deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-27323
Published: 2024-04-01
Description: PDF-XChange Editor Updater Improper Certificate Validation Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is not required to exploit this vulnerability.

The specific flaw exists within the update functionality. The issue results from the lack of proper validation of the certificate presented by the server. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-22224.
CVSS Score: 7.5 (HIGH)
CWE: CWE-295, CWE-295
References: https://www.zerodayinitiative.com/advisories/ZDI-24-198/; https://www.zerodayinitiative.com/advisories/ZDI-24-198/
CVE: CVE-2024-27324
Published: 2024-04-01
Description: PDF-XChange Editor TIF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of TIF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-22270.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://www.zerodayinitiative.com/advisories/ZDI-24-196/; https://www.zerodayinitiative.com/advisories/ZDI-24-196/
CVE: CVE-2024-27325
Published: 2024-04-01
Description: PDF-XChange Editor EMF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of EMF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-22275.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://www.zerodayinitiative.com/advisories/ZDI-24-203/; https://www.zerodayinitiative.com/advisories/ZDI-24-203/
CVE: CVE-2024-27326
Published: 2024-04-01
Description: PDF-XChange Editor XPS File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of XPS files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-22276.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://www.zerodayinitiative.com/advisories/ZDI-24-204/; https://www.zerodayinitiative.com/advisories/ZDI-24-204/
CVE: CVE-2024-27327
Published: 2024-04-01
Description: PDF-XChange Editor PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a write  past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22277.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.zerodayinitiative.com/advisories/ZDI-24-205/; https://www.zerodayinitiative.com/advisories/ZDI-24-205/
CVE: CVE-2024-27328
Published: 2024-04-01
Description: PDF-XChange Editor EMF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the handling of EMF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-22280.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://www.zerodayinitiative.com/advisories/ZDI-24-202/; https://www.zerodayinitiative.com/advisories/ZDI-24-202/
CVE: CVE-2024-27329
Published: 2024-04-01
Description: PDF-XChange Editor XPS File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of XPS files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-22285.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://www.zerodayinitiative.com/advisories/ZDI-24-200/; https://www.zerodayinitiative.com/advisories/ZDI-24-200/
CVE: CVE-2024-27330
Published: 2024-04-01
Description: PDF-XChange Editor EMF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of EMF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-22286.
CVSS Score: 3.3 (LOW)
CWE: CWE-125
References: https://www.zerodayinitiative.com/advisories/ZDI-24-199/; https://www.zerodayinitiative.com/advisories/ZDI-24-199/
CVE: CVE-2024-27331
Published: 2024-04-01
Description: PDF-XChange Editor EMF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of EMF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-22287.
CVSS Score: 3.3 (LOW)
CWE: CWE-125
References: https://www.zerodayinitiative.com/advisories/ZDI-24-201/; https://www.zerodayinitiative.com/advisories/ZDI-24-201/
CVE: CVE-2024-27332
Published: 2024-04-01
Description: PDF-XChange Editor JPG File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of JPG files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-22288.
CVSS Score: 3.3 (LOW)
CWE: CWE-125
References: https://www.zerodayinitiative.com/advisories/ZDI-24-197/; https://www.zerodayinitiative.com/advisories/ZDI-24-197/
CVE: CVE-2024-3138
Published: 2024-04-01
Description: ** DISPUTED ** A vulnerability was found in francoisjacquet RosarioSIS 11.5.1. It has been rated as problematic. This issue affects some unknown processing of the component Add Portal Note. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The associated identifier of this vulnerability is VDB-258911. NOTE: The vendor explains that the PDF is opened by the browser app in a sandbox, so no data from the website should be accessible.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://powerful-bulb-c36.notion.site/Stored-xss-via-malicious-PDF-upload-98fb1ea6b9bf4ddfaf04d61b2c05410a; https://vuldb.com/?ctiid.258911; https://vuldb.com/?id.258911
CVE: CVE-2024-3164
Published: 2024-04-01
Description: In dotCMS dashboard, the Tools and Log Files tabs under System → Maintenance Portlet, which is and always has been an Admin portlet, is accessible to anyone with that portlet and not just to CMS Admins. Users that get site admin but not a system admin, should not have access to the System Maintenance → Tools portlet. This would share database username and password under Log Files and download DB Dump and other dotCMS Content under Tools. Nothing in the System → Maintenance should be displayed for users with site admin role. Only system admins must have access to System Maintenance.

OWASP Top 10 - A01) Broken Access Control

OWASP Top 10 - A04) Insecure Design
CVSS Score: 4.5 (MEDIUM)
CWE: CWE-284
References: https://github.com/dotCMS/core/issues/27909; https://github.com/dotCMS/core/pull/27912; https://www.dotcms.com/security/SI-69
CVE: CVE-2024-3165
Published: 2024-04-01
Description: System->Maintenance-> Log Files in dotCMS dashboard is providing the username/password for database connections in the log output. Nevertheless, this is a moderate issue as it requires a backend admin as well as that dbs are locked down by environment.  

OWASP Top 10 - A05) Insecure Design

OWASP Top 10 - A05) Security Misconfiguration

OWASP Top 10 - A09) Security Logging and Monitoring Failure
CVSS Score: 4.5 (MEDIUM)
CWE: CWE-532
References: https://github.com/dotCMS/core/issues/27910; https://github.com/dotCMS/core/pull/28006; https://www.dotcms.com/security/SI-70
CVE: CVE-2024-27333
Published: 2024-04-01
Description: Kofax Power PDF GIF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Kofax Power PDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the handling of GIF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-21976.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://www.zerodayinitiative.com/advisories/ZDI-24-216/; https://www.zerodayinitiative.com/advisories/ZDI-24-216/
CVE: CVE-2024-3139
Published: 2024-04-01
Description: A vulnerability, which was classified as critical, has been found in SourceCodester Computer Laboratory Management System 1.0. Affected by this issue is the function save_users of the file /classes/Users.php?f=save. The manipulation of the argument id leads to improper authorization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-258914 is the identifier assigned to this vulnerability.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-285, CWE-639
References: https://github.com/Sospiro014/zday1/blob/main/Laboratory_Management_System.md; https://vuldb.com/?ctiid.258914; https://vuldb.com/?id.258914
CVE: CVE-2024-3140
Published: 2024-04-01
Description: A vulnerability, which was classified as problematic, was found in SourceCodester Computer Laboratory Management System 1.0. This affects an unknown part of the file /classes/Users.php?f=save. The manipulation of the argument middlename leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-258915.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/Sospiro014/zday1/blob/main/xss_1.md; https://vuldb.com/?ctiid.258915; https://vuldb.com/?id.258915
CVE: CVE-2024-3141
Published: 2024-04-01
Description: A vulnerability has been found in Clavister E10 and E80 up to 14.00.10 and classified as problematic. This vulnerability affects unknown code of the file /?Page=Node&OBJ=/System/AdvancedSettings/DeviceSettings/MiscSettings of the component Misc Settings Page. The manipulation of the argument WatchdogTimerTime/BufFloodRebootTime/MaxPipeUsers/AVCache Lifetime/HTTPipeliningMaxReq/Reassembly MaxConnections/Reassembly MaxProcessingMem/ScrSaveTime leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 14.00.11 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-258916.
CVSS Score: 2.4 (LOW)
CWE: CWE-79
References: https://docs.clavister.com/repo/cos-core-release-notes/doc/index.html#d0e2260; https://github.com/strik3r0x1/Vulns/blob/main/Clavister_E80-RXSS.md; https://my.clavister.com/downloads/?sid=1
CVE: CVE-2024-27334
Published: 2024-04-02
Description: Kofax Power PDF JPG File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Kofax Power PDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of JPG files.
The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-21978.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://www.zerodayinitiative.com/advisories/ZDI-24-232/; https://www.zerodayinitiative.com/advisories/ZDI-24-232/
CVE: CVE-2024-3137
Published: 2024-04-02
Description: Improper Privilege Management in uvdesk/community-skeleton
CVSS Score: 7.1 (HIGH)
CWE: CWE-269
References: https://huntr.com/bounties/faf74783-644c-40cd-aa98-2239e5fafcd1; https://huntr.com/bounties/faf74783-644c-40cd-aa98-2239e5fafcd1
CVE: CVE-2024-3142
Published: 2024-04-02
Description: A vulnerability was found in Clavister E10 and E80 up to 14.00.10 and classified as problematic. This issue affects some unknown processing of the component Setting Handler. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 14.00.11 is able to address this issue. It is recommended to upgrade the affected component. The identifier VDB-258917 was assigned to this vulnerability.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://docs.clavister.com/repo/cos-core-release-notes/doc/index.html#d0e2260; https://github.com/strik3r0x1/Vulns/blob/main/CSRF_Clavister-E80,E10.md; https://my.clavister.com/downloads/?sid=1
CVE: CVE-2024-3143
Published: 2024-04-02
Description: A vulnerability was found in DedeCMS 5.7. It has been classified as problematic. Affected is an unknown function of the file /src/dede/member_rank.php. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-258918 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://github.com/E1CHO/demo/blob/main/39.pdf; https://vuldb.com/?ctiid.258918; https://vuldb.com/?id.258918
CVE: CVE-2024-3144
Published: 2024-04-02
Description: A vulnerability was found in DedeCMS 5.7. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /src/dede/makehtml_spec.php. The manipulation leads to cross-site request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-258919. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://github.com/Hckwzh/cms/blob/main/12.md; https://vuldb.com/?ctiid.258919; https://vuldb.com/?id.258919
CVE: CVE-2024-3145
Published: 2024-04-02
Description: A vulnerability was found in DedeCMS 5.7. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /src/dede/makehtml_js_action.php. The manipulation leads to cross-site request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-258920. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://github.com/Hckwzh/cms/blob/main/13.md; https://vuldb.com/?ctiid.258920; https://vuldb.com/?id.258920
CVE: CVE-2024-3146
Published: 2024-04-02
Description: A vulnerability classified as problematic has been found in DedeCMS 5.7. This affects an unknown part of the file /src/dede/makehtml_rss_action.php. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-258921 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://github.com/Hckwzh/cms/blob/main/14.md; https://vuldb.com/?ctiid.258921; https://vuldb.com/?id.258921
CVE: CVE-2024-3147
Published: 2024-04-02
Description: A vulnerability classified as problematic was found in DedeCMS 5.7. This vulnerability affects unknown code of the file /src/dede/makehtml_map.php. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-258922 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://github.com/Hckwzh/cms/blob/main/15.md; https://vuldb.com/?ctiid.258922; https://vuldb.com/?id.258922
CVE: CVE-2024-3148
Published: 2024-04-02
Description: A vulnerability, which was classified as critical, has been found in DedeCMS 5.7.112. This issue affects some unknown processing of the file dede/makehtml_archives_action.php. The manipulation leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-258923. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/gatsby2003/DedeCms/blob/main/DedeCms%20sql%20time-based%20blind%20injection.md; https://vuldb.com/?ctiid.258923; https://vuldb.com/?id.258923
CVE: CVE-2024-20842
Published: 2024-04-02
Description: Improper Input Validation vulnerability in handling apdu of libsec-ril prior to SMR Apr-2024 Release 1 allows local privileged attackers to write out-of-bounds memory.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-787
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=04; https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=04
CVE: CVE-2024-20843
Published: 2024-04-02
Description: Out-of-bound write vulnerability in command parsing implementation of libIfaaCa prior to SMR Apr-2024 Release 1 allows local privileged attackers to execute arbitrary code.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-787
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=04; https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=04
CVE: CVE-2024-20844
Published: 2024-04-02
Description: Out-of-bounds write vulnerability while parsing remaining codewords in libsavsac.so prior to SMR Apr-2024 Release 1 allows local attacker to execute arbitrary code.
CVSS Score: 8.4 (HIGH)
CWE: CWE-787
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=04; https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=04
CVE: CVE-2024-20845
Published: 2024-04-02
Description: Out-of-bounds write vulnerability while releasing memory in libsavsac.so prior to SMR Apr-2024 Release 1 allows local attacker to execute arbitrary code.
CVSS Score: 8.4 (HIGH)
CWE: CWE-787
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=04; https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=04
CVE: CVE-2024-20846
Published: 2024-04-02
Description: Out-of-bounds write vulnerability while decoding hcr of libsavsac.so prior to SMR Apr-2024 Release 1 allows local attacker to execute arbitrary code.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-787
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=04; https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=04
CVE: CVE-2024-20847
Published: 2024-04-02
Description: Improper Access Control vulnerability in StorageManagerService prior to SMR Apr-2024 Release 1 allows local attackers to read sdcard information.
CVSS Score: 4.0 (MEDIUM)
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=04; https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=04
CVE: CVE-2024-20848
Published: 2024-04-02
Description: Improper Input Validation vulnerability in text parsing implementation of libsdffextractor prior to SMR Apr-2024 Release 1 allows local attackers to write out-of-bounds memory.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-787
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=04; https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=04
CVE: CVE-2024-20849
Published: 2024-04-02
Description: Out-of-bound Write vulnerability in chunk parsing implementation of libsdffextractor prior to SMR Apr-2023 Release 1 allows local attackers to execute arbitrary code.
CVSS Score: 7.3 (HIGH)
CWE: CWE-787
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=04; https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=04