deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-27322
Published: 2024-05-03
Description: Parallels Desktop Service Improper Initialization Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop. An attacker must first obtain the ability to execute low-privileged code on the target host system in order to exploit this vulnerability.

The specific flaw exists within the Parallels Service. The issue results from the lack of proper initialization of environment variables. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of root. Was ZDI-CAN-17751.
CVSS Score: 7.8 (HIGH)
CWE: CWE-665
References: https://kb.parallels.com/125013; https://www.zerodayinitiative.com/advisories/ZDI-23-216/; https://kb.parallels.com/125013
CVE: CVE-2023-27323
Published: 2024-05-03
Description: Parallels Desktop Updater Time-Of-Check Time-Of-Use Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop. An attacker must first obtain the ability to execute low-privileged code on the target host system in order to exploit this vulnerability.

The specific flaw exists within the Updater service. By creating a symbolic link, an attacker can abuse the service to execute a file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of root.
. Was ZDI-CAN-18150.
CVSS Score: 7.8 (HIGH)
CWE: CWE-367
References: https://kb.parallels.com/125013; https://www.zerodayinitiative.com/advisories/ZDI-23-217/; https://kb.parallels.com/125013
CVE: CVE-2023-27324
Published: 2024-05-03
Description: Parallels Desktop Updater Improper Initialization Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop. An attacker must first obtain the ability to execute low-privileged code on the target host system in order to exploit this vulnerability.

The specific flaw exists within the Updater service. The issue results from the lack of proper initialization of environment variables. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of root.
. Was ZDI-CAN-18229.
CVSS Score: 7.8 (HIGH)
CWE: CWE-665
References: https://kb.parallels.com/125013; https://www.zerodayinitiative.com/advisories/ZDI-23-218/; https://kb.parallels.com/125013
CVE: CVE-2023-27325
Published: 2024-05-03
Description: Parallels Desktop Updater Improper Initialization Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop. An attacker must first obtain the ability to execute low-privileged code on the target host system in order to exploit this vulnerability.

The specific flaw exists within the Updater service. The issue results from the lack of proper initialization of environment variables. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of root.
. Was ZDI-CAN-18253.
CVSS Score: 7.8 (HIGH)
CWE: CWE-665, CWE-665
References: https://kb.parallels.com/125013; https://www.zerodayinitiative.com/advisories/ZDI-23-219/; https://kb.parallels.com/125013
CVE: CVE-2023-27326
Published: 2024-05-03
Description: Parallels Desktop Toolgate Directory Traversal Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability.

The specific flaw exists within the Toolgate component. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the current user on the host system.
. Was ZDI-CAN-18933.
CVSS Score: 8.2 (HIGH)
CWE: CWE-22
References: https://kb.parallels.com/125013; https://www.zerodayinitiative.com/advisories/ZDI-23-221/; https://kb.parallels.com/125013
CVE: CVE-2023-27327
Published: 2024-05-03
Description: Parallels Desktop Toolgate Time-Of-Check Time-Of-Use Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability.

The specific flaw exists within the Toolgate component. The issue results from the lack of proper locking when performing operations on an object. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the current user on the host system. Was ZDI-CAN-18964.
CVSS Score: 7.5 (HIGH)
CWE: CWE-367
References: https://kb.parallels.com/125013; https://www.zerodayinitiative.com/advisories/ZDI-23-215/; https://kb.parallels.com/125013
CVE: CVE-2023-27328
Published: 2024-05-03
Description: Parallels Desktop Toolgate XML Injection Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop. An attacker must first obtain the ability to execute low-privileged code on the target guest system in order to exploit this vulnerability.

The specific flaw exists within the Toolgate component. The issue results from the lack of proper validation of a user-supplied string before using it to construct an XML document. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the hypervisor. Was ZDI-CAN-19187.
CVSS Score: 7.8 (HIGH)
CWE: CWE-91
References: https://kb.parallels.com/125013; https://www.zerodayinitiative.com/advisories/ZDI-23-220/; https://kb.parallels.com/125013
CVE: CVE-2023-27329
Published: 2024-05-03
Description: Foxit PDF Reader Annotation Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the handling of Annotation objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-19477.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://www.foxit.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-23-227/; https://www.foxit.com/support/security-bulletins.html
CVE: CVE-2023-27330
Published: 2024-05-03
Description: Foxit PDF Reader XFA Annotation Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the handling of Annotation objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-19476.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://www.foxit.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-23-226/; https://www.foxit.com/support/security-bulletins.html
CVE: CVE-2023-27331
Published: 2024-05-03
Description: Foxit PDF Reader Annotation Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the handling of Annotation objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-19475.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://www.foxit.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-23-225/; https://www.foxit.com/support/security-bulletins.html
CVE: CVE-2023-27332
Published: 2024-05-03
Description: TP-Link Archer AX21 tdpServer Logging Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link Archer AX21 routers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the logging functionality of the tdpServer program, which listens on UDP port 20002. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root.
. Was ZDI-CAN-19898.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121
References: https://www.zerodayinitiative.com/advisories/ZDI-23-245/; https://www.zerodayinitiative.com/advisories/ZDI-23-245/
CVE: CVE-2023-27333
Published: 2024-05-03
Description: TP-Link Archer AX21 tmpServer Command 0x422 Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link Archer AX21 routers. Authentication is required to exploit this vulnerability.

The specific flaw exists within the handling of command 0x422 provided to the tmpServer service. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root.
. Was ZDI-CAN-19905.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-121
References: https://www.zerodayinitiative.com/advisories/ZDI-23-244/; https://www.zerodayinitiative.com/advisories/ZDI-23-244/
CVE: CVE-2023-27334
Published: 2024-05-03
Description: Softing edgeConnector Siemens ConditionRefresh Resource Exhaustion Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Softing edgeConnector Siemens. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the handling of OPC UA ConditionRefresh requests. By sending a large number of requests, an attacker can consume all available resources on the server. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-20498.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://industrial.softing.com/fileadmin/psirt/downloads/syt-2023-1.html; https://www.zerodayinitiative.com/advisories/ZDI-23-1054/; https://industrial.softing.com/fileadmin/psirt/downloads/syt-2023-1.html
CVE: CVE-2023-27335
Published: 2024-05-03
Description: Softing edgeAggregator Client Cross-Site Scripting Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Softing edgeAggregator. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the handling of the input parameters provided to the edgeAggregetor client. The issue results from the lack of proper validation of user-supplied data, which can lead to the injection of an arbitrary script. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-20504.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-79
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1057/; https://www.zerodayinitiative.com/advisories/ZDI-23-1057/
CVE: CVE-2023-27336
Published: 2024-05-03
Description: Softing edgeConnector Siemens OPC UA Server Null Pointer Dereference Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Softing edgeConnector Siemens. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the handling of OPC client certificates. The issue results from dereferencing a NULL pointer. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-20508.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://www.zerodayinitiative.com/advisories/ZDI-23-1065/; https://www.zerodayinitiative.com/advisories/ZDI-23-1065/
CVE: CVE-2023-27337
Published: 2024-05-03
Description: PDF-XChange Editor PDF File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of PDF files. Crafted data in a PDF file can trigger a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18494.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-125
References: https://www.tracker-software.com/product/pdf-xchange-editor/history; https://www.zerodayinitiative.com/advisories/ZDI-23-349/; https://www.tracker-software.com/product/pdf-xchange-editor/history
CVE: CVE-2023-27338
Published: 2024-05-03
Description: PDF-XChange Editor TIF File Parsing Use-After-Free Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of TIF files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18612.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416, CWE-416
References: https://www.tracker-software.com/product/pdf-xchange-editor/history; https://www.zerodayinitiative.com/advisories/ZDI-23-350/; https://www.tracker-software.com/product/pdf-xchange-editor/history
CVE: CVE-2023-27339
Published: 2024-05-03
Description: PDF-XChange Editor PNG File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of PNG files. Crafted data in a PNG file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18663.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.tracker-software.com/product/pdf-xchange-editor/history; https://www.zerodayinitiative.com/advisories/ZDI-23-351/; https://www.tracker-software.com/product/pdf-xchange-editor/history
CVE: CVE-2023-27340
Published: 2024-05-03
Description: PDF-XChange Editor PNG File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of PNG files. Crafted data in a PNG file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18665.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.tracker-software.com/product/pdf-xchange-editor/history; https://www.zerodayinitiative.com/advisories/ZDI-23-352/; https://www.tracker-software.com/product/pdf-xchange-editor/history
CVE: CVE-2023-27341
Published: 2024-05-03
Description: PDF-XChange Editor TIF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of TIF files. Crafted data in a TIF file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18729.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.tracker-software.com/product/pdf-xchange-editor/history; https://www.zerodayinitiative.com/advisories/ZDI-23-353/; https://www.tracker-software.com/product/pdf-xchange-editor/history
CVE: CVE-2023-27342
Published: 2024-05-03
Description: PDF-XChange Editor EMF File Parsing Untrusted Pointer Dereference Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of EMF files. The issue results from the lack of proper validation of a user-supplied value prior to dereferencing it as a pointer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18766.
CVSS Score: 7.8 (HIGH)
CWE: CWE-822
References: https://www.tracker-software.com/product/pdf-xchange-editor/history; https://www.zerodayinitiative.com/advisories/ZDI-23-354/; https://www.tracker-software.com/product/pdf-xchange-editor/history
CVE: CVE-2023-27343
Published: 2024-05-03
Description: PDF-XChange Editor EMF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of EMF files. Crafted data in a EMF can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18790.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.tracker-software.com/product/pdf-xchange-editor/history; https://www.zerodayinitiative.com/advisories/ZDI-23-355/; https://www.tracker-software.com/product/pdf-xchange-editor/history
CVE: CVE-2023-27344
Published: 2024-05-03
Description: PDF-XChange Editor PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of PDF files. Crafted data in a PDF file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-19302.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.tracker-software.com/product/pdf-xchange-editor/history; https://www.zerodayinitiative.com/advisories/ZDI-23-356/; https://www.tracker-software.com/product/pdf-xchange-editor/history
CVE: CVE-2023-27345
Published: 2024-05-03
Description: PDF-XChange Editor PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of PDF files. Crafted data in a PDF file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-19303.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.tracker-software.com/product/pdf-xchange-editor/history; https://www.zerodayinitiative.com/advisories/ZDI-23-357/; https://www.tracker-software.com/product/pdf-xchange-editor/history
CVE: CVE-2023-27346
Published: 2024-05-03
Description: TP-Link AX1800 Firmware Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link AX1800 routers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the parsing of firmware images. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root.
. Was ZDI-CAN-19703.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121
References: https://www.zerodayinitiative.com/advisories/ZDI-23-377/; https://www.zerodayinitiative.com/advisories/ZDI-23-377/
CVE: CVE-2023-27347
Published: 2024-05-03
Description: G DATA Total Security Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of G Data Total Security. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the G DATA Backup Service. By creating a symbolic link, an attacker can abuse the service to create arbitrary files. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-18749.
CVSS Score: 7.8 (HIGH)
CWE: CWE-59
References: https://www.zerodayinitiative.com/advisories/ZDI-23-379/; https://www.zerodayinitiative.com/advisories/ZDI-23-379/
CVE: CVE-2023-27348
Published: 2024-05-03
Description: PDF-XChange Editor TIF File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of TIF files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-19108.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://www.tracker-software.com/product/pdf-xchange-editor/history; https://www.zerodayinitiative.com/advisories/ZDI-23-358/; https://www.tracker-software.com/product/pdf-xchange-editor/history