Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-33336 State: PUBLISHED Published: 2023-06-30T00:00:00 Last Updated: 2024-11-27T16:11:21.888Z Vendors: n/a Products: n/a Problem Types: n/a Description: Reflected cross site scripting (XSS) vulnerability was discovered in Sophos Web Appliance v4.3.9.1 that allows for arbitrary code to be inputted via the double quotes. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://inf0seq.github.io/cve/2023/04/30/Cross-site-scripting-%28XSS%29-in-Sophos-Web-Appliance-4.1.1-0.9.html
CVE ID: CVE-2023-33338 State: PUBLISHED Published: 2023-05-23T00:00:00.000Z Last Updated: 2025-01-31T15:30:57.301Z Vendors: n/a Products: n/a Problem Types: n/a Description: Old Age Home Management 1.0 is vulnerable to SQL Injection via the username parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/ANUJ-KUMAR/Old-Age-Home-Management-2022-2023-1.0
CVE ID: CVE-2023-33355 State: PUBLISHED Published: 2023-05-25T00:00:00 Last Updated: 2025-01-16T14:49:32.533Z Vendors: n/a Products: n/a Problem Types: n/a Description: IceCMS v1.0.0 has Insecure Permissions. There is unauthorized access to the API, resulting in the disclosure of sensitive information. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Thecosy/IceCMS/issues/7
CVE ID: CVE-2023-33356 State: PUBLISHED Published: 2023-05-25T00:00:00 Last Updated: 2024-08-02T15:47:05.087Z Vendors: n/a Products: n/a Problem Types: n/a Description: IceCMS v1.0.0 is vulnerable to Cross Site Scripting (XSS). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Thecosy/IceCMS/issues/8
CVE ID: CVE-2023-33359 State: PUBLISHED Published: 2023-05-23T00:00:00.000Z Last Updated: 2025-01-31T17:29:19.260Z Vendors: n/a Products: n/a Problem Types: n/a Description: Piwigo 13.6.0 is vulnerable to Cross Site Request Forgery (CSRF) in the "add tags" function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Piwigo/Piwigo/issues/1908
CVE ID: CVE-2023-33361 State: PUBLISHED Published: 2023-05-23T00:00:00.000Z Last Updated: 2025-01-31T15:34:35.058Z Vendors: n/a Products: n/a Problem Types: n/a Description: Piwigo 13.6.0 is vulnerable to SQL Injection via /admin/permalinks.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Piwigo/Piwigo/issues/1910
CVE ID: CVE-2023-33362 State: PUBLISHED Published: 2023-05-23T00:00:00.000Z Last Updated: 2025-04-16T14:03:03.973Z Vendors: n/a Products: n/a Problem Types: n/a Description: Piwigo 13.6.0 is vulnerable to SQL Injection via in the "profile" function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Piwigo/Piwigo/issues/1911 - https://github.com/MarkLee131/awesome-web-pocs/blob/main/CVE-2023-33362.md
CVE ID: CVE-2023-33363 State: PUBLISHED Published: 2023-08-03T00:00:00 Last Updated: 2024-10-17T19:48:31.981Z Vendors: n/a Products: n/a Problem Types: n/a Description: An authentication bypass vulnerability exists in Suprema BioStar 2 before 2.9.1, which allows unauthenticated users to access some functionality on BioStar 2 servers. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://kb.supremainc.com/knowledge/doku.php?id=en:release_note_291 - https://claroty.com/team82/disclosure-dashboard/cve-2023-33363
CVE ID: CVE-2023-33364 State: PUBLISHED Published: 2023-08-03T00:00:00 Last Updated: 2024-10-17T19:46:12.231Z Vendors: n/a Products: n/a Problem Types: n/a Description: An OS Command injection vulnerability exists in Suprema BioStar 2 before V2.9.1, which allows authenticated users to execute arbitrary OS commands on the BioStar 2 server. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://kb.supremainc.com/knowledge/doku.php?id=en:release_note_291 - https://claroty.com/team82/disclosure-dashboard/cve-2023-33364
CVE ID: CVE-2023-33365 State: PUBLISHED Published: 2023-08-03T00:00:00 Last Updated: 2024-10-17T19:43:20.130Z Vendors: n/a Products: n/a Problem Types: n/a Description: A path traversal vulnerability exists in Suprema BioStar 2 before 2.9.1, which allows unauthenticated attackers to fetch arbitrary files from the server's web server. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://kb.supremainc.com/knowledge/doku.php?id=en:release_note_291 - https://claroty.com/team82/disclosure-dashboard/cve-2023-33365
CVE ID: CVE-2023-33366 State: PUBLISHED Published: 2023-08-03T00:00:00 Last Updated: 2024-10-17T19:41:30.566Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection vulnerability exists in Suprema BioStar 2 before 2.9.1, which allows authenticated users to inject arbitrary SQL directives into an SQL statement and execute arbitrary SQL commands. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://kb.supremainc.com/knowledge/doku.php?id=en:release_note_291 - https://claroty.com/team82/disclosure-dashboard/cve-2023-33366
CVE ID: CVE-2023-33367 State: PUBLISHED Published: 2023-08-05T00:00:00 Last Updated: 2024-10-17T14:48:32.915Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection vulnerability exists in Control ID IDSecure 4.7.26.0 and prior, allowing unauthenticated attackers to write PHP files on the server's root directory, resulting in remote code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.controlid.com.br/en/access-control/idsecure/ - https://claroty.com/team82/disclosure-dashboard/cve-2023-33367
CVE ID: CVE-2023-33368 State: PUBLISHED Published: 2023-08-03T00:00:00 Last Updated: 2024-10-17T18:21:24.849Z Vendors: n/a Products: n/a Problem Types: n/a Description: Some API routes exists in Control ID IDSecure 4.7.26.0 and prior, exfiltrating sensitive information and passwords to users accessing these API routes. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.controlid.com.br/en/access-control/idsecure/ - https://claroty.com/team82/disclosure-dashboard/cve-2023-33368
CVE ID: CVE-2023-33369 State: PUBLISHED Published: 2023-08-03T00:00:00 Last Updated: 2024-10-17T18:20:31.373Z Vendors: n/a Products: n/a Problem Types: n/a Description: A path traversal vulnerability exists in Control ID IDSecure 4.7.26.0 and prior, allowing attackers to delete arbitrary files on IDSecure filesystem, causing a denial of service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.controlid.com.br/en/access-control/idsecure/ - https://claroty.com/team82/disclosure-dashboard/cve-2023-33369
CVE ID: CVE-2023-33370 State: PUBLISHED Published: 2023-08-03T00:00:00 Last Updated: 2024-10-17T18:18:03.522Z Vendors: n/a Products: n/a Problem Types: n/a Description: An uncaught exception vulnerability exists in Control ID IDSecure 4.7.26.0 and prior, allowing attackers to cause the main web server of IDSecure to fault and crash, causing a denial of service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.controlid.com.br/en/access-control/idsecure/ - https://claroty.com/team82/disclosure-dashboard/cve-2023-33370
CVE ID: CVE-2023-33371 State: PUBLISHED Published: 2023-08-03T00:00:00 Last Updated: 2024-10-17T16:46:34.211Z Vendors: n/a Products: n/a Problem Types: n/a Description: Control ID IDSecure 4.7.26.0 and prior uses a hardcoded cryptographic key in order to sign and verify JWT session tokens, allowing attackers to sign arbitrary session tokens and bypass authentication. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.controlid.com.br/en/access-control/idsecure/ - https://claroty.com/team82/disclosure-dashboard/cve-2023-33371
CVE ID: CVE-2023-33372 State: PUBLISHED Published: 2023-08-04T00:00:00 Last Updated: 2024-10-17T15:06:35.371Z Vendors: n/a Products: n/a Problem Types: n/a Description: Connected IO v2.1.0 and prior uses a hard-coded username/password pair embedded in their device's firmware used for device communication using MQTT. An attacker who gained access to these credentials is able to connect to the MQTT broker and send messages on behalf of devices, impersonating them. in order to sign and verify JWT session tokens, allowing attackers to sign arbitrary session tokens and bypass authentication. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.conn
thentication. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.connectedio.com/products/routers - https://claroty.com/team82/disclosure-dashboard/cve-2023-33372
CVE ID: CVE-2023-33373 State: PUBLISHED Published: 2023-08-04T00:00:00 Last Updated: 2024-10-17T15:33:01.497Z Vendors: n/a Products: n/a Problem Types: n/a Description: Connected IO v2.1.0 and prior keeps passwords and credentials in clear-text format, allowing attackers to exfiltrate the credentials and use them to impersonate the devices. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.connectedio.com/products/routers - https://claroty.com/team82/disclosure-dashboard/cve-2023-33373
CVE ID: CVE-2023-33374 State: PUBLISHED Published: 2023-08-04T00:00:00 Last Updated: 2024-10-17T15:30:32.383Z Vendors: n/a Products: n/a Problem Types: n/a Description: Connected IO v2.1.0 and prior has a command as part of its communication protocol allowing the management platform to specify arbitrary OS commands for devices to execute. Attackers abusing this dangerous functionality may issue all devices OS commands to execute, resulting in arbitrary remote command execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.connectedio.com/products/routers - https://claroty.com/team82/disclosure-dashboard/cve-2023-33374
CVE ID: CVE-2023-33375 State: PUBLISHED Published: 2023-08-04T00:00:00 Last Updated: 2024-10-17T15:30:03.999Z Vendors: n/a Products: n/a Problem Types: n/a Description: Connected IO v2.1.0 and prior has a stack-based buffer overflow vulnerability in its communication protocol, enabling attackers to take control over devices. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.connectedio.com/products/routers - https://claroty.com/team82/disclosure-dashboard/cve-2023-33375
CVE ID: CVE-2023-33376 State: PUBLISHED Published: 2023-08-04T00:00:00 Last Updated: 2024-10-17T14:56:35.609Z Vendors: n/a Products: n/a Problem Types: n/a Description: Connected IO v2.1.0 and prior has an argument injection vulnerability in its iptables command message in its communication protocol, enabling attackers to execute arbitrary OS commands on devices. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.connectedio.com/products/routers - https://claroty.com/team82/disclosure-dashboard/cve-2023-33376
CVE ID: CVE-2023-33377 State: PUBLISHED Published: 2023-08-04T00:00:00 Last Updated: 2024-10-17T15:29:31.689Z Vendors: n/a Products: n/a Problem Types: n/a Description: Connected IO v2.1.0 and prior has an OS command injection vulnerability in the set firewall command in part of its communication protocol, enabling attackers to execute arbitrary OS commands on devices. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.connectedio.com/products/routers - https://claroty.com/team82/disclosure-dashboard/cve-2023-33377
CVE ID: CVE-2023-33378 State: PUBLISHED Published: 2023-08-04T00:00:00 Last Updated: 2024-10-17T15:28:54.358Z Vendors: n/a Products: n/a Problem Types: n/a Description: Connected IO v2.1.0 and prior has an argument injection vulnerability in its AT command message in its communication protocol, enabling attackers to execute arbitrary OS commands on devices. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.connectedio.com/products/routers - https://claroty.com/team82/disclosure-dashboard/cve-2023-33378
CVE ID: CVE-2023-33379 State: PUBLISHED Published: 2023-08-04T00:00:00 Last Updated: 2024-10-17T15:16:20.577Z Vendors: n/a Products: n/a Problem Types: n/a Description: Connected IO v2.1.0 and prior has a misconfiguration in their MQTT broker used for management and device communication, which allows devices to connect to the broker and issue commands to other device, impersonating Connected IO management platform and sending commands to all of Connected IO's devices. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.connectedio.com/products/routers - https://claroty.com/team82/disclosure-dashboard/cve-2023-33379
CVE ID: CVE-2023-33381 State: PUBLISHED Published: 2023-06-06T00:00:00 Last Updated: 2025-01-08T15:40:13.063Z Vendors: n/a Products: n/a Problem Types: n/a Description: A command injection vulnerability was found in the ping functionality of the MitraStar GPT-2741GNAC router (firmware version AR_g5.8_110WVN0b7_2). The vulnerability allows an authenticated user to execute arbitrary OS commands by sending specially crafted input to the router via the ping function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://mitrastar.com - http://gpt-2741gnac.com - https://github.com/duality084/CVE-2023-33381-MitraStar-GPT-2741GNAC/blob/main/README.md
CVE ID: CVE-2023-33383 State: PUBLISHED Published: 2023-08-02T00:00:00 Last Updated: 2024-10-17T18:24:47.130Z Vendors: n/a Products: n/a Problem Types: n/a Description: Shelly 4PM Pro four-channel smart switch 0.11.0 allows an attacker to trigger a BLE out of bounds read fault condition that results in a device reload. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.exploitsecurity.io/post/cve-2023-33383-authentication-bypass-via-an-out-of-bounds-read-vulnerability - http://packetstormsecurity.com/files/173954/Shelly-PRO-4PM-0.11.0-Authentication-Bypass.html
CVE ID: CVE-2023-33386 State: PUBLISHED Published: 2023-06-05T00:00:00 Last Updated: 2025-01-08T19:37:17.801Z Vendors: n/a Products: n/a Problem Types: n/a Description: MarsCTF 1.2.1 has an arbitrary file upload vulnerability in the interface for uploading attachments in the background. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/b1ackc4t/MarsCTF/blob/V1.2.1/src/main/java/com/b1ackc4t/marsctfserver/service/impl/CTFFileServiceImpl.java#L46 - https://github.com/b1ackc4t/MarsCTF/issues/10
CVE ID: CVE-2023-33387 State: PUBLISHED Published: 2023-06-22T00:00:00 Last Updated: 2024-12-06T15:23:22.632Z Vendors: n/a Products: n/a Problem Types: n/a Description: A reflected cross-site scripting (XSS) vulnerability in DATEV eG Personal-Management System Comfort/Comfort Plus v15.1.0 to v16.1.1 P4 allows attackers to steal targeted users' login data by sending a crafted link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.veda.net/datev.php - https://apps.datev.de/help-center/documents/1021479 - https://www.tuv.com/landingpage/de/schwachstelle/
CVE ID: CVE-2023-33394 State: PUBLISHED Published: 2023-05-26T00:00:00 Last Updated: 2025-01-15T19:47:28.416Z Vendors: n/a Products: n/a Problem Types: n/a Description: skycaiji v2.5.4 is vulnerable to Cross Site Scripting (XSS). Attackers can achieve backend XSS by deploying malicious JSON data. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wanheiqiyihu.top/2023/05/02/skycaiji-v2-5-4-has-a-backend-xss-vulnerability/
CVE ID: CVE-2023-33404 State: PUBLISHED Published: 2023-06-26T00:00:00 Last Updated: 2024-12-03T17:18:13.843Z Vendors: n/a Products: n/a Problem Types: n/a Description: An Unrestricted Upload vulnerability, due to insufficient validation on UploadControlled.cs file, in BlogEngine.Net version 3.3.8.0 and earlier allows remote attackers to execute remote code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/hacip/CVE-2023-33404
CVE ID: CVE-2023-33405 State: PUBLISHED Published: 2023-06-21T00:00:00 Last Updated: 2024-12-06T17:11:39.560Z Vendors: n/a Products: n/a Problem Types: n/a Description: Blogengine.net 3.3.8.0 and earlier is vulnerable to Open Redirect. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/hacip/CVE-2023-33405
CVE ID: CVE-2023-33408 State: PUBLISHED Published: 2023-06-05T00:00:00 Last Updated: 2025-01-08T19:34:56.418Z Vendors: n/a Products: n/a Problem Types: n/a Description: Minical 1.0.0 is vulnerable to Cross Site Scripting (XSS). The vulnerability exists due to insufficient input validation in the application's user input handling in the security_helper.php file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/minical/minical - https://github.com/Thirukrishnan/CVE-2023-33408
CVE ID: CVE-2023-33409 State: PUBLISHED Published: 2023-06-05T00:00:00 Last Updated: 2025-01-08T19:01:05.330Z Vendors: n/a Products: n/a Problem Types: n/a Description: Minical 1.0.0 is vulnerable to Cross Site Request Forgery (CSRF) via minical/public/application/controllers/settings/company.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/minical/minical - https://github.com/Thirukrishnan/CVE-2023-33409
CVE ID: CVE-2023-33410 State: PUBLISHED Published: 2023-06-05T00:00:00 Last Updated: 2025-01-08T18:56:13.235Z Vendors: n/a Products: n/a Problem Types: n/a Description: Minical 1.0.0 and earlier contains a CSV injection vulnerability which allows an attacker to execute remote code. The vulnerability exists due to insufficient input validation on the Customer Name field in the Accounting module that is used to construct a CSV file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/minical/minical - https://github.com/Thirukrishnan/CVE-2023-33410
CVE ID: CVE-2023-33411 State: PUBLISHED Published: 2023-12-07T00:00:00 Last Updated: 2024-11-26T15:28:31.828Z Vendors: n/a Products: n/a Problem Types: n/a Description: A web server in the Intelligent Platform Management Interface (IPMI) baseboard management controller (BMC) implementation on Supermicro X11 and M11 based devices, with firmware versions up to 3.17.02, allows remote unauthenticated users to perform directory traversal, potentially disclosing sensitive information. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://supermicro.com - https://www.supermicro.com/en/support/security_BMC_Dec_2023
CVE ID: CVE-2023-33412 State: PUBLISHED Published: 2023-12-07T00:00:00 Last Updated: 2024-08-02T15:47:05.628Z Vendors: n/a Products: n/a Problem Types: n/a Description: The web interface in the Intelligent Platform Management Interface (IPMI) baseboard management controller (BMC) implementation on Supermicro X11 and M11 based devices, with firmware versions before 3.17.02, allows remote authenticated users to execute arbitrary commands via a crafted request targeting vulnerable cgi endpoints. Additional Analyst Notes: - CVE Program Container: References: - http://supermicro.com - https://www.supermicro.com/en/support/security_BMC_Dec_2023
CVE ID: CVE-2023-33413 State: PUBLISHED Published: 2023-12-07T00:00:00 Last Updated: 2024-08-02T15:47:05.256Z Vendors: n/a Products: n/a Problem Types: n/a Description: The configuration functionality in the Intelligent Platform Management Interface (IPMI) baseboard management controller (BMC) implementation on Supermicro X11 and M11 based devices, with firmware versions through 3.17.02, allows remote authenticated users to execute arbitrary commands. Additional Analyst Notes: - CVE Program Container: References: - http://supermicro.com - https://www.supermicro.com/en/support/security_BMC_Dec_2023
CVE ID: CVE-2023-33438 State: PUBLISHED Published: 2023-06-16T00:00:00 Last Updated: 2024-12-12T18:57:25.414Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored Cross-site scripting (XSS) vulnerability in Wolters Kluwer TeamMate+ 35.0.11.0 allows remote attackers to inject arbitrary web script or HTML. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://wolters.com - https://github.com/justas-dee/CVEs/blob/main/CVE-2023-33438/README.md
CVE ID: CVE-2023-33439 State: PUBLISHED Published: 2023-05-26T00:00:00 Last Updated: 2025-01-14T20:37:52.122Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sourcecodester Faculty Evaluation System v1.0 is vulnerable to SQL Injection via /eval/admin/manage_task.php?id=. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/F14me7wq/bug_report/blob/main/vendors/oretnom23/faculty-evaluation-system/SQLi-1.md
CVE ID: CVE-2023-33440 State: PUBLISHED Published: 2023-05-26T00:00:00 Last Updated: 2025-01-14T20:11:37.723Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sourcecodester Faculty Evaluation System v1.0 is vulnerable to arbitrary code execution via /eval/ajax.php?action=save_user. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/F14me7wq/bug_report/blob/main/vendors/oretnom23/faculty-evaluation-system/RCE-1.md - http://packetstormsecurity.com/files/172672/Faculty-Evaluation-System-1.0-Shell-Upload.html
CVE ID: CVE-2023-33443 State: PUBLISHED Published: 2023-06-08T00:00:00 Last Updated: 2025-01-06T20:37:01.456Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in the administrative functionalities of BES--6024PB-I50H1 VideoPlayTool v2.0.1.0 allow attackers to execute arbitrary administrative commands via a crafted payload sent to the desired endpoints. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/FallFur/exploiting-unprotected-admin-funcionalities-on-besder-ip-cameras/
CVE ID: CVE-2023-33457 State: PUBLISHED Published: 2023-06-06T00:00:00 Last Updated: 2025-01-08T15:38:01.313Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Sogou Workflow v0.10.6, memcpy a negtive size in URIParser::parse , may cause buffer-overflow and crash. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/sogou/workflow/issues/1272
CVE ID: CVE-2023-33460 State: PUBLISHED Published: 2023-06-06T00:00:00 Last Updated: 2025-01-08T16:24:46.526Z Vendors: n/a Products: n/a Problem Types: n/a Description: There's a memory leak in yajl 2.1.0 with use of yajl_tree_parse function. which will cause out-of-memory in server and cause crash. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/lloyd/yajl/issues/250 - https://lists.debian.org/debian-lts-announce/2023/07/msg00000.html - https://lists.debian.org/debian-lts-announce/2023/07/msg00013.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KLE3C4CECEJ4EUYI56KXI6OWACWXX7W
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KLE3C4CECEJ4EUYI56KXI6OWACWXX7WN/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IBUUHG27RM4ROEYKMVRROR27AX6R63MB/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YO32YDJ74DADC7CMJNLSLBVWN5EXGF5J/ - https://lists.debian.org/debian-lts-announce/2023/08/msg00003.html