Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
and may be used. The associated identifier of this vulnerability is VDB-247155. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.247155 - https://vuldb.com/?ctiid.247155 - https://vuldb.com/?submit.241692 - https://github.com/houhuidong/cve/blob/main/rce.md
CVE ID: CVE-2023-6576 State: PUBLISHED Published: 2023-12-07T20:31:04.084Z Last Updated: 2024-08-02T08:35:14.615Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Byzoro Products: S210 Problem Types: CWE-434 Description: A vulnerability was found in Byzoro S210 up to 20231123. It has been declared as critical. This vulnerability affects unknown code of the file /Tool/uploadfile.php of the component HTTP POST Request Handler. The manipulation of the argument file_upload leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-247156. NOTE: The vendor was contacted e
osed to the public and may be used. The identifier of this vulnerability is VDB-247156. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.247156 - https://vuldb.com/?ctiid.247156 - https://vuldb.com/?submit.242777 - https://github.com/willchen0011/cve/blob/main/upload.md
CVE ID: CVE-2023-6577 State: PUBLISHED Published: 2023-12-07T20:31:05.203Z Last Updated: 2024-08-02T08:35:14.646Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Byzoro Products: PatrolFlow 2530Pro Problem Types: CWE-22 Description: A vulnerability was found in Byzoro PatrolFlow 2530Pro up to 20231126. It has been rated as problematic. This issue affects some unknown processing of the file /log/mailsendview.php. The manipulation of the argument file with the input /boot/phpConfig/tb_admin.txt leads to path traversal. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-247157 was assigned to t
ated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-247157 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.247157 - https://vuldb.com/?ctiid.247157 - https://vuldb.com/?submit.243584 - https://github.com/kpz-wm/cve/blob/main/Any_file_read.md
CVE ID: CVE-2023-6578 State: PUBLISHED Published: 2023-12-07T21:00:07.731Z Last Updated: 2024-08-02T08:35:14.921Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Software AG Products: WebMethods Problem Types: CWE-284 Description: A vulnerability classified as critical has been found in Software AG WebMethods 10.11.x/10.15.x. Affected is an unknown function of the file wm.server/connect/. The manipulation leads to improper access controls. It is possible to launch the attack remotely. To access a file like /assets/ a popup may request username and password. By just clicking CANCEL you will be redirected to the directory. If you visited /invoke/wm.server/connect, you'll be able t
just clicking CANCEL you will be redirected to the directory. If you visited /invoke/wm.server/connect, you'll be able to see details like internal IPs, ports, and versions. In some cases if access to /assets/ is refused, you may enter /assets/x as a wrong value, then come back to /assets/ which we will show the requested data. It appears that insufficient access control is depending on referrer header data. VDB-247158 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.247158 - https://vuldb.com/?ctiid.247158
CVE ID: CVE-2023-6579 State: PUBLISHED Published: 2023-12-07T21:31:04.204Z Last Updated: 2025-02-13T17:26:27.974Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: n/a Products: osCommerce Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, has been found in osCommerce 4. Affected by this issue is some unknown functionality of the file /b2b-supermarket/shopping-cart of the component POST Parameter Handler. The manipulation of the argument estimate[country_id] leads to sql injection. The attack may be launched remotely. The identifier of this vulnerability is VDB-247160. NOTE: The vendor was contacted early about this disclosure but did not respond
fier of this vulnerability is VDB-247160. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.247160 - https://vuldb.com/?ctiid.247160 - http://packetstormsecurity.com/files/176124/osCommerce-4-SQL-Injection.html
CVE ID: CVE-2023-6580 State: PUBLISHED Published: 2023-12-07T21:31:05.210Z Last Updated: 2024-08-02T08:35:14.765Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: D-Link Products: DIR-846 Problem Types: CWE-502 Description: A vulnerability, which was classified as critical, was found in D-Link DIR-846 FW100A53DBR. This affects an unknown part of the file /HNAP1/ of the component QoS POST Handler. The manipulation of the argument smartqos_express_devices/smartqos_normal_devices leads to deserialization. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-247161 was assigned to this vulnerability. NOTE: The
s been disclosed to the public and may be used. The identifier VDB-247161 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.247161 - https://vuldb.com/?ctiid.247161 - https://github.com/c2dc/cve-reported/blob/main/CVE-2023-6580/CVE-2023-6580.md
CVE ID: CVE-2023-6581 State: PUBLISHED Published: 2023-12-07T22:00:07.244Z Last Updated: 2024-08-02T08:35:14.482Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: D-Link Products: DAR-7000 Problem Types: CWE-89 Description: A vulnerability has been found in D-Link DAR-7000 up to 20231126 and classified as critical. This vulnerability affects unknown code of the file /user/inc/workidajax.php. The manipulation of the argument id leads to sql injection. The exploit has been disclosed to the public and may be used. VDB-247162 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way
ssigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.247162 - https://vuldb.com/?ctiid.247162 - https://github.com/flyyue2001/cve/blob/main/D-LINK%20-DAR-7000_sql_workidajax.md
CVE ID: CVE-2023-6582 State: PUBLISHED Published: 2024-01-11T08:33:11.987Z Last Updated: 2025-06-03T14:08:12.545Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: xpeedstudio Products: ElementsKit Elementor addons Problem Types: CWE-284 Improper Access Control Description: The ElementsKit Elementor addons plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.3 via the ekit_widgetarea_content function. This makes it possible for unauthenticated attackers to obtain contents of posts in draft, private or pending review status that should not be visible to the general public. This applies to posts created w
raft, private or pending review status that should not be visible to the general public. This applies to posts created with Elementor only. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ff4ae5c8-d164-4c2f-9bf3-83934c22cf4c?source=cve - https://plugins.trac.wordpress.org/browser/elementskit-lite/tags/3.0.3/modules/controls/widget-area-utils.php#L15 - https://plugins.trac.wordpress.org/browser/elementskit-lite/tags/3.0.3/widgets/init/enqueue-scripts.php#L44 - https://plugins.trac.wordpress.org/changeset/3011323/elementskit-lite/trunk/modules/controls/widget-area-utils.php
CVE ID: CVE-2023-6583 State: PUBLISHED Published: 2024-01-11T08:32:50.136Z Last Updated: 2025-06-17T18:36:23.513Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: carazo Products: Import and export users and customers Problem Types: CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') Description: The Import and export users and customers plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.24.2 via the Recurring Import functionality. This makes it possible for authenticated attackers, with administrator access and above, to read and delete the contents of a
makes it possible for authenticated attackers, with administrator access and above, to read and delete the contents of arbitrary files on the server including wp-config.php, which can contain sensitive information. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ac709779-36f1-4f66-8db3-95a514a5ea59?source=cve - https://plugins.trac.wordpress.org/changeset/3007057/
CVE ID: CVE-2023-6584 State: PUBLISHED Published: 2024-02-27T08:30:26.628Z Last Updated: 2025-04-22T16:10:05.518Z Vendors: Unknown Products: WP JobSearch Problem Types: CWE-287 Improper Authentication Description: The WP JobSearch WordPress plugin before 2.3.4 does not prevent attackers from logging-in as any users with the only knowledge of that user's email address. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/e528e3cd-a45c-4bf7-a37a-101f5c257acd/
CVE ID: CVE-2023-6585 State: PUBLISHED Published: 2024-02-27T08:30:25.818Z Last Updated: 2024-08-09T20:57:46.541Z Vendors: Unknown Products: WP JobSearch Problem Types: CWE-434 Unrestricted Upload of File with Dangerous Type Description: The WP JobSearch WordPress plugin before 2.3.4 does not validate files to be uploaded, which could allow unauthenticated attackers to upload arbitrary files such as PHP on the server Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/757412f4-e4f8-4007-8e3b-639a72b33180/
CVE ID: CVE-2023-6588 State: PUBLISHED Published: 2023-12-07T15:59:19.821Z Last Updated: 2024-08-02T08:35:14.826Z Vendors: Devolutions Products: Workspace Description: Offline mode is always enabled, even if permission disallows it, in Devolutions Server data source in Devolutions Workspace 2023.3.2.0 and earlier. This allows an attacker with access to the Workspace application to access credentials when offline. Additional Analyst Notes: - CVE Program Container: References: - https://devolutions.net/security/advisories/DEVO-2023-0022/
CVE ID: CVE-2023-6591 State: PUBLISHED Published: 2024-02-12T16:06:00.145Z Last Updated: 2024-10-28T00:08:28.341Z Vendors: Unknown Products: Popup Box Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Popup Box WordPress plugin before 20.9.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/f296de1c-b70b-4829-aba7-4afa24f64c51/
CVE ID: CVE-2023-6592 State: PUBLISHED Published: 2024-01-16T15:57:01.390Z Last Updated: 2025-06-20T17:21:57.214Z Vendors: Unknown Products: FastDup Problem Types: CWE-200 Information Exposure Description: The FastDup WordPress plugin before 2.2 does not prevent directory listing in sensitive directories containing export files. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/a39bb807-b143-4863-88ff-1783e407d7d4/ - https://research.cleantalk.org/cve-2023-6592-fastdup-database-users-password-leak-poc-exploit/
CVE ID: CVE-2023-6593 State: PUBLISHED Published: 2023-12-12T14:32:56.806Z Last Updated: 2024-08-28T14:52:06.753Z Vendors: Devolutions Products: Remote Desktop Manager Description: Client side permission bypass in Devolutions Remote Desktop Manager 2023.3.4.0 and earlier on iOS allows an attacker that has access to the application to execute entries in a SQL data source without restriction. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://devolutions.net/security/advisories/DEVO-2023-0023/
CVE ID: CVE-2023-6594 State: PUBLISHED Published: 2024-01-09T02:34:50.547Z Last Updated: 2025-06-17T20:39:17.939Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: maxfoundry Products: WordPress Button Plugin MaxButtons Problem Types: CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) Description: The WordPress Button Plugin MaxButtons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 9.7.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inje
ut escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. Administrators can give button creation privileges to users with lower levels (contributor+) which would allow those lower-privileged users to carry out attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/cfe2cabd-98f6-4ebc-8a02-e6951202aa88?source=cve - https://plugins.trac.wo
.wordfence.com/threat-intel/vulnerabilities/id/cfe2cabd-98f6-4ebc-8a02-e6951202aa88?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3012872%40maxbuttons%2Ftrunk&old=2978023%40maxbuttons%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2023-6595 State: PUBLISHED Published: 2023-12-14T16:06:11.767Z Last Updated: 2024-10-16T14:37:37.331Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Progress Software Corporation Products: WhatsUp Gold Problem Types: CWE-306 Description: In WhatsUp Gold versions released before 2023.1, an API endpoint was found to be missing an authentication mechanism. It is possible for an unauthenticated attacker to enumerate ancillary credential information stored within WhatsUp Gold. Additional Analyst Notes: - CVE Program Container: References: - https://www.progress.com/network-monitoring - https://community.progress.com/s/article/WhatsUp-Gold-Security-Bull
ces: - https://www.progress.com/network-monitoring - https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-December-2023
CVE ID: CVE-2023-6596 State: PUBLISHED Published: 2024-04-25T16:00:24.215Z Last Updated: 2025-11-15T00:02:19.231Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Red Hat Products: Red Hat OpenShift Container Platform 4.11, Red Hat OpenShift Container Platform 4.12, Red Hat OpenShift Container Platform 4 Problem Types: CWE-400 Description: An incomplete fix was shipped for the Rapid Reset (CVE-2023-44487/CVE-2023-39325) vulnerability for an OpenShift Containers. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2024:0485 - https://access.redhat.com/errata/RHSA-2024:0682 - https://acce
nces: - https://access.redhat.com/errata/RHSA-2024:0485 - https://access.redhat.com/errata/RHSA-2024:0682 - https://access.redhat.com/security/cve/CVE-2023-6596 - https://bugzilla.redhat.com/show_bug.cgi?id=2253521
CVE ID: CVE-2023-6597 State: PUBLISHED Published: 2024-03-19T15:44:28.989Z Last Updated: 2025-11-03T21:50:47.799Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N) Vendors: Python Software Foundation Products: CPython Description: An issue was found in the CPython `tempfile.TemporaryDirectory` class affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior. The tempfile.TemporaryDirectory class would dereference symlinks during cleanup of permissions-related errors. This means users which can run privileged programs are potentially able to modify permissions of files referenced by symlinks in some circumstances. Additional Analyst Notes: - CISA ADP Vulnric
o modify permissions of files referenced by symlinks in some circumstances. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/python/cpython/commit/81c16cd94ec38d61aa478b9a452436dc3b1b524d - https://github.com/python/cpython/commit/6ceb8aeda504b079fef7a57b8d81472f15cdd9a5 - https://github.com/python/cpython/commit/5585334d772b253a01a6730e8202ffb1607c3d25 - https://github.com/python/cpython/commit/8eaeefe49d179ca4908d052745e3bb8b6f238f82 - https://github.com/python/cpython/commit/d54e22a669ae6e987199bb5d2c69bb5a46b0083b - https://github.com/python/cpython/commit/02a9259c717738dfe6b463c44d7e17f2b6d2cb3a - https://github.com/python/cpyt
83b - https://github.com/python/cpython/commit/02a9259c717738dfe6b463c44d7e17f2b6d2cb3a - https://github.com/python/cpython/issues/91133 - https://mail.python.org/archives/list/security-announce@python.org/thread/Q5C6ATFC67K53XFV4KE45325S7NS62LD/ - https://lists.debian.org/debian-lts-announce/2024/03/msg00025.html - http://www.openwall.com/lists/oss-security/2024/03/20/5 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T3IGRX54M7RNCQOXVQO5KQKTGWCOABIM/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U5VHWS52HGD743C47UMCSAK2A773M2YE/
CVE ID: CVE-2023-6598 State: PUBLISHED Published: 2024-01-11T08:33:02.864Z Last Updated: 2024-11-14T15:48:59.226Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: softaculous Products: SpeedyCache – Cache, Optimization, Performance Problem Types: CWE-862 Missing Authorization Description: The SpeedyCache plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the speedycache_save_varniship, speedycache_img_update_settings, speedycache_preloading_add_settings, and speedycache_preloading_delete_resource functions in all versions up to, and including, 1.1.3. This makes it possible for authenticated attackers,
ete_resource functions in all versions up to, and including, 1.1.3. This makes it possible for authenticated attackers, with subscriber-level access and above, to update plugin options. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/db8cfdba-f3b2-45dc-9be7-6f6374fd5f39?source=cve - https://plugins.trac.wordpress.org/changeset/3010577/speedycache
CVE ID: CVE-2023-6599 State: PUBLISHED Published: 2023-12-08T00:00:32.714Z Last Updated: 2024-08-02T08:35:14.759Z Severity: LOW (CVSS 3.1 CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: microweber Products: microweber/microweber Problem Types: CWE-544 Description: Missing Standardized Error Handling Mechanism in GitHub repository microweber/microweber prior to 2.0. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.com/bounties/6198785c-bf60-422e-9b80-68a6e658a10e - https://github.com/microweber/microweber/commit/f7eb9e1c6e801346f07f3b0164a01ac5f2ca5cfd
CVE ID: CVE-2023-6600 State: PUBLISHED Published: 2024-01-03T05:31:18.483Z Last Updated: 2025-06-03T14:44:18.802Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H) Vendors: daanvandenbergh Products: OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. Problem Types: CWE-862 Missing Authorization Description: The OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. plugin for WordPress is vulnerable to unauthorized modification of data and Stored Cross-Site Scripting due to a missing capability check on the update_settings() function hooked via admin_init in all versions up to, and including, 5.7.9. This makes it possible for unauthenticated attackers to update the
in_init in all versions up to, and including, 5.7.9. This makes it possible for unauthenticated attackers to update the plugin's settings which can be used to inject Cross-Site Scripting payloads and delete entire directories. PLease note there were several attempted patched, and we consider 5.7.10 to be the most sufficiently patched. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4e835b97-c066-4e8f-b99f-1a930105af0c?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3008876%40host-webfonts-local&new=3008876%40host-webfonts-local&sfp_email=&sfph_mail
sfp_email=&sfph_mail=&reponame=&old=3008876%40host-webfonts-local&new=3008876%40host-webfonts-local&sfp_email=&sfph_mail= - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3009010%40host-webfonts-local&new=3009010%40host-webfonts-local&sfp_email=&sfph_mail= - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3009453%40host-webfonts-local&new=3009453%40host-webfonts-local&sfp_email=&sfph_mail=
CVE ID: CVE-2023-6601 State: PUBLISHED Published: 2025-01-06T16:41:14.621Z Last Updated: 2025-11-03T19:29:00.544Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N) Problem Types: CWE-99 Description: A flaw was found in FFmpeg's HLS demuxer. This vulnerability allows bypassing unsafe file extension checks and triggering arbitrary demuxers via base64-encoded data URIs appended with specific file extensions. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2253172
CVE ID: CVE-2023-6602 State: PUBLISHED Published: 2024-12-31T14:20:07.379Z Last Updated: 2025-11-03T19:29:02.017Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Problem Types: CWE-99 Description: A flaw was found in FFmpeg's TTY Demuxer. This vulnerability allows possible data exfiltration via improper parsing of non-TTY-compliant input files in HLS playlists. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2334338
CVE ID: CVE-2023-6603 State: PUBLISHED Published: 2024-12-31T14:20:10.690Z Last Updated: 2025-08-21T16:04:01.868Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Problem Types: CWE-476 Description: A flaw was found in FFmpeg's HLS playlist parsing. This vulnerability allows a denial of service via a maliciously crafted HLS playlist that triggers a null pointer dereference during initialization. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2334335