Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-49270 State: PUBLISHED Published: 2023-12-20T19:21:34.658Z Last Updated: 2025-05-19T14:46:41.685Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Kashipara Group Products: Hotel Management Problem Types: CWE-79 Description: Hotel Management v1.0 is vulnerable to multiple authenticated Reflected Cross-Site Scripting vulnerabilities. The 'check_in_date' parameter of the reservation.php resource is copied into the HTML document as plain text between tags. Any input is echoed unmodified in the application's response. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/lang
Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/lang/ - https://www.kashipara.com/
CVE ID: CVE-2023-49271 State: PUBLISHED Published: 2023-12-20T19:24:15.907Z Last Updated: 2025-05-19T14:47:07.566Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Kashipara Group Products: Hotel Management Problem Types: CWE-79 Description: Hotel Management v1.0 is vulnerable to multiple authenticated Reflected Cross-Site Scripting vulnerabilities. The 'check_out_date' parameter of the reservation.php resource is copied into the HTML document as plain text between tags. Any input is echoed unmodified in the application's response. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/lan
l Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/lang/ - https://www.kashipara.com/
CVE ID: CVE-2023-49272 State: PUBLISHED Published: 2023-12-20T19:25:08.511Z Last Updated: 2025-05-19T14:47:29.612Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Kashipara Group Products: Hotel Management Problem Types: CWE-79 Description: Hotel Management v1.0 is vulnerable to multiple authenticated Reflected Cross-Site Scripting vulnerabilities. The 'children' parameter of the reservation.php resource is copied into the HTML document as plain text between tags. Any input is echoed unmodified in the application's response. Additional Analyst Notes: - CVE Program Container: References: - https://fluidattacks.com/advisories/lang/ - https://www.kashipara.com/
CVE ID: CVE-2023-49273 State: PUBLISHED Published: 2023-12-12T19:05:39.361Z Last Updated: 2024-08-02T21:53:45.336Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: umbraco Products: Umbraco-CMS Problem Types: CWE-863 Description: Umbraco is an ASP.NET content management system (CMS). Starting in version 8.0.0 and prior to versions 8.18.10, 10.8.1, and 12.3.4, users with low privileges (Editor, etc.) are able to access some unintended endpoints. Versions 8.18.10, 10.8.1, and 12.3.4 contain a patch for this issue. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-cfr5-7p54-4qg8
CVE ID: CVE-2023-49274 State: PUBLISHED Published: 2023-12-12T19:10:46.262Z Last Updated: 2024-08-02T21:53:44.983Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: umbraco Products: Umbraco-CMS Problem Types: CWE-200 Description: Umbraco is an ASP.NET content management system (CMS). Starting in version 8.0.0 and prior to versions 8.18.10, 10.8.1, and 12.3.4, a user enumeration attack is possible when SMTP is not set up correctly, but reset password is enabled. Versions 8.18.10, 10.8.1, and 12.3.4 contain a patch for this issue. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-8qp8-9
yst Notes: - CVE Program Container: References: - https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-8qp8-9rpw-j46c
CVE ID: CVE-2023-49275 State: PUBLISHED Published: 2024-04-19T14:24:25.343Z Last Updated: 2024-08-02T21:53:45.339Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: wazuh Products: wazuh Problem Types: CWE-476 Description: Wazuh is a free and open source platform used for threat prevention, detection, and response. A NULL pointer dereference was detected during fuzzing of the analysis engine, allowing malicious clients to DoS the analysis engine. The bug occurs when `analysisd` receives a syscollector message with the `hotfix` `msg_type` but lacking a `timestamp`. It uses `cJSON_GetObjectItem()` to get the `timestamp` object item and dereferences it without ch
lacking a `timestamp`. It uses `cJSON_GetObjectItem()` to get the `timestamp` object item and dereferences it without checking for a `NULL` value. A malicious client can DoS the analysis engine. This vulnerability is fixed in 4.7.1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/wazuh/wazuh/security/advisories/GHSA-4mq7-w9r6-9975 - https://github.com/wazuh/wazuh/blob/e1d5231b31b68a75f3b8b33f833155b362411078/src/analysisd/decoders/syscollector.c#L1573 - https://github.com/wazuh/wazuh/blob/e1d5231b31b68a75f3b8b33f833155b362411078/src/analysisd/decoders/syscollector.c#L1578
CVE ID: CVE-2023-49276 State: PUBLISHED Published: 2023-12-01T22:05:41.789Z Last Updated: 2024-08-02T21:53:44.985Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N) Vendors: louislam Products: uptime-kuma Problem Types: CWE-79 Description: Uptime Kuma is an open source self-hosted monitoring tool. In affected versions the Google Analytics element in vulnerable to Attribute Injection leading to Cross-Site-Scripting (XSS). Since the custom status interface can set an independent Google Analytics ID and the template has not been sanitized, there is an attribute injection vulnerability here, which can lead to XSS attacks. This vulnerability has been addressed in commit `f2
tribute injection vulnerability here, which can lead to XSS attacks. This vulnerability has been addressed in commit `f28dccf4e` which is included in release version 1.23.7. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/louislam/uptime-kuma/security/advisories/GHSA-v4v2-8h88-65qj - https://github.com/louislam/uptime-kuma/commit/f28dccf4e11f041564293e4f407e69ab9ee2277f
CVE ID: CVE-2023-49277 State: PUBLISHED Published: 2023-12-01T20:48:06.371Z Last Updated: 2024-10-11T17:55:30.833Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H) Vendors: DarrenOfficial Products: dpaste Problem Types: CWE-79 Description: dpaste is an open source pastebin application written in Python using the Django framework. A security vulnerability has been identified in the expires parameter of the dpaste API, allowing for a POST Reflected XSS attack. This vulnerability can be exploited by an attacker to execute arbitrary JavaScript code in the context of a user's browser, potentially leading to unauthorized access, data theft, or other malicious activities. User
context of a user's browser, potentially leading to unauthorized access, data theft, or other malicious activities. Users are strongly advised to upgrade to dpaste release v3.8 or later versions, as dpaste versions older than v3.8 are susceptible to the identified security vulnerability. No known workarounds have been identified, and applying the patch is the most effective way to remediate the vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/DarrenOfficial/dpaste/security/advisories/GHSA-r8j9-5cj7-cv39 - https://github.com/DarrenOfficial/dpaste/commit/44a666a79b3b29ed4f340600bfcf55113bfb7086
CVE ID: CVE-2023-49278 State: PUBLISHED Published: 2023-12-12T19:14:02.789Z Last Updated: 2024-10-08T14:33:55.652Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: umbraco Products: Umbraco-CMS Problem Types: CWE-200, CWE-307 Description: Umbraco is an ASP.NET content management system (CMS). Starting in version 8.0.0 and prior to versions 8.18.10, 10.8.1, and 12.3.4, a brute force exploit can be used to collect valid usernames. Versions 8.18.10, 10.8.1, and 12.3.4 contain a patch for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-7x74-h8cw-q
iner: - CISA ADP Vulnrichment: References: - https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-7x74-h8cw-qhxq
CVE ID: CVE-2023-49279 State: PUBLISHED Published: 2023-12-12T19:35:05.931Z Last Updated: 2024-08-28T14:43:18.346Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: umbraco Products: Umbraco-CMS Problem Types: CWE-79 Description: Umbraco is an ASP.NET content management system (CMS). Starting in version 7.0.0 and prior to versions 7.15.11, 8.18.9, 10.7.0, 11.5.0, and 12.2.0, a user with access to the backoffice can upload SVG files that include scripts. If the user can trick another user to load the media directly in a browser, the scripts can be executed. Versions 7.15.11, 8.18.9, 10.7.0, 11.5.0, and 12.2.0 contain a patch for this issue. Some workarounds are av
e executed. Versions 7.15.11, 8.18.9, 10.7.0, 11.5.0, and 12.2.0 contain a patch for this issue. Some workarounds are available. Implement the server side file validation or serve all media from an different host (e.g cdn) than where Umbraco is hosted. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-6xmx-85x3-4cv2 - https://docs.umbraco.com/umbraco-cms/reference/security/serverside-file-validation
CVE ID: CVE-2023-49280 State: PUBLISHED Published: 2023-12-04T22:33:59.292Z Last Updated: 2024-11-27T16:01:05.718Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: xwiki-contrib Products: application-changerequest Problem Types: CWE-522 Description: XWiki Change Request is an XWiki application allowing to request changes on a wiki without publishing directly the changes. Change request allows to edit any page by default, and the changes are then exported in an XML file that anyone can download. So it's possible for an attacker to obtain password hash of users by performing an edit on the user profiles and then downloading the XML file that has been created. Thi
rd hash of users by performing an edit on the user profiles and then downloading the XML file that has been created. This is also true for any document that might contain password field and that a user can view. This vulnerability impacts all version of Change Request, but the impact depends on the rights that has been set on the wiki since it requires for the user to have the Change request right (allowed by default) and view rights on the page to target. This issue cannot be easily exploited in an automated way. The patch consists in denying to users the right of editing pages that contains a password field with change request. It means that already existing change request for those pages
pages that contains a password field with change request. It means that already existing change request for those pages won't be removed by the patch, administrators needs to take care of it. The patch is provided in Change Request 1.10, administrators should upgrade immediately. It's possible to workaround the vulnerability by denying manually the Change request right on some spaces, such as XWiki space which will include any user profile by default. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/xwiki-contrib/application-changerequest/security/advisories/GHSA-2fr7-cc7p-p45q - https://github.com/xwiki-contrib/application-changere
pplication-changerequest/security/advisories/GHSA-2fr7-cc7p-p45q - https://github.com/xwiki-contrib/application-changerequest/commit/ff0f5368ea04f0e4aa7b33821c707dc68a8c5ca8 - https://jira.xwiki.org/browse/CRAPP-302
CVE ID: CVE-2023-49281 State: PUBLISHED Published: 2023-12-01T22:10:05.927Z Last Updated: 2024-08-02T21:53:45.403Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N) Vendors: Cainor Products: Calendarinho Problem Types: CWE-601 Description: Calendarinho is an open source calendaring application to manage large teams of consultants. An Open Redirect issue occurs when a web application redirects users to external URLs without proper validation. This can lead to phishing attacks, where users are tricked into visiting malicious sites, potentially leading to information theft and reputational damage to the website used for redirection. The problem is has been patched in comm
o information theft and reputational damage to the website used for redirection. The problem is has been patched in commit `15b2393`. Users are advised to update to a commit after `15b2393`. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Cainor/Calendarinho/security/advisories/GHSA-g2gp-x888-6xrj - https://github.com/Cainor/Calendarinho/commit/15b2393efd69101727d27a4e710880ce46e84d70 - https://github.com/Cainor/Calendarinho/commit/9a0174bef939565a76cbe7762996ecddca9ba55e - https://github.com/Cainor/Calendarinho/commit/c77defeb0103c1f7a4709799b8751aaeb0d09eed
CVE ID: CVE-2023-49282 State: PUBLISHED Published: 2023-12-05T22:40:44.054Z Last Updated: 2024-08-02T21:53:45.373Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L) Vendors: microsoftgraph Products: msgraph-sdk-php Problem Types: CWE-200 Description: msgraph-sdk-php is the Microsoft Graph Library for PHP. The Microsoft Graph PHP SDK published packages which contained test code that enabled the use of the phpInfo() function from any application that could access and execute the file at vendor/microsoft/microsoft-graph/tests/GetPhpInfo.php. The phpInfo function exposes system information. The vulnerability affects the GetPhpInfo.php script of the PHP SDK which contains a
function exposes system information. The vulnerability affects the GetPhpInfo.php script of the PHP SDK which contains a call to the phpinfo() function. This vulnerability requires a misconfiguration of the server to be present so it can be exploited. For example, making the PHP application’s /vendor directory web accessible. The combination of the vulnerability and the server misconfiguration would allow an attacker to craft an HTTP request that executes the phpinfo() method. The attacker would then be able to get access to system information like configuration, modules, and environment variables and later on use the compromised secrets to access additional data. This problem has been patch
nd environment variables and later on use the compromised secrets to access additional data. This problem has been patched in versions 1.109.1 and 2.0.0-RC5. If an immediate deployment with the updated vendor package is not available, you can perform the following temporary workarounds: delete the `vendor/microsoft/microsoft-graph/tests/GetPhpInfo.php` file, remove access to the `/vendor` directory, or disable the phpinfo function. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/microsoftgraph/msgraph-sdk-php/security/advisories/GHSA-cgwq-6prq-8h9q - https://github.com/microsoftgraph/msgraph-beta-sdk-php/compare/2.0.0...2.0.1 - https://github.com/microsoft
-6prq-8h9q - https://github.com/microsoftgraph/msgraph-beta-sdk-php/compare/2.0.0...2.0.1 - https://github.com/microsoftgraph/msgraph-sdk-php-core/compare/2.0.1...2.0.2 - https://github.com/microsoftgraph/msgraph-sdk-php/compare/1.109.0...1.109.1 - https://owncloud.com/security-advisories/disclosure-of-sensitive-credentials-and-configuration-in-containerized-deployments/
CVE ID: CVE-2023-49283 State: PUBLISHED Published: 2023-12-05T22:44:40.433Z Last Updated: 2024-10-10T19:07:45.469Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L) Vendors: microsoftgraph Products: msgraph-sdk-php-core Problem Types: CWE-200 Description: microsoft-graph-core the Microsoft Graph Library for PHP. The Microsoft Graph Beta PHP SDK published packages which contained test code that enabled the use of the phpInfo() function from any application that could access and execute the file at `vendor/microsoft/microsoft-graph-core/tests/GetPhpInfo.php`. The phpInfo function exposes system information. The vulnerability affects the GetPhpInfo.php script of the PHP S
.php`. The phpInfo function exposes system information. The vulnerability affects the GetPhpInfo.php script of the PHP SDK which contains a call to the phpinfo() function. This vulnerability requires a misconfiguration of the server to be present so it can be exploited. For example, making the PHP application’s /vendor directory web accessible. The combination of the vulnerability and the server misconfiguration would allow an attacker to craft an HTTP request that executes the phpinfo() method. The attacker would then be able to get access to system information like configuration, modules, and environment variables and later on use the compromised secrets to access additional data. This pro
uration, modules, and environment variables and later on use the compromised secrets to access additional data. This problem has been patched in version 2.0.2. If an immediate deployment with the updated vendor package is not available, you can perform the following temporary workarounds: delete the `vendor/microsoft/microsoft-graph-core/tests/GetPhpInfo.php` file, remove access to the /vendor directory, or disable the phpinfo function Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/microsoftgraph/msgraph-sdk-php-core/security/advisories/GHSA-mhhp-c3cm-2r86 - https://github.com/microsoftgraph/msgraph-beta-sdk-php/compare/2.0.0...2.
core/security/advisories/GHSA-mhhp-c3cm-2r86 - https://github.com/microsoftgraph/msgraph-beta-sdk-php/compare/2.0.0...2.0.1 - https://github.com/microsoftgraph/msgraph-sdk-php-core/compare/2.0.1...2.0.2 - https://github.com/microsoftgraph/msgraph-sdk-php/compare/1.109.0...1.109.1 - https://owncloud.com/security-advisories/disclosure-of-sensitive-credentials-and-configuration-in-containerized-deployments/
CVE ID: CVE-2023-49284 State: PUBLISHED Published: 2023-12-04T23:46:35.567Z Last Updated: 2025-02-13T17:18:37.222Z Severity: LOW (CVSS 3.9 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L) Vendors: fish-shell Products: fish-shell Problem Types: CWE-436 Description: fish is a smart and user-friendly command line shell for macOS, Linux, and the rest of the family. fish shell uses certain Unicode non-characters internally for marking wildcards and expansions. It will incorrectly allow these markers to be read on command substitution output, rather than transforming them into a safe internal representation. While this may cause unexpected behavior with direct input (for example, echo \UFDD2HOME has
e internal representation. While this may cause unexpected behavior with direct input (for example, echo \UFDD2HOME has the same output as echo $HOME), this may become a minor security problem if the output is being fed from an external program into a command substitution where this output may not be expected. This design flaw was introduced in very early versions of fish, predating the version control system, and is thought to be present in every version of fish released in the last 15 years or more, although with different characters. Code execution does not appear to be possible, but denial of service (through large brace expansion) or information disclosure (such as variable expansion) i
possible, but denial of service (through large brace expansion) or information disclosure (such as variable expansion) is potentially possible under certain circumstances. fish shell 3.6.2 has been released to correct this issue. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/fish-shell/fish-shell/security/advisories/GHSA-2j9r-pm96-wp4f - https://github.com/fish-shell/fish-shell/commit/09986f5563e31e2c900a606438f1d60d008f3a14 - http://www.openwall.com/lists/oss-security/2023/12/08/1
CVE ID: CVE-2023-49285 State: PUBLISHED Published: 2023-12-04T22:56:55.105Z Last Updated: 2025-02-13T17:18:37.933Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) Vendors: squid-cache Products: squid Problem Types: CWE-126 Description: Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a Buffer Overread bug Squid is vulnerable to a Denial of Service attack against Squid HTTP Message processing. This bug is fixed by Squid version 6.5. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/squid-cache/squid/security/advisories/
ditional Analyst Notes: - CVE Program Container: References: - https://github.com/squid-cache/squid/security/advisories/GHSA-8w9r-p88v-mmx9 - https://github.com/squid-cache/squid/commit/77b3fb4df0f126784d5fd4967c28ed40eb8d521b - https://github.com/squid-cache/squid/commit/deee944f9a12c9fd399ce52f3e2526bb573a9470 - http://www.squid-cache.org/Versions/v5/SQUID-2023_7.patch - http://www.squid-cache.org/Versions/v6/SQUID-2023_7.patch - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MEV66D3PAAY6K7TWDT3WZBLCPLASFJDC/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A5QASTMCUSUEW3UOMKHZJB3FTONWSRXS/ - ht
.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A5QASTMCUSUEW3UOMKHZJB3FTONWSRXS/ - https://lists.debian.org/debian-lts-announce/2024/01/msg00003.html - https://security.netapp.com/advisory/ntap-20240119-0004/
CVE ID: CVE-2023-49286 State: PUBLISHED Published: 2023-12-04T22:53:44.827Z Last Updated: 2025-02-13T17:18:38.522Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) Vendors: squid-cache Products: squid Problem Types: CWE-617, CWE-253 Description: Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to an Incorrect Check of Function Return Value bug Squid is vulnerable to a Denial of Service attack against its Helper process management. This bug is fixed by Squid version 6.5. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/squ
karounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/squid-cache/squid/security/advisories/GHSA-xggx-9329-3c27 - https://github.com/squid-cache/squid/commit/6014c6648a2a54a4ecb7f952ea1163e0798f9264 - http://www.squid-cache.org/Versions/v6/SQUID-2023_8.patch - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MEV66D3PAAY6K7TWDT3WZBLCPLASFJDC/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A5QASTMCUSUEW3UOMKHZJB3FTONWSRXS/ - https://lists.debian.org/debian-lts-announce/2024/01/msg00003.html - https://security.netapp.com/advisory/ntap-202
XS/ - https://lists.debian.org/debian-lts-announce/2024/01/msg00003.html - https://security.netapp.com/advisory/ntap-20240119-0004/
CVE ID: CVE-2023-49287 State: PUBLISHED Published: 2023-12-04T05:29:10.673Z Last Updated: 2025-05-29T13:54:57.520Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) Vendors: cxong Products: tinydir Problem Types: CWE-120, CWE-121 Description: TinyDir is a lightweight C directory and file reader. Buffer overflows in the `tinydir_file_open()` function. This vulnerability has been patched in version 1.2.6. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/cxong/tinydir/security/advisories/GHSA-jf5r-wgf4-qhxf - https://github.com/cxong/tinydir/releases/tag/1.2.6 - http://www.openwall.com/lists/oss-security/2023/12/04