Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-3287 State: PUBLISHED Published: 2024-07-09T10:17:37.145Z Last Updated: 2024-08-02T06:48:08.410Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Products: easyappointments Problem Types: CWE-639 Description: A BOLA vulnerability in POST /admins allows a low privileged user to create a high privileged user (admin) in the system. This results in privilege escalation. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/alextselegidis/easyappointments
CVE ID: CVE-2023-3288 State: PUBLISHED Published: 2024-07-09T10:30:32.889Z Last Updated: 2024-08-02T06:48:08.581Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N) Products: easyappointments Problem Types: CWE-639 Description: A BOLA vulnerability in POST /providers allows a low privileged user to create a privileged user (provider) in the system. This results in privilege escalation. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/alextselegidis/easyappointments
CVE ID: CVE-2023-3289 State: PUBLISHED Published: 2024-07-09T10:24:13.256Z Last Updated: 2024-08-02T06:48:08.585Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N) Products: easyappointments Problem Types: CWE-639 Description: A BOLA vulnerability in POST /services allows a low privileged user to create a service for any user in the system (including admin). This results in unauthorized data manipulation. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/alextselegidis/easyappointments
CVE ID: CVE-2023-3290 State: PUBLISHED Published: 2024-07-09T10:23:21.207Z Last Updated: 2024-08-02T06:48:08.412Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N) Products: easyappointments Problem Types: CWE-639 Description: A BOLA vulnerability in POST /customers allows a low privileged user to create a low privileged user (customer) in the system. This results in unauthorized data manipulation. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/alextselegidis/easyappointments
CVE ID: CVE-2023-3291 State: PUBLISHED Published: 2023-06-16T00:00:00 Last Updated: 2024-12-17T20:35:59.161Z Severity: MEDIUM (CVSS 5.1 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: gpac Products: gpac/gpac Problem Types: CWE-122 Description: Heap-based Buffer Overflow in GitHub repository gpac/gpac prior to 2.2.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/526954e6-8683-4697-bfa2-886c3204a1d5 - https://github.com/gpac/gpac/commit/6a748ccc3f76ff10e3ae43014967ea4b0c088aaf - https://www.debian.org/security/2023/dsa-5452
CVE ID: CVE-2023-3292 State: PUBLISHED Published: 2023-07-31T09:37:35.639Z Last Updated: 2024-10-17T20:59:55.146Z Vendors: Unknown Products: grid-kit-premium Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The grid-kit-premium WordPress plugin before 2.2.0 does not escape some parameters as well as generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/d993c385-c3ad-49a6-b079-3a1b090864c8
CVE ID: CVE-2023-3293 State: PUBLISHED Published: 2023-06-16T00:00:00 Last Updated: 2024-12-17T17:01:16.836Z Severity: HIGH (CVSS 7.6 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H) Vendors: salesagility Products: salesagility/suitecrm-core Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository salesagility/suitecrm-core prior to 8.3.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/22cb0ee3-e5da-40e0-9d2c-ace9b759f171 - https://github.com/salesagility/suitecrm-core/commit/1f949f1ac2b7fe82f3c2c6071f842b804ba91929
CVE ID: CVE-2023-3294 State: PUBLISHED Published: 2023-06-16T00:00:00 Last Updated: 2024-12-17T16:55:41.277Z Severity: HIGH (CVSS 7.6 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L) Vendors: saleor Products: saleor/react-storefront Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - DOM in GitHub repository saleor/react-storefront prior to c29aab226f07ca980cc19787dcef101e11b83ef7. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/9d308ebb-4289-411f-ac22-990383d98932 - https://github.com/saleor/react-storefront/commit/c29aab226f07ca980cc19787dcef101e11b83ef7
CVE ID: CVE-2023-3295 State: PUBLISHED Published: 2023-06-17T01:48:18.106Z Last Updated: 2024-08-29T15:51:41.042Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: unitecms Products: Unlimited Elements For Elementor (Free Widgets, Addons, Templates) Problem Types: CWE-434 Description: The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) for WordPress is vulnerable to arbitrary file uploads due to missing file type validation of files in the file manager functionality in versions up to, and including, 1.5.66 . This makes it possible for authenticated attackers, with contributor-level permissions and above, to upload arbitrary files on the affect
sible for authenticated attackers, with contributor-level permissions and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. The issue was partially patched in version 1.5.66 and fully patched in 1.5.67. CVE-2023-31231 appears to be a duplicate of this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ce1ac711-6026-49ef-b66b-2cc199697942?source=cve - https://plugins.trac.wordpress.org/browser/unlimited-elements-for-elementor/trunk/inc_php/unitecreator_assets.class.php#L1005
CVE ID: CVE-2023-3297 State: PUBLISHED Published: 2023-09-01T20:49:43.576Z Last Updated: 2024-09-30T20:19:08.943Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Canonical Ltd. Products: AccountService Problem Types: CWE-416 Description: In Ubuntu's accountsservice an unprivileged local attacker can trigger a use-after-free vulnerability in accountsservice by sending a D-Bus message to the accounts-daemon process. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://ubuntu.com/security/notices/USN-6190-1 - https://securitylab.github.com/advisories/GHSL-2023-139_accountsservice/ - https://bugs.launchpad.net/ubuntu/+s
6190-1 - https://securitylab.github.com/advisories/GHSL-2023-139_accountsservice/ - https://bugs.launchpad.net/ubuntu/+source/accountsservice/+bug/2024182 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-3297
CVE ID: CVE-2023-3299 State: PUBLISHED Published: 2023-07-19T23:35:12.990Z Last Updated: 2024-10-17T14:10:40.030Z Severity: LOW (CVSS 3.4 CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N) Vendors: HashiCorp Products: Nomad Enterprise Problem Types: CWE-201 Description: HashiCorp Nomad Enterprise 1.2.11 up to 1.5.6, and 1.4.10 ACL policies using a block without a label generates unexpected results. Fixed in 1.6.0, 1.5.7, and 1.4.11. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://discuss.hashicorp.com/t/hcsec-2023-21-nomad-caller-acl-tokens-secret-id-is-exposed-to-sentinel/56271
CVE ID: CVE-2023-3300 State: PUBLISHED Published: 2023-07-19T23:35:26.153Z Last Updated: 2024-10-24T19:48:48.228Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: HashiCorp Products: Nomad, Nomad Enterprise Problem Types: CWE-266 Description: HashiCorp Nomad and Nomad Enterprise 0.11.0 up to 1.5.6 and 1.4.1 HTTP search API can reveal names of available CSI plugins to unauthenticated users or users without the plugin:read policy. Fixed in 1.6.0, 1.5.7, and 1.4.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://discuss.hashicorp.com/t/hcsec-2023-22-nomad-search-api-leaks-information-about-csi-plugins/56272
CVE ID: CVE-2023-3301 State: PUBLISHED Published: 2023-09-13T16:09:36.861Z Last Updated: 2025-02-13T16:55:04.152Z Severity: MEDIUM (CVSS 5.6 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H) Vendors: n/a, Red Hat, Fedora Products: qemu, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8 Advanced Virtualization, Red Hat Enterprise Linux 9, Red Hat OpenStack Platform 13 (Queens), Extra Packages for Enterprise Linux, Fedora Problem Types: CWE-617 Description: A flaw was found in QEMU. The async nature of hot-unplug enables a race scenario where the net device backend is cleared before the virtio-net pci frontend has been unplugged. A malic
s a race scenario where the net device backend is cleared before the virtio-net pci frontend has been unplugged. A malicious guest could use this time window to trigger an assertion and cause a denial of service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2023-3301 - https://bugzilla.redhat.com/show_bug.cgi?id=2215784 - https://security.netapp.com/advisory/ntap-20231020-0008/
CVE ID: CVE-2023-3302 State: PUBLISHED Published: 2023-06-23T00:00:00 Last Updated: 2024-11-07T20:05:51.366Z Severity: MEDIUM (CVSS 6.6 CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N) Vendors: admidio Products: admidio/admidio Problem Types: CWE-1236 Description: Improper Neutralization of Formula Elements in a CSV File in GitHub repository admidio/admidio prior to 4.2.9. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/5e18619f-8379-464a-aad2-65883bb4e81a - https://github.com/admidio/admidio/commit/c87a7074a1a73c4851263060afd76aa4d5b6415f
CVE ID: CVE-2023-3303 State: PUBLISHED Published: 2023-06-23T00:00:00 Last Updated: 2024-11-07T20:01:13.744Z Severity: MEDIUM (CVSS 6.4 CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H) Vendors: admidio Products: admidio/admidio Problem Types: CWE-284 Description: Improper Access Control in GitHub repository admidio/admidio prior to 4.2.9. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/65d260cc-55a9-4e71-888d-cb2f66c071af - https://github.com/admidio/admidio/commit/3d8bafaa4e9b7a314ffdf548622a8c7b38faee8a
CVE ID: CVE-2023-3304 State: PUBLISHED Published: 2023-06-23T00:00:00 Last Updated: 2024-11-07T19:58:09.309Z Severity: MEDIUM (CVSS 5.9 CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N) Vendors: admidio Products: admidio/admidio Problem Types: CWE-284 Description: Improper Access Control in GitHub repository admidio/admidio prior to 4.2.9. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/721fae61-3c8c-4e4b-8407-64321bc0ed17 - https://github.com/admidio/admidio/commit/3b248b7d5e0e60a00ee2f9a6908d538d62a5837f
CVE ID: CVE-2023-3305 State: PUBLISHED Published: 2023-06-18T07:31:03.795Z Last Updated: 2024-08-02T06:48:08.466Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: C-DATA Products: Web Management System Problem Types: CWE-284 Description: A vulnerability was found in C-DATA Web Management System up to 20230607. It has been classified as critical. This affects an unknown part of the file /cgi-bin/jumpto.php?class=user&page=config_save&isphp=1 of the component User Creation Handler. The manipulation of the argument user/newpassword leads to improper access controls. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The iden
. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-231801 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.231801 - https://vuldb.com/?ctiid.231801 - https://github.com/sleepyvv/vul_report/blob/main/C-data/BrokenAccessControl.md
CVE ID: CVE-2023-3306 State: PUBLISHED Published: 2023-06-18T08:00:04.675Z Last Updated: 2024-12-16T19:58:23.915Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Ruijie Products: RG-EW1200G Problem Types: CWE-284 Description: A vulnerability was found in Ruijie RG-EW1200G EW_3.0(1)B11P204. It has been declared as critical. This vulnerability affects unknown code of the file app.09df2a9e44ab48766f5f.js of the component Admin Password Handler. The manipulation leads to improper access controls. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-231802 is the identifier assigned to this vulnerability. NOTE: The vendor was contact
to the public and may be used. VDB-231802 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.231802 - https://vuldb.com/?ctiid.231802 - https://github.com/RCEraser/cve/blob/main/RG-EW1200G.md
CVE ID: CVE-2023-3307 State: PUBLISHED Published: 2023-06-18T08:31:03.693Z Last Updated: 2024-08-02T06:48:08.449Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: n/a Products: miniCal Problem Types: CWE-89 Description: A vulnerability was found in miniCal 1.0.0. It has been rated as critical. This issue affects some unknown processing of the file /booking/show_bookings/. The manipulation of the argument search_query leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-231803. NOTE: The vendor was contacted early about this disclosure but did not respond i
er of this vulnerability is VDB-231803. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.231803 - https://vuldb.com/?ctiid.231803 - https://github.com/ctflearner/Vulnerability/blob/main/MINICAL/minical.md
CVE ID: CVE-2023-3308 State: PUBLISHED Published: 2023-06-18T09:00:03.513Z Last Updated: 2024-08-02T06:48:08.592Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: whaleal Products: IceFrog Problem Types: CWE-502 Description: A vulnerability classified as problematic has been found in whaleal IceFrog 1.1.8. Affected is an unknown function of the component Aviator Template Engine. The manipulation leads to deserialization. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-231804. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.231804 - https:/
al Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.231804 - https://vuldb.com/?ctiid.231804 - https://github.com/NanKeXXX/selfVuln_poc/blob/main/whaleal%3Aicefrog/icefrog_1.1.8_RCE.md
CVE ID: CVE-2023-3309 State: PUBLISHED Published: 2023-06-18T11:31:03.536Z Last Updated: 2024-12-18T15:30:32.863Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: SourceCodester Products: Resort Reservation System Problem Types: CWE-79 Description: A vulnerability classified as problematic was found in SourceCodester Resort Reservation System 1.0. Affected by this vulnerability is an unknown functionality of the file ?page=rooms of the component Manage Room Page. The manipulation of the argument Cottage Number leads to cross site scripting. The attack can be launched remotely. The identifier VDB-231805 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Cont
hed remotely. The identifier VDB-231805 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.231805 - https://vuldb.com/?ctiid.231805 - https://kr1shna4garwal.github.io/posts/cve-poc-2023/#cve-2023-3309
CVE ID: CVE-2023-3310 State: PUBLISHED Published: 2023-06-18T12:00:04.928Z Last Updated: 2024-08-02T06:48:08.461Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: code-projects Products: Agro-School Management System Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, has been found in code-projects Agro-School Management System 1.0. Affected by this issue is some unknown functionality of the file loaddata.php. The manipulation of the argument subject/course leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-231806 is the identifier assigned to this vulnerability. Additio
t has been disclosed to the public and may be used. VDB-231806 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.231806 - https://vuldb.com/?ctiid.231806 - https://github.com/humaowei/CVEHub/blob/main/Agro-School%20Management%20System%20loaddata.php%20has%20Sqlinjection.pdf
CVE ID: CVE-2023-3311 State: PUBLISHED Published: 2023-06-18T15:00:04.431Z Last Updated: 2024-11-27T16:19:20.053Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N) Vendors: PuneethReddyHC Products: online-shopping-system-advanced Problem Types: CWE-79 Description: A vulnerability, which was classified as problematic, was found in PuneethReddyHC online-shopping-system-advanced 1.0. This affects an unknown part of the file addsuppliers.php. The manipulation of the argument First name leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-231807. Additio
has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-231807. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.231807 - https://vuldb.com/?ctiid.231807 - https://kr1shna4garwal.github.io/posts/cve-poc-2023/#cve-2023-3311
CVE ID: CVE-2023-3312 State: PUBLISHED Published: 2023-06-19T00:00:00.000Z Last Updated: 2025-04-23T16:21:06.293Z Vendors: n/a Products: Kernel Problem Types: CWE-415 Description: A vulnerability was found in drivers/cpufreq/qcom-cpufreq-hw.c in cpufreq subsystem in the Linux Kernel. This flaw, during device unbind will lead to double release problem leading to denial of service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchwork.kernel.org/project/linux-pm/patch/20230323174026.950622-1-krzysztof.kozlowski%40linaro.org/ - https://security.netapp.com/advisory/ntap-20230731-0005/
CVE ID: CVE-2023-3313 State: PUBLISHED Published: 2023-07-03T07:53:15.697Z Last Updated: 2024-11-22T16:45:16.911Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Trellix Products: Enterprise Security Manager Problem Types: CWE-78 Description: An OS common injection vulnerability exists in the ESM certificate API, whereby incorrectly neutralized special elements may have allowed an unauthorized user to execute system command injection for the purpose of privilege escalation or to execute arbitrary commands. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://kcm.trellix.com/corporate/index?page=content&id=SB10403
CVE ID: CVE-2023-3314 State: PUBLISHED Published: 2023-07-03T08:02:29.010Z Last Updated: 2024-10-25T13:07:40.821Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) Vendors: Trellix Products: Enterprise Security Manager Problem Types: CWE-78 Description: A vulnerability arises out of a failure to comprehensively sanitize the processing of a zip file(s). Incomplete neutralization of external commands used to control the process execution of the .zip application allows an authorized user to obtain control of the .zip application to execute arbitrary commands or obtain elevation of system privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment:
ds or obtain elevation of system privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://kcm.trellix.com/corporate/index?page=content&id=SB10403
CVE ID: CVE-2023-3315 State: PUBLISHED Published: 2023-06-19T20:10:21.312Z Last Updated: 2024-12-11T16:57:20.721Z Vendors: Jenkins Project Products: Jenkins Team Concert Plugin Description: Missing permission checks in Jenkins Team Concert Plugin 2.4.1 and earlier allow attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-06-14/#SECURITY-2932
CVE ID: CVE-2023-3316 State: PUBLISHED Published: 2023-06-19T11:10:41.964Z Last Updated: 2025-11-03T20:35:32.533Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: libtiff Products: libtiff Problem Types: CWE-476 Description: A NULL pointer dereference in TIFFClose() is caused by a failure to open an output file (non-existent path or a path that requires permissions like /dev/null) while specifying zones. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://research.jfrog.com/vulnerabilities/libtiff-nullderef-dos-xray-522144/ - https://gitlab.com/libtiff/libtiff/-/issues/515 - https://gitlab.com/libtiff/libtiff/-/me
f-nullderef-dos-xray-522144/ - https://gitlab.com/libtiff/libtiff/-/issues/515 - https://gitlab.com/libtiff/libtiff/-/merge_requests/468 - https://lists.debian.org/debian-lts-announce/2023/07/msg00034.html
CVE ID: CVE-2023-3317 State: PUBLISHED Published: 2023-06-23T00:00:00.000Z Last Updated: 2025-03-11T14:05:29.173Z Vendors: n/a Products: Kernel Problem Types: CWE-416 Description: A use-after-free flaw was found in mt7921_check_offload_capability in drivers/net/wireless/mediatek/mt76/mt7921/init.c in wifi mt76/mt7921 sub-component in the Linux Kernel. This flaw could allow an attacker to crash the system after 'features' memory release. This vulnerability could even lead to a kernel information leak problem. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchwork.kernel.org/project/linux-wireless/patch/51fd8f76494348aa9ecbf0abc471ebe47a983d
richment: References: - https://patchwork.kernel.org/project/linux-wireless/patch/51fd8f76494348aa9ecbf0abc471ebe47a983dfd.1679502607.git.lorenzo%40kernel.org/
CVE ID: CVE-2023-3318 State: PUBLISHED Published: 2023-06-19T12:31:02.959Z Last Updated: 2024-08-02T06:55:02.762Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: SourceCodester Products: Resort Management System Problem Types: CWE-79 Description: A vulnerability was found in SourceCodester Resort Management System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality. The manipulation of the argument page leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-231937 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program C
and may be used. The identifier VDB-231937 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.231937 - https://vuldb.com/?ctiid.231937 - https://kr1shna4garwal.github.io/posts/cve-poc-2023/#cve-2023-3318