Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-20263 State: PUBLISHED Published: 2023-09-06T17:10:31.716Z Last Updated: 2024-11-21T21:42:51.502Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N) Vendors: Cisco Products: Cisco HyperFlex HX Data Platform Problem Types: CWE-601 Description: A vulnerability in the web-based management interface of Cisco HyperFlex HX Data Platform could allow an unauthenticated, remote attacker to redirect a user to a malicious web page. This vulnerability is due to improper input validation of the parameters in an HTTP request. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to red
it this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to redirect a user to a malicious website. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hyperflex-redirect-UxLgqdUF
CVE ID: CVE-2023-20264 State: PUBLISHED Published: 2023-11-01T17:10:33.630Z Last Updated: 2024-08-02T09:05:36.229Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Cisco Products: Cisco Adaptive Security Appliance (ASA) Software, Cisco Firepower Threat Defense Software Problem Types: CWE-601 Description: A vulnerability in the implementation of Security Assertion Markup Language (SAML) 2.0 single sign-on (SSO) for remote access VPN in Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to intercept the SAML assertion of a user who is authenticating to a remote acces
ow an unauthenticated, remote attacker to intercept the SAML assertion of a user who is authenticating to a remote access VPN session. This vulnerability is due to insufficient validation of the login URL. An attacker could exploit this vulnerability by persuading a user to access a site that is under the control of the attacker, allowing the attacker to modify the login URL. A successful exploit could allow the attacker to intercept a successful SAML assertion and use that assertion to establish a remote access VPN session toward the affected device with the identity and permissions of the hijacked user, resulting in access to the protected network. Additional Analyst Notes: - CVE Program C
ermissions of the hijacked user, resulting in access to the protected network. Additional Analyst Notes: - CVE Program Container: References: - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-saml-hijack-ttuQfyz
CVE ID: CVE-2023-20265 State: PUBLISHED Published: 2023-11-21T18:45:33.998Z Last Updated: 2024-08-29T20:02:00.535Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: Cisco Products: Cisco IP Phones with Multiplatform Firmware, Cisco Session Initiation Protocol (SIP) Software Problem Types: CWE-79 Description: A vulnerability in the web-based management interface of a small subset of Cisco IP Phones could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface on an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vuln
device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by persuading a user of an affected interface to view a page containing malicious HTML or script content. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To exploit this vulnerability, the attacker must have valid credentials to access the web-based management interface of the affected device. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecu
gram Container: - CISA ADP Vulnrichment: References: - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-uipphone-xss-NcmUykqA
CVE ID: CVE-2023-20266 State: PUBLISHED Published: 2023-08-30T16:18:42.528Z Last Updated: 2025-07-01T13:45:58.935Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N) Vendors: Cisco Products: Cisco Emergency Responder, Cisco Unity Connection, Cisco Unified Communications Manager Problem Types: CWE-347 Description: A vulnerability in Cisco Emergency Responder, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unity Connection could allow an authenticated, remote attacker to elevate privileges to root on an affected device. This vulnerability exists because the application does not
attacker to elevate privileges to root on an affected device. This vulnerability exists because the application does not properly restrict the files that are being used for upgrades. An attacker could exploit this vulnerability by providing a crafted upgrade file. A successful exploit could allow the attacker to elevate privileges to root. To exploit this vulnerability, the attacker must have valid platform administrator credentials on an affected device. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-priv-esc-D8Bky5eg
CVE ID: CVE-2023-20267 State: PUBLISHED Published: 2023-11-01T17:16:02.332Z Last Updated: 2024-11-21T21:45:42.544Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N) Vendors: Cisco Products: Cisco Firepower Threat Defense Software Problem Types: CWE-284 Description: A vulnerability in the IP geolocation rules of Snort 3 could allow an unauthenticated, remote attacker to potentially bypass IP address restrictions. This vulnerability exists because the configuration for IP geolocation rules is not parsed properly. An attacker could exploit this vulnerability by spoofing an IP address until they bypass the restriction. A successful exploit could allow the attacker to bypass
ty by spoofing an IP address until they bypass the restriction. A successful exploit could allow the attacker to bypass location-based IP address restrictions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftdsnort3sip-bypass-LMz2ThKn
CVE ID: CVE-2023-20268 State: PUBLISHED Published: 2023-09-27T17:22:55.840Z Last Updated: 2024-12-12T17:19:02.520Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L) Vendors: Cisco Products: Cisco Aironet Access Point Software, Cisco Aironet Access Point Software (IOS XE Controller), Cisco Business Wireless Access Point Software Problem Types: CWE-400 Description: A vulnerability in the packet processing functionality of Cisco access point (AP) software could allow an unauthenticated, adjacent attacker to exhaust resources on an affected device.&nbsp; This vulnerability is due to insufficient management of resources when handling certain types of traffic. An attacker co
This vulnerability is due to insufficient management of resources when handling certain types of traffic. An attacker could exploit this vulnerability by sending a series of specific wireless packets to an affected device. A successful exploit could allow the attacker to consume resources on an affected device. A sustained attack could lead to the disruption of the Control and Provisioning of Wireless Access Points (CAPWAP) tunnel and intermittent loss of wireless client traffic. Additional Analyst Notes: - CVE Program Container: References: - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ap-dos-capwap-DDMCZS4m
CVE ID: CVE-2023-20269 State: PUBLISHED Published: 2023-09-06T17:09:29.663Z Last Updated: 2025-10-21T23:05:39.522Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N) Vendors: Cisco Products: Cisco Adaptive Security Appliance (ASA) Software, Cisco Firepower Threat Defense Software Problem Types: CWE-288 Description: A vulnerability in the remote access VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct a brute force attack in an attempt to identify valid username and password combinations or an authenticated, remote attacker to establish a clientless SS
t to identify valid username and password combinations or an authenticated, remote attacker to establish a clientless SSL VPN session with an unauthorized user. This vulnerability is due to improper separation of authentication, authorization, and accounting (AAA) between the remote access VPN feature and the HTTPS management and site-to-site VPN features. An attacker could exploit this vulnerability by specifying a default connection profile/tunnel group while conducting a brute force attack or while establishing a clientless SSL VPN session using valid credentials. A successful exploit could allow the attacker to achieve one or both of the following: Identify valid credentials that could t
essful exploit could allow the attacker to achieve one or both of the following: Identify valid credentials that could then be used to establish an unauthorized remote access VPN session. Establish a clientless SSL VPN session (only when running Cisco ASA Software Release 9.16 or earlier). Notes: Establishing a client-based remote access VPN tunnel is not possible as these default connection profiles/tunnel groups do not and cannot have an IP address pool configured. This vulnerability does not allow an attacker to bypass authentication. To successfully establish a remote access VPN session, valid credentials are required, including a valid second factor if multi-factor authentication (MFA)
ccess VPN session, valid credentials are required, including a valid second factor if multi-factor authentication (MFA) is configured. Cisco will release software updates that address this vulnerability. There are workarounds that address this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-ravpn-auth-8LyfCkeC
CVE ID: CVE-2023-20270 State: PUBLISHED Published: 2023-11-01T16:51:13.156Z Last Updated: 2024-08-02T09:05:36.263Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L) Vendors: Cisco Products: Cisco Firepower Threat Defense Software Problem Types: CWE-20 Description: A vulnerability in the interaction between the Server Message Block (SMB) protocol preprocessor and the Snort 3 detection engine for Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass the configured policies or cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper error-checking when the Snort 3 detection eng
oS) condition on an affected device. This vulnerability is due to improper error-checking when the Snort 3 detection engine is processing SMB traffic. An attacker could exploit this vulnerability by sending a crafted SMB packet stream through an affected device. A successful exploit could allow the attacker to cause the Snort process to reload, resulting in a DoS condition. Additional Analyst Notes: - CVE Program Container: References: - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftd-smbsnort3-dos-pfOjOYUV
CVE ID: CVE-2023-20271 State: PUBLISHED Published: 2024-01-17T16:56:25.553Z Last Updated: 2025-06-17T21:19:17.301Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Cisco Products: Cisco Prime Infrastructure, Cisco Evolved Programmable Network Manager (EPNM) Problem Types: CWE-89 Description: A vulnerability in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager (EPNM) could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system. This vulnerability is due to improper validation of user-submitted parameters. An attacker could exploit this vulnerability by authent
lity is due to improper validation of user-submitted parameters. An attacker could exploit this vulnerability by authenticating to the application and sending malicious requests to an affected system. A successful exploit could allow the attacker to obtain and modify sensitive information that is stored in the underlying database. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-pi-epnm-wkZJeyeq
CVE ID: CVE-2023-20272 State: PUBLISHED Published: 2023-11-21T18:49:16.737Z Last Updated: 2024-08-02T09:05:36.852Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L) Vendors: Cisco Products: Cisco Identity Services Engine Software Problem Types: CWE-424 Description: A vulnerability in the web-based management interface of Cisco Identity Services Engine could allow an authenticated, remote attacker to upload malicious files to the web root of the application. This vulnerability is due to insufficient file input validation. An attacker could exploit this vulnerability by uploading a malicious file to the web interface. A successful exploit could allow the attacker to repl
vulnerability by uploading a malicious file to the web interface. A successful exploit could allow the attacker to replace files and gain access to sensitive server-side information. Additional Analyst Notes: - CVE Program Container: References: - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-mult-j-KxpNynR
CVE ID: CVE-2023-20273 State: PUBLISHED Published: 2023-10-24T14:13:36.311Z Last Updated: 2025-10-21T23:05:33.896Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Cisco Products: Cisco IOS XE Software Problem Types: CWE-78 Description: A vulnerability in the web UI feature of Cisco IOS XE Software could allow an authenticated, remote attacker to inject commands with the privileges of root. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending crafted input to the web UI. A successful exploit could allow the attacker to inject commands to the underlying operating system with root privileges. Addition
ul exploit could allow the attacker to inject commands to the underlying operating system with root privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z
CVE ID: CVE-2023-20274 State: PUBLISHED Published: 2023-11-21T18:49:52.044Z Last Updated: 2024-08-29T20:01:10.301Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L) Vendors: Cisco Products: Cisco AppDynamics Problem Types: CWE-269 Description: A vulnerability in the installer script of Cisco AppDynamics PHP Agent could allow an authenticated, local attacker to elevate privileges on an affected device. This vulnerability is due to insufficient permissions that are set by the PHP Agent Installer on the PHP Agent install directory. An attacker could exploit this vulnerability by modifying objects in the PHP Agent install directory, which would run with the same privileges
oit this vulnerability by modifying objects in the PHP Agent install directory, which would run with the same privileges as PHP. A successful exploit could allow a lower-privileged attacker to elevate their privileges to root on an affected device. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-appd-php-authpriv-gEBwTvu5
CVE ID: CVE-2023-20275 State: PUBLISHED Published: 2023-12-12T18:06:17.467Z Last Updated: 2024-08-02T09:05:36.246Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N) Vendors: Cisco Products: Cisco Adaptive Security Appliance (ASA) Software, Cisco Firepower Threat Defense Software Problem Types: CWE-346 Description: A vulnerability in the AnyConnect SSL VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, remote attacker to send packets with another VPN user's source IP address. This vulnerability is due to improper validation of the packet's inner source IP address after decryptio
rce IP address. This vulnerability is due to improper validation of the packet's inner source IP address after decryption. An attacker could exploit this vulnerability by sending crafted packets through the tunnel. A successful exploit could allow the attacker to send a packet impersonating another VPN user's IP address. It is not possible for the attacker to receive return packets. Additional Analyst Notes: - CVE Program Container: References: - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asa-ssl-vpn-Y88QOm77
CVE ID: CVE-2023-20507 State: PUBLISHED Published: 2025-02-11T21:02:54.581Z Last Updated: 2025-02-12T15:35:16.344Z Severity: LOW (CVSS 2.3 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N) Vendors: AMD Products: AMD Ryzen™ 5000 Series Desktop Processor with Radeon™ Graphics, AMD Ryzen™ 7000 Series Desktop Processors, AMD Athlon™ 3000 Series Desktop Processors with Radeon™ Graphics, AMD Ryzen™ 4000 Series Desktop Processor with Radeon™ Graphics, AMD Ryzen™ 8000 Series Processor with Radeon™ Graphics, AMD Ryzen™ 4000 Series Mobile Processors with Radeon™ Graphics, AMD Ryzen™ 5000 Series Processors with Radeon™ Graphics, AMD Ryzen™ 7020 Series Processors with Radeon™ Graphics, AMD Ryzen™ 6000 Serie
Series Processors with Radeon™ Graphics, AMD Ryzen™ 7020 Series Processors with Radeon™ Graphics, AMD Ryzen™ 6000 Series Processor with Radeon™ Graphics, AMD Ryzen™ 7035 Series Processor with Radeon™ Graphics, AMD Ryzen™ 7000 Series Mobile Processors, AMD Ryzen™ Embedded 5000, AMD Ryzen™ Embedded 7000, AMD Ryzen™ Embedded V2000, AMD Ryzen™ Embedded V3000 Problem Types: CWE-190 Description: An integer overflow in the ASP could allow a privileged attacker to perform an out-of-bounds write, potentially resulting in loss of data integrity. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.amd.com/en/resources/product-security/bulletin/amd-sb-5004.html - https://www.am
Vulnrichment: References: - https://www.amd.com/en/resources/product-security/bulletin/amd-sb-5004.html - https://www.amd.com/en/resources/product-security/bulletin/amd-sb-4008.html
CVE ID: CVE-2023-20508 State: PUBLISHED Published: 2025-02-11T23:34:02.874Z Last Updated: 2025-02-12T15:33:36.214Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L) Vendors: AMD Products: AMD Radeon™ RX 6000 Series Graphics Products, AMD Radeon™ PRO W6000 Series Graphics Products, AMD Radeon™ Instinct™ MI25, AMD Radeon™ PRO V520, AMD Radeon™ PRO V620, AMD Radeon™ PRO V710, AMD Instinct™ MI300A, AMD Instinct™ MI300X, AMD Ryzen™ 5000 Series Desktop Processor with Radeon™ Graphics, AMD Athlon™ 3000 Series Desktop Processors with Radeon™ Graphics, AMD Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics, AMD Ryzen™ 5000 Series Desktop Processors, AMD Ryzen™ 3000 Serie
n™ 3000 Series Mobile Processors with Radeon™ Graphics, AMD Ryzen™ 5000 Series Desktop Processors, AMD Ryzen™ 3000 Series Mobile Processor with Radeon™ Graphics, AMD Ryzen™ 5000 Series Mobile Processors with Radeon™ Graphics, AMD Ryzen™ 4000 Series Mobile Processors with Radeon™ Graphics, AMD Ryzen™ 7020 Series Processors with Radeon™ Graphics, AMD Ryzen™ 4000 Series Desktop Processor with Radeon™ Graphics, AMD Ryzen™ 8000 Series Processor with Radeon™ Graphics, AMD Ryzen™ 6000 Series Processor with Radeon™ Graphics, AMD Ryzen™ 7035 Series Processor with Radeon™ Graphics, AMD Ryzen™ 5000 Series Processors with Radeon™ Graphics, AMD Ryzen™ 7030 Series Processors with Radeon™ Graphics, AMD Ryz
MD Ryzen™ 5000 Series Processors with Radeon™ Graphics, AMD Ryzen™ 7030 Series Processors with Radeon™ Graphics, AMD Ryzen™ 7040 Series Processors with Radeon™ Graphics, AMD Ryzen™ 7000 Series Desktop Processors, AMD Ryzen™ 7045 Series Mobile Processors Problem Types: CWE-1284 Description: Improper access control in the ASP could allow a privileged attacker to perform an out-of-bounds write to a memory location not controlled by the attacker, potentially leading to loss of confidentiality, integrity, or availability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.amd.com/en/resources/product-security/bulletin/amd-sb-6008.html
CVE ID: CVE-2023-20509 State: PUBLISHED Published: 2024-08-13T16:52:00.677Z Last Updated: 2024-11-04T17:20:36.376Z Severity: MEDIUM (CVSS 5.2 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:H/A:L) Vendors: AMD Products: AMD Radeon™ RX 6000 Series Graphics Cards, AMD Radeon™ PRO W6000 Series Graphics Cards, AMD Radeon™ RX 7000 Series Graphics Cards, AMD Radeon™ PRO W7000 Series Graphics Cards Description: An insufficient DRAM address validation in PMFW may allow a privileged attacker to perform a DMA read from an invalid DRAM address to SRAM, potentially resulting in loss of data integrity. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.amd.com/en/resources/product-securi
egrity. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.amd.com/en/resources/product-security/bulletin/amd-sb-6005.html
CVE ID: CVE-2023-20510 State: PUBLISHED Published: 2024-08-13T16:52:11.777Z Last Updated: 2024-11-21T15:32:34.695Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H) Vendors: AMD Products: AMD Radeon™ RX 6000 Series Graphics Cards, AMD Radeon™ PRO W6000 Series Graphics Cards Description: An insufficient DRAM address validation in PMFW may allow a privileged attacker to read from an invalid DRAM address to SRAM, potentially resulting in data corruption or denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.amd.com/en/resources/product-security/bulletin/amd-sb-6005.html
CVE ID: CVE-2023-20512 State: PUBLISHED Published: 2024-08-13T16:52:33.888Z Last Updated: 2024-10-30T18:55:07.803Z Severity: LOW (CVSS 1.9 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N) Vendors: AMD Products: AMD Radeon™ RX 6000 Series Graphics Cards, AMD Radeon™ PRO W6000 Series Graphics Cards Description: A hardcoded AES key in PMFW may result in a privileged attacker gaining access to the key, potentially resulting in internal debug information leakage. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.amd.com/en/resources/product-security/bulletin/amd-sb-6005.html
CVE ID: CVE-2023-20513 State: PUBLISHED Published: 2024-08-13T16:52:35.499Z Last Updated: 2024-10-29T18:25:20.962Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: AMD Products: AMD Radeon™ RX 6000 Series Graphics Cards, AMD Radeon™ PRO W6000 Series Graphics Cards Description: An insufficient bounds check in PMFW (Power Management Firmware) may allow an attacker to utilize a malicious VF (virtualization function) to send a malformed message, potentially resulting in a denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.amd.com/en/resources/product-security/bulletin/amd-sb-6005.html