Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
itel.com/support/security-advisories - https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-23-0013
CVE ID: CVE-2023-39292 State: PUBLISHED Published: 2023-08-14T00:00:00 Last Updated: 2024-10-09T20:14:26.753Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL Injection vulnerability has been identified in the MiVoice Office 400 SMB Controller through 1.2.5.23 which could allow a malicious actor to access sensitive information and execute arbitrary database and management operations. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-23-0008
CVE ID: CVE-2023-39293 State: PUBLISHED Published: 2023-08-14T00:00:00 Last Updated: 2024-10-09T20:25:55.614Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Command Injection vulnerability has been identified in the MiVoice Office 400 SMB Controller through 1.2.5.23 which could allow a malicious actor to execute arbitrary commands within the context of the system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-23-0009
CVE ID: CVE-2023-39294 State: PUBLISHED Published: 2024-01-05T16:19:26.278Z Last Updated: 2024-09-04T19:53:30.491Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L) Vendors: QNAP Systems Inc. Products: QTS, QuTS hero Problem Types: CWE-78 Description: An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.3.2578 build 20231110 and later QuTS hero h5.1.3.2578 build 20231110 and later Additional Analyst Notes: - CVE Program Container: - CISA
31110 and later QuTS hero h5.1.3.2578 build 20231110 and later Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security-advisory/qsa-23-54
CVE ID: CVE-2023-39295 State: PUBLISHED Published: 2023-11-10T16:01:44.438Z Last Updated: 2024-09-03T17:35:42.394Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: QNAP Systems Inc. Products: QuMagie Problem Types: CWE-78 Description: An OS command injection vulnerability has been reported to affect QuMagie. If exploited, the vulnerability could allow authenticated users to execute commands via a network. We have already fixed the vulnerability in the following version: QuMagie 2.1.3 and later Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security-advisory/qsa-23-50
CVE ID: CVE-2023-39296 State: PUBLISHED Published: 2024-01-05T16:19:20.645Z Last Updated: 2025-06-03T14:41:20.050Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: QNAP Systems Inc. Products: QTS, QuTS hero Problem Types: CWE-1321 Description: A prototype pollution vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to override existing attributes with ones that have incompatible type, which may lead to a crash via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.3.2578 build 20231110 and later QuTS hero h5.1.3.2578 build 20231110 and later Addit
in the following versions: QTS 5.1.3.2578 build 20231110 and later QuTS hero h5.1.3.2578 build 20231110 and later Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security-advisory/qsa-23-64
CVE ID: CVE-2023-39297 State: PUBLISHED Published: 2024-02-02T16:03:13.178Z Last Updated: 2025-05-15T19:49:40.351Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: QNAP Systems Inc. Products: QTS, QuTS hero, QuTScloud Problem Types: CWE-78 Description: An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users to execute commands via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.4.2596 build 20231128 and later QTS 4.5.4.2627 build 20231225 and later QuTS hero h5.1.4.2596 build 20231128 and later QuTS hero h4.5.4.
31128 and later QTS 4.5.4.2627 build 20231225 and later QuTS hero h5.1.4.2596 build 20231128 and later QuTS hero h4.5.4.2626 build 20231225 and later QuTScloud c5.1.5.2651 and later Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security-advisory/qsa-23-30
CVE ID: CVE-2023-39298 State: PUBLISHED Published: 2024-09-06T16:27:08.552Z Last Updated: 2024-09-06T17:43:57.324Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: QNAP Systems Inc. Products: QTS, QuTS hero, QuTScloud Problem Types: CWE-862 Description: A missing authorization vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow local authenticated users to access data or perform actions that they should not be allowed to perform via unspecified vectors. QuTScloud, is not affected. We have already fixed the vulnerability in the following versions: QTS 5.2.0.2737 build 20240417 and later Qu
affected. We have already fixed the vulnerability in the following versions: QTS 5.2.0.2737 build 20240417 and later QuTS hero h5.2.0.2782 build 20240601 and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security-advisory/qsa-24-28
CVE ID: CVE-2023-39299 State: PUBLISHED Published: 2023-11-03T16:34:46.932Z Last Updated: 2024-09-05T18:40:12.259Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: QNAP Systems Inc. Products: Music Station Problem Types: CWE-22 Description: A path traversal vulnerability has been reported to affect Music Station. If exploited, the vulnerability could allow users to read the contents of unexpected files and expose sensitive data via a network. We have already fixed the vulnerability in the following versions: Music Station 4.8.11 and later Music Station 5.1.16 and later Music Station 5.3.23 and later Additional Analyst Notes: - CVE Program Container: - CISA ADP
c Station 5.1.16 and later Music Station 5.3.23 and later Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security-advisory/qsa-23-61
CVE ID: CVE-2023-39300 State: PUBLISHED Published: 2024-09-06T16:27:04.275Z Last Updated: 2024-09-06T17:44:00.200Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: QNAP Systems Inc. Products: QTS, QuTS hero, QuTScloud Problem Types: CWE-78 Description: An OS command injection vulnerability has been reported to affect legacy QTS. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network. We have already fixed the vulnerability in the following versions: QTS 4.3.6.2805 build 20240619 and later QTS 4.3.4.2814 build 20240618 and later QTS 4.3.3.2784 build 20240619 and later QTS 4.2.6 build 20240618 and later Addition
4.3.4.2814 build 20240618 and later QTS 4.3.3.2784 build 20240619 and later QTS 4.2.6 build 20240618 and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security-advisory/qsa-24-26
CVE ID: CVE-2023-39301 State: PUBLISHED Published: 2023-11-03T16:34:52.566Z Last Updated: 2024-09-05T13:58:28.386Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: QNAP Systems Inc. Products: QTS, QuTS hero, QuTScloud Problem Types: CWE-918 Description: A server-side request forgery (SSRF) vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users to read application data via a network. We have already fixed the vulnerability in the following versions: QTS 5.0.1.2514 build 20230906 and later QTS 5.1.1.2491 build 20230815 and later QuTS hero h5.0.1.2515 build 20230907 and la
5.0.1.2514 build 20230906 and later QTS 5.1.1.2491 build 20230815 and later QuTS hero h5.0.1.2515 build 20230907 and later QuTS hero h5.1.1.2488 build 20230812 and later QuTScloud c5.1.0.2498 and later Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security-advisory/qsa-23-51
CVE ID: CVE-2023-39302 State: PUBLISHED Published: 2024-02-02T16:03:02.933Z Last Updated: 2024-08-29T18:46:50.784Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L) Vendors: QNAP Systems Inc. Products: QTS, QuTS hero, QuTScloud Problem Types: CWE-78 Description: An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.3.2578 build 20231110 and later QuTS hero h5.1.3.2578 build 20231110 and later QuTScloud c5.1.5.2651 and later Additional Ana
8 build 20231110 and later QuTS hero h5.1.3.2578 build 20231110 and later QuTScloud c5.1.5.2651 and later Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security-advisory/qsa-23-33
CVE ID: CVE-2023-39303 State: PUBLISHED Published: 2024-02-02T16:03:30.513Z Last Updated: 2024-09-06T17:42:19.482Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: QNAP Systems Inc. Products: QTS, QuTS hero, QuTScloud Problem Types: CWE-287 Description: An improper authentication vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to compromise the security of the system via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.3.2578 build 20231110 and later QuTS hero h5.1.3.2578 build 20231110 and later QuTScloud c5.1.5.2651 and later Additional A
578 build 20231110 and later QuTS hero h5.1.3.2578 build 20231110 and later QuTScloud c5.1.5.2651 and later Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security-advisory/qsa-23-33
CVE ID: CVE-2023-39305 State: PUBLISHED Published: 2024-12-13T14:23:58.307Z Last Updated: 2024-12-13T18:23:10.350Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: YetAnotherStarsRating.com Products: Yet Another Stars Rating Problem Types: CWE-862 Description: Missing Authorization vulnerability in YetAnotherStarsRating.com Yet Another Stars Rating allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Yet Another Stars Rating: from n/a through 3.4.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/yet-another-stars-rating/vulnerability/wordpress-yet-another-
rences: - https://patchstack.com/database/wordpress/plugin/yet-another-stars-rating/vulnerability/wordpress-yet-another-stars-rating-plugin-3-4-3-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2023-39306 State: PUBLISHED Published: 2024-03-27T05:42:25.173Z Last Updated: 2024-08-05T16:45:32.519Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: ThemeFusion Products: Fusion Builder Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeFusion Fusion Builder allows Reflected XSS.This issue affects Fusion Builder: from n/a through 3.11.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/fusion-builder/wordpress-avada-builder-plugin-3-11-1-reflected-cross-site-scripting-xss
stack.com/database/vulnerability/fusion-builder/wordpress-avada-builder-plugin-3-11-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-39307 State: PUBLISHED Published: 2024-03-26T20:43:16.646Z Last Updated: 2024-08-06T15:12:49.966Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: ThemeFusion Products: Avada Problem Types: CWE-434 Description: Unrestricted Upload of File with Dangerous Type vulnerability in ThemeFusion Avada.This issue affects Avada: from n/a through 7.11.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/avada/wordpress-avada-theme-7-11-1-authenticated-arbitrary-file-upload-vulnerability?_s_id=cve
CVE ID: CVE-2023-39308 State: PUBLISHED Published: 2023-09-29T13:59:39.510Z Last Updated: 2024-09-20T15:26:24.963Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: UserFeedback Team Products: User Feedback Problem Types: CWE-79 Description: Unauth. Stored Cross-Site Scripting (XSS) vulnerability in UserFeedback Team User Feedback plugin <= 1.0.7 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/userfeedback-lite/wordpress-userfeedback-lite-plugin-1-0-7-cross-site-scripting-xss-vulnerability?_s_id=cve - https://revan-ar.medium.com/cve-2023-39308-wordpress-plugin-user-
0-7-cross-site-scripting-xss-vulnerability?_s_id=cve - https://revan-ar.medium.com/cve-2023-39308-wordpress-plugin-user-feedback-1-0-7-unauthenticated-stored-xss-db992a01686a
CVE ID: CVE-2023-39309 State: PUBLISHED Published: 2024-03-28T06:43:18.618Z Last Updated: 2024-08-02T18:02:06.918Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L) Vendors: ThemeFusion Products: Fusion Builder Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ThemeFusion Fusion Builder.This issue affects Fusion Builder: from n/a through 3.11.1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/fusion-builder/wordpress-avada-builder-plugin-3-11-1-authenticated-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2023-39310 State: PUBLISHED Published: 2024-06-19T14:07:17.747Z Last Updated: 2024-08-02T18:02:06.801Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: ThemeFusion Products: Fusion Builder Problem Types: CWE-862 Description: Missing Authorization vulnerability in ThemeFusion Fusion Builder.This issue affects Fusion Builder: from n/a through 3.11.1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/fusion-builder/wordpress-avada-builder-plugin-3-11-1-authenticated-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2023-39311 State: PUBLISHED Published: 2024-03-27T13:29:26.104Z Last Updated: 2024-08-27T20:40:10.785Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H) Vendors: ThemeFusion Products: Fusion Builder Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in ThemeFusion Fusion Builder.This issue affects Fusion Builder: from n/a through 3.11.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/fusion-builder/wordpress-avada-builder-plugin-3-11-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-39312 State: PUBLISHED Published: 2024-06-19T14:23:39.616Z Last Updated: 2024-08-02T18:02:06.931Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: ThemeFusion Products: Avada Problem Types: CWE-862 Description: Missing Authorization vulnerability in ThemeFusion Avada.This issue affects Avada: from n/a through 7.11.1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/avada/wordpress-avada-theme-7-11-1-authenticated-author-unrestricted-zip-extraction-vulnerability?_s_id=cve
CVE ID: CVE-2023-39313 State: PUBLISHED Published: 2024-03-28T05:56:39.972Z Last Updated: 2024-08-02T18:02:06.925Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: ThemeFusion Products: Avada Problem Types: CWE-918 Description: Server-Side Request Forgery (SSRF) vulnerability in ThemeFusion Avada.This issue affects Avada: from n/a through 7.11.1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/avada/wordpress-avada-theme-7-11-1-authenticated-server-side-request-forgery-ssrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-39314 State: PUBLISHED Published: 2023-08-10T12:46:48.926Z Last Updated: 2024-09-25T15:03:30.272Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Teplitsa of social technologies Products: Leyka Problem Types: CWE-79 Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Teplitsa of social technologies Leyka plugin <= 3.30.2 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/leyka/wordpress-leyka-plugin-3-30-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-39316 State: PUBLISHED Published: 2024-01-08T14:47:43.091Z Last Updated: 2025-11-04T18:16:26.145Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: GTKWave Products: GTKWave Problem Types: CWE-190 Description: Multiple integer overflow vulnerabilities exist in the LXT2 num_dict_entries functionality of GTKWave 3.3.115. A specially crafted .lxt2 file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the integer overflow when allocating the `string_pointers` array. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - h
the `string_pointers` array. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1820 - https://lists.debian.org/debian-lts-announce/2024/04/msg00007.html
CVE ID: CVE-2023-39317 State: PUBLISHED Published: 2024-01-08T14:47:43.181Z Last Updated: 2025-11-04T18:16:27.369Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: GTKWave Products: GTKWave Problem Types: CWE-190 Description: Multiple integer overflow vulnerabilities exist in the LXT2 num_dict_entries functionality of GTKWave 3.3.115. A specially crafted .lxt2 file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the integer overflow when allocating the `string_lens` array. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https
the `string_lens` array. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1820 - https://lists.debian.org/debian-lts-announce/2024/04/msg00007.html
CVE ID: CVE-2023-39318 State: PUBLISHED Published: 2023-09-08T16:13:24.063Z Last Updated: 2025-02-13T17:02:46.777Z Vendors: Go standard library Products: html/template Problem Types: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The html/template package does not properly handle HTML-like "" comment tokens, nor hashbang "#!" comment tokens, in <script> contexts. This may cause the template parser to improperly interpret the contents of <script> contexts, causing actions to be improperly escaped. This may be leveraged to perform an XSS attack. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - h
ed to perform an XSS attack. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://go.dev/issue/62196 - https://go.dev/cl/526156 - https://groups.google.com/g/golang-dev/c/2C5vbR-UNkI/m/L1hdrPhfBAAJ - https://pkg.go.dev/vuln/GO-2023-2041 - https://security.netapp.com/advisory/ntap-20231020-0009/ - https://security.gentoo.org/glsa/202311-09
CVE ID: CVE-2023-39319 State: PUBLISHED Published: 2023-09-08T16:13:28.663Z Last Updated: 2025-02-13T17:02:47.366Z Vendors: Go standard library Products: html/template Problem Types: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The html/template package does not apply the proper rules for handling occurrences of "<script", "<!--", and "</script" within JS literals in <script> contexts. This may cause the template parser to improperly consider script contexts to be terminated early, causing actions to be improperly escaped. This could be leveraged to perform an XSS attack. Additional Analyst Notes: - CVE Program Container: - CISA AD
escaped. This could be leveraged to perform an XSS attack. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://go.dev/issue/62197 - https://go.dev/cl/526157 - https://groups.google.com/g/golang-dev/c/2C5vbR-UNkI/m/L1hdrPhfBAAJ - https://pkg.go.dev/vuln/GO-2023-2043 - https://security.netapp.com/advisory/ntap-20231020-0009/ - https://security.gentoo.org/glsa/202311-09
CVE ID: CVE-2023-39320 State: PUBLISHED Published: 2023-09-08T16:13:26.609Z Last Updated: 2025-02-13T17:02:48.022Z Vendors: Go toolchain Products: cmd/go Problem Types: CWE-94: Improper Control of Generation of Code ('Code Injection') Description: The go.mod toolchain directive, introduced in Go 1.21, can be leveraged to execute scripts and binaries relative to the root of the module when the "go" command was executed within the module. This applies to modules downloaded using the "go" command from the module proxy, as well as modules downloaded directly using VCS software. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://go.dev/issue/62198 -
Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://go.dev/issue/62198 - https://go.dev/cl/526158 - https://groups.google.com/g/golang-dev/c/2C5vbR-UNkI/m/L1hdrPhfBAAJ - https://pkg.go.dev/vuln/GO-2023-2042 - https://security.netapp.com/advisory/ntap-20231020-0004/ - https://security.gentoo.org/glsa/202311-09
CVE ID: CVE-2023-39321 State: PUBLISHED Published: 2023-09-08T16:13:30.386Z Last Updated: 2025-02-13T17:02:48.554Z Vendors: Go standard library Products: crypto/tls Problem Types: CWE-400: Uncontrolled Resource Consumption Description: Processing an incomplete post-handshake message for a QUIC connection can cause a panic. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://go.dev/issue/62266 - https://go.dev/cl/523039 - https://groups.google.com/g/golang-dev/c/2C5vbR-UNkI/m/L1hdrPhfBAAJ - https://pkg.go.dev/vuln/GO-2023-2044 - https://security.netapp.com/advisory/ntap-20231020-0004/ - https://security.gentoo.org/glsa/202311-09
CVE ID: CVE-2023-39322 State: PUBLISHED Published: 2023-09-08T16:13:32.795Z Last Updated: 2025-02-13T17:02:49.143Z Vendors: Go standard library Products: crypto/tls Problem Types: CWE-400: Uncontrolled Resource Consumption Description: QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC connection to cause unbounded memory growth. With fix, connections now consistently reject messages larger than 65KiB in size. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://go.dev/issue/62266 - https://go.dev/cl/523039 - https://groups.google.com/g/golang-dev/c/2C5vbR-UNkI/