Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-50372 State: PUBLISHED Published: 2023-12-18T10:15:28.593Z Last Updated: 2024-11-20T20:44:16.366Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Hiroaki Miyashita Products: Custom Post Type Page Template Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Hiroaki Miyashita Custom Post Type Page Template.This issue affects Custom Post Type Page Template: from n/a through 1.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/custom-post-type-page-template/wordpress-custom-post-type-page-template-plugin-1-1-cross-site-reque
tabase/vulnerability/custom-post-type-page-template/wordpress-custom-post-type-page-template-plugin-1-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-50373 State: PUBLISHED Published: 2024-12-09T11:29:59.811Z Last Updated: 2024-12-09T16:58:46.207Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: WPSAAD Products: Alt Manager Problem Types: CWE-862 Description: Missing Authorization vulnerability in WPSAAD Alt Manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Alt Manager: from n/a through 1.6.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/alt-manager/vulnerability/wordpress-alt-manager-plugin-1-5-9-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2023-50374 State: PUBLISHED Published: 2024-03-28T06:31:13.919Z Last Updated: 2024-08-02T22:16:46.888Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: NiteoThemes Products: CMP – Coming Soon & Maintenance Problem Types: CWE-918 Description: Server-Side Request Forgery (SSRF) vulnerability in NiteoThemes CMP – Coming Soon & Maintenance.This issue affects CMP – Coming Soon & Maintenance: from n/a through 4.1.10. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/cmp-coming-soon-maintenance/wordpress-cmp-coming-soon-maintenance-plugin-by-niteothemes-plugin-4-1-10-se
e/vulnerability/cmp-coming-soon-maintenance/wordpress-cmp-coming-soon-maintenance-plugin-by-niteothemes-plugin-4-1-10-server-side-request-forgery-ssrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-50375 State: PUBLISHED Published: 2024-12-09T11:29:58.984Z Last Updated: 2024-12-09T17:04:02.363Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: Translate AI Multilingual Solutions Products: Google Language Translator Problem Types: CWE-862 Description: Missing Authorization vulnerability in Translate AI Multilingual Solutions Google Language Translator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Google Language Translator: from n/a through 6.0.19. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/google-language-translator/vulnera
CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/google-language-translator/vulnerability/wordpress-translate-wordpress-google-language-translator-plugin-6-0-19-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2023-50376 State: PUBLISHED Published: 2023-12-19T08:27:46.189Z Last Updated: 2024-08-02T22:16:46.968Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: smp7, wp.insider Products: Simple Membership Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in smp7, wp.Insider Simple Membership allows Reflected XSS.This issue affects Simple Membership: from n/a through 4.3.8. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/simple-membership/wordpress-simple-membership-plugin-4-3-8-reflected-cross-site-scripting-xss-
om/database/vulnerability/simple-membership/wordpress-simple-membership-plugin-4-3-8-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-50377 State: PUBLISHED Published: 2023-12-21T14:30:19.186Z Last Updated: 2024-08-02T22:16:46.650Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: AB-WP Products: Simple Counter Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AB-WP Simple Counter allows Stored XSS.This issue affects Simple Counter: from n/a through 1.0.2. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/abwp-simple-counter/wordpress-simple-counter-plugin-1-0-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-50378 State: PUBLISHED Published: 2024-03-01T14:38:29.732Z Last Updated: 2024-11-07T16:03:03.744Z Vendors: Apache Software Foundation Products: Apache Ambari Problem Types: CWE-79 Description: Lack of proper input validation and constraint enforcement in Apache Ambari prior to 2.7.8 Impact : As it will be stored XSS, Could be exploited to perform unauthorized actions, varying from data access to session hijacking and delivering malicious payloads. Users are recommended to upgrade to version 2.7.8 which fixes this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://lists.apache.org/thread/6hn0thq743vz9gh283s2d87wz8tqh37c
CVE ID: CVE-2023-50379 State: PUBLISHED Published: 2024-02-27T08:27:03.120Z Last Updated: 2025-02-13T17:19:25.008Z Vendors: Apache Software Foundation Products: Apache Ambari Problem Types: CWE-94 Description: Malicious code injection in Apache Ambari in prior to 2.7.8. Users are recommended to upgrade to version 2.7.8, which fixes this issue. Impact: A Cluster Operator can manipulate the request by adding a malicious code injection and gain a root over the cluster main host. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/jglww6h6ngxpo1r6r5fx7ff7z29lnvv8 - http://www.openwall.com/lists/oss-security/2024/02/27/1
CVE ID: CVE-2023-50380 State: PUBLISHED Published: 2024-02-27T16:51:33.978Z Last Updated: 2025-03-27T19:53:06.868Z Vendors: Apache Software Foundation Products: Apache Ambari Problem Types: CWE-611 Description: XML External Entity injection in apache ambari versions <= 2.7.7, Users are recommended to upgrade to version 2.7.8, which fixes this issue. More Details: Oozie Workflow Scheduler had a vulnerability that allowed for root-level file reading and privilege escalation from low-privilege users. The vulnerability was caused through lack of proper user input validation. This vulnerability is known as an XML External Entity (XXE) injection attack. Attackers can exploit XXE vulnerabilities to
is vulnerability is known as an XML External Entity (XXE) injection attack. Attackers can exploit XXE vulnerabilities to read arbitrary files on the server, including sensitive system files. In theory, it might be possible to use this to escalate privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/qrt7mq7v7zyrh1qsh1gkg1m7clysvy32 - http://www.openwall.com/lists/oss-security/2024/02/27/6
CVE ID: CVE-2023-50381 State: PUBLISHED Published: 2024-07-08T15:22:23.481Z Last Updated: 2025-11-04T17:13:31.458Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: LevelOne, Realtek Products: WBR-6013, rtl819x Jungle SDK Problem Types: CWE-78 Description: Three os command injection vulnerabilities exist in the boa formWsc functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted series of HTTP requests can lead to arbitrary command execution. An attacker can send a series of HTTP requests to trigger these vulnerabilities.This command injection is related to the `targetAPSsid` request's parameter. Additional Analyst Notes: - CISA ADP Vulnrichment:
mmand injection is related to the `targetAPSsid` request's parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1899
CVE ID: CVE-2023-50382 State: PUBLISHED Published: 2024-07-08T15:22:23.599Z Last Updated: 2025-11-04T17:13:32.830Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: LevelOne, Realtek Products: WBR-6013, rtl819x Jungle SDK Problem Types: CWE-78 Description: Three os command injection vulnerabilities exist in the boa formWsc functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted series of HTTP requests can lead to arbitrary command execution. An attacker can send a series of HTTP requests to trigger these vulnerabilities.This command injection is related to the `peerPin` request's parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: - CV
mmand injection is related to the `peerPin` request's parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1899
CVE ID: CVE-2023-50383 State: PUBLISHED Published: 2024-07-08T15:22:23.701Z Last Updated: 2025-11-04T17:13:34.217Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: LevelOne, Realtek Products: WBR-6013, rtl819x Jungle SDK Problem Types: CWE-78 Description: Three os command injection vulnerabilities exist in the boa formWsc functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted series of HTTP requests can lead to arbitrary command execution. An attacker can send a series of HTTP requests to trigger these vulnerabilities.This command injection is related to the `localPin` request's parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: - C
mmand injection is related to the `localPin` request's parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1899
CVE ID: CVE-2023-50386 State: PUBLISHED Published: 2024-02-09T17:28:51.290Z Last Updated: 2025-04-24T15:47:50.228Z Vendors: Apache Software Foundation Products: Apache Solr Problem Types: CWE-434, CWE-913 Description: Improper Control of Dynamically-Managed Code Resources, Unrestricted Upload of File with Dangerous Type, Inclusion of Functionality from Untrusted Control Sphere vulnerability in Apache Solr.This issue affects Apache Solr: from 6.0.0 through 8.11.2, from 9.0.0 before 9.4.1. In the affected versions, Solr ConfigSets accepted Java jar and class files to be uploaded through the ConfigSets API. When backing up Solr Collections, these configSet files would be saved to disk when usin
ded through the ConfigSets API. When backing up Solr Collections, these configSet files would be saved to disk when using the LocalFileSystemRepository (the default for backups). If the backup was saved to a directory that Solr uses in its ClassPath/ClassLoaders, then the jar and class files would be available to use with any ConfigSet, trusted or untrusted. When Solr is run in a secure way (Authorization enabled), as is strongly suggested, this vulnerability is limited to extending the Backup permissions with the ability to add libraries. Users are recommended to upgrade to version 8.11.3 or 9.4.1, which fix the issue. In these versions, the following protections have been added: * Users ar
o version 8.11.3 or 9.4.1, which fix the issue. In these versions, the following protections have been added: * Users are no longer able to upload files to a configSet that could be executed via a Java ClassLoader. * The Backup API restricts saving backups to directories that are used in the ClassLoader. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://solr.apache.org/security.html#cve-2023-50386-apache-solr-backuprestore-apis-allow-for-deployment-of-executables-in-malicious-configsets - http://www.openwall.com/lists/oss-security/2024/02/09/1
CVE ID: CVE-2023-50387 State: PUBLISHED Published: 2024-02-14T00:00:00.000Z Last Updated: 2025-11-04T18:20:34.949Z Vendors: n/a Products: n/a Problem Types: n/a Description: Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the "KeyTrap" issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG records. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ath
RRSIG records. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.athene-center.de/aktuelles/key-trap - https://nlnetlabs.nl/news/2024/Feb/13/unbound-1.19.1-released/ - https://kb.isc.org/docs/cve-2023-50387 - https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2024-01.html - https://www.theregister.com/2024/02/13/dnssec_vulnerability_internet/ - https://news.ycombinator.com/item?id=39367411 - https://www.securityweek.com/keytrap-dns-attack-could-disable-large-parts-of-internet-researchers/ - https://www.isc.org/blogs/2024-bind-security-release/ - https://news.ycombinator.com/item?id=39372384 - https://gitlab.nic.cz/knot
w.isc.org/blogs/2024-bind-security-release/ - https://news.ycombinator.com/item?id=39372384 - https://gitlab.nic.cz/knot/knot-resolver/-/releases/v5.7.1 - https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2024q1/017430.html - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-50387 - https://access.redhat.com/security/cve/CVE-2023-50387 - https://bugzilla.suse.com/show_bug.cgi?id=1219823 - https://www.athene-center.de/fileadmin/content/PDF/Technical_Report_KeyTrap.pdf - http://www.openwall.com/lists/oss-security/2024/02/16/2 - http://www.openwall.com/lists/oss-security/2024/02/16/3 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/
ts/oss-security/2024/02/16/3 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SVYA42BLXUCIDLD35YIJPJSHDIADNYMP/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BUIP7T7Z4T3UHLXFWG6XIVDP4GYPD3AI/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PNNHZSZPG2E7NBMBNYPGHCFI4V4XRWNQ/ - https://lists.debian.org/debian-lts-announce/2024/02/msg00006.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TEXGOYGW7DBS3N2QSSQONZ4ENIRQEAPG/ - https://lists.fedoraproject.org/archives/list/package-announce%40lis
ect.org/message/TEXGOYGW7DBS3N2QSSQONZ4ENIRQEAPG/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQESRWMJCF4JEYJEAKLRM6CT55GLJAB7/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RGS7JN6FZXUSTC2XKQHH27574XOULYYJ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HVRDSJVZKMCXKKPP6PNR62T7RWZ3YSDZ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6FV5O347JTX7P5OZA6NGO4MKTXRXMKOZ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IGSLGKUAQTW5JPPZCMF
/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IGSLGKUAQTW5JPPZCMF5YPEYALLRUZZ6/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZDZFMEKQTZ4L7RY46FCENWFB5MDT263R/ - https://security.netapp.com/advisory/ntap-20240307-0007/ - https://lists.debian.org/debian-lts-announce/2024/05/msg00011.html
CVE ID: CVE-2023-50395 State: PUBLISHED Published: 2024-02-06T15:59:48.664Z Last Updated: 2025-06-13T15:09:53.712Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: SolarWinds Products: SolarWinds Platform Problem Types: CWE-89 Description: SQL Injection Remote Code Execution Vulnerability was found using an update statement in the SolarWinds Platform. This vulnerability requires user authentication to be exploited Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.solarwinds.com/trust-center/security-advisories/CVE-2023-50395 - https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_n
urity-advisories/CVE-2023-50395 - https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2024-1_release_notes.htm
CVE ID: CVE-2023-50422 State: PUBLISHED Published: 2023-12-12T01:31:17.991Z Last Updated: 2024-09-28T22:17:43.519Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: SAP_SE Products: cloud-security-services-integration-library Problem Types: CWE-749 Description: SAP BTP Security Services Integration Library ([Java] cloud-security-services-integration-library) - versions below 2.17.0 and versions from 3.0.0 to before 3.3.0, allow under certain conditions an escalation of privileges. On successful exploitation, an unauthenticated attacker can obtain arbitrary permissions within the application. Additional Analyst Notes: - CVE Program Container: References: - ht
obtain arbitrary permissions within the application. Additional Analyst Notes: - CVE Program Container: References: - https://me.sap.com/notes/3411067 - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html - https://github.com/SAP/cloud-security-services-integration-library/ - https://mvnrepository.com/artifact/com.sap.cloud.security/java-security - https://mvnrepository.com/artifact/com.sap.cloud.security/spring-security - https://mvnrepository.com/artifact/com.sap.cloud.security.xsuaa/spring-xsuaa - https://blogs.sap.com/2023/12/12/unveiling-critical-security-updates-sap-btp-security-note-3411067/ - https://github.com/SAP/cloud-security-services-integration-libra
tical-security-updates-sap-btp-security-note-3411067/ - https://github.com/SAP/cloud-security-services-integration-library/security/advisories/GHSA-59c9-pxq8-9c73 - https://me.sap.com/notes/3413475
CVE ID: CVE-2023-50423 State: PUBLISHED Published: 2023-12-12T01:52:44.999Z Last Updated: 2024-09-28T22:18:31.778Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: SAP_SE Products: sap-xssec Problem Types: CWE-749 Description: SAP BTP Security Services Integration Library ([Python] sap-xssec) - versions < 4.1.0, allow under certain conditions an escalation of privileges. On successful exploitation, an unauthenticated attacker can obtain arbitrary permissions within the application. Additional Analyst Notes: - CVE Program Container: References: - https://me.sap.com/notes/3411067 - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.htm
ces: - https://me.sap.com/notes/3411067 - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html - https://pypi.org/project/sap-xssec/ - https://blogs.sap.com/2023/12/12/unveiling-critical-security-updates-sap-btp-security-note-3411067/ - https://github.com/SAP/cloud-pysec/security/advisories/GHSA-6mjg-37cp-42x5 - https://github.com/SAP/cloud-pysec/
CVE ID: CVE-2023-50424 State: PUBLISHED Published: 2023-12-12T01:59:36.703Z Last Updated: 2024-09-28T22:19:05.889Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: SAP_SE Products: github.com/sap/cloud-security-client-go Problem Types: CWE-749 Description: SAP BTP Security Services Integration Library ([Golang] github.com/sap/cloud-security-client-go) - versions < 0.17.0, allow under certain conditions an escalation of privileges. On successful exploitation, an unauthenticated attacker can obtain arbitrary permissions within the application. Additional Analyst Notes: - CVE Program Container: References: - https://me.sap.com/notes/3411067 - https://www.sap.c
n. Additional Analyst Notes: - CVE Program Container: References: - https://me.sap.com/notes/3411067 - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html - https://github.com/SAP/cloud-security-client-go - https://pkg.go.dev/github.com/sap/cloud-security-client-go@v0.17.0 - https://blogs.sap.com/2023/12/12/unveiling-critical-security-updates-sap-btp-security-note-3411067/ - https://github.com/SAP/cloud-security-services-integration-library/security/advisories/GHSA-59c9-pxq8-9c73
CVE ID: CVE-2023-50428 State: PUBLISHED Published: 2023-12-09T00:00:00 Last Updated: 2024-08-02T22:16:46.327Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Bitcoin Core through 26.0 and Bitcoin Knots before 25.1.knots20231115, datacarrier size limits can be bypassed by obfuscating data as code (e.g., with OP_FALSE OP_IF), as exploited in the wild by Inscriptions in 2022 and 2023. NOTE: although this is a vulnerability from the perspective of the Bitcoin Knots project, some others consider it "not a bug." Additional Analyst Notes: - CVE Program Container: References: - https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures - https://twitter.com/LukeDashjr/status/17322
erences: - https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures - https://twitter.com/LukeDashjr/status/1732204937466032285 - https://github.com/bitcoin/bitcoin/pull/28408#issuecomment-1844981799 - https://github.com/bitcoinknots/bitcoin/blob/aed49ce8989334c364a219a6eb016a3897d4e3d7/doc/release-notes.md - https://github.com/bitcoin/bitcoin/tags - https://github.com/bitcoin/bitcoin/blob/65c05db660b2ca1d0076b0d8573a6760b3228068/src/kernel/mempool_options.h#L46-L53
CVE ID: CVE-2023-50429 State: PUBLISHED Published: 2023-12-09T00:00:00 Last Updated: 2024-08-02T22:16:46.866Z Vendors: n/a Products: n/a Problem Types: n/a Description: IzyBat Orange casiers before 20230803_1 allows getEnsemble.php ensemble SQL injection. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/orangecertcc/security-research/security/advisories/GHSA-mc3w-rv8p-f9xf
CVE ID: CVE-2023-50430 State: PUBLISHED Published: 2023-12-09T00:00:00 Last Updated: 2024-08-02T22:16:46.671Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Goodix Fingerprint Device, as shipped in Dell Inspiron 15 computers, does not follow the Secure Device Connection Protocol (SDCP) when enrolling via Linux, and accepts an unauthenticated configuration packet to select the Windows template database, which allows bypass of Windows Hello authentication by enrolling an attacker's fingerprint. Additional Analyst Notes: - CVE Program Container: References: - https://blackwinghq.com/blog/posts/a-touch-of-pwn-part-i/
CVE ID: CVE-2023-50431 State: PUBLISHED Published: 2023-12-09T00:00:00 Last Updated: 2024-08-02T22:16:46.637Z Vendors: n/a Products: n/a Problem Types: n/a Description: sec_attest_info in drivers/accel/habanalabs/common/habanalabs_ioctl.c in the Linux kernel through 6.6.5 allows an information leak to user space because info->pad0 is not initialized. Additional Analyst Notes: - CVE Program Container: References: - https://lists.freedesktop.org/archives/dri-devel/2023-November/431772.html - https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=a9f07790a4b2250f0140e9a61c7f842fd9b618c7
CVE ID: CVE-2023-50432 State: PUBLISHED Published: 2024-04-29T00:00:00 Last Updated: 2024-11-20T16:08:51.724Z Vendors: n/a Products: n/a Problem Types: n/a Description: simple-dhcp-server through ec976d2 allows remote attackers to cause a denial of service (daemon crash) by sending a DHCP packet without any option fields, which causes free_packet in dhcp_packet.c to dereference a NULL pointer. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://papers.mathyvanhoef.com/esorics2024.pdf