rainbutterfly/cve_corpus huggingface dataset:
CVE-2023-29528 Cross-site Scripting in org.xwiki.commons:xwiki-commons-xml
XWiki Commons are technical libraries common to several other top level XWiki projects. The "restricted" mode of the HTML cleaner in XWiki, introduced in version 4.2-milestone-1 and massively improved in version 14.6-rc-1, allowed the injection of arbitrary HTML code and thus cross-site scripting via invalid HTML comments. As a consequence, any code relying on this "restricted" mode for security is vulnerable to JavaScript injection ("cross-site scripting"/XSS). When a privileged user with programming rights visits such a comment in XWiki, the malicious JavaScript code is executed in the context of the user session. This allows server-side code execution with programming rights, impacting the confidentiality, integrity and availability of the XWiki instance. This problem has been patched in XWiki 14.10, HTML comments are now removed in restricted mode and a check has been introduced that ensures that comments don't start with `>`. There are no known workarounds apart from upgrading to a version including the fix.

Problem types: cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: xwiki
product: xwiki-commons
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.1
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
version: 3.1
Published: 2023-04-20T17:08:50.083Z
CVE-2023-29529 matrix-js-sdk vulnerable to invisible eavesdropping in group calls
matrix-js-sdk is the Matrix Client-Server SDK for JavaScript and TypeScript. An attacker present in a room where an MSC3401 group call is taking place can eavesdrop on the video and audio of participants using matrix-js-sdk, without their knowledge. To affected matrix-js-sdk users, the attacker will not appear to be participating in the call. This attack is possible because matrix-js-sdk's group call implementation accepts incoming direct calls from other users, even if they have not yet declared intent to participate in the group call, as a means of resolving a race condition in call setup. Affected versions do not restrict access to the user's outbound media in this case. Legacy 1:1 calls are unaffected. This is fixed in matrix-js-sdk 24.1.0. As a workaround, users may hold group calls in private rooms where only the exact users who are expected to participate in the call are present.
Problem types: cwe_id: CWE-862
description: CWE-862: Missing Authorization
Affected products: vendor: matrix-org
product: matrix-js-sdk
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
version: 3.1
Published: 2023-04-14T18:21:17.050Z
CVE-2023-29530 Laminas Diactoros vulnerable to HTTP Multiline Header Termination
Laminas Diactoros provides PSR HTTP Message implementations. In versions 2.18.0 and prior, 2.19.0, 2.20.0, 2.21.0, 2.22.0, 2.23.0, 2.24.0, and 2.25.0, users who create HTTP requests or responses using laminas/laminas-diactoros, when providing a newline at the start or end of a header key or value, can cause an invalid message. This can lead to denial of service vectors or application errors. The problem has been patched in following versions 2.18.1, 2.19.1, 2.20.1, 2.21.1, 2.22.1, 2.23.1, 2.24.1, and 2.25.1. As a workaround, validate HTTP header keys and/or values, and if using user-supplied values, filter them to strip off leading or trailing newline characters before calling `withHeader()`.
Problem types: cwe_id: CWE-20
description: CWE-20: Improper Input Validation
Affected products: vendor: laminas
product: laminas-diactoros
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2023-04-24T19:34:40.294Z
CVE-2023-29531 
An attacker could have caused an out of bounds memory access using WebGL APIs, leading to memory corruption and a potentially exploitable crash.

*This bug only affects Firefox and Thunderbird for macOS. Other operating systems are unaffected.* This vulnerability affects Firefox < 112, Firefox ESR < 102.10, and Thunderbird < 102.10.


Problem types: description: Out-of-bound memory access in WebGL on macOS
Affected products: vendor: Mozilla
product: Firefox
default_status: unaffected
vendor: Mozilla
product: Firefox ESR
default_status: unaffected
vendor: Mozilla
product: Thunderbird
default_status: unaffected
Credits: lang: en
value: DoHyun Lee
Published: 2023-06-19T09:48:59.394Z
CVE-2023-29532 
A local attacker can trick the Mozilla Maintenance Service into applying an unsigned update file by pointing the service at an update file on a malicious SMB server. The update file can be replaced after the signature check, before the use, because the write-lock requested by the service does not work on a SMB server.

*Note: This attack requires local system access and only affects Windows. Other operating systems are not affected.* This vulnerability affects Firefox < 112, Firefox ESR < 102.10, and Thunderbird < 102.10.


Problem types: description: Mozilla Maintenance Service Write-lock bypass
Affected products: vendor: Mozilla
product: Firefox
default_status: unaffected
vendor: Mozilla
product: Firefox ESR
default_status: unaffected
vendor: Mozilla
product: Thunderbird
default_status: unaffected
Credits: lang: en
value: Holger Fuhrmannek
Published: 2023-06-19T09:58:03.748Z
CVE-2023-29533 
A website could have obscured the fullscreen notification by using a combination of <code>window.open</code>, fullscreen requests, <code>window.name</code> assignments, and <code>setInterval</code> calls. This could have led to user confusion and possible spoofing attacks. This vulnerability affects Firefox < 112, Focus for Android < 112, Firefox ESR < 102.10, Firefox for Android < 112, and Thunderbird < 102.10.
Problem types: description: Fullscreen notification obscured
Affected products: vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Focus for Android
vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Firefox for Android
vendor: Mozilla
product: Thunderbird
Published: 2023-06-02T00:00:00.000Z
CVE-2023-29534 
Different techniques existed to obscure the fullscreen notification in Firefox and Focus for Android.  These could have led to potential user confusion and spoofing attacks.

*This bug only affects Firefox and Focus for Android. Other versions of Firefox are unaffected.* This vulnerability affects Firefox for Android < 112 and Focus for Android < 112.


Problem types: description: Fullscreen notification could have been obscured on Firefox for Android
Affected products: vendor: Mozilla
product: Firefox for Android
default_status: unaffected
vendor: Mozilla
product: Focus for Android
default_status: unaffected
Credits: lang: en
value: Shaheen Fazim and Hafiizh
Published: 2023-06-19T10:11:00.470Z
CVE-2023-29535 
Following a Garbage Collector compaction, weak maps may have been accessed before they were correctly traced. This resulted in memory corruption and a potentially exploitable crash. This vulnerability affects Firefox < 112, Focus for Android < 112, Firefox ESR < 102.10, Firefox for Android < 112, and Thunderbird < 102.10.
Problem types: description: Potential Memory Corruption following Garbage Collector compaction
Affected products: vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Focus for Android
vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Firefox for Android
vendor: Mozilla
product: Thunderbird
Published: 2023-06-02T00:00:00.000Z
CVE-2023-29536 
An attacker could cause the memory manager to incorrectly free a pointer that addresses attacker-controlled memory, resulting in an assertion, memory corruption, or a potentially exploitable crash. This vulnerability affects Firefox < 112, Focus for Android < 112, Firefox ESR < 102.10, Firefox for Android < 112, and Thunderbird < 102.10.
Problem types: description: Invalid free from JavaScript code
Affected products: vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Focus for Android
vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Firefox for Android
vendor: Mozilla
product: Thunderbird
Published: 2023-06-02T00:00:00.000Z
CVE-2023-29537 
Multiple race conditions in the font initialization could have led to memory corruption and execution of attacker-controlled code. This vulnerability affects Firefox for Android < 112, Firefox < 112, and Focus for Android < 112.
Problem types: description: Data Races in font initialization code
Affected products: vendor: Mozilla
product: Firefox for Android
vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Focus for Android
Published: 2023-06-02T00:00:00.000Z
CVE-2023-29538 
Under specific circumstances a WebExtension may have received a <code>jar:file:///</code> URI instead of a <code>moz-extension:///</code> URI during a load request. This leaked directory paths on the user's machine. This vulnerability affects Firefox for Android < 112, Firefox < 112, and Focus for Android < 112.
Problem types: description: Directory information could have been leaked to WebExtensions
Affected products: vendor: Mozilla
product: Firefox for Android
vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Focus for Android
Published: 2023-06-02T00:00:00.000Z
CVE-2023-29539 
When handling the filename directive in the Content-Disposition header, the filename would be truncated if the filename contained a NULL character. This could have led to reflected file download attacks potentially tricking users to install malware. This vulnerability affects Firefox < 112, Focus for Android < 112, Firefox ESR < 102.10, Firefox for Android < 112, and Thunderbird < 102.10.
Problem types: description: Content-Disposition filename truncation leads to Reflected File Download
Affected products: vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Focus for Android
vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Firefox for Android
vendor: Mozilla
product: Thunderbird
Published: 2023-06-02T00:00:00.000Z
CVE-2023-29540 
Using a redirect embedded into <code>sourceMappingUrls</code> could allow for navigation to external protocol links in sandboxed iframes without <code>allow-top-navigation-to-custom-protocols</code>. This vulnerability affects Firefox for Android < 112, Firefox < 112, and Focus for Android < 112.
Problem types: description: Iframe sandbox bypass using redirects and sourceMappingUrls
Affected products: vendor: Mozilla
product: Firefox for Android
vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Focus for Android
Published: 2023-06-02T00:00:00.000Z
CVE-2023-29541 
Firefox did not properly handle downloads of files ending in <code>.desktop</code>, which can be interpreted to run attacker-controlled commands. <br>*This bug only affects Firefox for Linux on certain Distributions. Other operating systems are unaffected, and Mozilla is unable to enumerate all affected Linux Distributions.*. This vulnerability affects Firefox < 112, Focus for Android < 112, Firefox ESR < 102.10, Firefox for Android < 112, and Thunderbird < 102.10.
Problem types: description: Files with malicious extensions could have been downloaded unsafely on Linux
Affected products: vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Focus for Android
vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Firefox for Android
vendor: Mozilla
product: Thunderbird
Published: 2023-06-02T00:00:00.000Z
CVE-2023-29542 
A newline in a filename could have been used to bypass the file extension security mechanisms that replace malicious file extensions such as .lnk  with .download. This could have led to accidental execution of malicious code.

*This bug only affects Firefox and Thunderbird on Windows. Other versions of Firefox and Thunderbird are unaffected.* This vulnerability affects Firefox < 112, Firefox ESR < 102.10, and Thunderbird < 102.10.


Problem types: description: Bypass of file download extension restrictions
Affected products: vendor: Mozilla
product: Firefox
default_status: unaffected
vendor: Mozilla
product: Firefox ESR
default_status: unaffected
vendor: Mozilla
product: Thunderbird
default_status: unaffected
Credits: lang: en
value: Shaheen Fazim and Ameen Basha M K
Published: 2023-06-19T10:03:32.039Z
CVE-2023-29543 
An attacker could have caused memory corruption and a potentially exploitable use-after-free of a pointer in a global object's debugger vector. This vulnerability affects Firefox for Android < 112, Firefox < 112, and Focus for Android < 112.
Problem types: description: Use-after-free in debugging APIs
Affected products: vendor: Mozilla
product: Firefox for Android
vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Focus for Android
Published: 2023-06-02T00:00:00.000Z
CVE-2023-29544 
If multiple instances of resource exhaustion occurred at the incorrect time, the garbage collector could have caused memory corruption and a potentially exploitable crash. This vulnerability affects Firefox for Android < 112, Firefox < 112, and Focus for Android < 112.
Problem types: description: Memory Corruption in garbage collector
Affected products: vendor: Mozilla
product: Firefox for Android
vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Focus for Android
Published: 2023-06-02T00:00:00.000Z
CVE-2023-29545 
Similar to CVE-2023-28163, this time when choosing 'Save Link As', suggested filenames containing environment variable names would have resolved those in the context of the current user. 

*This bug only affects Firefox and Thunderbird on Windows. Other versions of Firefox and Thunderbird are unaffected.* This vulnerability affects Firefox < 112, Firefox ESR < 102.10, and Thunderbird < 102.10.


Problem types: description: Windows Save As dialog resolved environment variables
Affected products: vendor: Mozilla
product: Firefox
default_status: unaffected
vendor: Mozilla
product: Firefox ESR
default_status: unaffected
vendor: Mozilla
product: Thunderbird
default_status: unaffected
Credits: lang: en
value: Axel Chong (@Haxatron)
Published: 2023-06-19T10:07:39.855Z
CVE-2023-29546 
When recording the screen while in Private Browsing on Firefox for Android the address bar and keyboard were not hidden, potentially leaking sensitive information. 

*This bug only affects Firefox for Android. Other operating systems are unaffected.* This vulnerability affects Firefox for Android < 112 and Focus for Android < 112.


Problem types: description: Screen recording in Private Browsing included address bar on Android
Affected products: vendor: Mozilla
product: Firefox for Android
default_status: unaffected
vendor: Mozilla
product: Focus for Android
default_status: unaffected
Credits: lang: en
value: Irwan
Published: 2023-06-19T10:13:23.600Z
CVE-2023-29547 
When a secure cookie existed in the Firefox cookie jar an insecure cookie for the same domain could have been created, when it should have silently failed. This could have led to a desynchronization in expected results when reading from the secure cookie. This vulnerability affects Firefox for Android < 112, Firefox < 112, and Focus for Android < 112.
Problem types: description: Secure document cookie could be spoofed with insecure cookie
Affected products: vendor: Mozilla
product: Firefox for Android
vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Focus for Android
Published: 2023-06-02T00:00:00.000Z
CVE-2023-29548 
A wrong lowering instruction in the ARM64 Ion compiler resulted in a wrong optimization result. This vulnerability affects Firefox < 112, Focus for Android < 112, Firefox ESR < 102.10, Firefox for Android < 112, and Thunderbird < 102.10.
Problem types: description: Incorrect optimization result on ARM64
Affected products: vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Focus for Android
vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Firefox for Android
vendor: Mozilla
product: Thunderbird
Published: 2023-06-02T00:00:00.000Z
CVE-2023-29549 
Under certain circumstances, a call to the <code>bind</code> function may have resulted in the incorrect realm. This may have created a vulnerability relating to JavaScript-implemented sandboxes such as SES. This vulnerability affects Firefox for Android < 112, Firefox < 112, and Focus for Android < 112.
Problem types: description: Javascript's bind function may have failed
Affected products: vendor: Mozilla
product: Firefox for Android
vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Focus for Android
Published: 2023-06-02T00:00:00.000Z
CVE-2023-29550 
Memory safety bugs present in Firefox 111 and Firefox ESR 102.9. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 112, Focus for Android < 112, Firefox ESR < 102.10, Firefox for Android < 112, and Thunderbird < 102.10.
Problem types: description: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10
Affected products: vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Focus for Android
vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Firefox for Android
vendor: Mozilla
product: Thunderbird
Published: 2023-06-02T00:00:00.000Z
CVE-2023-29551 
Memory safety bugs present in Firefox 111. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox for Android < 112, Firefox < 112, and Focus for Android < 112.
Problem types: description: Memory safety bugs fixed in Firefox 112
Affected products: vendor: Mozilla
product: Firefox for Android
vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Focus for Android
Published: 2023-06-02T00:00:00.000Z
CVE-2023-29552 
The Service Location Protocol (SLP, RFC 2608) allows an unauthenticated, remote attacker to register arbitrary services. This could allow the attacker to use spoofed UDP traffic to conduct a denial-of-service attack with a significant amplification factor.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-25T00:00:00.000Z
CVE-2023-29562 
TP-Link TL-WPA7510 (EU)_V2_190125 was discovered to contain a stack overflow via the operation parameter at /admin/locale.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-06-13T00:00:00.000Z
CVE-2023-29566 
huedawn-tesseract 0.3.3 and dawnsparks-node-tesseract 0.4.0 to 0.4.1 was discovered to contain a remote code execution (RCE) vulnerability via the child_process function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-24T00:00:00.000Z
CVE-2023-29569 
Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via ffi_cb_impl_wpwwwww at src/mjs_ffi.c. This vulnerability can lead to a Denial of Service (DoS).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-14T00:00:00.000Z
CVE-2023-29570 
Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via mjs_ffi_cb_free at src/mjs_ffi.c. This vulnerability can lead to a Denial of Service (DoS).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-24T00:00:00.000Z
CVE-2023-29571 
Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via gc_sweep at src/mjs_gc.c. This vulnerability can lead to a Denial of Service (DoS).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-12T00:00:00.000Z
CVE-2023-29573 
Bento4 v1.6.0-639 was discovered to contain an out-of-memory bug in the mp4info component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-13T00:00:00.000Z
CVE-2023-29574 
Bento4 v1.6.0-639 was discovered to contain an out-of-memory bug in the mp42avc component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-12T00:00:00.000Z
CVE-2023-29575 
Bento4 v1.6.0-639 was discovered to contain an out-of-memory bug in the mp42aac component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-21T00:00:00.000Z
CVE-2023-29576 
Bento4 v1.6.0-639 was discovered to contain a segmentation violation via the AP4_TrunAtom::SetDataOffset(int) function in Ap4TrunAtom.h.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-11T00:00:00.000Z
CVE-2023-29578 
mp4v2 v2.0.0 was discovered to contain a heap buffer overflow via the mp4v2::impl::MP4StringProperty::~MP4StringProperty() function at src/mp4property.cpp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-24T00:00:00.000Z
CVE-2023-29579 
yasm 1.3.0.55.g101bc was discovered to contain a stack overflow via the component yasm/yasm+0x43b466 in vsprintf. Note: This has been disputed by third parties who argue this is a bug and not a security issue because yasm is a standalone program not designed to run untrusted code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-24T00:00:00.000Z
CVE-2023-29580 
yasm 1.3.0.55.g101bc was discovered to contain a segmentation violation via the component yasm_expr_create at /libyasm/expr.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-12T00:00:00.000Z
CVE-2023-29581 
yasm 1.3.0.55.g101bc has a segmentation violation in the function delete_Token at modules/preprocs/nasm/nasm-pp.c. NOTE: although a libyasm application could become unavailable if this were exploited, the vendor's position is that there is no security relevance because there is either supposed to be input validation before data reaches libyasm, or a sandbox in which the application runs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-12T00:00:00.000Z
CVE-2023-29582 
yasm 1.3.0.55.g101bc was discovered to contain a stack overflow via the function parse_expr1 at /nasm/nasm-parse.c. Note: This has been disputed by third parties who argue this is a bug and not a security issue because yasm is a standalone program not designed to run untrusted code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-24T00:00:00.000Z
CVE-2023-29583 
yasm 1.3.0.55.g101bc was discovered to contain a stack overflow via the function parse_expr5 at /nasm/nasm-parse.c. Note: This has been disputed by third parties who argue this is a bug and not a security issue because yasm is a standalone program not designed to run untrusted code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-24T00:00:00.000Z
CVE-2023-29584 
mp4v2 v2.0.0 was discovered to contain a heap buffer overflow via the MP4GetVideoProfileLevel function at /src/mp4.cpp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-14T00:00:00.000Z
CVE-2023-29586 
Code Sector TeraCopy 3.9.7 does not perform proper access validation on the source folder during a copy operation. This leads to Arbitrary File Read by allowing any user to copy any directory in the system to a directory they control. NOTE: the Supplier disputes this because only admin users can copy arbitrary folders, and because the 143984 reference is about a different concern (unrelated to directory copying) that was fixed in 3.5b.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-19T00:00:00.000Z