deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-25152
Published: 2023-02-08
Description: Wings is Pterodactyl's server control plane. Affected versions are subject to a vulnerability which can be used to create new files and directory structures on the host system that previously did not exist, potentially allowing attackers to change their resource allocations, promote their containers to privileged mode, or potentially add ssh authorized keys to allow the attacker access to a remote shell on the target machine.   In order to use this exploit, an attacker must have an existing "server" allocated and controlled by the Wings Daemon. This vulnerability has been resolved in version `v1.11.3` of the Wings Daemon, and has been back-ported to the 1.7 release series in `v1.7.3`. Anyone running `v1.11.x` should upgrade to `v1.11.3` and anyone running `v1.7.x` should upgrade to `v1.7.3`. There are no known workarounds for this vulnerability.

### Workarounds

None at this time.  




CVSS Score: 8.4 (HIGH)
CWE: CWE-59
References: https://github.com/pterodactyl/wings/commit/dac9685298c3c1c49b3109fa4241aa88272b9f14; https://github.com/pterodactyl/wings/security/advisories/GHSA-p8r3-83r8-jwj5; https://github.com/pterodactyl/wings/commit/dac9685298c3c1c49b3109fa4241aa88272b9f14
CVE: CVE-2023-25396
Published: 2023-02-08
Description: Privilege escalation in the MSI repair functionality in Caphyon Advanced Installer 20.0 and below allows attackers to access and manipulate system files.
CVSS Score: 7.8 (HIGH)
References: https://www.advancedinstaller.com/release-20.1.html; https://www.advancedinstaller.com/release-20.1.html
CVE: CVE-2022-34350
Published: 2023-02-08
Description: IBM API Connect 10.0.0.0 through 10.0.5.0, 10.0.1.0 through 10.0.1.7, and 2018.4.1.0 through 2018.4.1.20 is vulnerable to External Service Interaction attack, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability to induce the application to perform server-side DNS lookups or HTTP requests to arbitrary domain names. By submitting suitable payloads, an attacker can cause the application server to attack other systems that it can interact with.  IBM X-Force ID:  230264.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/230264; https://www.ibm.com/support/pages/node/6921243; https://exchange.xforce.ibmcloud.com/vulnerabilities/230264
CVE: CVE-2022-4304
Published: 2023-02-08
Description: A timing based side channel exists in the OpenSSL RSA Decryption implementation
which could be sufficient to recover a plaintext across a network in a
Bleichenbacher style attack. To achieve a successful decryption an attacker
would have to be able to send a very large number of trial messages for
decryption. The vulnerability affects all RSA padding modes: PKCS#1 v1.5,
RSA-OEAP and RSASVE.

For example, in a TLS connection, RSA is commonly used by a client to send an
encrypted pre-master secret to the server. An attacker that had observed a
genuine connection between a client and a server could use this flaw to send
trial messages to the server and record the time taken to process them. After a
sufficiently large number of messages the attacker could recover the pre-master
secret used for the original connection and thus be able to decrypt the
application data sent over that connection.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-203, CWE-203
References: https://security.gentoo.org/glsa/202402-08; https://www.openssl.org/news/secadv/20230207.txt; https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0003
CVE: CVE-2022-4450
Published: 2023-02-08
Description: The function PEM_read_bio_ex() reads a PEM file from a BIO and parses and
decodes the "name" (e.g. "CERTIFICATE"), any header data and the payload data.
If the function succeeds then the "name_out", "header" and "data" arguments are
populated with pointers to buffers containing the relevant decoded data. The
caller is responsible for freeing those buffers. It is possible to construct a
PEM file that results in 0 bytes of payload data. In this case PEM_read_bio_ex()
will return a failure code but will populate the header argument with a pointer
to a buffer that has already been freed. If the caller also frees this buffer
then a double free will occur. This will most likely lead to a crash. This
could be exploited by an attacker who has the ability to supply malicious PEM
files for parsing to achieve a denial of service attack.

The functions PEM_read_bio() and PEM_read() are simple wrappers around
PEM_read_bio_ex() and therefore these functions are also directly affected.

These functions are also called indirectly by a number of other OpenSSL
functions including PEM_X509_INFO_read_bio_ex() and
SSL_CTX_use_serverinfo_file() which are also vulnerable. Some OpenSSL internal
uses of these functions are not vulnerable because the caller does not free the
header argument if PEM_read_bio_ex() returns a failure code. These locations
include the PEM_read_bio_TYPE() functions as well as the decoders introduced in
OpenSSL 3.0.

The OpenSSL asn1parse command line application is also impacted by this issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-415, CWE-415
References: https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=63bcf189be73a9cc1264059bed6f57974be74a83; https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=bbcf509bd046b34cca19c766bbddc31683d0858b; https://security.gentoo.org/glsa/202402-08
CVE: CVE-2023-0215
Published: 2023-02-08
Description: The public API function BIO_new_NDEF is a helper function used for streaming
ASN.1 data via a BIO. It is primarily used internally to OpenSSL to support the
SMIME, CMS and PKCS7 streaming capabilities, but may also be called directly by
end user applications.

The function receives a BIO from the caller, prepends a new BIO_f_asn1 filter
BIO onto the front of it to form a BIO chain, and then returns the new head of
the BIO chain to the caller. Under certain conditions, for example if a CMS
recipient public key is invalid, the new filter BIO is freed and the function
returns a NULL result indicating a failure. However, in this case, the BIO chain
is not properly cleaned up and the BIO passed by the caller still retains
internal pointers to the previously freed filter BIO. If the caller then goes on
to call BIO_pop() on the BIO then a use-after-free will occur. This will most
likely result in a crash.



This scenario occurs directly in the internal function B64_write_ASN1() which
may cause BIO_new_NDEF() to be called and will subsequently call BIO_pop() on
the BIO. This internal function is in turn called by the public API functions
PEM_write_bio_ASN1_stream, PEM_write_bio_CMS_stream, PEM_write_bio_PKCS7_stream,
SMIME_write_ASN1, SMIME_write_CMS and SMIME_write_PKCS7.

Other public API functions that may be impacted by this include
i2d_ASN1_bio_stream, BIO_new_CMS, BIO_new_PKCS7, i2d_CMS_bio_stream and
i2d_PKCS7_bio_stream.

The OpenSSL cms and smime command line applications are similarly affected.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416, CWE-416
References: https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=8818064ce3c3c0f1b740a5aaba2a987e75bfbafd; https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=9816136fe31d92ace4037d5da5257f763aeeb4eb; https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=c3829dd8825c654652201e16f8a0a0c46ee3f344
CVE: CVE-2023-0216
Published: 2023-02-08
Description: An invalid pointer dereference on read can be triggered when an
application tries to load malformed PKCS7 data with the
d2i_PKCS7(), d2i_PKCS7_bio() or d2i_PKCS7_fp() functions.

The result of the dereference is an application crash which could
lead to a denial of service attack. The TLS implementation in OpenSSL
does not call this function however third party applications might
call these functions on untrusted data.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476, CWE-476
References: https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=934a04f0e775309cadbef0aa6b9692e1b12a76c6; https://security.gentoo.org/glsa/202402-08; https://www.openssl.org/news/secadv/20230207.txt
CVE: CVE-2023-0217
Published: 2023-02-08
Description: An invalid pointer dereference on read can be triggered when an
application tries to check a malformed DSA public key by the
EVP_PKEY_public_check() function. This will most likely lead
to an application crash. This function can be called on public
keys supplied from untrusted sources which could allow an attacker
to cause a denial of service attack.

The TLS implementation in OpenSSL does not call this function
but applications might call the function if there are additional
security requirements imposed by standards such as FIPS 140-3.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476, CWE-476
References: https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=23985bac83fd50c8e[PII_REDACTED]2b5442f985096; https://security.gentoo.org/glsa/202402-08; https://www.openssl.org/news/secadv/20230207.txt
CVE: CVE-2023-0286
Published: 2023-02-08
Description: There is a type confusion vulnerability relating to X.400 address processing
inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but
the public structure definition for GENERAL_NAME incorrectly specified the type
of the x400Address field as ASN1_TYPE. This field is subsequently interpreted by
the OpenSSL function GENERAL_NAME_cmp as an ASN1_TYPE rather than an
ASN1_STRING.

When CRL checking is enabled (i.e. the application sets the
X509_V_FLAG_CRL_CHECK flag), this vulnerability may allow an attacker to pass
arbitrary pointers to a memcmp call, enabling them to read memory contents or
enact a denial of service. In most cases, the attack requires the attacker to
provide both the certificate chain and CRL, neither of which need to have a
valid signature. If the attacker only controls one of these inputs, the other
input must already contain an X.400 address as a CRL distribution point, which
is uncommon. As such, this vulnerability is most likely to only affect
applications which have implemented their own functionality for retrieving CRLs
over a network.
CVSS Score: 7.4 (HIGH)
CWE: CWE-843, CWE-843
References: https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-3.6.2-relnotes.txt; https://ftp.openbsd.org/pub/OpenBSD/patches/7.2/common/018_x509.patch.sig; https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2c6c9d439b484e1ba9830d8454a34fa4f80fdfe9
CVE: CVE-2023-0401
Published: 2023-02-08
Description: A NULL pointer can be dereferenced when signatures are being
verified on PKCS7 signed or signedAndEnveloped data. In case the hash
algorithm used for the signature is known to the OpenSSL library but
the implementation of the hash algorithm is not available the digest
initialization will fail. There is a missing check for the return
value from the initialization function which later leads to invalid
usage of the digest API most likely leading to a crash.

The unavailability of an algorithm can be caused by using FIPS
enabled configuration of providers or more commonly by not loading
the legacy provider.

PKCS7 data is processed by the SMIME library calls and also by the
time stamp (TS) library calls. The TLS implementation in OpenSSL does
not call these functions however third party applications would be
affected if they call these functions to verify signatures on untrusted
data.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476, CWE-476
References: https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=d3b6dfd70db844c4499bec6ad6601623a565e674; https://security.gentoo.org/glsa/202402-08; https://www.openssl.org/news/secadv/20230207.txt
CVE: CVE-2023-0751
Published: 2023-02-08
Description: When GELI reads a key file from standard input, it does not reuse the key file to initialize multiple providers at once resulting in the second and subsequent devices silently using a NULL key as the user key file. If a user only uses a key file without a user passphrase, the master key is encrypted with an empty key file allowing trivial recovery of the master key.

CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://security.FreeBSD.org/advisories/FreeBSD-SA-23:01.geli.asc; https://security.FreeBSD.org/advisories/FreeBSD-SA-23:01.geli.asc; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2023-25150
Published: 2023-02-08
Description: Nextcloud office/richdocuments is an office suit for the nextcloud server platform. In affected versions the Collabora integration can be tricked to provide access to any file without proper permission validation. As a result any user with access to Collabora can obtain the content of other users files. It is recommended that the Nextcloud Office App (Collabora Integration) is updated to 7.0.2 (Nextcloud 25), 6.3.2 (Nextcloud 24), 5.0.10 (Nextcloud 23), 4.2.9 (Nextcloud 21-22), or 3.8.7 (Nextcloud 15-20). There are no known workarounds for this issue.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-284, CWE-732
References: https://github.com/nextcloud/richdocuments/pull/2669; https://github.com/nextcloud/security-advisories/security/advisories/GHSA-64xc-r58v-53gj; https://hackerone.com/reports/1788222
CVE: CVE-2023-25151
Published: 2023-02-08
Description: opentelemetry-go-contrib is a collection of extensions for OpenTelemetry-Go. The v0.38.0 release of `go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp` uses the `httpconv.ServerRequest` function to annotate metric measurements for the `http.server.request_content_length`, `http.server.response_content_length`, and `http.server.duration` instruments. The `ServerRequest` function sets the `http.target` attribute value to be the whole request URI (including the query string)[^1]. The metric instruments do not "forget" previous measurement attributes when `cumulative` temporality is used, this means the cardinality of the measurements allocated is directly correlated with the unique URIs handled. If the query string is constantly random, this will result in a constant increase in memory allocation that can be used in a denial-of-service attack. This issue has been addressed in version 0.39.0. Users are advised to upgrade. There are no known workarounds for this issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://github.com/open-telemetry/opentelemetry-go-contrib/security/advisories/GHSA-5r5m-65gx-7vrh; https://github.com/open-telemetry/opentelemetry-go/blob/v1.12.0/semconv/internal/v2/http.go#L159; https://github.com/open-telemetry/opentelemetry-go-contrib/security/advisories/GHSA-5r5m-65gx-7vrh
CVE: CVE-2023-25164
Published: 2023-02-08
Description: Tinacms is a Git-backed headless content management system with support for visual editing. Sites being built with @tinacms/cli >= 1.0.0 && < 1.0.9 which store sensitive values in the process.env variable are impacted. These values will be added in plaintext to the index.js file. If you're on a version prior to 1.0.0 this vulnerability does not affect you. If you are affected and your Tina-enabled website has sensitive credentials stored as environment variables (eg. Algolia API keys) you should rotate those keys immediately. This issue has been patched in @tinacms/cli@1.0.9. Users are advised to upgrade. There are no known workarounds for this issue.
CVSS Score: 8.6 (HIGH)
CWE: CWE-200, CWE-532
References: https://github.com/tinacms/tinacms/pull/3584; https://github.com/tinacms/tinacms/security/advisories/GHSA-pc2q-jcxq-rjrr; https://github.com/tinacms/tinacms/pull/3584
CVE: CVE-2023-25165
Published: 2023-02-08
Description: Helm is a tool that streamlines installing and managing Kubernetes applications.`getHostByName` is a Helm template function introduced in Helm v3. The function is able to accept a hostname and return an IP address for that hostname. To get the IP address the function performs a DNS lookup. The DNS lookup happens when used with `helm install|upgrade|template` or when the Helm SDK is used to render a chart. Information passed into the chart can be disclosed to the DNS servers used to lookup the IP address. For example, a malicious chart could inject `getHostByName` into a chart in order to disclose values to a malicious DNS server. The issue has been fixed in Helm 3.11.1. Prior to using a chart with Helm verify the `getHostByName` function is not being used in a template to disclose any information you do not want passed to DNS servers.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://github.com/helm/helm/commit/5abcf74227bfe8e5a3dbf105fe62e7b12deb58d2; https://github.com/helm/helm/security/advisories/GHSA-pwcw-6f5g-gxf8; https://github.com/helm/helm/commit/5abcf74227bfe8e5a3dbf105fe62e7b12deb58d2
CVE: CVE-2023-25166
Published: 2023-02-08
Description: formula is a math and string formula parser. In versions prior to 3.0.1 crafted user-provided strings to formula's parser might lead to polynomial execution time and a denial of service. Users should upgrade to 3.0.1+. There are no known workarounds for this vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-1333
References: https://github.com/hapijs/formula/commit/9fbc20a02d75ae809c37a610a57802cd1b41b3fe; https://github.com/hapijs/formula/security/advisories/GHSA-c2jc-4fpr-4vhg; https://github.com/hapijs/formula/commit/9fbc20a02d75ae809c37a610a57802cd1b41b3fe
CVE: CVE-2023-25167
Published: 2023-02-08
Description: Discourse is an open source discussion platform. In affected versions a malicious user can cause a regular expression denial of service using a carefully crafted git URL. This issue is patched in the latest stable, beta and tests-passed versions of Discourse. Users are advised to upgrade. There are no known workarounds for this issue.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-1333
References: https://github.com/discourse/discourse/commit/ec4c[PII_REDACTED]6dc28788bc4ab8a22a098573cd; https://github.com/discourse/discourse/security/advisories/GHSA-4w55-w26q-r35w; https://github.com/discourse/discourse/commit/ec4c[PII_REDACTED]6dc28788bc4ab8a22a098573cd
CVE: CVE-2022-38777
Published: 2023-02-08
Description: An issue was discovered in the rollback feature of Elastic Endpoint Security for Windows, which could allow unprivileged users to elevate their privileges to those of the LocalSystem account.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269, CWE-269
References: https://discuss.elastic.co/t/elastic-7-17-9-8-5-0-and-8-6-1-security-update/324661; https://www.elastic.co/community/security; https://discuss.elastic.co/t/elastic-7-17-9-8-5-0-and-8-6-1-security-update/324661
CVE: CVE-2022-38778
Published: 2023-02-08
Description: A flaw (CVE-2022-38900) was discovered in one of Kibana’s third party dependencies, that could allow an authenticated user to perform a request that crashes the Kibana server process.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://discuss.elastic.co/t/elastic-7-17-9-8-5-0-and-8-6-1-security-update/324661; https://www.elastic.co/community/security; https://discuss.elastic.co/t/elastic-7-17-9-8-5-0-and-8-6-1-security-update/324661
CVE: CVE-2022-45982
Published: 2023-02-08
Description: thinkphp 6.0.0~6.0.13 and 6.1.0~6.1.1 contains a deserialization vulnerability. This vulnerability allows attackers to execute arbitrary code via a crafted payload.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502, CWE-502
References: https://gist.github.com/Dar1in9s/aa87df679057db3bbdade360d77f8cca; https://gist.github.com/Dar1in9s/aa87df679057db3bbdade360d77f8cca
CVE: CVE-2022-47648
Published: 2023-02-08
Description: An Improper Access Control vulnerability allows an attacker to access the control panel of the B420 without requiring any sort of authorization or authentication due to the IP based authorization. If an authorized user has accessed a publicly available B420 product using valid credentials, an insider attacker can gain access to the same panel without requiring any sort of authorization. The B420 module was already obsolete at the time this vulnerability was found (The End of Life announcement was made in 2013).
CVSS Score: 7.6 (HIGH)
CWE: CWE-284, CWE-290
References: https://drive.google.com/drive/folders/16jvVFyp9RlHvXvq7qbOCjCs1jiAPT3i_?usp=sharing; https://pastebin.com/raw/0CGTpiEn; https://psirt.bosch.com/security-advisories/BOSCH-SA-341298-BT.html
CVE: CVE-2023-25163
Published: 2023-02-08
Description: Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of Argo CD starting with v2.6.0-rc1 have an output sanitization bug which leaks repository access credentials in error messages. These error messages are visible to the user, and they are logged. The error message is visible when a user attempts to create or update an Application via the Argo CD API (and therefor the UI or CLI). The user must have `applications, create` or `applications, update` RBAC access to reach the code which may produce the error. The user is not guaranteed to be able to trigger the error message. They may attempt to spam the API with requests to trigger a rate limit error from the upstream repository. If the user has `repositories, update` access, they may edit an existing repository to introduce a URL typo or otherwise force an error message. But if they have that level of access, they are probably intended to have access to the credentials anyway. A patch for this vulnerability has been released in version 2.6.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-532
References: https://argo-cd.readthedocs.io/en/stable/operator-manual/rbac/; https://github.com/argoproj/argo-cd/issues/12309; https://github.com/argoproj/argo-cd/pull/12320
CVE: CVE-2023-0249
Published: 2023-02-08
Description: Delta Electronics DIAScreen versions 1.2.1.23 and prior are vulnerable to out-of-bounds write, which may allow an attacker to remotely execute arbitrary code.


CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.cisa.gov/uscert/ics/advisories/icsa-23-033-01; https://www.cisa.gov/uscert/ics/advisories/icsa-23-033-01
CVE: CVE-2023-0250
Published: 2023-02-08
Description: Delta Electronics DIAScreen versions 1.2.1.23 and prior are vulnerable to a stack-based buffer overflow, which could allow an attacker to remotely execute arbitrary code.


CVSS Score: 7.8 (HIGH)
CWE: CWE-121
References: https://www.cisa.gov/uscert/ics/advisories/icsa-23-033-01; https://www.cisa.gov/uscert/ics/advisories/icsa-23-033-01
CVE: CVE-2023-0251
Published: 2023-02-08
Description: Delta Electronics DIAScreen versions 1.2.1.23 and prior are vulnerable to a buffer overflow through improper restrictions of operations within memory, which could allow an attacker to remotely execute arbitrary code.


CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://www.cisa.gov/uscert/ics/advisories/icsa-23-033-01; https://www.cisa.gov/uscert/ics/advisories/icsa-23-033-01
CVE: CVE-2023-25168
Published: 2023-02-09
Description: Wings is Pterodactyl's server control plane. This vulnerability can be used to delete files and directories recursively on the host system.  This vulnerability can be combined with `GHSA-p8r3-83r8-jwj5` to overwrite files on the host system. In order to use this exploit, an attacker must have an existing "server" allocated and controlled by Wings. This vulnerability has been resolved in version `v1.11.4` of Wings, and has been back-ported to the 1.7 release series in `v1.7.4`. Anyone running `v1.11.x` should upgrade to `v1.11.4` and anyone running `v1.7.x` should upgrade to `v1.7.4`. There are no known workarounds for this issue.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-59, CWE-59
References: https://github.com/pterodactyl/wings/commit/429ac62dba22997a278bc709df5ac00a5a25d83d; https://github.com/pterodactyl/wings/security/advisories/GHSA-66p8-j459-rq63; https://github.com/pterodactyl/wings/security/advisories/GHSA-p8r3-83r8-jwj5
CVE: CVE-2022-43440
Published: 2023-02-09
Description: Uncontrolled Search Path Element in Checkmk Agent in Tribe29 Checkmk before 2.1.0p1, before 2.0.0p25 and before 1.6.0p29 on a Checkmk server allows the site user to escalate privileges via a manipulated unixcat executable
CVSS Score: 8.8 (HIGH)
CWE: CWE-427, CWE-427
References: https://checkmk.com/werk/14087; https://checkmk.com/werk/14087