Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-27285 State: PUBLISHED Published: 2023-06-04T23:52:11.073Z Last Updated: 2025-01-08T19:48:22.455Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: IBM Products: Aspera Connect, Aspera Cargo Problem Types: CWE-119 Description: IBM Aspera Connect 4.2.5 and IBM Aspera Cargo 4.2.5 is vulnerable to a buffer overflow, caused by improper bounds checking. An attacker could overflow a buffer and execute arbitrary code on the system. IBM X-Force ID: 248625. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7001053 - https://exchange.xforce.ibmcloud.com/vulnerabilities/248625
CVE ID: CVE-2023-27286 State: PUBLISHED Published: 2023-03-28T20:07:54.929Z Last Updated: 2025-02-18T19:17:30.211Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: IBM Products: Aspera Problem Types: CWE-119 Description: IBM Aspera Cargo 4.2.5 and IBM Aspera Connect 4.2.5 are vulnerable to a buffer overflow, caused by improper bounds checking. An attacker could overflow a buffer and execute arbitrary code on the system. IBM X-Force ID: 248616. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/248627 - https://www.ibm.com/support/pages/node/6966588
CVE ID: CVE-2023-27290 State: PUBLISHED Published: 2023-03-03T22:36:06.445Z Last Updated: 2025-03-05T16:01:17.049Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: IBM Products: Observability with Instana Problem Types: CWE-306 Description: Docker based datastores for IBM Instana (IBM Observability with Instana 239-0 through 239-2, 241-0 through 241-2, and 243-0) do not currently require authentication. Due to this, an attacker within the network could access the datastores with read/write access. IBM X-Force ID: 248737. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6959969 -
Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6959969 - https://exchange.xforce.ibmcloud.com/vulnerabilities/248737 - http://packetstormsecurity.com/files/171770/IBM-Instana-243-0-Missing-Authentication.html
CVE ID: CVE-2023-27291 State: PUBLISHED Published: 2024-03-03T15:39:55.755Z Last Updated: 2024-09-19T15:09:09.016Z Severity: MEDIUM (CVSS 4.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N) Vendors: IBM Products: Watson CP4D Data Stores Problem Types: CWE-319 Description: IBM Watson CP4D Data Stores 4.6.0, 4.6.1, 4.6.2, and 4.6.3 does not encrypt sensitive or critical information before storage or transmission which could allow an attacker to obtain sensitive information. IBM X-Force ID: 248740. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/6965458 - https://exchange.xforce.ibmcloud.com/vulnerabilities/248740
CVE ID: CVE-2023-27292 State: PUBLISHED Published: 2023-02-28T00:00:00.000Z Last Updated: 2025-03-21T20:10:24.007Z Vendors: n/a Products: OpenCATS Problem Types: Open Redirect Description: An open redirect vulnerability exposes OpenCATS to template injection due to improper validation of user-supplied GET parameters. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.tenable.com/security/research/tra-2023-8
CVE ID: CVE-2023-27293 State: PUBLISHED Published: 2023-02-28T00:00:00.000Z Last Updated: 2025-03-21T20:16:30.644Z Vendors: n/a Products: OpenCATS Problem Types: Improper Neutralization of Input During Web Page Generation (Cross-Site Scripting) Description: Improper neutralization of input during web page generation allows an unauthenticated attacker to submit malicious Javascript as the answer to a questionnaire which would then be executed when an authenticated user reviews the candidate's submission. This could be used to steal other users’ cookies and force users to make actions without their knowledge. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Reference
e actions without their knowledge. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.tenable.com/security/research/tra-2023-8
CVE ID: CVE-2023-27294 State: PUBLISHED Published: 2023-02-28T00:00:00.000Z Last Updated: 2025-03-21T20:18:39.926Z Vendors: n/a Products: OpenCATS Problem Types: Improper Neutralization of Input During Web Page Generation (Cross-Site Scripting) Description: Improper neutralization of input during web page generation allows an authenticated attacker with access to a restricted account to submit malicious Javascript as the description for a calendar event, which would then be executed in other users' browsers if they browse to that event. This could result in stealing session tokens from users with higher permission levels or forcing users to make actions without their knowledge. Additional An
tokens from users with higher permission levels or forcing users to make actions without their knowledge. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.tenable.com/security/research/tra-2023-8
CVE ID: CVE-2023-27295 State: PUBLISHED Published: 2023-02-28T00:00:00.000Z Last Updated: 2025-03-10T14:23:58.905Z Vendors: n/a Products: OpenCATS Problem Types: Cross-Site Request Forgery Description: Cross-site request forgery is facilitated by OpenCATS failure to require CSRF tokens in POST requests. An attacker can exploit this issue by creating a dummy page that executes Javascript in an authenticated user's session when visited. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.tenable.com/security/research/tra-2023-8
CVE ID: CVE-2023-27296 State: PUBLISHED Published: 2023-03-27T14:10:32.785Z Last Updated: 2024-10-23T16:39:30.822Z Vendors: Apache Software Foundation Products: Apache InLong Problem Types: CWE-502 Description: Deserialization of Untrusted Data vulnerability in Apache Software Foundation Apache InLong. It could be triggered by authenticated users of InLong, you could refer to [1] to know more about this vulnerability. This issue affects Apache InLong: from 1.1.0 through 1.5.0. Users are advised to upgrade to Apache InLong's latest version or cherry-pick [2] to solve it. [1] https://programmer.help/blogs/jdbc-deserialization-vulnerability-learning.html https://programmer.help/blogs/jdbc-deser
https://programmer.help/blogs/jdbc-deserialization-vulnerability-learning.html https://programmer.help/blogs/jdbc-deserialization-vulnerability-learning.html [2] https://github.com/apache/inlong/pull/7422 https://github.com/apache/inlong/pull/7422 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/xbvtjw9bwzgbo9fp1by8o3p49nf59xzt
CVE ID: CVE-2023-27298 State: PUBLISHED Published: 2023-05-10T13:17:26.434Z Last Updated: 2025-01-24T17:51:21.078Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: WULT software maintained by Intel(R) Problem Types: escalation of privilege, CWE-427 Description: Uncontrolled search path in the WULT software maintained by Intel(R) before version 1.0.0 (commit id 592300b) may allow an unauthenticated user to potentially enable escalation of privilege via network access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00853.html
CVE ID: CVE-2023-27300 State: PUBLISHED Published: 2024-02-14T13:37:47.252Z Last Updated: 2024-08-08T13:43:16.354Z Severity: LOW (CVSS 3.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) Vendors: n/a Products: Intel(R) Thunderbolt(TM) DCH drivers for Windows Problem Types: information disclosure, CWE-92 Description: Improper buffer restrictions in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an authenticated user to potentially enable information disclosure via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00851.html
CVE ID: CVE-2023-27301 State: PUBLISHED Published: 2024-02-14T13:37:46.150Z Last Updated: 2024-08-16T19:47:07.286Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: n/a Products: Intel(R) Thunderbolt(TM) DCH drivers for Windows Problem Types: escalation of privilege, CWE-284 Description: Improper access control in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00851.html
CVE ID: CVE-2023-27303 State: PUBLISHED Published: 2024-02-14T13:37:48.307Z Last Updated: 2024-08-14T19:14:22.968Z Severity: LOW (CVSS 3.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) Vendors: n/a Products: Intel(R) Thunderbolt(TM) DCH drivers for Windows Problem Types: information disclosure, CWE-284 Description: Improper access control in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an authenticated user to potentially enable information disclosure via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00851.html
CVE ID: CVE-2023-27304 State: PUBLISHED Published: 2023-05-23T00:00:00 Last Updated: 2025-01-17T18:02:06.527Z Vendors: Cybozu, Inc. Products: Cybozu Garoon Problem Types: Improper authorization Description: Operation restriction bypass vulnerability in Message and Bulletin of Cybozu Garoon 4.6.0 to 5.9.2 allows a remote authenticated attacker to alter the data of Message and/or Bulletin. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cs.cybozu.co.jp/2023/007698.html - https://jvn.jp/en/jp/JVN41694426/
CVE ID: CVE-2023-27305 State: PUBLISHED Published: 2023-11-14T19:04:21.686Z Last Updated: 2024-08-02T12:09:43.445Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) Arc(TM) Control software Problem Types: escalation of privilege, CWE-276 Description: Incorrect default permissions in some Intel(R) Arc(TM) Control software before version 1.73.5335.2 may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01020.html
CVE ID: CVE-2023-27306 State: PUBLISHED Published: 2023-11-14T19:04:56.952Z Last Updated: 2024-08-02T12:09:42.482Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H) Vendors: n/a Products: Intel(R) Optane(TM) SSD products Problem Types: denial of service, CWE-665 Description: Improper Initialization in firmware for some Intel(R) Optane(TM) SSD products may allow an authenticated user to potentially enable denial of service via local access. Additional Analyst Notes: - CVE Program Container: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00758.html
CVE ID: CVE-2023-27307 State: PUBLISHED Published: 2024-02-14T13:37:46.706Z Last Updated: 2024-08-15T19:13:43.243Z Severity: LOW (CVSS 3.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) Vendors: n/a Products: Intel(R) Thunderbolt(TM) DCH drivers for Windows Problem Types: information disclosure, CWE-92 Description: Improper buffer restrictions in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an authenticated user to potentially enable information disclosure via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00851.html
CVE ID: CVE-2023-27308 State: PUBLISHED Published: 2024-02-14T13:37:45.069Z Last Updated: 2024-08-14T17:47:12.084Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:L) Vendors: n/a Products: Intel(R) Thunderbolt(TM) DCH drivers for Windows Problem Types: escalation of privilege, CWE-92 Description: Improper buffer restrictions in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow a privileged user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00851.html
CVE ID: CVE-2023-27309 State: PUBLISHED Published: 2023-03-14T09:31:57.134Z Last Updated: 2025-02-27T15:00:08.924Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C) Vendors: Siemens Products: RUGGEDCOM CROSSBOW Problem Types: CWE-862 Description: A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.2). The client query handler of the affected application fails to check for proper permissions for specific write queries. This could allow an authenticated remote attacker to perform unauthorized actions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/p
yst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-260625.pdf
CVE ID: CVE-2023-27310 State: PUBLISHED Published: 2023-03-14T09:31:58.178Z Last Updated: 2025-02-27T19:01:06.092Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: RUGGEDCOM CROSSBOW Problem Types: CWE-862 Description: A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.2). The client query handler of the affected application fails to check for proper permissions when assigning groups to user accounts. This could allow an authenticated remote attacker to assign administrative groups to otherwise non-privileged user accounts. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Ref
otherwise non-privileged user accounts. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-260625.pdf
CVE ID: CVE-2023-27311 State: PUBLISHED Published: 2023-05-26T00:00:00 Last Updated: 2025-01-15T16:04:10.822Z Vendors: n/a Products: Information Disclosure Vulnerability in NetApp BlueXP Connector Problem Types: Information Disclosure Description: NetApp Blue XP Connector versions prior to 3.9.25 expose information via a directory listing. A new Connector architecture resolves this issue - obtaining the fix requires redeploying a fresh Connector. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.netapp.com/advisory/ntap-20230525-0001/
CVE ID: CVE-2023-27312 State: PUBLISHED Published: 2023-10-12T18:19:16.530Z Last Updated: 2024-09-17T18:11:37.472Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: NetApp Products: SnapCenter Plugin for VMware vSphere Problem Types: CWE-250 Description: SnapCenter Plugin for VMware vSphere versions 4.6 prior to 4.9 are susceptible to a vulnerability which may allow authenticated unprivileged users to modify email and snapshot name settings within the VMware vSphere user interface. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.netapp.com/advisory/ntap-20230713-0001/
CVE ID: CVE-2023-27313 State: PUBLISHED Published: 2023-10-12T18:22:28.435Z Last Updated: 2024-09-17T17:26:14.223Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H) Vendors: NetApp Products: SnapCenter Problem Types: CWE-250 Description: SnapCenter versions 3.x and 4.x prior to 4.9 are susceptible to a vulnerability which may allow an authenticated unprivileged user to gain access as an admin user. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.netapp.com/advisory/ntap-20230713-0002/
CVE ID: CVE-2023-27314 State: PUBLISHED Published: 2023-10-12T18:26:47.593Z Last Updated: 2024-09-18T15:02:57.897Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: NetApp Products: ONTAP 9 Problem Types: CWE-400 Description: ONTAP 9 versions prior to 9.8P19, 9.9.1P16, 9.10.1P12, 9.11.1P8, 9.12.1P2 and 9.13.1 are susceptible to a vulnerability which could allow a remote unauthenticated attacker to cause a crash of the HTTP service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.netapp.com/advisory/ntap-20231009-0001/
CVE ID: CVE-2023-27315 State: PUBLISHED Published: 2023-10-12T13:56:38.513Z Last Updated: 2024-09-18T16:33:01.296Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: NetApp Products: SnapGathers Problem Types: CWE-256 Description: SnapGathers versions prior to 4.9 are susceptible to a vulnerability which could allow a local authenticated attacker to discover plaintext domain user credentials Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.netapp.com/advisory/ntap-20231009-0002/
CVE ID: CVE-2023-27316 State: PUBLISHED Published: 2023-10-12T21:04:47.473Z Last Updated: 2025-02-13T16:45:21.492Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: NetApp Products: SnapCenter Problem Types: CWE-269 Description: SnapCenter versions 4.8 through 4.9 are susceptible to a vulnerability which may allow an authenticated SnapCenter Server user to become an admin user on a remote system where a SnapCenter plug-in has been installed. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.netapp.com/advisory/NTAP-20231012-0001/ - https://security.netapp.com/advisory/ntap-20231012-0001/
CVE ID: CVE-2023-27317 State: PUBLISHED Published: 2023-12-15T22:59:11.093Z Last Updated: 2025-05-07T20:42:38.376Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: NetApp Products: ONTAP 9 Problem Types: CWE-200 Description: ONTAP 9 versions 9.12.1P8, 9.13.1P4, and 9.13.1P5 are susceptible to a vulnerability which will cause all SAS-attached FIPS 140-2 drives to become unlocked after a system reboot or power cycle or a single SAS-attached FIPS 140-2 drive to become unlocked after reinsertion. This could lead to disclosure of sensitive information to an attacker with physical access to the unlocked drives. Additional Analyst Notes: - CVE Program Container: - C
ation to an attacker with physical access to the unlocked drives. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.netapp.com/advisory/NTAP-20231215-0001/
CVE ID: CVE-2023-27318 State: PUBLISHED Published: 2024-02-05T20:35:27.521Z Last Updated: 2024-08-02T12:09:42.409Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: NetApp Products: StorageGRID (formerly StorageGRID Webscale) Problem Types: CWE-248 Description: StorageGRID (formerly StorageGRID Webscale) versions 11.6.0 through 11.6.0.13 are susceptible to a Denial of Service (DoS) vulnerability. A successful exploit could lead to a crash of the Local Distribution Router (LDR) service. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://security.netapp.com/advisory/NTAP-20240202-0012/
CVE ID: CVE-2023-27319 State: PUBLISHED Published: 2023-12-21T21:15:51.018Z Last Updated: 2024-08-02T12:09:43.564Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: NetApp Products: ONTAP Mediator Problem Types: CWE-209 Description: ONTAP Mediator versions prior to 1.7 are susceptible to a vulnerability that can allow an unauthenticated attacker to enumerate URLs via REST API. Additional Analyst Notes: - CVE Program Container: References: - https://security.netapp.com/advisory/ntap-20231221-0011/
CVE ID: CVE-2023-27320 State: PUBLISHED Published: 2023-02-28T00:00:00.000Z Last Updated: 2025-03-21T20:49:54.702Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sudo before 1.9.13p2 has a double free in the per-command chroot feature. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.openwall.com/lists/oss-security/2023/02/28/1 - https://www.sudo.ws/releases/stable/#1.9.13p2 - http://www.openwall.com/lists/oss-security/2023/03/01/8 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FPLXMRAMXC3BYL4DNKVTK3V6JDMUXZ7B/ - https://lists.fedoraproject.org/archives/list/package-announce%4
project.org/message/FPLXMRAMXC3BYL4DNKVTK3V6JDMUXZ7B/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X6VW24YGXJYI4NZ5HZPQCF4MCE7766AU/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/332KN4QI6QXB7NI7SWSJ2EQJKWIILFN6/ - https://security.netapp.com/advisory/ntap-20230413-0009/ - https://security.gentoo.org/glsa/202309-12
CVE ID: CVE-2023-27321 State: PUBLISHED Published: 2024-05-07T22:55:01.898Z Last Updated: 2024-08-02T12:09:43.438Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: OPC Foundation Products: UA .NET Standard Problem Types: CWE-400 Description: OPC Foundation UA .NET Standard ConditionRefresh Resource Exhaustion Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of OPC Foundation UA .NET Standard. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of OPC UA ConditionRefresh requests. By sending a large number of request
. The specific flaw exists within the handling of OPC UA ConditionRefresh requests. By sending a large number of requests, an attacker can consume all available resources on the server. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-20505. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-23-548/ - https://files.opcfoundation.org/SecurityBulletins/OPC%20Foundation%20Security%20Bulletin%20CVE-2023-27321.pdf
CVE ID: CVE-2023-27322 State: PUBLISHED Published: 2024-05-03T01:55:48.211Z Last Updated: 2024-08-02T12:09:42.400Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Parallels Products: Desktop Problem Types: CWE-665 Description: Parallels Desktop Service Improper Initialization Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop. An attacker must first obtain the ability to execute low-privileged code on the target host system in order to exploit this vulnerability. The specific flaw exists within the Parallels Service. The issue results from the lack of proper
it this vulnerability. The specific flaw exists within the Parallels Service. The issue results from the lack of proper initialization of environment variables. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of root. Was ZDI-CAN-17751. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-23-216/ - https://kb.parallels.com/125013