rainbutterfly/cve_corpus huggingface dataset:
CVE-2023-27902 
Jenkins 2.393 and earlier, LTS 2.375.3 and earlier shows temporary directories related to job workspaces, which allows attackers with Item/Workspace permission to access their contents.
Affected products: vendor: Jenkins Project
product: Jenkins
default_status: affected
Published: 2023-03-08T17:14:51.451Z
CVE-2023-27903 
Jenkins 2.393 and earlier, LTS 2.375.3 and earlier creates a temporary file in the default temporary directory with the default permissions for newly created files when uploading a file parameter through the CLI, potentially allowing attackers with access to the Jenkins controller file system to read and write the file before it is used.
Affected products: vendor: Jenkins Project
product: Jenkins
default_status: affected
Published: 2023-03-08T17:14:52.143Z
CVE-2023-27904 
Jenkins 2.393 and earlier, LTS 2.375.3 and earlier prints an error stack trace on agent-related pages when agent connections are broken, potentially revealing information about Jenkins configuration that is otherwise inaccessible to attackers.
Affected products: vendor: Jenkins Project
product: Jenkins
default_status: affected
Published: 2023-03-08T17:14:52.848Z
CVE-2023-27905 
Jenkins update-center2 3.13 and 3.14 renders the required Jenkins core version on plugin download index pages without sanitization, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to provide a plugin for hosting.
Affected products: vendor: Jenkins Project
product: Jenkins update-center2
default_status: unaffected
Published: 2023-03-08T17:14:53.560Z
CVE-2023-27906 
A malicious actor may convince a victim to open a malicious USD file that may trigger an out-of-bounds read vulnerability which may result in code execution.
Problem types: description: Out-of-bound Read
Affected products: vendor: n/a
product: Autodesk Maya USD Plugin
Published: 2023-04-17T00:00:00.000Z
CVE-2023-27907 
A malicious actor may convince a victim to open a malicious USD file that may trigger an out-of-bounds write vulnerability which may result in code execution.
Problem types: description: Out-of-bound Write
Affected products: vendor: n/a
product: Autodesk Maya USD Plugin
Published: 2023-04-17T00:00:00.000Z
CVE-2023-27908 
A maliciously crafted DLL file can be forced to write beyond allocated boundaries in the Autodesk installer when parsing the DLL files and could lead to a Privilege Escalation vulnerability.
Problem types: description: Privilege Escalation vulnerability.
Affected products: vendor: n/a
product: Autodesk installer
Published: 2023-06-23T00:00:00.000Z
CVE-2023-27909 
An Out-Of-Bounds Write Vulnerability in Autodesk® FBX® SDK version 2020 or prior may lead to code execution through maliciously crafted FBX files or information disclosure.
Problem types: description: Out-of-bound Write
Affected products: vendor: n/a
product: Autodesk FBX SDK
Published: 2023-04-17T00:00:00.000Z
CVE-2023-27910 
A user may be tricked into opening a malicious FBX file that may exploit a stack buffer overflow vulnerability in Autodesk® FBX® SDK 2020 or prior which may lead to code execution.
Problem types: description: Stack Buffer Overflow
Affected products: vendor: n/a
product: Autodesk FBX SDK
Published: 2023-04-17T00:00:00.000Z
CVE-2023-27911 
A user may be tricked into opening a malicious FBX file that may exploit a heap buffer overflow vulnerability in Autodesk® FBX® SDK 2020 or prior which may lead to code execution.
Problem types: description: Heap Buffer Overflow
Affected products: vendor: n/a
product: Autodesk FBX SDK
Published: 2023-04-17T00:00:00.000Z
CVE-2023-27912 
A maliciously crafted X_B file when parsed through Autodesk® AutoCAD® 2023 can force an Out-of-Bound Read. A malicious actor can leverage this vulnerability to cause a crash or read sensitive data or execute arbitrary code in the context of the current process.
Problem types: description: Out-of-bound Read
Affected products: vendor: n/a
product: Autodesk AutoCAD
Published: 2023-04-14T00:00:00.000Z
CVE-2023-27913 
A maliciously crafted X_B file when parsed through Autodesk® AutoCAD® 2023 can be used to cause an Integer Overflow. A malicious actor can leverage this vulnerability to cause a crash or read sensitive data, or execute arbitrary code in the context of the current process.
Problem types: description: Integer Overflow
Affected products: vendor: n/a
product: Autodesk AutoCAD
Published: 2023-04-14T00:00:00.000Z
CVE-2023-27914 
A maliciously crafted X_B file when parsed through Autodesk® AutoCAD® 2023 can be used to write beyond the allocated buffer causing a Stack Buffer Overflow. A malicious actor can leverage this vulnerability to cause a crash or read sensitive data or execute arbitrary code in the context of the current process.
Problem types: description: Stack Buffer Overflow
Affected products: vendor: n/a
product: Autodesk AutoCAD
Published: 2023-04-14T00:00:00.000Z
CVE-2023-27915 
A maliciously crafted X_B file when parsed through Autodesk® AutoCAD® 2023 could lead to memory corruption vulnerability by read access violation. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process.
Problem types: description: Memory Corruption Read
Affected products: vendor: n/a
product: Autodesk AutoCAD
Published: 2023-04-14T00:00:00.000Z
CVE-2023-27916 















The affected application lacks proper validation of user-supplied data when parsing font files (e.g., FNT). This could lead to an out-of-bounds read. An attacker could leverage this vulnerability to potentially execute arbitrary code in the context of the current process. 

 

 



 








Problem types: cwe_id: CWE-125
description: CWE-125 Out-of-bounds Read
Affected products: vendor: Horner Automation
product: Cscape
default_status: unaffected
vendor: Horner Automation
product: Cscape EnvisionRV
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Michael Heinzl reported these vulnerabilities to CISA. 
Published: 2023-06-06T16:39:46.317Z
CVE-2023-27917 
OS command injection vulnerability in CONPROSYS IoT Gateway products allows a remote authenticated attacker who can access Network Maintenance page to execute arbitrary OS commands with a root privilege. The affected products and versions are as follows: M2M Gateway with the firmware Ver.3.7.10 and earlier (CPS-MG341-ADSC1-111, CPS-MG341-ADSC1-931, CPS-MG341G-ADSC1-111, CPS-MG341G-ADSC1-930, and CPS-MG341G5-ADSC1-931), M2M Controller Integrated Type with firmware Ver.3.7.6 and earlier versions (CPS-MC341-ADSC1-111, CPS-MC341-ADSC1-931, CPS-MC341-ADSC2-111, CPS-MC341G-ADSC1-110, CPS-MC341Q-ADSC1-111, CPS-MC341-DS1-111, CPS-MC341-DS11-111, CPS-MC341-DS2-911, and CPS-MC341-A1-111), and M2M Controller Configurable Type with firmware Ver.3.8.8 and earlier versions (CPS-MCS341-DS1-111, CPS-MCS341-DS1-131, CPS-MCS341G-DS1-130, CPS-MCS341G5-DS1-130, and CPS-MCS341Q-DS1-131).
Problem types: description: OS Command Injection
Affected products: vendor: Contec CO.,LTD.
product: CONPROSYS IoT Gateway products
Published: 2023-04-11T00:00:00.000Z
CVE-2023-27918 
Cross-site scripting vulnerability in Appointment and Event Booking Calendar for WordPress - Amelia versions prior to 1.0.76 allows a remote unauthenticated attacker to inject an arbitrary script by having a user who is logging in the WordPress where the product is installed visit a malicious URL.
Problem types: description: Cross-site scripting
Affected products: vendor: TMS
product: Appointment and Event Booking Calendar for WordPress - Amelia
Published: 2023-05-10T00:00:00.000Z
CVE-2023-27919 
Authentication bypass vulnerability in NEXT ENGINE Integration Plugin (for EC-CUBE 2.0 series) all versions allows a remote unauthenticated attacker to alter the information stored in the system.
Problem types: description: Improper Authentication
Affected products: vendor: NE Inc.
product: NEXT ENGINE Integration Plugin (for EC-CUBE 2.0 series)
Published: 2023-05-10T00:00:00.000Z
CVE-2023-27920 
Improper access control vulnerability in the system date/time setting page of SolarView Compact SV-CPT-MC310 versions prior to Ver.8.10 and SV-CPT-MC310F versions prior to Ver.8.10 allows a remote authenticated attacker to alter system date/time of the affected product.
Problem types: description: Improper access control
Affected products: vendor: Contec Co., Ltd.
product: SolarView Compact
Published: 2023-05-23T00:00:00.000Z
CVE-2023-27921 
JINS MEME CORE Firmware version 2.2.0 and earlier uses a hard-coded cryptographic key, which may lead to data acquired by a sensor of the affected product being decrypted by a network-adjacent attacker.
Problem types: description: Use of hard-coded cryptographic key
Affected products: vendor: JINS Inc.
product: JINS MEME CORE
Published: 2023-05-23T00:00:00.000Z
CVE-2023-27922 
Cross-site scripting vulnerability in Newsletter versions prior to 7.6.9 allows a remote unauthenticated attacker to inject an arbitrary script.
Problem types: description: Cross-site scripting
Affected products: vendor: Stefano Lissa & The Newsletter Team
product: Newsletter
Published: 2023-05-23T00:00:00.000Z
CVE-2023-27923 
Cross-site scripting vulnerability in Tag edit function of VK Blocks 1.53.0.1 and earlier and VK Blocks Pro 1.53.0.1 and earlier allows a remote authenticated attacker to inject an arbitrary script.
Problem types: description: Cross-site scripting
Affected products: vendor: Vektor,Inc.
product: VK Blocks and VK Blocks Pro
Published: 2023-05-23T00:00:00.000Z
CVE-2023-27925 
Cross-site scripting vulnerability in Post function of VK Blocks 1.53.0.1 and earlier and VK Blocks Pro 1.53.0.1 and earlier allows a remote authenticated attacker to inject an arbitrary script.
Problem types: description: Cross-site scripting
Affected products: vendor: Vektor,Inc.
product: VK Blocks and VK Blocks Pro
Published: 2023-05-23T00:00:00.000Z
CVE-2023-27926 
Cross-site scripting vulnerability in Profile setting function of VK All in One Expansion Unit 9.88.1.0 and earlier allows a remote authenticated attacker to inject an arbitrary script.
Problem types: description: Cross-site scripting
Affected products: vendor: Vektor,Inc.
product: VK All in One Expansion Unit
Published: 2023-05-23T00:00:00.000Z
CVE-2023-27927 CVE-2023-27927
An authenticated malicious user could acquire the simple mail transfer protocol (SMTP) Password in cleartext format, despite it being protected and hidden behind asterisks. The attacker could then perform further attacks using the SMTP credentials.
Problem types: description: CWE-319 Cleartext Transmission of Sensitive Information
Affected products: vendor: SAUTER
product: EY-AS525F001 with moduWeb
Published: 2023-03-27T19:33:49.432Z
CVE-2023-27928 
A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Ventura 13.3, iOS 16.4 and iPadOS 16.4, iOS 15.7.4 and iPadOS 15.7.4, tvOS 16.4, watchOS 9.4, macOS Big Sur 11.7.5. An app may be able to access information about a user’s contacts.
Problem types: description: An app may be able to access information about a user’s contacts
Affected products: vendor: Apple
product: macOS
vendor: Apple
product: iOS and iPadOS
vendor: Apple
product: watchOS
vendor: Apple
product: tvOS
vendor: Apple
product: macOS
vendor: Apple
product: iOS and iPadOS
Published: 2023-05-08T00:00:00.000Z
CVE-2023-27929 
An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Ventura 13.3, tvOS 16.4, iOS 16.4 and iPadOS 16.4, watchOS 9.4. Processing a maliciously crafted image may result in disclosure of process memory.
Problem types: description: Processing a maliciously crafted image may result in disclosure of process memory
Affected products: vendor: Apple
product: macOS
vendor: Apple
product: iOS and iPadOS
vendor: Apple
product: watchOS
vendor: Apple
product: tvOS
Published: 2023-05-08T00:00:00.000Z
CVE-2023-27930 
A type confusion issue was addressed with improved checks. This issue is fixed in iOS 16.5 and iPadOS 16.5, watchOS 9.5, tvOS 16.5, macOS Ventura 13.4. An app may be able to execute arbitrary code with kernel privileges.
Problem types: description: An app may be able to execute arbitrary code with kernel privileges
Affected products: vendor: Apple
product: macOS
vendor: Apple
product: watchOS
vendor: Apple
product: iOS and iPadOS
vendor: Apple
product: tvOS
Published: 2023-06-23T00:00:00.000Z
CVE-2023-27931 
This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Ventura 13.3, macOS Monterey 12.6.3, iOS 16.4 and iPadOS 16.4, macOS Big Sur 11.7.3, tvOS 16.4, watchOS 9.4. An app may be able to access user-sensitive data.
Problem types: description: An app may be able to access user-sensitive data
Affected products: vendor: Apple
product: macOS
vendor: Apple
product: iOS and iPadOS
vendor: Apple
product: watchOS
vendor: Apple
product: macOS
vendor: Apple
product: tvOS
vendor: Apple
product: macOS
Published: 2023-05-08T00:00:00.000Z
CVE-2023-27932 
This issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.3, Safari 16.4, iOS 16.4 and iPadOS 16.4, tvOS 16.4, watchOS 9.4. Processing maliciously crafted web content may bypass Same Origin Policy.
Problem types: description: Processing maliciously crafted web content may bypass Same Origin Policy
Affected products: vendor: Apple
product: macOS
vendor: Apple
product: Safari
vendor: Apple
product: iOS and iPadOS
vendor: Apple
product: watchOS
vendor: Apple
product: tvOS
Published: 2023-05-08T00:00:00.000Z
CVE-2023-27933 
The issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13.3, iOS 16.4 and iPadOS 16.4, macOS Monterey 12.6.4, tvOS 16.4, watchOS 9.4. An app with root privileges may be able to execute arbitrary code with kernel privileges.
Problem types: description: An app with root privileges may be able to execute arbitrary code with kernel privileges
Affected products: vendor: Apple
product: macOS
vendor: Apple
product: iOS and iPadOS
vendor: Apple
product: macOS
vendor: Apple
product: watchOS
vendor: Apple
product: tvOS
Published: 2023-05-08T00:00:00.000Z
CVE-2023-27934 
A memory initialization issue was addressed. This issue is fixed in macOS Ventura 13.3, macOS Monterey 12.6.4. A remote attacker may be able to cause unexpected app termination or arbitrary code execution.
Problem types: description: A remote attacker may be able to cause unexpected app termination or arbitrary code execution
Affected products: vendor: Apple
product: macOS
vendor: Apple
product: macOS
Published: 2023-05-08T00:00:00.000Z
CVE-2023-27935 
The issue was addressed with improved bounds checks. This issue is fixed in macOS Ventura 13.3, macOS Monterey 12.6.4, macOS Big Sur 11.7.5. A remote user may be able to cause unexpected app termination or arbitrary code execution.
Problem types: description: A remote user may be able to cause unexpected app termination or arbitrary code execution
Affected products: vendor: Apple
product: macOS
vendor: Apple
product: macOS
vendor: Apple
product: macOS
Published: 2023-05-08T00:00:00.000Z
CVE-2023-27936 
An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in macOS Ventura 13.3, iOS 15.7.4 and iPadOS 15.7.4, macOS Monterey 12.6.4, macOS Big Sur 11.7.5. An app may be able to cause unexpected system termination or write kernel memory.
Problem types: description: An app may be able to cause unexpected system termination or write kernel memory
Affected products: vendor: Apple
product: macOS
vendor: Apple
product: macOS
vendor: Apple
product: macOS
vendor: Apple
product: iOS and iPadOS
Published: 2023-05-08T00:00:00.000Z
CVE-2023-27937 
An integer overflow was addressed with improved input validation. This issue is fixed in macOS Ventura 13.3, iOS 16.4 and iPadOS 16.4, macOS Big Sur 11.7.5, macOS Monterey 12.6.4, tvOS 16.4, watchOS 9.4. Parsing a maliciously crafted plist may lead to an unexpected app termination or arbitrary code execution.
Problem types: description: Parsing a maliciously crafted plist may lead to an unexpected app termination or arbitrary code execution
Affected products: vendor: Apple
product: macOS
vendor: Apple
product: iOS and iPadOS
vendor: Apple
product: macOS
vendor: Apple
product: watchOS
vendor: Apple
product: tvOS
vendor: Apple
product: macOS
Published: 2023-05-08T00:00:00.000Z
CVE-2023-27938 
An out-of-bounds read issue was addressed with improved input validation. This issue is fixed in GarageBand for macOS 10.4.8. Parsing a maliciously crafted MIDI file may lead to an unexpected application termination or arbitrary code execution.
Problem types: description: Parsing a maliciously crafted MIDI file may lead to an unexpected application termination or arbitrary code execution
Affected products: vendor: Apple
product: macOS
Published: 2023-05-08T00:00:00.000Z
CVE-2023-27939 
An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Ventura 13.3. Processing an image may result in disclosure of process memory.
Problem types: description: Processing an image may result in disclosure of process memory
Affected products: vendor: Apple
product: macOS
Published: 2023-08-14T22:40:40.585Z
CVE-2023-27940 
The issue was addressed with additional permissions checks. This issue is fixed in iOS 15.7.6 and iPadOS 15.7.6, macOS Monterey 12.6.6, macOS Ventura 13.4. A sandboxed app may be able to observe system-wide network connections.
Problem types: description: A sandboxed app may be able to observe system-wide network connections
Affected products: vendor: Apple
product: macOS
vendor: Apple
product: macOS
vendor: Apple
product: iOS and iPadOS
Published: 2023-06-23T00:00:00.000Z
CVE-2023-27941 
A validation issue was addressed with improved input sanitization. This issue is fixed in macOS Ventura 13.3, iOS 15.7.4 and iPadOS 15.7.4, macOS Monterey 12.6.4, macOS Big Sur 11.7.5. An app may be able to disclose kernel memory.
Problem types: description: An app may be able to disclose kernel memory
Affected products: vendor: Apple
product: macOS
vendor: Apple
product: macOS
vendor: Apple
product: macOS
vendor: Apple
product: iOS and iPadOS
Published: 2023-05-08T00:00:00.000Z
CVE-2023-27942 
The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.3, iOS 16.4 and iPadOS 16.4, macOS Big Sur 11.7.5, macOS Monterey 12.6.4, tvOS 16.4, watchOS 9.4. An app may be able to access user-sensitive data.
Problem types: description: An app may be able to access user-sensitive data
Affected products: vendor: Apple
product: macOS
vendor: Apple
product: iOS and iPadOS
vendor: Apple
product: macOS
vendor: Apple
product: watchOS
vendor: Apple
product: tvOS
vendor: Apple
product: macOS
Published: 2023-05-08T00:00:00.000Z
CVE-2023-27943 
This issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.3, iOS 16.4 and iPadOS 16.4. Files downloaded from the internet may not have the quarantine flag applied.
Problem types: description: Files downloaded from the internet may not have the quarantine flag applied
Affected products: vendor: Apple
product: macOS
vendor: Apple
product: iOS and iPadOS
Published: 2023-05-08T00:00:00.000Z
CVE-2023-27944 
This issue was addressed with a new entitlement. This issue is fixed in macOS Ventura 13.3, macOS Monterey 12.6.4, macOS Big Sur 11.7.5. An app may be able to break out of its sandbox.
Problem types: description: An app may be able to break out of its sandbox
Affected products: vendor: Apple
product: macOS
vendor: Apple
product: macOS
vendor: Apple
product: macOS
Published: 2023-05-08T00:00:00.000Z
CVE-2023-27945 
This issue was addressed with improved entitlements. This issue is fixed in Xcode 14.3, macOS Big Sur 11.7.7, macOS Monterey 12.6.6. A sandboxed app may be able to collect system logs.
Problem types: description: A sandboxed app may be able to collect system logs
Affected products: vendor: Apple
product: macOS
vendor: Apple
product: Xcode
vendor: Apple
product: macOS
Published: 2023-05-08T00:00:00.000Z
CVE-2023-27946 
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Ventura 13.3, iOS 15.7.4 and iPadOS 15.7.4, macOS Monterey 12.6.4, macOS Big Sur 11.7.5. Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution.
Problem types: description: Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution
Affected products: vendor: Apple
product: macOS
vendor: Apple
product: macOS
vendor: Apple
product: macOS
vendor: Apple
product: iOS and iPadOS
Published: 2023-05-08T00:00:00.000Z
CVE-2023-27947 
An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Ventura 13.3. Processing an image may result in disclosure of process memory.
Problem types: description: Processing an image may result in disclosure of process memory
Affected products: vendor: Apple
product: macOS
Published: 2023-08-14T22:40:28.046Z
CVE-2023-27948 
An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Ventura 13.3. Processing an image may result in disclosure of process memory.
Problem types: description: Processing an image may result in disclosure of process memory
Affected products: vendor: Apple
product: macOS
Published: 2023-08-14T22:40:50.455Z
CVE-2023-27949 
An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Ventura 13.3, macOS Monterey 12.6.4, iOS 15.7.4 and iPadOS 15.7.4. Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution.
Problem types: description: Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution
Affected products: vendor: Apple
product: macOS
vendor: Apple
product: macOS
vendor: Apple
product: iOS and iPadOS
Published: 2023-05-08T00:00:00.000Z
CVE-2023-27950 
An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Ventura 13.3. Processing an image may result in disclosure of process memory.
Problem types: description: Processing an image may result in disclosure of process memory
Affected products: vendor: Apple
product: macOS
Published: 2023-09-06T01:36:29.244Z
CVE-2023-27951 
The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.3, macOS Monterey 12.6.4, macOS Big Sur 11.7.5. An archive may be able to bypass Gatekeeper.
Problem types: description: An archive may be able to bypass Gatekeeper
Affected products: vendor: Apple
product: macOS
vendor: Apple
product: macOS
vendor: Apple
product: macOS
Published: 2023-05-08T00:00:00.000Z
CVE-2023-27952 
A race condition was addressed with improved locking. This issue is fixed in macOS Ventura 13.3. An app may bypass Gatekeeper checks.
Problem types: description: An app may bypass Gatekeeper checks
Affected products: vendor: Apple
product: macOS
Published: 2023-05-08T00:00:00.000Z
CVE-2023-27953 
The issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13.3, macOS Monterey 12.6.4, macOS Big Sur 11.7.5. A remote user may be able to cause unexpected system termination or corrupt kernel memory.
Problem types: description: A remote user may be able to cause unexpected system termination or corrupt kernel memory
Affected products: vendor: Apple
product: macOS
vendor: Apple
product: macOS
vendor: Apple
product: macOS
Published: 2023-05-08T00:00:00.000Z