Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-35968 State: PUBLISHED Published: 2023-10-11T15:14:27.992Z Last Updated: 2025-11-04T19:17:00.631Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Yifan Products: YF325 Problem Types: CWE-190 Description: Two heap-based buffer overflow vulnerabilities exist in the gwcfg_cgi_set_manage_post_data functionality of Yifan YF325 v1.0_20221108. A specially crafted network request can lead to a heap buffer overflow. An attacker can send a network request to trigger these vulnerabilities.This integer overflow result is used as argument for the realloc function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: -
ment for the realloc function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1788
CVE ID: CVE-2023-35969 State: PUBLISHED Published: 2024-01-08T14:47:57.931Z Last Updated: 2025-11-04T18:15:03.818Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: GTKWave Products: GTKWave Problem Types: CWE-119 Description: Multiple heap-based buffer overflow vulnerabilities exist in the fstReaderIterBlocks2 chain_table parsing functionality of GTKWave 3.3.115. A specially crafted .fst file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the chain_table of `FST_BL_VCDATA` and `FST_BL_VCDATA_DYN_ALIAS` section types. Additional Analyst Notes: - CVE Program Container
_table of `FST_BL_VCDATA` and `FST_BL_VCDATA_DYN_ALIAS` section types. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1789 - https://lists.debian.org/debian-lts-announce/2024/04/msg00007.html
CVE ID: CVE-2023-35970 State: PUBLISHED Published: 2024-01-08T14:47:58.040Z Last Updated: 2025-11-04T18:15:05.038Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: GTKWave Products: GTKWave Problem Types: CWE-119 Description: Multiple heap-based buffer overflow vulnerabilities exist in the fstReaderIterBlocks2 chain_table parsing functionality of GTKWave 3.3.115. A specially crafted .fst file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the chain_table of the `FST_BL_VCDATA_DYN_ALIAS2` section type. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vul
_table of the `FST_BL_VCDATA_DYN_ALIAS2` section type. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1789 - https://lists.debian.org/debian-lts-announce/2024/04/msg00007.html
CVE ID: CVE-2023-35971 State: PUBLISHED Published: 2023-07-05T14:43:11.546Z Last Updated: 2024-10-21T21:11:32.335Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: Hewlett Packard Enterprise (HPE) Products: Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central Description: A vulnerability in the ArubaOS web-based management interface could allow an unauthenticated remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface. A successful exploit could allow an attacker to execute arbitrary script code in a victim's browser in the contex
rface. A successful exploit could allow an attacker to execute arbitrary script code in a victim's browser in the context of the affected interface. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-008.txt
CVE ID: CVE-2023-35972 State: PUBLISHED Published: 2023-07-05T14:44:42.156Z Last Updated: 2024-12-04T15:41:16.557Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Hewlett Packard Enterprise (HPE) Products: Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central Description: An authenticated remote command injection vulnerability exists in the ArubaOS web-based management interface. Successful exploitation of this vulnerability results in the ability to execute arbitrary commands as a privileged user on the underlying operating system. This allows an attacker to fully compromise
arbitrary commands as a privileged user on the underlying operating system. This allows an attacker to fully compromise the underlying operating system on the device running ArubaOS. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-008.txt
CVE ID: CVE-2023-35973 State: PUBLISHED Published: 2023-07-05T14:45:39.756Z Last Updated: 2024-12-04T15:40:45.590Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Hewlett Packard Enterprise (HPE) Products: Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central Description: Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system. Additional Analyst Notes: - CVE Program Container: - CISA
ands as a privileged user on the underlying operating system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-008.txt
CVE ID: CVE-2023-35974 State: PUBLISHED Published: 2023-07-05T14:45:43.215Z Last Updated: 2024-12-04T15:40:07.015Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Hewlett Packard Enterprise (HPE) Products: Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central Description: Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system. Additional Analyst Notes: - CVE Program Container: - CISA
CVE ID: CVE-2023-35975 State: PUBLISHED Published: 2023-07-05T14:46:49.679Z Last Updated: 2024-12-04T15:39:41.143Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H) Vendors: Hewlett Packard Enterprise (HPE) Products: Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central Description: An authenticated path traversal vulnerability exists in the ArubaOS command line interface. Successful exploitation of this vulnerability results in the ability to delete arbitrary files in the underlying operating system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Referenc
in the underlying operating system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-008.txt
CVE ID: CVE-2023-35976 State: PUBLISHED Published: 2023-07-05T14:47:43.236Z Last Updated: 2024-12-04T15:39:11.162Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Hewlett Packard Enterprise (HPE) Products: Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central Description: Vulnerabilities exist which allow an authenticated attacker to access sensitive information on the ArubaOS command line interface. Successful exploitation could allow access to data beyond what is authorized by the users existing privilege level. Additional Analyst Notes: - CVE Program Container: - CISA AD
d what is authorized by the users existing privilege level. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-008.txt
CVE ID: CVE-2023-35977 State: PUBLISHED Published: 2023-07-05T14:47:46.596Z Last Updated: 2024-12-04T15:38:20.007Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Hewlett Packard Enterprise (HPE) Products: Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central Description: Vulnerabilities exist which allow an authenticated attacker to access sensitive information on the ArubaOS command line interface. Successful exploitation could allow access to data beyond what is authorized by the users existing privilege level. Additional Analyst Notes: - CVE Program Container: - CISA AD
CVE ID: CVE-2023-35978 State: PUBLISHED Published: 2023-07-05T14:49:00.807Z Last Updated: 2024-10-21T21:11:25.552Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Hewlett Packard Enterprise (HPE) Products: Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central Description: A vulnerability in ArubaOS could allow an unauthenticated remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the web-based management interface. A successful exploit could allow an attacker to execute arbitrary script code in a victim's browser in the context of the
successful exploit could allow an attacker to execute arbitrary script code in a victim's browser in the context of the affected interface. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-008.txt
CVE ID: CVE-2023-35979 State: PUBLISHED Published: 2023-07-05T14:50:10.736Z Last Updated: 2024-12-04T15:36:27.642Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Hewlett Packard Enterprise (HPE) Products: Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central Description: There is an unauthenticated buffer overflow vulnerability in the process controlling the ArubaOS web-based management interface. Successful exploitation of this vulnerability results in a Denial-of-Service (DoS) condition affecting the web-based management interface of the controller. Additional Analyst No
Denial-of-Service (DoS) condition affecting the web-based management interface of the controller. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-008.txt
CVE ID: CVE-2023-35980 State: PUBLISHED Published: 2023-07-25T18:28:10.354Z Last Updated: 2024-11-07T18:56:09.980Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Hewlett Packard Enterprise (HPE) Products: Aruba Access Points running InstantOS and ArubaOS 10 Description: There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operati
of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-009.txt
CVE ID: CVE-2023-35981 State: PUBLISHED Published: 2023-07-25T18:28:14.271Z Last Updated: 2024-11-07T18:51:06.659Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Hewlett Packard Enterprise (HPE) Products: Aruba Access Points running InstantOS and ArubaOS 10 Description: There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operati
CVE ID: CVE-2023-35982 State: PUBLISHED Published: 2023-07-25T18:28:20.312Z Last Updated: 2024-11-07T18:11:05.797Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Hewlett Packard Enterprise (HPE) Products: Aruba Access Points running InstantOS and ArubaOS 10 Description: There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operati
CVE ID: CVE-2023-35983 State: PUBLISHED Published: 2023-07-26T23:52:30.789Z Last Updated: 2024-10-29T18:14:31.944Z Vendors: Apple Products: macOS Problem Types: An app may be able to modify protected parts of the file system Description: This issue was addressed with improved data protection. This issue is fixed in macOS Monterey 12.6.8, macOS Ventura 13.5, macOS Big Sur 11.7.9. An app may be able to modify protected parts of the file system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.apple.com/en-us/HT213843 - https://support.apple.com/en-us/HT213845 - https://support.apple.com/en-us/HT213844
CVE ID: CVE-2023-35984 State: PUBLISHED Published: 2023-09-26T20:14:40.561Z Last Updated: 2025-11-04T19:17:04.992Z Vendors: Apple Products: iOS and iPadOS, tvOS, macOS, watchOS Problem Types: An attacker in physical proximity can cause a limited out of bounds write Description: The issue was addressed with improved checks. This issue is fixed in tvOS 17, iOS 17 and iPadOS 17, watchOS 10, macOS Sonoma 14. An attacker in physical proximity can cause a limited out of bounds write. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.apple.com/en-us/HT213938 - https://support.apple.com/en-us/HT213936 - https://support.apple.com/en-us/HT213940
/support.apple.com/en-us/HT213938 - https://support.apple.com/en-us/HT213936 - https://support.apple.com/en-us/HT213940 - https://support.apple.com/en-us/HT213937 - http://seclists.org/fulldisclosure/2023/Oct/10 - http://seclists.org/fulldisclosure/2023/Oct/8 - http://seclists.org/fulldisclosure/2023/Oct/9 - http://seclists.org/fulldisclosure/2023/Oct/3
CVE ID: CVE-2023-35985 State: PUBLISHED Published: 2023-11-27T15:25:11.052Z Last Updated: 2025-11-04T19:17:06.076Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Foxit Products: Foxit Reader Problem Types: CWE-73 Description: An arbitrary file creation vulnerability exists in the Javascript exportDataObject API of Foxit Reader 12.1.3.15356 due to a failure to properly validate a dangerous extension. A specially crafted malicious file can create files at arbitrary locations, which can lead to arbitrary code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visit
ck the user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially-crafted malicious site if the browser plugin extension is enabled. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1834
CVE ID: CVE-2023-35986 State: PUBLISHED Published: 2023-10-19T17:35:00.379Z Last Updated: 2025-01-16T21:28:52.516Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Santesoft Products: Sante DICOM Viewer Pro Problem Types: CWE-121 Description: Sante DICOM Viewer Pro lacks proper validation of user-supplied data when parsing DICOM files. This could lead to a stack-based buffer overflow. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current process. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-medical-advisories/icsma-23-285-01
CVE ID: CVE-2023-35987 State: PUBLISHED Published: 2023-07-06T22:58:06.843Z Last Updated: 2024-11-13T21:32:42.878Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: PiiGAB Products: M-Bus SoftwarePack Problem Types: CWE-798 Description: PiiGAB M-Bus contains hard-coded credentials which it uses for authentication. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-187-01
CVE ID: CVE-2023-35989 State: PUBLISHED Published: 2024-01-08T14:47:42.164Z Last Updated: 2025-11-04T18:15:06.245Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: GTKWave Products: GTKWave Problem Types: CWE-190 Description: An integer overflow vulnerability exists in the LXT2 zlib block allocation functionality of GTKWave 3.3.115. A specially crafted .lxt2 file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1822 - https://lists.debian.org/debi
hment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1822 - https://lists.debian.org/debian-lts-announce/2024/04/msg00007.html
CVE ID: CVE-2023-35990 State: PUBLISHED Published: 2023-09-26T20:14:46.575Z Last Updated: 2025-11-04T19:17:10.383Z Vendors: Apple Products: iOS and iPadOS, macOS, watchOS Problem Types: An app may be able to identify what other apps a user has installed Description: The issue was addressed with improved checks. This issue is fixed in iOS 17 and iPadOS 17, watchOS 10, iOS 16.7 and iPadOS 16.7, macOS Sonoma 14. An app may be able to identify what other apps a user has installed. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.apple.com/en-us/HT213938 - https://support.apple.com/en-us/HT213927 - https://support.apple.com/en-us/HT213940 -
support.apple.com/en-us/HT213938 - https://support.apple.com/en-us/HT213927 - https://support.apple.com/en-us/HT213940 - https://support.apple.com/en-us/HT213937 - http://seclists.org/fulldisclosure/2023/Oct/8 - http://seclists.org/fulldisclosure/2023/Oct/9 - http://seclists.org/fulldisclosure/2023/Oct/3 - http://seclists.org/fulldisclosure/2023/Oct/4
CVE ID: CVE-2023-35991 State: PUBLISHED Published: 2023-08-18T09:37:37.744Z Last Updated: 2024-10-21T20:26:02.037Z Vendors: LOGITEC CORPORATION Products: LAN-W300N/DR, LAN-WH300N/DR, LAN-W300N/P, LAN-WH450N/GP, LAN-WH300AN/DGP, LAN-WH300N/DGP, LAN-WH300ANDGPE Problem Types: Hidden Functionality Description: Hidden functionality vulnerability in LOGITEC wireless LAN routers allows an unauthenticated attacker to log in to the product's certain management console and execute arbitrary OS commands. Affected products and versions are as follows: LAN-W300N/DR all versions, LAN-WH300N/DR all versions, LAN-W300N/P all versions, LAN-WH450N/GP all versions, LAN-WH300AN/DGP all versions, LAN-WH300N/DGP
300N/DR all versions, LAN-W300N/P all versions, LAN-WH450N/GP all versions, LAN-WH300AN/DGP all versions, LAN-WH300N/DGP all versions, and LAN-WH300ANDGPE all versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.elecom.co.jp/news/security/20230810-01/ - https://jvn.jp/en/vu/JVNVU91630351/
CVE ID: CVE-2023-35992 State: PUBLISHED Published: 2024-01-08T14:47:57.460Z Last Updated: 2025-11-04T18:15:07.576Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: GTKWave Products: GTKWave Problem Types: CWE-190 Description: An integer overflow vulnerability exists in the FST fstReaderIterBlocks2 vesc allocation functionality of GTKWave 3.3.115, when compiled as a 32-bit binary. A specially crafted .fst file can lead to memory corruption. A victim would need to open a malicious file to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-202
Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1790 - https://lists.debian.org/debian-lts-announce/2024/04/msg00007.html
CVE ID: CVE-2023-35993 State: PUBLISHED Published: 2023-07-27T00:22:30.186Z Last Updated: 2024-10-22T20:41:55.052Z Vendors: Apple Products: tvOS, iOS and iPadOS, macOS, watchOS Problem Types: An app may be able to execute arbitrary code with kernel privileges Description: A use-after-free issue was addressed with improved memory management. This issue is fixed in macOS Monterey 12.6.8, iOS 15.7.8 and iPadOS 15.7.8, iOS 16.6 and iPadOS 16.6, tvOS 16.6, macOS Big Sur 11.7.9, macOS Ventura 13.5, watchOS 9.6. An app may be able to execute arbitrary code with kernel privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.apple.com/en-u
CVE ID: CVE-2023-35994 State: PUBLISHED Published: 2024-01-08T14:47:56.687Z Last Updated: 2025-11-04T18:15:08.880Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: GTKWave Products: GTKWave Problem Types: CWE-129 Description: Multiple improper array index validation vulnerabilities exist in the fstReaderIterBlocks2 tdelta functionality of GTKWave 3.3.115. A specially crafted .fst file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the tdelta initialization part. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosin
lization part. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1791 - https://lists.debian.org/debian-lts-announce/2024/04/msg00007.html
CVE ID: CVE-2023-35995 State: PUBLISHED Published: 2024-01-08T14:47:56.783Z Last Updated: 2025-11-04T18:15:10.047Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: GTKWave Products: GTKWave Problem Types: CWE-129 Description: Multiple improper array index validation vulnerabilities exist in the fstReaderIterBlocks2 tdelta functionality of GTKWave 3.3.115. A specially crafted .fst file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the tdelta indexing when signal_lens is 1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http
ng when signal_lens is 1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1791 - https://lists.debian.org/debian-lts-announce/2024/04/msg00007.html