Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ty command, the goroutine will be stuck waiting to send without a receiver, resulting in a memory leak. Kubernetes and crictl can both be configured to use containerd's CRI implementation and the stream server is used for handling container IO. This bug has been fixed in containerd 1.6.12 and 1.5.16. Users should update to these versions to resolve the issue. Users unable to upgrade should ensure that only trusted images and commands are used and that only trusted users have permissions to execute commands in running containers. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/containerd/containerd/security/advisories/GHSA-2qjp-425j
iner: - CISA ADP Vulnrichment: References: - https://github.com/containerd/containerd/security/advisories/GHSA-2qjp-425j-52j9 - https://github.com/containerd/containerd/commit/a05d175400b1145e5e6a735a6710579d181e7fb0 - https://security.gentoo.org/glsa/202401-31
CVE ID: CVE-2022-23472 State: PUBLISHED Published: 2022-12-06T17:18:59.217Z Last Updated: 2025-04-23T16:32:14.640Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: ArjunSharda Products: Passeo Problem Types: CWE-338 Description: Passeo is an open source python password generator. Versions prior to 1.0.5 rely on the python `random` library for random value selection. The python `random` library warns that it should not be used for security purposes due to its reliance on a non-cryptographically secure random number generator. As a result a motivated attacker may be able to guess generated passwords. This issue has been addressed in version 1.0.5. Users are adv
tivated attacker may be able to guess generated passwords. This issue has been addressed in version 1.0.5. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ArjunSharda/Passeo/security/advisories/GHSA-mhhf-vgwh-fw9h - https://github.com/ArjunSharda/Passeo/commit/8caa798b6bc4647dca59b2376204b6dc6176361a - https://peps.python.org/pep-0506/
CVE ID: CVE-2022-23473 State: PUBLISHED Published: 2022-12-13T06:46:17.479Z Last Updated: 2025-04-23T16:28:41.005Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Enalean Products: tuleap Problem Types: CWE-863 Description: Tuleap is an Open Source Suite to improve management of software developments and collaboration. In versions prior to 14.2.99.148, Authorizations are not properly verified when accessing MediaWiki standalone resources. Users with read only permissions for pages are able to also edit them. This only affects the MediaWiki standalone plugin. This issue is patched in versions Tuleap Community Edition 14.2.99.148, Tuleap Enterprise Edition 14.
standalone plugin. This issue is patched in versions Tuleap Community Edition 14.2.99.148, Tuleap Enterprise Edition 14.2-5, and Tuleap Enterprise Edition 14.1-6. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Enalean/tuleap/security/advisories/GHSA-c7rr-5vmc-rgcw - https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=97cac78302170a883c1d60c9fa6dfd0d95854cb9 - https://tuleap.net/plugins/tracker/?aid=29645
CVE ID: CVE-2022-23474 State: PUBLISHED Published: 2022-12-15T02:08:07.054Z Last Updated: 2025-04-17T18:14:12.107Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: codex-team Products: editor.js Problem Types: CWE-94 Description: Editor.js is a block-style editor with clean JSON output. Versions prior to 2.26.0 are vulnerable to Code Injection via pasted input. The processHTML method passes pasted input into wrapper’s innerHTML. This issue is patched in version 2.26.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://securitylab.github.com/advisories/GHSL-2022-028_codex-team_editor_js/ - https://github.com/code
t: References: - https://securitylab.github.com/advisories/GHSL-2022-028_codex-team_editor_js/ - https://github.com/codex-team/editor.js/pull/2100
CVE ID: CVE-2022-23475 State: PUBLISHED Published: 2022-12-06T19:13:36.217Z Last Updated: 2025-04-22T15:58:29.584Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: lirantal Products: daloradius Problem Types: CWE-79, CWE-352 Description: daloRADIUS is an open source RADIUS web management application. daloRadius 1.3 and prior are vulnerable to a combination cross site scripting (XSS) and cross site request forgery (CSRF) vulnerability which leads to account takeover in the mng-del.php file because of an unescaped variable reflected in the DOM on line 116. This issue has been addressed in commit `ec3b4a419e`. Users are advised to manually apply the commit in orde
n line 116. This issue has been addressed in commit `ec3b4a419e`. Users are advised to manually apply the commit in order to mitigate this issue. Users may also mitigate this issue with in two parts 1) The CSRF vulnerability can be mitigated by making the daloRadius session cookie to samesite=Lax or by the implimentation of a CSRF token in all forms. 2) The XSS vulnerability may be mitigated by escaping it or by introducing a Content-Security policy. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/lirantal/daloradius/security/advisories/GHSA-c9xx-6mvw-9v84 - https://github.com/lirantal/daloradius/commit/ec3b4a419e20540cf28ce60e4899
ius/security/advisories/GHSA-c9xx-6mvw-9v84 - https://github.com/lirantal/daloradius/commit/ec3b4a419e20540cf28ce60e48998b893e3f1dea
CVE ID: CVE-2022-23476 State: PUBLISHED Published: 2022-12-08T03:03:24.572Z Last Updated: 2025-04-23T16:31:18.189Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: sparklemotion Products: nokogiri Problem Types: CWE-252, CWE-476 Description: Nokogiri is an open source XML and HTML library for the Ruby programming language. Nokogiri `1.13.8` and `1.13.9` fail to check the return value from `xmlTextReaderExpand` in the method `Nokogiri::XML::Reader#attribute_hash`. This can lead to a null pointer exception when invalid markup is being parsed. For applications using `XML::Reader` to parse untrusted inputs, this may potentially be a vector for a denial of service a
r applications using `XML::Reader` to parse untrusted inputs, this may potentially be a vector for a denial of service attack. Users are advised to upgrade to Nokogiri `>= 1.13.10`. Users may be able to search their code for calls to either `XML::Reader#attributes` or `XML::Reader#attribute_hash` to determine if they are affected. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-qv4q-mr5r-qprj - https://github.com/sparklemotion/nokogiri/commit/85410e38410f670cbbc8c5b00d07b843caee88ce - https://github.com/sparklemotion/nokogiri/commit/9fe0761c47c0d4270d1a5220cfd25de080350d50
CVE ID: CVE-2022-23477 State: PUBLISHED Published: 2022-12-09T17:51:32.781Z Last Updated: 2025-04-23T16:29:24.690Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) Vendors: neutrinolabs Products: xrdp Problem Types: CWE-120 Description: xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP). xrdp < v0.9.21 contain a buffer over flow in audin_send_open() function. There are no known workarounds for this issue. Users are advised to upgrade. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-hqw2-
am Container: - CISA ADP Vulnrichment: References: - https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-hqw2-jx2c-wrr2 - https://www.debian.org/security/2023/dsa-5502
CVE ID: CVE-2022-23478 State: PUBLISHED Published: 2022-12-09T17:49:42.594Z Last Updated: 2025-04-23T16:30:09.020Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) Vendors: neutrinolabs Products: xrdp Problem Types: CWE-787 Description: xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP). xrdp < v0.9.21 contain a Out of Bound Write in xrdp_mm_trans_process_drdynvc_channel_open() function. There are no known workarounds for this issue. Users are advised to upgrade. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/neutrinolabs/xrdp/s
al Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-2f49-wwpm-78pj - https://www.debian.org/security/2023/dsa-5502
CVE ID: CVE-2022-23479 State: PUBLISHED Published: 2022-12-09T17:49:56.260Z Last Updated: 2025-04-23T16:30:02.763Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) Vendors: neutrinolabs Products: xrdp Problem Types: CWE-120 Description: xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP). xrdp < v0.9.21 contain a buffer over flow in xrdp_mm_chan_data_in() function. There are no known workarounds for this issue. Users are advised to upgrade. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-
Program Container: - CISA ADP Vulnrichment: References: - https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-pgx2-3fjj-fqqh - https://www.debian.org/security/2023/dsa-5502
CVE ID: CVE-2022-23480 State: PUBLISHED Published: 2022-12-09T17:50:08.748Z Last Updated: 2025-04-23T16:29:56.341Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) Vendors: neutrinolabs Products: xrdp Problem Types: CWE-120 Description: xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP). xrdp < v0.9.21 contain a buffer over flow in devredir_proc_client_devlist_announce_req() function. There are no known workarounds for this issue. Users are advised to upgrade. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/neutrinolabs/xrdp/secu
Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-3jmx-f6hv-95wg - https://www.debian.org/security/2023/dsa-5502
CVE ID: CVE-2022-23481 State: PUBLISHED Published: 2022-12-09T17:50:24.280Z Last Updated: 2025-04-23T16:29:49.845Z Severity: NONE (CVSS N/A CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N) Vendors: neutrinolabs Products: xrdp Problem Types: CWE-125 Description: xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP). xrdp < v0.9.21 contain a Out of Bound Read in xrdp_caps_process_confirm_active() function. There are no known workarounds for this issue. Users are advised to upgrade. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/neutrinolabs/xrdp/security/advisor
s: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-hm75-9jcg-p7hq - https://www.debian.org/security/2023/dsa-5502
CVE ID: CVE-2022-23482 State: PUBLISHED Published: 2022-12-09T17:50:39.075Z Last Updated: 2025-04-23T16:29:43.350Z Severity: NONE (CVSS N/A CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N) Vendors: neutrinolabs Products: xrdp Problem Types: CWE-125 Description: xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP). xrdp < v0.9.21 contain a Out of Bound Read in xrdp_sec_process_mcs_data_CS_CORE() function. There are no known workarounds for this issue. Users are advised to upgrade. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/neutrinolabs/xrdp/security/adviso
es: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-56pq-2pm9-7fhm - https://www.debian.org/security/2023/dsa-5502
CVE ID: CVE-2022-23483 State: PUBLISHED Published: 2022-12-09T17:50:52.518Z Last Updated: 2025-04-23T16:29:36.558Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: neutrinolabs Products: xrdp Problem Types: CWE-125 Description: xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP). xrdp < v0.9.21 contain a Out of Bound Read in libxrdp_send_to_channel() function. There are no known workarounds for this issue. Users are advised to upgrade. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-
Program Container: - CISA ADP Vulnrichment: References: - https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-38rw-9ch2-fcxq - https://www.debian.org/security/2023/dsa-5502
CVE ID: CVE-2022-23484 State: PUBLISHED Published: 2022-12-09T17:51:15.376Z Last Updated: 2025-04-23T16:29:30.774Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H) Vendors: neutrinolabs Products: xrdp Problem Types: CWE-190 Description: xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP). xrdp < v0.9.21 contain a Integer Overflow in xrdp_mm_process_rail_update_window_text() function. There are no known workarounds for this issue. Users are advised to upgrade. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/neutrinolabs/xrdp/security/a
t Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-rqfx-5fv8-q9c6 - https://www.debian.org/security/2023/dsa-5502
CVE ID: CVE-2022-23485 State: PUBLISHED Published: 2022-12-10T00:40:46.301Z Last Updated: 2025-04-23T16:29:00.368Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:L) Vendors: getsentry Products: sentry Problem Types: CWE-269, CWE-284 Description: Sentry is an error tracking and performance monitoring platform. In versions of the sentry python library prior to 22.11.0 an attacker with a known valid invite link could manipulate a cookie to allow the same invite link to be reused on multiple accounts when joining an organization. As a result an attacker with a valid invite link can create multiple users and join an organization they may not have been originally invited to.
ith a valid invite link can create multiple users and join an organization they may not have been originally invited to. This issue was patched in version 22.11.0. Sentry SaaS customers do not need to take action. Self-hosted Sentry installs on systems which can not upgrade can disable the invite functionality until they are ready to deploy the patched version by editing their `sentry.conf.py` file (usually located at `~/.sentry/`). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/getsentry/sentry/security/advisories/GHSA-jv85-mqxj-3f9j
CVE ID: CVE-2022-23486 State: PUBLISHED Published: 2022-12-07T20:03:35.212Z Last Updated: 2025-04-23T16:31:48.560Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: libp2p Products: rust-libp2p Problem Types: CWE-400 Description: libp2p-rust is the official rust language Implementation of the libp2p networking stack. In versions prior to 0.45.1 an attacker node can cause a victim node to allocate a large number of small memory chunks, which can ultimately lead to the victim’s process running out of memory and thus getting killed by its operating system. When executed continuously, this can lead to a denial of service attack, especially relevant on a larger scale
g system. When executed continuously, this can lead to a denial of service attack, especially relevant on a larger scale when run against more than one node of a libp2p based network. Users are advised to upgrade to `libp2p` `v0.45.1` or above. Users unable to upgrade should reference the DoS Mitigation page for more information on how to incorporate mitigation strategies, monitor their application, and respond to attacks: https://docs.libp2p.io/reference/dos-mitigation/. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/libp2p/rust-libp2p/security/advisories/GHSA-jvgw-gccv-q5p8
CVE ID: CVE-2022-23487 State: PUBLISHED Published: 2022-12-07T20:05:35.319Z Last Updated: 2025-04-23T16:31:42.214Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: libp2p Products: js-libp2p Problem Types: CWE-400 Description: js-libp2p is the official javascript Implementation of libp2p networking stack. Versions older than `v0.38.0` of js-libp2p are vulnerable to targeted resource exhaustion attacks. These attacks target libp2p’s connection, stream, peer, and memory management. An attacker can cause the allocation of large amounts of memory, ultimately leading to the process getting killed by the host’s operating system. While a connection manager tasked with
ultimately leading to the process getting killed by the host’s operating system. While a connection manager tasked with keeping the number of connections within manageable limits has been part of js-libp2p, this component was designed to handle the regular churn of peers, not a targeted resource exhaustion attack. Users are advised to update their js-libp2p dependency to `v0.38.0` or greater. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/libp2p/js-libp2p/security/advisories/GHSA-f44q-634c-jvwv
CVE ID: CVE-2022-23488 State: PUBLISHED Published: 2022-12-17T00:28:46.567Z Last Updated: 2025-04-17T14:33:18.205Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: bigbluebutton Products: bigbluebutton Problem Types: CWE-201, CWE-200 Description: BigBlueButton is an open source web conferencing system. Versions prior to 2.4-rc-6 are vulnerable to Insertion of Sensitive Information Into Sent Data. The moderators-only webcams lock setting is not enforced on the backend, which allows an attacker to subscribe to viewers' webcams, even when the lock setting is applied. (The required streamId was being sent to all users even with lock setting applied). This issue i
ock setting is applied. (The required streamId was being sent to all users even with lock setting applied). This issue is fixed in version 2.4-rc-6. There are no workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-j5g3-f74q-rvfq - https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.4-rc-6
CVE ID: CVE-2022-23490 State: PUBLISHED Published: 2022-12-16T21:02:30.109Z Last Updated: 2025-04-17T14:34:58.102Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: bigbluebutton Products: bigbluebutton Problem Types: CWE-200, CWE-863 Description: BigBlueButton is an open source web conferencing system. Versions prior to 2.4.0 expose sensitive information to Unauthorized Actors. This issue affects meetings with polls, where the attacker is a meeting participant. Subscribing to the current-poll collection does not update the client UI, but does give the attacker access to the contents of the collection, which include the individual poll responses. This issue is
s give the attacker access to the contents of the collection, which include the individual poll responses. This issue is patched in version 2.4.0. There are no workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-4qgc-xhw5-6qfg - https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.4.0
CVE ID: CVE-2022-23491 State: PUBLISHED Published: 2022-12-07T21:15:53.804Z Last Updated: 2025-04-23T16:31:36.080Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N) Vendors: certifi Products: python-certifi Problem Types: CWE-345 Description: Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi 2022.12.07 removes root certificates from "TrustCor" from the root store. These are in the process of being removed from Mozilla's trust store. TrustCor's root certificates are being removed pursuant to an investigation prompted by media reporting that TrustCor's ownership a
root certificates are being removed pursuant to an investigation prompted by media reporting that TrustCor's ownership also operated a business that produced spyware. Conclusions of Mozilla's investigation can be found in the linked google group discussion. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/certifi/python-certifi/security/advisories/GHSA-43fp-rhv2-5gv8 - https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/oxX69KFvsm4/m/yLohoVqtCgAJ
CVE ID: CVE-2022-23492 State: PUBLISHED Published: 2022-12-08T00:08:11.210Z Last Updated: 2025-04-23T16:31:24.219Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: libp2p Products: go-libp2p Problem Types: CWE-400 Description: go-libp2p is the offical libp2p implementation in the Go programming language. Version `0.18.0` and older of go-libp2p are vulnerable to targeted resource exhaustion attacks. These attacks target libp2p’s connection, stream, peer, and memory management. An attacker can cause the allocation of large amounts of memory, ultimately leading to the process getting killed by the host’s operating system. While a connection manager tasked with kee
imately leading to the process getting killed by the host’s operating system. While a connection manager tasked with keeping the number of connections within manageable limits has been part of go-libp2p, this component was designed to handle the regular churn of peers, not a targeted resource exhaustion attack. Users are advised to upgrade their version of go-libp2p to version `0.18.1` or newer. Users unable to upgrade may consult the denial of service (dos) mitigation page for more information on how to incorporate mitigation strategies, monitor your application, and respond to attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.
nd to attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/libp2p/go-libp2p/security/advisories/GHSA-j7qp-mfxf-8xjw - https://github.com/libp2p/go-libp2p/commit/15d7dfbf54264ead8e6f49ca658d79c90635e2de - https://docs.libp2p.io/reference/dos-mitigation/
CVE ID: CVE-2022-23493 State: PUBLISHED Published: 2022-12-09T17:48:49.800Z Last Updated: 2025-04-23T16:30:21.084Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H) Vendors: neutrinolabs Products: xrdp Problem Types: CWE-125 Description: xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP). xrdp < v0.9.21 contain a Out of Bound Read in xrdp_mm_trans_process_drdynvc_channel_close() function. There are no known workarounds for this issue. Users are advised to upgrade. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/neutrinolabs/xrdp/s
al Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-59wp-3wq6-jh5v - https://www.debian.org/security/2023/dsa-5502