Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-24575 State: PUBLISHED Published: 2023-02-21T04:03:48.673Z Last Updated: 2025-03-12T16:03:01.768Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Dell Products: Dell Multifunction Printer E525w Driver and Software Suite Problem Types: CWE-428 Description: Dell Multifunction Printer E525w Driver and Software Suite, versions prior to 1.047.2022, A05, contain a local privilege escalation vulnerability that could be exploited by malicious users to compromise the affected system Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000208396/dsa-2023-043
CVE ID: CVE-2023-24576 State: PUBLISHED Published: 2023-02-03T17:21:30.059Z Last Updated: 2025-03-25T20:29:30.493Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Dell Products: NetWorker, NVE Problem Types: CWE-94 Description: EMC NetWorker may potentially be vulnerable to an unauthenticated remote code execution vulnerability in the NetWorker Client execution service (nsrexecd) irrespective of any auth used. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000208258/dsa-2023-041-dell-networker-security-update-for-nsrdump-vulnerability
CVE ID: CVE-2023-24577 State: PUBLISHED Published: 2023-03-13T00:00:00.000Z Last Updated: 2025-03-03T20:10:36.032Z Vendors: n/a Products: n/a Problem Types: n/a Description: McAfee Total Protection prior to 16.0.50 allows attackers to elevate user privileges due to Improper Link Resolution via registry keys. This could enable a user with lower privileges to execute unauthorized tasks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mcafee.com/en-us/consumer-corporate/mcafee-labs/product-security-bulletins.html - https://www.mcafee.com/support/?articleId=TS103397&page=shell&shell=article-view
CVE ID: CVE-2023-24578 State: PUBLISHED Published: 2023-03-13T00:00:00.000Z Last Updated: 2025-02-27T20:57:14.550Z Vendors: n/a Products: n/a Problem Types: n/a Description: McAfee Total Protection prior to 16.0.49 allows attackers to elevate user privileges due to DLL sideloading. This could enable a user with lower privileges to execute unauthorized tasks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mcafee.com/en-us/consumer-corporate/mcafee-labs/product-security-bulletins.html - https://www.mcafee.com/support/?articleId=TS103397&page=shell&shell=article-view
CVE ID: CVE-2023-24579 State: PUBLISHED Published: 2023-03-13T00:00:00.000Z Last Updated: 2025-03-03T20:04:36.543Z Vendors: n/a Products: n/a Problem Types: n/a Description: McAfee Total Protection prior to 16.0.51 allows attackers to trick a victim into uninstalling the application via the command prompt. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mcafee.com/en-us/consumer-corporate/mcafee-labs/product-security-bulletins.html - https://www.mcafee.com/support/?articleId=TS103397&page=shell&shell=article-view
CVE ID: CVE-2023-24580 State: PUBLISHED Published: 2023-02-15T00:00:00.000Z Last Updated: 2025-03-18T19:24:32.509Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Multipart Request Parser in Django 3.2 before 3.2.18, 4.0 before 4.0.10, and 4.1 before 4.1.7. Passing certain inputs (e.g., an excessive number of parts) to multipart forms could result in too many open files or memory exhaustion, and provided a potential vector for a denial-of-service attack. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://groups.google.com/forum/#%21forum/django-announce - https://docs.djangoproject.com/en/4.1/releases/se
erences: - https://groups.google.com/forum/#%21forum/django-announce - https://docs.djangoproject.com/en/4.1/releases/security/ - http://www.openwall.com/lists/oss-security/2023/02/14/1 - https://www.djangoproject.com/weblog/2023/feb/14/security-releases/ - https://lists.debian.org/debian-lts-announce/2023/02/msg00023.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VZS4G6NSZWPTVXMMZHJOJVQEPL3QTO77/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FKYVMMR7RPM6AHJ2SBVM2LO6D3NGFY7B/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YJB6FUBBLV
6D3NGFY7B/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YJB6FUBBLVKKG655UMTLQNN6UQ6EDLSP/ - https://security.netapp.com/advisory/ntap-20230316-0006/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HWY6DQWRVBALV73BPUVBXC3QIYUM24IK/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LTZVAKU5ALQWOKFTPISE257VCVIYGFQI/
CVE ID: CVE-2023-24581 State: PUBLISHED Published: 2023-02-14T10:36:46.345Z Last Updated: 2025-03-20T14:10:54.444Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: Solid Edge SE2022, Solid Edge SE2023 Problem Types: CWE-416 Description: A vulnerability has been identified in Solid Edge SE2022 (All versions < V222.0MP12), Solid Edge SE2022 (All versions), Solid Edge SE2023 (All versions < V223.0Update2). The affected application contains a use-after-free vulnerability that could be triggered while parsing specially crafted STP files. An attacker could leverage this vulnerability to execute code in the context of the current proces
ly crafted STP files. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-19425) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-491245.pdf
CVE ID: CVE-2023-24582 State: PUBLISHED Published: 2023-07-06T14:53:29.848Z Last Updated: 2025-11-04T19:14:46.264Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Milesight Products: UR32L Problem Types: CWE-77 Description: Two OS command injection vulnerabilities exist in the urvpn_client cmd_name_action functionality of Milesight UR32L v32.3.0.5. A specially crafted network request can lead to arbitrary command execution. An attacker can send a network request to trigger these vulnerabilities.This OS command injection is triggered through a TCP packet. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosinte
TCP packet. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1710
CVE ID: CVE-2023-24583 State: PUBLISHED Published: 2023-07-06T14:53:29.946Z Last Updated: 2025-11-04T19:14:47.356Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Milesight Products: UR32L Problem Types: CWE-77 Description: Two OS command injection vulnerabilities exist in the urvpn_client cmd_name_action functionality of Milesight UR32L v32.3.0.5. A specially crafted network request can lead to arbitrary command execution. An attacker can send a network request to trigger these vulnerabilities.This OS command injection is triggered through a UDP packet. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosinte
UDP packet. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1710
CVE ID: CVE-2023-24584 State: PUBLISHED Published: 2023-06-01T04:08:35.754Z Last Updated: 2025-01-10T18:47:07.773Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Gallagher Products: Controller 6000 Problem Types: CWE-120 Description: Controller 6000 is vulnerable to a buffer overflow via the Controller diagnostic web interface upload feature. This issue affects Controller 6000: before vCR8.80.230201a, before vCR8.70.230201a, before vCR8.60.230201b, before vCR8.50.230201a, all versions of vCR8.40 and prior. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2023
gram Container: - CISA ADP Vulnrichment: References: - https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2023-24584
CVE ID: CVE-2023-24585 State: PUBLISHED Published: 2023-11-14T09:14:53.950Z Last Updated: 2024-08-02T11:03:18.943Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H) Vendors: Silicon Labs, Weston Embedded Products: Gecko Platform, Cesium NET, uC-HTTP Problem Types: CWE-119 Description: An out-of-bounds write vulnerability exists in the HTTP Server functionality of Weston Embedded uC-HTTP v3.01.01. A specially crafted network packet can lead to memory corruption. An attacker can send a network request to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/T
s: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1725
CVE ID: CVE-2023-24586 State: PUBLISHED Published: 2023-05-10T00:00:00.000Z Last Updated: 2025-01-28T14:48:12.082Z Vendors: Seiko Solutions Inc. Products: SkyBridge MB-A100/110 Problem Types: Cleartext storage of sensitive information Description: Cleartext storage of sensitive information exists in SkyBridge MB-A100/110 firmware Ver. 4.2.0 and earlier, which may allow a remote authenticated attacker to obtain an APN credential for the product. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.seiko-sol.co.jp/archives/73969/ - https://www.seiko-sol.co.jp/products/skybridge/skybridge_download/mb-a100/ - https://www.seiko-sol.co.jp/products/s
9/ - https://www.seiko-sol.co.jp/products/skybridge/skybridge_download/mb-a100/ - https://www.seiko-sol.co.jp/products/skybridge/skybridge_download/mb-a200/ - https://www.seiko-sol.co.jp/products/skybridge/skybridge_download/mb-a130/ - https://www.seiko-sol.co.jp/products/skyspider/skyspider_download/mb-r210/ - https://jvn.jp/en/jp/JVN40604023/
CVE ID: CVE-2023-24587 State: PUBLISHED Published: 2023-11-14T19:04:55.135Z Last Updated: 2024-10-11T18:07:34.507Z Severity: MEDIUM (CVSS 6.9 CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:N/I:H/A:H) Vendors: n/a Products: Intel(R) Optane(TM) SSD products Problem Types: denial of service, CWE-691 Description: Insufficient control flow management in firmware for some Intel(R) Optane(TM) SSD products may allow a privileged user to potentially enable denial of service via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00758.html
CVE ID: CVE-2023-24588 State: PUBLISHED Published: 2023-11-14T19:04:57.506Z Last Updated: 2024-10-11T18:07:24.352Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N) Vendors: n/a Products: Intel(R) Optane(TM) SSD products Problem Types: information disclosure, CWE-200 Description: Exposure of sensitive information to an unauthorized actor in firmware for some Intel(R) Optane(TM) SSD products may allow an unauthenticated user to potentially enable information disclosure via physical access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00758.html
CVE ID: CVE-2023-24589 State: PUBLISHED Published: 2024-02-14T13:37:42.926Z Last Updated: 2025-05-12T14:59:47.452Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:L) Vendors: n/a Products: Intel(R) Thunderbolt(TM) DCH drivers for Windows Problem Types: escalation of privilege, CWE-92 Description: Improper buffer restrictions in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow a privileged user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00851.html
CVE ID: CVE-2023-24590 State: PUBLISHED Published: 2023-12-18T22:00:17.083Z Last Updated: 2024-08-02T11:03:19.228Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Gallagher Products: Controller 6000 Problem Types: CWE-134 Description: A format string issue in the Controller 6000's optional diagnostic web interface can be used to write/read from memory, and in some instances crash the Controller 6000 leading to a Denial of Service. This issue affects: Gallagher Controller 6000 8.60 prior to vCR8.60.231116a (distributed in 8.60.2550 (MR7)), all versions of 8.50 and prior. Additional Analyst Notes: - CVE Program Container: References: - https://security.gallagher
versions of 8.50 and prior. Additional Analyst Notes: - CVE Program Container: References: - https://security.gallagher.com/Security-Advisories/CVE-2023-24590
CVE ID: CVE-2023-24591 State: PUBLISHED Published: 2024-02-14T13:38:10.995Z Last Updated: 2025-04-24T15:16:51.432Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) Binary Configuration Tool software Problem Types: escalation of privilege, CWE-427 Description: Uncontrolled search path in some Intel(R) Binary Configuration Tool software before version 3.4.4 may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00973.html
CVE ID: CVE-2023-24592 State: PUBLISHED Published: 2023-11-14T19:05:04.547Z Last Updated: 2024-08-02T11:03:18.935Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) oneAPI Toolkits and Component software Problem Types: escalation of privilege, CWE-22 Description: Path traversal in the some Intel(R) oneAPI Toolkits and Component software before version 2023.1 may allow authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00841.html
CVE ID: CVE-2023-24593 State: REJECTED Published: N/A Last Updated: 2023-07-20T20:27:34.167Z Description: No description available.
CVE ID: CVE-2023-24594 State: PUBLISHED Published: 2023-05-03T14:31:16.883Z Last Updated: 2025-01-29T21:04:16.205Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: F5 Products: BIG-IP, BIG-IP SPK Problem Types: CWE-400 Description: When an SSL profile is configured on a Virtual Server, undisclosed traffic can cause an increase in CPU or SSL accelerator resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://my.f5.com/manage/s/article/K000133132
CVE ID: CVE-2023-24595 State: PUBLISHED Published: 2023-07-06T14:53:28.636Z Last Updated: 2024-11-14T14:49:09.344Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Milesight Products: UR32L Problem Types: CWE-78 Description: An OS command injection vulnerability exists in the ys_thirdparty system_user_script functionality of Milesight UR32L v32.3.0.5. A specially crafted series of network requests can lead to command execution. An attacker can send a sequence of requests to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1713
CVE ID: CVE-2023-24597 State: PUBLISHED Published: 2023-05-29T00:00:00 Last Updated: 2025-01-14T15:22:00.970Z Vendors: n/a Products: n/a Problem Types: n/a Description: OX App Suite before frontend 7.10.6-rev24 allows the loading (without user consent) of an e-mail message's remote resources during printing. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://open-xchange.com - http://seclists.org/fulldisclosure/2023/May/3
CVE ID: CVE-2023-24598 State: PUBLISHED Published: 2023-05-29T00:00:00 Last Updated: 2025-01-14T15:19:46.095Z Vendors: n/a Products: n/a Problem Types: n/a Description: OX App Suite before backend 7.10.6-rev37 has an information leak in the handling of distribution lists, e.g., partial disclosure of the private contacts of another user. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://open-xchange.com - http://seclists.org/fulldisclosure/2023/May/3
CVE ID: CVE-2023-24599 State: PUBLISHED Published: 2023-05-29T00:00:00 Last Updated: 2025-01-14T15:14:59.159Z Vendors: n/a Products: n/a Problem Types: n/a Description: OX App Suite before backend 7.10.6-rev37 allows authenticated users to change the appointments of arbitrary users via conflicting ID numbers, aka "ID confusion." Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://open-xchange.com - http://seclists.org/fulldisclosure/2023/May/3
CVE ID: CVE-2023-24600 State: PUBLISHED Published: 2023-05-29T00:00:00 Last Updated: 2025-01-14T15:11:32.137Z Vendors: n/a Products: n/a Problem Types: n/a Description: OX App Suite before backend 7.10.6-rev37 allows authenticated users to bypass access controls (for reading contacts) via a move to their own address book. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://open-xchange.com - http://seclists.org/fulldisclosure/2023/May/3
CVE ID: CVE-2023-24601 State: PUBLISHED Published: 2023-05-29T00:00:00 Last Updated: 2025-01-14T15:08:04.528Z Vendors: n/a Products: n/a Problem Types: n/a Description: OX App Suite before frontend 7.10.6-rev24 allows XSS via a non-app deeplink such as the jslob API's registry sub-tree. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://open-xchange.com - http://seclists.org/fulldisclosure/2023/May/3
CVE ID: CVE-2023-24602 State: PUBLISHED Published: 2023-05-29T00:00:00 Last Updated: 2025-01-14T15:06:16.946Z Vendors: n/a Products: n/a Problem Types: n/a Description: OX App Suite before frontend 7.10.6-rev24 allows XSS via data to the Tumblr portal widget, such as a post title. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://open-xchange.com - http://seclists.org/fulldisclosure/2023/May/3
CVE ID: CVE-2023-24603 State: PUBLISHED Published: 2023-05-29T00:00:00 Last Updated: 2025-01-14T17:18:22.455Z Vendors: n/a Products: n/a Problem Types: n/a Description: OX App Suite before backend 7.10.6-rev37 does not check size limits when downloading, e.g., potentially allowing a crafted iCal feed to provide an unlimited amount of data. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://open-xchange.com - http://seclists.org/fulldisclosure/2023/May/3
CVE ID: CVE-2023-24604 State: PUBLISHED Published: 2023-05-29T00:00:00 Last Updated: 2025-01-14T17:16:02.430Z Vendors: n/a Products: n/a Problem Types: n/a Description: OX App Suite before backend 7.10.6-rev37 does not check HTTP header lengths when downloading, e.g., potentially allowing a crafted iCal feed to provide an unlimited amount of header data. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://open-xchange.com - http://seclists.org/fulldisclosure/2023/May/3
CVE ID: CVE-2023-24605 State: PUBLISHED Published: 2023-05-29T00:00:00 Last Updated: 2025-01-14T17:14:53.627Z Vendors: n/a Products: n/a Problem Types: n/a Description: OX App Suite before backend 7.10.6-rev37 does not enforce 2FA for all endpoints, e.g., reading from a drive, reading contact data, and renaming tokens. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://open-xchange.com - http://seclists.org/fulldisclosure/2023/May/3
CVE ID: CVE-2023-24607 State: PUBLISHED Published: 2023-04-15T00:00:00 Last Updated: 2024-08-02T11:03:18.644Z Vendors: n/a Products: n/a Problem Types: n/a Description: Qt before 6.4.3 allows a denial of service via a crafted string when the SQL ODBC driver plugin is used and the size of SQLTCHAR is 4. The affected versions are 5.x before 5.15.13, 6.x before 6.2.8, and 6.3.x before 6.4.3. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.qt.io/blog/tag/security - https://codereview.qt-project.org/c/qt/qtbase/+/456216 - https://codereview.qt-project.org/c/qt/tqtc-qtbase/+/456217 - https://codereview.qt-project.org/c/qt/tqtc-qtbase/+/456238 -
ps://codereview.qt-project.org/c/qt/tqtc-qtbase/+/456217 - https://codereview.qt-project.org/c/qt/tqtc-qtbase/+/456238 - https://download.qt.io/official_releases/qt/5.15/CVE-2023-24607-qtbase-5.15.diff - https://github.com/qt/qtbase/commit/aaf1381eab6292aa0444a5eadcc24165b6e1c02d - https://www.qt.io/blog/security-advisory-qt-sql-odbc-driver-plugin - https://lists.debian.org/debian-lts-announce/2024/04/msg00027.html
CVE ID: CVE-2023-24609 State: PUBLISHED Published: 2023-12-22T00:00:00 Last Updated: 2024-08-02T11:03:18.963Z Vendors: n/a Products: n/a Problem Types: n/a Description: Matrix SSL 4.x through 4.6.0 and Rambus TLS Toolkit have a length-subtraction integer overflow for Client Hello Pre-Shared Key extension parsing in the TLS 1.3 server. An attacked device calculates an SHA-2 hash over at least 65 KB (in RAM). With a large number of crafted TLS messages, the CPU becomes heavily loaded. This occurs in tls13VerifyBinder and tls13TranscriptHashUpdate. Additional Analyst Notes: - CVE Program Container: References: - https://www.telekom.com/en/company/data-privacy-and-security/news/advisories-504842
CVE Program Container: References: - https://www.telekom.com/en/company/data-privacy-and-security/news/advisories-504842 - https://www.rambus.com/security/software-protocols/tls-toolkit/
CVE ID: CVE-2023-24610 State: PUBLISHED Published: 2023-02-01T00:00:00.000Z Last Updated: 2025-03-27T14:15:49.709Z Vendors: n/a Products: n/a Problem Types: n/a Description: NOSH 4a5cfdb allows remote authenticated users to execute PHP arbitrary code via the "practice logo" upload feature. The client-side checks can be bypassed. This may allow attackers to steal Protected Health Information because the product is for health charting. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/shihjay2/docker-nosh - https://noshemr.wordpress.com - https://github.com/shihjay2/nosh2/tree/4a5cfdbd73f6a2ab5ee43a33d173c46fe0271533 - https://gist.git
shemr.wordpress.com - https://github.com/shihjay2/nosh2/tree/4a5cfdbd73f6a2ab5ee43a33d173c46fe0271533 - https://gist.github.com/abbisQQ/d8392acf7e02003e73af973cc9f5f54a
CVE ID: CVE-2023-24612 State: PUBLISHED Published: 2023-01-30T00:00:00.000Z Last Updated: 2025-03-28T15:36:33.109Z Vendors: n/a Products: n/a Problem Types: n/a Description: The PdfBook extension through 2.0.5 before b07b6a64 for MediaWiki allows command injection via an option. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/organicdesign/PdfBook/-/merge_requests/6