Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08014144; Issue ID: ALPS08014144. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://corp.mediatek.com/product-security-bulletin/September-2023
CVE ID: CVE-2023-20829 State: PUBLISHED Published: 2023-09-04T02:27:30.694Z Last Updated: 2024-10-10T15:24:13.653Z Vendors: MediaTek, Inc. Products: MT2735, MT6761, MT6762, MT6765, MT6768, MT6769, MT6779, MT6833, MT6835, MT6853, MT6853T, MT6855, MT6873, MT6875, MT6877, MT6879, MT6880, MT6883, MT6885, MT6886, MT6889, MT6890, MT6891, MT6893, MT6895, MT6980, MT6983, MT6985, MT6990, MT8167, MT8167S, MT8168, MT8175, MT8362A, MT8365 Problem Types: Elevation of Privilege Description: In gps, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08014144; Issue ID: ALPS08014148. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://corp.mediatek.com/product-security-bulletin/September-2023
CVE ID: CVE-2023-20830 State: PUBLISHED Published: 2023-09-04T02:27:32.386Z Last Updated: 2024-10-10T15:25:53.574Z Vendors: MediaTek, Inc. Products: MT2713, MT2735, MT6761, MT6762, MT6765, MT6768, MT6769, MT6779, MT6833, MT6835, MT6853, MT6853T, MT6855, MT6873, MT6875, MT6877, MT6879, MT6880, MT6883, MT6885, MT6886, MT6889, MT6890, MT6891, MT6893, MT6895, MT6980, MT6983, MT6985, MT6990, MT8167, MT8167S, MT8168, MT8173, MT8195, MT8362A, MT8365, MT8781 Problem Types: Elevation of Privilege Description: In gps, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not n
eck. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08014144; Issue ID: ALPS08014156. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://corp.mediatek.com/product-security-bulletin/September-2023
CVE ID: CVE-2023-20831 State: PUBLISHED Published: 2023-09-04T02:27:34.059Z Last Updated: 2024-10-10T15:22:06.368Z Vendors: MediaTek, Inc. Products: MT2735, MT6761, MT6762, MT6765, MT6768, MT6769, MT6779, MT6833, MT6835, MT6853, MT6853T, MT6855, MT6873, MT6875, MT6877, MT6879, MT6880, MT6883, MT6885, MT6886, MT6889, MT6890, MT6891, MT6893, MT6895, MT6980, MT6983, MT6985, MT6990, MT8167, MT8167S, MT8175, MT8195, MT8362A, MT8365 Problem Types: Elevation of Privilege Description: In gps, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08014144; Issue ID: ALPS08014162. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://corp.mediatek.com/product-security-bulletin/September-2023
CVE ID: CVE-2023-20832 State: PUBLISHED Published: 2023-09-04T02:27:35.686Z Last Updated: 2024-10-04T14:22:36.874Z Vendors: MediaTek, Inc. Products: MT2735, MT6761, MT6762, MT6765, MT6768, MT6769, MT6779, MT6833, MT6835, MT6853, MT6853T, MT6855, MT6873, MT6875, MT6877, MT6879, MT6880, MT6883, MT6885, MT6886, MT6889, MT6890, MT6891, MT6893, MT6895, MT6980, MT6983, MT6985, MT6990, MT8167, MT8167S, MT8168, MT8175, MT8195, MT8362A, MT8365 Problem Types: Elevation of Privilege Description: In gps, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploi
lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08014144; Issue ID: ALPS08013530. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://corp.mediatek.com/product-security-bulletin/September-2023
CVE ID: CVE-2023-20833 State: PUBLISHED Published: 2023-09-04T02:27:37.358Z Last Updated: 2024-10-28T01:35:33.140Z Vendors: MediaTek, Inc. Products: MT6580, MT6731, MT6735, MT6737, MT6739, MT6753, MT6757, MT6757C, MT6757CD, MT6757CH, MT6761, MT6762, MT6763, MT6765, MT6768, MT6769, MT6771, MT6779, MT6781, MT6785, MT6789, MT6833, MT6835, MT6853, MT6853T, MT6855, MT6873, MT6875, MT6877, MT6879, MT6883, MT6885, MT6886, MT6889, MT6891, MT6893, MT6895, MT6983, MT6985, MT8185, MT8321, MT8385, MT8666, MT8673, MT8675, MT8765, MT8766, MT8768, MT8781, MT8786, MT8788, MT8789, MT8791, MT8791T, MT8797 Problem Types: Information Disclosure Description: In keyinstall, there is a possible information disclos
T8791T, MT8797 Problem Types: Information Disclosure Description: In keyinstall, there is a possible information disclosure due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08017756; Issue ID: ALPS08017764. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://corp.mediatek.com/product-security-bulletin/September-2023
CVE ID: CVE-2023-20834 State: PUBLISHED Published: 2023-09-04T02:27:38.962Z Last Updated: 2024-10-21T16:55:42.131Z Vendors: MediaTek, Inc. Products: MT6879, MT6886, MT6895, MT6983, MT6985, MT8175, MT8188, MT8195, MT8365, MT8781 Problem Types: Elevation of Privilege Description: In pda, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07608514; Issue ID: ALPS07608514. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://corp.mediatek.com/product-security-bulletin/September-2023
CVE ID: CVE-2023-20835 State: PUBLISHED Published: 2023-09-04T02:27:40.600Z Last Updated: 2024-10-21T16:59:12.216Z Vendors: MediaTek, Inc. Products: MT6895, MT6983, MT8188, MT8195, MT8395, MT8781 Problem Types: Elevation of Privilege Description: In camsys, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07341261; Issue ID: ALPS07326570. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://corp.mediatek.com/product-security-bulletin/September-2023
CVE ID: CVE-2023-20836 State: PUBLISHED Published: 2023-09-04T02:27:42.196Z Last Updated: 2024-10-08T20:13:30.076Z Vendors: MediaTek, Inc. Products: MT6762, MT6765, MT6768, MT6771, MT6779, MT6781, MT6785, MT6833, MT6853, MT6877, MT6885, MT6893, MT8768, MT8788 Problem Types: Information Disclosure Description: In camsys, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07505629; Issue ID: ALPS07505629. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://corp.mediatek.com/produc
CVE ID: CVE-2023-20837 State: PUBLISHED Published: 2023-09-04T02:27:43.828Z Last Updated: 2024-10-21T17:17:26.463Z Vendors: MediaTek, Inc. Products: MT6779, MT6781, MT6785, MT6789, MT6833, MT6853, MT6855, MT6873, MT6877, MT6885, MT6893, MT8185, MT8385, MT8781, MT8788, MT8789, MT8797 Problem Types: Elevation of Privilege Description: In seninf, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07992786; Issue ID: ALPS07992786. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https:
Issue ID: ALPS07992786. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://corp.mediatek.com/product-security-bulletin/September-2023
CVE ID: CVE-2023-20838 State: PUBLISHED Published: 2023-09-04T02:27:45.442Z Last Updated: 2024-10-08T20:13:21.882Z Vendors: MediaTek, Inc. Products: MT2713, MT6895, MT6897, MT6983, MT8188, MT8195, MT8395, MT8673 Problem Types: Information Disclosure Description: In imgsys, there is a possible out of bounds read due to a race condition. This could lead to local information disclosure with System execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS07326455; Issue ID: ALPS07326418. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://corp.mediatek.com/product-security-bulletin/September-2023
CVE ID: CVE-2023-20839 State: PUBLISHED Published: 2023-09-04T02:27:47.001Z Last Updated: 2024-10-08T20:13:11.478Z Vendors: MediaTek, Inc. Products: MT2713, MT6895, MT6897, MT6983, MT8188, MT8195, MT8395, MT8673 Problem Types: Information Disclosure Description: In imgsys, there is a possible out of bounds read due to a missing valid range checking. This could lead to local information disclosure with System execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS07326455; Issue ID: ALPS07326409. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://corp.mediatek.com/product-security-bulletin/September-2023
CVE ID: CVE-2023-20840 State: PUBLISHED Published: 2023-09-04T02:27:48.606Z Last Updated: 2024-10-21T17:21:58.898Z Vendors: MediaTek, Inc. Products: MT6895, MT6897, MT6983, MT8188, MT8195, MT8395 Problem Types: Elevation of Privilege Description: In imgsys, there is a possible out of bounds read and write due to a missing valid range checking. This could lead to local escalation of privilege with System execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS07326430; Issue ID: ALPS07326430. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://corp.mediatek.com/product-security-bulletin/September-2023
CVE ID: CVE-2023-20841 State: PUBLISHED Published: 2023-09-04T02:27:50.280Z Last Updated: 2024-10-21T17:25:15.440Z Vendors: MediaTek, Inc. Products: MT2713, MT6895, MT6897, MT6983, MT8188, MT8195, MT8395, MT8673 Problem Types: Elevation of Privilege Description: In imgsys, there is a possible out of bounds write due to a missing valid range checking. This could lead to local escalation of privilege with System execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS07326455; Issue ID: ALPS07326441. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://corp.mediatek.com/product-security-bulletin/September-2023
CVE ID: CVE-2023-20842 State: PUBLISHED Published: 2023-09-04T02:27:51.965Z Last Updated: 2024-10-21T17:28:33.704Z Vendors: MediaTek, Inc. Products: MT2713, MT6895, MT6897, MT6983, MT8188, MT8195, MT8395, MT8781 Problem Types: Elevation of Privilege Description: In imgsys_cmdq, there is a possible out of bounds write due to a missing valid range checking. This could lead to local escalation of privilege with System execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS07354259; Issue ID: ALPS07340477. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://corp.mediatek.com/product-security-bulletin/September-2023
CVE ID: CVE-2023-20843 State: PUBLISHED Published: 2023-09-04T02:27:53.712Z Last Updated: 2024-10-08T20:13:00.738Z Vendors: MediaTek, Inc. Products: MT6895, MT6897, MT6983, MT8188, MT8195, MT8395, MT8781 Problem Types: Information Disclosure Description: In imgsys_cmdq, there is a possible out of bounds read due to a missing valid range checking. This could lead to local information disclosure with System execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS07340119; Issue ID: ALPS07340119. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://corp.mediatek.com/product-security-bulletin/September-2023
CVE ID: CVE-2023-20844 State: PUBLISHED Published: 2023-09-04T02:27:55.388Z Last Updated: 2024-10-08T20:12:52.704Z Vendors: MediaTek, Inc. Products: MT6895, MT6897, MT6983, MT8188, MT8195, MT8395, MT8781 Problem Types: Information Disclosure Description: In imgsys_cmdq, there is a possible out of bounds read due to a missing valid range checking. This could lead to local information disclosure with System execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS07354058; Issue ID: ALPS07340121. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://corp.mediatek.com/product-security-bulletin/September-2023
CVE ID: CVE-2023-20845 State: PUBLISHED Published: 2023-09-04T02:27:57.105Z Last Updated: 2024-10-08T20:12:45.420Z Vendors: MediaTek, Inc. Products: MT6895, MT6897, MT6983, MT8188, MT8195, MT8395 Problem Types: Information Disclosure Description: In imgsys, there is a possible out of bounds read due to a missing valid range checking. This could lead to local information disclosure with System execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS07197795; Issue ID: ALPS07340357. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://corp.mediatek.com/product-security-bulletin/September-2023
CVE ID: CVE-2023-20846 State: PUBLISHED Published: 2023-09-04T02:27:58.838Z Last Updated: 2024-10-08T20:12:36.786Z Vendors: MediaTek, Inc. Products: MT6895, MT6897, MT6983, MT8188, MT8195, MT8395, MT8781 Problem Types: Information Disclosure Description: In imgsys_cmdq, there is a possible out of bounds read due to a missing valid range checking. This could lead to local information disclosure with System execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS07354023; Issue ID: ALPS07340098. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://corp.mediatek.com/product-security-bulletin/September-2023
CVE ID: CVE-2023-20847 State: PUBLISHED Published: 2023-09-04T02:28:00.486Z Last Updated: 2024-10-08T20:12:28.123Z Vendors: MediaTek, Inc. Products: MT6895, MT6897, MT6983, MT8188, MT8195, MT8395, MT8781 Problem Types: Denial of Service Description: In imgsys_cmdq, there is a possible out of bounds read due to a missing valid range checking. This could lead to local denial of service with System execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS07354025; Issue ID: ALPS07340108. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://corp.mediatek.com/product-security-bulletin/September-2023
CVE ID: CVE-2023-20848 State: PUBLISHED Published: 2023-09-04T02:28:02.171Z Last Updated: 2024-10-21T17:29:46.979Z Vendors: MediaTek, Inc. Products: MT2713, MT6895, MT6897, MT6983, MT8188, MT8195, MT8395, MT8781 Problem Types: Elevation of Privilege Description: In imgsys_cmdq, there is a possible out of bounds read due to a missing valid range checking. This could lead to local escalation of privilege with System execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS07340433; Issue ID: ALPS07340433. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://corp.mediatek.com/product-security-bulletin/September-2023
CVE ID: CVE-2023-20849 State: PUBLISHED Published: 2023-09-04T02:28:03.822Z Last Updated: 2024-10-01T18:58:38.274Z Vendors: MediaTek, Inc. Products: MT2713, MT6895, MT6897, MT6983, MT8188, MT8195, MT8395, MT8781 Problem Types: Elevation of Privilege Description: In imgsys_cmdq, there is a possible use after free due to a missing valid range checking. This could lead to local escalation of privilege with System execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS07340433; Issue ID: ALPS07340350. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://corp.mediatek.com/product-security-bulletin/September-2023
CVE ID: CVE-2023-20850 State: PUBLISHED Published: 2023-09-04T02:28:05.423Z Last Updated: 2024-10-01T17:38:18.992Z Vendors: MediaTek, Inc. Products: MT2713, MT6895, MT6897, MT6983, MT8188, MT8195, MT8395, MT8781 Problem Types: Elevation of Privilege Description: In imgsys_cmdq, there is a possible out of bounds write due to a missing valid range checking. This could lead to local escalation of privilege with System execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS07340433; Issue ID: ALPS07340381. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://corp.mediatek.com/product-security-bulletin/September-2023
CVE ID: CVE-2023-20851 State: PUBLISHED Published: 2023-09-04T02:28:07.214Z Last Updated: 2024-10-01T13:01:09.937Z Vendors: MediaTek, Inc. Products: MT8188 Problem Types: Elevation of Privilege Description: In stc, there is a possible out of bounds read due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS08048635; Issue ID: ALPS08048635. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://corp.mediatek.com/product-security-bulletin/September-2023
CVE ID: CVE-2023-20852 State: PUBLISHED Published: 2023-04-27T00:00:00.000Z Last Updated: 2025-01-30T21:17:19.561Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: aEnrich Products: a+HRD Problem Types: CWE-502 Description: aEnrich Technology a+HRD has a vulnerability of Deserialization of Untrusted Data within its MSMQ interpreter. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary system commands to perform arbitrary system operation or disrupt service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-7023-8368b-1.html
CVE ID: CVE-2023-20853 State: PUBLISHED Published: 2023-04-27T00:00:00.000Z Last Updated: 2025-01-30T21:16:25.951Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: aEnrich Products: a+HRD Problem Types: CWE-502 Description: aEnrich Technology a+HRD has a vulnerability of Deserialization of Untrusted Data within its MSMQ asynchronized message process. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary system commands to perform arbitrary system operation or disrupt service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-7024-bdefe-1.html
CVE ID: CVE-2023-20854 State: PUBLISHED Published: 2023-02-03T00:00:00.000Z Last Updated: 2025-03-26T14:05:19.424Z Vendors: n/a Products: VMware Workstation Problem Types: Arbitrary file deletion vulnerability Description: VMware Workstation contains an arbitrary file deletion vulnerability. A malicious actor with local user privileges on the victim's machine may exploit this vulnerability to delete arbitrary files from the file system of the machine on which Workstation is installed. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.vmware.com/security/advisories/VMSA-2023-0003.html
CVE ID: CVE-2023-20855 State: PUBLISHED Published: 2023-02-21T00:00:00.000Z Last Updated: 2025-03-17T18:25:24.743Z Vendors: n/a Products: VMware vRealize Orchestrator, VMware vRealize Automation, VMware Cloud Foundation Problem Types: XML External Entity (XXE) Vulnerability Description: VMware vRealize Orchestrator contains an XML External Entity (XXE) vulnerability. A malicious actor, with non-administrative access to vRealize Orchestrator, may be able to use specially crafted input to bypass XML parsing restrictions leading to access to sensitive information or possible escalation of privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https
scalation of privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.vmware.com/security/advisories/VMSA-2023-0005.html
CVE ID: CVE-2023-20856 State: PUBLISHED Published: 2023-02-01T00:00:00.000Z Last Updated: 2025-03-27T14:36:08.877Z Vendors: n/a Products: VMware vRealize Operations (vROps) Problem Types: VMware vRealize Operations (vROps) update addresses a CSRF bypass vulnerability Description: VMware vRealize Operations (vROps) contains a CSRF bypass vulnerability. A malicious user could execute actions on the vROps platform on behalf of the authenticated victim user. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.vmware.com/security/advisories/VMSA-2023-0002.html
CVE ID: CVE-2023-20857 State: PUBLISHED Published: 2023-02-28T00:00:00.000Z Last Updated: 2025-03-10T14:46:52.730Z Vendors: n/a Products: VMware Workspace ONE Content Problem Types: Passcode bypass vulnerability. Description: VMware Workspace ONE Content contains a passcode bypass vulnerability. A malicious actor, with access to a users rooted device, may be able to bypass the VMware Workspace ONE Content passcode. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.vmware.com/security/advisories/VMSA-2023-0006.html - http://packetstormsecurity.com/files/171158/VMware-Security-Advisory-2023-0006.html
CVE ID: CVE-2023-20858 State: PUBLISHED Published: 2023-02-21T00:00:00.000Z Last Updated: 2025-03-17T18:25:57.164Z Vendors: n/a Products: VMware Carbon Black App Control Problem Types: Injection vulnerability Description: VMware Carbon Black App Control 8.7.x prior to 8.7.8, 8.8.x prior to 8.8.6, and 8.9.x.prior to 8.9.4 contain an injection vulnerability. A malicious actor with privileged access to the App Control administration console may be able to use specially crafted input allowing access to the underlying server operating system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.vmware.com/security/advisories/VMSA-2023-0004.html
CVE ID: CVE-2023-20859 State: PUBLISHED Published: 2023-03-23T00:00:00.000Z Last Updated: 2025-02-25T15:40:28.087Z Vendors: n/a Products: Spring Vault, Spring Cloud Vault, Spring Cloud Config Problem Types: Information disclosure vulnerability Description: In Spring Vault, versions 3.0.x prior to 3.0.2 and versions 2.3.x prior to 2.3.3 and older versions, an application is vulnerable to insertion of sensitive information into a log file when it attempts to revoke a Vault batch token. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://spring.io/security/cve-2023-20859
CVE ID: CVE-2023-20860 State: PUBLISHED Published: 2023-03-27T00:00:00.000Z Last Updated: 2025-02-19T19:05:54.805Z Vendors: n/a Products: Spring Framework Problem Types: Potential for security bypass with Spring mvcRequestMatcher configuration Description: Spring Framework running version 6.0.0 - 6.0.6 or 5.3.0 - 5.3.25 using "**" as a pattern in Spring Security configuration with the mvcRequestMatcher creates a mismatch in pattern matching between Spring Security and Spring MVC, and the potential for a security bypass. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://spring.io/security/cve-2023-20860 - https://security.netapp.com/advisory/nta