Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-27879 State: PUBLISHED Published: 2023-11-14T19:04:56.352Z Last Updated: 2024-08-02T12:23:30.306Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N) Vendors: n/a Products: Intel(R) Optane(TM) SSD products Problem Types: information disclosure, CWE-284 Description: Improper access control in firmware for some Intel(R) Optane(TM) SSD products may allow an unauthenticated user to potentially enable information disclosure via physical access. Additional Analyst Notes: - CVE Program Container: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00758.html
CVE ID: CVE-2023-27881 State: PUBLISHED Published: 2023-06-07T21:48:50.037Z Last Updated: 2025-01-06T19:57:24.859Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: PTC Products: Vuforia Studio Problem Types: CWE-434 Description: A user could use the “Upload Resource” functionality to upload files to any location on the disk. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://https://www.cisa.gov/news-events/ics-advisories/icsa-23-131-13
CVE ID: CVE-2023-27882 State: PUBLISHED Published: 2023-11-14T09:14:52.532Z Last Updated: 2025-11-04T19:15:42.678Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Silicon Labs, Weston Embedded Products: Gecko Platform, Cesium NET, uC-HTTP Problem Types: CWE-122 Description: A heap-based buffer overflow vulnerability exists in the HTTP Server form boundary functionality of Weston Embedded uC-HTTP v3.01.01. A specially crafted network packet can lead to code execution. An attacker can send a malicious packet to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vul
itional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1733
CVE ID: CVE-2023-27886 State: PUBLISHED Published: 2023-03-28T20:04:07.830Z Last Updated: 2025-01-16T21:38:19.554Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: ProPump and Controls, Inc. Products: Osprey Pump Controller Problem Types: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') Description: Osprey Pump Controller version 1.01 is vulnerable to an unauthenticated OS command injection vulnerability. This can be exploited to inject and execute arbitrary shell commands through a HTTP POST parameter called by index.php script. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Refe
T parameter called by index.php script. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-082-06
CVE ID: CVE-2023-27887 State: PUBLISHED Published: 2023-08-11T02:37:19.659Z Last Updated: 2024-10-02T13:28:01.306Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:N) Vendors: n/a Products: Intel(R) NUCs Problem Types: information disclosure, CWE-665 Description: Improper initialization in BIOS firmware for some Intel(R) NUCs may allow a privileged user to potentially enable information disclosure via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00892.html
CVE ID: CVE-2023-27888 State: PUBLISHED Published: 2023-05-10T00:00:00.000Z Last Updated: 2025-01-27T21:04:26.907Z Vendors: SiteBridge Inc. Products: Joruri Gw Problem Types: Cross-site scripting Description: Cross-site scripting vulnerability in Joruri Gw Ver 3.2.5 and earlier allows a remote authenticated attacker to inject an arbitrary script via Message Memo function of the affected product. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://joruri-pwm.jp/org/docs/2022093000017/ - https://jvn.jp/en/jp/JVN87559956/
CVE ID: CVE-2023-27889 State: PUBLISHED Published: 2023-05-10T00:00:00.000Z Last Updated: 2025-01-27T21:03:28.233Z Vendors: LIQUID DESIGN Ltd. Products: LIQUID SPEECH BALLOON Problem Types: Cross-site request forgery Description: Cross-site request forgery (CSRF) vulnerability in LIQUID SPEECH BALLOON versions prior to 1.2 allows a remote unauthenticated attacker to hijack the authentication of a user and to perform unintended operations by having a user view a malicious page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/liquid-speech-balloon/#developers - https://jvn.jp/en/jp/JVN99657911/
CVE ID: CVE-2023-27890 State: PUBLISHED Published: 2023-04-14T00:00:00 Last Updated: 2024-08-02T12:23:30.574Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Export User plugin through 2.0 for MyBB allows XSS during the process of an admin generating DSGVO data for a user, via the Custom User Title, Location, or Bio field. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://community.mybb.com/mods.php?action=view&pid=1408 - https://community.mybb.com/user-121250.html - http://packetstormsecurity.com/files/171421/MyBB-Export-User-2.0-Cross
8 - https://community.mybb.com/user-121250.html - http://packetstormsecurity.com/files/171421/MyBB-Export-User-2.0-Cross-Site-Scripting.html
CVE ID: CVE-2023-27891 State: PUBLISHED Published: 2023-03-06T00:00:00.000Z Last Updated: 2025-03-06T15:17:33.590Z Vendors: n/a Products: n/a Problem Types: n/a Description: rami.io pretix before 4.17.1 allows OAuth application authorization from a logged-out session. The fixed versions are 4.15.1, 4.16.1, and 4.17.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://pretix.eu/about/en/blog/20230306-release-4171/
CVE ID: CVE-2023-27892 State: PUBLISHED Published: 2023-05-02T00:00:00.000Z Last Updated: 2025-01-30T16:42:38.016Z Severity: LOW (CVSS 3.8 CVSS:3.1/AC:H/AV:P/A:N/C:H/I:N/PR:H/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: Insufficient length checks in the ShapeShift KeepKey hardware wallet firmware before 7.7.0 allow a global buffer overflow via crafted messages. Flaws in cf_confirmExecTx() in ethereum_contracts.c can be used to reveal arbitrary microcontroller memory on the device screen or crash the device. With physical access to a PIN-unlocked device, attackers can extract the BIP39 mnemonic secret from the hardware wallet. Additional Analyst Notes: - CVE Program Co
ce, attackers can extract the BIP39 mnemonic secret from the hardware wallet. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/keepkey/keepkey-firmware/pull/337 - https://blog.inhq.net/posts/keepkey-CVE-2023-27892/
CVE ID: CVE-2023-27893 State: PUBLISHED Published: 2023-03-14T05:07:21.276Z Last Updated: 2025-02-27T18:01:10.927Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: SAP Products: Solution Manager and ABAP managed systems Problem Types: CWE-94 Description: An attacker authenticated as a user with a non-administrative role and a common remote execution authorization in SAP Solution Manager and ABAP managed systems (ST-PI) - versions 2088_1_700, 2008_1_710, 740, can use a vulnerable interface to execute an application function to perform actions which they would not normally be permitted to perform. Depending on the function executed, the attack can read or modify
hich they would not normally be permitted to perform. Depending on the function executed, the attack can read or modify any user or application data and can make the application unavailable. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://launchpad.support.sap.com/#/notes/3296476 - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
CVE ID: CVE-2023-27894 State: PUBLISHED Published: 2023-03-14T05:03:25.121Z Last Updated: 2025-02-27T18:03:47.806Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) Vendors: SAP Products: BusinessObjects Business Intelligence Platform (Web Services) Problem Types: CWE-200 Description: SAP BusinessObjects Business Intelligence Platform (Web Services) - versions 420, 430, allows an attacker to inject arbitrary values as CMS parameters to perform lookups on the internal network which is otherwise not accessible externally. On successful exploitation, attacker can scan internal network to determine internal infrastructure for further attacks like remote file inclusion, retri
ker can scan internal network to determine internal infrastructure for further attacks like remote file inclusion, retrieve server files, bypass firewall and force the vulnerable server to execute malicious requests, resulting in sensitive information disclosure. This causes limited impact on confidentiality of data. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://launchpad.support.sap.com/#/notes/3287120 - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
CVE ID: CVE-2023-27895 State: PUBLISHED Published: 2023-03-14T05:08:09.049Z Last Updated: 2025-02-27T17:59:07.047Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N) Vendors: SAP Products: Authenticator for Android Problem Types: CWE-267 Description: SAP Authenticator for Android - version 1.3.0, allows the screen to be captured, if an authorized attacker installs a malicious app on the mobile device. The attacker could extract the currently views of the OTP and the secret OTP alphanumeric token during the token setup. On successful exploitation, an attacker can read some sensitive information but cannot modify and delete the data. Additional Analyst Notes: - CVE Progra
tacker can read some sensitive information but cannot modify and delete the data. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://launchpad.support.sap.com/#/notes/3302710 - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
CVE ID: CVE-2023-27896 State: PUBLISHED Published: 2023-03-14T05:02:29.225Z Last Updated: 2025-02-27T18:04:36.525Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: SAP Products: BusinessObjects Business Intelligence Platform (Web Services) Problem Types: CWE-918 Description: In SAP BusinessObjects Business Intelligence Platform - version 420, 430, an attacker can control a malicious BOE server, forcing the application server to connect to its own CMS, leading to a high impact on availability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://launchpad.support.sap.com/#/notes/3287120 - https://www.sap.com/documen
: - CISA ADP Vulnrichment: References: - https://launchpad.support.sap.com/#/notes/3287120 - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
CVE ID: CVE-2023-27897 State: PUBLISHED Published: 2023-04-11T02:50:00.642Z Last Updated: 2025-02-07T16:54:50.000Z Severity: MEDIUM (CVSS 6 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L) Vendors: SAP Products: CRM Problem Types: CWE-94 Description: In SAP CRM - versions 700, 701, 702, 712, 713, an attacker who is authenticated with a non-administrative role and a common remote execution authorization can use a vulnerable interface to execute an application function to perform actions which they would not normally be permitted to perform. Depending on the function executed, the attack can can have limited impact on confidentiality and integrity of non-critical user or application data and appl
he attack can can have limited impact on confidentiality and integrity of non-critical user or application data and application availability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://launchpad.support.sap.com/#/notes/3309056 - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
CVE ID: CVE-2023-27898 State: PUBLISHED Published: 2023-03-08T17:14:48.437Z Last Updated: 2025-02-28T18:34:50.742Z Vendors: Jenkins Project Products: Jenkins Description: Jenkins 2.270 through 2.393 (both inclusive), LTS 2.277.1 through 2.375.3 (both inclusive) does not escape the Jenkins version a plugin depends on when rendering the error message stating its incompatibility with the current version of Jenkins, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to provide plugins to the configured update sites and have this message shown by Jenkins instances. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - h
shown by Jenkins instances. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-03-08/#SECURITY-3037
CVE ID: CVE-2023-27899 State: PUBLISHED Published: 2023-03-08T17:14:49.111Z Last Updated: 2025-02-28T18:36:45.296Z Vendors: Jenkins Project Products: Jenkins Description: Jenkins 2.393 and earlier, LTS 2.375.3 and earlier creates a temporary file in the default temporary directory with the default permissions for newly created files when uploading a plugin for installation, potentially allowing attackers with access to the Jenkins controller file system to read and write the file before it is used, potentially resulting in arbitrary code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-03-08/#SE
- CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-03-08/#SECURITY-2823
CVE ID: CVE-2023-27900 State: PUBLISHED Published: 2023-03-08T17:14:49.805Z Last Updated: 2025-02-28T18:43:28.521Z Vendors: Jenkins Project Products: Jenkins Description: Jenkins 2.393 and earlier, LTS 2.375.3 and earlier uses the Apache Commons FileUpload library without specifying limits for the number of request parts introduced in version 1.5 for CVE-2023-24998 in hudson.util.MultipartFormDataParser, allowing attackers to trigger a denial of service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-03-08/#SECURITY-3030
CVE ID: CVE-2023-27901 State: PUBLISHED Published: 2023-03-08T17:14:50.696Z Last Updated: 2025-02-28T18:45:56.466Z Vendors: Jenkins Project Products: Jenkins Description: Jenkins 2.393 and earlier, LTS 2.375.3 and earlier uses the Apache Commons FileUpload library without specifying limits for the number of request parts introduced in version 1.5 for CVE-2023-24998 in org.kohsuke.stapler.RequestImpl, allowing attackers to trigger a denial of service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-03-08/#SECURITY-3030
CVE ID: CVE-2023-27902 State: PUBLISHED Published: 2023-03-08T17:14:51.451Z Last Updated: 2025-02-28T18:48:21.844Z Vendors: Jenkins Project Products: Jenkins Description: Jenkins 2.393 and earlier, LTS 2.375.3 and earlier shows temporary directories related to job workspaces, which allows attackers with Item/Workspace permission to access their contents. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-03-08/#SECURITY-1807
CVE ID: CVE-2023-27903 State: PUBLISHED Published: 2023-03-08T17:14:52.143Z Last Updated: 2025-02-28T18:50:23.901Z Vendors: Jenkins Project Products: Jenkins Description: Jenkins 2.393 and earlier, LTS 2.375.3 and earlier creates a temporary file in the default temporary directory with the default permissions for newly created files when uploading a file parameter through the CLI, potentially allowing attackers with access to the Jenkins controller file system to read and write the file before it is used. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-03-08/#SECURITY-3058
CVE ID: CVE-2023-27904 State: PUBLISHED Published: 2023-03-08T17:14:52.848Z Last Updated: 2025-02-28T18:52:53.060Z Vendors: Jenkins Project Products: Jenkins Description: Jenkins 2.393 and earlier, LTS 2.375.3 and earlier prints an error stack trace on agent-related pages when agent connections are broken, potentially revealing information about Jenkins configuration that is otherwise inaccessible to attackers. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-03-08/#SECURITY-2120
CVE ID: CVE-2023-27905 State: PUBLISHED Published: 2023-03-08T17:14:53.560Z Last Updated: 2025-02-28T18:54:24.407Z Vendors: Jenkins Project Products: Jenkins update-center2 Description: Jenkins update-center2 3.13 and 3.14 renders the required Jenkins core version on plugin download index pages without sanitization, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to provide a plugin for hosting. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-03-08/#SECURITY-3063
CVE ID: CVE-2023-27906 State: PUBLISHED Published: 2023-04-17T00:00:00.000Z Last Updated: 2025-02-06T16:16:28.652Z Vendors: n/a Products: Autodesk Maya USD Plugin Problem Types: Out-of-bound Read Description: A malicious actor may convince a victim to open a malicious USD file that may trigger an out-of-bounds read vulnerability which may result in code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.autodesk.com/trust/security-advisories/adsk-sa-2023-0003
CVE ID: CVE-2023-27907 State: PUBLISHED Published: 2023-04-17T00:00:00.000Z Last Updated: 2025-02-06T16:14:36.702Z Vendors: n/a Products: Autodesk Maya USD Plugin Problem Types: Out-of-bound Write Description: A malicious actor may convince a victim to open a malicious USD file that may trigger an out-of-bounds write vulnerability which may result in code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.autodesk.com/trust/security-advisories/adsk-sa-2023-0003
CVE ID: CVE-2023-27908 State: PUBLISHED Published: 2023-06-23T00:00:00 Last Updated: 2024-12-05T17:07:26.875Z Vendors: n/a Products: Autodesk installer Problem Types: Privilege Escalation vulnerability. Description: A maliciously crafted DLL file can be forced to write beyond allocated boundaries in the Autodesk installer when parsing the DLL files and could lead to a Privilege Escalation vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.autodesk.com/trust/security-advisories/adsk-sa-2023-0010
CVE ID: CVE-2023-27909 State: PUBLISHED Published: 2023-04-17T00:00:00.000Z Last Updated: 2025-02-06T16:13:15.690Z Vendors: n/a Products: Autodesk FBX SDK Problem Types: Out-of-bound Write Description: An Out-Of-Bounds Write Vulnerability in Autodesk® FBX® SDK version 2020 or prior may lead to code execution through maliciously crafted FBX files or information disclosure. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.autodesk.com/trust/security-advisories/adsk-sa-2023-0004
CVE ID: CVE-2023-27910 State: PUBLISHED Published: 2023-04-17T00:00:00.000Z Last Updated: 2025-02-06T15:44:29.546Z Vendors: n/a Products: Autodesk FBX SDK Problem Types: Stack Buffer Overflow Description: A user may be tricked into opening a malicious FBX file that may exploit a stack buffer overflow vulnerability in Autodesk® FBX® SDK 2020 or prior which may lead to code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.autodesk.com/trust/security-advisories/adsk-sa-2023-0004
CVE ID: CVE-2023-27911 State: PUBLISHED Published: 2023-04-17T00:00:00.000Z Last Updated: 2025-02-06T15:33:38.280Z Vendors: n/a Products: Autodesk FBX SDK Problem Types: Heap Buffer Overflow Description: A user may be tricked into opening a malicious FBX file that may exploit a heap buffer overflow vulnerability in Autodesk® FBX® SDK 2020 or prior which may lead to code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.autodesk.com/trust/security-advisories/adsk-sa-2023-0004
CVE ID: CVE-2023-27912 State: PUBLISHED Published: 2023-04-14T00:00:00.000Z Last Updated: 2025-02-06T21:11:45.206Z Vendors: n/a Products: Autodesk AutoCAD Problem Types: Out-of-bound Read Description: A maliciously crafted X_B file when parsed through Autodesk® AutoCAD® 2023 can force an Out-of-Bound Read. A malicious actor can leverage this vulnerability to cause a crash or read sensitive data or execute arbitrary code in the context of the current process. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.autodesk.com/trust/security-advisories/adsk-sa-2023-0005
CVE ID: CVE-2023-27913 State: PUBLISHED Published: 2023-04-14T00:00:00.000Z Last Updated: 2025-02-06T21:11:00.882Z Vendors: n/a Products: Autodesk AutoCAD Problem Types: Integer Overflow Description: A maliciously crafted X_B file when parsed through Autodesk® AutoCAD® 2023 can be used to cause an Integer Overflow. A malicious actor can leverage this vulnerability to cause a crash or read sensitive data, or execute arbitrary code in the context of the current process. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.autodesk.com/trust/security-advisories/adsk-sa-2023-0005
CVE ID: CVE-2023-27914 State: PUBLISHED Published: 2023-04-14T00:00:00.000Z Last Updated: 2025-02-06T21:09:28.222Z Vendors: n/a Products: Autodesk AutoCAD Problem Types: Stack Buffer Overflow Description: A maliciously crafted X_B file when parsed through Autodesk® AutoCAD® 2023 can be used to write beyond the allocated buffer causing a Stack Buffer Overflow. A malicious actor can leverage this vulnerability to cause a crash or read sensitive data or execute arbitrary code in the context of the current process. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.autodesk.com/trust/security-advisories/adsk-sa-2023-0005
CVE ID: CVE-2023-27915 State: PUBLISHED Published: 2023-04-14T00:00:00.000Z Last Updated: 2025-02-06T21:10:15.303Z Vendors: n/a Products: Autodesk AutoCAD Problem Types: Memory Corruption Read Description: A maliciously crafted X_B file when parsed through Autodesk® AutoCAD® 2023 could lead to memory corruption vulnerability by read access violation. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.autodesk.com/trust/security-advisories/adsk-sa-2023-0005
CVE ID: CVE-2023-27916 State: PUBLISHED Published: 2023-06-06T16:39:46.317Z Last Updated: 2025-01-07T18:34:58.614Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Horner Automation Products: Cscape, Cscape EnvisionRV Problem Types: CWE-125 Description: The affected application lacks proper validation of user-supplied data when parsing font files (e.g., FNT). This could lead to an out-of-bounds read. An attacker could leverage this vulnerability to potentially execute arbitrary code in the context of the current process. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa
es: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-143-04