stasvinokur/cve-and-cwe-dataset-1999-2025 huggingface dataset:
CVE-2023-29299 (severity: MEDIUM, weakness: CWE-426)
Adobe Acrobat Reader versions 23.003.20244 (and earlier) and 20.005.30467 (and earlier) are affected by an Untrusted Search Path vulnerability that could lead to Application denial-of-service. An attacker could leverage this vulnerability if the default PowerShell Set-ExecutionPolicy is set to Unrestricted, making the attack complexity high. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2023-2930 (severity: HIGH, weakness: CWE-416)
Use after free in Extensions in Google Chrome prior to 114.0.5735.90 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVE-2023-29300 (severity: CRITICAL, weakness: CWE-502)
Adobe ColdFusion versions 2018u16 (and earlier), 2021u6 (and earlier) and 2023.0.0.330468 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction.
CVE-2023-29301 (severity: HIGH, weakness: CWE-307)
Adobe ColdFusion versions 2018u16 (and earlier), 2021u6 (and earlier) and 2023.0.0.330468 (and earlier) are affected by an Improper Restriction of Excessive Authentication Attempts vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to impact the confidentiality of the user. Exploitation of this issue does not require user interaction.
CVE-2023-29302 (severity: MEDIUM, weakness: CWE-79)
Adobe Experience Manager versions 6.5.16.0 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
CVE-2023-29303 (severity: MEDIUM, weakness: CWE-416)
Adobe Acrobat Reader versions 23.003.20244 (and earlier) and 20.005.30467 (and earlier) are affected by a Use After Free vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2023-29304 (severity: MEDIUM, weakness: CWE-79)
Adobe Experience Manager versions 6.5.16.0 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
CVE-2023-29305 (severity: MEDIUM, weakness: CWE-79)
Adobe Connect versions 12.3 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
CVE-2023-29306 (severity: MEDIUM, weakness: CWE-79)
Adobe Connect versions 12.3 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
CVE-2023-29307 (severity: MEDIUM, weakness: CWE-601)
Adobe Experience Manager versions 6.5.16.0 (and earlier) is affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. A low-privilege authenticated attacker could leverage this vulnerability to redirect users to malicious websites. Exploitation of this issue requires user interaction.
CVE-2023-29308 (severity: HIGH, weakness: CWE-787)
Adobe InDesign versions ID18.3 (and earlier) and ID17.4.1 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2023-29309 (severity: MEDIUM, weakness: CWE-125)
Adobe InDesign versions ID18.3 (and earlier) and ID17.4.1 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2023-2931 (severity: HIGH, weakness: CWE-416)
Use after free in PDF in Google Chrome prior to 114.0.5735.90 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. (Chromium security severity: High)
CVE-2023-29310 (severity: MEDIUM, weakness: CWE-125)
Adobe InDesign versions ID18.3 (and earlier) and ID17.4.1 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2023-29311 (severity: MEDIUM, weakness: CWE-125)
Adobe InDesign versions ID18.3 (and earlier) and ID17.4.1 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2023-29312 (severity: MEDIUM, weakness: CWE-125)
Adobe InDesign versions ID18.3 (and earlier) and ID17.4.1 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2023-29313 (severity: MEDIUM, weakness: CWE-125)
Adobe InDesign versions ID18.3 (and earlier) and ID17.4.1 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2023-29314 (severity: MEDIUM, weakness: CWE-125)
Adobe InDesign versions ID18.3 (and earlier) and ID17.4.1 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2023-29315 (severity: MEDIUM, weakness: CWE-125)
Adobe InDesign versions ID18.3 (and earlier) and ID17.4.1 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2023-29316 (severity: MEDIUM, weakness: CWE-125)
Adobe InDesign versions ID18.3 (and earlier) and ID17.4.1 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2023-29317 (severity: MEDIUM, weakness: CWE-125)
Adobe InDesign versions ID18.3 (and earlier) and ID17.4.1 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2023-29318 (severity: MEDIUM, weakness: CWE-125)
Adobe InDesign versions ID18.3 (and earlier) and ID17.4.1 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2023-29319 (severity: MEDIUM, weakness: CWE-125)
Adobe InDesign versions ID18.3 (and earlier) and ID17.4.1 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2023-2932 (severity: HIGH, weakness: CWE-416)
Use after free in PDF in Google Chrome prior to 114.0.5735.90 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. (Chromium security severity: High)
CVE-2023-29320 (severity: HIGH, weakness: CWE-657)
Adobe Acrobat Reader versions 23.003.20244 (and earlier) and 20.005.30467 (and earlier) are affected by an Violation of Secure Design Principles vulnerability that could result in arbitrary code execution in the context of the current user by bypassing the API blacklisting feature. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2023-29321 (severity: HIGH, weakness: CWE-416)
Adobe Animate versions 22.0.9 (and earlier) and 23.0.1 (and earlier) are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2023-29322 (severity: MEDIUM, weakness: CWE-79)
Adobe Experience Manager versions 6.5.16.0 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
CVE-2023-29323 (severity: HIGH, weakness: NVD-CWE-Other)
ascii_load_sockaddr in smtpd in OpenBSD before 7.1 errata 024 and 7.2 before errata 020, and OpenSMTPD Portable before 7.0.0-portable commit f748277, can abort upon a connection from a local, scoped IPv6 address.
CVE-2023-29324 (severity: MEDIUM, weakness: CWE-73)
Windows MSHTML Platform Security Feature Bypass Vulnerability
CVE-2023-29325 (severity: HIGH, weakness: CWE-416)
Windows OLE Remote Code Execution Vulnerability
CVE-2023-29326 (severity: HIGH, weakness: NVD-CWE-Other)
.NET Framework Remote Code Execution Vulnerability
CVE-2023-29328 (severity: HIGH, weakness: CWE-416)
Microsoft Teams Remote Code Execution Vulnerability
CVE-2023-2933 (severity: HIGH, weakness: CWE-416)
Use after free in PDF in Google Chrome prior to 114.0.5735.90 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. (Chromium security severity: High)
CVE-2023-29330 (severity: HIGH, weakness: CWE-416)
Microsoft Teams Remote Code Execution Vulnerability
CVE-2023-29331 (severity: HIGH, weakness: CWE-400)
.NET, .NET Framework, and Visual Studio Denial of Service Vulnerability
CVE-2023-29332 (severity: CRITICAL, weakness: CWE-330)
Microsoft Azure Kubernetes Service Elevation of Privilege Vulnerability
CVE-2023-29333 (severity: LOW, weakness: CWE-400)
Microsoft Access Denial of Service Vulnerability
CVE-2023-29334 (severity: MEDIUM, weakness: CWE-290)
Microsoft Edge (Chromium-based) Spoofing Vulnerability
CVE-2023-29335 (severity: HIGH, weakness: CWE-20)
Microsoft Word Security Feature Bypass Vulnerability
CVE-2023-29336 (severity: HIGH, weakness: CWE-416)
Win32k Elevation of Privilege Vulnerability
CVE-2023-29337 (severity: HIGH, weakness: CWE-367)
NuGet Client Remote Code Execution Vulnerability
CVE-2023-29338 (severity: MEDIUM, weakness: CWE-285)
Visual Studio Code Spoofing Vulnerability
CVE-2023-2934 (severity: HIGH, weakness: CWE-787)
Out of bounds memory access in Mojo in Google Chrome prior to 114.0.5735.90 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVE-2023-29340 (severity: HIGH, weakness: NVD-CWE-Other)
AV1 Video Extension Remote Code Execution Vulnerability
CVE-2023-29341 (severity: HIGH, weakness: CWE-122)
AV1 Video Extension Remote Code Execution Vulnerability
CVE-2023-29343 (severity: HIGH, weakness: CWE-59)
SysInternals Sysmon for Windows Elevation of Privilege Vulnerability
CVE-2023-29344 (severity: HIGH, weakness: CWE-122)
Microsoft Office Remote Code Execution Vulnerability
CVE-2023-29345 (severity: MEDIUM, weakness: CWE-79)
Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability
CVE-2023-29346 (severity: HIGH, weakness: CWE-681)
NTFS Elevation of Privilege Vulnerability
CVE-2023-29347 (severity: MEDIUM, weakness: CWE-79)
Windows Admin Center Spoofing Vulnerability
CVE-2023-29348 (severity: HIGH, weakness: CWE-200)
Windows Remote Desktop Gateway (RD Gateway) Information Disclosure Vulnerability
CVE-2023-29349 (severity: HIGH, weakness: CWE-191)
Microsoft ODBC and OLE DB Remote Code Execution Vulnerability
CVE-2023-2935 (severity: HIGH, weakness: CWE-843)
Type Confusion in V8 in Google Chrome prior to 114.0.5735.90 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVE-2023-29350 (severity: HIGH, weakness: CWE-269)
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
CVE-2023-29351 (severity: HIGH, weakness: CWE-59)
Windows Group Policy Elevation of Privilege Vulnerability
CVE-2023-29352 (severity: MEDIUM, weakness: NVD-CWE-Other)
Windows Remote Desktop Security Feature Bypass Vulnerability
CVE-2023-29353 (severity: MEDIUM, weakness: CWE-20)
Sysinternals Process Monitor for Windows Denial of Service Vulnerability
CVE-2023-29354 (severity: MEDIUM, weakness: CWE-693)
Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability
CVE-2023-29355 (severity: MEDIUM, weakness: CWE-668)
DHCP Server Service Information Disclosure Vulnerability
CVE-2023-29356 (severity: HIGH, weakness: CWE-416)
Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
CVE-2023-29357 (severity: CRITICAL, weakness: CWE-303)
Microsoft SharePoint Server Elevation of Privilege Vulnerability
CVE-2023-29358 (severity: HIGH, weakness: CWE-416)
Windows GDI Elevation of Privilege Vulnerability
CVE-2023-29359 (severity: HIGH, weakness: CWE-20)
GDI Elevation of Privilege Vulnerability
CVE-2023-2936 (severity: HIGH, weakness: CWE-843)
Type Confusion in V8 in Google Chrome prior to 114.0.5735.90 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVE-2023-29360 (severity: HIGH, weakness: CWE-822)
Microsoft Streaming Service Elevation of Privilege Vulnerability
CVE-2023-29361 (severity: HIGH, weakness: CWE-416)
Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
CVE-2023-29362 (severity: HIGH, weakness: CWE-122)
Remote Desktop Client Remote Code Execution Vulnerability
CVE-2023-29363 (severity: CRITICAL, weakness: CWE-122)
Windows Pragmatic General Multicast (PGM) Remote Code Execution Vulnerability
CVE-2023-29364 (severity: HIGH, weakness: CWE-190)
Windows Authentication Elevation of Privilege Vulnerability
CVE-2023-29365 (severity: HIGH, weakness: CWE-416)
Windows Media Remote Code Execution Vulnerability
CVE-2023-29366 (severity: HIGH, weakness: CWE-415)
Windows Geolocation Service Remote Code Execution Vulnerability
CVE-2023-29367 (severity: HIGH, weakness: CWE-908)
iSCSI Target WMI Provider Remote Code Execution Vulnerability
CVE-2023-29368 (severity: HIGH, weakness: CWE-415)
Windows Filtering Platform Elevation of Privilege Vulnerability
CVE-2023-29369 (severity: MEDIUM, weakness: CWE-190)
Remote Procedure Call Runtime Denial of Service Vulnerability
CVE-2023-2937 (severity: MEDIUM, weakness: CWE-451)
Inappropriate implementation in Picture In Picture in Google Chrome prior to 114.0.5735.90 allowed a remote attacker who had compromised the renderer process to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Medium)
CVE-2023-29370 (severity: HIGH, weakness: CWE-122)
Windows Media Remote Code Execution Vulnerability
CVE-2023-29371 (severity: HIGH, weakness: CWE-20)
Windows GDI Elevation of Privilege Vulnerability
CVE-2023-29372 (severity: HIGH, weakness: CWE-122)
Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
CVE-2023-29373 (severity: HIGH, weakness: CWE-125)
Microsoft ODBC Driver Remote Code Execution Vulnerability
CVE-2023-29374 (severity: CRITICAL, weakness: CWE-74)
In LangChain through 0.0.131, the LLMMathChain chain allows prompt injection attacks that can execute arbitrary code via the Python exec method.
CVE-2023-29375 (severity: CRITICAL, weakness: CWE-434)
An issue was discovered in Progress Sitefinity 13.3 before 13.3.7647, 14.0 before 14.0.7736, 14.1 before 14.1.7826, 14.2 before 14.2.7930, and 14.3 before 14.3.8025. There is potentially dangerous file upload through the SharePoint connector.
CVE-2023-29376 (severity: MEDIUM, weakness: CWE-79)
An issue was discovered in Progress Sitefinity 13.3 before 13.3.7647, 14.0 before 14.0.7736, 14.1 before 14.1.7826, 14.2 before 14.2.7930, and 14.3 before 14.3.8025. There is potential XSS by privileged users in Sitefinity to media libraries.
CVE-2023-2938 (severity: MEDIUM, weakness: CWE-451)
Inappropriate implementation in Picture In Picture in Google Chrome prior to 114.0.5735.90 allowed a remote attacker who had compromised the renderer process to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Medium)
CVE-2023-29380 (severity: HIGH, weakness: CWE-22)
Warpinator before 1.6.0 allows remote file deletion via directory traversal in top_dir_basenames.
CVE-2023-29381 (severity: CRITICAL, weakness: CWE-863)
An issue in Zimbra Collaboration (ZCS) v.8.8.15 and v.9.0 allows a remote attacker to escalate privileges and obtain sensitive information via the password and 2FA parameters.
CVE-2023-29382 (severity: CRITICAL, weakness: CWE-94)
An issue in Zimbra Collaboration ZCS v.8.8.15 and v.9.0 allows an attacker to execute arbitrary code via the sfdc_preauth.jsp component.
CVE-2023-29383 (severity: LOW, weakness: CWE-74)
In Shadow 4.13, it is possible to inject control characters into fields provided to the SUID program chfn (change finger). Although it is not possible to exploit this directly (e.g., adding a new user fails because \n is in the block list), it is possible to misrepresent the /etc/passwd file when viewed. Use of \r manipulations and Unicode characters to work around blocking of the : character make it possible to give the impression that a new user has been added. In other words, an adversary may be able to convince a system administrator to take the system offline (an indirect, social-engineered denial of service) by demonstrating that "cat /etc/passwd" shows a rogue user account.
CVE-2023-29384 (severity: CRITICAL, weakness: CWE-434)
Unrestricted Upload of File with Dangerous Type vulnerability in HM Plugin WordPress Job Board and Recruitment Plugin – JobWP.This issue affects WordPress Job Board and Recruitment Plugin – JobWP: from n/a through 2.0.
CVE-2023-29385 (severity: MEDIUM, weakness: CWE-79)
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Kevon Adonis WP Abstracts plugin <= 2.6.2 versions.
CVE-2023-29386 (severity: CRITICAL, weakness: CWE-434)
Unrestricted Upload of File with Dangerous Type vulnerability in Julien Crego Manager for Icomoon.This issue affects Manager for Icomoon: from n/a through 2.0.
CVE-2023-29387 (severity: MEDIUM, weakness: CWE-79)
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Julien Crego Manager for Icomoon plugin <= 2.0 versions.
CVE-2023-29388 (severity: MEDIUM, weakness: CWE-79)
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in impleCode Product Catalog Simple plugin <= 1.6.17 versions.
CVE-2023-29389 (severity: MEDIUM, weakness: CWE-74)
Toyota RAV4 2021 vehicles automatically trust messages from other ECUs on a CAN bus, which allows physically proximate attackers to drive a vehicle by accessing the control CAN bus after pulling the bumper away and reaching the headlight connector, and then sending forged "Key is validated" messages via CAN Injection, as exploited in the wild in (for example) July 2022.
CVE-2023-2939 (severity: HIGH, weakness: CWE-59)
Insufficient data validation in Installer in Google Chrome on Windows prior to 114.0.5735.90 allowed a local attacker to perform privilege escalation via crafted symbolic link. (Chromium security severity: Medium)
CVE-2023-2940 (severity: MEDIUM, weakness: CWE-284)
Inappropriate implementation in Downloads in Google Chrome prior to 114.0.5735.90 allowed an attacker who convinced a user to install a malicious extension to bypass file access restrictions via a crafted HTML page. (Chromium security severity: Medium)
CVE-2023-29400 (severity: HIGH, weakness: CWE-74)
Templates containing actions in unquoted HTML attributes (e.g. "attr={{.}}") executed with empty input can result in output with unexpected results when parsed due to HTML normalization rules. This may allow injection of arbitrary attributes into tags.
CVE-2023-29401 (severity: MEDIUM, weakness: CWE-494)
The filename parameter of the Context.FileAttachment function is not properly sanitized. A maliciously crafted filename can cause the Content-Disposition header to be sent with an unexpected filename value or otherwise modify the Content-Disposition header. For example, a filename of "setup.bat&quot;;x=.txt" will be sent as a file named "setup.bat". If the FileAttachment function is called with names provided by an untrusted source, this may permit an attacker to cause a file to be served with a name different than provided. Maliciously crafted attachment file name can modify the Content-Disposition header.
CVE-2023-29402 (severity: CRITICAL, weakness: CWE-94)
The go command may generate unexpected code at build time when using cgo. This may result in unexpected behavior when running a go program which uses cgo. This may occur when running an untrusted module which contains directories with newline characters in their names. Modules which are retrieved using the go command, i.e. via "go get", are not affected (modules retrieved using GOPATH-mode, i.e. GO111MODULE=off, may be affected).
CVE-2023-29403 (severity: HIGH, weakness: CWE-668)
On Unix platforms, the Go runtime does not behave differently when a binary is run with the setuid/setgid bits. This can be dangerous in certain cases, such as when dumping memory state, or assuming the status of standard i/o file descriptors. If a setuid/setgid binary is executed with standard I/O file descriptors closed, opening any files can result in unexpected content being read or written with elevated privileges. Similarly, if a setuid/setgid program is terminated, either via panic or signal, it may leak the contents of its registers.
CVE-2023-29404 (severity: CRITICAL, weakness: CWE-94)
The go command may execute arbitrary code at build time when using cgo. This may occur when running "go get" on a malicious module, or when running any other command which builds untrusted code. This is can by triggered by linker flags, specified via a "#cgo LDFLAGS" directive. The arguments for a number of flags which are non-optional are incorrectly considered optional, allowing disallowed flags to be smuggled through the LDFLAGS sanitization. This affects usage of both the gc and gccgo compilers.