Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
cess and above, to download and read any file on the server, including system and configuration files. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6cd166bc-774e-4083-b5f7-bffba1f7c293?source=cve - https://plugins.trac.wordpress.org/browser/wp-downloadmanager/trunk/download-options.php#L16 - https://plugins.trac.wordpress.org/browser/wp-downloadmanager/trunk/download-options.php#L42 - https://plugins.trac.wordpress.org/changeset/3294467/
CVE ID: CVE-2025-4799 State: PUBLISHED Published: 2025-06-11T03:41:53.029Z Last Updated: 2025-06-11T13:23:50.639Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: gamerz Products: WP-DownloadManager Problem Types: CWE-36 Description: The WP-DownloadManager plugin for WordPress is vulnerable to arbitrary file deletion due to lack of restriction on the directory a file can be deleted from in all versions up to, and including, 1.68.10. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config
ry files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This vulnerability can be paired with CVE-2025-4798 to delete any file within the WordPress root directory. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f9d9e485-171f-4e36-943d-397d540e31f4?source=cve - https://plugins.trac.wordpress.org/browser/wp-downloadmanager/trunk/download-options.php#L16 - https://plugins.trac.wordpress.org/browser/wp-downloadmanager/trunk/download-options.php#L42 - https://plugins.trac.wordpress.org/browser/wp-downloadmanager/trunk/download-manager.php#L215 - https:
options.php#L42 - https://plugins.trac.wordpress.org/browser/wp-downloadmanager/trunk/download-manager.php#L215 - https://plugins.trac.wordpress.org/changeset/3294467/
CVE ID: CVE-2025-4800 State: PUBLISHED Published: 2025-05-28T05:24:21.802Z Last Updated: 2025-05-28T13:31:51.311Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: StylemixThemes Products: MasterStudy LMS Pro Problem Types: CWE-434 Description: The MasterStudy LMS Pro plugin for WordPress is vulnerable to arbitrary file uploads due to a missing file type validation in the stm_lms_add_assignment_attachment function in all versions up to, and including, 4.7.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server, which may make remote code execution possible. Additional
ove, to upload arbitrary files on the affected site's server, which may make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c170a228-4abd-4ee6-ba37-bdcde1cb7fc5?source=cve - https://stylemixthemes.com/wordpress-lms-plugin/ - https://themeforest.net/item/masterstudy-education-center-wordpress-theme/12170274/ - https://docs.stylemixthemes.com/masterstudy-lms/changelog-pro-version
CVE ID: CVE-2025-4801 State: REJECTED Published: N/A Last Updated: 2025-06-10T15:25:36.099Z Description: No description available.
CVE ID: CVE-2025-4802 State: PUBLISHED Published: 2025-05-16T19:32:50.586Z Last Updated: 2025-11-03T20:04:41.052Z Vendors: The GNU C Library Products: glibc Problem Types: CWE-426 Description: Untrusted LD_LIBRARY_PATH environment variable vulnerability in the GNU C Library version 2.27 to 2.38 allows attacker controlled loading of dynamically shared library in statically compiled setuid binaries that call dlopen (including internal dlopen calls after setlocale or calls to NSS functions such as getaddrinfo). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://sourceware.org/cgit/glibc/commit/?id=1e18586c5820e329f741d5c710275e165581380e - https://
richment: References: - https://sourceware.org/cgit/glibc/commit/?id=1e18586c5820e329f741d5c710275e165581380e - https://sourceware.org/bugzilla/show_bug.cgi?id=32976
CVE ID: CVE-2025-4803 State: PUBLISHED Published: 2025-05-21T09:21:49.897Z Last Updated: 2025-05-21T10:15:42.170Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: steinrein Products: Glossary by WPPedia – Best Glossary plugin for WordPress Problem Types: CWE-502 Description: The Glossary by WPPedia – Best Glossary plugin for WordPress plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.3.0 via deserialization of untrusted input from the 'posttypes' parameter. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vu
ed attackers, with Administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/53fb54bc-6eaa-4e99-a41c-e59a9bae81e5?source=cve - https://plugins.trac
www.wordfence.com/threat-intel/vulnerabilities/id/53fb54bc-6eaa-4e99-a41c-e59a9bae81e5?source=cve - https://plugins.trac.wordpress.org/browser/wppedia/tags/1.3.0/core/classes/class-options.php#L396 - https://plugins.trac.wordpress.org/browser/wppedia/tags/1.3.0/core/classes/traits/trait-sanitizes-data.php#L64 - https://github.com/bfiessinger/wppedia/blob/1d0b8568349c9c9479372f845a812eb2aa4b3d09/core/classes/traits/trait-sanitizes-data.php#L64
CVE ID: CVE-2025-4804 State: PUBLISHED Published: 2025-05-16T20:12:44.848Z Last Updated: 2025-05-17T02:28:29.225Z Vendors: WatchGuard Products: Fireware OS Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS allows Stored XSS via the spamBlocker module. This vulnerability requires an authenticated administrator session to a locally managed Firebox. This issue affects Fireware OS: from 12.0 through 12.11.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00006
CVE ID: CVE-2025-4805 State: PUBLISHED Published: 2025-05-16T20:13:47.615Z Last Updated: 2025-09-19T16:26:29.751Z Vendors: WatchGuard Products: Fireware OS Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS allows Stored XSS. This vulnerability requires an authenticated administrator session to a locally managed Firebox. This issue affects Fireware OS: from 12.0 through 12.11.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00007
CVE ID: CVE-2025-4806 State: PUBLISHED Published: 2025-05-16T19:00:06.184Z Last Updated: 2025-05-16T19:16:33.473Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester, oretnom23 Products: Stock Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, has been found in SourceCodester/oretnom23 Stock Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/?page=back_order/view_bo. The manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnr
nched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.309260 - https://vuldb.com/?ctiid.309260 - https://vuldb.com/?submit.572219 - https://github.com/th3w0lf-1337/Vulnerabilities/blob/main/SMS-PHP/SQLi/Back-Order/info.md
CVE ID: CVE-2025-4807 State: PUBLISHED Published: 2025-05-16T19:31:05.433Z Last Updated: 2025-05-17T02:35:32.751Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: SourceCodester Products: Online Student Clearance System Problem Types: CWE-548, CWE-552 Description: A vulnerability, which was classified as problematic, was found in SourceCodester Online Student Clearance System 1.0. This affects an unknown part. The manipulation leads to exposure of information through directory listing. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - h
oit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.309261 - https://vuldb.com/?ctiid.309261 - https://vuldb.com/?submit.572238 - https://github.com/laifeng-boy/cve/issues/2 - https://www.sourcecodester.com/
CVE ID: CVE-2025-4808 State: PUBLISHED Published: 2025-05-16T20:00:10.452Z Last Updated: 2025-05-20T14:23:56.509Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: PHPGurukul Products: Park Ticketing Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in PHPGurukul Park Ticketing Management System 2.0 and classified as critical. This issue affects some unknown processing of the file /add-normal-ticket.php. The manipulation of the argument noadult/nochildren/aprice/cprice leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. Additional
ly. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.309263 - https://vuldb.com/?ctiid.309263 - https://vuldb.com/?submit.572602 - https://github.com/f1rstb100d/myCVE/issues/11 - https://phpgurukul.com/
CVE ID: CVE-2025-4809 State: PUBLISHED Published: 2025-05-16T20:00:14.307Z Last Updated: 2025-05-17T02:29:55.165Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: Tenda Products: AC7 Problem Types: CWE-121, CWE-119 Description: A vulnerability was found in Tenda AC7 15.03.06.44. It has been classified as critical. Affected is the function fromSafeSetMacFilter of the file /goform/setMacFilterCfg. The manipulation of the argument deviceList leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.309264 - https
c and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.309264 - https://vuldb.com/?ctiid.309264 - https://vuldb.com/?submit.573642 - https://lavender-bicycle-a5a.notion.site/Tenda-AC7-fromSafeSetMacFilter-1ed53a41781f80cbbf13c8d4cc405ed1?pvs=4 - https://www.tenda.com.cn/
CVE ID: CVE-2025-4810 State: PUBLISHED Published: 2025-05-16T20:31:06.542Z Last Updated: 2025-05-17T02:25:49.517Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: Tenda Products: AC7 Problem Types: CWE-121, CWE-119 Description: A vulnerability was found in Tenda AC7 15.03.06.44. It has been declared as critical. Affected by this vulnerability is the function formSetRebootTimer of the file /goform/SetRebootTimer. The manipulation of the argument reboot_time leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.30926
the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.309265 - https://vuldb.com/?ctiid.309265 - https://vuldb.com/?submit.573643 - https://lavender-bicycle-a5a.notion.site/Tenda-AC7-formSetRebootTimer-1ed53a41781f80f78851c1c9dfc4f216?pvs=4 - https://www.tenda.com.cn/
CVE ID: CVE-2025-4811 State: PUBLISHED Published: 2025-05-16T21:00:07.719Z Last Updated: 2025-05-17T02:20:07.298Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: CodeAstro Products: Pharmacy Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in CodeAstro Pharmacy Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /index.php of the component Login. The manipulation of the argument Username leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - htt
t has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.309266 - https://vuldb.com/?ctiid.309266 - https://vuldb.com/?submit.573700 - https://github.com/Lanxiy7th/lx_CVE_report-/issues/24 - https://codeastro.com/
CVE ID: CVE-2025-4812 State: PUBLISHED Published: 2025-05-16T21:31:05.295Z Last Updated: 2025-05-17T02:18:01.532Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: PHPGurukul Products: Human Metapneumovirus Testing Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, has been found in PHPGurukul Human Metapneumovirus Testing Management System 1.0. This issue affects some unknown processing of the file /profile.php. The manipulation of the argument mobilenumber leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vuln
tiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.309269 - https://vuldb.com/?ctiid.309269 - https://vuldb.com/?submit.573886 - https://github.com/Pjwww13447/pjwww/issues/5 - https://phpgurukul.com/
CVE ID: CVE-2025-4813 State: PUBLISHED Published: 2025-05-16T21:31:08.083Z Last Updated: 2025-05-17T02:16:22.031Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: PHPGurukul Products: Human Metapneumovirus Testing Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, was found in PHPGurukul Human Metapneumovirus Testing Management System 1.0. Affected is an unknown function of the file /edit-phlebotomist.php. The manipulation of the argument mobilenumber leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vu
e attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.309270 - https://vuldb.com/?ctiid.309270 - https://vuldb.com/?submit.573888 - https://github.com/Pjwww13447/pjwww/issues/6 - https://phpgurukul.com/
CVE ID: CVE-2025-4814 State: PUBLISHED Published: 2025-05-17T02:00:08.395Z Last Updated: 2025-05-19T15:44:47.971Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Campcodes Products: Sales and Inventory System Problem Types: CWE-89, CWE-74 Description: A vulnerability has been found in Campcodes Sales and Inventory System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /pages/supplier_add.php. The manipulation of the argument Name leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vu
een disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.309271 - https://vuldb.com/?ctiid.309271 - https://vuldb.com/?submit.574081 - https://github.com/iGGbondTC/cve/issues/1 - https://www.campcodes.com/
CVE ID: CVE-2025-4815 State: PUBLISHED Published: 2025-05-17T02:31:04.635Z Last Updated: 2025-05-19T15:42:52.448Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Campcodes Products: Sales and Inventory System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in Campcodes Sales and Inventory System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /pages/supplier_update.php. The manipulation of the argument Name leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/
losed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.309272 - https://vuldb.com/?ctiid.309272 - https://vuldb.com/?submit.574082 - https://github.com/iGGbondTC/cve/issues/2 - https://www.campcodes.com/
CVE ID: CVE-2025-4816 State: PUBLISHED Published: 2025-05-17T03:00:07.870Z Last Updated: 2025-05-19T15:40:19.826Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: SourceCodester Products: Doctor's Appointment System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in SourceCodester Doctor's Appointment System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/appointment.php of the component GET Parameter Handler. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnr
ttack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.309273 - https://vuldb.com/?ctiid.309273 - https://vuldb.com/?submit.574129 - https://github.com/Xiaoyi-ing/CVE/issues/8 - https://www.sourcecodester.com/
CVE ID: CVE-2025-4817 State: PUBLISHED Published: 2025-05-17T04:00:07.133Z Last Updated: 2025-05-19T15:38:39.646Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Sourcecodester Products: Doctor's Appointment System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in Sourcecodester Doctor's Appointment System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/delete-appointment.php of the component GET Parameter Handler. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP
e initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.309274 - https://vuldb.com/?ctiid.309274 - https://vuldb.com/?submit.574178 - https://github.com/Xiaoyi-ing/CVE/issues/9 - https://www.sourcecodester.com/
CVE ID: CVE-2025-4818 State: PUBLISHED Published: 2025-05-17T05:00:07.248Z Last Updated: 2025-05-19T15:38:06.957Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: SourceCodester Products: Doctor's Appointment System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in SourceCodester Doctor's Appointment System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /admin/delete-doctor.php of the component GET Parameter Handler. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vuln
tiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.309275 - https://vuldb.com/?ctiid.309275 - https://vuldb.com/?submit.574219 - https://github.com/Xiaoyi-ing/CVE/issues/10 - https://www.sourcecodester.com/
CVE ID: CVE-2025-4819 State: PUBLISHED Published: 2025-05-17T06:00:06.145Z Last Updated: 2025-05-19T15:24:05.806Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: y_project Products: RuoYi Problem Types: CWE-285, CWE-266 Description: A vulnerability classified as problematic has been found in y_project RuoYi 4.8.0. Affected is an unknown function of the file /monitor/online/batchForceLogout of the component Offline Logout. The manipulation of the argument ids leads to improper authorization. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the p
plexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.309276 - https://vuldb.com/?ctiid.309276 - https://vuldb.com/?submit.574443 - https://github.com/chujianxin0101/vuln/issues/4
CVE ID: CVE-2025-4820 State: PUBLISHED Published: 2025-06-18T15:45:49.994Z Last Updated: 2025-06-18T18:27:38.799Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Cloudflare Products: quiche Problem Types: CWE-770 Description: Impact Cloudflare quiche was discovered to be vulnerable to incorrect congestion window growth, which could cause it to send data at a rate faster than the path might actually support. An unauthenticated remote attacker can exploit the vulnerability by first completing a handshake and initiating a congestion-controlled data transfer towards itself. Then, it could manipulate the victim's congestion control state by sending ACK frames exe
data transfer towards itself. Then, it could manipulate the victim's congestion control state by sending ACK frames exercising an opportunistic ACK attack; see RFC 9000 Section 21.4. The victim could grow the congestion window beyond typical expectations and allow more bytes in flight than the path might really support. Patches quiche 0.24.4 is the earliest version containing the fix for this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/cloudflare/quiche/security/advisories/GHSA-2v9p-3p3h-w56j
CVE ID: CVE-2025-4821 State: PUBLISHED Published: 2025-06-18T15:47:52.211Z Last Updated: 2025-06-18T18:29:54.995Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Cloudflare Products: quiche Problem Types: CWE-770 Description: Impact Cloudflare quiche was discovered to be vulnerable to incorrect congestion window growth, which could cause it to send data at a rate faster than the path might actually support. An unauthenticated remote attacker can exploit the vulnerability by first completing a handshake and initiating a congestion-controlled data transfer towards itself. Then, it could manipulate the victim's congestion control state by sending ACK frames cover
ata transfer towards itself. Then, it could manipulate the victim's congestion control state by sending ACK frames covering a large range of packet numbers (including packet numbers that had never been sent); see RFC 9000 Section 19.3. The victim could grow the congestion window beyond typical expectations and allow more bytes in flight than the path might really support. In extreme cases, the window might grow beyond the limit of the internal variable's type, leading to an overflow panic. Patches quiche 0.24.4 is the earliest version containing the fix for this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/cloudflare/quiche/security/advisories/GH
tional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/cloudflare/quiche/security/advisories/GHSA-6m38-4r9r-5c4m