Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-29218 State: PUBLISHED Published: 2023-04-03T00:00:00.000Z Last Updated: 2025-02-18T16:59:47.104Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Twitter Recommendation Algorithm through ec83d01 allows attackers to cause a denial of service (reduction of reputation score) by arranging for multiple Twitter accounts to coordinate negative signals regarding a target account, such as unfollowing, muting, blocking, and reporting, as exploited in the wild in March and April 2023. NOTE: Vendor states that allowing users to unfollow, mute, block, and report tweets and accounts and the impact of these negative engagements on Twitter’s ranking algorithm is a conscious d
report tweets and accounts and the impact of these negative engagements on Twitter’s ranking algorithm is a conscious design decision, rather than a security vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/twitter/the-algorithm/issues/1386 - https://twitter.com/elonmusk/status/1642324821324230657 - https://steventey.com/blog/twitter-algorithm - https://twitter.com/aakashg0/status/1641976913165180929 - https://twitter.com/Kaptain_Kobold/status/1642379706925477888 - https://github.com/twitter/the-algorithm/tree/ec83d01dcaebf369444d75ed04b3625a0a645eb9
CVE ID: CVE-2023-29234 State: PUBLISHED Published: 2023-12-15T08:14:47.561Z Last Updated: 2025-02-13T16:49:03.349Z Vendors: Apache Software Foundation Products: Apache Dubbo Problem Types: CWE-502 Description: A deserialization vulnerability existed when decode a malicious package.This issue affects Apache Dubbo: from 3.1.0 through 3.1.10, from 3.2.0 through 3.2.4. Users are recommended to upgrade to the latest version, which fixes the issue. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread/wb2df2whkdnbgp54nnqn0m94rllx8f77 - http://www.openwall.com/lists/oss-security/2023/12/15/2
CVE ID: CVE-2023-29235 State: PUBLISHED Published: 2023-10-06T13:05:05.806Z Last Updated: 2024-09-19T14:46:45.968Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: Fugu Products: Maintenance Switch Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Fugu Maintenance Switch plugin <= 1.5.2 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/maintenance-switch/wordpress-maintenance-switch-plugin-1-5-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-29236 State: PUBLISHED Published: 2023-04-07T11:22:36.916Z Last Updated: 2024-08-02T14:47:08.071Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Cththemes Products: Outdoor Problem Types: CWE-79 Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Cththemes Outdoor theme <= 3.9.6 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/outdoor/wordpress-outdoor-theme-3-9-6-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-29237 State: PUBLISHED Published: 2024-12-09T11:31:12.056Z Last Updated: 2024-12-09T13:49:55.637Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Muhammad Rehman Products: Remove Duplicate Posts Problem Types: CWE-862 Description: Missing Authorization vulnerability in Muhammad Rehman Remove Duplicate Posts allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Remove Duplicate Posts: from n/a through 1.3.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/remove-duplicate-posts/vulnerability/wordpress-remove-duplicate-posts-plugin-1-3-4-brok
ck.com/database/wordpress/plugin/remove-duplicate-posts/vulnerability/wordpress-remove-duplicate-posts-plugin-1-3-4-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2023-29238 State: PUBLISHED Published: 2023-11-12T21:21:36.190Z Last Updated: 2024-09-03T13:33:32.073Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Whydonate Products: Whydonate – FREE Donate button – Crowdfunding – Fundraising Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Whydonate Whydonate – FREE Donate button – Crowdfunding – Fundraising plugin <= 3.12.15 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wp-whydonate/wordpress-whydonate-plugin-3-12-13-cross-site-request-forgery-csrf-vulnerability?_s_id=cv
ase/vulnerability/wp-whydonate/wordpress-whydonate-plugin-3-12-13-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-29239 State: PUBLISHED Published: 2024-12-09T11:31:11.263Z Last Updated: 2024-12-09T13:49:55.796Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: LuckyWP Products: LuckyWP Scripts Control Problem Types: CWE-862 Description: Missing Authorization vulnerability in LuckyWP LuckyWP Scripts Control allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LuckyWP Scripts Control: from n/a through 1.2.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/luckywp-scripts-control/vulnerability/wordpress-luckywp-scripts-control-plugin-1-2-1-broken-access-c
se/wordpress/plugin/luckywp-scripts-control/vulnerability/wordpress-luckywp-scripts-control-plugin-1-2-1-broken-access-control-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-29240 State: PUBLISHED Published: 2023-05-03T14:35:03.436Z Last Updated: 2025-09-18T19:48:26.259Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: F5 Products: BIG-IQ Problem Types: CWE-863 Description: An authenticated attacker granted a Viewer or Auditor role on a BIG-IQ can upload arbitrary files using an undisclosed iControl REST endpoint. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://my.f5.com/manage/s/article/K000132719
CVE ID: CVE-2023-29241 State: PUBLISHED Published: 2023-06-30T00:00:00 Last Updated: 2024-11-26T19:59:56.176Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) Vendors: Bosch Products: BIS Problem Types: CWE-1112 Description: Improper Information in Cybersecurity Guidebook in Bosch Building Integration System (BIS) 5.0 may lead to wrong configuration which allows local users to access data via network Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://psirt.bosch.com/security-advisories/BOSCH-SA-988400-BT.html
CVE ID: CVE-2023-29242 State: PUBLISHED Published: 2023-05-12T14:01:46.925Z Last Updated: 2025-01-24T16:45:21.910Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) oneAPI Toolkits Problem Types: escalation of privilege, CWE-284 Description: Improper access control for Intel(R) oneAPI Toolkits before version 2021.1 Beta 10 may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00551.html
CVE ID: CVE-2023-29243 State: PUBLISHED Published: 2023-08-11T02:37:25.285Z Last Updated: 2024-10-04T13:04:55.284Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: n/a Products: Intel(R) RealSense(TM) ID software for Intel(R) RealSense(TM) 450 FA Problem Types: denial of service, CWE-252 Description: Unchecked return value in some Intel(R) RealSense(TM) ID software for Intel(R) RealSense(TM) 450 FA in version 0.25.0 may allow a priviledged user to potentially enable denial of service via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.intel.com/content/www/us/en/security-center/advisory/intel-
Container: - CISA ADP Vulnrichment: References: - http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00912.html
CVE ID: CVE-2023-29244 State: PUBLISHED Published: 2024-01-19T20:03:14.759Z Last Updated: 2025-06-17T21:19:22.730Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: Intel Integrated Sensor Hub (ISH) driver for Windows 10 for Intel NUC P14E Laptop Element software installers Problem Types: escalation of privilege, CWE-276 Description: Incorrect default permissions in some Intel Integrated Sensor Hub (ISH) driver for Windows 10 for Intel NUC P14E Laptop Element software installers before version 5.4.1.4479 may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CVE Program Containe
ed user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00964.html
CVE ID: CVE-2023-29245 State: PUBLISHED Published: 2023-09-19T10:04:57.213Z Last Updated: 2025-02-27T20:49:42.741Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Nozomi Networks Products: Guardian, CMC Problem Types: CWE-89 Description: A SQL Injection vulnerability in Nozomi Networks Guardian and CMC, due to improper input validation in certain fields used in the Asset Intelligence functionality of our IDS, may allow an unauthenticated attacker to execute arbitrary SQL statements on the DBMS used by the web application by sending specially crafted malicious network packets. Malicious users with extensive knowledge on the underlying system may be able to extr
crafted malicious network packets. Malicious users with extensive knowledge on the underlying system may be able to extract arbitrary information from the DBMS in an uncontrolled way, alter its structure and data, and/or affect its availability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.nozominetworks.com/NN-2023:11-01
CVE ID: CVE-2023-29246 State: PUBLISHED Published: 2023-05-12T07:43:20.422Z Last Updated: 2024-10-10T19:35:57.172Z Vendors: Apache Software Foundation Products: Apache OpenMeetings Problem Types: CWE-20 Description: An attacker who has gained access to an admin account can perform RCE via null-byte injection Vendor: The Apache Software Foundation Versions Affected: Apache OpenMeetings from 2.0.0 before 7.1.0 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/230plvhbdx26m43b0sy942wlwt6kkmmr
CVE ID: CVE-2023-29247 State: PUBLISHED Published: 2023-05-08T09:01:40.033Z Last Updated: 2024-10-15T18:26:11.465Z Vendors: Apache Software Foundation Products: Apache Airflow Problem Types: CWE-79 Description: Task instance details page in the UI is vulnerable to a stored XSS.This issue affects Apache Airflow: before 2.6.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/apache/airflow/pull/30447 - https://github.com/apache/airflow/pull/30779 - https://lists.apache.org/thread/kqf5lxmko133780clsp827xfsh4xd3fl
CVE ID: CVE-2023-29255 State: PUBLISHED Published: 2023-04-27T12:47:02.803Z Last Updated: 2025-02-13T16:49:04.007Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: IBM Products: DB2 for Linux, UNIX and Windows Problem Types: CWE-20 Description: IBM DB2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to a denial of service as it may trap when compiling a variation of an anonymous block. IBM X-Force ID: 251991. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6985687 - https://exchange.xforce.ibmcloud.com/vulnerabilities/251991 - https://se
ttps://www.ibm.com/support/pages/node/6985687 - https://exchange.xforce.ibmcloud.com/vulnerabilities/251991 - https://security.netapp.com/advisory/ntap-20230511-0010/
CVE ID: CVE-2023-29256 State: PUBLISHED Published: 2023-07-09T23:27:56.560Z Last Updated: 2025-02-13T16:49:04.579Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: Db2 for Linux, UNIX and Windows Problem Types: 284 Improper Access Control Description: IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to an information disclosure due to improper privilege management when certain federation features are used. IBM X-Force ID: 252046. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7010573 - https://exchange.xforce.ibmc
er: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7010573 - https://exchange.xforce.ibmcloud.com/vulnerabilities/252046 - https://security.netapp.com/advisory/ntap-20230731-0007/
CVE ID: CVE-2023-29257 State: PUBLISHED Published: 2023-04-26T12:56:10.502Z Last Updated: 2025-02-13T16:49:05.190Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: IBM Products: Db2 for Linux, UNIX and Windows Problem Types: 284 Improper Access Control Description: IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to remote code execution as a database administrator of one database may execute code or read/write files from another database within the same instance. IBM X-Force ID: 252011. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/
tional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6985691 - https://exchange.xforce.ibmcloud.com/vulnerabilities/252011 - https://security.netapp.com/advisory/ntap-20230511-0010/
CVE ID: CVE-2023-29258 State: PUBLISHED Published: 2023-12-04T01:12:20.327Z Last Updated: 2025-02-13T16:49:05.760Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: IBM Products: Db2 for Linux, UNIX and Windows Problem Types: CWE-20 Description: IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1, and 11.5 is vulnerable to a denial of service through a specially crafted federated query on specific federation objects. IBM X-Force ID: 252048. Additional Analyst Notes: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7087218 - https://exchange.xforce.ibmcloud.com/vulnerabilities/252048 - https://security.netapp.com/
/support/pages/node/7087218 - https://exchange.xforce.ibmcloud.com/vulnerabilities/252048 - https://security.netapp.com/advisory/ntap-20240112-0002/
CVE ID: CVE-2023-29259 State: PUBLISHED Published: 2023-07-19T01:14:57.925Z Last Updated: 2024-10-21T18:55:22.488Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: IBM Products: Sterling Connect:Express for UNIX Problem Types: 1275 Sensitive Cookie with Improper SameSite Attribute Description: IBM Sterling Connect:Express for UNIX 1.5 browser UI is vulnerable to attacks that rely on the use of cookies without the SameSite attribute. IBM X-Force ID: 252055. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7010921 - https://exchange.xforce.ibmcloud.com/vulnerabilities/252055
CVE ID: CVE-2023-29260 State: PUBLISHED Published: 2023-07-19T01:17:31.614Z Last Updated: 2024-10-28T15:08:24.496Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: IBM Products: Sterling Connect:Express for UNIX Problem Types: CWE-918 Description: IBM Sterling Connect:Express for UNIX 1.5 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 252135. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7010923 -
Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7010923 - https://exchange.xforce.ibmcloud.com/vulnerabilities/252135
CVE ID: CVE-2023-29261 State: PUBLISHED Published: 2023-09-05T00:00:10.852Z Last Updated: 2024-09-26T18:28:16.756Z Severity: MEDIUM (CVSS 5.1 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: Sterling Secure Proxy Problem Types: CWE-922 Description: IBM Sterling Secure Proxy 6.0.3 and 6.1.0 could allow a local user with specific information about the system to obtain privileged information due to inadequate memory clearing during operations. IBM X-Force ID: 252139. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://https://www.ibm.com/support/pages/node/7029765 - https://exchange.xforce.ibmcloud.com/vulnerabilities/252139
CVE ID: CVE-2023-29267 State: PUBLISHED Published: 2024-06-12T18:24:20.764Z Last Updated: 2024-08-28T15:02:43.378Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: IBM Products: Db2 for Linux, UNIX and Windows Problem Types: CWE-399 Description: IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5is vulnerable to a denial of service, under specific configurations, as the server may crash when using a specially crafted SQL statement by an authenticated user. IBM X-Force ID: 287612. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7156851 - https://
CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7156851 - https://exchange.xforce.ibmcloud.com/vulnerabilities/287612
CVE ID: CVE-2023-29268 State: PUBLISHED Published: 2023-04-26T17:24:18.689Z Last Updated: 2025-01-30T21:39:54.123Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: TIBCO Software Inc. Products: TIBCO Spotfire Statistics Services Problem Types: Uploaded or modified files may be executed within the scope of the web server process allowing access to the system. Description: The Splus Server component of TIBCO Software Inc.'s TIBCO Spotfire Statistics Services contains a vulnerability that allows an unauthenticated remote attacker to upload or modify arbitrary files within the web server directory on the affected system. Affected releases are TIBCO Software Inc
modify arbitrary files within the web server directory on the affected system. Affected releases are TIBCO Software Inc.'s TIBCO Spotfire Statistics Services: versions 11.4.10 and below, versions 11.5.0, 11.6.0, 11.6.1, 11.6.2, 11.7.0, 11.8.0, 11.8.1, 12.0.0, 12.0.1, and 12.0.2, versions 12.1.0 and 12.2.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.tibco.com/services/support/advisories
CVE ID: CVE-2023-29273 State: PUBLISHED Published: 2023-05-11T00:00:00.000Z Last Updated: 2025-03-05T19:03:21.185Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Substance3D - Painter Problem Types: CWE-125 Description: Adobe Substance 3D Painter versions 8.3.0 (and earlier) is affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Note
xploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/substance3d_painter/apsb23-29.html
CVE ID: CVE-2023-29274 State: PUBLISHED Published: 2023-05-11T00:00:00.000Z Last Updated: 2025-03-05T19:03:12.833Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Substance3D - Painter Problem Types: CWE-125 Description: Adobe Substance 3D Painter versions 8.3.0 (and earlier) is affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Note
CVE ID: CVE-2023-29275 State: PUBLISHED Published: 2023-05-11T00:00:00.000Z Last Updated: 2025-03-05T19:03:05.046Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Substance3D - Painter Problem Types: CWE-125 Description: Adobe Substance 3D Painter versions 8.3.0 (and earlier) is affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Note
CVE ID: CVE-2023-29276 State: PUBLISHED Published: 2023-05-11T00:00:00.000Z Last Updated: 2025-03-05T19:02:57.549Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Substance3D - Painter Problem Types: CWE-787 Description: Adobe Substance 3D Painter versions 8.3.0 (and earlier) is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/substance3d
s: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/substance3d_painter/apsb23-29.html
CVE ID: CVE-2023-29277 State: PUBLISHED Published: 2023-05-11T00:00:00.000Z Last Updated: 2025-03-05T19:02:51.232Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: Adobe Products: Substance3D - Painter Problem Types: CWE-125 Description: Adobe Substance 3D Painter versions 8.3.0 (and earlier) is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - h
must open a malicious file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/substance3d_painter/apsb23-29.html
CVE ID: CVE-2023-29278 State: PUBLISHED Published: 2023-05-11T00:00:00.000Z Last Updated: 2025-03-05T19:02:44.928Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Substance3D - Painter Problem Types: CWE-824 Description: Adobe Substance 3D Painter versions 8.3.0 (and earlier) is affected by an Access of Uninitialized Pointer vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products
Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/substance3d_painter/apsb23-29.html