Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-4774 State: PUBLISHED Published: 2023-09-22T05:31:26.949Z Last Updated: 2025-02-05T19:26:55.810Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: braekling Products: Connect Matomo (WP-Matomo, WP-Piwik) Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The WP-Matomo Integration (WP-Piwik) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wp-piwik' shortcode in versions up to, and including, 1.0.28 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributo
tion and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/faa4f041-4740-4ebb-afb3-10019ce571be?source=cve - https://plugins.trac.wordpress.org/browser/wp-piwik/tags/1.0.28/classes/WP_Piwik/Widget/OptOut.php#L28 - https://plugins.trac.wordpress.org/changeset/2969705/wp-piwik#file164
CVE ID: CVE-2023-4775 State: PUBLISHED Published: 2023-11-13T07:31:16.722Z Last Updated: 2025-01-08T21:31:09.315Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: mdempfle Products: Advanced iFrame Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Advanced iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'advanced_iframe' shortcode in versions up to, and including, 2023.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to
supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e9944443-2e71-45c4-8a19-d76863cf66df?source=cve - https://plugins.trac.wordpress.org/browser/advanced-iframe/trunk/includes/advanced-iframe-main-iframe.php?rev=2961394#L552 - https://plugins.trac.wordpress.org/browser/advanced-iframe/trunk/includes/advanced-iframe-main-iframe.php?rev=2961394#L419 - https://plugins.trac.wordpress.o
owser/advanced-iframe/trunk/includes/advanced-iframe-main-iframe.php?rev=2961394#L419 - https://plugins.trac.wordpress.org/changeset/2993602/advanced-iframe
CVE ID: CVE-2023-4776 State: PUBLISHED Published: 2023-10-16T19:38:59.813Z Last Updated: 2025-04-23T16:13:48.916Z Vendors: Unknown Products: School Management System Problem Types: CWE-89 SQL Injection Description: The School Management System WordPress plugin before 2.2.5 uses the WordPress esc_sql() function on a field not delimited by quotes and did not first prepare the query, leading to a SQL injection exploitable by relatively low-privilege users like Teachers. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/59dd3917-01cb-479f-a557-021b2a5147df
CVE ID: CVE-2023-4777 State: PUBLISHED Published: 2023-09-08T08:42:35.645Z Last Updated: 2024-09-25T20:07:05.784Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Qualys,Inc. Products: Container Scanning Connector Jenkins Plugin Problem Types: CWE-732 Description: An incorrect permission check in Qualys Container Scanning Connector Plugin 1.6.2.6 and earlier allows attackers with global Item/Configure permission (while lacking Item/Configure permission on any particular job) to enumerate credentials IDs of credentials stored in Jenkins and to connect to an attacker-specified URL using attacker-specified credentials IDs, capturing credentials stored in Jenkins. A
onnect to an attacker-specified URL using attacker-specified credentials IDs, capturing credentials stored in Jenkins. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.qualys.com/security-advisories/
CVE ID: CVE-2023-4778 State: PUBLISHED Published: 2023-09-05T15:43:08.880Z Last Updated: 2024-09-27T13:31:58.844Z Severity: MEDIUM (CVSS 5.9 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: gpac Products: gpac/gpac Problem Types: CWE-125 Description: Out-of-bounds Read in GitHub repository gpac/gpac prior to 2.3-DEV. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/abb450fb-4ab2-49b0-90da-3d878eea5397 - https://github.com/gpac/gpac/commit/d553698050af478049e1a09e44a15ac884f223ed
CVE ID: CVE-2023-4779 State: PUBLISHED Published: 2023-09-06T06:41:21.692Z Last Updated: 2025-02-05T19:31:04.106Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: specialk Products: User Submitted Posts – Enable Users to Submit Posts from the Front End Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The User Submitted Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's [usp_gallery] shortcode in versions up to, and including, 20230811 due to insufficient input sanitization and output escaping on user supplied attributes like 'before'. This makes it pos
due to insufficient input sanitization and output escaping on user supplied attributes like 'before'. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d21ca709-183f-4dd1-849c-f1b2a4f7ec43?source=cve - https://plugins.trac.wordpress.org/changeset/2961841
CVE ID: CVE-2023-4780 State: REJECTED Published: N/A Last Updated: 2024-03-12T14:29:08.238Z Description: No description available.
CVE ID: CVE-2023-4781 State: PUBLISHED Published: 2023-09-05T18:32:30.859Z Last Updated: 2025-11-03T20:36:09.591Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: vim Products: vim/vim Problem Types: CWE-122 Description: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1873. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/c867eb0a-aa8b-4946-a621-510350673883 - https://github.com/vim/vim/commit/f6d28fe2c95c678cc3202cc5dc825a3fcc709e93 - https://lists.debian.org/debian-lts-announce/2023/09/msg00035.html - https://support.apple.com/kb/HT213984 - http://seclists.org/fulldisclosure/2023/Oct/24
CVE ID: CVE-2023-4782 State: PUBLISHED Published: 2023-09-08T17:04:33.242Z Last Updated: 2024-09-26T14:05:36.006Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:H/A:N) Vendors: HashiCorp Products: Terraform Problem Types: CWE-22 Description: Terraform version 1.0.8 through 1.5.6 allows arbitrary file write during the `init` operation if run on maliciously crafted Terraform configuration. This vulnerability is fixed in Terraform 1.5.7. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://discuss.hashicorp.com/t/hcsec-2023-27-terraform-allows-arbitrary-file-write-during-init-operation/58082
CVE ID: CVE-2023-4783 State: PUBLISHED Published: 2023-10-16T19:39:04.294Z Last Updated: 2025-04-23T16:13:04.389Z Vendors: Unknown Products: Magee Shortcodes Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Magee Shortcodes WordPress plugin through 2.1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/02928db8-ceb3-471a-b626-ca661d073e4f
CVE ID: CVE-2023-4784 State: REJECTED Published: N/A Last Updated: 2025-02-11T01:05:39.826Z Description: No description available.
CVE ID: CVE-2023-4785 State: PUBLISHED Published: 2023-09-13T16:31:55.664Z Last Updated: 2024-09-25T18:05:52.337Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Google Products: gRPC Problem Types: CWE-248 Description: Lack of error handling in the TCP server in Google's gRPC starting version 1.23 on posix-compatible platforms (ex. Linux) allows an attacker to cause a denial of service by initiating a significant number of connections with the server. Note that gRPC C++ Python, and Ruby are affected, but gRPC Java, and Go are NOT affected. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/grpc/grpc/pu
dditional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/grpc/grpc/pull/33656 - https://github.com/grpc/grpc/pull/33667 - https://github.com/grpc/grpc/pull/33669 - https://github.com/grpc/grpc/pull/33670 - https://github.com/grpc/grpc/pull/33672
CVE ID: CVE-2023-4792 State: PUBLISHED Published: 2023-09-07T01:52:17.103Z Last Updated: 2025-02-05T19:30:27.167Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: inqsys Products: Duplicate Post Page Menu & Custom Post Type Problem Types: CWE-862 Missing Authorization Description: The Duplicate Post Page Menu & Custom Post Type plugin for WordPress is vulnerable to unauthorized page and post duplication due to a missing capability check on the duplicate_ppmc_post_as_draft function in versions up to, and including, 2.3.1. This makes it possible for authenticated attackers with subscriber access or higher to duplicate posts and pages. Additional Analyst Notes:
le for authenticated attackers with subscriber access or higher to duplicate posts and pages. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d6bb08e8-9ef5-41db-a111-c377a5dfae77?source=cve - https://plugins.trac.wordpress.org/browser/duplicate-post-page-menu-custom-post-type/trunk/duplicate-post-page-menu-cpt.php?rev=2871256#L383 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2963515%40duplicate-post-page-menu-custom-post-type&new=2963515%40duplicate-post-page-menu-custom-post-type&sfp_email=&sfph_mail=
CVE ID: CVE-2023-4795 State: PUBLISHED Published: 2023-10-16T19:39:03.448Z Last Updated: 2025-04-23T16:13:10.988Z Vendors: Unknown Products: Testimonial Slider Shortcode Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Testimonial Slider Shortcode WordPress plugin before 1.1.9 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/b8390b4a-b4
lyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/b8390b4a-b43f-4bf6-a61b-dfcbc7b2e7a0
CVE ID: CVE-2023-4796 State: PUBLISHED Published: 2023-10-20T07:29:25.653Z Last Updated: 2025-02-05T19:05:40.588Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: pluggabl Products: Booster for WooCommerce Problem Types: CWE-200 Information Exposure Description: The Booster for WooCommerce for WordPress is vulnerable to Information Disclosure via the 'wcj_wp_option' shortcode in versions up to, and including, 7.1.0 due to insufficient controls on the information retrievable via the shortcode. This makes it possible for authenticated attackers, with subscriber-level capabilities or above, to retrieve arbitrary sensitive site options. Additional Analyst Notes:
s, with subscriber-level capabilities or above, to retrieve arbitrary sensitive site options. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a4cd49b2-ff93-4582-906b-b690d8472c38?source=cve - https://plugins.trac.wordpress.org/browser/woocommerce-jetpack/tags/7.1.0/includes/shortcodes/class-wcj-general-shortcodes.php#L450 - https://plugins.trac.wordpress.org/changeset/2966325/woocommerce-jetpack#file1
CVE ID: CVE-2023-4797 State: PUBLISHED Published: 2024-01-16T15:56:40.507Z Last Updated: 2025-06-11T16:43:37.677Z Vendors: Unknown Products: Newsletters Problem Types: CWE-78 OS Command Injection Description: The Newsletters WordPress plugin before 4.9.3 does not properly escape user-controlled parameters when they are appended to SQL queries and shell commands, which could enable an administrator to run arbitrary commands on the server. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/de169fc7-f388-4abb-ab94-12522fd1ac92/
CVE ID: CVE-2023-4798 State: PUBLISHED Published: 2023-10-16T19:39:09.545Z Last Updated: 2024-08-02T07:38:00.684Z Vendors: Unknown Products: User Avatar Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The User Avatar WordPress plugin before 1.2.2 does not properly sanitize and escape certain of its shortcodes attributes, which could allow relatively low-privileged users like contributors to conduct Stored XSS attacks. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/273a95bf-39fe-4ba7-bc14-9527acfd9f42
CVE ID: CVE-2023-4799 State: PUBLISHED Published: 2023-11-20T18:55:04.531Z Last Updated: 2024-09-04T18:49:23.931Z Vendors: Unknown Products: Magic Embeds Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Magic Embeds WordPress plugin before 3.1.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/04c71873-5ae7-4f94-8ba9-03e03ff55180
CVE ID: CVE-2023-4800 State: PUBLISHED Published: 2023-10-16T19:39:19.260Z Last Updated: 2025-03-06T16:02:32.406Z Vendors: Unknown Products: DoLogin Security Problem Types: CWE-425 Direct Request ('Forced Browsing') Description: The DoLogin Security WordPress plugin before 3.7.1 does not restrict the access of a widget that shows the IPs of failed logins to low privileged users. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/7eae1434-8c7a-4291-912d-a4a07b73ee56
CVE ID: CVE-2023-4801 State: PUBLISHED Published: 2023-09-13T15:14:36.165Z Last Updated: 2024-09-25T17:38:58.900Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Proofpoint Products: Insider Threat Management Problem Types: CWE-295 Description: An improper certification validation vulnerability in the Insider Threat Management (ITM) Agent for MacOS could be used by an anonymous actor on an adjacent network to establish a man-in-the-middle position between the agent and the ITM server after the agent has registered. All versions prior to 7.14.3.69 are affected. Agents for Windows, Linux, and Cloud are unaffected. Additional Analyst Notes: - CVE Program Containe
3.69 are affected. Agents for Windows, Linux, and Cloud are unaffected. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2023-006
CVE ID: CVE-2023-4802 State: PUBLISHED Published: 2023-09-13T15:15:06.042Z Last Updated: 2024-09-24T19:54:46.722Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: Proofpoint Products: ITM Server Problem Types: CWE-79 Description: A reflected cross-site scripting vulnerability in the UpdateInstalledSoftware endpoint of the Insider Threat Management (ITM) Server's web console could be used by an authenticated administrator to run arbitrary javascript within another web console administrator's browser. All versions prior to 7.14.3.69 are affected. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.proofpoint.com
ed. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2023-007
CVE ID: CVE-2023-4803 State: PUBLISHED Published: 2023-09-13T15:15:40.928Z Last Updated: 2024-09-24T19:53:11.481Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: Proofpoint Products: ITM Server Problem Types: CWE-79 Description: A reflected cross-site scripting vulnerability in the WriteWindowTitle endpoint of the Insider Threat Management (ITM) Server's web console could be used by an authenticated administrator to run arbitrary javascript within another web console administrator's browser. All versions prior to 7.14.3.69 are affected. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.proofpoint.com/us/sec
itional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2023-007
CVE ID: CVE-2023-4804 State: PUBLISHED Published: 2023-11-10T22:17:55.249Z Last Updated: 2025-01-08T21:46:14.130Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Johnson Controls Products: Quantum HD Unity Compressor, Quantum HD Unity AcuAir, Quantum HD Unity Condenser/Vessel, Quantum HD Unity Evaporator, Quantum HD Unity Engine Room, Quantum HD Unity Interface Problem Types: CWE-489 Description: An unauthorized user could access debug features in Quantum HD Unity products that were accidentally exposed. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.johnsoncontrols.com/cyber-solutions/security-advisori
gram Container: - CISA ADP Vulnrichment: References: - https://www.johnsoncontrols.com/cyber-solutions/security-advisories - https://www.cisa.gov/news-events/ics-advisories/icsa-23-313-01
CVE ID: CVE-2023-4805 State: PUBLISHED Published: 2023-10-16T19:39:06.867Z Last Updated: 2025-04-23T16:12:51.381Z Vendors: Unknown Products: Tutor LMS Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Tutor LMS WordPress plugin before 2.3.0 does not sanitise and escape some of its settings, which could allow users such as subscriber to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/1049e940-49b1-4236-bea2-c636f35c5647
CVE ID: CVE-2023-4806 State: PUBLISHED Published: 2023-09-18T16:33:57.211Z Last Updated: 2025-11-20T17:55:55.988Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.6 Extended Update Support, Red Hat Enterprise Linux 9, Red Hat Virtualization 4 for Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 Problem Types: CWE-416 Description: A flaw has been identified in glibc. In an extremely rare situation, the getaddrinfo function may access memory that has been freed, resulting in an application crash. This issue is only exploitable when a NSS module implements
ory that has been freed, resulting in an application crash. This issue is only exploitable when a NSS module implements only the _nss_*_gethostbyname2_r and _nss_*_getcanonname_r hooks without implementing the _nss_*_gethostbyname3_r hook. The resolved name should return a large number of IPv6 and IPv4, and the call to the getaddrinfo function should have the AF_INET6 address family with AI_CANONNAME, AI_ALL and AI_V4MAPPED as flags. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHBA-2024:2413 - https://access.redhat.com/errata/RHSA-2023:5453 - https://access.redhat.com/errata/RHSA-2023:5455 - https://access.redhat.
tps://access.redhat.com/errata/RHSA-2023:5453 - https://access.redhat.com/errata/RHSA-2023:5455 - https://access.redhat.com/errata/RHSA-2023:7409 - https://access.redhat.com/security/cve/CVE-2023-4806 - https://bugzilla.redhat.com/show_bug.cgi?id=2237782
CVE ID: CVE-2023-4807 State: PUBLISHED Published: 2023-09-08T11:01:53.663Z Last Updated: 2025-08-27T20:42:52.433Z Vendors: OpenSSL Products: OpenSSL Problem Types: CWE-440 Description: Issue summary: The POLY1305 MAC (message authentication code) implementation contains a bug that might corrupt the internal state of applications on the Windows 64 platform when running on newer X86_64 processors supporting the AVX512-IFMA instructions. Impact summary: If in an application that uses the OpenSSL library an attacker can influence whether the POLY1305 MAC algorithm is used, the application state might be corrupted with various application dependent consequences. The POLY1305 MAC (message authenti
application state might be corrupted with various application dependent consequences. The POLY1305 MAC (message authentication code) implementation in OpenSSL does not save the contents of non-volatile XMM registers on Windows 64 platform when calculating the MAC of data larger than 64 bytes. Before returning to the caller all the XMM registers are set to zero rather than restoring their previous content. The vulnerable code is used only on newer x86_64 processors supporting the AVX512-IFMA instructions. The consequences of this kind of internal application state corruption can be various - from no consequences, if the calling application does not depend on the contents of non-volatile XMM r
can be various - from no consequences, if the calling application does not depend on the contents of non-volatile XMM registers at all, to the worst consequences, where the attacker could get complete control of the application process. However given the contents of the registers are just zeroized so the attacker cannot put arbitrary values inside, the most likely consequence, if any, would be an incorrect result of some application dependent calculations or a crash leading to a denial of service. The POLY1305 MAC algorithm is most frequently used as part of the CHACHA20-POLY1305 AEAD (authenticated encryption with associated data) algorithm. The most common usage of this AEAD cipher is wit
OLY1305 AEAD (authenticated encryption with associated data) algorithm. The most common usage of this AEAD cipher is with TLS protocol versions 1.2 and 1.3 and a malicious client can influence whether this AEAD cipher is used by the server. This implies that server applications using OpenSSL can be potentially impacted. However we are currently not aware of any concrete application that would be affected by this issue therefore we consider this a Low severity security issue. As a workaround the AVX512-IFMA instructions support can be disabled at runtime by setting the environment variable OPENSSL_ia32cap: OPENSSL_ia32cap=:~0x200000 The FIPS provider is not affected by this issue. Additional