Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-0450 State: PUBLISHED Published: 2023-04-05T00:00:00.000Z Last Updated: 2025-02-11T15:29:29.135Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: GitLab Products: GitLab Problem Types: Vulnerability in GitLab Description: An issue has been discovered in GitLab affecting all versions starting from 8.1 to 15.8.5, and from 15.9 to 15.9.4, and from 15.10 to 15.10.1. It was possible to add a branch with an ambiguous name that could be used to social engineer users. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/388962 - https://hackerone.com/reports/1831547 - htt
chment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/388962 - https://hackerone.com/reports/1831547 - https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0450.json
CVE ID: CVE-2023-0451 State: PUBLISHED Published: 2023-01-26T20:37:53.380Z Last Updated: 2025-01-16T21:59:03.789Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Econolite Products: EOS Problem Types: CWE-284 Description: Econolite EOS versions prior to 3.2.23 lack a password requirement for gaining “READONLY” access to log files and certain database and configuration files. One such file contains tables with MD5 hashes and usernames for all defined users in the control software, including administrators and technicians. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-23-
tes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-23-026-02
CVE ID: CVE-2023-0452 State: PUBLISHED Published: 2023-01-26T20:39:37.729Z Last Updated: 2025-01-16T21:58:55.805Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Econolite Products: EOS Problem Types: CWE-328 Description: Econolite EOS versions prior to 3.2.23 use a weak hash algorithm for encrypting privileged user credentials. A configuration file that is accessible without authentication uses MD5 hashes for encrypting credentials, including those of administrators and technicians. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-23-026-02
CVE ID: CVE-2023-0453 State: PUBLISHED Published: 2023-02-21T08:50:54.150Z Last Updated: 2025-03-12T15:08:26.567Z Vendors: Unknown Products: WP Private Message Problem Types: CWE-639 Authorization Bypass Through User-Controlled Key Description: The WP Private Message WordPress plugin (bundled with the Superio theme as a required plugin) before 1.0.6 does not ensure that private messages to be accessed belong to the user making the requests. This allowing any authenticated users to access private messages belonging to other users by tampering the ID. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/f915e5ac-e216-4d1c-ae
: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/f915e5ac-e216-4d1c-aec1-c3be11e2a6de - https://themeforest.net/item/superio-job-board-wordpress-theme/32180231
CVE ID: CVE-2023-0454 State: PUBLISHED Published: 2023-02-01T00:00:00.000Z Last Updated: 2025-03-27T14:41:27.319Z Vendors: n/a Products: OrangeScrum Problem Types: Path Traversal Description: OrangeScrum version 2.0.11 allows an authenticated external attacker to delete arbitrary local files from the server. This is possible because the application uses an unsanitized attacker-controlled parameter to construct an internal path. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/slushii/ - https://github.com/Orangescrum/orangescrum/
CVE ID: CVE-2023-0455 State: PUBLISHED Published: 2023-01-26T00:00:00.000Z Last Updated: 2025-03-31T16:48:09.399Z Severity: HIGH (CVSS 7.6 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L) Vendors: unilogies Products: unilogies/bumsys Problem Types: CWE-434 Description: Unrestricted Upload of File with Dangerous Type in GitHub repository unilogies/bumsys prior to v1.0.3-beta. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/b5e9c578-1a33-4745-bf6b-e7cdb89793f7 - https://github.com/unilogies/bumsys/commit/a5beff7868ab63bf4ec752a1102f8da033c66b28 - http://packetstormsecurity.com/files/172674/Bumsys-Business-Management-System-1.0.3
7868ab63bf4ec752a1102f8da033c66b28 - http://packetstormsecurity.com/files/172674/Bumsys-Business-Management-System-1.0.3-beta-Shell-Upload.html
CVE ID: CVE-2023-0456 State: PUBLISHED Published: 2023-09-27T13:39:37.294Z Last Updated: 2024-09-24T14:12:37.141Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: n/a, Red Hat Products: apicast, Red Hat 3scale API Management Platform 2 Problem Types: CWE-285 Description: A flaw was found in APICast, when 3Scale's OIDC module does not properly evaluate the response to a mismatched token from a separate realm. This could allow a separate realm to be accessible to an attacker, permitting access to unauthorized information. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2023-0456
s: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2023-0456 - https://bugzilla.redhat.com/show_bug.cgi?id=2163586
CVE ID: CVE-2023-0457 State: PUBLISHED Published: 2023-03-03T04:18:15.787Z Last Updated: 2025-03-05T20:02:32.364Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Mitsubishi Electric Corporation Products: MELSEC iQ-F Series FX5U-32MT/ES, MELSEC iQ-F Series FX5U-64MT/ES, MELSEC iQ-F Series FX5U-80MT/ES, MELSEC iQ-F Series FX5U-32MR/ES, MELSEC iQ-F Series FX5U-64MR/ES, MELSEC iQ-F Series FX5U-80MR/ES, MELSEC iQ-F Series FX5U-32MT/DS, MELSEC iQ-F Series FX5U-64MT/DS, MELSEC iQ-F Series FX5U-80MT/DS, MELSEC iQ-F Series FX5U-32MR/DS, MELSEC iQ-F Series FX5U-64MR/DS, MELSEC iQ-F Series FX5U-80MR/DS, MELSEC iQ-F Series FX5U-32MT/ESS, MELSEC iQ-F Series FX5U-64MT/ESS,
ries FX5U-64MR/DS, MELSEC iQ-F Series FX5U-80MR/DS, MELSEC iQ-F Series FX5U-32MT/ESS, MELSEC iQ-F Series FX5U-64MT/ESS, MELSEC iQ-F Series FX5U-80MT/ESS, MELSEC iQ-F Series FX5U-32MT/DSS, MELSEC iQ-F Series FX5U-64MT/DSS, MELSEC iQ-F Series FX5U-80MT/DSS, MELSEC iQ-F Series FX5UC-32MT/D, MELSEC iQ-F Series FX5UC-64MT/D, MELSEC iQ-F Series FX5UC-96MT/D, MELSEC iQ-F Series FX5UC-32MT/DSS, MELSEC iQ-F Series FX5UC-64MT/DSS, MELSEC iQ-F Series FX5UC-96MT/DSS, MELSEC iQ-F Series FX5UC-32MT/DS-TS, MELSEC iQ-F Series FX5UC-32MT/DSS-TS, MELSEC iQ-F Series FX5UC-32MR/DS-TS, MELSEC iQ-F Series FX5UJ-24MT/ES, MELSEC iQ-F Series FX5UJ-40MT/ES, MELSEC iQ-F Series FX5UJ-60MT/ES, MELSEC iQ-F Series FX5UJ-2
Q-F Series FX5UJ-24MT/ES, MELSEC iQ-F Series FX5UJ-40MT/ES, MELSEC iQ-F Series FX5UJ-60MT/ES, MELSEC iQ-F Series FX5UJ-24MR/ES, MELSEC iQ-F Series FX5UJ-40MR/ES, MELSEC iQ-F Series FX5UJ-60MR/ES, MELSEC iQ-F Series FX5UJ-24MT/ESS, MELSEC iQ-F Series FX5UJ-40MT/ESS, MELSEC iQ-F Series FX5UJ-60MT/ESS, MELSEC iQ-F Series FX5UJ-24MT/ES-A, MELSEC iQ-F Series FX5UJ-40MT/ES-A, MELSEC iQ-F Series FX5UJ-60MT/ES-A, MELSEC iQ-F Series FX5UJ-24MR/ES-A, MELSEC iQ-F Series FX5UJ-40MR/ES-A, MELSEC iQ-F Series FX5UJ-60MR/ES-A, MELSEC iQ-F Series FX5S-30MT/ES, MELSEC iQ-F Series FX5S-40MT/ES, MELSEC iQ-F Series FX5S-60MT/ES, MELSEC iQ-F Series FX5S-80MT/ES, MELSEC iQ-F Series FX5S-30MR/ES, MELSEC iQ-F Series
S, MELSEC iQ-F Series FX5S-60MT/ES, MELSEC iQ-F Series FX5S-80MT/ES, MELSEC iQ-F Series FX5S-30MR/ES, MELSEC iQ-F Series FX5S-40MR/ES, MELSEC iQ-F Series FX5S-60MR/ES, MELSEC iQ-F Series FX5S-80MR/ES, MELSEC iQ-F Series FX5S-30MT/ESS, MELSEC iQ-F Series FX5S-40MT/ESS, MELSEC iQ-F Series FX5S-60MT/ESS, MELSEC iQ-F Series FX5S-80MT/ESS, MELSEC iQ-F Series FX5-ENET, MELSEC iQ-F Series FX5-ENET/IP, MELSEC iQ-R Series R00CPU, MELSEC iQ-R Series R01CPU, MELSEC iQ-R Series R02CPU, MELSEC iQ-R Series R04CPU, MELSEC iQ-R Series R08CPU, MELSEC iQ-R Series R16CPU, MELSEC iQ-R Series R32CPU, MELSEC iQ-R Series R120CPU, MELSEC iQ-R Series R04ENCPU, MELSEC iQ-R Series R08ENCPU, MELSEC iQ-R Series R16ENCPU
32CPU, MELSEC iQ-R Series R120CPU, MELSEC iQ-R Series R04ENCPU, MELSEC iQ-R Series R08ENCPU, MELSEC iQ-R Series R16ENCPU, MELSEC iQ-R Series R32ENCPU, MELSEC iQ-R Series R120ENCPU, MELSEC iQ-R Series R08SFCPU, MELSEC iQ-R Series R16SFCPU, MELSEC iQ-R Series R32SFCPU, MELSEC iQ-R Series R120SFCPU, MELSEC iQ-R Series R08PCPU, MELSEC iQ-R Series R16PCPU, MELSEC iQ-R Series R32PCPU, MELSEC iQ-R Series R120PCPU, MELSEC iQ-R Series R08PSFCPU, MELSEC iQ-R Series R16PSFCPU, MELSEC iQ-R Series R32PSFCPU, MELSEC iQ-R Series R120PSFCPU, MELSEC iQ-R Series RJ71EN71, MELSEC iQ-R Series R12CCPU-V, MELSEC-Q Series Q03UDECPU, MELSEC-Q Series Q04UDEHCPU, MELSEC-Q Series Q06UDEHCPU, MELSEC-Q Series Q10UDEHCPU
R12CCPU-V, MELSEC-Q Series Q03UDECPU, MELSEC-Q Series Q04UDEHCPU, MELSEC-Q Series Q06UDEHCPU, MELSEC-Q Series Q10UDEHCPU, MELSEC-Q Series Q13UDEHCPU, MELSEC-Q Series Q20UDEHCPU, MELSEC-Q Series Q26UDEHCPU, MELSEC-Q Series Q50UDEHCPU, MELSEC-Q Series Q100UDEHCPU, MELSEC-Q Series Q03UDVCPU, MELSEC-Q Series Q04UDVCPU, MELSEC-Q Series Q06UDVCPU, MELSEC-Q Series Q13UDVCPU, MELSEC-Q Series Q26UDVCPU, MELSEC-Q Series Q04UDPVCPU, MELSEC-Q Series Q06UDPVCPU, MELSEC-Q Series Q13UDPVCPU, MELSEC-Q Series Q26UDPVCPU, MELSEC-Q Series QJ71E71-100, MELSEC-L Series L02CPU, MELSEC-L Series L06CPU, MELSEC-L Series L26CPU, MELSEC-L Series L02CPU-P, MELSEC-L Series L06CPU-P, MELSEC-L Series L26CPU-P, MELSEC-L Se
06CPU, MELSEC-L Series L26CPU, MELSEC-L Series L02CPU-P, MELSEC-L Series L06CPU-P, MELSEC-L Series L26CPU-P, MELSEC-L Series L26CPU-BT, MELSEC-L Series L26CPU-PBT, MELSEC-L Series LJ71E71-100 Problem Types: CWE-256 Description: Plaintext Storage of a Password vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series, MELSEC iQ-R Series, MELSEC-Q Series and MELSEC-L Series allows a remote unauthenticated attacker to disclose plaintext credentials stored in project files and login into FTP server or Web server. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-023_en.pdf - https
SA ADP Vulnrichment: References: - https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-023_en.pdf - https://jvn.jp/vu/JVNVU93891523/index.html - https://www.cisa.gov/news-events/ics-advisories/icsa-23-061-01
CVE ID: CVE-2023-0458 State: PUBLISHED Published: 2023-04-26T18:03:11.815Z Last Updated: 2025-02-13T16:38:58.312Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Linux Products: Linux Kernel Problem Types: CWE-476 Description: A speculative pointer dereference problem exists in the Linux Kernel on the do_prlimit() function. The resource argument value is controlled and is used in pointer arithmetic for the 'rlim' variable and can be used to leak the contents. We recommend upgrading past version 6.1.8 or commit 739790605705ddcf18f21782b9c99ad7d53a8c11 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.
d7d53a8c11 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/diff/kernel/sys.c?id=v6.1.8&id2=v6.1.7 - https://github.com/torvalds/linux/commit/739790605705ddcf18f21782b9c99ad7d53a8c11 - https://lists.debian.org/debian-lts-announce/2023/05/msg00005.html - https://lists.debian.org/debian-lts-announce/2023/05/msg00006.html
CVE ID: CVE-2023-0459 State: PUBLISHED Published: 2023-05-25T13:22:38.338Z Last Updated: 2024-09-26T18:39:17.009Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Linux Products: Linux Kernel Problem Types: CWE-763 Description: Copy_from_user on 64-bit versions of the Linux kernel does not implement the __uaccess_begin_nospec allowing a user to bypass the "access_ok" check and pass a kernel pointer to copy_from_user(). This would allow an attacker to leak information. We recommend upgrading beyond commit 74e19ef0ff8061ef55957c3abd71614ef0f42f47 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/torvald
f47 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/torvalds/linux/commit/4b842e4e25b12951fa10dedb4bc16bc47e3b850c - https://github.com/torvalds/linux/commit/74e19ef0ff8061ef55957c3abd71614ef0f42f47
CVE ID: CVE-2023-0460 State: PUBLISHED Published: 2023-03-01T16:50:12.807Z Last Updated: 2025-03-07T21:33:17.205Z Severity: MEDIUM (CVSS 5.1 CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:U/C:L/I:H/A:N) Vendors: Google Products: YouTube Android Player API SDK Problem Types: CWE-470 Description: The YouTube Embedded 1.2 SDK binds to a service within the YouTube Main App. After binding, a remote context is created with the flags Context.CONTEXT_INCLUDE_CODE | Context.CONTEXT_IGNORE_SECURITY. This allows the client app to remotely load code from YouTube Main App by retrieving the Main App’s ClassLoader. A potential vulnerability in the binding logic used by the client SDK where the SDK ends up calling bindServ
lassLoader. A potential vulnerability in the binding logic used by the client SDK where the SDK ends up calling bindService() on a malicious app rather than YT Main App. This creates a vulnerability where the SDK can load the malicious app’s ClassLoader instead, allowing the malicious app to load arbitrary code into the calling app whenever the embedded SDK is invoked. In order to trigger this vulnerability, an attacker must masquerade the Youtube app and install it on a device, have a second app that uses the Embedded player and typically distribute both to the victim outside of the Play Store. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https:/
ide of the Play Store. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://developers.google.com/youtube/android/player/downloads
CVE ID: CVE-2023-0461 State: PUBLISHED Published: 2023-02-28T14:23:02.224Z Last Updated: 2025-02-13T16:38:58.993Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Linux Products: Linux Kernel Problem Types: CWE-416 Description: There is a use-after-free vulnerability in the Linux Kernel which can be exploited to achieve local privilege escalation. To reach the vulnerability kernel configuration flag CONFIG_TLS or CONFIG_XFRM_ESPINTCP has to be configured, but the operation does not require any privilege. There is a use-after-free bug of icsk_ulp_data of a struct inet_connection_sock. When CONFIG_TLS is enabled, user can install a tls context (struct tls_context
lp_data of a struct inet_connection_sock. When CONFIG_TLS is enabled, user can install a tls context (struct tls_context) on a connected tcp socket. The context is not cleared if this socket is disconnected and reused as a listener. If a new socket is created from the listener, the context is inherited and vulnerable. The setsockopt TCP_ULP operation does not require any privilege. We recommend upgrading past commit 2c02d41d71f90a5168391b6a5f2954112ba2307c Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://kernel.dance/#2c02d41d71f90a5168391b6a5f2954112ba2307c - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=2c02d4
d71f90a5168391b6a5f2954112ba2307c - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=2c02d41d71f90a5168391b6a5f2954112ba2307c - https://lists.debian.org/debian-lts-announce/2023/05/msg00005.html - https://lists.debian.org/debian-lts-announce/2023/05/msg00006.html
CVE ID: CVE-2023-0462 State: PUBLISHED Published: 2023-09-20T13:40:43.213Z Last Updated: 2024-09-24T15:05:20.612Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: n/a, Red Hat Products: foreman, Red Hat Satellite 6 Problem Types: CWE-94 Description: An arbitrary code execution flaw was found in Foreman. This issue may allow an admin user to execute arbitrary code on the underlying operating system by setting global parameters with a YAML payload. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2023-0462 - https://bugzilla.redhat.com/show_bug.cgi?id=2162970
CVE ID: CVE-2023-0463 State: PUBLISHED Published: 2023-01-24T16:42:58.172Z Last Updated: 2025-04-02T13:33:28.957Z Vendors: Devolutions Products: Remote Desktop Manager Problem Types: n/a Description: The force offline MFA prompt setting is not respected when switching to offline mode in Devolutions Remote Desktop Manager 2022.3.29 to 2022.3.30 allows a user to save sensitive data on disk. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://devolutions.net/security/advisories/DEVO-2023-0001
CVE ID: CVE-2023-0464 State: PUBLISHED Published: 2023-03-22T16:36:47.383Z Last Updated: 2025-05-05T16:08:48.783Z Vendors: OpenSSL Products: OpenSSL Problem Types: inefficient algorithmic complexity Description: A security vulnerability has been identified in all supported versions of OpenSSL related to the verification of X.509 certificate chains that include policy constraints. Attackers may be able to exploit this vulnerability by creating a malicious certificate chain that triggers exponential use of computational resources, leading to a denial-of-service (DoS) attack on affected systems. Policy processing is disabled by default but can be enabled by passing the `-policy' argument to the
n affected systems. Policy processing is disabled by default but can be enabled by passing the `-policy' argument to the command line utilities or by calling the `X509_VERIFY_PARAM_set1_policies()' function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.openssl.org/news/secadv/20230322.txt - https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2017771e2db3e2b96f89bbe8766c3209f6a99545 - https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=959c59c7a0164117e7f8366466a32bb1f8d77ff1 - https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=879f7080d7e141f415c79eaa3a8ac4a3dad0348b - https://git.openssl.org/gitweb/?p=opens
/gitweb/?p=openssl.git;a=commitdiff;h=879f7080d7e141f415c79eaa3a8ac4a3dad0348b - https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2dcd4f1e3115f38cefa43e3efbe9b801c27e642e - https://www.couchbase.com/alerts/ - https://www.debian.org/security/2023/dsa-5417 - https://lists.debian.org/debian-lts-announce/2023/06/msg00011.html - https://security.gentoo.org/glsa/202402-08 - https://security.netapp.com/advisory/ntap-20240621-0006/
CVE ID: CVE-2023-0465 State: PUBLISHED Published: 2023-03-28T14:30:39.707Z Last Updated: 2025-02-18T20:12:50.266Z Vendors: OpenSSL Products: OpenSSL Problem Types: improper certificate validation Description: Applications that use a non-default option when verifying certificates may be vulnerable to an attack from a malicious CA to circumvent certain checks. Invalid certificate policies in leaf certificates are silently ignored by OpenSSL and other certificate policy checks are skipped for that certificate. A malicious CA could use this to deliberately assert invalid certificate policies in order to circumvent policy checking on the certificate altogether. Policy processing is disabled by de
icate policies in order to circumvent policy checking on the certificate altogether. Policy processing is disabled by default but can be enabled by passing the `-policy' argument to the command line utilities or by calling the `X509_VERIFY_PARAM_set1_policies()' function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.openssl.org/news/secadv/20230328.txt - https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=facfb1ab745646e97a1920977ae4a9965ea61d5c - https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=1dd43e0709fece299b15208f36cc7c76209ba0bb - https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=b013765abfa80036d
dd43e0709fece299b15208f36cc7c76209ba0bb - https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=b013765abfa80036dc779dd0e50602c57bb3bf95 - https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=10325176f3d3e98c6e2b3bf5ab1e3b334de6947a - https://security.netapp.com/advisory/ntap-20230414-0001/ - https://www.debian.org/security/2023/dsa-5417 - https://lists.debian.org/debian-lts-announce/2023/06/msg00011.html - https://security.gentoo.org/glsa/202402-08
CVE ID: CVE-2023-0466 State: PUBLISHED Published: 2023-03-28T14:30:49.595Z Last Updated: 2025-02-19T17:12:25.801Z Vendors: OpenSSL Products: OpenSSL Problem Types: improper certificate validation Description: The function X509_VERIFY_PARAM_add0_policy() is documented to implicitly enable the certificate policy check when doing certificate verification. However the implementation of the function does not enable the check which allows certificates with invalid or incorrect policies to pass the certificate verification. As suddenly enabling the policy check could break existing deployments it was decided to keep the existing behavior of the X509_VERIFY_PARAM_add0_policy() function. Instead the
g deployments it was decided to keep the existing behavior of the X509_VERIFY_PARAM_add0_policy() function. Instead the applications that require OpenSSL to perform certificate policy check need to use X509_VERIFY_PARAM_set1_policies() or explicitly enable the policy check by calling X509_VERIFY_PARAM_set_flags() with the X509_V_FLAG_POLICY_CHECK flag argument. Certificate policy checks are disabled by default in OpenSSL and are not commonly used by applications. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.openssl.org/news/secadv/20230328.txt - https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=fc814a30fc4f0bc54fcea7d9a7462f
g/news/secadv/20230328.txt - https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=fc814a30fc4f0bc54fcea7d9a7462f5457aab061 - https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=51e8a84ce742db0f6c70510d0159dad8f7825908 - https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=0d16b7e99aafc0b4a6d729eec65a411a7e025f0a - https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=73398dea26de9899fb4baa94098ad0a61f435c72 - https://security.netapp.com/advisory/ntap-20230414-0001/ - https://www.debian.org/security/2023/dsa-5417 - https://lists.debian.org/debian-lts-announce/2023/06/msg00011.html - http://www.openwall.com/lists/oss-security/2023/09/28/4 - https://security.gent
ian-lts-announce/2023/06/msg00011.html - http://www.openwall.com/lists/oss-security/2023/09/28/4 - https://security.gentoo.org/glsa/202402-08
CVE ID: CVE-2023-0467 State: PUBLISHED Published: 2023-03-27T15:37:26.271Z Last Updated: 2025-02-19T16:51:18.280Z Vendors: Unknown Products: WP Dark Mode Problem Types: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Description: The WP Dark Mode WordPress plugin before 4.0.8 does not properly sanitize the style parameter in shortcodes before using it to load a PHP template. This leads to Local File Inclusion on servers where non-existent directories may be traversed, or when chained with another vulnerability allowing arbitrary directory creation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.co
ry creation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/8eb431a6-59a5-4cee-84e0-156c0b31cfc4