Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-40136 State: PUBLISHED Published: 2023-10-27T20:22:58.825Z Last Updated: 2024-09-09T19:40:31.470Z Vendors: Google Products: Android Problem Types: Information disclosure Description: In setHeader of DialogFillUi.java, there is a possible way to view another user's images due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/frameworks/base/+/08becc8c600f14c5529115cc1a1e0c97cd503f33 - https://source.android.com/security/bulletin/20
om/platform/frameworks/base/+/08becc8c600f14c5529115cc1a1e0c97cd503f33 - https://source.android.com/security/bulletin/2023-10-01
CVE ID: CVE-2023-40137 State: PUBLISHED Published: 2023-10-27T20:22:59.038Z Last Updated: 2024-09-09T19:39:59.719Z Vendors: Google Products: Android Problem Types: Information disclosure Description: In multiple functions of DialogFillUi.java, there is a possible way to view another user's images due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/frameworks/base/+/08becc8c600f14c5529115cc1a1e0c97cd503f33 - https://source.android.com/security/bu
CVE ID: CVE-2023-40138 State: PUBLISHED Published: 2023-10-27T20:22:59.315Z Last Updated: 2024-09-09T19:39:28.100Z Vendors: Google Products: Android Problem Types: Information disclosure Description: In FillUi of FillUi.java, there is a possible way to view another user's images due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/frameworks/base/+/08becc8c600f14c5529115cc1a1e0c97cd503f33 - https://source.android.com/security/bulletin/2023-10-01
CVE ID: CVE-2023-40139 State: PUBLISHED Published: 2023-10-27T20:22:59.503Z Last Updated: 2024-09-09T19:38:59.837Z Vendors: Google Products: Android Problem Types: Information disclosure Description: In FillUi of FillUi.java, there is a possible way to view another user's images due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/frameworks/base/+/08becc8c600f14c5529115cc1a1e0c97cd503f33 - https://source.android.com/security/bulletin/2023-10-01
CVE ID: CVE-2023-40140 State: PUBLISHED Published: 2023-10-27T20:22:59.679Z Last Updated: 2024-09-09T19:38:12.376Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In android_view_InputDevice_create of android_view_InputDevice.cpp, there is a possible way to execute arbitrary code due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/frameworks/base/+/2d88a5c481df8986dbba2e02c5bf82f105b36243 - https://source.and
ttps://android.googlesource.com/platform/frameworks/base/+/2d88a5c481df8986dbba2e02c5bf82f105b36243 - https://source.android.com/security/bulletin/2023-10-01
CVE ID: CVE-2023-40141 State: PUBLISHED Published: 2023-10-11T19:26:45.729Z Last Updated: 2024-09-18T14:54:57.420Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In temp_residency_name_store of thermal_metrics.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/pixel/2023-10-01
CVE ID: CVE-2023-40142 State: PUBLISHED Published: 2023-10-11T19:27:08.329Z Last Updated: 2024-09-18T14:53:51.297Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In TBD of TBD, there is a possible way to bypass carrier restrictions due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/pixel/2023-10-01
CVE ID: CVE-2023-40143 State: PUBLISHED Published: 2024-02-06T21:51:51.093Z Last Updated: 2024-08-02T18:24:55.351Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: Westermo Products: Lynx Problem Types: CWE-79 Description: An attacker with access to the Westermo Lynx web application that has the vulnerable software could introduce arbitrary JavaScript by injecting a cross-site scripting payload into the "forward.0.domain" parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-023-04
CVE ID: CVE-2023-40144 State: PUBLISHED Published: 2023-08-23T03:09:26.960Z Last Updated: 2024-08-02T18:24:55.653Z Vendors: CBC Co.,Ltd. Products: NR4H, NR8H, NR16H series, DR-16F, DR-8F, DR-4F, DR-16H, DR-8H, DR-4H, DR-4M41 series, NR-4M, NR-8M, NR-16M series, NR-4F, NR-8F, NR-16F series, DR-16M, DR-8M, DR-4M51 series Problem Types: OS command injection Description: OS command injection vulnerability in the CBC products allows a remote authenticated attacker to execute an arbitrary OS command on the device or alter its settings. As for the affected products/versions, see the detailed information provided by the vendor. Note that NR4H, NR8H, NR16H series and DR-16F, DR-8F, DR-4F, DR-16H, DR-
he detailed information provided by the vendor. Note that NR4H, NR8H, NR16H series and DR-16F, DR-8F, DR-4F, DR-16H, DR-8H, DR-4H, DR-4M41 series are no longer supported, therefore updates for those products are not provided. Additional Analyst Notes: - CVE Program Container: References: - https://download.ganzsecurity.pl/ - https://ganzsecurity.com/release/1578/digimasterpixelmaster-security-notice - https://jvn.jp/en/vu/JVNVU92545432/
CVE ID: CVE-2023-40145 State: PUBLISHED Published: 2023-10-19T19:26:20.948Z Last Updated: 2025-01-16T21:28:39.035Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Weintek Products: cMT-FHD, cMT-HDM, cMT3071, cMT3072, cMT3103, cMT3090, cMT3151 Problem Types: CWE-78 Description: In Weintek's cMT3000 HMI Web CGI device, an anonymous attacker can execute arbitrary commands after login to the device. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-285-12 - https://dl.weintek.com/public/Document/TEC/TEC23005E_cMT_Web_Security_Update.pdf
CVE ID: CVE-2023-40146 State: PUBLISHED Published: 2024-04-17T12:55:47.083Z Last Updated: 2025-11-04T18:16:38.419Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Peplink Products: Smart Reader Problem Types: CWE-77 Description: A privilege escalation vulnerability exists in the /bin/login functionality of Peplink Smart Reader v1.2.0 (in QEMU). A specially crafted command line argument can lead to a limited-shell escape and elevated capabilities. An attacker can authenticate with hard-coded credentials and execute unblocked default busybox functionality to trigger this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container:
functionality to trigger this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1868 - https://forum.peplink.com/t/peplink-security-advisory-smart-reader-firmware-1-2-0-cve-2023-43491-cve-2023-45209-cve-2023-39367-cve-2023-45744-cve-2023-40146/47256
CVE ID: CVE-2023-40148 State: PUBLISHED Published: 2024-04-10T00:03:31.966Z Last Updated: 2024-08-12T15:09:02.174Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L) Vendors: Ping Identity Products: PingFederate Problem Types: CWE-918 Description: Server-side request forgery (SSRF) in PingFederate allows unauthenticated http requests to attack network resources and consume server-side resources via forged HTTP POST requests. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://docs.pingidentity.com/r/en-us/pingfederate-120/tuj1708533127032 - https://www.pingidentity.com/en/resources/downloads/pingfederate/previous-releases.ht
ingfederate-120/tuj1708533127032 - https://www.pingidentity.com/en/resources/downloads/pingfederate/previous-releases.html
CVE ID: CVE-2023-40150 State: PUBLISHED Published: 2023-09-11T19:05:00.754Z Last Updated: 2024-09-26T14:31:10.863Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Softneta Products: MedDream PACS Problem Types: CWE-749 Description: Softneta MedDream PACS does not perform an authentication check and performs some dangerous functionality, which could result in unauthenticated remote code execution.0 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-medical-advisories/icsma-23-248-01
CVE ID: CVE-2023-40151 State: PUBLISHED Published: 2023-11-21T00:11:10.081Z Last Updated: 2024-08-02T18:24:55.459Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Red Lion Controls Products: ST-IPm-8460, ST-IPm-6350, VT-mIPm-135-D, VT-mIPm-245-D, VT-IPm2m-213-D, VT-IPm2m-113-D Problem Types: CWE-749 Description: When user authentication is not enabled the shell can execute commands with the highest privileges. Red Lion SixTRAK and VersaTRAK Series RTUs with authenticated users enabled (UDR-A) any Sixnet UDR message will meet an authentication challenge over UDP/IP. When the same message comes over TCP/IP the RTU will simply accept the message with no authen
ion challenge over UDP/IP. When the same message comes over TCP/IP the RTU will simply accept the message with no authentication challenge. Additional Analyst Notes: - CVE Program Container: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-320-01 - https://support.redlion.net/hc/en-us/articles/19339209248269-RLCSIM-2023-05-Authentication-Bypass-and-Remote-Code-Execution
CVE ID: CVE-2023-40152 State: PUBLISHED Published: 2023-11-22T00:42:49.608Z Last Updated: 2024-08-29T19:51:44.689Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Fuji Electric Products: Tellus Lite V-Simulator Problem Types: CWE-787 Description: When Fuji Electric Tellus Lite V-Simulator parses a specially-crafted input file an out of bounds write may occur. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-325-02 - https://felib.fujielectric.co.jp/en/M10009/M20034/document_detail/c27d5b69-68ef-4af5-90ee-b5dab118f71a
CVE ID: CVE-2023-40153 State: PUBLISHED Published: 2023-10-19T18:05:42.988Z Last Updated: 2024-09-11T20:09:53.916Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: DEXMA Products: DexGate Problem Types: CWE-79 Description: The affected product is vulnerable to a cross-site scripting vulnerability, which could allow an attacker to access the web application to introduce arbitrary Java Script by injecting an XSS payload into the 'hostname' parameter of the vulnerable software. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-271-02
CVE ID: CVE-2023-40154 State: PUBLISHED Published: 2024-02-14T13:38:18.098Z Last Updated: 2024-08-08T13:23:39.304Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) SUR for Gameplay Software Problem Types: escalation of privilege, CWE-276 Description: Incorrect default permissions in the Intel(R) SUR for Gameplay Software before version 2.0.1901 may allow privillaged user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01004.html
CVE ID: CVE-2023-40155 State: PUBLISHED Published: 2024-05-16T20:47:29.343Z Last Updated: 2024-08-02T18:24:55.563Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) CST software Problem Types: escalation of privilege, CWE-427 Description: Uncontrolled search path for some Intel(R) CST software before version 2.1.10300 may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01021.html
CVE ID: CVE-2023-40156 State: PUBLISHED Published: 2024-02-14T13:38:19.747Z Last Updated: 2024-08-16T18:13:19.825Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) SSU software Problem Types: escalation of privilege, CWE-427 Description: Uncontrolled search path element in some Intel(R) SSU software before version 3.0.0.2 may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01011.html
CVE ID: CVE-2023-40158 State: PUBLISHED Published: 2023-08-23T02:51:29.372Z Last Updated: 2024-10-11T21:56:59.562Z Vendors: CBC Co.,Ltd. Products: NR4H, NR8H, NR16H series, DR-16F, DR-8F, DR-4F, DR-16H, DR-8H, DR-4H, DR-4M41 series, NR-4M, NR-8M, NR-16M series, NR-4F, NR-8F, NR-16F series, DR-16M, DR-8M, DR-4M51 series Problem Types: Hidden Functionality Description: Hidden functionality vulnerability in the CBC products allows a remote authenticated attacker to execute an arbitrary OS command on the device or alter its settings. As for the affected products/versions, see the detailed information provided by the vendor. Note that NR4H, NR8H, NR16H series and DR-16F, DR-8F, DR-4F, DR-16H, DR-
he detailed information provided by the vendor. Note that NR4H, NR8H, NR16H series and DR-16F, DR-8F, DR-4F, DR-16H, DR-8H, DR-4H, DR-4M41 series are no longer supported, therefore updates for those products are not provided. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://download.ganzsecurity.pl/ - https://ganzsecurity.com/release/1578/digimasterpixelmaster-security-notice - https://jvn.jp/en/vu/JVNVU92545432/
CVE ID: CVE-2023-40159 State: REJECTED Published: 2024-07-18T16:19:22.089Z Last Updated: 2025-04-09T20:26:21.382Z Description: No description available.
CVE ID: CVE-2023-40160 State: PUBLISHED Published: 2024-03-18T00:32:53.212Z Last Updated: 2025-03-24T21:06:34.497Z Vendors: A.K.I Software Products: pmmls.exe Problem Types: Directory traversal Description: Directory traversal vulnerability exists in Mailing List Search CGI (pmmls.exe) included in A.K.I Software's PMailServer/PMailServer2 products. If this vulnerability is exploited, a remote attacker may obtain arbitrary files on the server. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://akisoftware.com/Vulnerability202301.html - https://jvn.jp/en/jp/JVN92720882/
CVE ID: CVE-2023-40161 State: PUBLISHED Published: 2024-02-14T13:38:12.070Z Last Updated: 2024-08-07T19:22:37.051Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H) Vendors: n/a Products: Intel Unite(R) Client software Problem Types: escalation of privilege, CWE-284 Description: Improper access control in some Intel Unite(R) Client software before version 4.2.35041 may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00981.html
CVE ID: CVE-2023-40163 State: PUBLISHED Published: 2023-09-25T15:22:32.584Z Last Updated: 2025-11-04T19:17:46.453Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Accusoft Products: ImageGear Problem Types: CWE-787 Description: An out-of-bounds write vulnerability exists in the allocate_buffer_for_jpeg_decoding functionality of Accusoft ImageGear 20.1. A specially crafted malformed file can lead to memory corruption. An attacker can provide a malicious file to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1836
CVE ID: CVE-2023-40164 State: PUBLISHED Published: 2023-08-25T20:12:58.877Z Last Updated: 2024-10-02T14:52:01.393Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: notepad-plus-plus Products: notepad-plus-plus Problem Types: CWE-120 Description: Notepad++ is a free and open-source source code editor. Versions 8.5.6 and prior are vulnerable to global buffer read overflow in `nsCodingStateMachine::NextStater`. The exploitability of this issue is not clear. Potentially, it may be used to leak internal memory allocation information. As of time of publication, no known patches are available in existing versions of Notepad++. Additional Analyst Notes: - CVE Program
f publication, no known patches are available in existing versions of Notepad++. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://securitylab.github.com/advisories/GHSL-2023-092_Notepad__/
CVE ID: CVE-2023-40165 State: PUBLISHED Published: 2023-08-17T17:06:32.593Z Last Updated: 2024-10-01T17:53:27.145Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N) Vendors: rubygems Products: rubygems.org Problem Types: CWE-20 Description: rubygems.org is the Ruby community's primary gem (library) hosting service. Insufficient input validation allowed malicious actors to replace any uploaded gem version that had a platform, version number, or gem name matching `/-\d/`, permanently replacing the legitimate upload in the canonical gem storage bucket, and triggering an immediate CDN purge so that the malicious gem would be served immediately. The maintainers have checked a
triggering an immediate CDN purge so that the malicious gem would be served immediately. The maintainers have checked all gems matching the `/-\d/` pattern and can confirm that no unexpected `.gem`s were found. As a result, we believe this vulnerability was _not_ exploited. The easiest way to ensure that a user's applications were not exploited by this vulnerability is to check that all of your downloaded .gems have a checksum that matches the checksum recorded in the RubyGems.org database. RubyGems contributor Maciej Mensfeld wrote a tool to automatically check that all downloaded .gem files match the checksums recorded in the RubyGems.org database. You can use it by running: `bundle add b
ownloaded .gem files match the checksums recorded in the RubyGems.org database. You can use it by running: `bundle add bundler-integrity` followed by `bundle exec bundler-integrity`. Neither this tool nor anything else can prove you were not exploited, but the can assist your investigation by quickly comparing RubyGems API-provided checksums with the checksums of files on your disk. The issue has been patched with improved input validation and the changes are live. No action is required on the part of the user. Users are advised to validate their local gems. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/rubygems/rubygems.org/secu
yst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/rubygems/rubygems.org/security/advisories/GHSA-rxcq-2m4f-94wm - https://github.com/rubygems/rubygems.org/commit/7e19c19247ddf5885a915710afc60ec6663d8502
CVE ID: CVE-2023-40166 State: PUBLISHED Published: 2023-08-25T20:20:20.390Z Last Updated: 2024-10-02T14:50:07.295Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: notepad-plus-plus Products: notepad-plus-plus Problem Types: CWE-120, CWE-122 Description: Notepad++ is a free and open-source source code editor. Versions 8.5.6 and prior are vulnerable to heap buffer read overflow in `FileManager::detectLanguageFromTextBegining `. The exploitability of this issue is not clear. Potentially, it may be used to leak internal memory allocation information. As of time of publication, no known patches are available in existing versions of Notepad++. Additional Analyst N
ation. As of time of publication, no known patches are available in existing versions of Notepad++. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://securitylab.github.com/advisories/GHSL-2023-092_Notepad__/
CVE ID: CVE-2023-40167 State: PUBLISHED Published: 2023-09-15T19:37:37.530Z Last Updated: 2025-02-13T17:03:25.096Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: eclipse Products: jetty.project Problem Types: CWE-130 Description: Jetty is a Java based web server and servlet engine. Prior to versions 9.4.52, 10.0.16, 11.0.16, and 12.0.1, Jetty accepts the `+` character proceeding the content-length value in a HTTP/1 header field. This is more permissive than allowed by the RFC and other servers routinely reject such requests with 400 responses. There is no known exploit scenario, but it is conceivable that request smuggling could result if jetty is used in c
ses. There is no known exploit scenario, but it is conceivable that request smuggling could result if jetty is used in combination with a server that does not close the connection after sending such a 400 response. Versions 9.4.52, 10.0.16, 11.0.16, and 12.0.1 contain a patch for this issue. There is no workaround as there is no known exploit scenario. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/eclipse/jetty.project/security/advisories/GHSA-hmr7-m48g-48f6 - https://www.rfc-editor.org/rfc/rfc9110#section-8.6 - https://www.debian.org/security/2023/dsa-5507 - https://lists.debian.org/debian-lts-announce/2023/09/msg00039.html
CVE ID: CVE-2023-40168 State: PUBLISHED Published: 2023-08-17T19:05:18.113Z Last Updated: 2024-10-01T17:52:22.984Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N) Vendors: TurboWarp Products: desktop Problem Types: CWE-863 Description: TurboWarp is a desktop application that compiles scratch projects to JavaScript. TurboWarp Desktop versions prior to version 1.8.0 allowed a malicious project or custom extension to read arbitrary files from disk and upload them to a remote server. The only required user interaction is opening the sb3 file or loading the extension. The web version of TurboWarp is not affected. This bug has been addressed in commit `55e07e99b59` after an