Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-33173 State: PUBLISHED Published: 2023-07-11T17:02:23.850Z Last Updated: 2025-01-01T01:51:58.274Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows 11 version 21H2, Windows 10 Version 21H2, Windows 11 version 22H2, Windows 10 Version 22H2, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 Service Pack 2 (Server Core installation), Windows Server 2008 Service Pack 2,
2008 Service Pack 2, Windows Server 2008 Service Pack 2 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 R2 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) Problem Types: CWE-126 Description: Remote Procedure Call Runtime Denial of Service Vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-33173
CVE ID: CVE-2023-33174 State: PUBLISHED Published: 2023-07-11T17:02:24.397Z Last Updated: 2025-01-01T01:51:58.822Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows 11 version 21H2, Windows 10 Version 21H2, Windows 11 version 22H2, Windows 10 Version 22H2, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 Service Pack 2 (Server Core installation), Windows Server 2008 Service Pack 2,
2008 Service Pack 2, Windows Server 2008 Service Pack 2 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 R2 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) Problem Types: CWE-200 Description: Windows Cryptographic Information Disclosure Vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-33174
CVE ID: CVE-2023-33175 State: PUBLISHED Published: 2023-05-30T04:31:36.503Z Last Updated: 2025-01-10T20:35:07.109Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: mubarakalmehairbi Products: ToUI Problem Types: CWE-914 Description: ToUI is a Python package for creating user interfaces (websites and desktop apps) from HTML. ToUI is using Flask-Caching (SimpleCache) to store user variables. Websites that use `Website.user_vars` property. It affects versions 2.0.1 to 2.4.0. This issue has been patched in version 2.4.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/mubarakalmehairbi/ToUI/security/a
es: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/mubarakalmehairbi/ToUI/security/advisories/GHSA-hh7j-pg39-q563 - https://github.com/mubarakalmehairbi/ToUI/releases/tag/v2.4.1
CVE ID: CVE-2023-33176 State: PUBLISHED Published: 2023-06-26T19:50:25.212Z Last Updated: 2024-11-12T15:18:46.803Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L) Vendors: bigbluebutton Products: bigbluebutton Problem Types: CWE-918 Description: BigBlueButton is an open source virtual classroom designed to help teachers teach and learners learn. In affected versions are affected by a Server-Side Request Forgery (SSRF) vulnerability. In an `insertDocument` API request the user is able to supply a URL from which the presentation should be downloaded. This URL was being used without having been successfully validated first. An update to the `followRedirect` method in th
This URL was being used without having been successfully validated first. An update to the `followRedirect` method in the `PresentationUrlDownloadService` has been made to validate all URLs to be used for presentation download. Two new properties `presentationDownloadSupportedProtocols` and `presentationDownloadBlockedHosts` have also been added to `bigbluebutton.properties` to allow administrators to define what protocols a URL must use and to explicitly define hosts that a presentation cannot be downloaded from. All URLs passed to `insertDocument` must conform to the requirements of the two previously mentioned properties. Additionally, these URLs must resolve to valid addresses, and these
irements of the two previously mentioned properties. Additionally, these URLs must resolve to valid addresses, and these addresses must not be local or loopback addresses. There are no workarounds. Users are advised to upgrade to a patched version of BigBlueButton. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-3q22-hph2-cff7 - https://github.com/bigbluebutton/bigbluebutton/pull/18045 - https://github.com/bigbluebutton/bigbluebutton/pull/18052 - https://github.com/bigbluebutton/bigbluebutton/commit/43394dade595d0707384e4878357901537352415 - https://github.com/bigbluebutton/bigbl
com/bigbluebutton/bigbluebutton/commit/43394dade595d0707384e4878357901537352415 - https://github.com/bigbluebutton/bigbluebutton/commit/b18aff32e65a47f1eb2c800e86dcfc7a8fb05e71
CVE ID: CVE-2023-33177 State: PUBLISHED Published: 2023-05-30T19:12:01.606Z Last Updated: 2025-06-17T20:21:25.891Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: xibosignage Products: xibo-cms Problem Types: CWE-22 Description: Xibo is a content management system (CMS). A path traversal vulnerability exists in the Xibo CMS whereby a specially crafted zip file can be uploaded to the CMS via the layout import function by an authenticated user which would allow creation of files outside of the CMS library directory as the webserver user. This can be used to upload a PHP webshell inside the web root directory and achieve remote code execution as the webserver use
an be used to upload a PHP webshell inside the web root directory and achieve remote code execution as the webserver user. Users should upgrade to version 2.3.17 or 3.3.5, which fix this issue. Customers who host their CMS with Xibo Signage have already received an upgrade or patch to resolve this issue regardless of the CMS version that they are running. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/xibosignage/xibo-cms/security/advisories/GHSA-jj27-x85q-crqv - https://github.com/xibosignage/xibo-cms/commit/1cbba380fa751a00756e70d7b08b5c6646092658 - https://github.com/xibosignage/xibo-cms/commit/45c6b53c3978639db03b63270a56f4397
ba380fa751a00756e70d7b08b5c6646092658 - https://github.com/xibosignage/xibo-cms/commit/45c6b53c3978639db03b63270a56f4397f49b2c9 - https://claroty.com/team82/disclosure-dashboard - https://xibosignage.com/blog/security-advisory-2023-05/
CVE ID: CVE-2023-33178 State: PUBLISHED Published: 2023-05-30T19:55:49.496Z Last Updated: 2025-01-09T19:16:45.390Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: xibosignage Products: xibo-cms Problem Types: CWE-89 Description: Xibo is a content management system (CMS). An SQL injection vulnerability was discovered in the `/dataset/data/{id}` API route inside the CMS starting in version 1.4.0 and prior to versions 2.3.17 and 3.3.5. This allows an authenticated user to exfiltrate data from the Xibo database by injecting specially crafted values in to the `filter` parameter. Values allowed in the filter parameter are checked against a deny list of commands th
lues in to the `filter` parameter. Values allowed in the filter parameter are checked against a deny list of commands that should not be allowed, however this checking was done in a case sensitive manor and so it is possible to bypass these checks by using unusual case combinations. Users should upgrade to version 2.3.17 or 3.3.5, which fix this issue. There are no workarounds aside from upgrading. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/xibosignage/xibo-cms/security/advisories/GHSA-g9x2-757j-hmhh - https://claroty.com/team82/disclosure-dashboard - https://xibosignage.com/blog/security-advisory-2023-05/
CVE ID: CVE-2023-33179 State: PUBLISHED Published: 2023-05-30T20:07:13.870Z Last Updated: 2025-01-09T21:16:43.284Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: xibosignage Products: xibo-cms Problem Types: CWE-89 Description: Xibo is a content management system (CMS). An SQL injection vulnerability was discovered starting in version 3.2.0 and prior to version 3.3.5 in the `nameFilter` function used throughout the CMS. This allows an authenticated user to exfiltrate data from the Xibo database by injecting specially crafted values for logical operators. Users should upgrade to version 3.3.5 which fixes this issue. There are no known workarounds aside from
ical operators. Users should upgrade to version 3.3.5 which fixes this issue. There are no known workarounds aside from upgrading. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/xibosignage/xibo-cms/security/advisories/GHSA-jmx8-cgm4-7mf5 - https://claroty.com/team82/disclosure-dashboard - https://xibosignage.com/blog/security-advisory-2023-05/
CVE ID: CVE-2023-33180 State: PUBLISHED Published: 2023-05-30T20:18:40.895Z Last Updated: 2025-01-09T21:15:34.741Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: xibosignage Products: xibo-cms Problem Types: CWE-89 Description: Xibo is a content management system (CMS). An SQL injection vulnerability was discovered starting in version 3.2.0 and prior to version 3.3.2 in the `/display/map` API route inside the CMS. This allows an authenticated user to exfiltrate data from the Xibo database by injecting specially crafted values in to the `bounds` parameter. Users should upgrade to version 3.3.5, which fixes this issue. There are no known workarounds aside fro
unds` parameter. Users should upgrade to version 3.3.5, which fixes this issue. There are no known workarounds aside from upgrading. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/xibosignage/xibo-cms/security/advisories/GHSA-7ww5-x9rm-qm89 - https://claroty.com/team82/disclosure-dashboard - https://xibosignage.com/blog/security-advisory-2023-05/
CVE ID: CVE-2023-33181 State: PUBLISHED Published: 2023-05-30T20:57:38.437Z Last Updated: 2025-01-09T18:48:26.867Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: xibosignage Products: xibo-cms Problem Types: CWE-209 Description: Xibo is a content management system (CMS). Starting in version 3.0.0 and prior to version 3.3.5, some API routes will print a stack trace when called with missing or invalid parameters revealing sensitive information about the locations of paths that the server is using. Users should upgrade to version 3.3.5, which fixes this issue. There are no known workarounds aside from upgrading. Additional Analyst Notes: - CVE Program Containe
fixes this issue. There are no known workarounds aside from upgrading. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/xibosignage/xibo-cms/security/advisories/GHSA-c9cx-ghwr-x58m - https://claroty.com/team82/disclosure-dashboard - https://xibosignage.com/blog/security-advisory-2023-05/
CVE ID: CVE-2023-33182 State: PUBLISHED Published: 2023-05-30T04:58:07.669Z Last Updated: 2025-01-10T19:59:11.557Z Severity: NONE (CVSS N/A CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:N) Vendors: nextcloud Products: security-advisories Problem Types: CWE-20 Description: Contacts app for Nextcloud easily syncs contacts from various devices with your Nextcloud and allows editing. The unsanitized SVG is converted to a JavaScript blob (in memory data) that the Avatar can't render. Due to this constellation the missing sanitization does not seem to be exploitable. It is recommended that the Contacts app is upgraded to 5.0.3 or 4.2.4 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vul
ed that the Contacts app is upgraded to 5.0.3 or 4.2.4 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-hxr6-cx85-gcjx - https://github.com/nextcloud/contacts/pull/3199 - https://hackerone.com/reports/1789602
CVE ID: CVE-2023-33183 State: PUBLISHED Published: 2023-05-30T05:01:55.759Z Last Updated: 2025-01-10T19:58:25.902Z Severity: LOW (CVSS 2.6 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N) Vendors: nextcloud Products: security-advisories Problem Types: CWE-285 Description: Calendar app for Nextcloud easily sync events from various devices with your Nextcloud. Some internal paths of the website are disclosed when the SMTP server is unavailable. It is recommended that the Calendar app is updated to 3.5.5 or 4.2.3 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-2792-2734-hr7j - https:
ichment: References: - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-2792-2734-hr7j - https://github.com/nextcloud/calendar/pull/4938
CVE ID: CVE-2023-33184 State: PUBLISHED Published: 2023-05-27T04:36:01.535Z Last Updated: 2025-01-14T18:17:48.760Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N) Vendors: nextcloud Products: security-advisories Problem Types: CWE-918 Description: Nextcloud Mail is a mail app in Nextcloud. A blind SSRF attack allowed to send GET requests to services running in the same web server. It is recommended that the Mail app is update to version 3.02, 2.2.5 or 1.15.3. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-8gph-9895-w564 - https://github.com/nextcloud/mail
s://github.com/nextcloud/security-advisories/security/advisories/GHSA-8gph-9895-w564 - https://github.com/nextcloud/mail/pull/8275 - https://hackerone.com/reports/1913095
CVE ID: CVE-2023-33185 State: PUBLISHED Published: 2023-05-26T20:03:33.725Z Last Updated: 2025-01-14T19:31:45.155Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L) Vendors: django-ses Products: django-ses Problem Types: CWE-347 Description: Django-SES is a drop-in mail backend for Django. The django_ses library implements a mail backend for Django using AWS Simple Email Service. The library exports the `SESEventWebhookView class` intended to receive signed requests from AWS to handle email bounces, subscriptions, etc. These requests are signed by AWS and are verified by django_ses, however the verification of this signature was found to be flawed as it allowed users t
and are verified by django_ses, however the verification of this signature was found to be flawed as it allowed users to specify arbitrary public certificates. This issue was patched in version 3.5.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/django-ses/django-ses/security/advisories/GHSA-qg36-9jxh-fj25 - https://github.com/django-ses/django-ses/commit/b71b5f413293a13997b6e6314086cb9c22629795 - https://github.com/django-ses/django-ses/blob/3d627067935876487f9938310d5e1fbb249a7778/CVE/001-cert-url-signature-verification.md
CVE ID: CVE-2023-33186 State: PUBLISHED Published: 2023-05-30T05:31:37.279Z Last Updated: 2025-01-10T19:47:40.529Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L) Vendors: zulip Products: zulip Problem Types: CWE-79 Description: Zulip is an open-source team collaboration tool with unique topic-based threading that combines the best of email and chat to make remote work productive and delightful. The main development branch of Zulip Server from May 2, 2023 and later, including beta versions 7.0-beta1 and 7.0-beta2, is vulnerable to a cross-site scripting vulnerability in tooltips on the message feed. An attacker who can send messages could maliciously craft a topic for
ng vulnerability in tooltips on the message feed. An attacker who can send messages could maliciously craft a topic for the message, such that a victim who hovers the tooltip for that topic in their message feed triggers execution of JavaScript code controlled by the attacker. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/zulip/zulip/security/advisories/GHSA-4r83-8f94-hrph - https://github.com/zulip/zulip/pull/25370 - https://github.com/zulip/zulip/commit/03cfb3d9fe61c975d133121ec31a7357f0c9e18f - https://github.com/zulip/zulip/commit/3ca131743b00f42bad8edbac4ef92656d954c629
CVE ID: CVE-2023-33187 State: PUBLISHED Published: 2023-05-26T20:11:54.507Z Last Updated: 2025-01-14T19:30:59.002Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N) Vendors: highlight Products: highlight Problem Types: CWE-319 Description: Highlight is an open source, full-stack monitoring platform. Highlight may record passwords on customer deployments when a password html input is switched to `type="text"` via a javascript "Show Password" button. This differs from the expected behavior which always obfuscates `type="password"` inputs. A customer may assume that switching to `type="text"` would also not record this input; hence, they would not add additional `highligh
assume that switching to `type="text"` would also not record this input; hence, they would not add additional `highlight-mask` css-class obfuscation to this part of the DOM, resulting in unintentional recording of a password value when a `Show Password` button is used. This issue was patched in version 6.0.0. This patch tracks changes to the `type` attribute of an input to ensure an input that used to be a `type="password"` continues to be obfuscated. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/highlight/highlight/security/advisories/GHSA-9qpj-qq2r-5mcc - https://github.com/rrweb-io/rrweb/pull/1184
CVE ID: CVE-2023-33188 State: PUBLISHED Published: 2023-05-27T03:47:52.194Z Last Updated: 2025-01-14T18:22:17.011Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:L) Vendors: federicoiosue Products: Omni-Notes Problem Types: CWE-441, CWE-610 Description: Omni-notes is an open source note-taking application for Android. The Omni-notes Android app had an insufficient path validation vulnerability when displaying the details of a note received through an externally-provided intent. The paths of the note's attachments were not properly validated, allowing malicious or compromised applications in the same device to force Omni-notes to copy files from its internal storage to
malicious or compromised applications in the same device to force Omni-notes to copy files from its internal storage to its external storage directory, where they would have become accessible to any component with permission to read the external storage. Updating to the newest version (6.2.7) of Omni-notes Android fixes this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/federicoiosue/Omni-Notes/security/advisories/GHSA-g38r-4cf6-3v32
CVE ID: CVE-2023-33189 State: PUBLISHED Published: 2023-05-30T05:39:45.132Z Last Updated: 2025-01-10T19:02:02.336Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N) Vendors: pomerium Products: pomerium Problem Types: CWE-285 Description: Pomerium is an identity and context-aware access proxy. With specially crafted requests, incorrect authorization decisions may be made by Pomerium. This issue has been patched in versions 0.17.4, 0.18.1, 0.19.2, 0.20.1, 0.21.4 and 0.22.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/pomerium/pomerium/security/advisories/GHSA-pvrc-wvj2-f59p - https://github.com/pomerium/po
erences: - https://github.com/pomerium/pomerium/security/advisories/GHSA-pvrc-wvj2-f59p - https://github.com/pomerium/pomerium/commit/d315e683357a9b587ba9ef399a8813bcc52fdebb - https://github.com/pomerium/pomerium/releases/tag/v0.17.4 - https://github.com/pomerium/pomerium/releases/tag/v0.18.1 - https://github.com/pomerium/pomerium/releases/tag/v0.19.2 - https://github.com/pomerium/pomerium/releases/tag/v0.20.1 - https://github.com/pomerium/pomerium/releases/tag/v0.21.4 - https://github.com/pomerium/pomerium/releases/tag/v0.22.2
CVE ID: CVE-2023-33190 State: PUBLISHED Published: 2023-06-29T17:27:08.015Z Last Updated: 2024-11-06T17:14:26.101Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: labring Products: sealos Problem Types: CWE-287 Description: Sealos is an open source cloud operating system distribution based on the Kubernetes kernel. In versions of Sealos prior to 4.2.1-rc4 an improper configuration of role based access control (RBAC) permissions resulted in an attacker being able to obtain cluster control permissions, which could control the entire cluster deployed with Sealos, as well as hundreds of pods and other resources within the cluster. This issue has been addressed
deployed with Sealos, as well as hundreds of pods and other resources within the cluster. This issue has been addressed in version 4.2.1-rc4. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/labring/sealos/security/advisories/GHSA-74j8-w7f9-pp62 - https://github.com/labring/sealos/commit/4cdf52e55666864e5f90ed502e9fc13e18985b7b
CVE ID: CVE-2023-33191 State: PUBLISHED Published: 2023-05-30T06:06:14.987Z Last Updated: 2025-01-10T19:00:31.962Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L) Vendors: kyverno Products: kyverno Problem Types: CWE-284 Description: Kyverno is a policy engine designed for Kubernetes. Kyverno seccomp control can be circumvented. Users of the podSecurity `validate.podSecurity` subrule in Kyverno 1.9.2 and 1.9.3 are vulnerable. This issue was patched in version 1.9.4. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/kyverno/kyverno/security/advisories/GHSA-33hq-f2mf-jm3c - https://github.com/kyverno/kyverno/pu
es: - https://github.com/kyverno/kyverno/security/advisories/GHSA-33hq-f2mf-jm3c - https://github.com/kyverno/kyverno/pull/7263 - https://github.com/kyverno/kyverno/releases/tag/v1.9.4
CVE ID: CVE-2023-33192 State: PUBLISHED Published: 2023-05-27T03:53:34.506Z Last Updated: 2025-01-14T18:20:44.928Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: pendulum-project Products: ntpd-rs Problem Types: CWE-130 Description: ntpd-rs is an NTP implementation written in Rust. ntpd-rs does not validate the length of NTS cookies in received NTP packets to the server. An attacker can crash the server by sending a specially crafted NTP packet containing a cookie shorter than what the server expects. The server also crashes when it is not configured to handle NTS packets. The issue was caused by improper slice indexing. The indexing operations were replaced