Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-1774 State: PUBLISHED Published: 2023-03-31T11:14:00.954Z Last Updated: 2024-12-06T23:05:52.973Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: Mattermost Products: Mattermost Problem Types: CWE-862 Description: When processing an email invite to a private channel on a team, Mattermost fails to validate the inviter's permission to that channel, allowing an attacker to invite themselves to a private channel. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates/
CVE ID: CVE-2023-1775 State: PUBLISHED Published: 2023-03-31T11:26:21.640Z Last Updated: 2024-12-06T23:05:41.615Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Mattermost Products: Mattermost Problem Types: CWE-200 Description: When running in a High Availability configuration, Mattermost fails to sanitize some of the user_updated and post_deleted events broadcast to all users, leading to disclosure of sensitive information to some of the users with currently connected Websocket clients. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates/
CVE ID: CVE-2023-1776 State: PUBLISHED Published: 2023-03-31T11:29:36.185Z Last Updated: 2024-12-06T23:05:30.076Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N) Vendors: Mattermost Products: Mattermost Problem Types: CWE-79 Description: Boards in Mattermost allows an attacker to upload a malicious SVG image file as an attachment to a card and share it using a direct link to the file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates/
CVE ID: CVE-2023-1777 State: PUBLISHED Published: 2023-03-31T11:35:22.813Z Last Updated: 2024-12-06T23:05:19.185Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Mattermost Products: Mattermost Problem Types: CWE-200 Description: Mattermost allows an attacker to request a preview of an existing message when creating a new message via the createPost API call, disclosing the contents of the linked message. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates/
CVE ID: CVE-2023-1778 State: PUBLISHED Published: 2023-04-27T09:33:19.070Z Last Updated: 2025-01-30T21:02:01.047Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: GajShield Products: Data Security Firewall Problem Types: CWE-287 Description: This vulnerability exists in GajShield Data Security Firewall firmware versions prior to v4.28 (except v4.21) due to insecure default credentials which allows remote attacker to login as superuser by using default username/password via web-based management interface and/or exposed SSH port thereby enabling remote attackers to execute arbitrary commands with administrative/superuser privileges on the targeted systems. The
ing remote attackers to execute arbitrary commands with administrative/superuser privileges on the targeted systems. The vulnerability has been addressed by forcing the user to change their default password to a new non-default password. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2023-0119
CVE ID: CVE-2023-1779 State: PUBLISHED Published: 2023-06-06T10:07:35.354Z Last Updated: 2025-01-07T19:19:11.622Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: MB Connect Line, Helmholz Products: mbCONNECT24, mymbCONNECT24, myREX24, myREX24.virtual Problem Types: CWE-863 Description: Exposure of Sensitive Information to an unauthorized actor vulnerability in MB Connect Lines mbCONNECT24, mymbCONNECT24 and Helmholz' myREX24 and myREX24.virtual in versions <=2.13.3 allow an authorized remote attacker with low privileges to view a limited amount of another accounts contact information. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment
ount of another accounts contact information. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert.vde.com/en/advisories/VDE-2023-008/
CVE ID: CVE-2023-1780 State: PUBLISHED Published: 2023-07-10T12:40:32.893Z Last Updated: 2024-11-08T18:23:54.090Z Vendors: Unknown Products: Companion Sitemap Generator Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Companion Sitemap Generator WordPress plugin before 4.5.3 does not sanitise and escape some parameters before outputting them back in pages, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/8176308f-f210-4109-9c88-9372415dbed3
CVE ID: CVE-2023-1782 State: PUBLISHED Published: 2023-04-05T19:10:52.697Z Last Updated: 2025-02-10T16:27:03.209Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: HashiCorp Products: Nomad, Nomad Enterprise Problem Types: CWE-862 Description: HashiCorp Nomad and Nomad Enterprise versions 1.5.0 up to 1.5.2 allow unauthenticated users to bypass intended ACL authorizations for clusters where mTLS is not enabled. This issue is fixed in version 1.5.3. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://discuss.hashicorp.com/t/hcsec-2023-12-nomad-unauthenticated-client-agent-http-request-privilege-escalation/52375
CVE ID: CVE-2023-1783 State: PUBLISHED Published: 2023-06-23T21:55:48.800Z Last Updated: 2024-11-27T19:56:41.416Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Orangescrum Products: Orangescrum Problem Types: CWE-79 Description: OrangeScrum version 2.0.11 allows an external attacker to remotely obtain AWS instance credentials. This is possible because the application does not properly validate the HTML content to be converted to PDF. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Orangescrum/orangescrum/ - https://fluidattacks.com/advisories/stirling/
CVE ID: CVE-2023-1784 State: PUBLISHED Published: 2023-03-31T20:00:05.366Z Last Updated: 2025-02-11T17:23:49.332Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: n/a Products: jeecg-boot Problem Types: CWE-287 Description: A vulnerability was found in jeecg-boot 3.5.0 and classified as critical. This issue affects some unknown processing of the component API Documentation. The manipulation leads to improper authentication. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-224699. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment:
tifier of this vulnerability is VDB-224699. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.224699 - https://vuldb.com/?ctiid.224699 - https://note.youdao.com/ynoteshare/index.html?id=7eb8fc804ea3544d8add43749a09173e
CVE ID: CVE-2023-1785 State: PUBLISHED Published: 2023-03-31T20:00:06.742Z Last Updated: 2024-08-02T05:57:25.236Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Earnings and Expense Tracker App Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester Earnings and Expense Tracker App 1.0. It has been classified as critical. Affected is an unknown function of the file manage_user.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The identifier of this vulnerability is VDB-224700. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.224700 -
erability is VDB-224700. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.224700 - https://vuldb.com/?ctiid.224700 - https://github.com/web-zxl/img/blob/main/4.png
CVE ID: CVE-2023-1786 State: PUBLISHED Published: 2023-04-26T22:23:47.305Z Last Updated: 2025-02-13T16:39:30.230Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Canonical Ltd. Products: cloud-init Problem Types: CWE-532 Description: Sensitive data could be exposed in logs of cloud-init before version 23.1.2. An attacker could use this information to find hashed passwords and possibly escalate their privilege. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/canonical/cloud-init/commit/a378b7e4f47375458651c0972e7cd813f6fe0a6b - https://bugs.launchpad.net/cloud-init/+bug/2013967 - https://ubuntu.com/
mmit/a378b7e4f47375458651c0972e7cd813f6fe0a6b - https://bugs.launchpad.net/cloud-init/+bug/2013967 - https://ubuntu.com/security/notices/USN-6042-1 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ATBJSXPL2IOAD2LDQRKWPLIC7QXS44GZ/
CVE ID: CVE-2023-1787 State: PUBLISHED Published: 2023-04-05T00:00:00.000Z Last Updated: 2025-02-10T20:42:19.982Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: GitLab Products: GitLab Problem Types: Uncontrolled resource consumption in GitLab Description: An issue has been discovered in GitLab affecting all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1. A search timeout could be triggered if a specific HTML payload was used in the issue description. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/394817 - https://gitlab.com/g
iner: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/394817 - https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-1787.json
CVE ID: CVE-2023-1788 State: PUBLISHED Published: 2023-04-05T00:00:00.000Z Last Updated: 2025-02-10T20:41:33.690Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: firefly-iii Products: firefly-iii/firefly-iii Problem Types: CWE-613 Description: Insufficient Session Expiration in GitHub repository firefly-iii/firefly-iii prior to 6. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/79323c9e-e0e5-48ef-bd19-d0b09587ccb2 - https://github.com/firefly-iii/firefly-iii/commit/68f398f97cbe1870fc098d8460bf903b9c3fab30
CVE ID: CVE-2023-1789 State: PUBLISHED Published: 2023-04-01T00:00:00.000Z Last Updated: 2025-02-11T16:44:22.914Z Severity: MEDIUM (CVSS 5.2 CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: firefly-iii Products: firefly-iii/firefly-iii Problem Types: CWE-20 Description: Improper Input Validation in GitHub repository firefly-iii/firefly-iii prior to 6.0.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/2c3489f7-6b84-48f8-9368-9cea67cf373d - https://github.com/firefly-iii/firefly-iii/commit/6b05c0fbd3e8c40ae9b24dc2698821786fccf0c5
CVE ID: CVE-2023-1790 State: PUBLISHED Published: 2023-04-01T09:00:04.922Z Last Updated: 2024-08-02T05:57:24.985Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: SourceCodester Products: Simple Task Allocation System Problem Types: CWE-200 Description: A vulnerability, which was classified as problematic, was found in SourceCodester Simple Task Allocation System 1.0. Affected is an unknown function of the file index.php. The manipulation of the argument page leads to information disclosure. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-224724. Additional
exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-224724. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.224724 - https://vuldb.com/?ctiid.224724 - https://github.com/Pe4cefulSnow/CVE-Advisory/blob/main/uploadcve.md
CVE ID: CVE-2023-1791 State: PUBLISHED Published: 2023-04-02T07:00:07.231Z Last Updated: 2024-08-02T05:57:25.258Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Simple Task Allocation System Problem Types: CWE-89 Description: A vulnerability has been found in SourceCodester Simple Task Allocation System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file manage_user.php. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-224743. Additional Ana
n disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-224743. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.224743 - https://vuldb.com/?ctiid.224743 - https://github.com/Pe4cefulSnow/SQL-Injection/blob/main/SQLcve.md
CVE ID: CVE-2023-1792 State: PUBLISHED Published: 2023-04-02T07:00:08.537Z Last Updated: 2024-08-02T05:57:25.192Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Simple Mobile Comparison Website Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester Simple Mobile Comparison Website 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/fields/manage_field.php of the component GET Parameter Handler. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulne
ack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-224744. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.224744 - https://vuldb.com/?ctiid.224744 - https://github.com/LOBSSSA5DD5/bug_report/blob/main/SQLi-1.md
CVE ID: CVE-2023-1793 State: PUBLISHED Published: 2023-04-02T07:31:03.379Z Last Updated: 2024-08-02T05:57:25.219Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Police Crime Record Management System Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester Police Crime Record Management System 1.0. It has been classified as critical. This affects an unknown part of the file /officer/assigncase.php of the component GET Parameter Handler. The manipulation of the argument caseid leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-224745
to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-224745 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.224745 - https://vuldb.com/?ctiid.224745 - https://github.com/fillorkill/bug_report/blob/main/SQLi-1.md
CVE ID: CVE-2023-1794 State: PUBLISHED Published: 2023-04-02T08:00:05.737Z Last Updated: 2024-08-02T05:57:25.004Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: SourceCodester Products: Police Crime Record Management System Problem Types: CWE-79 Description: A vulnerability was found in SourceCodester Police Crime Record Management System 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file /admin/casedetails.php of the component GET Parameter Handler. The manipulation of the argument id with the input "><script>alert(233)</script> leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the pu
)</script> leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-224746 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.224746 - https://vuldb.com/?ctiid.224746 - https://github.com/fillorkill/bug_report/blob/main/XSS-1.md
CVE ID: CVE-2023-1795 State: PUBLISHED Published: 2023-04-02T08:31:03.827Z Last Updated: 2024-08-02T05:57:25.055Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: SourceCodester Products: Gadget Works Online Ordering System Problem Types: CWE-79 Description: A vulnerability was found in SourceCodester Gadget Works Online Ordering System 1.0. It has been rated as problematic. This issue affects some unknown processing of the file /admin/products/index.php of the component GET Parameter Handler. The manipulation of the argument view with the input <script>alert(666)</script> leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the pub
</script> leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-224747. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.224747 - https://vuldb.com/?ctiid.224747 - https://github.com/FinleyTang/bug_report/blob/main/XSS-1.md
CVE ID: CVE-2023-1796 State: PUBLISHED Published: 2023-04-02T09:00:06.561Z Last Updated: 2024-11-22T21:49:09.156Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N) Vendors: SourceCodester Products: Employee Payslip Generator Problem Types: CWE-79 Description: A vulnerability classified as problematic has been found in SourceCodester Employee Payslip Generator 1.0. Affected is an unknown function of the file /classes/Master.php?f=save_position of the component Create News Handler. The manipulation of the argument name with the input <script>alert(document.cookie)</script> leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the publi
leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-224748. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.224748 - https://vuldb.com/?ctiid.224748 - https://github.com/Jean-Astruc/bug_report/blob/main/XSS-1.md
CVE ID: CVE-2023-1797 State: PUBLISHED Published: 2023-04-02T09:00:07.864Z Last Updated: 2024-08-02T06:05:26.160Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: n/a Products: OTCMS Problem Types: CWE-434 Description: A vulnerability classified as critical was found in OTCMS 6.0.1. Affected by this vulnerability is an unknown functionality of the file sysCheckFile.php?mudi=sql. The manipulation leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-224749 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.224749 - ht
o this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.224749 - https://vuldb.com/?ctiid.224749 - https://gitee.com/wkstestete/cve/blob/master/upload/upload1.md
CVE ID: CVE-2023-1798 State: PUBLISHED Published: 2023-04-02T09:31:03.558Z Last Updated: 2024-08-02T06:05:26.058Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: n/a Products: EyouCMS Problem Types: CWE-79 Description: A vulnerability, which was classified as problematic, has been found in EyouCMS up to 1.5.4. Affected by this issue is some unknown functionality of the file login.php. The manipulation of the argument typename leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-224750 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - htt
0 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.224750 - https://vuldb.com/?ctiid.224750 - https://gitee.com/wkstestete/cve/blob/master/xss/eyoucms%20xss.md
CVE ID: CVE-2023-1799 State: PUBLISHED Published: 2023-04-02T10:00:06.308Z Last Updated: 2025-02-11T16:07:03.180Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: n/a Products: EyouCMS Problem Types: CWE-79 Description: A vulnerability, which was classified as problematic, was found in EyouCMS up to 1.5.4. This affects an unknown part of the file login.php. The manipulation of the argument tag_tag leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-224751. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Reference
this vulnerability is VDB-224751. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.224751 - https://vuldb.com/?ctiid.224751 - https://gitee.com/wkstestete/cve/blob/master/xss/Eyoucms%20xss2.md
CVE ID: CVE-2023-1800 State: PUBLISHED Published: 2023-04-02T10:31:03.341Z Last Updated: 2024-11-22T21:40:19.685Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: sjqzhang Products: go-fastdfs Problem Types: CWE-24 Description: A vulnerability, which was classified as critical, has been found in sjqzhang go-fastdfs up to 1.4.3. Affected by this issue is the function upload of the file /group1/uploa of the component File Upload Handler. The manipulation leads to path traversal: '../filedir'. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-224768. Additional Analyst Notes: - CVE Program C
he public and may be used. The identifier of this vulnerability is VDB-224768. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.224768 - https://vuldb.com/?ctiid.224768 - https://github.com/yangyanglo/ForCVE/blob/main/2023-0x05.md
CVE ID: CVE-2023-1801 State: PUBLISHED Published: 2023-04-07T20:40:55.540Z Last Updated: 2025-02-13T16:39:31.168Z Vendors: The Tcpdump Group Products: tcpdump Problem Types: CWE-787 Description: The SMB protocol decoder in tcpdump version 4.99.3 can perform an out-of-bounds write when decoding a crafted network packet. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/the-tcpdump-group/tcpdump/commit/7578e1c04ee280dda50c4c2813e7d55f539c6501 - https://github.com/the-tcpdump-group/tcpdump/commit/03c037bbd75588beba3ee09f26d17783d21e30bc - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KOA2BJFERAC3VRQIRHJOWN4HZY4ZA
s://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KOA2BJFERAC3VRQIRHJOWN4HZY4ZA7CH/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WYL5DEVHRJYF2CM5LTCZKEYFYDZAIZSN/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZLLZCG23MU6O4QOG2CX3DLEL3YXP6LAI/ - https://support.apple.com/kb/HT213844 - https://support.apple.com/kb/HT213845
CVE ID: CVE-2023-1802 State: PUBLISHED Published: 2023-04-06T08:52:19.506Z Last Updated: 2025-02-10T20:22:38.457Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Docker Products: Docker Desktop Problem Types: CWE-319 Description: In Docker Desktop 4.17.x the Artifactory Integration falls back to sending registry credentials over plain HTTP if the HTTPS health check has failed. A targeted network sniffing attack can lead to a disclosure of sensitive information. Only users who have Access Experimental Features enabled and have logged in to a private registry are affected. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: