CVE-2023-38745

MEDIUM Year: 2023
CVSS v3 Score
6.3
Medium
Weakness Type
NVD-CWE-Other
View all →

Vulnerability Description

Pandoc before 3.1.6 allows arbitrary file write: this can be triggered by providing a crafted image element in the input when generating files via the --extract-media option or outputting to PDF format. This allows an attacker to create or overwrite arbitrary files, depending on the privileges of the process running Pandoc. It only affects systems that pass untrusted user input to Pandoc and allow Pandoc to be used to produce a PDF or with the --extract-media option. NOTE: this issue exists because of an incomplete fix for CVE-2023-35936 (failure to properly account for double encoded path names).

Related Vulnerabilities

CVE-2016-3563

MEDIUM
CVSS:6.3(Medium)

Unspecified vulnerability in the Enterprise Manager Base Platform component in Oracle Enterprise Manager Grid Control 12.1.0.5 allows local users to affect confidentiality and integrity via vectors re...

NVD-CWE-Other2016

CVE-2017-10153

MEDIUM
CVSS:6.3(Medium)

Vulnerability in the Oracle Communications WebRTC Session Controller component of Oracle Communications Applications (subcomponent: Security (Gson)). Supported versions that are affected are 7.0, 7.1 ...

NVD-CWE-Other2017

CVE-2017-10163

MEDIUM
CVSS:6.3(Medium)

Vulnerability in the Oracle Business Intelligence Enterprise Edition component of Oracle Fusion Middleware (subcomponent: Analytics Web General). Supported versions that are affected are 11.1.1.7.0, 1...

NVD-CWE-Other2017

CVE-2017-10385

MEDIUM
CVSS:6.3(Medium)

Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Web Container). Supported versions that are affected are 3.0.1 and 3.1.2. Easily exploitable vulnerabi...

NVD-CWE-Other2017

CVE-2017-10393

MEDIUM
CVSS:6.3(Medium)

Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Web Container). Supported versions that are affected are 3.0.1 and 3.1.2. Easily exploitable vulnerabi...

NVD-CWE-Other2017

CVE-2017-18711

MEDIUM
CVSS:6.3(Medium)

Certain NETGEAR devices are affected by incorrect configuration of security settings. This affects D7800 before 1.0.1.28, R6400 before 1.01.32, R6400v2 before 1.0.2.44, R6700 before 1.0.1.36, R6900 be...

NVD-CWE-Other2017