Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-40969 State: PUBLISHED Published: 2023-09-01T00:00:00 Last Updated: 2024-10-01T13:16:34.971Z Vendors: n/a Products: n/a Problem Types: n/a Description: Senayan Library Management Systems SLIMS 9 Bulian v9.6.1 is vulnerable to Server Side Request Forgery (SSRF) via admin/modules/bibliography/pop_p2p.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/komangsughosa/CVE-ID-not-yet/blob/main/slims/slims9_bulian-9.6.1-SSRF-pop_p2p.md - https://github.com/slims/slims9_bulian/issues/204
CVE ID: CVE-2023-40970 State: PUBLISHED Published: 2023-09-01T00:00:00 Last Updated: 2024-10-01T13:15:52.563Z Vendors: n/a Products: n/a Problem Types: n/a Description: Senayan Library Management Systems SLIMS 9 Bulian v 9.6.1 is vulnerable to SQL Injection via admin/modules/circulation/loan_rules.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/slims/slims9_bulian/issues/205 - https://github.com/komangsughosa/CVE-ID-not-yet/blob/main/slims/slims9_bulian-9.6.1-SQLI-loan_rules.md
CVE ID: CVE-2023-40980 State: PUBLISHED Published: 2023-09-01T00:00:00 Last Updated: 2024-09-30T20:26:54.937Z Vendors: n/a Products: n/a Problem Types: n/a Description: File Upload vulnerability in DWSurvey DWSurvey-OSS v.3.2.0 and before allows a remote attacker to execute arbitrary code via the saveimage method and savveFile in the action/UploadAction.java file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/wkeyuan/DWSurvey/issues/107
CVE ID: CVE-2023-40982 State: PUBLISHED Published: 2023-09-15T00:00:00 Last Updated: 2024-09-25T18:08:00.827Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability in Webmin v2.100 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the cloned module name parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://webmin.com - https://github.com/Vi39/Webmin-2.100/blob/main/CVE-2023-40982
CVE ID: CVE-2023-40983 State: PUBLISHED Published: 2023-09-15T00:00:00 Last Updated: 2024-09-25T15:44:40.955Z Vendors: n/a Products: n/a Problem Types: n/a Description: A reflected cross-site scripting (XSS) vulnerability in the File Manager function of Webmin v2.100 allows attackers to execute malicious scripts via injecting a crafted payload into the Find in Results file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://webmin.com - https://github.com/Vi39/Webmin-2.100/blob/main/CVE-2023-40983
CVE ID: CVE-2023-40984 State: PUBLISHED Published: 2023-09-15T00:00:00 Last Updated: 2024-09-25T15:38:02.147Z Vendors: n/a Products: n/a Problem Types: n/a Description: A reflected cross-site scripting (XSS) vulnerability in the File Manager function of Webmin v2.100 allows attackers to execute malicious scripts via injecting a crafted payload into the Replace in Results file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://webmin.com - https://github.com/Vi39/Webmin-2.100/blob/main/CVE-2023-40984
CVE ID: CVE-2023-40985 State: PUBLISHED Published: 2023-09-15T00:00:00 Last Updated: 2024-09-25T15:36:46.617Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Webmin 2.100. The File Manager functionality allows an attacker to exploit a Cross-Site Scripting (XSS) vulnerability. By providing a malicious payload, an attacker can inject arbitrary code, which is then executed within the context of the victim's browser when any file is searched/replaced. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://webmin.com - https://github.com/Vi39/Webmin-2.100/blob/main/CVE-2023-40985
CVE ID: CVE-2023-40986 State: PUBLISHED Published: 2023-09-15T00:00:00 Last Updated: 2024-09-25T15:34:38.856Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability in the Usermin Configuration function of Webmin v2.100 allows attackers to execute arbitrary web sripts or HTML via a crafted payload injected into the Custom field. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://webmin.com - https://github.com/Vi39/Webmin-2.100/blob/main/CVE-2023-40986
CVE ID: CVE-2023-40989 State: PUBLISHED Published: 2023-09-22T00:00:00 Last Updated: 2024-09-24T16:29:58.541Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerbility in jeecgboot jeecg-boot v 3.0, 3.5.3 that allows a remote attacker to execute arbitrary code via a crafted request to the report/jeecgboot/jmreport/queryFieldBySql component. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Zone1-Z/CVE-2023-40989/blob/main/CVE-2023-40989
CVE ID: CVE-2023-40992 State: PUBLISHED Published: 2025-08-07T00:00:00.000Z Last Updated: 2025-08-07T20:36:08.993Z Vendors: n/a Products: n/a Problem Types: n/a Description: Hospital Management System 4 is vulnerable to a SQL injection in /Hospital-Management-System-master/func.php via the password2 parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/kishan0725/Hospital-Management-System - https://gist.github.com/celbahraoui/606fc8159738c06c41ece15182a6934f
CVE ID: CVE-2023-40997 State: PUBLISHED Published: 2023-08-28T00:00:00 Last Updated: 2024-08-02T18:46:11.496Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer Overflow vulnerability in O-RAN Software Community ric-plt-lib-rmr v.4.9.0 allows a remote attacker to cause a denial of service via a crafted packet. Additional Analyst Notes: - CVE Program Container: References: - https://jira.o-ran-sc.org/browse/RIC-991 - https://www.trendmicro.com/en_us/research/23/l/the-current-state-of-open-ran-security.html
CVE ID: CVE-2023-40998 State: PUBLISHED Published: 2023-08-28T00:00:00 Last Updated: 2024-08-02T18:46:11.503Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer Overflow vulnerability in O-RAN Software Community ric-plt-lib-rmr v.4.9.0 allows a remote attacker to cause a denial of service via the packet size component. Additional Analyst Notes: - CVE Program Container: References: - https://jira.o-ran-sc.org/browse/RIC-989 - https://www.trendmicro.com/en_us/research/23/l/the-current-state-of-open-ran-security.html
CVE ID: CVE-2023-41000 State: PUBLISHED Published: 2023-09-11T00:00:00 Last Updated: 2024-09-26T15:58:46.765Z Vendors: n/a Products: n/a Problem Types: n/a Description: GPAC through 2.2.1 has a use-after-free vulnerability in the function gf_bifs_flush_command_list in bifs/memory_decoder.c. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/gpac/gpac/issues/2550
CVE ID: CVE-2023-41005 State: PUBLISHED Published: 2023-08-28T00:00:00 Last Updated: 2024-10-02T15:03:12.408Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Pagekit pagekit v.1.0.18 alows a remote attacker to execute arbitrary code via thedownloadAction and updateAction functions in UpdateController.php Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/pagekit/pagekit/issues/977
CVE ID: CVE-2023-41009 State: PUBLISHED Published: 2023-09-05T00:00:00 Last Updated: 2024-09-30T17:23:29.535Z Vendors: n/a Products: n/a Problem Types: n/a Description: File Upload vulnerability in adlered bolo-solo v.2.6 allows a remote attacker to execute arbitrary code via a crafted script to the authorization field in the header. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://adlered.com - https://github.com/adlered/bolo-solo - https://github.com/Rabb1tQ/HillstoneCVEs/blob/main/CVE-2023-41009/CVE-2023-41009.md
CVE ID: CVE-2023-41010 State: PUBLISHED Published: 2023-09-14T00:00:00 Last Updated: 2024-09-25T18:28:08.621Z Vendors: n/a Products: n/a Problem Types: n/a Description: Insecure Permissions vulnerability in Sichuan Tianyi Kanghe Communication Co., Ltd China Telecom Tianyi Home Gateway v.TEWA-700G allows a local attacker to obtain sensitive information via the default password parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/te5tb99/For-submitting/wiki/China-Telecom-Tianyi-Home-Gateway-TEWA%E2%80%90700G
CVE ID: CVE-2023-41011 State: PUBLISHED Published: 2023-09-14T00:00:00 Last Updated: 2024-09-25T19:38:39.279Z Vendors: n/a Products: n/a Problem Types: n/a Description: Command Execution vulnerability in China Mobile Communications China Mobile Intelligent Home Gateway v.HG6543C4 allows a remote attacker to execute arbitrary code via the shortcut_telnet.cg component. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/te5tb99/For-submitting/wiki/Command-Execution-Vulnerability-in-China-Mobile-Intelligent-Home-Gateway-HG6543C4
CVE ID: CVE-2023-41012 State: PUBLISHED Published: 2023-09-05T00:00:00 Last Updated: 2024-09-30T17:22:29.131Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in China Mobile Communications China Mobile Intelligent Home Gateway v.HG6543C4 allows a remote attacker to execute arbitrary code via the authentication mechanism. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/te5tb99/For-submitting/wiki/Command-Execution-Vulnerability-in-China-Mobile-Intelligent-Home-Gateway-HG6543C4-Identity-verification-has-design-flaws
CVE ID: CVE-2023-41013 State: PUBLISHED Published: 2023-09-12T00:00:00 Last Updated: 2024-09-26T14:29:11.209Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) in Webmail Calendar in IceWarp 10.3.1 allows remote attackers to inject arbitrary web script or HTML via the "p4" field. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://icewrap.com - https://medium.com/%40katikitala.sushmitha078/cve-2023-41013-789841dcad91
CVE ID: CVE-2023-41014 State: PUBLISHED Published: 2024-03-07T00:00:00.000Z Last Updated: 2025-03-26T20:11:11.451Z Vendors: n/a Products: n/a Problem Types: n/a Description: code-projects.org Online Job Portal 1.0 is vulnerable to SQL Injection via the Username parameter for "Employer." Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ASR511-OO7/CVE-2023-41014/blob/main/CVE-28
CVE ID: CVE-2023-41015 State: PUBLISHED Published: 2024-03-07T00:00:00 Last Updated: 2024-11-07T19:11:07.342Z Vendors: n/a Products: n/a Problem Types: n/a Description: code-projects.org Online Job Portal 1.0 is vulnerable to SQL Injection via /Employer/DeleteJob.php?JobId=1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/ASR511-OO7/CVE-2023-41015/blob/main/CVE-27
CVE ID: CVE-2023-41027 State: PUBLISHED Published: 2023-09-22T16:06:05.266Z Last Updated: 2024-09-24T18:06:58.998Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Juplink Products: RX4-1500 Problem Types: CWE-210 Description: Credential disclosure in the '/webs/userpasswd.htm' endpoint in Juplink RX4-1500 Wifi router firmware versions V1.0.4 and V1.0.5 allows an authenticated attacker to leak the password for the administrative account via requests to the vulnerable endpoint. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://blog.exodusintel.com/2023/09/18/juplink-rx4-1500-credential-disclosure-vulnerability/
CVE ID: CVE-2023-41028 State: PUBLISHED Published: 2023-08-23T21:47:26.833Z Last Updated: 2024-10-03T13:39:37.389Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Juplink Products: RX4-1500 Problem Types: CWE-121 Description: A stack-based buffer overflow exists in Juplink RX4-1500, a WiFi router, in versions 1.0.2 through 1.0.5. An authenticated attacker can exploit this vulnerability to achieve code execution as root. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://blog.exodusintel.com/2023/08/23/juplink-rx4-1500-stack-based-buffer-overflow-vulnerability/
CVE ID: CVE-2023-41029 State: PUBLISHED Published: 2023-09-22T16:07:12.826Z Last Updated: 2024-09-24T18:05:12.853Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Juplink Products: RX4-1500 Problem Types: CWE-77 Description: Command injection vulnerability in the homemng.htm endpoint in Juplink RX4-1500 Wifi router firmware versions V1.0.2, V1.0.3, V1.0.4, and V1.0.5 allows authenticated remote attackers to execute commands as root via specially crafted HTTP requests to the vulnerable endpoint. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://blog.exodusintel.com/2023/09/18/juplink-rx4-1500-command-injection-vulne
- CISA ADP Vulnrichment: References: - https://blog.exodusintel.com/2023/09/18/juplink-rx4-1500-command-injection-vulnerability/
CVE ID: CVE-2023-41030 State: PUBLISHED Published: 2023-09-18T18:22:08.377Z Last Updated: 2024-09-25T14:05:54.698Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: Juplink Products: RX4-1500 Problem Types: CWE-259 Description: Hard-coded credentials in Juplink RX4-1500 versions V1.0.2 through V1.0.5 allow unauthenticated attackers to log in to the web interface or telnet service as the 'user' user. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://blog.exodusintel.com/2023/09/18/juplink-rx4-1500-hard-coded-credential-vulnerability/
CVE ID: CVE-2023-41031 State: PUBLISHED Published: 2023-09-22T16:07:59.041Z Last Updated: 2024-09-24T18:03:52.388Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Juplink Products: RX4-1500 Problem Types: CWE-77 Description: Command injection in homemng.htm in Juplink RX4-1500 versions V1.0.2, V1.0.3, V1.0.4, and V1.0.5 allows remote authenticated attackers to execute commands via specially crafted requests to the vulnerable endpoint. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://blog.exodusintel.com/2023/09/18/juplink-rx4-1500-homemng-command-injection-vulnerability/
CVE ID: CVE-2023-41032 State: PUBLISHED Published: 2023-09-12T09:32:33.893Z Last Updated: 2025-02-27T20:55:11.015Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: Parasolid V34.1, Parasolid V35.0, Parasolid V35.1, Parasolid V36.0, Simcenter Femap V2301, Simcenter Femap V2306 Problem Types: CWE-787 Description: A vulnerability has been identified in Parasolid V34.1 (All versions < V34.1.258), Parasolid V35.0 (All versions < V35.0.253), Parasolid V35.1 (All versions < V35.1.184), Parasolid V36.0 (All versions < V36.0.142), Simcenter Femap V2301 (All versions < V2301.0003), Simcenter Femap V2306 (All versions < V2306.0001). The aff
36.0.142), Simcenter Femap V2301 (All versions < V2301.0003), Simcenter Femap V2306 (All versions < V2306.0001). The affected application contains an out of bounds write past the end of an allocated structure while parsing specially crafted X_T files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-21263) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-190839.pdf - https://cert-portal.siemens.com/productcert/pdf/ssa-887122.pdf - https://www.bentley.com/advisories/be-2023-0004/
CVE ID: CVE-2023-41033 State: PUBLISHED Published: 2023-09-12T09:32:34.938Z Last Updated: 2025-02-27T20:55:04.635Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: Parasolid V35.0, Parasolid V35.1, Parasolid V36.0, Simcenter Femap V2301, Simcenter Femap V2306 Problem Types: CWE-787 Description: A vulnerability has been identified in Parasolid V35.0 (All versions < V35.0.260), Parasolid V35.1 (All versions < V35.1.246), Parasolid V36.0 (All versions < V36.0.156), Simcenter Femap V2301 (All versions < V2301.0003), Simcenter Femap V2306 (All versions < V2306.0001). The affected application contains an out of bounds write past the en
Simcenter Femap V2306 (All versions < V2306.0001). The affected application contains an out of bounds write past the end of an allocated structure while parsing specially crafted X_T files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-21266) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-190839.pdf - https://cert-portal.siemens.com/productcert/pdf/ssa-887122.pdf
CVE ID: CVE-2023-41034 State: PUBLISHED Published: 2023-08-31T17:01:38.082Z Last Updated: 2024-09-27T14:17:15.256Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N) Vendors: eclipse-leshan Products: leshan Problem Types: CWE-611 Description: Eclipse Leshan is a device management server and client Java implementation. In affected versions DDFFileParser` and `DefaultDDFFileValidator` (and so `ObjectLoader`) are vulnerable to `XXE Attacks`. A DDF file is a LWM2M format used to store LWM2M object description. Leshan users are impacted only if they parse untrusted DDF files (e.g. if they let external users provide their own model), in that case they MUST upgrade to fixed ve
ntrusted DDF files (e.g. if they let external users provide their own model), in that case they MUST upgrade to fixed version. If you parse only trusted DDF file and validate only with trusted xml schema, upgrading is not mandatory. This issue has been fixed in versions 1.5.0 and 2.0.0-M13. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/eclipse-leshan/leshan/security/advisories/GHSA-wc9j-gc65-3cm7 - https://github.com/eclipse-leshan/leshan/commit/29577d2879ba8e7674c3b216a7f01193fc7ae013 - https://github.com/eclipse-leshan/leshan/commit/4d3e63ac271
han/leshan/commit/29577d2879ba8e7674c3b216a7f01193fc7ae013 - https://github.com/eclipse-leshan/leshan/commit/4d3e63ac271a817f81fba3e3229c519af7a3049c - https://github.com/eclipse-leshan/leshan/wiki/Adding-new-objects#the-lwm2m-model - https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing
CVE ID: CVE-2023-41036 State: PUBLISHED Published: 2023-09-12T19:48:15.108Z Last Updated: 2024-11-27T16:17:52.371Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: macvim-dev Products: macvim Problem Types: CWE-269 Description: Macvim is a text editor for MacOS. Prior to version 178, Macvim makes use of an insecure interprocess communication (IPC) mechanism which could lead to a privilege escalation. Distributed objects are a concept introduced by Apple which allow one program to vend an interface to another program. What is not made clear in the documentation is that this service can vend this interface to any other program on the machine. The impact of exploi
the documentation is that this service can vend this interface to any other program on the machine. The impact of exploitation is a privilege escalation to root - this is likely to affect anyone who is not careful about the software they download and use MacVim to edit files that would require root privileges. Version 178 contains a fix for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/macvim-dev/macvim/security/advisories/GHSA-9jgj-jfwg-99fv - https://github.com/macvim-dev/macvim/commit/399b43e9e1dbf656a1780e87344f4d3c875e4cda - https://github.com/macvim-dev/macvim/blob/d9de087dddadbfd82fcb5dc9734380a2f829bd0a/src/Ma
f656a1780e87344f4d3c875e4cda - https://github.com/macvim-dev/macvim/blob/d9de087dddadbfd82fcb5dc9734380a2f829bd0a/src/MacVim/MMAppController.h#L28 - https://github.com/macvim-dev/macvim/blob/d9de087dddadbfd82fcb5dc9734380a2f829bd0a/src/MacVim/MMBackend.h
CVE ID: CVE-2023-41037 State: PUBLISHED Published: 2023-08-29T16:46:47.708Z Last Updated: 2024-09-30T17:43:47.802Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: openpgpjs Products: openpgpjs Problem Types: CWE-347 Description: OpenPGP.js is a JavaScript implementation of the OpenPGP protocol. In affected versions OpenPGP Cleartext Signed Messages are cryptographically signed messages where the signed text is readable without special tools. These messages typically contain a "Hash: ..." header declaring the hash algorithm used to compute the signature digest. OpenPGP.js up to v5.9.0 ignored any data preceding the "Hash: ..." texts when verifying the signatu
he signature digest. OpenPGP.js up to v5.9.0 ignored any data preceding the "Hash: ..." texts when verifying the signature. As a result, malicious parties could add arbitrary text to a third-party Cleartext Signed Message, to lead the victim to believe that the arbitrary text was signed. A user or application is vulnerable to said attack vector if it verifies the CleartextMessage by only checking the returned `verified` property, discarding the associated `data` information, and instead _visually trusting_ the contents of the original message. Since `verificationResult.data` would always contain the actual signed data, users and apps that check this information are not vulnerable. Similarly,
` would always contain the actual signed data, users and apps that check this information are not vulnerable. Similarly, given a CleartextMessage object, retrieving the data using `getText()` or the `text` field returns only the contents that are considered when verifying the signature. Finally, re-armoring a CleartextMessage object (using `armor()` will also result in a "sanitised" version, with the extraneous text being removed. This issue has been addressed in version 5.10.1 (current stable version) which will reject messages when calling `openpgp.readCleartextMessage()` and in version 4.10.11 (legacy version) which will will reject messages when calling `openpgp.cleartext.readArmored()`.
and in version 4.10.11 (legacy version) which will will reject messages when calling `openpgp.cleartext.readArmored()`. Users are advised to upgrade. Users unable to upgrade should check the contents of `verificationResult.data` to see what data was actually signed, rather than visually trusting the contents of the armored message. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/openpgpjs/openpgpjs/security/advisories/GHSA-ch3c-v47x-4pgp - https://github.com/openpgpjs/openpgpjs/commit/6b43e02a254853f5ff508ebd1b07541f78b7c566
CVE ID: CVE-2023-41038 State: PUBLISHED Published: 2024-03-20T14:22:50.484Z Last Updated: 2024-08-13T16:44:27.739Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: FirebirdSQL Products: firebird Problem Types: CWE-770 Description: Firebird is a relational database. Versions 4.0.0 through 4.0.3 and version 5.0 beta1 are vulnerable to a server crash when a user uses a specific form of SET BIND statement. Any non-privileged user with minimum access to a server may type a statement with a long `CHAR` length, which causes the server to crash due to stack corruption. Versions 4.0.4.2981 and 5.0.0.117 contain fixes for this issue. No known workarounds are available. A
stack corruption. Versions 4.0.4.2981 and 5.0.0.117 contain fixes for this issue. No known workarounds are available. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/FirebirdSQL/firebird/security/advisories/GHSA-6fv8-8rwr-9692 - https://firebirdsql.org/en/snapshot-builds