Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
networks, or from the Internet. Exploitation is possible only from a CSP (Communication Service Provider) mobile network solution internal BTS management network. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://nokia.com - https://www.nokia.com/about-us/security-and-privacy/product-security-advisory/cve-2023-26062/
CVE ID: CVE-2023-26063 State: PUBLISHED Published: 2023-04-10T00:00:00.000Z Last Updated: 2025-02-11T16:08:36.511Z Vendors: n/a Products: n/a Problem Types: n/a Description: Certain Lexmark devices through 2023-02-19 access a Resource By Using an Incompatible Type. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.lexmark.com/alerts/ - https://publications.lexmark.com/publications/security-alerts/CVE-2023-26063.pdf
CVE ID: CVE-2023-26064 State: PUBLISHED Published: 2023-04-10T00:00:00.000Z Last Updated: 2025-02-11T16:06:38.659Z Vendors: n/a Products: n/a Problem Types: n/a Description: Certain Lexmark devices through 2023-02-19 have an Out-of-bounds Write. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.lexmark.com/alerts/ - https://publications.lexmark.com/publications/security-alerts/CVE-2023-26064.pdf
CVE ID: CVE-2023-26065 State: PUBLISHED Published: 2023-04-10T00:00:00.000Z Last Updated: 2025-02-11T16:05:00.712Z Vendors: n/a Products: n/a Problem Types: n/a Description: Certain Lexmark devices through 2023-02-19 have an Integer Overflow. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.lexmark.com/alerts/ - https://publications.lexmark.com/publications/security-alerts/CVE-2023-26065.pdf
CVE ID: CVE-2023-26066 State: PUBLISHED Published: 2023-04-10T00:00:00.000Z Last Updated: 2025-02-11T16:02:14.293Z Vendors: n/a Products: n/a Problem Types: n/a Description: Certain Lexmark devices through 2023-02-19 have Improper Validation of an Array Index. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.lexmark.com/alerts/ - https://publications.lexmark.com/publications/security-alerts/CVE-2023-26066.pdf
CVE ID: CVE-2023-26067 State: PUBLISHED Published: 2023-04-10T00:00:00.000Z Last Updated: 2025-02-11T16:05:04.335Z Vendors: n/a Products: n/a Problem Types: n/a Description: Certain Lexmark devices through 2023-02-19 mishandle Input Validation (issue 1 of 4). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.lexmark.com/alerts/ - https://publications.lexmark.com/publications/security-alerts/CVE-2023-26067.pdf - http://packetstormsecurity.com/files/174763/Lexmark-Device-Embedded-Web-Server-Remote-Code-Execution.html
CVE ID: CVE-2023-26068 State: PUBLISHED Published: 2023-04-10T00:00:00.000Z Last Updated: 2025-05-05T16:04:52.135Z Vendors: n/a Products: n/a Problem Types: n/a Description: Certain Lexmark devices through 2023-02-19 mishandle Input Validation (issue 2 of 4). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.lexmark.com/alerts/ - https://publications.lexmark.com/publications/security-alerts/CVE-2023-26068.pdf - http://packetstormsecurity.com/files/174763/Lexmark-Device-Embedded-Web-Server-Remote-Code-Execution.html
CVE ID: CVE-2023-26069 State: PUBLISHED Published: 2023-04-10T00:00:00.000Z Last Updated: 2025-02-11T16:12:18.513Z Vendors: n/a Products: n/a Problem Types: n/a Description: Certain Lexmark devices through 2023-02-19 mishandle Input Validation (issue 3 of 4). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.lexmark.com/alerts/ - https://publications.lexmark.com/publications/security-alerts/CVE-2023-26069.pdf
CVE ID: CVE-2023-26070 State: PUBLISHED Published: 2023-04-10T00:00:00.000Z Last Updated: 2025-02-11T16:14:11.653Z Vendors: n/a Products: n/a Problem Types: n/a Description: Certain Lexmark devices through 2023-02-19 mishandle Input Validation (issue 4 of 4). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.lexmark.com/alerts/ - https://publications.lexmark.com/publications/security-alerts/CVE-2023-26070.pdf
CVE ID: CVE-2023-26071 State: PUBLISHED Published: 2023-03-28T00:00:00.000Z Last Updated: 2025-02-19T15:33:13.485Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in MCUBO ICT through 10.12.4 (aka 6.0.2). An Observable Response Discrepancy can occur under the login web page. In particular, the web application provides different responses to incoming requests in a way that reveals internal state information to an unauthorized actor. That allow an unauthorized actor to perform User Enumeration attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.gruppotim.it/it/footer/red-team.html
CVE ID: CVE-2023-26072 State: PUBLISHED Published: 2023-03-13T00:00:00.000Z Last Updated: 2025-03-03T19:21:07.889Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AC:L/AV:N/A:H/C:L/I:L/PR:L/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Samsung Mobile Chipset and Baseband Modem Chipset for Exynos 850, Exynos 980, Exynos 1080, Exynos 1280, Exynos 2200, Exynos Modem 5123, Exynos Modem 5300, and Exynos Auto T5123. A heap-based buffer overflow in the 5G MM message codec can occur due to insufficient parameter validation when decoding the Emergency number list. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://semi
ency number list. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://semiconductor.samsung.com/processor/modem/ - https://semiconductor.samsung.com/processor/mobile-processor/ - https://semiconductor.samsung.com/support/quality-support/product-security-updates/ - https://googleprojectzero.blogspot.com/2023/03/multiple-internet-to-baseband-remote-rce.html - https://bugs.chromium.org/p/project-zero/issues/detail?id=2395 - http://packetstormsecurity.com/files/171378/Shannon-Baseband-NrmmMsgCodec-Emergency-Number-List-Heap-Buffer-Overflow.html
CVE ID: CVE-2023-26073 State: PUBLISHED Published: 2023-03-13T00:00:00.000Z Last Updated: 2025-03-03T19:17:40.134Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AC:L/AV:N/A:H/C:L/I:L/PR:L/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Samsung Mobile Chipset and Baseband Modem Chipset for Exynos 850, Exynos 980, Exynos 1080, Exynos 1280, Exynos 2200, Exynos Modem 5123, Exynos Modem 5300, and Exynos Auto T5123. A heap-based buffer overflow in the 5G MM message codec can occur due to insufficient parameter validation when decoding the extended emergency number list. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - htt
ded emergency number list. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://semiconductor.samsung.com/processor/modem/ - https://semiconductor.samsung.com/processor/mobile-processor/ - https://semiconductor.samsung.com/support/quality-support/product-security-updates/ - https://googleprojectzero.blogspot.com/2023/03/multiple-internet-to-baseband-remote-rce.html - https://bugs.chromium.org/p/project-zero/issues/detail?id=2396 - http://packetstormsecurity.com/files/171380/Shannon-Baseband-NrmmMsgCodec-Extended-Emergency-Number-List-Heap-Buffer-Overflow.html
CVE ID: CVE-2023-26074 State: PUBLISHED Published: 2023-03-13T00:00:00.000Z Last Updated: 2025-03-03T19:11:30.839Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AC:L/AV:N/A:H/C:L/I:L/PR:L/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Samsung Mobile Chipset and Baseband Modem Chipset for Exynos 850, Exynos 980, Exynos 1080, Exynos 1280, Exynos 2200, Exynos Modem 5123, Exynos Modem 5300, and Exynos Auto T5123.. A heap-based buffer overflow in the 5G MM message codec can occur due to insufficient parameter validation when decoding operator-defined access category definitions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Refere
-defined access category definitions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://semiconductor.samsung.com/processor/modem/ - https://semiconductor.samsung.com/processor/mobile-processor/ - https://semiconductor.samsung.com/support/quality-support/product-security-updates/ - https://googleprojectzero.blogspot.com/2023/03/multiple-internet-to-baseband-remote-rce.html - https://bugs.chromium.org/p/project-zero/issues/detail?id=2397 - http://packetstormsecurity.com/files/171383/Shannon-Baseband-NrmmMsgCodec-Access-Category-Definitions-Heap-Buffer-Overflow.html
CVE ID: CVE-2023-26075 State: PUBLISHED Published: 2023-03-10T00:00:00.000Z Last Updated: 2025-02-27T21:06:50.570Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AC:L/AV:N/A:H/C:L/I:L/PR:L/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Samsung Mobile Chipset and Baseband Modem Chipset for Exynos 850, Exynos 980, Exynos 1080, Exynos 1280, Exynos 2200, Exynos Modem 5123, Exynos Modem 5300, and Exynos Auto T5123. An intra-object overflow in the 5G MM message codec can occur due to insufficient parameter validation when decoding the Service Area List. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://semiconducto
rea List. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://semiconductor.samsung.com/processor/modem/ - https://semiconductor.samsung.com/processor/mobile-processor/ - https://semiconductor.samsung.com/support/quality-support/product-security-updates/ - https://googleprojectzero.blogspot.com/2023/03/multiple-internet-to-baseband-remote-rce.html - https://bugs.chromium.org/p/project-zero/issues/detail?id=2398 - http://packetstormsecurity.com/files/171387/Shannon-Baseband-NrmmMsgCodec-Intra-Object-Overflow.html
CVE ID: CVE-2023-26076 State: PUBLISHED Published: 2023-03-13T00:00:00.000Z Last Updated: 2025-03-03T18:06:41.894Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AC:L/AV:N/A:H/C:L/I:L/PR:L/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Samsung Mobile Chipset and Baseband Modem Chipset for Exynos 1280, Exynos 2200, Exynos Modem 5123, Exynos Modem 5300, and Exynos Auto T5123. An intra-object overflow in the 5G SM message codec can occur due to insufficient parameter validation when decoding reserved options. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://semiconductor.samsung.com/processor/modem/ - https://s
Program Container: - CISA ADP Vulnrichment: References: - https://semiconductor.samsung.com/processor/modem/ - https://semiconductor.samsung.com/processor/mobile-processor/ - https://semiconductor.samsung.com/support/quality-support/product-security-updates/ - https://googleprojectzero.blogspot.com/2023/03/multiple-internet-to-baseband-remote-rce.html - http://packetstormsecurity.com/files/171400/Shannon-Baseband-NrSmPcoCodec-Intra-Object-Overflow.html
CVE ID: CVE-2023-26077 State: PUBLISHED Published: 2023-07-24T00:00:00 Last Updated: 2024-10-24T14:04:50.111Z Vendors: n/a Products: n/a Problem Types: n/a Description: Atera Agent through 1.8.3.6 on Windows Creates a Temporary File in a Directory with Insecure Permissions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/mandiant/Vulnerability-Disclosures - https://www.atera.com - https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2023/MNDT-2023-0008.md
CVE ID: CVE-2023-26078 State: PUBLISHED Published: 2023-07-24T00:00:00.000Z Last Updated: 2025-02-13T16:44:46.975Z Vendors: n/a Products: n/a Problem Types: n/a Description: Privilege escalation vulnerability was discovered in Atera Agent 1.8.4.4 and prior on Windows due to mishandling of privileged APIs. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/mandiant/Vulnerability-Disclosures - https://www.atera.com - https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2023/MNDT-2023-0009.md
CVE ID: CVE-2023-26081 State: PUBLISHED Published: 2023-02-20T00:00:00.000Z Last Updated: 2025-03-18T15:00:49.464Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Epiphany (aka GNOME Web) through 43.0, untrusted web content can trick users into exfiltrating passwords, because autofill occurs in sandboxed contexts. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/1275 - https://github.com/google/security-research/security/advisories/GHSA-mhhf-w9xw-pp9x - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SADQCSQKTJKTTIJMEPY7GII6IVQSKEKV/
sts.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SADQCSQKTJKTTIJMEPY7GII6IVQSKEKV/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IFWUNG6E4ZT43EYNHKYXS7QVSO2VW2H2/ - https://lists.debian.org/debian-lts-announce/2023/05/msg00015.html
CVE ID: CVE-2023-26083 State: PUBLISHED Published: 2023-04-06T00:00:00.000Z Last Updated: 2025-10-21T23:15:20.684Z Vendors: n/a Products: n/a Problem Types: n/a Description: Memory leak vulnerability in Mali GPU Kernel Driver in Midgard GPU Kernel Driver all versions from r6p0 - r32p0, Bifrost GPU Kernel Driver all versions from r0p0 - r42p0, Valhall GPU Kernel Driver all versions from r19p0 - r42p0, and Avalon GPU Kernel Driver all versions from r41p0 - r42p0 allows a non-privileged user to make valid GPU processing operations that expose sensitive kernel metadata. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://developer.arm.com/Arm%20Secur
nal Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities - https://www.cybersecurity-help.cz/vdb/SB2023033049 - https://www.cybersecurity-help.cz/vulnerabilities/74210/
CVE ID: CVE-2023-26084 State: PUBLISHED Published: 2023-03-15T00:00:00.000Z Last Updated: 2025-02-27T21:08:42.908Z Vendors: n/a Products: n/a Problem Types: n/a Description: The armv8_dec_aes_gcm_full() API of Arm AArch64cryptolib before 86065c6 fails to the verify the authentication tag of AES-GCM protected data, leading to a man-in-the-middle attack. This occurs because of an improperly initialized variable. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ARM-software/AArch64cryptolib/security/advisories/GHSA-47c6-7x5x-r74g
CVE ID: CVE-2023-26085 State: PUBLISHED Published: 2023-06-29T00:00:00 Last Updated: 2024-11-27T14:29:59.591Z Vendors: n/a Products: n/a Problem Types: n/a Description: A possible out-of-bounds read and write (due to an improper length check of shared memory) was discovered in Arm NN Android-NN-Driver before 23.02. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://developer.arm.com/Arm%20Security%20Center - https://github.com/ARM-software/android-nn-driver/releases/tag/v23.02
CVE ID: CVE-2023-26088 State: PUBLISHED Published: 2023-03-23T00:00:00.000Z Last Updated: 2025-02-25T15:25:25.164Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Malwarebytes before 4.5.23, a symbolic link may be used delete any arbitrary file on the system by exploiting the local quarantine system. It can also lead to privilege escalation in certain scenarios. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.malwarebytes.com/hc/en-us/articles/14279575968659-Malwarebytes-for-Windows-4-5-23-Release-Notes - https://www.malwarebytes.com/secure/cves/cve-2023-26088
CVE ID: CVE-2023-26089 State: PUBLISHED Published: 2023-05-02T00:00:00.000Z Last Updated: 2025-01-30T16:49:18.907Z Vendors: n/a Products: n/a Problem Types: n/a Description: European Chemicals Agency IUCLID 6.x before 6.27.6 allows authentication bypass because a weak hard-coded secret is used for JWT signing. The affected versions are 5.15.0 through 6.27.5. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://iuclid6.echa.europa.eu - https://iuclid6.echa.europa.eu/download - https://iuclid6.echa.europa.eu/documents/1387205/1809530/note_v6.27.6.pdf/76545a65-e6be-6486-280a-7d7c3d2ad455?t=1677577170669
CVE ID: CVE-2023-26091 State: PUBLISHED Published: 2023-02-26T00:00:00.000Z Last Updated: 2025-03-11T18:19:49.472Z Vendors: n/a Products: n/a Problem Types: n/a Description: The frp_form_answers (aka Forms Export) extension before 3.1.2, and 4.x before 4.0.2, for TYPO3 allows XSS via saved emails. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://typo3.org/help/security-advisories - https://typo3.org/security/advisory/typo3-ext-sa-2023-002
CVE ID: CVE-2023-26092 State: PUBLISHED Published: 2023-02-20T00:00:00.000Z Last Updated: 2025-03-17T18:50:09.864Z Vendors: n/a Products: n/a Problem Types: n/a Description: Liima before 1.17.28 allows server-side template injection. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/liimaorg/liima/blob/master/release-changelog.md - https://github.com/liimaorg/liima/pull/678
CVE ID: CVE-2023-26093 State: PUBLISHED Published: 2023-02-20T00:00:00.000Z Last Updated: 2025-03-17T18:49:01.059Z Vendors: n/a Products: n/a Problem Types: n/a Description: Liima before 1.17.28 allows Hibernate query language (HQL) injection, related to colToSort in the deployment filter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/liimaorg/liima/blob/master/release-changelog.md - https://github.com/liimaorg/liima/pull/663
CVE ID: CVE-2023-26095 State: PUBLISHED Published: 2023-08-28T00:00:00 Last Updated: 2024-10-02T17:36:09.360Z Vendors: n/a Products: n/a Problem Types: n/a Description: ASQ in Stormshield Network Security (SNS) 4.3.15 before 4.3.16 and 4.6.x before 4.6.3 allows a crash when analysing a crafted SIP packet. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://advisories.stormshield.eu/2023-007/
CVE ID: CVE-2023-26097 State: PUBLISHED Published: 2023-04-24T00:00:00.000Z Last Updated: 2025-05-30T16:02:16.433Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AC:L/AV:L/A:H/C:H/I:H/PR:N/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Telindus Apsal 3.14.2022.235 b. Unauthorized actions that could modify the application behaviour may not be blocked. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.telindus.lu/fr/produits/apsal - https://excellium-services.com/cert-xlm-advisory/CVE-2023-26097 - https://cds.thalesgroup.com/en/tcs-cert/CVE-2023-26097
CVE ID: CVE-2023-26098 State: PUBLISHED Published: 2023-04-25T00:00:00.000Z Last Updated: 2025-05-30T16:02:31.482Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AC:L/AV:L/A:H/C:H/I:H/PR:L/S:C/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Open Document feature in Telindus Apsal 3.14.2022.235 b. An attacker may upload a crafted file to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.telindus.lu/fr/produits/apsal - https://excellium-services.com/cert-xlm-advisory/CVE-2023-26098 - https://cds.thalesgroup.com/en/tcs-cert/CVE-2023-26098
CVE ID: CVE-2023-26099 State: PUBLISHED Published: 2023-04-24T00:00:00.000Z Last Updated: 2025-05-30T16:29:46.029Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AC:L/AV:L/A:N/C:L/I:L/PR:L/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Telindus Apsal 3.14.2022.235 b. The consultation permission is insecure. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.telindus.lu/fr/produits/apsal - https://excellium-services.com/cert-xlm-advisory/CVE-2023-26099 - https://cds.thalesgroup.com/en/tcs-cert/CVE-2023-26099
CVE ID: CVE-2023-26100 State: PUBLISHED Published: 2023-04-21T00:00:00.000Z Last Updated: 2025-02-05T20:10:47.013Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Progress Flowmon before 12.2.0, an application endpoint failed to sanitize user-supplied input. A threat actor could leverage a reflected XSS vulnerability to execute arbitrary code within the context of a Flowmon user's web browser. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.flowmon.com/en - https://support.kemptechnologies.com/hc/en-us/articles/12736934205837
CVE ID: CVE-2023-26101 State: PUBLISHED Published: 2023-04-21T00:00:00.000Z Last Updated: 2025-02-05T14:46:11.674Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Progress Flowmon Packet Investigator before 12.1.0, a Flowmon user with access to Flowmon Packet Investigator could leverage a path-traversal vulnerability to retrieve files on the Flowmon appliance's local filesystem. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.flowmon.com/en - https://support.kemptechnologies.com/hc/en-us/articles/12737582619789
CVE ID: CVE-2023-26102 State: PUBLISHED Published: 2023-02-24T05:00:01.144Z Last Updated: 2025-03-11T15:52:25.411Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: n/a Products: rangy Problem Types: CWE-1321 Description: All versions of the package rangy are vulnerable to Prototype Pollution when using the extend() function in file rangy-core.js.The function uses recursive merge which can lead an attacker to modify properties of the Object.prototype Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-JS-RANGY-3175702 - https://github.com/timdown/rangy/issues/478
CVE ID: CVE-2023-26103 State: PUBLISHED Published: 2023-02-25T05:00:01.387Z Last Updated: 2025-03-11T15:31:01.247Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: n/a Products: deno Problem Types: CWE-1333 Description: Versions of the package deno before 1.31.0 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the upgradeWebSocket function, which contains regexes in the form of /s*,s*/, used for splitting the Connection/Upgrade header. A specially crafted Connection/Upgrade header can be used to significantly slow down a web socket server. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://se
web socket server. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-RUST-DENO-3315970 - https://github.com/denoland/deno/blob/2b247be517d789a37e532849e2e40b724af0918f/ext/http/01_http.js%23L395-L409 - https://github.com/denoland/deno/pull/17722 - https://github.com/denoland/deno/commit/cf06a7c7e672880e1b38598fe445e2c50b4a9d06 - https://github.com/denoland/deno/releases/tag/v1.31.0
CVE ID: CVE-2023-26104 State: PUBLISHED Published: 2023-02-25T05:00:02.786Z Last Updated: 2025-03-11T15:29:45.265Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P) Vendors: n/a Products: lite-web-server Problem Types: CWE-400 Description: All versions of the package lite-web-server are vulnerable to Denial of Service (DoS) when an attacker sends an HTTP request and includes control characters that the decodeURI() function is unable to parse. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-JS-LITEWEBSERVER-3153703 - https://github.com/chasyumen/lite-web-server/blob/main/src/WebServer.js%23L2