Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-31250 State: PUBLISHED Published: 2023-04-26T00:00:00.000Z Last Updated: 2025-02-03T16:49:05.839Z Vendors: Drupal Products: Core Problem Types: Access bypass Description: The file download facility doesn't sufficiently sanitize file paths in certain situations. This may result in users gaining access to private files that they should not have access to. Some sites may require configuration changes following this security release. Review the release notes for your Drupal version if you have issues accessing private files after updating. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-core-2023-005
CVE ID: CVE-2023-31271 State: PUBLISHED Published: 2024-02-14T13:38:01.535Z Last Updated: 2024-08-08T13:33:22.546Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) VROC software Problem Types: escalation of privilege, CWE-284 Description: Improper access control in some Intel(R) VROC software before version 8.0.8.1001 may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00953.html
CVE ID: CVE-2023-31272 State: PUBLISHED Published: 2023-10-11T15:14:29.947Z Last Updated: 2025-11-04T19:16:01.548Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Yifan Products: YF325 Problem Types: CWE-121 Description: A stack-based buffer overflow vulnerability exists in the httpd do_wds functionality of Yifan YF325 v1.0_20221108. A specially crafted network request can lead to stack-based buffer overflow. An attacker can send a network request to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1765
CVE ID: CVE-2023-31273 State: PUBLISHED Published: 2023-11-14T19:04:58.618Z Last Updated: 2024-08-30T15:27:09.009Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: n/a Products: Intel DCM software Problem Types: escalation of privilege, CWE-693 Description: Protection mechanism failure in some Intel DCM software before version 5.2 may allow an unauthenticated user to potentially enable escalation of privilege via network access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00902.html
CVE ID: CVE-2023-31274 State: PUBLISHED Published: 2024-01-18T17:15:25.837Z Last Updated: 2024-08-29T20:02:08.687Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Aveva Products: PI Server Problem Types: CWE-772 Description: AVEVA PI Server versions 2023 and 2018 SP3 P05 and prior contain a vulnerability that could allow an unauthenticated user to cause the PI Message Subsystem of a PI Server to consume available memory resulting in throttled processing of new PI Data Archive events and a partial denial-of-service condition. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisori
yst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-018-01
CVE ID: CVE-2023-31275 State: PUBLISHED Published: 2023-11-27T15:34:38.413Z Last Updated: 2025-11-04T19:16:02.698Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: WPS Products: WPS Office Problem Types: CWE-457 Description: An uninitialized pointer use vulnerability exists in the functionality of WPS Office 11.2.0.11537 that handles Data elements in an Excel file. A specially crafted malformed file can lead to remote code execution. An attacker can provide a malicious file to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1748
CVE ID: CVE-2023-31276 State: PUBLISHED Published: 2025-02-12T21:19:40.934Z Last Updated: 2025-02-13T15:11:52.195Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) Server Board S2600WF, Intel(R) Server Board S2600ST, Intel(R) Server Board S2600BP, Intel(R) Server Board M50CYP and Intel(R) Server Board D50TNP Problem Types: Escalation of Privilege, CWE-122 Description: Heap-based buffer overflow in BMC Firmware for the Intel(R) Server Board S2600WF, Intel(R) Server Board S2600ST, Intel(R) Server Board S2600BP, before version 02.01.0017 and Intel(R) Server Board M50CYP and Intel(R) Server Board D50TNP before version R01.01.0009 may allow a
ion 02.01.0017 and Intel(R) Server Board M50CYP and Intel(R) Server Board D50TNP before version R01.01.0009 may allow a privileged user to enable escalation of privilege via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://intel.com/content/www/us/en/security-center/advisory/intel-sa-00990.html
CVE ID: CVE-2023-31277 State: PUBLISHED Published: 2023-07-06T22:56:10.047Z Last Updated: 2024-11-14T14:04:05.199Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: PiiGAB Products: M-Bus SoftwarePack Problem Types: CWE-523 Description: PiiGAB M-Bus transmits credentials in plaintext format. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-187-01
CVE ID: CVE-2023-31278 State: PUBLISHED Published: 2023-06-06T16:25:34.270Z Last Updated: 2025-01-07T18:45:01.786Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Horner Automation Products: Cscape, Cscape EnvisionRV Problem Types: CWE-125 Description: Horner Automation Cscape lacks proper validation of user-supplied data when parsing project files (e.g., HMI). This could lead to an out-of-bounds read. An attacker could leverage this vulnerability to potentially execute arbitrary code in the context of the current process. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/i
Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-143-04
CVE ID: CVE-2023-31279 State: PUBLISHED Published: 2024-12-20T23:35:29.797Z Last Updated: 2024-12-24T00:40:07.676Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) Vendors: Sierra Wireless Products: AirVantage, AirVantage-Capable Devices: All Sierra Wireless devices. Problem Types: CWE-287 Description: The AirVantage platform is vulnerable to an unauthorized attacker registering previously unregistered devices on the AirVantage platform when the owner has not disabled the AirVantage Management Service on the devices or registered the device. This could enable an attacker to configure, manage, and execute AT commands on an unsuspecting user’s devices. Additional Analyst
enable an attacker to configure, manage, and execute AT commands on an unsuspecting user’s devices. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://source.sierrawireless.com/resources/security-bulletins/sierra-wireless-technical-bulletin---swi-psa-2023-002/
CVE ID: CVE-2023-31280 State: PUBLISHED Published: 2024-12-20T23:41:22.070Z Last Updated: 2024-12-24T00:39:59.493Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Sierra Wireless Products: AirVantage, AirVantage-Capable Devices: All Sierra Wireless devices. Problem Types: CWE-200 Description: An AirVantage online Warranty Checker tool vulnerability could allow an attacker to perform bulk enumeration of IMEI and Serial Numbers pairs. The AirVantage Warranty Checker is updated to no longer return the IMEI and Serial Number in addition to the warranty status when the Serial Number or IMEI is used to look up warranty status. Additional Analyst Notes: - CISA ADP
warranty status when the Serial Number or IMEI is used to look up warranty status. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://source.sierrawireless.com/resources/security-bulletins/sierra-wireless-technical-bulletin---swi-psa-2023-002/
CVE ID: CVE-2023-31284 State: PUBLISHED Published: 2023-05-04T00:00:00.000Z Last Updated: 2025-01-29T19:13:59.675Z Vendors: n/a Products: n/a Problem Types: n/a Description: illumos illumos-gate before 676abcb has a stack buffer overflow in /dev/net, leading to privilege escalation via a stat on a long file name in /dev/net. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/illumos/illumos-gate/tree/16b76d3cb933ff92018a2a75594449010192eacb - https://illumos.topicbox.com/groups/developer/T13ef186a53edeb5c-M821cc18b5884e04e16daa8fd/cve-2023-31284-buffer-overflow-in-dev-net - http://www.openwall.com/lists/oss-security/2023/09/13/4 - htt
84e04e16daa8fd/cve-2023-31284-buffer-overflow-in-dev-net - http://www.openwall.com/lists/oss-security/2023/09/13/4 - http://www.openwall.com/lists/oss-security/2023/09/13/5 - http://www.openwall.com/lists/oss-security/2023/09/14/4
CVE ID: CVE-2023-31285 State: PUBLISHED Published: 2023-04-27T00:00:00.000Z Last Updated: 2025-02-13T16:49:49.253Z Vendors: n/a Products: n/a Problem Types: n/a Description: An XSS issue was discovered in Serenity Serene (and StartSharp) before 6.7.0. When users upload temporary files, some specific file endings are not allowed, but it is possible to upload .html or .htm files containing an XSS payload. The resulting link can be sent to an administrator user. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/serenity-is/Serenity/commit/11b9d267f840513d04b4f4d4876de7823a6e48d2 - http://seclists.org/fulldisclosure/2023/May/14 - http://
y-is/Serenity/commit/11b9d267f840513d04b4f4d4876de7823a6e48d2 - http://seclists.org/fulldisclosure/2023/May/14 - http://packetstormsecurity.com/files/172648/Serenity-StartSharp-Software-File-Upload-XSS-User-Enumeration-Reusable-Tokens.html
CVE ID: CVE-2023-31286 State: PUBLISHED Published: 2023-04-27T00:00:00.000Z Last Updated: 2025-02-13T16:49:49.813Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Serenity Serene (and StartSharp) before 6.7.0. When a password reset request occurs, the server response leaks the existence of users. If one tries to reset a password of a non-existent user, an error message indicates that this user does not exist. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/serenity-is/Serenity/commit/11b9d267f840513d04b4f4d4876de7823a6e48d2 - http://seclists.org/fulldisclosure/2023/May/14 - http://packetstormse
/commit/11b9d267f840513d04b4f4d4876de7823a6e48d2 - http://seclists.org/fulldisclosure/2023/May/14 - http://packetstormsecurity.com/files/172648/Serenity-StartSharp-Software-File-Upload-XSS-User-Enumeration-Reusable-Tokens.html
CVE ID: CVE-2023-31287 State: PUBLISHED Published: 2023-04-27T00:00:00.000Z Last Updated: 2025-02-13T16:50:05.795Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Serenity Serene (and StartSharp) before 6.7.0. Password reset links are sent by email. A link contains a token that is used to reset the password. This token remains valid even after the password reset and can be used a second time to change the password of the corresponding user. The token expires only 3 hours after issuance and is sent as a query parameter when resetting. An attacker with access to the browser history can thus use the token again to change the password in order to take over t
attacker with access to the browser history can thus use the token again to change the password in order to take over the account. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/serenity-is/Serenity/commit/11b9d267f840513d04b4f4d4876de7823a6e48d2 - http://seclists.org/fulldisclosure/2023/May/14 - http://packetstormsecurity.com/files/172648/Serenity-StartSharp-Software-File-Upload-XSS-User-Enumeration-Reusable-Tokens.html
CVE ID: CVE-2023-31289 State: PUBLISHED Published: 2023-12-25T00:00:00 Last Updated: 2024-08-02T14:53:30.700Z Vendors: n/a Products: n/a Problem Types: n/a Description: Pexip Infinity before 31.2 has Improper Input Validation for signalling, allowing remote attackers to trigger an abort. Additional Analyst Notes: - CVE Program Container: References: - https://docs.pexip.com/admin/security_bulletins.htm
CVE ID: CVE-2023-31290 State: PUBLISHED Published: 2023-04-27T00:00:00.000Z Last Updated: 2025-01-30T20:19:42.908Z Vendors: n/a Products: n/a Problem Types: n/a Description: Trust Wallet Core before 3.1.1, as used in the Trust Wallet browser extension before 0.0.183, allows theft of funds because the entropy is 32 bits, as exploited in the wild in December 2022 and March 2023. This occurs because the mt19937 Mersenne Twister takes a single 32-bit value as an input seed, resulting in only four billion possible mnemonics. The affected versions of the browser extension are 0.0.172 through 0.0.182. To steal funds efficiently, an attacker can identify all Ethereum addresses created since the 0.0.
.172 through 0.0.182. To steal funds efficiently, an attacker can identify all Ethereum addresses created since the 0.0.172 release, and check whether they are Ethereum addresses that could have been created by this extension. To respond to the risk, affected users need to upgrade the product version and also move funds to a new wallet address. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://community.trustwallet.com/t/browser-extension-wasm-vulnerability-postmortem/750787 - https://community.trustwallet.com/t/wasm-vulnerability-incident-update-and-recommended-actions/750786 - https://github.com/trustwallet/wallet-core/compare/3.1.0...3.1.1 -
lity-incident-update-and-recommended-actions/750786 - https://github.com/trustwallet/wallet-core/compare/3.1.0...3.1.1 - https://twitter.com/TrustWallet/status/1649699428733947906 - https://blog.ledger.com/Funds-of-every-wallet-created-with-the-Trust-Wallet-browser-extension-could-have-been-stolen/
CVE ID: CVE-2023-31292 State: PUBLISHED Published: 2023-12-29T00:00:00.000Z Last Updated: 2025-04-17T20:26:21.517Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Sesami Cash Point & Transport Optimizer (CPTO) 6.3.8.6 (#718), allows local attackers to obtain sensitive information and bypass authentication via "Back Button Refresh" attack. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://herolab.usd.de/en/security-advisories/usd-2022-0051/
CVE ID: CVE-2023-31293 State: PUBLISHED Published: 2023-12-29T00:00:00 Last Updated: 2024-11-26T14:37:33.073Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Sesami Cash Point & Transport Optimizer (CPTO) 6.3.8.6 (#718), allows remote attackers to obtain sensitive information and bypass profile restriction via improper access control in the Reader system user's web browser, allowing the journal to be displayed, despite the option being disabled. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://herolab.usd.de/en/security-advisories/usd-2022-0061/
CVE ID: CVE-2023-31294 State: PUBLISHED Published: 2023-12-29T00:00:00 Last Updated: 2024-08-02T14:53:30.866Z Vendors: n/a Products: n/a Problem Types: n/a Description: CSV Injection vulnerability in Sesami Cash Point & Transport Optimizer (CPTO) version 6.3.8.6 (#718), allows remote attackers to obtain sensitive information via the Delivery Name field. Additional Analyst Notes: - CVE Program Container: References: - https://herolab.usd.de/en/security-advisories/usd-2022-0052/
CVE ID: CVE-2023-31295 State: PUBLISHED Published: 2023-12-29T00:00:00 Last Updated: 2024-08-02T14:53:30.881Z Vendors: n/a Products: n/a Problem Types: n/a Description: CSV Injection vulnerability in Sesami Cash Point & Transport Optimizer (CPTO) version 6.3.8.6 (#718), allows remote attackers to obtain sensitive information via the User Profile field. Additional Analyst Notes: - CVE Program Container: References: - https://herolab.usd.de/en/security-advisories/usd-2022-0053/
CVE ID: CVE-2023-31296 State: PUBLISHED Published: 2023-12-29T00:00:00 Last Updated: 2024-08-27T18:25:18.750Z Vendors: n/a Products: n/a Problem Types: n/a Description: CSV Injection vulnerability in Sesami Cash Point & Transport Optimizer (CPTO) version 6.3.8.6 (#718), allows attackers to obtain sensitive information via the User Name field. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://herolab.usd.de/en/security-advisories/usd-2022-0054/
CVE ID: CVE-2023-31297 State: PUBLISHED Published: 2023-12-25T00:00:00 Last Updated: 2024-08-02T14:53:30.584Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in SESAMI planfocus CPTO (Cash Point & Transport Optimizer) 6.3.8.6 718. There is XSS via the Name field when modifying a client. Additional Analyst Notes: - CVE Program Container: References: - https://herolab.usd.de/security-advisories/ - https://herolab.usd.de/en/security-advisories/usd-2022-0058/
CVE ID: CVE-2023-31298 State: PUBLISHED Published: 2023-12-29T00:00:00 Last Updated: 2024-09-03T19:55:59.448Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability in Sesami Cash Point & Transport Optimizer (CPTO) version 6.3.8.6 (#718), allows remote attackers to execute arbitrary code and obtain sensitive information via the User ID field when creating a new system user. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://herolab.usd.de/en/security-advisories/usd-2022-0060/
CVE ID: CVE-2023-31299 State: PUBLISHED Published: 2023-12-29T00:00:00 Last Updated: 2024-08-02T14:53:30.660Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability in Sesami Cash Point & Transport Optimizer (CPTO) version 6.3.8.6 (#718), allows remote attackers to execute arbitrary code via the Barcode field of a container. Additional Analyst Notes: - CVE Program Container: References: - https://herolab.usd.de/en/security-advisories/usd-2022-0055/
CVE ID: CVE-2023-31300 State: PUBLISHED Published: 2023-12-29T00:00:00.000Z Last Updated: 2025-04-17T20:25:03.643Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Sesami Cash Point & Transport Optimizer (CPTO) version 6.3.8.6 (#718), allows remote attackers to obtain sensitive information via transmission of unencrypted, cleartext credentials during Password Reset feature. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://herolab.usd.de/en/security-advisories/usd-2022-0057/
CVE ID: CVE-2023-31301 State: PUBLISHED Published: 2023-12-29T00:00:00 Last Updated: 2024-08-02T14:53:30.852Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stored Cross Site Scripting (XSS) Vulnerability in Sesami Cash Point & Transport Optimizer (CPTO) version 6.3.8.6 (#718), allows remote attackers to execute arbitrary code and obtain sensitive information via the Username field of the login form and application log. Additional Analyst Notes: - CVE Program Container: References: - https://herolab.usd.de/en/security-advisories/usd-2022-0059/
CVE ID: CVE-2023-31302 State: PUBLISHED Published: 2023-12-29T00:00:00 Last Updated: 2024-08-27T15:23:51.187Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability in Sesami Cash Point & Transport Optimizer (CPTO) 6.3.8.6 (#718), allows remote attackers to execute arbitrary code via the Teller field. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://herolab.usd.de/en/security-advisories/usd-2022-0056/
CVE ID: CVE-2023-31304 State: PUBLISHED Published: 2024-08-13T16:53:44.552Z Last Updated: 2024-11-04T16:38:19.642Z Severity: LOW (CVSS 2.3 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L) Vendors: AMD Products: AMD Radeon™ RX 6000 Series Graphics Cards, AMD Radeon™ PRO W6000 Series Graphics Cards Description: Improper input validation in SMU may allow an attacker with privileges and a compromised physical function (PF) to modify the PCIe® lane count and speed, potentially leading to a loss of availability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.amd.com/en/resources/product-security/bulletin/amd-sb-6005.html
CVE ID: CVE-2023-31305 State: PUBLISHED Published: 2024-08-13T16:53:42.810Z Last Updated: 2024-11-06T15:22:36.182Z Severity: LOW (CVSS 1.9 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N) Vendors: AMD Products: AMD Radeon™ RX 6000 Series Graphics Cards, AMD Radeon™ PRO W6000 Series Graphics Cards Description: Generation of weak and predictable Initialization Vector (IV) in PMFW (Power Management Firmware) may allow an attacker with privileges to reuse IV values to reverse-engineer debug data, potentially resulting in information disclosure. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.amd.com/en/resources/product-security/bulletin/amd-sb-6005.html
CVE ID: CVE-2023-31306 State: PUBLISHED Published: 2025-09-06T16:26:58.244Z Last Updated: 2025-09-08T13:33:35.158Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: AMD Products: AMD Radeon™ RX 5000 Series Graphics Products, AMD Radeon™ PRO W5000 Series Graphics Products, AMD Radeon™ RX 6000 Series Graphics Products, AMD Radeon™ PRO W6000 Series Graphics Products, AMD Radeon™ PRO V520 Graphics Products, AMD Radeon™ PRO V620 Graphics Products Problem Types: CWE-129 Description: Improper validation of an array index in the AMD graphics driver software could allow an attacker to pass malformed arguments to the dynamic power management (DPM) functions resulting in an
ware could allow an attacker to pass malformed arguments to the dynamic power management (DPM) functions resulting in an out of bounds read and loss of availability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-6018.html
CVE ID: CVE-2023-31307 State: PUBLISHED Published: 2024-08-13T16:54:03.514Z Last Updated: 2024-12-03T16:30:08.173Z Severity: LOW (CVSS 2.3 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L) Vendors: AMD Products: AMD Radeon™ RX 6000 Series Graphics Cards, AMD Radeon™ PRO W6000 Series Graphics Cards Description: Improper validation of array index in Power Management Firmware (PMFW) may allow a privileged attacker to cause an out-of-bounds memory read within PMFW, potentially leading to a denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.amd.com/en/resources/product-security/bulletin/amd-sb-6005.html
CVE ID: CVE-2023-31310 State: PUBLISHED Published: 2024-08-13T16:54:05.783Z Last Updated: 2024-10-31T14:14:29.589Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L) Vendors: AMD Products: AMD Radeon™ RX 6000 Series Graphics Cards, AMD Radeon™ PRO W6000 Series Graphics Cards Description: Improper input validation in Power Management Firmware (PMFW) may allow an attacker with privileges to send a malformed input for the "set temperature input selection" command, potentially resulting in a loss of integrity and/or availability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.amd.com/en/resources/product-security/bulletin/amd-sb-6005.html