Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-0191 State: PUBLISHED Published: 2023-04-01T04:51:09.537Z Last Updated: 2025-02-13T16:38:49.420Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) Vendors: NVIDIA Products: vGPU software (guest driver - Windows), vGPU software (guest driver - Linux), vGPU software (Virtual GPU Manager - Citrix Hypervisor, VMware vSphere, Red Hat Enterprise Linux KVM), NVIDIA Cloud Gaming (guest driver - Windows), NVIDIA Cloud Gaming (guest driver - Linux), NVIDIA Cloud Gaming (Virtual GPU Manager - Red Hat Enterprise Linux KVM) Problem Types: CWE-119 Description: NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer handler, wh
scription: NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer handler, where an out-of-bounds access may lead to denial of service or data tampering. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://nvidia.custhelp.com/app/answers/detail/a_id/5452 - https://security.gentoo.org/glsa/202310-02
CVE ID: CVE-2023-0192 State: PUBLISHED Published: 2023-04-01T04:52:15.595Z Last Updated: 2025-02-11T16:39:35.265Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:L) Vendors: NVIDIA Products: vGPU software (Virtual GPU Manager - Citrix Hypervisor, VMware vSphere, Red Hat Enterprise Linux KVM), NVIDIA Cloud Gaming (Virtual GPU Manager - Red Hat Enterprise Linux KVM) Problem Types: CWE-269 Description: NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer handler, where improper privilege management can lead to escalation of privileges and information disclosure. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: R
of privileges and information disclosure. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://nvidia.custhelp.com/app/answers/detail/a_id/5452
CVE ID: CVE-2023-0193 State: PUBLISHED Published: 2023-03-02T01:19:51.597Z Last Updated: 2025-03-05T21:30:00.350Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L) Vendors: NVIDIA Products: NVIDIA CUDA Toolkit Problem Types: CWE-125 Description: NVIDIA CUDA Toolkit SDK contains a vulnerability in cuobjdump, where a local user running the tool against a malicious binary may cause an out-of-bounds read, which may result in a limited denial of service and limited information disclosure. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://nvidia.custhelp.com/app/answers/detail/a_id/5446
CVE ID: CVE-2023-0194 State: PUBLISHED Published: 2023-04-01T04:53:48.218Z Last Updated: 2025-02-13T16:38:50.041Z Severity: LOW (CVSS 2 CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: NVIDIA Products: vGPU software (guest driver - Windows), NVIDIA Cloud Gaming (guest driver - Windows) Problem Types: CWE-1284 Description: NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer driver, where an invalid display configuration may lead to denial of service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://nvidia.custhelp.com/app/answers/detail/a_id/5452 - https://security.gentoo.org/glsa/202310-02
CVE ID: CVE-2023-0195 State: PUBLISHED Published: 2023-04-01T04:55:08.956Z Last Updated: 2025-02-13T16:38:50.625Z Severity: LOW (CVSS 2 CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: NVIDIA Products: vGPU software (guest driver - Windows), NVIDIA Cloud Gaming (guest driver - Windows) Problem Types: CWE-1284 Description: NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer driver nvlddmkm.sys, where an can cause CWE-1284, which may lead to hypothetical Information leak of unimportant data such as local variable data of the driver Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://nvidia.custhelp.com/app/
ditional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://nvidia.custhelp.com/app/answers/detail/a_id/5452 - https://security.gentoo.org/glsa/202310-02
CVE ID: CVE-2023-0196 State: PUBLISHED Published: 2023-03-02T01:23:31.384Z Last Updated: 2025-03-07T15:49:37.725Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Vendors: NVIDIA Products: NVIDIA CUDA Toolkit Problem Types: CWE-476 Description: NVIDIA CUDA Toolkit SDK contains a bug in cuobjdump, where a local user running the tool against an ill-formed binary may cause a null- pointer dereference, which may result in a limited denial of service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://nvidia.custhelp.com/app/answers/detail/a_id/5446
CVE ID: CVE-2023-0197 State: PUBLISHED Published: 2023-04-01T04:55:48.959Z Last Updated: 2025-02-11T16:38:07.401Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: NVIDIA Products: vGPU software (Virtual GPU Manager - Citrix Hypervisor, VMware vSphere, Red Hat Enterprise Linux KVM), NVIDIA Cloud Gaming (Virtual GPU Manager - Red Hat Enterprise Linux KVM) Problem Types: CWE-476 Description: NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager, where a malicious user in a guest VM can cause a NULL-pointer dereference, which may lead to denial of service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: -
may lead to denial of service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://nvidia.custhelp.com/app/answers/detail/a_id/5452
CVE ID: CVE-2023-0198 State: PUBLISHED Published: 2023-04-01T04:56:27.051Z Last Updated: 2025-02-13T16:38:51.192Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H) Vendors: NVIDIA Products: vGPU software (guest driver - Linux), vGPU software (Virtual GPU Manager - Citrix Hypervisor, VMware vSphere, Red Hat Enterprise Linux KVM), , NVIDIA Cloud Gaming (guest driver - Linux), NVIDIA Cloud Gaming (Virtual GPU Manager - Red Hat Enterprise Linux KVM) Problem Types: CWE-119 Description: NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer, where improper restriction of operations within the bounds of a memory buffer can lead to denial of serv
nel mode layer, where improper restriction of operations within the bounds of a memory buffer can lead to denial of service, information disclosure, and data tampering. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://nvidia.custhelp.com/app/answers/detail/a_id/5452 - https://security.gentoo.org/glsa/202310-02
CVE ID: CVE-2023-0199 State: PUBLISHED Published: 2023-04-22T02:19:48.182Z Last Updated: 2025-02-13T16:38:51.743Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H) Vendors: NVIDIA Products: NVIDIA GPU Display Driver Problem Types: CWE-787 Description: NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer handler, where an out-of-bounds write can lead to denial of service and data tampering. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://nvidia.custhelp.com/app/answers/detail/a_id/5452 - https://security.gentoo.org/glsa/202310-02
CVE ID: CVE-2023-0200 State: PUBLISHED Published: 2023-04-22T02:21:13.210Z Last Updated: 2025-02-04T19:17:11.381Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: NVIDIA Products: NVIDIA DGX servers Problem Types: CWE-788 Description: NVIDIA DGX-2 contains a vulnerability in OFBD where a user with high privileges and a pre-conditioned heap can cause an access beyond a buffers end, which may lead to code execution, escalation of privileges, denial of service, and information disclosure. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://nvidia.custhelp.com/app/answers/detail/a_id/5449
CVE ID: CVE-2023-0201 State: PUBLISHED Published: 2023-04-22T02:22:51.372Z Last Updated: 2025-02-04T19:16:43.629Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: NVIDIA Products: NVIDIA DGX servers Problem Types: CWE-118 Description: NVIDIA DGX-2 SBIOS contains a vulnerability in Bds, where a user with high privileges can cause a write beyond the bounds of an indexable resource, which may lead to code execution, denial of service, compromised integrity, and information disclosure. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://nvidia.custhelp.com/app/answers/detail/a_id/5449
CVE ID: CVE-2023-0202 State: PUBLISHED Published: 2023-04-22T02:23:32.519Z Last Updated: 2025-02-04T19:16:02.121Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: NVIDIA Products: NVIDIA DGX servers Problem Types: CWE-119 Description: NVIDIA DGX A100 SBIOS contains a vulnerability where an attacker may modify arbitrary memory of SMRAM by exploiting the GenericSio and LegacySmmSredir SMM APIs. A successful exploit of this vulnerability may lead to denial of service, escalation of privileges, and information disclosure. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://nvidia.custhelp.com/app/answers/detail/a_id/544
- CVE Program Container: - CISA ADP Vulnrichment: References: - https://nvidia.custhelp.com/app/answers/detail/a_id/5449
CVE ID: CVE-2023-0203 State: PUBLISHED Published: 2023-04-22T02:24:15.822Z Last Updated: 2025-02-04T19:04:46.466Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L) Vendors: NVIDIA Products: NVIDIA ConnectX Firmware Problem Types: CWE-1220 Description: NVIDIA ConnectX-5, ConnectX-6, and ConnectX6-DX contain a vulnerability in the NIC firmware, where an unprivileged user can exploit insufficient granularity of access control, which may lead to denial of service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://nvidia.custhelp.com/app/answers/detail/a_id/5459
CVE ID: CVE-2023-0204 State: PUBLISHED Published: 2023-04-22T02:24:54.842Z Last Updated: 2025-02-04T19:32:02.861Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H) Vendors: NVIDIA Products: NVIDIA ConnectX Firmware Problem Types: CWE-703 Description: NVIDIA ConnectX-5, ConnectX-6, and ConnectX6-DX contain a vulnerability in the NIC firmware, where an unprivileged user can cause improper handling of exceptional conditions, which may lead to denial of service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://nvidia.custhelp.com/app/answers/detail/a_id/5459
CVE ID: CVE-2023-0205 State: PUBLISHED Published: 2023-04-22T02:26:35.234Z Last Updated: 2025-02-04T19:31:29.111Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L) Vendors: NVIDIA Products: NVIDIA ConnectX Firmware Problem Types: CWE-1220 Description: NVIDIA ConnectX-5, ConnectX-6, and ConnectX6-DX contain a vulnerability in the NIC firmware, where an unprivileged user can exploit insufficient granularity of access control, which may lead to denial of service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://nvidia.custhelp.com/app/answers/detail/a_id/5459
CVE ID: CVE-2023-0206 State: PUBLISHED Published: 2023-04-22T02:27:25.553Z Last Updated: 2025-02-04T19:30:54.184Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: NVIDIA Products: NVIDIA DGX servers Problem Types: CWE-119 Description: NVIDIA DGX A100 SBIOS contains a vulnerability where an attacker may modify arbitrary memory of SMRAM by exploiting the NVME SMM API. A successful exploit of this vulnerability may lead to denial of service, escalation of privileges, and information disclosure. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://nvidia.custhelp.com/app/answers/detail/a_id/5449
CVE ID: CVE-2023-0207 State: PUBLISHED Published: 2023-04-22T02:28:08.389Z Last Updated: 2025-02-04T19:29:29.893Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: NVIDIA Products: NVIDIA DGX servers Problem Types: CWE-732 Description: NVIDIA DGX-2 SBIOS contains a vulnerability where an attacker may modify the ServerSetup NVRAM variable at runtime by executing privileged code. A successful exploit of this vulnerability may lead to denial of service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://nvidia.custhelp.com/app/answers/detail/a_id/5449
CVE ID: CVE-2023-0208 State: PUBLISHED Published: 2023-04-01T03:23:19.574Z Last Updated: 2025-02-11T16:43:49.223Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H) Vendors: NVIDIA Products: DCGM Problem Types: CWE-122 Description: NVIDIA DCGM for Linux contains a vulnerability in HostEngine (server component) where a user may cause a heap-based buffer overflow through the bound socket. A successful exploit of this vulnerability may lead to denial of service and data tampering. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://nvidia.custhelp.com/app/answers/detail/a_id/5453
CVE ID: CVE-2023-0209 State: PUBLISHED Published: 2023-04-22T02:28:54.450Z Last Updated: 2025-02-04T19:29:14.779Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: NVIDIA Products: NVIDIA DGX servers Problem Types: CWE-287 Description: NVIDIA DGX-1 SBIOS contains a vulnerability in the Uncore PEI module, where authentication of the code executed by SSA is missing, which may lead to arbitrary code execution, denial of service, escalation of privileges assisted by a firmware implant, information disclosure assisted by a firmware implant, data tampering, and SecureBoot bypass. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: -
pering, and SecureBoot bypass. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://nvidia.custhelp.com/app/answers/detail/a_id/5458
CVE ID: CVE-2023-0210 State: PUBLISHED Published: 2023-03-27T00:00:00.000Z Last Updated: 2025-02-19T16:10:39.887Z Vendors: n/a Products: Linux Kernel Problem Types: CWE-122 Description: A bug affects the Linux kernel’s ksmbd NTLMv2 authentication and is known to crash the OS immediately in Linux-based systems. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.openwall.com/lists/oss-security/2023/01/04/1 - https://www.openwall.com/lists/oss-security/2023/01/11/1 - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit - https://securityonline.info/cve-2023-0210-flaw-in-linux-kernel-allows-unauthenticated-remote-dos-attacks
ux.git/commit - https://securityonline.info/cve-2023-0210-flaw-in-linux-kernel-allows-unauthenticated-remote-dos-attacks/ - https://security.netapp.com/advisory/ntap-20230517-0002/ - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=797805d81baa814f76cf7bdab35f86408a79d707 - https://github.com/cifsd-team/ksmbd/commit/8824b7af409f51f1316e92e9887c2fd48c0b26d6
CVE ID: CVE-2023-0212 State: PUBLISHED Published: 2023-03-06T13:34:03.634Z Last Updated: 2025-03-06T15:03:51.807Z Vendors: Unknown Products: Advanced Recent Posts Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Advanced Recent Posts WordPress plugin through 0.6.14 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/5fdd44aa-7f3f-423a-9fb0-dc9dc36f33a3
CVE ID: CVE-2023-0213 State: PUBLISHED Published: 2023-03-29T10:22:45.724Z Last Updated: 2024-08-28T19:37:22.593Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: M-Files Products: M-Files Problem Types: CWE-427 Description: Elevation of privilege issue in M-Files Installer versions before 22.6 on Windows allows user to gain SYSTEM privileges via DLL hijacking. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://product.m-files.com/security-advisories/cve-2023-0213/
CVE ID: CVE-2023-0214 State: PUBLISHED Published: 2023-01-18T10:49:16.055Z Last Updated: 2025-04-03T18:07:47.531Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Skyhigh Security Products: Secure Web Gateway (SWG) Problem Types: CWE-79 Description: A cross-site scripting vulnerability in Skyhigh SWG in main releases 11.x prior to 11.2.6, 10.x prior to 10.2.17, and controlled release 12.x prior to 12.0.1 allows a remote attacker to craft SWG-specific internal requests with URL paths to any third-party website, causing arbitrary content to be injected into the response when accessed through SWG. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vul
injected into the response when accessed through SWG. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://kcm.trellix.com/corporate/index?page=content&id=SB10393
CVE ID: CVE-2023-0215 State: PUBLISHED Published: 2023-02-08T19:03:28.691Z Last Updated: 2025-11-04T19:14:32.988Z Vendors: OpenSSL Products: OpenSSL Problem Types: use-after-free Description: The public API function BIO_new_NDEF is a helper function used for streaming ASN.1 data via a BIO. It is primarily used internally to OpenSSL to support the SMIME, CMS and PKCS7 streaming capabilities, but may also be called directly by end user applications. The function receives a BIO from the caller, prepends a new BIO_f_asn1 filter BIO onto the front of it to form a BIO chain, and then returns the new head of the BIO chain to the caller. Under certain conditions, for example if a CMS recipient publi
then returns the new head of the BIO chain to the caller. Under certain conditions, for example if a CMS recipient public key is invalid, the new filter BIO is freed and the function returns a NULL result indicating a failure. However, in this case, the BIO chain is not properly cleaned up and the BIO passed by the caller still retains internal pointers to the previously freed filter BIO. If the caller then goes on to call BIO_pop() on the BIO then a use-after-free will occur. This will most likely result in a crash. This scenario occurs directly in the internal function B64_write_ASN1() which may cause BIO_new_NDEF() to be called and will subsequently call BIO_pop() on the BIO. This interna
4_write_ASN1() which may cause BIO_new_NDEF() to be called and will subsequently call BIO_pop() on the BIO. This internal function is in turn called by the public API functions PEM_write_bio_ASN1_stream, PEM_write_bio_CMS_stream, PEM_write_bio_PKCS7_stream, SMIME_write_ASN1, SMIME_write_CMS and SMIME_write_PKCS7. Other public API functions that may be impacted by this include i2d_ASN1_bio_stream, BIO_new_CMS, BIO_new_PKCS7, i2d_CMS_bio_stream and i2d_PKCS7_bio_stream. The OpenSSL cms and smime command line applications are similarly affected. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.openssl.org/news/secadv/20230207.txt - https://gi
Program Container: - CISA ADP Vulnrichment: References: - https://www.openssl.org/news/secadv/20230207.txt - https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=8818064ce3c3c0f1b740a5aaba2a987e75bfbafd - https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=c3829dd8825c654652201e16f8a0a0c46ee3f344 - https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=9816136fe31d92ace4037d5da5257f763aeeb4eb - https://security.netapp.com/advisory/ntap-20230427-0007/ - https://security.netapp.com/advisory/ntap-20230427-0009/ - https://security.gentoo.org/glsa/202402-08 - https://security.netapp.com/advisory/ntap-20240621-0006/
CVE ID: CVE-2023-0216 State: PUBLISHED Published: 2023-02-08T19:03:05.652Z Last Updated: 2025-11-04T19:14:34.082Z Vendors: OpenSSL Products: OpenSSL Problem Types: invalid pointer dereference Description: An invalid pointer dereference on read can be triggered when an application tries to load malformed PKCS7 data with the d2i_PKCS7(), d2i_PKCS7_bio() or d2i_PKCS7_fp() functions. The result of the dereference is an application crash which could lead to a denial of service attack. The TLS implementation in OpenSSL does not call this function however third party applications might call these functions on untrusted data. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment
might call these functions on untrusted data. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.openssl.org/news/secadv/20230207.txt - https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=934a04f0e775309cadbef0aa6b9692e1b12a76c6 - https://security.gentoo.org/glsa/202402-08
CVE ID: CVE-2023-0217 State: PUBLISHED Published: 2023-02-08T19:02:48.524Z Last Updated: 2025-11-04T19:14:35.179Z Vendors: OpenSSL Products: OpenSSL Problem Types: invalid pointer dereference Description: An invalid pointer dereference on read can be triggered when an application tries to check a malformed DSA public key by the EVP_PKEY_public_check() function. This will most likely lead to an application crash. This function can be called on public keys supplied from untrusted sources which could allow an attacker to cause a denial of service attack. The TLS implementation in OpenSSL does not call this function but applications might call the function if there are additional security requir
in OpenSSL does not call this function but applications might call the function if there are additional security requirements imposed by standards such as FIPS 140-3. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.openssl.org/news/secadv/20230207.txt - https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=23985bac83fd50c8e29431009302b5442f985096 - https://security.gentoo.org/glsa/202402-08
CVE ID: CVE-2023-0219 State: PUBLISHED Published: 2023-03-13T16:03:36.376Z Last Updated: 2025-02-27T15:46:50.142Z Vendors: Unknown Products: FluentSMTP Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The FluentSMTP WordPress plugin before 2.2.3 does not sanitize or escape email content, making it vulnerable to stored cross-site scripting attacks (XSS) when an administrator views the email logs. This exploit requires other plugins to enable users to send emails with unfiltered HTML. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/71662b72-311c-42db-86c5-a0276d25535c
CVE ID: CVE-2023-0220 State: PUBLISHED Published: 2023-02-13T14:32:08.000Z Last Updated: 2025-03-21T16:21:58.259Z Vendors: Unknown Products: Pinpoint Booking System Problem Types: CWE-89 SQL Injection Description: The Pinpoint Booking System WordPress plugin before 2.9.9.2.9 does not validate and escape one of its shortcode attributes before using it in a SQL statement, which could allow any authenticated users, such as subscriber to perform SQL Injection attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/d6d976be-31d1-419d-8729-4a36fbd2755c
CVE ID: CVE-2023-0221 State: PUBLISHED Published: 2023-01-13T15:19:03.662Z Last Updated: 2025-04-04T14:49:27.402Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: Trellix Products: Application and Change Control Problem Types: CWE-269 Description: Product security bypass vulnerability in ACC prior to version 8.3.4 allows a locally logged-in attacker with administrator privileges to bypass the execution controls provided by ACC using the utilman program. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://kcm.trellix.com/corporate/index?page=content&id=SB10370