Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-3064 State: PUBLISHED Published: 2023-06-05T08:24:53.735Z Last Updated: 2025-01-08T17:22:09.745Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Mobatime Products: Mobatime mobile application AMXGT100 Problem Types: CWE-200 Description: Anonymous user may get the list of existing users managed by the application, that could ease further attacks (see CVE-2023-3065 and 3066)This issue affects Mobatime mobile application AMXGT100 through 1.3.20. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://borelenzo.github.io/stuff/2023/06/02/cve-2023-3064_65_66.html
CVE ID: CVE-2023-3065 State: PUBLISHED Published: 2023-06-05T08:27:33.950Z Last Updated: 2025-01-08T17:21:15.239Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: Mobatime Products: Mobatime mobile application AMXGT100 Problem Types: CWE-287 Description: Improper Authentication vulnerability in Mobatime mobile application AMXGT100 allows Authentication Bypass.This issue affects Mobatime mobile application AMXGT100 through 1.3.20. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://borelenzo.github.io/stuff/2023/06/02/cve-2023-3064_65_66.html
CVE ID: CVE-2023-3066 State: PUBLISHED Published: 2023-06-05T08:27:49.960Z Last Updated: 2025-01-08T17:20:37.222Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: Mobatime Products: Mobatime mobile application AMXGT100 Problem Types: CWE-863 Description: Incorrect Authorization vulnerability in Mobatime mobile application AMXGT100 allows a low-privileged user to impersonate anyone else, including administratorsThis issue affects Mobatime mobile application AMXGT100: through 1.3.20. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://borelenzo.github.io/stuff/2023/06/02/cve-2023-3064_65_66.html
CVE ID: CVE-2023-3067 State: PUBLISHED Published: 2023-06-02T00:00:00 Last Updated: 2025-01-08T19:46:14.208Z Severity: MEDIUM (CVSS 4.6 CVSS:3.0/AV:A/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: zadam Products: zadam/trilium Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository zadam/trilium prior to 0.59.4. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/4772ceb7-1594-414d-9b20-5b82029da7b6 - https://github.com/zadam/trilium/commit/4c3fcc3ea6f37debcb87ac1a7f5698c27be0e67b
CVE ID: CVE-2023-3068 State: PUBLISHED Published: 2023-06-02T15:31:03.441Z Last Updated: 2024-11-22T17:59:06.672Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Campcodes Products: Retro Cellphone Online Store Problem Types: CWE-89 Description: A vulnerability classified as critical has been found in Campcodes Retro Cellphone Online Store 1.0. Affected is an unknown function of the file /admin/modal_add_product.php. The manipulation of the argument category leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-230580. Additional Analyst Notes: - CVE Program
the public and may be used. The identifier of this vulnerability is VDB-230580. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.230580 - https://vuldb.com/?ctiid.230580 - https://github.com/wordpress405/cve/blob/main/Retro%20Cellphone%20Online%20Store.pdf
CVE ID: CVE-2023-3069 State: PUBLISHED Published: 2023-06-02T00:00:00 Last Updated: 2025-01-08T19:45:21.161Z Severity: HIGH (CVSS 7.6 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H) Vendors: tsolucio Products: tsolucio/corebos Problem Types: CWE-620 Description: Unverified Password Change in GitHub repository tsolucio/corebos prior to 8. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/00544982-365a-476b-b5fe-42f02f11d367 - https://github.com/tsolucio/corebos/commit/e3dabd74c68646bb54538d66411fc1e633ec454b
CVE ID: CVE-2023-3070 State: PUBLISHED Published: 2023-06-02T00:00:00 Last Updated: 2025-01-08T19:44:43.226Z Severity: HIGH (CVSS 7.6 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H) Vendors: tsolucio Products: tsolucio/corebos Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository tsolucio/corebos prior to 8. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/e193068e-0b95-403a-8453-e015241b8f1b - https://github.com/tsolucio/corebos/commit/b3a7a26c60117d7859b8d77b57fd5771a038c93a
CVE ID: CVE-2023-3071 State: PUBLISHED Published: 2023-06-02T00:00:00 Last Updated: 2025-01-08T19:44:10.044Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:H/A:L) Vendors: tsolucio Products: tsolucio/corebos Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository tsolucio/corebos prior to 8. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/3e8d5166-9bc6-46e7-94a8-cad52434a39e - https://github.com/tsolucio/corebos/commit/5e87fbc4292cf7a96fa5139ede88f4baefad104b
CVE ID: CVE-2023-3072 State: PUBLISHED Published: 2023-07-19T23:34:56.155Z Last Updated: 2024-10-17T14:10:16.427Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:L) Vendors: HashiCorp Products: Nomad, Nomad Enterprise Problem Types: CWE-266 Description: HashiCorp Nomad and Nomad Enterprise 0.7.0 up to 1.5.6 and 1.4.10 ACL policies using a block without a label generates unexpected results. Fixed in 1.6.0, 1.5.7, and 1.4.11. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://discuss.hashicorp.com/t/hcsec-2023-20-nomad-acl-policies-without-label-are-applied-to-unexpected-resources/56270
CVE ID: CVE-2023-3073 State: PUBLISHED Published: 2023-06-02T00:00:00 Last Updated: 2025-01-08T19:43:15.218Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: tsolucio Products: tsolucio/corebos Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository tsolucio/corebos prior to 8 via evvtgendoc. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/tsolucio/corebos/commit/e87f77c64061b43186c80ad1b50d313c67d7f6cf - https://huntr.dev/bounties/a4d6a082-2ea8-49a5-8e48-6d39b5cc62e1
CVE ID: CVE-2023-3074 State: PUBLISHED Published: 2023-06-02T00:00:00 Last Updated: 2025-01-08T19:39:55.237Z Severity: HIGH (CVSS 8.6 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L) Vendors: tsolucio Products: tsolucio/corebos Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository tsolucio/corebos prior to 8. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/6132f557-3f0f-465d-990f-4329313349a4 - https://github.com/tsolucio/corebos/commit/659e328c06a127249e651100d2bc7ec1d2dd8533
CVE ID: CVE-2023-3075 State: PUBLISHED Published: 2023-06-02T00:00:00.000Z Last Updated: 2025-02-06T21:28:54.994Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: tsolucio Products: tsolucio/corebos Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) in GitHub repository tsolucio/corebos prior to 8. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/0f5448a6-d551-424f-887d-80f9bcfaa6e4 - https://github.com/tsolucio/corebos/commit/2e415fb4613bc4122578dad5f40c6f819c228a48
CVE ID: CVE-2023-3076 State: PUBLISHED Published: 2023-07-10T12:40:16.209Z Last Updated: 2024-11-12T14:06:15.649Z Vendors: Unknown Products: MStore API Problem Types: CWE-862 Missing Authorization Description: The MStore API WordPress plugin before 3.9.9 does not prevent visitors from creating user accounts with the role of their choice via their wholesale REST API endpoint. This is only exploitable if the site owner paid to access the plugin's pro features. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/ac662436-29d7-4ea6-84e1-f9e229b44f5b
CVE ID: CVE-2023-3077 State: PUBLISHED Published: 2023-07-10T12:40:19.779Z Last Updated: 2024-11-12T14:05:29.463Z Vendors: Unknown Products: MStore API Problem Types: CWE-89 SQL Injection Description: The MStore API WordPress plugin before 3.9.8 does not sanitise and escape a parameter before using it in a SQL statement, leading to a Blind SQL injection exploitable by unauthenticated users. This is only exploitable if the site owner elected to pay to get access to the plugins' pro features, and uses the woocommerce-appointments plugin. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/9480d0b5-97da-467d-98f6-71a32599a43
m Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/9480d0b5-97da-467d-98f6-71a32599a432
CVE ID: CVE-2023-3078 State: PUBLISHED Published: 2023-08-17T16:47:36.274Z Last Updated: 2024-10-08T16:26:10.567Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Lenovo Products: Universal Device Client (UDC) Problem Types: CWE-427 Description: An uncontrolled search path vulnerability was reported in the Lenovo Universal Device Client (UDC) that could allow an attacker with local access to execute code with elevated privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.lenovo.com/us/en/product_security/LEN-121183
CVE ID: CVE-2023-3079 State: PUBLISHED Published: 2023-06-05T21:40:06.622Z Last Updated: 2025-10-21T23:05:46.769Z Vendors: Google Products: Chrome Problem Types: Type Confusion Description: Type confusion in V8 in Google Chrome prior to 114.0.5735.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2023/06/stable-channel-update-for-desktop.html - https://crbug.com/1450481 - https://www.couchbase.com/alerts/ - https://www.debian.org/security/2023/dsa-5420 - https://lists.fedoraproject.org/ar
- https://www.couchbase.com/alerts/ - https://www.debian.org/security/2023/dsa-5420 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DYTXO5E3FI3I2ETDP3HF4SHYYTFMKMIC/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U4OXTNIZY4JYHJT7CVLPAJQILI6BISVM/ - https://security.gentoo.org/glsa/202311-11 - http://packetstormsecurity.com/files/176211/Chrome-V8-Type-Confusion.html - http://packetstormsecurity.com/files/176212/Chrome-V8-Type-Confusion-New-Sandbox-Escape.html - https://security.gentoo.org/glsa/202401-34
CVE ID: CVE-2023-3080 State: PUBLISHED Published: 2023-07-12T04:38:42.645Z Last Updated: 2024-08-02T06:41:04.267Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: wardee Products: Mail logging – WP Mail Catcher Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The WP Mail Catcher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an email subject in versions up to, and including, 2.1.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user acc
it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1525e1c9-4b94-4f9f-92c5-fc69fe000771?source=cve - https://plugins.trac.wordpress.org/changeset/2924014/wp-mail-catcher
CVE ID: CVE-2023-3081 State: PUBLISHED Published: 2023-07-12T04:38:51.671Z Last Updated: 2025-02-05T19:39:49.807Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: smub Products: WP Mail Logging Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The WP Mail Logging plugin for WordPress is vulnerable to Stored Cross-Site Scripting via email contents in versions up to, and including, 1.11.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected
authenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Note: An incomplete fix was released in 1.11.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ef20b3e6-d8f4-458e-b604-b46ef16e229e?source=cve - https://plugins.trac.wordpress.org/changeset/2923464/wp-mail-logging - https://plugins.trac.wordpress.org/changeset/2925728/wp-mail-logging
CVE ID: CVE-2023-3082 State: PUBLISHED Published: 2023-07-12T04:38:45.662Z Last Updated: 2025-02-05T19:40:54.881Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: wpexpertsio Products: POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Post SMTP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via email contents in versions up to, and including, 2.5.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrar
fficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6ecd0fa6-4fdb-4780-9560-0bb126800685?source=cve - https://plugins.trac.wordpress.org/changeset/2935537/post-smtp
CVE ID: CVE-2023-3083 State: PUBLISHED Published: 2023-06-03T00:00:00.000Z Last Updated: 2025-02-12T16:36:15.488Z Severity: MEDIUM (CVSS 6.1 CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N) Vendors: nilsteampassnet Products: nilsteampassnet/teampass Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.9. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/c6b29e46-02e0-43ad-920f-28ac482ea2ab - https://github.com/nilsteampassnet/teampass/commit/79731553fa305d45dabb7a227f3074d56d7c94c1
CVE ID: CVE-2023-3084 State: PUBLISHED Published: 2023-06-03T00:00:00 Last Updated: 2025-01-08T17:48:56.372Z Severity: HIGH (CVSS 8.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) Vendors: nilsteampassnet Products: nilsteampassnet/teampass Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.9. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/4b86b56b-c51b-4be8-8ee4-6e385d1e9e8a - https://github.com/nilsteampassnet/teampass/commit/61b9b7d4e33bbaad2cd61a7ee988f9c22298bf1a
CVE ID: CVE-2023-3085 State: PUBLISHED Published: 2023-06-03T10:31:02.697Z Last Updated: 2024-08-02T06:41:04.097Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: X-WRT Products: luci Problem Types: CWE-79 Description: A vulnerability, which was classified as problematic, has been found in X-WRT luci up to 22.10_b202303061504. This issue affects the function run_action of the file modules/luci-base/ucode/dispatcher.uc of the component 404 Error Template Handler. The manipulation of the argument request_path leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 22.10_b202303121313 is able to address this issue. The patch is named 24d7da2416b9ab246
d remotely. Upgrading to version 22.10_b202303121313 is able to address this issue. The patch is named 24d7da2416b9ab246825c33c213fe939a89b369c. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-230663. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.230663 - https://vuldb.com/?ctiid.230663 - https://github.com/x-wrt/luci/commit/24d7da2416b9ab246825c33c213fe939a89b369c - https://github.com/x-wrt/luci/releases/tag/22.10_b202303121313
CVE ID: CVE-2023-3086 State: PUBLISHED Published: 2023-06-03T00:00:00 Last Updated: 2025-01-08T19:57:14.018Z Severity: CRITICAL (CVSS 9 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: nilsteampassnet Products: nilsteampassnet/teampass Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.9. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/17be9e8a-abe8-41db-987f-1d5b0686ae20 - https://github.com/nilsteampassnet/teampass/commit/1c0825b67eb8f8b5ecc418ff7614423a275e6a79
CVE ID: CVE-2023-3087 State: PUBLISHED Published: 2023-07-12T04:38:52.072Z Last Updated: 2025-02-05T19:39:42.189Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: techjewel Products: FluentSMTP – WP Mail SMTP, Amazon SES, SendGrid, MailGun and Any SMTP Connector Plugin Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The FluentSMTP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an email subject in versions up to, and including, 2.2.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web
nt input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/fa47a794-e5ce-491d-a10b-c7c5718aa853?source=cve - https://plugins.trac.wordpress.org/changeset/2935217/fluent-smtp/trunk/app/Services/Mailer/BaseHandler.php - https://plugins.trac.wordpress.org/changeset/2935217/fluent-smtp/trunk/app/Models/Logger.php
CVE ID: CVE-2023-3088 State: PUBLISHED Published: 2023-07-12T04:38:46.572Z Last Updated: 2025-02-05T19:40:44.214Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: anandau14 Products: WP Mail Log Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The WP Mail Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting via email contents in versions up to, and including, 1.1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page
enticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/86ee1acb-6f0c-40e6-80a0-fc93b61c1602?source=cve - https://plugins.trac.wordpress.org/changeset/2931706/wp-mail-log
CVE ID: CVE-2023-3089 State: PUBLISHED Published: 2023-07-05T12:21:03.036Z Last Updated: 2024-10-24T19:13:59.907Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L) Vendors: n/a, Red Hat Products: openshift, OpenShift Serverless, OpenShift Service Mesh 2.2.x, OpenShift Service Mesh 2.3.x, OpenShift Service Mesh 2.4, Red Hat Advanced Cluster Management for Kubernetes 2, Red Hat JBoss A-MQ Streams, Red Hat OpenShift Container Platform 3.11, Red Hat OpenShift Container Platform 4, Red Hat Openshift Data Foundation 4, Red Hat Openshift sandboxed containers, Red Hat OpenShift Virtualization 4 Problem Types: CWE-693 Description: A compliance problem was found in the Red Hat OpenS
d Hat OpenShift Virtualization 4 Problem Types: CWE-693 Description: A compliance problem was found in the Red Hat OpenShift Container Platform. Red Hat discovered that, when FIPS mode was enabled, not all of the cryptographic modules in use were FIPS-validated. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2023-3089 - https://bugzilla.redhat.com/show_bug.cgi?id=2212085
CVE ID: CVE-2023-3090 State: PUBLISHED Published: 2023-06-28T19:06:41.221Z Last Updated: 2025-03-05T18:55:25.596Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Linux Products: Kernel Problem Types: CWE-787 Description: A heap out-of-bounds write vulnerability in the Linux Kernel ipvlan network driver can be exploited to achieve local privilege escalation. The out-of-bounds write is caused by missing skb->cb initialization in the ipvlan network driver. The vulnerability is reachable if CONFIG_IPVLAN is enabled. We recommend upgrading past commit 90cbed5247439a966b645b34eb0a2e037836ea8e. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichmen
mmit 90cbed5247439a966b645b34eb0a2e037836ea8e. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=90cbed5247439a966b645b34eb0a2e037836ea8e - https://kernel.dance/90cbed5247439a966b645b34eb0a2e037836ea8e - https://www.debian.org/security/2023/dsa-5448 - https://lists.debian.org/debian-lts-announce/2023/07/msg00030.html - https://security.netapp.com/advisory/ntap-20230731-0002/ - https://www.debian.org/security/2023/dsa-5480 - http://packetstormsecurity.com/files/174577/Kernel-Live-Patch-Security-Notice-LSN-0097-1.html - http://packetstormsecurity.com/files/175072/Kernel-Live-Pa
es/174577/Kernel-Live-Patch-Security-Notice-LSN-0097-1.html - http://packetstormsecurity.com/files/175072/Kernel-Live-Patch-Security-Notice-LSN-0098-1.html - https://lists.debian.org/debian-lts-announce/2023/10/msg00027.html
CVE ID: CVE-2023-3091 State: PUBLISHED Published: 2023-06-03T23:31:02.994Z Last Updated: 2024-08-02T06:41:04.180Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: n/a Products: Captura Problem Types: CWE-427 Description: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in Captura up to 8.0.0. It has been declared as critical. This vulnerability affects unknown code in the library CRYPTBASE.dll. The manipulation leads to uncontrolled search path. Attacking locally is a requirement. The complexity of an attack is rather high. The exploitation appears to be difficult. The identifier of this vulnerability is VDB-230668. NOTE: This vulnerability only affects
tion appears to be difficult. The identifier of this vulnerability is VDB-230668. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.230668 - https://vuldb.com/?ctiid.230668