Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-46820 State: PUBLISHED Published: 2023-11-30T14:38:26.733Z Last Updated: 2024-10-01T14:27:06.042Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Iulia Cazan Products: Image Regenerate & Select Crop Problem Types: CWE-200 Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Iulia Cazan Image Regenerate & Select Crop.This issue affects Image Regenerate & Select Crop: from n/a through 7.3.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/image-regenerate-select-crop/wordpress-image-regenerate-select-crop-plugin-7-3-0-sen
tchstack.com/database/vulnerability/image-regenerate-select-crop/wordpress-image-regenerate-select-crop-plugin-7-3-0-sensitive-data-exposure-via-log-file-vulnerability?_s_id=cve
CVE ID: CVE-2023-46821 State: PUBLISHED Published: 2023-11-06T09:12:35.730Z Last Updated: 2024-09-05T15:35:47.001Z Vendors: Milan Petrovic Products: GD Security Headers Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Milan Petrovic GD Security Headers allows auth. (admin+) SQL Injection.This issue affects GD Security Headers: from n/a through 1.7. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/gd-security-headers/wordpress-gd-security-headers-plugin-1-7-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2023-46822 State: PUBLISHED Published: 2023-11-06T09:30:17.576Z Last Updated: 2024-10-29T19:06:40.950Z Vendors: Visser Labs Products: Store Exporter for WooCommerce – Export Products, Export Orders, Export Subscriptions, and More Problem Types: CWE-79 Description: Unauth. Reflected Cross-Site Scripting') vulnerability in Visser Labs Store Exporter for WooCommerce – Export Products, Export Orders, Export Subscriptions, and More plugin <= 2.7.2 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/woocommerce-exporter/wordpress-store-exporter-for-woocommerce-plugin-2-7-2-cross-site-scripting
m/database/vulnerability/woocommerce-exporter/wordpress-store-exporter-for-woocommerce-plugin-2-7-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-46823 State: PUBLISHED Published: 2023-11-06T09:15:09.225Z Last Updated: 2025-02-26T21:14:10.204Z Vendors: Avirtum Products: ImageLinks Interactive Image Builder for WordPress Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Avirtum ImageLinks Interactive Image Builder for WordPress allows SQL Injection.This issue affects ImageLinks Interactive Image Builder for WordPress: from n/a through 1.5.4. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/imagelinks-interactive-image-builder-lite/wordpress-imageli
References: - https://patchstack.com/database/vulnerability/imagelinks-interactive-image-builder-lite/wordpress-imagelinks-interactive-image-builder-for-wordpress-plugin-1-5-4-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2023-46824 State: PUBLISHED Published: 2023-11-06T09:43:42.874Z Last Updated: 2024-10-29T19:09:57.832Z Vendors: Om Ak Solutions Products: Slick Popup: Contact Form 7 Popup Plugin Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Om Ak Solutions Slick Popup: Contact Form 7 Popup Plugin plugin <= 1.7.14 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/slick-popup/wordpress-slick-popup-plugin-1-7-14-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-46835 State: PUBLISHED Published: 2024-01-05T16:34:49.531Z Last Updated: 2025-11-04T19:25:41.611Z Vendors: Xen Products: Xen Description: The current setup of the quarantine page tables assumes that the quarantine domain (dom_io) has been initialized with an address width of DEFAULT_DOMAIN_ADDRESS_WIDTH (48) and hence 4 page table levels. However dom_io being a PV domain gets the AMD-Vi IOMMU page tables levels based on the maximum (hot pluggable) RAM address, and hence on systems with no RAM above the 512GB mark only 3 page-table levels are configured in the IOMMU. On systems without RAM above the 512GB boundary amd_iommu_quarantine_init() will setup page tables for the scr
he IOMMU. On systems without RAM above the 512GB boundary amd_iommu_quarantine_init() will setup page tables for the scratch page with 4 levels, while the IOMMU will be configured to use 3 levels only, resulting in the last page table directory (PDE) effectively becoming a page table entry (PTE), and hence a device in quarantine mode gaining write access to the page destined to be a PDE. Due to this page table level mismatch, the sink page the device gets read/write access to is no longer cleared between device assignment, possibly leading to data leaks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://xenbits.xenproject.org/xsa/advisory-445.h
Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://xenbits.xenproject.org/xsa/advisory-445.html
CVE ID: CVE-2023-46836 State: PUBLISHED Published: 2024-01-05T16:34:59.036Z Last Updated: 2025-11-04T19:25:42.692Z Vendors: Xen Products: Xen Description: The fixes for XSA-422 (Branch Type Confusion) and XSA-434 (Speculative Return Stack Overflow) are not IRQ-safe. It was believed that the mitigations always operated in contexts with IRQs disabled. However, the original XSA-254 fix for Meltdown (XPTI) deliberately left interrupts enabled on two entry paths; one unconditionally, and one conditionally on whether XPTI was active. As BTC/SRSO and Meltdown affect different CPU vendors, the mitigations are not active together by default. Therefore, there is a race condition whereby a malicious PV
vendors, the mitigations are not active together by default. Therefore, there is a race condition whereby a malicious PV guest can bypass BTC/SRSO protections and launch a BTC/SRSO attack against Xen. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://xenbits.xenproject.org/xsa/advisory-446.html
CVE ID: CVE-2023-46837 State: PUBLISHED Published: 2024-01-05T16:36:10.881Z Last Updated: 2025-11-04T18:18:50.284Z Vendors: Xen Products: Xen Description: Arm provides multiple helpers to clean & invalidate the cache for a given region. This is, for instance, used when allocating guest memory to ensure any writes (such as the ones during scrubbing) have reached memory before handing over the page to a guest. Unfortunately, the arithmetics in the helpers can overflow and would then result to skip the cache cleaning/invalidation. Therefore there is no guarantee when all the writes will reach the memory. This undefined behavior was meant to be addressed by XSA-437, but the approach was not suff
rites will reach the memory. This undefined behavior was meant to be addressed by XSA-437, but the approach was not sufficient. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://xenbits.xenproject.org/xsa/advisory-447.html - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XLL6SQ6IKFYXLYWITYZCRV5IBRK5G35R/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JFVKWYQFRUU3CAS53THTUKXEOUDWI42G/
CVE ID: CVE-2023-46838 State: PUBLISHED Published: 2024-01-29T10:18:48.418Z Last Updated: 2025-11-04T18:18:51.507Z Vendors: Linux Products: Linux Description: Transmit requests in Xen's virtual network protocol can consist of multiple parts. While not really useful, except for the initial part any of them may be of zero length, i.e. carry no data at all. Besides a certain initial portion of the to be transferred data, these parts are directly translated into what Linux calls SKB fragments. Such converted request parts can, when for a particular SKB they are all of length zero, lead to a de-reference of NULL in core networking code. Additional Analyst Notes: - CVE Program Container: - CISA AD
ro, lead to a de-reference of NULL in core networking code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://xenbits.xenproject.org/xsa/advisory-448.html - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZFYW6R64GPLUOXSQBJI3JBUX3HGLAYPP/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RGEKT4DKSDXDS34EL7M4UVJMMPH7Z3ZZ/ - https://lists.debian.org/debian-lts-announce/2024/06/msg00016.html - https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html
CVE ID: CVE-2023-46839 State: PUBLISHED Published: 2024-03-20T10:35:52.532Z Last Updated: 2025-11-04T18:18:53.943Z Vendors: Xen Products: Xen Description: PCI devices can make use of a functionality called phantom functions, that when enabled allows the device to generate requests using the IDs of functions that are otherwise unpopulated. This allows a device to extend the number of outstanding requests. Such phantom functions need an IOMMU context setup, but failure to setup the context is not fatal when the device is assigned. Not failing device assignment when such failure happens can lead to the primary device being assigned to a guest, while some of the phantom functions are assigned to
re happens can lead to the primary device being assigned to a guest, while some of the phantom functions are assigned to a different domain. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://xenbits.xenproject.org/xsa/advisory-449.html
CVE ID: CVE-2023-46840 State: PUBLISHED Published: 2024-03-20T10:40:18.050Z Last Updated: 2025-11-04T18:18:56.351Z Vendors: Xen Products: Xen Description: Incorrect placement of a preprocessor directive in source code results in logic that doesn't operate as intended when support for HVM guests is compiled out of Xen. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://xenbits.xenproject.org/xsa/advisory-450.html
CVE ID: CVE-2023-46841 State: PUBLISHED Published: 2024-03-20T10:40:36.597Z Last Updated: 2025-11-04T18:18:57.552Z Vendors: Xen Products: Xen Description: Recent x86 CPUs offer functionality named Control-flow Enforcement Technology (CET). A sub-feature of this are Shadow Stacks (CET-SS). CET-SS is a hardware feature designed to protect against Return Oriented Programming attacks. When enabled, traditional stacks holding both data and return addresses are accompanied by so called "shadow stacks", holding little more than return addresses. Shadow stacks aren't writable by normal instructions, and upon function returns their contents are used to check for possible manipulation of a return addr
rmal instructions, and upon function returns their contents are used to check for possible manipulation of a return address coming from the traditional stack. In particular certain memory accesses need intercepting by Xen. In various cases the necessary emulation involves kind of replaying of the instruction. Such replaying typically involves filling and then invoking of a stub. Such a replayed instruction may raise an exceptions, which is expected and dealt with accordingly. Unfortunately the interaction of both of the above wasn't right: Recovery involves removal of a call frame from the (traditional) stack. The counterpart of this operation for the shadow stack was missing. Additional Ana
l frame from the (traditional) stack. The counterpart of this operation for the shadow stack was missing. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://xenbits.xenproject.org/xsa/advisory-451.html - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZON4TLXG7TG4A2XZG563JMVTGQW4SF3A/
CVE ID: CVE-2023-46842 State: PUBLISHED Published: 2024-05-16T13:39:26.183Z Last Updated: 2025-11-04T17:12:51.532Z Vendors: Xen Products: Xen Description: Unlike 32-bit PV guests, HVM guests may switch freely between 64-bit and other modes. This in particular means that they may set registers used to pass 32-bit-mode hypercall arguments to values outside of the range 32-bit code would be able to set them to. When processing of hypercalls takes a considerable amount of time, the hypervisor may choose to invoke a hypercall continuation. Doing so involves putting (perhaps updated) hypercall arguments in respective registers. For guests not running in 64-bit mode this further involves a certain
ted) hypercall arguments in respective registers. For guests not running in 64-bit mode this further involves a certain amount of translation of the values. Unfortunately internal sanity checking of these translated values assumes high halves of registers to always be clear when invoking a hypercall. When this is found not to be the case, it triggers a consistency check in the hypervisor and causes a crash. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://xenbits.xenproject.org/xsa/advisory-454.html
CVE ID: CVE-2023-46845 State: PUBLISHED Published: 2023-11-07T07:39:57.896Z Last Updated: 2024-09-04T20:28:15.713Z Vendors: EC-CUBE CO.,LTD. Products: EC-CUBE 4 series, EC-CUBE 3 series Problem Types: Code injection Description: EC-CUBE 3 series (3.0.0 to 3.0.18-p6) and 4 series (4.0.0 to 4.0.6-p3, 4.1.0 to 4.1.2-p2, and 4.2.0 to 4.2.2) contain an arbitrary code execution vulnerability due to improper settings of the template engine Twig included in the product. As a result, arbitrary code may be executed on the server where the product is running by a user with an administrative privilege. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.
rative privilege. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ec-cube.net/info/weakness/20231026/index_40.php - https://www.ec-cube.net/info/weakness/20231026/index.php - https://www.ec-cube.net/info/weakness/20231026/index_3.php - https://jvn.jp/en/jp/JVN29195731/
CVE ID: CVE-2023-46846 State: PUBLISHED Published: 2023-11-03T07:33:16.184Z Last Updated: 2025-11-20T07:06:45.546Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N) Vendors: Red Hat Products: Red Hat Enterprise Linux 7 Extended Lifecycle Support, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions, Red Hat Enterprise Linux 8.2 Advanced Update Support, Red Hat Enterprise Linux 8.2 Telecommunications Update Service, Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions, Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.4 Telecommunications Update Service, Red Hat Enterprise
ced Mission Critical Update Support, Red Hat Enterprise Linux 8.4 Telecommunications Update Service, Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions, Red Hat Enterprise Linux 8.6 Extended Update Support, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.0 Extended Update Support, Red Hat Enterprise Linux 6 Problem Types: CWE-444 Description: SQUID is vulnerable to HTTP request smuggling, caused by chunked decoder lenience, allows a remote attacker to perform Request/Response smuggling past firewall and frontend security systems. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2023:6266 - https
- CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2023:6266 - https://access.redhat.com/errata/RHSA-2023:6267 - https://access.redhat.com/errata/RHSA-2023:6268 - https://access.redhat.com/errata/RHSA-2023:6748 - https://access.redhat.com/errata/RHSA-2023:6801 - https://access.redhat.com/errata/RHSA-2023:6803 - https://access.redhat.com/errata/RHSA-2023:6804 - https://access.redhat.com/errata/RHSA-2023:6810 - https://access.redhat.com/errata/RHSA-2023:7213 - https://access.redhat.com/errata/RHSA-2024:11049 - https://access.redhat.com/security/cve/CVE-2023-46846 - https://bugzilla.redhat.com/show_bug.cgi?id=2245910 - https://github.com/squid
.redhat.com/security/cve/CVE-2023-46846 - https://bugzilla.redhat.com/show_bug.cgi?id=2245910 - https://github.com/squid-cache/squid/security/advisories/GHSA-j83v-w3p4-5cqh
CVE ID: CVE-2023-46847 State: PUBLISHED Published: 2023-11-03T07:58:05.641Z Last Updated: 2025-11-20T07:06:47.294Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 6 Extended Lifecycle Support, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 7.6 Advanced Update Support(Disable again in 2026 - SPRHEL-7118), Red Hat Enterprise Linux 7.7 Advanced Update Support, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions, Red Hat Enterprise Linux 8.2 Advanced Update Support, Red Hat Enterprise Linux 8.2 Telecommunications Update Service, Red Hat Enterprise Linux 8.2 Update Services for
pport, Red Hat Enterprise Linux 8.2 Telecommunications Update Service, Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions, Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.4 Telecommunications Update Service, Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions, Red Hat Enterprise Linux 8.6 Extended Update Support, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.0 Extended Update Support Problem Types: CWE-120 Description: Squid is vulnerable to a Denial of Service, where a remote attacker can perform buffer overflow attack by writing up to 2 MB of arbitrary data to heap memory when Squid is configured to accept HT
form buffer overflow attack by writing up to 2 MB of arbitrary data to heap memory when Squid is configured to accept HTTP Digest Authentication. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2023:6266 - https://access.redhat.com/errata/RHSA-2023:6267 - https://access.redhat.com/errata/RHSA-2023:6268 - https://access.redhat.com/errata/RHSA-2023:6748 - https://access.redhat.com/errata/RHSA-2023:6801 - https://access.redhat.com/errata/RHSA-2023:6803 - https://access.redhat.com/errata/RHSA-2023:6804 - https://access.redhat.com/errata/RHSA-2023:6805 - https://access.redhat.com/errata/RHSA-2023:6810 - https://access.redhat.com/errata/RHSA-2
at.com/errata/RHSA-2023:6805 - https://access.redhat.com/errata/RHSA-2023:6810 - https://access.redhat.com/errata/RHSA-2023:6882 - https://access.redhat.com/errata/RHSA-2023:6884 - https://access.redhat.com/errata/RHSA-2023:7213 - https://access.redhat.com/errata/RHSA-2023:7576 - https://access.redhat.com/errata/RHSA-2023:7578 - https://access.redhat.com/security/cve/CVE-2023-46847 - https://bugzilla.redhat.com/show_bug.cgi?id=2245916 - https://github.com/squid-cache/squid/security/advisories/GHSA-phqj-m8gv-cq4g
CVE ID: CVE-2023-46848 State: PUBLISHED Published: 2023-11-03T07:58:05.613Z Last Updated: 2025-11-20T07:06:51.897Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.0 Extended Update Support, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8 Problem Types: CWE-681 Description: Squid is vulnerable to Denial of Service, where a remote attacker can perform DoS by sending ftp:// URLs in HTTP Request messages or constructing ftp:// URLs from FTP Native input. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-20
Native input. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2023:6266 - https://access.redhat.com/errata/RHSA-2023:6268 - https://access.redhat.com/errata/RHSA-2023:6748 - https://access.redhat.com/security/cve/CVE-2023-46848 - https://bugzilla.redhat.com/show_bug.cgi?id=2245919 - https://github.com/squid-cache/squid/security/advisories/GHSA-2g3c-pg7q-g59w
CVE ID: CVE-2023-46849 State: PUBLISHED Published: 2023-11-11T00:05:13.487Z Last Updated: 2025-06-11T14:30:02.796Z Vendors: OpenVPN Products: OpenVPN 2 (Community), Access Server Problem Types: CWE-369 Description: Using the --fragment option in certain configuration setups OpenVPN version 2.6.0 to 2.6.6 allows an attacker to trigger a divide by zero behaviour which could cause an application crash, leading to a denial of service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://community.openvpn.net/openvpn/wiki/CVE-2023-46849 - https://openvpn.net/security-advisory/access-server-security-update-cve-2023-46849-cve-2023-46850/ - https://www.de
49 - https://openvpn.net/security-advisory/access-server-security-update-cve-2023-46849-cve-2023-46850/ - https://www.debian.org/security/2023/dsa-5555 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L3FS46ANNTAVLIQY56ZKGM5CBTRVBUNE/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O54I7D753V6PU6XBU26FEROD2DSHEJQ4/
CVE ID: CVE-2023-46850 State: PUBLISHED Published: 2023-11-11T00:15:07.076Z Last Updated: 2025-02-13T17:14:45.269Z Vendors: OpenVPN Products: OpenVPN 2 (Community), Access Server Problem Types: CWE-416 Description: Use after free in OpenVPN version 2.6.0 to 2.6.6 may lead to undefined behavoir, leaking memory buffers or remote execution when sending network buffers to a remote peer. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://community.openvpn.net/openvpn/wiki/CVE-2023-46850 - https://openvpn.net/security-advisory/access-server-security-update-cve-2023-46849-cve-2023-46850/ - https://www.debian.org/security/2023/dsa-5555 - https://lists.f
-server-security-update-cve-2023-46849-cve-2023-46850/ - https://www.debian.org/security/2023/dsa-5555 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L3FS46ANNTAVLIQY56ZKGM5CBTRVBUNE/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O54I7D753V6PU6XBU26FEROD2DSHEJQ4/
CVE ID: CVE-2023-46851 State: PUBLISHED Published: 2023-11-07T08:56:35.172Z Last Updated: 2024-09-04T20:12:28.257Z Vendors: Apache Software Foundation Products: Apache Allura Problem Types: CWE-20, CWE-73, CWE-200 Description: Allura Discussion and Allura Forum importing does not restrict URL values specified in attachments. Project administrators can run these imports, which could cause Allura to read local files and expose them. Exposing internal files then can lead to other exploits, like session hijacking, or remote code execution. This issue affects Apache Allura from 1.0.1 through 1.15.0. Users are recommended to upgrade to version 1.16.0, which fixes the issue. If you are unable to up
1.0.1 through 1.15.0. Users are recommended to upgrade to version 1.16.0, which fixes the issue. If you are unable to upgrade, set "disable_entry_points.allura.importers = forge-tracker, forge-discussion" in your .ini config file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://allura.apache.org/posts/2023-allura-1.16.0.html - https://lists.apache.org/thread/hqk0vltl7qgrq215zgwjfoj0khbov0gx
CVE ID: CVE-2023-46852 State: PUBLISHED Published: 2023-10-27T00:00:00 Last Updated: 2024-09-09T15:36:33.049Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Memcached before 1.6.22, a buffer overflow exists when processing multiget requests in proxy mode, if there are many spaces after the "get" substring. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/memcached/memcached/commit/76a6c363c18cfe7b6a1524ae64202ac9db330767 - https://github.com/memcached/memcached/compare/1.6.21...1.6.22