Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-38604 State: PUBLISHED Published: 2023-07-28T04:30:43.764Z Last Updated: 2025-02-13T17:02:05.195Z Vendors: Apple Products: tvOS, iOS and iPadOS, macOS, watchOS Problem Types: An app may be able to execute arbitrary code with kernel privileges Description: An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in watchOS 9.6, macOS Big Sur 11.7.9, iOS 15.7.8 and iPadOS 15.7.8, macOS Monterey 12.6.8, tvOS 16.6, iOS 16.6 and iPadOS 16.6, macOS Ventura 13.5. An app may be able to execute arbitrary code with kernel privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.apple.com
ges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.apple.com/en-us/HT213846 - https://support.apple.com/en-us/HT213841 - https://support.apple.com/en-us/HT213843 - https://support.apple.com/en-us/HT213842 - https://support.apple.com/en-us/HT213845 - https://support.apple.com/en-us/HT213844 - https://support.apple.com/en-us/HT213848 - https://support.apple.com/kb/HT213843 - https://support.apple.com/kb/HT213844 - https://support.apple.com/kb/HT213841 - https://support.apple.com/kb/HT213845 - https://support.apple.com/kb/HT213846 - https://support.apple.com/kb/HT213842 - https://support.apple.com/kb/HT213848
CVE ID: CVE-2023-38605 State: PUBLISHED Published: 2023-09-06T20:48:09.737Z Last Updated: 2025-02-13T17:02:05.732Z Vendors: Apple Products: macOS Problem Types: An app may be able to determine a user’s current location Description: This issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Ventura 13.5. An app may be able to determine a user’s current location. Additional Analyst Notes: - CVE Program Container: References: - https://support.apple.com/en-us/HT213843 - https://support.apple.com/kb/HT213844 - https://support.apple.com/kb/HT213841 - https://support.apple.com/kb/HT213842
CVE ID: CVE-2023-38606 State: PUBLISHED Published: 2023-07-26T23:55:05.346Z Last Updated: 2025-10-30T18:31:27.599Z Vendors: Apple Products: tvOS, iOS and iPadOS, macOS, watchOS Problem Types: An app may be able to modify sensitive kernel state. Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.7.1. Description: This issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.6.8, iOS 15.7.8 and iPadOS 15.7.8, iOS 16.6 and iPadOS 16.6, tvOS 16.6, macOS Big Sur 11.7.9, macOS Ventura 13.5, watchOS 9.6. An app may be able to modify sensitive kernel state. Apple is aware of a report that this
cOS Ventura 13.5, watchOS 9.6. An app may be able to modify sensitive kernel state. Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.7.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.apple.com/en-us/HT213846 - https://support.apple.com/en-us/HT213841 - https://support.apple.com/en-us/HT213843 - https://support.apple.com/en-us/HT213842 - https://support.apple.com/en-us/HT213845 - https://support.apple.com/en-us/HT213844 - https://support.apple.com/en-us/HT213848
CVE ID: CVE-2023-38607 State: PUBLISHED Published: 2024-01-10T22:03:17.061Z Last Updated: 2025-11-04T19:17:25.862Z Vendors: Apple Products: macOS Problem Types: An app may be able to modify Printer settings Description: The issue was addressed with improved handling of caches. This issue is fixed in macOS Sonoma 14. An app may be able to modify Printer settings. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.apple.com/en-us/HT213940
CVE ID: CVE-2023-38608 State: PUBLISHED Published: 2023-07-27T00:31:21.187Z Last Updated: 2024-10-22T20:32:15.246Z Vendors: Apple Products: macOS Problem Types: An app may be able to access user-sensitive data Description: The issue was addressed with additional permissions checks. This issue is fixed in macOS Ventura 13.5. An app may be able to access user-sensitive data. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.apple.com/en-us/HT213843
CVE ID: CVE-2023-38609 State: PUBLISHED Published: 2023-07-28T04:30:45.223Z Last Updated: 2025-02-13T17:02:06.292Z Vendors: Apple Products: macOS Problem Types: An app may be able to bypass certain Privacy preferences Description: An injection issue was addressed with improved input validation. This issue is fixed in macOS Ventura 13.5. An app may be able to bypass certain Privacy preferences. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.apple.com/en-us/HT213843 - https://support.apple.com/kb/HT213843
CVE ID: CVE-2023-38610 State: PUBLISHED Published: 2024-01-10T22:03:11.487Z Last Updated: 2025-11-04T19:17:28.146Z Vendors: Apple Products: iOS and iPadOS, macOS Problem Types: An app may be able to cause unexpected system termination or write kernel memory Description: A memory corruption issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sonoma 14, iOS 17 and iPadOS 17. An app may be able to cause unexpected system termination or write kernel memory. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.apple.com/en-us/HT213938 - https://support.apple.com/en-us/HT213940
CVE ID: CVE-2023-38611 State: PUBLISHED Published: 2023-07-27T00:22:12.030Z Last Updated: 2025-02-13T17:02:06.908Z Vendors: Apple Products: Safari, tvOS, iOS and iPadOS, macOS, watchOS Problem Types: Processing web content may lead to arbitrary code execution Description: The issue was addressed with improved memory handling. This issue is fixed in iOS 16.6 and iPadOS 16.6, tvOS 16.6, macOS Ventura 13.5, Safari 16.6, watchOS 9.6. Processing web content may lead to arbitrary code execution. Additional Analyst Notes: - CVE Program Container: References: - https://support.apple.com/en-us/HT213847 - https://support.apple.com/en-us/HT213846 - https://support.apple.com/en-us/HT213841 - https://sup
e.com/en-us/HT213847 - https://support.apple.com/en-us/HT213846 - https://support.apple.com/en-us/HT213841 - https://support.apple.com/en-us/HT213843 - https://support.apple.com/en-us/HT213848 - http://www.openwall.com/lists/oss-security/2023/08/02/1 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJ4DG5LHWG2INDOTPB7MO4JVJN6LKL3M/ - https://www.debian.org/security/2023/dsa-5468 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KQXJYKTGLKI6TJEFJCKPHCNY7PS72OER/ - https://security.gentoo.org/glsa/202401-04
CVE ID: CVE-2023-38612 State: PUBLISHED Published: 2024-01-10T22:03:45.130Z Last Updated: 2025-11-04T19:17:32.510Z Vendors: Apple Products: iOS and iPadOS, macOS Problem Types: An app may be able to access protected user data Description: The issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.7, iOS 16.7 and iPadOS 16.7, iOS 17 and iPadOS 17, macOS Sonoma 14, macOS Ventura 13.6. An app may be able to access protected user data. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.apple.com/en-us/HT213938 - https://support.apple.com/en-us/HT213932 - https://support.apple.com/en-us/HT213927 - https://support.a
en-us/HT213938 - https://support.apple.com/en-us/HT213932 - https://support.apple.com/en-us/HT213927 - https://support.apple.com/en-us/HT213931 - https://support.apple.com/en-us/HT213940
CVE ID: CVE-2023-38614 State: PUBLISHED Published: 2025-04-11T14:53:58.510Z Last Updated: 2025-04-11T16:30:01.676Z Vendors: Apple Products: iOS and iPadOS, macOS Problem Types: A permissions issue was addressed with additional restrictions. Description: A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 17 and iPadOS 17, macOS Sonoma 14. An app may be able to access sensitive user data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.apple.com/en-us/120949 - https://support.apple.com/en-us/120950
CVE ID: CVE-2023-38615 State: PUBLISHED Published: 2023-09-26T20:14:50.622Z Last Updated: 2025-11-04T19:17:33.614Z Vendors: Apple Products: macOS Problem Types: An app may be able to execute arbitrary code with kernel privileges Description: The issue was addressed with improved memory handling. This issue is fixed in macOS Sonoma 14. An app may be able to execute arbitrary code with kernel privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.apple.com/en-us/HT213940 - http://seclists.org/fulldisclosure/2023/Oct/3
CVE ID: CVE-2023-38616 State: PUBLISHED Published: 2023-09-06T20:48:07.521Z Last Updated: 2024-09-26T17:44:11.764Z Vendors: Apple Products: macOS Problem Types: An app may be able to execute arbitrary code with kernel privileges Description: A race condition was addressed with improved state handling. This issue is fixed in macOS Ventura 13.5. An app may be able to execute arbitrary code with kernel privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.apple.com/en-us/HT213843
CVE ID: CVE-2023-38617 State: PUBLISHED Published: 2023-07-20T00:00:00 Last Updated: 2024-10-24T20:14:25.945Z Vendors: n/a Products: n/a Problem Types: n/a Description: Office Suite Premium Version v10.9.1.42602 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the filter parameter at /api?path=files. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://packetstormsecurity.com/files/173143/Office-Suite-Premium-10.9.1.42602-Cross-Site-Scripting.html
CVE ID: CVE-2023-38618 State: PUBLISHED Published: 2024-01-08T14:47:47.979Z Last Updated: 2025-11-04T18:15:54.296Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: GTKWave Products: GTKWave Problem Types: CWE-190 Description: Multiple integer overflow vulnerabilities exist in the VZT facgeometry parsing functionality of GTKWave 3.3.115. A specially crafted .vzt file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the integer overflow when allocating the `rows` array. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tal
the `rows` array. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1812 - https://lists.debian.org/debian-lts-announce/2024/04/msg00007.html
CVE ID: CVE-2023-38619 State: PUBLISHED Published: 2024-01-08T14:47:48.061Z Last Updated: 2025-11-04T18:15:55.483Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: GTKWave Products: GTKWave Problem Types: CWE-190 Description: Multiple integer overflow vulnerabilities exist in the VZT facgeometry parsing functionality of GTKWave 3.3.115. A specially crafted .vzt file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the integer overflow when allocating the `msb` array. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talo
the `msb` array. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1812 - https://lists.debian.org/debian-lts-announce/2024/04/msg00007.html
CVE ID: CVE-2023-38620 State: PUBLISHED Published: 2024-01-08T14:47:48.155Z Last Updated: 2025-11-04T18:15:56.648Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: GTKWave Products: GTKWave Problem Types: CWE-190 Description: Multiple integer overflow vulnerabilities exist in the VZT facgeometry parsing functionality of GTKWave 3.3.115. A specially crafted .vzt file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the integer overflow when allocating the `lsb` array. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talo
the `lsb` array. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1812 - https://lists.debian.org/debian-lts-announce/2024/04/msg00007.html
CVE ID: CVE-2023-38621 State: PUBLISHED Published: 2024-01-08T14:47:48.282Z Last Updated: 2025-11-04T18:15:57.848Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: GTKWave Products: GTKWave Problem Types: CWE-190 Description: Multiple integer overflow vulnerabilities exist in the VZT facgeometry parsing functionality of GTKWave 3.3.115. A specially crafted .vzt file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the integer overflow when allocating the `flags` array. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://ta
the `flags` array. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1812 - https://lists.debian.org/debian-lts-announce/2024/04/msg00007.html
CVE ID: CVE-2023-38622 State: PUBLISHED Published: 2024-01-08T14:47:48.376Z Last Updated: 2025-11-04T18:15:59.024Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: GTKWave Products: GTKWave Problem Types: CWE-190 Description: Multiple integer overflow vulnerabilities exist in the VZT facgeometry parsing functionality of GTKWave 3.3.115. A specially crafted .vzt file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the integer overflow when allocating the `len` array. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talo
the `len` array. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1812 - https://lists.debian.org/debian-lts-announce/2024/04/msg00007.html
CVE ID: CVE-2023-38623 State: PUBLISHED Published: 2024-01-08T14:47:48.463Z Last Updated: 2025-11-04T18:16:00.356Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: GTKWave Products: GTKWave Problem Types: CWE-190 Description: Multiple integer overflow vulnerabilities exist in the VZT facgeometry parsing functionality of GTKWave 3.3.115. A specially crafted .vzt file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the integer overflow when allocating the `vindex_offset` array. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - ht
the `vindex_offset` array. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1812 - https://lists.debian.org/debian-lts-announce/2024/04/msg00007.html
CVE ID: CVE-2023-38624 State: PUBLISHED Published: 2024-01-23T20:34:05.300Z Last Updated: 2025-06-20T18:43:53.873Z Vendors: Trend Micro, Inc. Products: Trend Micro Apex Central Description: A post-authenticated server-side request forgery (SSRF) vulnerability in Trend Micro Apex Central 2019 (lower than build 6481) could allow an attacker to interact with internal or local services directly. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. This is a similar, but not identical vulnerability as CVE-2023-38625 through CVE-2023-38627. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vul
ulnerability as CVE-2023-38625 through CVE-2023-38627. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://success.trendmicro.com/dcx/s/solution/000294176?language=en_US - https://www.zerodayinitiative.com/advisories/ZDI-23-998/
CVE ID: CVE-2023-38625 State: PUBLISHED Published: 2024-01-23T20:34:25.108Z Last Updated: 2025-06-20T18:44:47.918Z Vendors: Trend Micro, Inc. Products: Trend Micro Apex Central Description: A post-authenticated server-side request forgery (SSRF) vulnerability in Trend Micro Apex Central 2019 (lower than build 6481) could allow an attacker to interact with internal or local services directly. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. This is a similar, but not identical vulnerability as CVE-2023-38624. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References:
ulnerability as CVE-2023-38624. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://success.trendmicro.com/dcx/s/solution/000294176?language=en_US - https://www.zerodayinitiative.com/advisories/ZDI-23-999/
CVE ID: CVE-2023-38626 State: PUBLISHED Published: 2024-01-23T20:34:41.067Z Last Updated: 2025-06-20T18:45:32.190Z Vendors: Trend Micro, Inc. Products: Trend Micro Apex Central Description: A post-authenticated server-side request forgery (SSRF) vulnerability in Trend Micro Apex Central 2019 (lower than build 6481) could allow an attacker to interact with internal or local services directly. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. This is a similar, but not identical vulnerability as CVE-2023-38625. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References:
ulnerability as CVE-2023-38625. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://success.trendmicro.com/dcx/s/solution/000294176?language=en_US - https://www.zerodayinitiative.com/advisories/ZDI-23-1000/
CVE ID: CVE-2023-38627 State: PUBLISHED Published: 2024-01-23T20:34:54.008Z Last Updated: 2025-06-20T18:46:13.667Z Vendors: Trend Micro, Inc. Products: Trend Micro Apex Central Description: A post-authenticated server-side request forgery (SSRF) vulnerability in Trend Micro Apex Central 2019 (lower than build 6481) could allow an attacker to interact with internal or local services directly. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. This is a similar, but not identical vulnerability as CVE-2023-38626. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References:
ulnerability as CVE-2023-38626. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://success.trendmicro.com/dcx/s/solution/000294176?language=en_US - https://www.zerodayinitiative.com/advisories/ZDI-23-1001/
CVE ID: CVE-2023-38632 State: PUBLISHED Published: 2023-07-21T00:00:00 Last Updated: 2024-10-24T14:41:14.506Z Vendors: n/a Products: n/a Problem Types: n/a Description: async-sockets-cpp through 0.3.1 has a stack-based buffer overflow in tcpsocket.hpp when processing malformed TCP packets. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/eminfedar/async-sockets-cpp/issues/31
CVE ID: CVE-2023-38633 State: PUBLISHED Published: 2023-07-22T00:00:00 Last Updated: 2024-08-02T17:46:56.600Z Vendors: n/a Products: n/a Problem Types: n/a Description: A directory traversal problem in the URL decoder of librsvg before 2.56.3 could be used by local or remote attackers to disclose files (on the local filesystem outside of the expected area), as demonstrated by href=".?../../../../../../../../../../etc/passwd" in an xi:include element. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.gnome.org/GNOME/librsvg/-/issues/996 - https://bugzilla.suse.com/show_bug.cgi?id=1213502 - https://gitlab.gnome.org/GNOME/librsvg/-/releases/2.56.3 - http://seclists
//bugzilla.suse.com/show_bug.cgi?id=1213502 - https://gitlab.gnome.org/GNOME/librsvg/-/releases/2.56.3 - http://seclists.org/fulldisclosure/2023/Jul/43 - http://www.openwall.com/lists/oss-security/2023/07/27/1 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R5BCXT5GW6RCL45ZUHUZR4CJG2BAFDVC/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/422NTIHIEBRASIG2DWXYBH4ADYMHY626/ - https://www.debian.org/security/2023/dsa-5484 - https://security.netapp.com/advisory/ntap-20230831-0011/ - http://www.openwall.com/lists/oss-security/2023/09/06/10 - https://www.canva.dev/blog/engineering/when-url-parsers-
1/ - http://www.openwall.com/lists/oss-security/2023/09/06/10 - https://www.canva.dev/blog/engineering/when-url-parsers-disagree-cve-2023-38633/ - https://news.ycombinator.com/item?id=37415799
CVE ID: CVE-2023-38640 State: PUBLISHED Published: 2023-10-10T10:21:25.048Z Last Updated: 2024-08-02T17:46:56.933Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: SICAM PAS/PQS Problem Types: CWE-732 Description: A vulnerability has been identified in SICAM PAS/PQS (All versions >= V8.00 < V8.22). The affected application is installed with specific files and folders with insecure permissions. This could allow an authenticated local attacker to read and modify configuration data in the context of the application process. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cert-porta
on process. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-035466.pdf - https://cert-portal.siemens.com/productcert/html/ssa-035466.html
CVE ID: CVE-2023-38641 State: PUBLISHED Published: 2023-08-08T09:20:43.085Z Last Updated: 2025-02-27T21:09:35.100Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: SICAM TOOLBOX II Problem Types: CWE-250 Description: A vulnerability has been identified in SICAM TOOLBOX II (All versions < V07.10). The affected application's database service is executed as `NT AUTHORITY\SYSTEM`. This could allow a local attacker to execute operating system commands with elevated privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-975961.pdf
CVE ID: CVE-2023-38646 State: PUBLISHED Published: 2023-07-21T00:00:00 Last Updated: 2024-08-02T17:46:56.432Z Vendors: n/a Products: n/a Problem Types: n/a Description: Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary commands on the server, at the server's privilege level. Authentication is not required for exploitation. The other fixed versions are 0.45.4.1, 1.45.4.1, 0.44.7.1, 1.44.7.1, 0.43.7.2, and 1.43.7.2. Additional Analyst Notes: - CVE Program Container: References: - https://www.metabase.com/blog/security-advisory - https://github.com/metabase/metabase/releases/tag/v0.46.6.1 - https://news.ycombinator.com/item?id=3681
urity-advisory - https://github.com/metabase/metabase/releases/tag/v0.46.6.1 - https://news.ycombinator.com/item?id=36812256 - https://github.com/metabase/metabase/issues/32552 - http://packetstormsecurity.com/files/174091/Metabase-Remote-Code-Execution.html - http://packetstormsecurity.com/files/177138/Metabase-0.46.6-Remote-Code-Execution.html