Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2023-0102
LS ELECTRIC XBC-DN32U with operating system version 01.80 is missing authentication for its deletion command. This could allow an attacker to delete arbitrary files.


Affected Products: XBC-DN32U
References: [{'url': 'https://www.cisa.gov/uscert/ics/advisories/icsa-23-040-02'}]
CVE State: PUBLISHED
Explain CVE-2023-0103
If an attacker were to access memory locations of LS ELECTRIC XBC-DN32U with operating system version 01.80 that are outside of the communication buffer, the device stops operating. This could allow an attacker to cause a denial-of-service condition.


Affected Products: XBC-DN32U
References: [{'url': 'https://www.cisa.gov/uscert/ics/advisories/icsa-23-040-02'}]
CVE State: PUBLISHED
Explain CVE-2023-0104

The listed versions for Weintek EasyBuilder Pro are vulnerable to a ZipSlip attack caused by decompiling a malicious project file. This may allow an attacker to gain control of the user’s computer or gain access to sensitive data.   





Affected Products: EasyBuilder Pro cMT 
References: [{'url': 'https://www.cisa.gov/uscert/ics/advisories/icsa-23-045-01'}]
CVE State: PUBLISHED
Explain CVE-2023-0105
A flaw was found in Keycloak. This flaw allows impersonation and lockout due to the email trust not being handled correctly in Keycloak. An attacker can shadow other users with the same email and lockout or impersonate them.
Affected Products: Keycloak
References: [{'url': 'https://access.redhat.com/security/cve/CVE-2023-0105'}]
CVE State: PUBLISHED
Explain CVE-2023-0106
Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0.
Affected Products: usememos/memos
References: [{'url': 'https://huntr.dev/bounties/5c0809cb-f4ff-4447-bed6-b5625fb374bb'}, {'url': 'https://github.com/usememos/memos/commit/0f8ce3dd1696722f951d7195ad1f88b39a5d15d7'}]
CVE State: PUBLISHED
Explain CVE-2023-0107
Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0.
Affected Products: usememos/memos
References: [{'url': 'https://github.com/usememos/memos/commit/0f8ce3dd1696722f951d7195ad1f88b39a5d15d7'}, {'url': 'https://huntr.dev/bounties/0b28fa57-acb0-47c8-ac48-962ff3898156'}]
CVE State: PUBLISHED
Explain CVE-2023-0108
Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0.
Affected Products: usememos/memos
References: [{'url': 'https://github.com/usememos/memos/commit/46c13a4b7f675b92d297df6dabb4441f13c7cd9c'}, {'url': 'https://huntr.dev/bounties/f66d33df-6588-4ab4-80a0-847451517944'}]
CVE State: PUBLISHED
Explain CVE-2023-0110
Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0.
Affected Products: usememos/memos
References: [{'url': 'https://github.com/usememos/memos/commit/46c13a4b7f675b92d297df6dabb4441f13c7cd9c'}, {'url': 'https://huntr.dev/bounties/6e4a1961-dbca-46f6-ae21-c25a621e54a7'}]
CVE State: PUBLISHED
Explain CVE-2023-0111
Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0.
Affected Products: usememos/memos
References: [{'url': 'https://github.com/usememos/memos/commit/46c13a4b7f675b92d297df6dabb4441f13c7cd9c'}, {'url': 'https://huntr.dev/bounties/70da256c-977a-487e-8a6a-9ae22caedbe3'}]
CVE State: PUBLISHED
Explain CVE-2023-0112
Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0.
Affected Products: usememos/memos
References: [{'url': 'https://huntr.dev/bounties/ec2a29dc-79a3-44bd-a58b-15f676934af6'}, {'url': 'https://github.com/usememos/memos/commit/46c13a4b7f675b92d297df6dabb4441f13c7cd9c'}]
CVE State: PUBLISHED
Explain CVE-2023-0113
A vulnerability was found in Netis Netcore Router up to 2.2.6. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file param.file.tgz of the component Backup Handler. The manipulation leads to information disclosure. The attack can be launched remotely. The associated identifier of this vulnerability is VDB-217591.
Affected Products: Netcore Router
References: [{'url': 'https://vuldb.com/?id.217591', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.217591', 'tags': ['signature']}]
CVE State: PUBLISHED
Explain CVE-2023-0114
A vulnerability was found in Netis Netcore Router. It has been rated as problematic. Affected by this issue is some unknown functionality of the file param.file.tgz of the component Backup Handler. The manipulation leads to cleartext storage in a file or on disk. Local access is required to approach this attack. The identifier of this vulnerability is VDB-217592.
Affected Products: Netcore Router
References: [{'url': 'https://vuldb.com/?id.217592', 'tags': ['vdb-entry']}, {'url': 'https://vuldb.com/?ctiid.217592', 'tags': ['signature', 'permissions-required']}]
CVE State: PUBLISHED
Explain CVE-2023-0121
A denial of service issue was discovered in GitLab CE/EE affecting all versions starting from 13.2.4 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2 which allows an attacker to cause high resource consumption using malicious test report artifacts.
Affected Products: GitLab
References: [{'url': 'https://gitlab.com/gitlab-org/gitlab/-/issues/387549'}, {'url': 'https://hackerone.com/reports/1774688'}, {'url': 'https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0121.json'}]
CVE State: PUBLISHED
Explain CVE-2023-0122
A NULL pointer dereference vulnerability in the Linux kernel NVMe functionality, in nvmet_setup_auth(), allows an attacker to perform a Pre-Auth Denial of Service (DoS) attack on a remote machine. Affected versions v6.0-rc1 to v6.0-rc3, fixed in v6.0-rc4.
Affected Products: Kernel
References: [{'url': 'https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=da0342a3aa0357795224e6283df86444e1117168'}, {'name': '[oss-security] 20230118 Re: CVE-2023-0122: Linux kernel: Pre-Auth Remote DoS in NVMe', 'tags': ['mailing-list'], 'url': 'http://www.openwall.com/lists/oss-security/2023/01/18/1'}, {'url': 'https://security.netapp.com/advisory/ntap-20230302-0002/'}]
CVE State: PUBLISHED
Explain CVE-2023-0123
Delta Electronics DOPSoft versions 4.00.16.22 and prior are vulnerable to a stack-based buffer overflow, which could allow an attacker to remotely execute arbitrary code when a malformed file is introduced to the software.


Affected Products: DOPSoft
References: [{'url': 'https://www.cisa.gov/uscert/ics/advisories/icsa-23-031-01'}]
CVE State: PUBLISHED
Explain CVE-2023-0124
Delta Electronics DOPSoft versions 4.00.16.22 and prior are vulnerable to an out-of-bounds write, which could allow an attacker to remotely execute arbitrary code when a malformed file is introduced to the software.


Affected Products: DOPSoft
References: [{'url': 'https://www.cisa.gov/uscert/ics/advisories/icsa-23-031-01'}]
CVE State: PUBLISHED
Explain CVE-2023-0125
A vulnerability was found in Control iD Panel. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the component Web Interface. The manipulation of the argument Nome leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-217717 was assigned to this vulnerability.
Affected Products: Panel
References: [{'url': 'https://vuldb.com/?id.217717', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.217717', 'tags': ['signature', 'permissions-required']}, {'url': 'https://www.notion.so/ControlID-XSS-7ab891644a794103b582a59360f071a5', 'tags': ['exploit']}]
CVE State: PUBLISHED
Explain CVE-2023-0126
Pre-authentication path traversal vulnerability in SMA1000 firmware version 12.4.2, which allows an unauthenticated attacker to access arbitrary files and directories stored outside the web root directory.
Affected Products: SonicWall SMA1000
References: [{'url': 'https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0001'}]
CVE State: PUBLISHED
Explain CVE-2023-0127
A command injection vulnerability in the firmware_update command, in the device's restricted telnet interface, allows an authenticated attacker to execute arbitrary commands as root.
Affected Products: D-Link DWL-2600AP with firmware v4.2.0.17
References: [{'url': 'https://www.tenable.com/security/research/tra-2023-1'}]
CVE State: PUBLISHED
Explain CVE-2023-0128
Use after free in Overview Mode in Google Chrome on Chrome OS prior to 109.0.5414.74 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Affected Products: Chrome
References: [{'url': 'https://chromereleases.googleblog.com/2023/01/stable-channel-update-for-desktop.html'}, {'url': 'https://crbug.com/1353208'}, {'name': 'GLSA-202305-10', 'tags': ['vendor-advisory'], 'url': 'https://security.gentoo.org/glsa/202305-10'}]
CVE State: PUBLISHED
Explain CVE-2023-0129
Heap buffer overflow in Network Service in Google Chrome prior to 109.0.5414.74 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page and specific interactions. (Chromium security severity: High)
Affected Products: Chrome
References: [{'url': 'https://chromereleases.googleblog.com/2023/01/stable-channel-update-for-desktop.html'}, {'url': 'https://crbug.com/1382033'}, {'name': 'GLSA-202305-10', 'tags': ['vendor-advisory'], 'url': 'https://security.gentoo.org/glsa/202305-10'}]
CVE State: PUBLISHED
Explain CVE-2023-0130
Inappropriate implementation in in Fullscreen API in Google Chrome on Android prior to 109.0.5414.74 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Medium)
Affected Products: Chrome
References: [{'url': 'https://chromereleases.googleblog.com/2023/01/stable-channel-update-for-desktop.html'}, {'url': 'https://crbug.com/1370028'}, {'name': 'GLSA-202305-10', 'tags': ['vendor-advisory'], 'url': 'https://security.gentoo.org/glsa/202305-10'}]
CVE State: PUBLISHED
Explain CVE-2023-0131
Inappropriate implementation in in iframe Sandbox in Google Chrome prior to 109.0.5414.74 allowed a remote attacker to bypass file download restrictions via a crafted HTML page. (Chromium security severity: Medium)
Affected Products: Chrome
References: [{'url': 'https://chromereleases.googleblog.com/2023/01/stable-channel-update-for-desktop.html'}, {'url': 'https://crbug.com/1357366'}, {'name': 'GLSA-202305-10', 'tags': ['vendor-advisory'], 'url': 'https://security.gentoo.org/glsa/202305-10'}]
CVE State: PUBLISHED
Explain CVE-2023-0132
Inappropriate implementation in in Permission prompts in Google Chrome on Windows prior to 109.0.5414.74 allowed a remote attacker to force acceptance of a permission prompt via a crafted HTML page. (Chromium security severity: Medium)
Affected Products: Chrome
References: [{'url': 'https://chromereleases.googleblog.com/2023/01/stable-channel-update-for-desktop.html'}, {'url': 'https://crbug.com/1371215'}, {'name': 'GLSA-202305-10', 'tags': ['vendor-advisory'], 'url': 'https://security.gentoo.org/glsa/202305-10'}]
CVE State: PUBLISHED
Explain CVE-2023-0133
Inappropriate implementation in in Permission prompts in Google Chrome on Android prior to 109.0.5414.74 allowed a remote attacker to bypass main origin permission delegation via a crafted HTML page. (Chromium security severity: Medium)
Affected Products: Chrome
References: [{'url': 'https://chromereleases.googleblog.com/2023/01/stable-channel-update-for-desktop.html'}, {'url': 'https://crbug.com/1375132'}, {'name': 'GLSA-202305-10', 'tags': ['vendor-advisory'], 'url': 'https://security.gentoo.org/glsa/202305-10'}]
CVE State: PUBLISHED
Explain CVE-2023-0134
Use after free in Cart in Google Chrome prior to 109.0.5414.74 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via database corruption and a crafted HTML page. (Chromium security severity: Medium)
Affected Products: Chrome
References: [{'url': 'https://chromereleases.googleblog.com/2023/01/stable-channel-update-for-desktop.html'}, {'url': 'https://crbug.com/1385709'}, {'name': 'GLSA-202305-10', 'tags': ['vendor-advisory'], 'url': 'https://security.gentoo.org/glsa/202305-10'}]
CVE State: PUBLISHED
Explain CVE-2023-0135
Use after free in Cart in Google Chrome prior to 109.0.5414.74 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via database corruption and a crafted HTML page. (Chromium security severity: Medium)
Affected Products: Chrome
References: [{'url': 'https://chromereleases.googleblog.com/2023/01/stable-channel-update-for-desktop.html'}, {'url': 'https://crbug.com/1385831'}, {'name': 'GLSA-202305-10', 'tags': ['vendor-advisory'], 'url': 'https://security.gentoo.org/glsa/202305-10'}]
CVE State: PUBLISHED
Explain CVE-2023-0136
Inappropriate implementation in in Fullscreen API in Google Chrome on Android prior to 109.0.5414.74 allowed a remote attacker to execute incorrect security UI via a crafted HTML page. (Chromium security severity: Medium)
Affected Products: Chrome
References: [{'url': 'https://chromereleases.googleblog.com/2023/01/stable-channel-update-for-desktop.html'}, {'url': 'https://crbug.com/1356987'}, {'name': 'GLSA-202305-10', 'tags': ['vendor-advisory'], 'url': 'https://security.gentoo.org/glsa/202305-10'}]
CVE State: PUBLISHED
Explain CVE-2023-0137
Heap buffer overflow in Platform Apps in Google Chrome on Chrome OS prior to 109.0.5414.74 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
Affected Products: Chrome
References: [{'url': 'https://chromereleases.googleblog.com/2023/01/stable-channel-update-for-desktop.html'}, {'url': 'https://crbug.com/1399904'}, {'name': 'GLSA-202305-10', 'tags': ['vendor-advisory'], 'url': 'https://security.gentoo.org/glsa/202305-10'}]
CVE State: PUBLISHED
Explain CVE-2023-0138
Heap buffer overflow in libphonenumber in Google Chrome prior to 109.0.5414.74 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Low)
Affected Products: Chrome
References: [{'url': 'https://chromereleases.googleblog.com/2023/01/stable-channel-update-for-desktop.html'}, {'url': 'https://crbug.com/1346675'}, {'name': 'GLSA-202305-10', 'tags': ['vendor-advisory'], 'url': 'https://security.gentoo.org/glsa/202305-10'}]
CVE State: PUBLISHED
Explain CVE-2023-0139
Insufficient validation of untrusted input in Downloads in Google Chrome on Windows prior to 109.0.5414.74 allowed a remote attacker to bypass download restrictions via a crafted HTML page. (Chromium security severity: Low)
Affected Products: Chrome
References: [{'url': 'https://chromereleases.googleblog.com/2023/01/stable-channel-update-for-desktop.html'}, {'url': 'https://crbug.com/1367632'}, {'name': 'GLSA-202305-10', 'tags': ['vendor-advisory'], 'url': 'https://security.gentoo.org/glsa/202305-10'}]
CVE State: PUBLISHED
Explain CVE-2023-0140
Inappropriate implementation in in File System API in Google Chrome on Windows prior to 109.0.5414.74 allowed a remote attacker to bypass file system restrictions via a crafted HTML page. (Chromium security severity: Low)
Affected Products: Chrome
References: [{'url': 'https://chromereleases.googleblog.com/2023/01/stable-channel-update-for-desktop.html'}, {'url': 'https://crbug.com/1326788'}, {'name': 'GLSA-202305-10', 'tags': ['vendor-advisory'], 'url': 'https://security.gentoo.org/glsa/202305-10'}]
CVE State: PUBLISHED
Explain CVE-2023-0141
Insufficient policy enforcement in CORS in Google Chrome prior to 109.0.5414.74 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)
Affected Products: Chrome
References: [{'url': 'https://chromereleases.googleblog.com/2023/01/stable-channel-update-for-desktop.html'}, {'url': 'https://crbug.com/1362331'}, {'name': 'GLSA-202305-10', 'tags': ['vendor-advisory'], 'url': 'https://security.gentoo.org/glsa/202305-10'}]
CVE State: PUBLISHED
Explain CVE-2023-0142
Uncontrolled search path element vulnerability in Backup Management Functionality in Synology DiskStation Manager (DSM) before 7.1-42661 allows remote authenticated users to read or write arbitrary files via unspecified vectors.
Affected Products: DiskStation Manager (DSM)
References: [{'url': 'https://www.synology.com/en-global/security/advisory/Synology_SA_23_05', 'name': 'Synology-SA-23:05 DSM', 'tags': ['vendor-advisory']}, {'url': 'https://www.synology.com/en-global/security/advisory/Synology_SA_23_06', 'name': 'Synology-SA-23:06 SRM', 'tags': ['vendor-advisory']}]
CVE State: PUBLISHED
Explain CVE-2023-0143
The Send PDF for Contact Form 7 WordPress plugin before 0.9.9.2 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Affected Products: Send PDF for Contact Form 7
References: [{'url': 'https://wpscan.com/vulnerability/c4cd3d98-9678-49cb-9d1a-551ef8a810b9', 'tags': ['exploit', 'vdb-entry', 'technical-description']}]
CVE State: PUBLISHED
Explain CVE-2023-0144
The Event Manager and Tickets Selling Plugin for WooCommerce WordPress plugin before 3.8.0 does not validate and escape some of its post meta before outputting them back in a page/post, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Affected Products: Event Manager and Tickets Selling Plugin for WooCommerce
References: [{'url': 'https://wpscan.com/vulnerability/d7b3917a-d11f-4216-9d2c-30771d83a7b4', 'tags': ['exploit', 'vdb-entry', 'technical-description']}]
CVE State: PUBLISHED
Explain CVE-2023-0145
The Saan World Clock WordPress plugin through 1.8 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Affected Products: Saan World Clock
References: [{'url': 'https://wpscan.com/vulnerability/f4e4b4a2-c7cb-42ce-9d5b-bd84efcbf54d', 'tags': ['exploit', 'vdb-entry', 'technical-description']}]
CVE State: PUBLISHED
Explain CVE-2023-0146
The Naver Map WordPress plugin through 1.1.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Affected Products: Naver Map
References: [{'url': 'https://wpscan.com/vulnerability/d1218c69-4f6a-4b2d-a537-5cc16a46ba7b', 'tags': ['exploit', 'vdb-entry', 'technical-description']}]
CVE State: PUBLISHED
Explain CVE-2023-0147
The Flexible Captcha WordPress plugin through 4.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Affected Products: Flexible Captcha
References: [{'url': 'https://wpscan.com/vulnerability/af9cbb4a-42fc-43c5-88f3-349b417f1a6a', 'tags': ['exploit', 'vdb-entry', 'technical-description']}]
CVE State: PUBLISHED
Explain CVE-2023-0148
The Gallery Factory Lite WordPress plugin through 2.0.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Affected Products: Gallery Factory Lite
References: [{'url': 'https://wpscan.com/vulnerability/f15f2f2c-2053-4b93-8064-15b5243a4021', 'tags': ['exploit', 'vdb-entry', 'technical-description']}]
CVE State: PUBLISHED
Explain CVE-2023-0149
The WordPrezi WordPress plugin before 0.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Affected Products: WordPrezi
References: [{'url': 'https://wpscan.com/vulnerability/6b6f9e42-7f7f-4daa-99c9-14a24a6d76b0', 'tags': ['exploit', 'vdb-entry', 'technical-description']}]
CVE State: PUBLISHED
Explain CVE-2023-0150
The Cloak Front End Email WordPress plugin before 1.9.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Affected Products: Cloak Front End Email
References: [{'url': 'https://wpscan.com/vulnerability/517154dc-d6bd-462d-b955-061a7b7f8da5', 'tags': ['exploit', 'vdb-entry', 'technical-description']}]
CVE State: PUBLISHED
Explain CVE-2023-0151
The uTubeVideo Gallery WordPress plugin before 2.0.8 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Affected Products: uTubeVideo Gallery
References: [{'url': 'https://wpscan.com/vulnerability/d9fc6f5f-efc1-4e23-899b-e9a49330ed13', 'tags': ['exploit', 'vdb-entry', 'technical-description']}]
CVE State: PUBLISHED
Explain CVE-2023-0152
The WP Multi Store Locator WordPress plugin through 2.4 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Affected Products: WP Multi Store Locator
References: [{'url': 'https://wpscan.com/vulnerability/8281fce2-6f24-4d3f-895f-4d8694806609', 'tags': ['exploit', 'vdb-entry', 'technical-description']}]
CVE State: PUBLISHED
Explain CVE-2023-0153
The Vimeo Video Autoplay Automute WordPress plugin through 1.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Affected Products: Vimeo Video Autoplay Automute
References: [{'url': 'https://wpscan.com/vulnerability/f3459868-28aa-4a5d-94d8-bbc17e3ce653', 'tags': ['exploit', 'vdb-entry', 'technical-description']}]
CVE State: PUBLISHED
Explain CVE-2023-0154
The GamiPress WordPress plugin before 1.0.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Affected Products: GamiPress
References: [{'url': 'https://wpscan.com/vulnerability/5e66e173-776d-4423-b4a2-eb7316b2502f', 'tags': ['exploit', 'vdb-entry', 'technical-description']}]
CVE State: PUBLISHED
Explain CVE-2023-0155
An issue has been discovered in GitLab CE/EE affecting all versions before 15.8.5, 15.9.4, 15.10.1. Open redirects was possible due to framing arbitrary content on any page allowing user controlled markdown
Affected Products: GitLab
References: [{'url': 'https://gitlab.com/gitlab-org/gitlab/-/issues/387638'}, {'url': 'https://hackerone.com/reports/1817250'}, {'url': 'https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0155.json'}]
CVE State: PUBLISHED
Explain CVE-2023-0156
The All-In-One Security (AIOS) WordPress plugin before 5.1.5 does not limit what log files to display in it's settings pages, allowing an authorized user (admin+) to view the contents of arbitrary files and list directories anywhere on the server (to which the web server has access). The plugin only displays the last 50 lines of the file.
Affected Products: All-In-One Security (AIOS)
References: [{'url': 'https://wpscan.com/vulnerability/caf1dbb5-197e-41e9-8f48-ba1f2360a759', 'tags': ['exploit', 'vdb-entry', 'technical-description']}]
CVE State: PUBLISHED
Explain CVE-2023-0157
The All-In-One Security (AIOS) WordPress plugin before 5.1.5 does not escape the content of log files before outputting it to the plugin admin page, allowing an authorized user (admin+) to plant bogus log files containing malicious JavaScript code that will be executed in the context of any administrator visiting this page.
Affected Products: All-In-One Security (AIOS)
References: [{'url': 'https://wpscan.com/vulnerability/8248b550-6485-4108-a701-8446ffa35f06', 'tags': ['exploit', 'vdb-entry', 'technical-description']}]
CVE State: PUBLISHED
Explain CVE-2023-0158
NLnet Labs Krill supports direct access to the RRDP repository content through its built-in web server at the "/rrdp" endpoint. Prior to 0.12.1 a direct query for any existing directory under "/rrdp/", rather than an RRDP file such as "/rrdp/notification.xml" as would be expected, causes Krill to crash. If the built-in "/rrdp" endpoint is exposed directly to the internet, then malicious remote parties can cause the publication server to crash. The repository content is not affected by this, but the availability of the server and repository can cause issues if this attack is persistent and is not mitigated.
Affected Products: Krill
References: [{'url': 'https://www.nlnetlabs.nl/downloads/krill/CVE-2023-0158.txt'}]
CVE State: PUBLISHED
Explain CVE-2023-0159
The Extensive VC Addons for WPBakery page builder WordPress plugin before 1.9.1 does not validate a parameter passed to the php extract function when loading templates, allowing an unauthenticated attacker to override the template path to read arbitrary files from the hosts file system.
Affected Products: Extensive VC Addons for WPBakery page builder
References: [{'url': 'https://wpscan.com/vulnerability/239ea870-66e5-4754-952e-74d4dd60b809', 'tags': ['exploit', 'vdb-entry', 'technical-description']}]
CVE State: PUBLISHED
Explain CVE-2023-0160
A deadlock flaw was found in the Linux kernel’s BPF subsystem. This flaw allows a local user to potentially crash the system.
Affected Products: kernel
References: [{'url': 'https://access.redhat.com/security/cve/CVE-2023-0160', 'tags': ['vdb-entry', 'x_refsource_REDHAT']}, {'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=2159764', 'name': 'RHBZ#2159764', 'tags': ['issue-tracking', 'x_refsource_REDHAT']}, {'url': 'https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=ed17aa92dc56'}, {'url': 'https://lore.kernel.org/all/CABcoxUayum5oOqFMMqAeWuS8+EzojquSOSyDA3J_2omY=2EeAg@mail.gmail.com/'}]
CVE State: PUBLISHED
Explain CVE-2023-0162
The CPO Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several of its content type settings parameters in versions up to, and including, 1.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Products: CPO Companion
References: [{'url': 'https://www.wordfence.com/threat-intel/vulnerabilities/id/9195ac7e-2995-44d0-b5c6-8ffb47395f24'}, {'url': 'https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2844012%40cpo-companion%2Ftrunk&old=2574013%40cpo-companion%2Ftrunk&sfp_email=&sfph_mail='}]
CVE State: PUBLISHED
Explain CVE-2023-0164
OrangeScrum version 2.0.11 allows an authenticated external attacker to execute arbitrary commands on the server. This is possible because the application injects an attacker-controlled parameter into a system function.
Affected Products: OrangeScrum
References: [{'url': 'https://fluidattacks.com/advisories/queen/'}, {'url': 'https://github.com/Orangescrum/orangescrum'}]
CVE State: PUBLISHED
Explain CVE-2023-0165
The Cost Calculator WordPress plugin through 1.8 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Affected Products: Cost Calculator
References: [{'url': 'https://wpscan.com/vulnerability/f00b82f7-d8ad-4f6b-b791-81cc16b6336b', 'tags': ['exploit', 'vdb-entry', 'technical-description']}]
CVE State: PUBLISHED
Explain CVE-2023-0166
The Product Slider for WooCommerce by PickPlugins WordPress plugin before 1.13.42 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Affected Products: Product Slider for WooCommerce by PickPlugins
References: [{'url': 'https://wpscan.com/vulnerability/f5d43062-4ef3-4dd1-b916-0127f0016f5c', 'tags': ['exploit', 'vdb-entry', 'technical-description']}]
CVE State: PUBLISHED
Explain CVE-2023-0167
The GetResponse for WordPress plugin through 5.5.31 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Affected Products: GetResponse for WordPress
References: [{'url': 'https://wpscan.com/vulnerability/fafbf666-b908-48ef-9041-fea653e9bfeb', 'tags': ['exploit', 'vdb-entry', 'technical-description']}]
CVE State: PUBLISHED
Explain CVE-2023-0168
The Olevmedia Shortcodes WordPress plugin through 1.1.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Affected Products: Olevmedia Shortcodes
References: [{'url': 'https://wpscan.com/vulnerability/e854efee-16fc-4379-9e66-d2883e01fb32', 'tags': ['exploit', 'vdb-entry', 'technical-description']}]
CVE State: PUBLISHED
Explain CVE-2023-0169
The Zoho Forms WordPress plugin before 3.0.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Affected Products: Form plugin for WordPress
References: [{'url': 'https://wpscan.com/vulnerability/178d71f2-4666-4f7e-ada5-cb72a50fd663', 'tags': ['exploit', 'vdb-entry', 'technical-description']}]
CVE State: PUBLISHED
Explain CVE-2023-0170
The Html5 Audio Player WordPress plugin before 2.1.12 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Affected Products: Html5 Audio Player
References: [{'url': 'https://wpscan.com/vulnerability/19ee5e33-acc8-40c5-8f54-c9cb0fa491f0', 'tags': ['exploit', 'vdb-entry', 'technical-description']}]
CVE State: PUBLISHED
Explain CVE-2023-0171
The jQuery T(-) Countdown Widget WordPress plugin before 2.3.24 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Affected Products: jQuery T(-) Countdown Widget
References: [{'url': 'https://wpscan.com/vulnerability/32324655-ff91-4a53-a2c5-ebe6678d4a9d', 'tags': ['exploit', 'vdb-entry', 'technical-description']}]
CVE State: PUBLISHED
Explain CVE-2023-0172
The Juicer WordPress plugin before 1.11 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Affected Products: Embed, curate & aggregate social media feeds into your website using JUICER
References: [{'url': 'https://wpscan.com/vulnerability/c8982b8d-985f-4a5d-840d-e8be7c3405bd', 'tags': ['exploit', 'vdb-entry', 'technical-description']}]
CVE State: PUBLISHED
Explain CVE-2023-0173
The Drag & Drop Sales Funnel Builder for WordPress plugin before 2.6.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Affected Products: Drag & Drop Sales Funnel Builder for WordPress
References: [{'url': 'https://wpscan.com/vulnerability/c543b6e2-a7c0-4ba7-a308-e9951dd59fb9', 'tags': ['exploit', 'vdb-entry', 'technical-description']}]
CVE State: PUBLISHED
Explain CVE-2023-0174
The WP VR WordPress plugin before 8.2.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Affected Products: WP VR
References: [{'url': 'https://wpscan.com/vulnerability/6b53d0e6-def9-4907-bd2b-884b2afa52b3', 'tags': ['exploit', 'vdb-entry', 'technical-description']}]
CVE State: PUBLISHED
Explain CVE-2023-0175
The Responsive Clients Logo Gallery Plugin for WordPress plugin through 1.1.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Affected Products: Responsive Clients Logo Gallery Plugin for WordPress
References: [{'url': 'https://wpscan.com/vulnerability/cdcd3c2c-cb29-4b21-8d3d-7eafbc1d3098', 'tags': ['exploit', 'vdb-entry', 'technical-description']}]
CVE State: PUBLISHED
Explain CVE-2023-0176
The Giveaways and Contests by RafflePress WordPress plugin before 1.11.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Affected Products: Giveaways and Contests by RafflePress
References: [{'url': 'https://wpscan.com/vulnerability/a762c25b-5c47-400e-8964-407cf4c94e9f', 'tags': ['exploit', 'vdb-entry', 'technical-description']}]
CVE State: PUBLISHED
Explain CVE-2023-0177
The Social Like Box and Page by WpDevArt WordPress plugin before 0.8.41 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Affected Products: Social Like Box and Page by WpDevArt
References: [{'url': 'https://wpscan.com/vulnerability/712c2154-37f4-424c-ba3b-26ba6aa95bca', 'tags': ['exploit', 'vdb-entry', 'technical-description']}]
CVE State: PUBLISHED
Explain CVE-2023-0178
The Annual Archive WordPress plugin before 1.6.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Affected Products: Annual Archive
References: [{'url': 'https://wpscan.com/vulnerability/cc308e15-7937-4d41-809d-74f8c13bee23', 'tags': ['exploit', 'vdb-entry', 'technical-description']}]
CVE State: PUBLISHED
Explain CVE-2023-0179
A buffer overflow vulnerability was found in the Netfilter subsystem in the Linux Kernel. This issue could allow the leakage of both stack and heap addresses, and potentially allow Local Privilege Escalation to the root user via arbitrary code execution.
Affected Products: kernel
References: [{'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=2161713'}, {'url': 'https://seclists.org/oss-sec/2023/q1/20'}, {'url': 'http://packetstormsecurity.com/files/171601/Kernel-Live-Patch-Security-Notice-LNS-0093-1.html'}, {'url': 'https://security.netapp.com/advisory/ntap-20230511-0003/'}]
CVE State: PUBLISHED
Explain CVE-2023-0180
NVIDIA GPU Display Driver for Linux contains a vulnerability in a kernel mode layer handler, which may lead to denial of service or information disclosure.
Affected Products: vGPU software (guest driver - Linux), vGPU software (Virtual GPU Manager - Citrix Hypervisor, VMware vSphere, Red Hat Enterprise Linux KVM), NVIDIA Cloud Gaming (guest driver - Linux), NVIDIA Cloud Gaming (Virtual GPU Manager - Red Hat Enterprise Linux KVM)
References: [{'url': 'https://nvidia.custhelp.com/app/answers/detail/a_id/5452'}]
CVE State: PUBLISHED
Explain CVE-2023-0181
NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in a kernel mode layer handler, where memory permissions are not correctly checked, which may lead to denial of service and data tampering.
Affected Products: vGPU software (guest driver - Windows), vGPU software (guest driver - Linux), vGPU software (Virtual GPU Manager - Citrix Hypervisor, VMware vSphere, Red Hat Enterprise Linux KVM), NVIDIA Cloud Gaming (guest driver - Windows), NVIDIA Cloud Gaming (guest driver - Linux), NVIDIA Cloud Gaming (Virtual GPU Manager - Red Hat Enterprise Linux KVM)
References: [{'url': 'https://nvidia.custhelp.com/app/answers/detail/a_id/5452'}]
CVE State: PUBLISHED
Explain CVE-2023-0182
NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer, where an out-of-bounds write can lead to denial of service, information disclosure, and data tampering.
Affected Products: vGPU software (guest driver - Windows), NVIDIA Cloud Gaming (guest driver - Windows)
References: [{'url': 'https://nvidia.custhelp.com/app/answers/detail/a_id/5452'}]
CVE State: PUBLISHED
Explain CVE-2023-0183
NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an out-of-bounds write can lead to denial of service and data tampering.
Affected Products: vGPU software (guest driver - Linux), vGPU software (Virtual GPU Manager - Citrix Hypervisor, VMware vSphere, Red Hat Enterprise Linux KVM), NVIDIA Cloud Gaming (guest driver - Linux), NVIDIA Cloud Gaming (Virtual GPU Manager - Red Hat Enterprise Linux KVM)
References: [{'url': 'https://nvidia.custhelp.com/app/answers/detail/a_id/5452'}]
CVE State: PUBLISHED
Explain CVE-2023-0185
NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer, where sign conversion issuescasting an unsigned primitive to signed may lead to denial of service or information disclosure.
Affected Products: vGPU software (Virtual GPU Manager - Citrix Hypervisor, VMware vSphere, Red Hat Enterprise Linux KVM), NVIDIA Cloud Gaming (Virtual GPU Manager - Red Hat Enterprise Linux KVM)
References: [{'url': 'https://nvidia.custhelp.com/app/answers/detail/a_id/5452'}]
CVE State: PUBLISHED
Explain CVE-2023-0186
NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer, where an out-of-bounds write can lead to denial of service and data tampering.
Affected Products: vGPU software (guest driver - Windows), NVIDIA Cloud Gaming (guest driver - Windows)
References: [{'url': 'https://nvidia.custhelp.com/app/answers/detail/a_id/5452'}]
CVE State: PUBLISHED
Explain CVE-2023-0187
NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer handler, where an out-of-bounds read can lead to denial of service.
Affected Products: vGPU software (guest driver - Windows), NVIDIA Cloud Gaming (guest driver - Windows)
References: [{'url': 'https://nvidia.custhelp.com/app/answers/detail/a_id/5452'}]
CVE State: PUBLISHED
Explain CVE-2023-0188
NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer handler, where an unprivileged user can cause improper restriction of operations within the bounds of a memory buffer cause an out-of-bounds read, which may lead to denial of service.
Affected Products: vGPU software (guest driver - Windows), vGPU software (guest driver - Linux), vGPU software (Virtual GPU Manager - Citrix Hypervisor, VMware vSphere, Red Hat Enterprise Linux KVM), NVIDIA Cloud Gaming (guest driver - Windows), NVIDIA Cloud Gaming (guest driver - Linux), NVIDIA Cloud Gaming (Virtual GPU Manager - Red Hat Enterprise Linux KVM)
References: [{'url': 'https://nvidia.custhelp.com/app/answers/detail/a_id/5452'}]
CVE State: PUBLISHED
Explain CVE-2023-0189
NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer handler which may lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.
Affected Products: vGPU software (guest driver - Linux), NVIDIA Cloud Gaming (guest driver - Linux)
References: [{'url': 'https://nvidia.custhelp.com/app/answers/detail/a_id/5452'}]
CVE State: PUBLISHED
Explain CVE-2023-0191
NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer handler, where an out-of-bounds access may lead to denial of service or data tampering.
Affected Products: vGPU software (guest driver - Windows), vGPU software (guest driver - Linux), vGPU software (Virtual GPU Manager - Citrix Hypervisor, VMware vSphere, Red Hat Enterprise Linux KVM), NVIDIA Cloud Gaming (guest driver - Windows), NVIDIA Cloud Gaming (guest driver - Linux), NVIDIA Cloud Gaming (Virtual GPU Manager - Red Hat Enterprise Linux KVM)
References: [{'url': 'https://nvidia.custhelp.com/app/answers/detail/a_id/5452'}]
CVE State: PUBLISHED
Explain CVE-2023-0192
NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer handler, where improper privilege management can lead to escalation of privileges and information disclosure.
Affected Products: vGPU software (Virtual GPU Manager - Citrix Hypervisor, VMware vSphere, Red Hat Enterprise Linux KVM), NVIDIA Cloud Gaming (Virtual GPU Manager - Red Hat Enterprise Linux KVM)
References: [{'url': 'https://nvidia.custhelp.com/app/answers/detail/a_id/5452'}]
CVE State: PUBLISHED
Explain CVE-2023-0193

NVIDIA CUDA Toolkit SDK contains a vulnerability in cuobjdump, where a local user running the tool against a malicious binary may cause an out-of-bounds read, which may result in a limited denial of service and limited information disclosure.


Affected Products: NVIDIA CUDA Toolkit
References: [{'url': 'https://nvidia.custhelp.com/app/answers/detail/a_id/5446'}]
CVE State: PUBLISHED
Explain CVE-2023-0194
NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer driver, where an invalid display configuration may lead to denial of service.
Affected Products: vGPU software (guest driver - Windows), NVIDIA Cloud Gaming (guest driver - Windows)
References: [{'url': 'https://nvidia.custhelp.com/app/answers/detail/a_id/5452'}]
CVE State: PUBLISHED
Explain CVE-2023-0195
NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer driver nvlddmkm.sys, where an can cause CWE-1284,
which may lead to hypothetical Information leak of unimportant data such as local variable data of the driver
Affected Products: vGPU software (guest driver - Windows), NVIDIA Cloud Gaming (guest driver - Windows)
References: [{'url': 'https://nvidia.custhelp.com/app/answers/detail/a_id/5452'}]
CVE State: PUBLISHED
Explain CVE-2023-0196

NVIDIA CUDA Toolkit SDK contains a bug in cuobjdump, where a local user running the tool against an ill-formed binary may cause a null- pointer dereference, which may result in a limited denial of service.


Affected Products: NVIDIA CUDA Toolkit
References: [{'url': 'https://nvidia.custhelp.com/app/answers/detail/a_id/5446'}]
CVE State: PUBLISHED
Explain CVE-2023-0197
NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager, where a malicious user in a guest VM can cause a NULL-pointer dereference, which may lead to denial of service.
Affected Products: vGPU software (Virtual GPU Manager - Citrix Hypervisor, VMware vSphere, Red Hat Enterprise Linux KVM), NVIDIA Cloud Gaming (Virtual GPU Manager - Red Hat Enterprise Linux KVM)
References: [{'url': 'https://nvidia.custhelp.com/app/answers/detail/a_id/5452'}]
CVE State: PUBLISHED
Explain CVE-2023-0198
NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer, where improper restriction of operations within the bounds of a memory buffer can lead to denial of service, information disclosure, and data tampering.
Affected Products: vGPU software (guest driver - Linux), vGPU software (Virtual GPU Manager - Citrix Hypervisor, VMware vSphere, Red Hat Enterprise Linux KVM), , NVIDIA Cloud Gaming (guest driver - Linux), NVIDIA Cloud Gaming (Virtual GPU Manager - Red Hat Enterprise Linux KVM)
References: [{'url': 'https://nvidia.custhelp.com/app/answers/detail/a_id/5452'}]
CVE State: PUBLISHED
Explain CVE-2023-0200
NVIDIA DGX-2 contains a vulnerability in OFBD where a user with high privileges and a pre-conditioned heap can cause an access beyond a buffers end, which may lead to code execution, escalation of privileges, denial of service, and information disclosure.
Affected Products: NVIDIA DGX servers
References: [{'url': 'https://nvidia.custhelp.com/app/answers/detail/a_id/5449'}]
CVE State: PUBLISHED
Explain CVE-2023-0201
NVIDIA DGX-2 SBIOS contains a vulnerability in Bds, where a user with high privileges can cause a write beyond the bounds of an indexable resource, which may lead to code execution, denial of service, compromised integrity, and information disclosure.
Affected Products: NVIDIA DGX servers
References: [{'url': 'https://nvidia.custhelp.com/app/answers/detail/a_id/5449'}]
CVE State: PUBLISHED
Explain CVE-2023-0202
NVIDIA DGX A100 SBIOS contains a vulnerability where an attacker may modify arbitrary memory of SMRAM by exploiting the GenericSio and LegacySmmSredir SMM APIs. A successful exploit of this vulnerability may lead to denial of service, escalation of privileges, and information disclosure.
Affected Products: NVIDIA DGX servers
References: [{'url': 'https://nvidia.custhelp.com/app/answers/detail/a_id/5449'}]
CVE State: PUBLISHED
Explain CVE-2023-0203
NVIDIA ConnectX-5, ConnectX-6, and ConnectX6-DX contain a vulnerability in the NIC firmware, where an unprivileged user can exploit insufficient granularity of access control, which may lead to denial of service.
Affected Products: NVIDIA ConnectX Firmware
References: [{'url': 'https://nvidia.custhelp.com/app/answers/detail/a_id/5459'}]
CVE State: PUBLISHED
Explain CVE-2023-0204
NVIDIA ConnectX-5, ConnectX-6, and ConnectX6-DX contain a vulnerability in the NIC firmware, where an unprivileged user can cause improper handling of exceptional conditions, which may lead to denial of service.
Affected Products: NVIDIA ConnectX Firmware
References: [{'url': 'https://nvidia.custhelp.com/app/answers/detail/a_id/5459'}]
CVE State: PUBLISHED
Explain CVE-2023-0205
NVIDIA ConnectX-5, ConnectX-6, and ConnectX6-DX contain a vulnerability in the NIC firmware, where an unprivileged user can exploit insufficient granularity of access control, which may lead to denial of service.
Affected Products: NVIDIA ConnectX Firmware
References: [{'url': 'https://nvidia.custhelp.com/app/answers/detail/a_id/5459'}]
CVE State: PUBLISHED
Explain CVE-2023-0206
NVIDIA DGX A100 SBIOS contains a vulnerability where an attacker may modify arbitrary memory of SMRAM by exploiting the NVME SMM API. A successful exploit of this vulnerability may lead to denial of service, escalation of privileges, and information disclosure.
Affected Products: NVIDIA DGX servers
References: [{'url': 'https://nvidia.custhelp.com/app/answers/detail/a_id/5449'}]
CVE State: PUBLISHED
Explain CVE-2023-0207
NVIDIA DGX-2 SBIOS contains a vulnerability where an attacker may modify the ServerSetup NVRAM variable at runtime by executing privileged code. A successful exploit of this vulnerability may lead to denial of service.
Affected Products: NVIDIA DGX servers
References: [{'url': 'https://nvidia.custhelp.com/app/answers/detail/a_id/5449'}]
CVE State: PUBLISHED
Explain CVE-2023-0208

NVIDIA DCGM for Linux contains a vulnerability in HostEngine (server component) where a user may cause a heap-based buffer overflow through the bound socket. A successful exploit of this vulnerability may lead to denial of service and data tampering.


Affected Products: DCGM
References: [{'url': 'https://nvidia.custhelp.com/app/answers/detail/a_id/5453'}]
CVE State: PUBLISHED