exploitintel/cve-cwe-consensus huggingface dataset:
user: Synapse is a Matrix protocol homeserver written in Python with the Twisted framework. A discovered oEmbed or image URL can bypass the `url_preview_url_blacklist` setting potentially allowing server side request forgery or bypassing network policies. Impact is limited to IP addresses allowed by the `url_preview_ip_range_blacklist` setting (by default this only allows public IPs) and by the limited information returned to the client: 1. For discovered oEmbed URLs, any non-JSON response or a JSON response which includes non-oEmbed information is discarded. 2. For discovered image URLs, any non-image response is discarded. Systems which have URL preview disabled (via the `url_preview_enabled` setting) or have not configured a `url_preview_url_blacklist` are not affected. This issue has been addressed in version 1.85.0. Users are advised to upgrade. User unable to upgrade may also disable URL previews.

assistant: CWE-863
user: Kiwi TCMS is an open source test management system for both manual and automated testing. Kiwi TCMS allows users to upload attachments to test plans, test cases, etc. Earlier versions of Kiwi TCMS had introduced upload validators in order to prevent potentially dangerous files from being uploaded. The upload validation checks were not robust enough which left the possibility of an attacker to circumvent them and upload a potentially dangerous file. Exploiting this flaw, a combination of files could be uploaded so that they work together to circumvent the existing Content-Security-Policy and allow execution of arbitrary JavaScript in the browser. This issue has been patched in version 12.3.

assistant: CWE-79, CWE-434
user: parse-server-push-adapter is the official Push Notification adapter for Parse Server. The Parse Server Push Adapter can crash Parse Server due to an invalid push notification payload. This issue has been patched in version 4.1.3.

assistant: CWE-20
user: Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Versions prior to 5.4.4 and 6.1.1 are vulnerable to a phishing attack vulnerability that involves a user uploading malicious files. A malicious user could upload an HTML file to Parse Server via its public API. That HTML file would then be accessible at the internet domain at which Parse Server is hosted. The URL of the the uploaded HTML could be shared for phishing attacks. The HTML page may seem legitimate because it is served under the internet domain where Parse Server is hosted, which may be the same as a company's official website domain.

An additional security issue arises when the Parse JavaScript SDK is used. The SDK stores sessions in the internet browser's local storage, which usually restricts data access depending on the internet domain. A malicious HTML file could contain a script that retrieves the user's session token from local storage and then share it with the attacker.

The fix included in versions 5.4.4 and 6.1.1 adds a new Parse Server option `fileUpload.fileExtensions` to restrict file upload on Parse Server by file extension. It is recommended to restrict file upload for HTML file extensions, which this fix disables by default. If an app requires upload of files with HTML file extensions, the option can be set to `['.*']` or another custom value to override the default.

assistant: CWE-434
user: libspdm is a sample implementation that follows the DMTF SPDM specifications. Prior to versions 2.3.3 and 3.0, following a successful CAPABILITIES response, a libspdm Requester stores the Responder's CTExponent into its context without validation. If the Requester sends a request message that requires a cryptography operation by the Responder, such as CHALLENGE, libspdm will calculate the timeout value using the Responder's unvalidated CTExponent.

A patch is available in version 2.3.3. A workaround is also available. After completion of VCA, the Requester can check the value of the Responder's CTExponent. If it greater than or equal to 64, then the Requester can stop communication with the Responder.

assistant: CWE-20
user: CodeIgniter is a PHP full-stack web framework. This vulnerability allows attackers to execute arbitrary code when you use Validation Placeholders. The vulnerability exists in the Validation library, and validation methods in the controller and in-model validation are also vulnerable because they use the Validation library internally. This issue is patched in version 4.3.5.

assistant: CWE-94
user: Saleor Core is a composable, headless commerce API. Saleor's `validate_hmac_signature` function is vulnerable to timing attacks. Malicious users could abuse this vulnerability on Saleor deployments having the Adyen plugin enabled in order to determine the secret key and forge fake events, this could affect the database integrity such as marking an order as paid when it is not. This issue has been patched in versions 3.7.68, 3.8.40, 3.9.49, 3.10.36, 3.11.35, 3.12.25, and 3.13.16.

assistant: CWE-203
user: CKAN is an open-source data management system for powering data hubs and data portals. Prior to versions 2.9.9 and 2.10.1, the `ckan` user (equivalent to www-data) owned code and configuration files in the docker container and the `ckan` user had the permissions to use sudo. These issues allowed for code execution or privilege escalation if an arbitrary file write bug was available. Versions 2.9.9, 2.9.9-dev, 2.10.1, and 2.10.1-dev contain a patch.

assistant: CWE-269
user: SQLite JDBC is a library for accessing and creating SQLite database files in Java. Sqlite-jdbc addresses a remote code execution vulnerability via JDBC URL. This issue impacting versions 3.6.14.1 through 3.41.2.1 and has been fixed in version 3.41.2.2.

assistant: CWE-94
user: nFPM is an alternative to fpm. The file permissions on the checked-in files were not maintained. Hence, when nfpm packaged 
the files (without extra config for enforcing it’s own permissions) files could go out with bad permissions (chmod 666 or 777). Anyone using nfpm for creating packages without checking/setting file permissions before packaging could result in bad permissions for files/folders.

assistant: CWE-276
user: The zabbix/src/libs/zbxjson module is vulnerable to a buffer overflow when parsing JSON files via zbx_json_open.

assistant: CWE-120
user: Request to LDAP is sent before user permissions are checked.

assistant: CWE-732
user: Memory pointer is in a property of the Ducktape object. This leads to multiple vulnerabilities related to direct memory access and manipulation.

assistant: CWE-732
user: The vulnerability is caused by improper check for check if RDLENGTH does not overflow the buffer in response from DNS server.

assistant: CWE-754
user: A vulnerability has been identified in SIMATIC STEP 7 Safety V18 (All versions < V18 Update 2). Affected applications do not properly restrict the .NET BinaryFormatter when deserializing user-controllable input. This could allow an attacker to cause a type confusion and execute arbitrary code within the affected application.

This is the same issue that exists for .NET BinaryFormatter https://docs.microsoft.com/en-us/visualstudio/code-quality/ca2300.

assistant: CWE-502
user: Cross-Site Request Forgery (CSRF) vulnerability in Web_Trendy WP Custom Cursors | WordPress Cursor Plugin plugin < 3.2 versions.

assistant: CWE-352
user: Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce Product Recommendations plugin <= 2.3.0 versions.

assistant: CWE-352
user: Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce WooCommerce Bookings.This issue affects WooCommerce Bookings: from n/a through 1.15.78.

assistant: CWE-639
user: Thinking Software Efence login function has insufficient validation for user input. An unauthenticated remote attacker can exploit this vulnerability to inject arbitrary SQL commands to access, modify or delete database.

assistant: CWE-89
user: e-Excellence U-Office Force generates an error message in webiste service. An unauthenticated remote attacker can obtain partial sensitive system information from error message by sending a crafted command.

assistant: CWE-209
user: Cross-Site Request Forgery (CSRF) vulnerability in NXLog Manager 5.6.5633 version. This vulnerability allows an attacker to eliminate roles within the platform by sending a specifically crafted query to the server. The vulnerability is based on the absence of proper validation of the origin of incoming requests.

assistant: CWE-352
user: Deserialization of Untrusted Data vulnerability in WooCommerce Product Add-Ons.This issue affects Product Add-Ons: from n/a through 6.1.3.

assistant: CWE-502
user: Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce Shipping Multiple Addresses.This issue affects Shipping Multiple Addresses: from n/a through 3.8.3.

assistant: CWE-639
user: In DA, there is a possible permission bypass due to an incorrect status check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08355514; Issue ID: ALPS08355514.

assistant: CWE-754
user: In keyInstall, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08583919; Issue ID: ALPS08304227.

assistant: CWE-787
user: Cross-Site Request Forgery (CSRF) vulnerability in Made with Fuel Better Notifications for WP plugin <= 1.9.2 versions.

assistant: CWE-352
user: An incorrect authorization vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users to bypass intended access restrictions via a network.
QTS 5.x, QuTS hero are not affected.

We have already fixed the vulnerability in the following versions:
QuTScloud c5.1.5.2651 and later
QTS 4.5.4.2627 build 20231225 and later

assistant: CWE-863
user: A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to launch a denial-of-service (DoS) attack via a network.
QES is not affected.

We have already fixed the vulnerability in the following versions:
QuTS hero h5.0.1.2515 build 20230907 and later
QuTS hero h5.1.0.2453 build 20230708 and later
QuTS hero h4.5.4.2476 build 20230728 and later
QuTScloud c5.1.0.2498 and later
QTS 5.1.0.2444 build 20230629 and later
QTS 4.5.4.2467 build 20230718 and later

assistant: CWE-476
user: A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network.

We have already fixed the vulnerability in the following versions:
QTS 5.0.1.2425 build 20230609 and later
QTS 5.1.0.2444 build 20230629 and later
QTS 4.5.4.2467 build 20230718 and later
QuTS hero h5.0.1.2515 build 20230907 and later
QuTS hero h5.1.0.2424 build 20230609 and later
QuTS hero h4.5.4.2476 build 20230728 and later
QuTScloud c5.1.0.2498 and later

assistant: CWE-119, CWE-120, CWE-787
user: An OS command injection vulnerability has been reported to affect Container Station. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network.

We have already fixed the vulnerability in the following version:
Container Station 2.6.7.44 and later

assistant: CWE-78
user: Deserialization of Untrusted Data vulnerability in Apache Software Foundation Apache Johnzon.


A malicious attacker can craft up some JSON input that uses large numbers (numbers such as 1e20000000) that Apache Johnzon will deserialize into BigDecimal and maybe use numbers too large which may result in a slow conversion (Denial of service risk). Apache Johnzon 1.2.21 mitigates this by setting a scale limit of 1000 (by default) to the BigDecimal. 


This issue affects Apache Johnzon: through 1.2.20.

assistant: CWE-502
user: A buffer overflow vulnerability in the notification function in Zyxel ATP series firmware versions 4.60 through 5.36 Patch 1, USG FLEX series firmware versions 4.60 through 5.36 Patch 1, USG FLEX 50(W) firmware versions 4.60 through 5.36 Patch 1, USG20(W)-VPN firmware versions 4.60 through 5.36 Patch 1, VPN series firmware versions 4.60 through 5.36 Patch 1, ZyWALL/USG series firmware versions 4.60 through 4.73 Patch 1, could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions and even a remote code execution on an affected device.

assistant: CWE-120
user: A buffer overflow vulnerability in the ID processing function in Zyxel ATP series firmware versions 4.32 through 5.36 Patch 1, USG FLEX series firmware versions 4.50 through 5.36 Patch 1, USG FLEX 50(W) firmware versions 4.25 through 5.36 Patch 1, USG20(W)-VPN firmware versions 4.25 through 5.36 Patch 1, VPN series firmware versions 4.30 through 5.36 Patch 1, ZyWALL/USG series firmware versions 4.25 through 4.73 Patch 1, could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions and even a remote code execution on an affected device.

assistant: CWE-120
user: A format string vulnerability in the Zyxel ATP series firmware versions 5.10 through 5.36 Patch 2, USG FLEX series firmware versions 5.00 through 5.36 Patch 2,  USG FLEX 50(W) series firmware versions 5.10 through 5.36 Patch 2, USG20(W)-VPN series firmware versions 5.10 through 5.36 Patch 2, and VPN series firmware versions 5.00 through 5.36 Patch 2, could allow an unauthenticated, LAN-based attacker to execute some OS commands by using a crafted PPPoE configuration on an affected device when the cloud management mode is enabled.

assistant: CWE-134
user: A command injection vulnerability in the configuration parser of the Zyxel ATP series firmware versions 5.10 through 5.36 Patch 2, USG FLEX series firmware versions 5.00 through 5.36 Patch 2,  USG FLEX 50(W) series firmware versions 5.10 through 5.36 Patch 2, USG20(W)-VPN series firmware versions 5.10 through 5.36 Patch 2, and VPN series firmware versions 5.00 through 5.36 Patch 2, could allow an unauthenticated, LAN-based attacker to execute some OS commands by using a crafted GRE configuration when the cloud management mode is enabled.

assistant: CWE-78
user: Transient DOS in WLAN Firmware while interpreting MBSSID IE of a received beacon frame.

assistant: CWE-119, CWE-125
user: Transient DOS in WLAN firmware while parsing MLO (multi-link operation).

assistant: CWE-119, CWE-125
user: Memory corruption in Boot while running a ListVars test in UEFI Menu during boot.

assistant: CWE-120
user: Memory corruption while using the UIM diag command to get the operators name.

assistant: CWE-190
user: Memory corruption in Graphics while processing user packets for command submission.

assistant: CWE-416
user: Memory corruption in HLOS while invoking IOCTL calls from user-space.

assistant: CWE-190
user: Memory corruption while processing finish_sign command to pass a rsp buffer.

assistant: CWE-120
user: Memory corruption while sending SMS from AP firmware.

assistant: CWE-120
user: Transient DOS in WLAN Firmware while parsing a NAN management frame.

assistant: CWE-119, CWE-125
user: Memory corruption in WLAN Firmware while doing a memory copy of pmk cache.

assistant: CWE-119, CWE-787
user: Memory corruption in DSP Service during a remote call from HLOS to DSP.

assistant: CWE-416
user: Memory corruption in HLOS while running playready use-case.

assistant: CWE-120
user: Memory corruption in Automotive Audio while copying data from ADSP shared buffer to the VOC packet data buffer.

assistant: CWE-120
user: Memory corruption in TZ Secure OS while requesting a memory allocation from TA region.

assistant: CWE-190
user: Memory corruption while parsing the ADSP response command.

assistant: CWE-681
user: Memory corruption while invoking callback function of AFE from ADSP.

assistant: CWE-120
user: Permanent DOS in Hypervisor while untrusted VM without PSCI support makes a PSCI call.

assistant: CWE-476
user: Memory corruption while receiving a message in Bus Socket Transport Server.

assistant: CWE-190
user: Memory corruption in Automotive Display while destroying the image handle created using connected display driver.

assistant: CWE-416
user: Under certain scenarios the WLAN Firmware will reach an assertion due to state confusion while looking up peer ids.

assistant: CWE-617
user: Memory corruption in WLAN Firmware while parsing a NAN management frame carrying a S3 attribute.

assistant: CWE-120
user: Transient DOS in WLAN Firmware while parsing no-inherit IES.

assistant: CWE-119, CWE-125
user: Transient DOS in WLAN Firmware while parsing t2lm buffers.

assistant: CWE-119, CWE-125
user: Transient DOS in Multi-Mode Call Processor due to UE failure because of heap leakage.

assistant: CWE-401
user: Memory corruption in Kernel while parsing metadata.

assistant: CWE-129
user: Cryptographic issue in GPS HLOS Driver while downloading Qualcomm GNSS assistance data.

assistant: CWE-287
user: Memory Corruption in Audio while invoking callback function in driver from ADSP.

assistant: CWE-120
user: Memory corruption in Audio while processing the VOC packet data from ADSP.

assistant: CWE-191
user: Transient DOS in Core when DDR memory check is called while DDR is not initialized.

assistant: CWE-119, CWE-125
user: Transient DOS in WLAN Firmware while parsing a BTM request.

assistant: CWE-119, CWE-125
user: Memory corruption in DSP Services during a remote call from HLOS to DSP.

assistant: CWE-416
user: Transient DOS in Audio when invoking callback function of ASM driver.

assistant: CWE-119, CWE-125
user: Memory corruption in Audio while processing RT proxy port register driver.

assistant: CWE-119
user: Memory corruption in Audio while calling START command on host voice PCM multiple times for the same RX or TX tap points.

assistant: CWE-119
user: Memory corruption in Audio while processing IIR config data from AFE calibration block.

assistant: CWE-120
user: Memory corruption in Audio while processing the calibration data returned from ACDB loader.

assistant: CWE-120
user: Transient DOS in Automotive OS due to improper authentication to the secure IO calls.

assistant: CWE-287
user: Memory corruption in Core while processing control functions.

assistant: CWE-120
user: Memory corruption in Audio when SSR event is triggered after music playback is stopped.

assistant: CWE-416
user: Memory corruption in HLOS while converting from authorization token to HIDL vector.

assistant: CWE-120
user: Memory corruption in Audio while running invalid audio recording from ADSP.

assistant: CWE-119
user: Transient DOS while parsing a vender specific IE (Information Element) of reassociation response management frame.

assistant: CWE-119, CWE-125
user: Memory corruption in WLAN Host while processing RRM beacon on the AP.

assistant: CWE-120
user: Transient DOS while processing IE fragments from server during DTLS handshake.

assistant: CWE-401
user: Memory corruption in wearables while processing data from AON.

assistant: CWE-120
user: Transient DOS while processing multiple IKEV2 Informational Request to device from IPSEC server with different identifiers.

assistant: CWE-401
user: Memory corruption in Core while processing RX intent request.

assistant: CWE-120
user: Memory corruption when processing cmd parameters while parsing vdev.

assistant: CWE-476
user: Transient DOS while processing channel information for speaker protection v2 module in ADSP.

assistant: CWE-119, CWE-125
user: Memory corruption while processing pin reply in Bluetooth, when pin code received from APP layer is greater than expected size.

assistant: CWE-120
user: Transient DOS while processing DL NAS Transport message, as specified in 3GPP 24.501 v16.

assistant: CWE-617
user: Transient DOS in WLAN Firmware while processing a FTMR frame.

assistant: CWE-119, CWE-125
user: Transient DOS while processing SMS container of non-standard size received in DL NAS transport in NR.

assistant: CWE-20
user: Transient DOS while processing DL NAS TRANSPORT message with payload length 0.

assistant: CWE-704
user: Memory corruption while submitting a large list of sync points in an AUX command to the IOCTL_KGSL_GPU_AUX_COMMAND.

assistant: CWE-119
user: Memory corruption in Graphics Linux while assigning shared virtual memory region during IOCTL call.

assistant: CWE-190
user: Memory corruption in Graphics Driver when destroying a context with KGSL_GPU_AUX_COMMAND_TIMELINE objects queued.

assistant: CWE-416
user: Transient DOS while processing a WMI P2P listen start command (0xD00A) sent from host.

assistant: CWE-476
user: Information disclosure when VI calibration state set by ADSP is greater than MAX_FBSP_STATE in the response payload to AFE calibration command.

assistant: CWE-129
user: Transient DOS when WLAN firmware receives "reassoc response" frame including RIC_DATA element.

assistant: CWE-119, CWE-125
user: Memory corruption while running NPU, when NETWORK_UNLOAD and (NETWORK_UNLOAD or NETWORK_EXECUTE_V2) commands are submitted at the same time.

assistant: CWE-416
user: Memory corruption while processing buffer initialization, when trusted report for certain report types are generated.

assistant: CWE-119, CWE-125
user: Memory corruption while processing Listen Sound Model client payload buffer when there is a request for Listen Sound session get parameter from ST HAL.

assistant: CWE-416
user: Memory corruption while loading a VM from a signed VM image that is not coherent in the processor cache.

assistant: CWE-367
user: Memory corruption in Audio when memory map command is executed consecutively in ADSP.

assistant: CWE-416
user: A vulnerability has been identified in JT2Go (All versions < V14.2.0.3), Teamcenter Visualization V13.2 (All versions < V13.2.0.13), Teamcenter Visualization V13.3 (All versions < V13.3.0.10), Teamcenter Visualization V14.0 (All versions < V14.0.0.6), Teamcenter Visualization V14.1 (All versions < V14.1.0.8), Teamcenter Visualization V14.2 (All versions < V14.2.0.3). The affected applications contain a null pointer dereference vulnerability while parsing specially crafted CGM files. An attacker could leverage this vulnerability to crash the application causing denial of service condition.

assistant: CWE-476
user: A vulnerability has been identified in JT2Go (All versions < V14.2.0.3), Teamcenter Visualization V13.2 (All versions < V13.2.0.13), Teamcenter Visualization V13.3 (All versions < V13.3.0.10), Teamcenter Visualization V14.0 (All versions < V14.0.0.6), Teamcenter Visualization V14.1 (All versions < V14.1.0.8), Teamcenter Visualization V14.2 (All versions < V14.2.0.3). The affected applications contain a memory corruption vulnerability while parsing specially crafted CGM files. This could allow an attacker to execute code in the context of the current process.

assistant: CWE-119
user: Windows Partition Management Driver Elevation of Privilege Vulnerability

assistant: CWE-367
user: BigBlueButton is an open source virtual classroom designed to help teachers teach and learners learn. In affected versions are affected by a Server-Side Request Forgery (SSRF) vulnerability. In an `insertDocument` API request the user is able to supply a URL from which the presentation should be downloaded. This URL was being used without having been successfully validated first. An update to the `followRedirect` method in the `PresentationUrlDownloadService` has been made to validate all URLs to be used for presentation download. Two new properties `presentationDownloadSupportedProtocols` and `presentationDownloadBlockedHosts` have also been added to `bigbluebutton.properties` to allow administrators to define what protocols a URL must use and to explicitly define hosts that a presentation cannot be downloaded from. All URLs passed to `insertDocument` must conform to the requirements of the two previously mentioned properties. Additionally, these URLs must resolve to valid addresses, and these addresses must not be local or loopback addresses. There are no workarounds. Users are advised to upgrade to a patched version of BigBlueButton.

assistant: CWE-918