Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
the last page of RAM. The hard fault is not handled and the system will be stuck until reset. Thus the impact is denial of service. Version 2022.10 fixes this issue. As a workaround, apply the patch manually. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/RIOT-OS/RIOT/security/advisories/GHSA-vpx8-h94p-9vrj - https://github.com/RIOT-OS/RIOT/pull/18817/commits/2709fbd827b688fe62df2c77c316914f4a3a6d4a - https://github.com/RIOT-OS/RIOT/pull/18820/commits/d052e2ee166e55bbdfe4c455e65dbd7e3479ebe3
CVE ID: CVE-2023-24821 State: PUBLISHED Published: 2023-04-24T15:11:47.374Z Last Updated: 2025-02-04T18:59:52.801Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: RIOT-OS Products: RIOT Problem Types: CWE-191, CWE-787 Description: RIOT-OS, an operating system that supports Internet of Things devices, contains a network stack with the ability to process 6LoWPAN frames. Prior to version 2022.10, an attacker can send a crafted frame to the device resulting in a large out of bounds write beyond the packet buffer. The write will create a hard fault exception after reaching the last page of RAM. The hard fault is not handled and the system will be stuck until reset,
t exception after reaching the last page of RAM. The hard fault is not handled and the system will be stuck until reset, thus the impact is denial of service. Version 2022.10 fixes this issue. As a workaround, disable support for fragmented IP datagrams or apply the patches manually. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/RIOT-OS/RIOT/security/advisories/GHSA-2fpr-82xr-p887 - https://github.com/RIOT-OS/RIOT/pull/18817/commits/9728f727e75d7d78dbfb5918e0de1b938b7b6d2c - https://github.com/RIOT-OS/RIOT/pull/18820/commits/bd31010231f5340e21410595dd95afc86bbfd341
CVE ID: CVE-2023-24822 State: PUBLISHED Published: 2023-04-24T15:24:26.836Z Last Updated: 2025-02-04T18:56:00.229Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: RIOT-OS Products: RIOT Problem Types: CWE-476 Description: RIOT-OS, an operating system that supports Internet of Things devices, contains a network stack with the ability to process 6LoWPAN frames. Prior to version 2022.10, an attacker can send a crafted frame to the device resulting in a NULL pointer dereference while encoding a 6LoWPAN IPHC header. The NULL pointer dereference causes a hard fault exception, leading to denial of service. Version 2022.10 fixes this issue. As a workaround, apply the
uses a hard fault exception, leading to denial of service. Version 2022.10 fixes this issue. As a workaround, apply the patches manually. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/RIOT-OS/RIOT/security/advisories/GHSA-8x69-5fhj-72wh - https://github.com/RIOT-OS/RIOT/pull/18817/commits/639c04325de4ceb9d444955f4927bfae95843a39 - https://github.com/RIOT-OS/RIOT/pull/18820/commits/7253e261556f252816f4a3b7c4f96fc10d642485
CVE ID: CVE-2023-24823 State: PUBLISHED Published: 2023-04-24T15:27:55.864Z Last Updated: 2025-02-04T18:54:53.625Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: RIOT-OS Products: RIOT Problem Types: CWE-787, CWE-843 Description: RIOT-OS, an operating system that supports Internet of Things devices, contains a network stack with the ability to process 6LoWPAN frames. Prior to version 2022.10, an attacker can send a crafted frame to the device resulting in a type confusion between IPv6 extension headers and a UDP header. This occurs while encoding a 6LoWPAN IPHC header. The type confusion manifests in an out of bounds write in the packet buffer. The overfl
encoding a 6LoWPAN IPHC header. The type confusion manifests in an out of bounds write in the packet buffer. The overflow can be used to corrupt other packets and the allocator metadata. Corrupting a pointer will easily lead to denial of service. While carefully manipulating the allocator metadata gives an attacker the possibility to write data to arbitrary locations and thus execute arbitrary code. Version 2022.10 fixes this issue. As a workaround, apply the patches manually. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/RIOT-OS/RIOT/security/advisories/GHSA-jwmv-47p2-hgq2 - https://github.com/RIOT-OS/RIOT/pull/18817/commits/4a
/github.com/RIOT-OS/RIOT/security/advisories/GHSA-jwmv-47p2-hgq2 - https://github.com/RIOT-OS/RIOT/pull/18817/commits/4a081f86616cb5c9dd0b5d7b286da03285d1652a - https://github.com/RIOT-OS/RIOT/pull/18820/commits/dafc397fdc3655aeb5c7b9963a43f1604c6a2062
CVE ID: CVE-2023-24824 State: PUBLISHED Published: 2023-03-31T22:01:18.220Z Last Updated: 2025-02-11T17:19:40.510Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: github Products: cmark-gfm Problem Types: CWE-400, CWE-407 Description: cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. A polynomial time complexity issue in cmark-gfm may lead to unbounded resource exhaustion and subsequent denial of service. This CVE covers quadratic complexity issues when parsing text which leads with either large numbers of `>` or `-` characters. This issue has been addressed in version 0.29.0.gfm.10. Users are advised to upgrad
ge numbers of `>` or `-` characters. This issue has been addressed in version 0.29.0.gfm.10. Users are advised to upgrade. Users unable to upgrade should validate that their input comes from trusted sources. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/github/cmark-gfm/security/advisories/GHSA-66g8-4hjf-77xh - https://github.com/github/cmark-gfm/commit/2300c1bd2c8226108885bf019655c4159cf26b59
CVE ID: CVE-2023-24825 State: PUBLISHED Published: 2023-05-30T15:54:49.930Z Last Updated: 2025-01-10T16:55:33.480Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: RIOT-OS Products: RIOT Problem Types: CWE-252, CWE-476 Description: RIOT-OS, an operating system for Internet of Things (IoT) devices, contains a network stack with the ability to process 6LoWPAN frames. Prior to version 2023.04, an attacker can send a crafted frame to the device to trigger a NULL pointer dereference leading to denial of service. This issue is fixed in version 2023.04. There are no known workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Referenc
04. There are no known workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/RIOT-OS/RIOT/security/advisories/GHSA-xqm8-xj74-fjw2 - https://github.com/RIOT-OS/RIOT/commit/0c522075445a62ce3102e141573ecc2788521897 - https://github.com/RIOT-OS/RIOT/blob/2022.10-branch/sys/net/gnrc/network_layer/sixlowpan/frag/rb/gnrc_sixlowpan_frag_rb.c#L416 - https://github.com/RIOT-OS/RIOT/blob/2022.10-branch/sys/net/gnrc/network_layer/sixlowpan/frag/rb/gnrc_sixlowpan_frag_rb.c#L429 - https://github.com/RIOT-OS/RIOT/blob/2022.10-branch/sys/net/gnrc/network_layer/sixlowpan/iphc/gnrc_sixlowpan_iphc.c#L729 - https://github.com/RIOT-OS/RIOT/blob/
2.10-branch/sys/net/gnrc/network_layer/sixlowpan/iphc/gnrc_sixlowpan_iphc.c#L729 - https://github.com/RIOT-OS/RIOT/blob/2022.10-branch/sys/net/gnrc/network_layer/sixlowpan/iphc/gnrc_sixlowpan_iphc.c#L761 - https://github.com/RIOT-OS/RIOT/blob/ccbb304eae7b59e8aca24a6ffd095b5b3f7720ee/sys/net/gnrc/pktbuf_static/gnrc_pktbuf_static.c#L169
CVE ID: CVE-2023-24826 State: PUBLISHED Published: 2023-05-30T16:07:45.208Z Last Updated: 2025-01-10T16:54:54.059Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: RIOT-OS Products: RIOT Problem Types: CWE-824 Description: RIOT-OS, an operating system for Internet of Things (IoT) devices, contains a network stack with the ability to process 6LoWPAN frames. Prior to version 2023.04, an attacker can send crafted frames to the device to trigger the usage of an uninitialized object leading to denial of service. This issue is fixed in version 2023.04. As a workaround, disable fragment forwarding or SFR. Additional Analyst Notes: - CVE Program Container: - CISA ADP
3.04. As a workaround, disable fragment forwarding or SFR. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/RIOT-OS/RIOT/security/advisories/GHSA-xfj4-9g7w-f4gh - https://github.com/RIOT-OS/RIOT/commit/287f030af20e829469cdf740606148018a5a220d - https://github.com/RIOT-OS/RIOT/blob/ccbb304eae7b59e8aca24a6ffd095b5b3f7720ee/sys/net/gnrc/network_layer/sixlowpan/frag/sfr/gnrc_sixlowpan_frag_sfr.c#L402 - https://github.com/RIOT-OS/RIOT/blob/ccbb304eae7b59e8aca24a6ffd095b5b3f7720ee/sys/net/gnrc/network_layer/sixlowpan/frag/sfr/gnrc_sixlowpan_frag_sfr.c#L420
CVE ID: CVE-2023-24827 State: PUBLISHED Published: 2023-02-07T00:07:38.460Z Last Updated: 2025-03-10T21:15:45.771Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: anchore Products: syft Problem Types: CWE-200, CWE-532 Description: syft is a a CLI tool and Go library for generating a Software Bill of Materials (SBOM) from container images and filesystems. A password disclosure flaw was found in Syft versions v0.69.0 and v0.69.1. This flaw leaks the password stored in the SYFT_ATTEST_PASSWORD environment variable. The `SYFT_ATTEST_PASSWORD` environment variable is for the `syft attest` command to generate attested SBOMs for the given container image. This envi
nvironment variable is for the `syft attest` command to generate attested SBOMs for the given container image. This environment variable is used to decrypt the private key (provided with `syft attest --key <path-to-key-file>`) during the signing process while generating an SBOM attestation. This vulnerability affects users running syft that have the `SYFT_ATTEST_PASSWORD` environment variable set with credentials (regardless of if the attest command is being used or not). Users that do not have the environment variable `SYFT_ATTEST_PASSWORD` set are not affected by this issue. The credentials are leaked in two ways: in the syft logs when `-vv` or `-vvv` are used in the syft command (which is
ue. The credentials are leaked in two ways: in the syft logs when `-vv` or `-vvv` are used in the syft command (which is any log level >= `DEBUG`) and in the attestation or SBOM only when the `syft-json` format is used. Note that as of v0.69.0 any generated attestations by the `syft attest` command are uploaded to the OCI registry (if you have write access to that registry) in the same way `cosign attach` is done. This means that any attestations generated for the affected versions of syft when the `SYFT_ATTEST_PASSWORD` environment variable was set would leak credentials in the attestation payload uploaded to the OCI registry. This issue has been patched in commit `9995950c70` and has been
n the attestation payload uploaded to the OCI registry. This issue has been patched in commit `9995950c70` and has been released as v0.70.0. There are no workarounds for this vulnerability. Users are advised to upgrade. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/anchore/syft/security/advisories/GHSA-jp7v-3587-2956 - https://github.com/anchore/syft/commit/9995950c70e849f9921919faffbfcf46401f71f3
CVE ID: CVE-2023-24828 State: PUBLISHED Published: 2023-02-07T23:25:11.397Z Last Updated: 2025-03-10T21:15:15.671Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: theonedev Products: onedev Problem Types: CWE-338 Description: Onedev is a self-hosted Git Server with CI/CD and Kanban. In versions prior to 7.9.12 the algorithm used to generate access token and password reset keys was not cryptographically secure. Existing normal users (or everyone if it allows self-registration) may exploit this to elevate privilege to obtain administrator permission. This issue is has been addressed in version 7.9.12. Users are advised to upgrade. There are no known workarounds
ssion. This issue is has been addressed in version 7.9.12. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/theonedev/onedev/security/advisories/GHSA-jf5c-9r77-3j5j - https://github.com/theonedev/onedev/commit/d67dd9686897fe5e4ab881d749464aa7c06a68e5
CVE ID: CVE-2023-24829 State: PUBLISHED Published: 2023-01-31T09:22:41.587Z Last Updated: 2025-03-27T17:13:42.494Z Vendors: Apache Software Foundation Products: Apache IoTDB Workbench Problem Types: CWE-863 Description: Incorrect Authorization vulnerability in Apache Software Foundation Apache IoTDB.This issue affects the iotdb-web-workbench component from 0.13.0 before 0.13.3. iotdb-web-workbench is an optional component of IoTDB, providing a web console of the database. This problem is fixed from version 0.13.3 of iotdb-web-workbench onwards. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/l0b59hh046tyn4gqot0bdrpg8gx
VE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/l0b59hh046tyn4gqot0bdrpg8gxlksmo
CVE ID: CVE-2023-24830 State: PUBLISHED Published: 2023-01-30T16:25:33.163Z Last Updated: 2025-03-28T14:24:59.531Z Vendors: Apache Software Foundation Products: Apache IoTDB Workbench Problem Types: CWE-287 Description: Improper Authentication vulnerability in Apache Software Foundation Apache IoTDB.This issue affects iotdb-web-workbench component: from 0.13.0 before 0.13.3. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/l4fon37687jz5ohgsnz2ko9fv400915t
CVE ID: CVE-2023-24831 State: PUBLISHED Published: 2023-04-17T06:42:06.404Z Last Updated: 2024-10-21T14:17:36.529Z Vendors: Apache Software Foundation Products: Apache IoTDB Problem Types: CWE-287 Description: Improper Authentication vulnerability in Apache Software Foundation Apache IoTDB.This issue affects Apache IoTDB Grafana Connector: from 0.13.0 through 0.13.3. Attackers could login without authorization. This is fixed in 0.13.4. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/3dgvzgstycf8b5hyf4z3n7cqdhcyln3l
CVE ID: CVE-2023-24832 State: PUBLISHED Published: 2023-05-18T21:24:01.747Z Last Updated: 2025-01-21T20:23:54.785Z Vendors: Facebook Products: Hermes Problem Types: CWE-476: NULL Pointer Dereference Description: A null pointer dereference bug in Hermes prior to commit 5cae9f72975cf0e5a62b27fdd8b01f103e198708 could have been used by an attacker to crash an Hermes runtime where the EnableHermesInternal config option was set to true. Note that this is only exploitable in cases where Hermes is used to execute untrusted JavaScript. Hence, most React Native applications are not affected. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.facebook.
ffected. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.facebook.com/security/advisories/cve-2023-24832 - https://github.com/facebook/hermes/commit/5cae9f72975cf0e5a62b27fdd8b01f103e198708
CVE ID: CVE-2023-24833 State: PUBLISHED Published: 2023-05-18T21:24:11.057Z Last Updated: 2025-01-21T20:21:32.835Z Vendors: Facebook Products: Hermes Problem Types: CWE-125: Out-of-bounds Read Description: A use-after-free in BigIntPrimitive addition in Hermes prior to commit a6dcafe6ded8e61658b40f5699878cd19a481f80 could have been used by an attacker to leak raw data from Hermes VM’s heap. Note that this is only exploitable in cases where Hermes is used to execute untrusted JavaScript. Hence, most React Native applications are not affected. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.facebook.com/security/advisories/cve-2023-24833 -
Program Container: - CISA ADP Vulnrichment: References: - https://www.facebook.com/security/advisories/cve-2023-24833 - https://github.com/facebook/hermes/commit/a6dcafe6ded8e61658b40f5699878cd19a481f80
CVE ID: CVE-2023-24834 State: PUBLISHED Published: 2023-03-27T00:00:00.000Z Last Updated: 2025-02-19T16:28:13.210Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: WisdomGarden Products: Tronclass ilearn Problem Types: CWE-639 Description: WisdomGarden Tronclass has improper access control when uploading file. An authenticated remote attacker with general user privilege can exploit this vulnerability to access files belonging to other users by modifying the file ID within URL. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-6954-ed16b-1.html
CVE ID: CVE-2023-24835 State: PUBLISHED Published: 2023-03-27T00:00:00.000Z Last Updated: 2025-02-19T16:27:56.502Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Softnext Products: SPAM SQR Problem Types: CWE-94 Description: Softnext Technologies Corp.’s SPAM SQR has a vulnerability of Code Injection within its specific function. An authenticated remote attacker with administrator privilege can exploit this vulnerability to execute arbitrary system command to perform arbitrary system operation or disrupt service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-6955-c7612-1.html
CVE ID: CVE-2023-24836 State: PUBLISHED Published: 2023-04-27T00:00:00.000Z Last Updated: 2025-01-30T21:13:35.314Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: SUNNET Products: CTMS Problem Types: CWE-22 Description: SUNNET CTMS has vulnerability of path traversal within its file uploading function. An authenticated remote attacker with general user privilege can exploit this vulnerability to upload and execute scripts onto arbitrary directories to perform arbitrary system operation or disrupt service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-7033-878ab-1.html
CVE ID: CVE-2023-24837 State: PUBLISHED Published: 2023-03-27T00:00:00.000Z Last Updated: 2025-02-19T16:27:37.410Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: HGiga Products: PowerStation Problem Types: CWE-78 Description: HGiga PowerStation remote management function has insufficient filtering for user input. An authenticated remote attacker with general user privilege can exploit this vulnerability to inject and execute arbitrary system commands to perform arbitrary system operation or disrupt service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-6956-fbd85-1.html
CVE ID: CVE-2023-24838 State: PUBLISHED Published: 2023-03-27T00:00:00.000Z Last Updated: 2025-02-19T16:27:22.923Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: HGiga Products: PowerStation Problem Types: CWE-200 Description: HGiga PowerStation has a vulnerability of Information Leakage. An unauthenticated remote attacker can exploit this vulnerability to obtain the administrator's credential. This credential can then be used to login PowerStation or Secure Shell to achieve remote code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-6957-d8f67-1.html
CVE ID: CVE-2023-24839 State: PUBLISHED Published: 2023-03-27T00:00:00.000Z Last Updated: 2025-02-19T16:07:44.653Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: HGiga Products: MailSherlock Problem Types: CWE-79 Description: HGiga MailSherlock’s specific function has insufficient filtering for user input. An unauthenticated remote attacker can exploit this vulnerability to inject JavaScript, conducting a reflected XSS attack. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-6958-e1a8e-1.html
CVE ID: CVE-2023-24840 State: PUBLISHED Published: 2023-03-27T00:00:00.000Z Last Updated: 2025-02-19T15:56:20.875Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: HGiga Products: MailSherlock Problem Types: CWE-89 Description: HGiga MailSherlock mail query function has vulnerability of insufficient validation for user input. An authenticated remote attacker with administrator privilege can exploit this vulnerability to inject SQL commands to read, modify, and delete the database. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-6959-cdecb-1.html
CVE ID: CVE-2023-24841 State: PUBLISHED Published: 2023-03-27T00:00:00.000Z Last Updated: 2025-02-19T15:55:17.853Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: HGiga Products: MailSherlock Problem Types: CWE-78 Description: HGiga MailSherlock query function for connection log has a vulnerability of insufficient filtering for user input. An authenticated remote attacker with administrator privilege can exploit this vulnerability to inject and execute arbitrary system commands to perform arbitrary system operation or disrupt service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-6
nal Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-6960-fc2fe-1.html
CVE ID: CVE-2023-24842 State: PUBLISHED Published: 2023-03-27T00:00:00.000Z Last Updated: 2025-02-19T15:54:06.404Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: HGiga Products: MailSherlock Problem Types: CWE-639 Description: HGiga MailSherlock has vulnerability of insufficient access control. An unauthenticated remote user can exploit this vulnerability to access partial content of another user’s mail by changing user ID and mail ID within URL. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-6961-12444-1.html
CVE ID: CVE-2023-24843 State: PUBLISHED Published: 2023-10-03T05:00:24.982Z Last Updated: 2024-08-02T11:03:19.411Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Qualcomm, Inc. Products: Snapdragon Problem Types: CWE-617 Description: Transient DOS in Modem while triggering a camping on an 5G cell. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.qualcomm.com/company/product-security/bulletins/october-2023-bulletin
CVE ID: CVE-2023-24844 State: PUBLISHED Published: 2023-10-03T05:00:26.163Z Last Updated: 2025-02-27T20:48:15.762Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Qualcomm, Inc. Products: Snapdragon Problem Types: CWE-284 Description: Memory Corruption in Core while invoking a call to Access Control core library with hardware protected address range. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.qualcomm.com/company/product-security/bulletins/october-2023-bulletin
CVE ID: CVE-2023-24845 State: PUBLISHED Published: 2023-08-08T09:20:14.156Z Last Updated: 2025-08-12T11:16:15.707Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: RUGGEDCOM i800, RUGGEDCOM i800NC, RUGGEDCOM i801, RUGGEDCOM i801NC, RUGGEDCOM i802, RUGGEDCOM i802NC, RUGGEDCOM i803, RUGGEDCOM i803NC, RUGGEDCOM M2100, RUGGEDCOM M2100F, RUGGEDCOM M2100NC, RUGGEDCOM M2200, RUGGEDCOM M2200F, RUGGEDCOM M2200NC, RUGGEDCOM M969, RUGGEDCOM M969F, RUGGEDCOM M969NC, RUGGEDCOM RMC30, RUGGEDCOM RMC30NC, RUGGEDCOM RMC8388 V4.X, RUGGEDCOM RMC8388 V5.X, RUGGEDCOM RMC8388NC V4.X, RUGGEDCOM RMC8388NC V5.X, RUGGEDCOM RP110, RUGGEDCOM RP110NC, RU