitive information on agents.

This is similar to, but not identical to CVE-2023-32553
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-281
References: https://success.trendmicro.com/dcx/s/solution/000293108?language=en_US; https://www.zerodayinitiative.com/advisories/ZDI-23-655/; https://success.trendmicro.com/dcx/s/solution/000293108?language=en_US
CVE: CVE-2023-32553
Published: 2023-06-26
Description: An Improper access control vulnerability in Trend Micro Apex One and Apex One as a Service could allow an unauthenticated user under certain circumstances to disclose sensitive information on agents.

This is similar to, but not identical to CVE-2023-32552.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-346
References: https://success.trendmicro.com/dcx/s/solution/000293108?language=en_US; https://www.zerodayinitiative.com/advisories/ZDI-23-653/; https://success.trendmicro.com/dcx/s/solution/000293108?language=en_US
CVE: CVE-2023-32554
Published: 2023-06-26
Description: A Time-of-Check Time-Of-Use vulnerability in the Trend Micro Apex One and Apex One as a Service agent could allow a local attacker to escalate privileges on affected installations.

Please note: a local attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

This is similar to, but not identical to CVE-2023-32555.
CVSS Score: 7.0 (HIGH)
CWE: CWE-367
References: https://success.trendmicro.com/dcx/s/solution/000293108?language=en_US; https://www.zerodayinitiative.com/advisories/ZDI-23-657/; https://success.trendmicro.com/dcx/s/solution/000293108?language=en_US
CVE: CVE-2023-32555
Published: 2023-06-26
Description: A Time-of-Check Time-Of-Use vulnerability in the Trend Micro Apex One and Apex One as a Service agent could allow a local attacker to escalate privileges on affected installations.

Please note: a local attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

This is similar to, but not identical to CVE-2023-32554.
CVSS Score: 7.0 (HIGH)
CWE: CWE-367
References: https://success.trendmicro.com/dcx/s/solution/000293108?language=en_US; https://www.zerodayinitiative.com/advisories/ZDI-23-656/; https://success.trendmicro.com/dcx/s/solution/000293108?language=en_US
CVE: CVE-2023-32556
Published: 2023-06-26
Description: A link following vulnerability in the Trend Micro Apex One and Apex One as a Service agent could allow a local attacker to disclose sensitive information.

Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-59
References: https://success.trendmicro.com/dcx/s/solution/000293108?language=en_US; https://www.zerodayinitiative.com/advisories/ZDI-23-651/; https://success.trendmicro.com/dcx/s/solution/000293108?language=en_US
CVE: CVE-2023-32557
Published: 2023-06-26
Description: A path traversal vulnerability in the Trend Micro Apex One and Apex One as a Service could allow an unauthenticated attacker to upload an arbitrary file to the Management Server which could lead to remote code execution with system privileges.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://success.trendmicro.com/dcx/s/solution/000293108?language=en_US; https://success.trendmicro.com/dcx/s/solution/000293108?language=en_US
CVE: CVE-2023-32604
Published: 2023-06-26
Description: Affected versions Trend Micro Apex Central (on-premise) are vulnerable to potential authenticated reflected cross-site scripting (XSS) attacks due to user input validation and sanitization issues. 

Please note: an attacker must first obtain authentication to Apex Central on the target system in order to exploit this vulnerability.

This is similar to, but not identical to CVE-2023-32605.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://success.trendmicro.com/dcx/s/solution/000293107?language=en_US; https://success.trendmicro.com/dcx/s/solution/000293107?language=en_US
CVE: CVE-2023-32605
Published: 2023-06-26
Description: Affected versions Trend Micro Apex Central (on-premise) are vulnerable to potential authenticated reflected cross-site scripting (XSS) attacks due to user input validation and sanitization issues. 

Please note: an attacker must first obtain authentication to Apex Central on the target system in order to exploit this vulnerability.

This is similar to, but not identical to CVE-2023-32604.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://success.trendmicro.com/dcx/s/solution/000293107?language=en_US; https://success.trendmicro.com/dcx/s/solution/000293107?language=en_US