Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ent::save()` method, the package would use a series of unsanitized and insecure input values from the mail as fallback. Even if a developer passes a `$filename` into the `Attachment::save()` method, e.g. by passing the name or filename of the mail attachment itself (from email headers), the input values never get sanitized by the package. There is also no restriction about the file extension (e.g. ".php") or the contents of a file. This allows an attacker to upload malicious code of any type and content at any location where the underlying user has write permissions. The attacker can also overwrite existing files and inject malicious code into files that, e.g. get executed by the system via
tacker can also overwrite existing files and inject malicious code into files that, e.g. get executed by the system via cron or requests. Version 5.3.0 contains a patch for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Webklex/php-imap/security/advisories/GHSA-47p7-xfcc-4pv9 - https://github.com/Webklex/php-imap/pull/414 - https://github.com/Webklex/php-imap/blob/5.2.0/src/Attachment.php#L251-L255 - https://github.com/Webklex/php-imap/blob/5.2.0/src/Attachment.php#L252 - https://github.com/Webklex/php-imap/releases/tag/5.3.0
CVE ID: CVE-2023-35170 State: REJECTED Published: 2023-06-26T19:40:23.707Z Last Updated: 2023-06-29T20:40:31.244Z Description: No description available.
CVE ID: CVE-2023-35171 State: PUBLISHED Published: 2023-06-23T20:44:34.272Z Last Updated: 2024-11-07T18:46:56.587Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N) Vendors: nextcloud Products: security-advisories Problem Types: CWE-601 Description: NextCloud Server and NextCloud Enterprise Server provide file storage for Nextcloud, a self-hosted productivity platform. Starting in version 26.0.0 and prior to version 26.0.2, an attacker could supply a URL that redirects an unsuspecting victim from a legitimate domain to an attacker's site. Nextcloud Server and Nextcloud Enterprise Server 26.0.2 contain a patch for this issue. No known workarounds are available. Addition
rver and Nextcloud Enterprise Server 26.0.2 contain a patch for this issue. No known workarounds are available. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-h353-vvwv-j2r4 - https://github.com/nextcloud/server/pull/38194 - https://hackerone.com/reports/1977222
CVE ID: CVE-2023-35172 State: PUBLISHED Published: 2023-06-23T20:49:56.795Z Last Updated: 2024-12-05T16:16:35.458Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N) Vendors: nextcloud Products: security-advisories Problem Types: CWE-307 Description: NextCloud Server and NextCloud Enterprise Server provide file storage for Nextcloud, a self-hosted productivity platform. In NextCloud Server versions 25.0.0 until 25.0.7 and 26.0.0 until 26.0.2 and Nextcloud Enterprise Server versions 21.0.0 until 21.0.9.12, 22.0.0 until 22.2.10.12, 23.0.0 until 23.0.12.7, 24.0.0 until 24.0.12.2, 25.0.0 until 25.0.7, and 26.0.0 until 26.0.2, an attacker can bruteforce the password reset link
24.0.0 until 24.0.12.2, 25.0.0 until 25.0.7, and 26.0.0 until 26.0.2, an attacker can bruteforce the password reset links. Nextcloud Server n 25.0.7 and 26.0.2 and Nextcloud Enterprise Server 21.0.9.12, 22.2.10.12, 23.0.12.7, 24.0.12.2, 25.0.7, and 26.0.2 contain a patch for this issue. No known workarounds are available. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-mjf5-p765-qmr6 - https://github.com/nextcloud/server/pull/38267 - https://hackerone.com/reports/1987062
CVE ID: CVE-2023-35173 State: PUBLISHED Published: 2023-06-23T20:50:15.948Z Last Updated: 2024-08-02T16:23:59.642Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H) Vendors: nextcloud Products: security-advisories Problem Types: CWE-284 Description: Nextcloud End-to-end encryption app provides all the necessary APIs to implement End-to-End encryption on the client side. By providing an invalid meta data file, an attacker can make previously dropped files inaccessible. It is recommended that the Nextcloud End-to-end encryption app is upgraded to version 1.12.4 that contains the fix. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/next
n 1.12.4 that contains the fix. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-x7c7-v5r3-mg37 - https://github.com/nextcloud/end_to_end_encryption/pull/435 - https://hackerone.com/reports/1914115
CVE ID: CVE-2023-35174 State: PUBLISHED Published: 2023-06-22T13:34:38.492Z Last Updated: 2024-12-06T15:14:24.752Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L) Vendors: livebook-dev Products: livebook Problem Types: CWE-78 Description: Livebook is a web application for writing interactive and collaborative code notebooks. On Windows, it is possible to open a `livebook://` link from a browser which opens Livebook Desktop and triggers arbitrary code execution on victim's machine. Any user using Livebook Desktop on Windows is potentially vulnerable to arbitrary code execution when they expect Livebook to be opened from browser. This vulnerability has been fixed in vers
arbitrary code execution when they expect Livebook to be opened from browser. This vulnerability has been fixed in version 0.8.2 and 0.9.3. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/livebook-dev/livebook/security/advisories/GHSA-564w-97r7-c6p9 - https://github.com/livebook-dev/livebook/commit/2e11b59f677c6ed3b6aa82dad412a8b3406ffdf1 - https://github.com/livebook-dev/livebook/commit/beb10daaadcc765f0380e436bd7cd5f74cf086c8 - https://github.com/livebook-dev/livebook/releases/tag/v0.8.2 - https://github.com/livebook-dev/livebook/releases/tag/v0.9.3
CVE ID: CVE-2023-35175 State: PUBLISHED Published: 2023-06-30T15:43:02.451Z Last Updated: 2024-12-04T16:12:51.010Z Vendors: HP Inc. Products: HP LaserJet Pro Description: Certain HP LaserJet Pro print products are potentially vulnerable to Potential Remote Code Execution and/or Elevation of Privilege via Server-Side Request Forgery (SSRF) using the Web Service Eventing model. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.hp.com/us-en/document/ish_8651322-8651446-16/hpsbpi03851
CVE ID: CVE-2023-35176 State: PUBLISHED Published: 2023-06-30T15:44:41.868Z Last Updated: 2024-12-04T17:02:44.165Z Vendors: HP Inc. Products: HP LaserJet Pro Description: Certain HP LaserJet Pro print products are potentially vulnerable to Buffer Overflow and/or Denial of Service when using the backup & restore feature through the embedded web service on the device. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.hp.com/us-en/document/ish_8651671-8651697-16/hpsbpi03852
CVE ID: CVE-2023-35177 State: PUBLISHED Published: 2023-06-30T15:51:43.530Z Last Updated: 2024-12-04T17:03:23.089Z Vendors: HP Inc. Products: HP LaserJet Pro Description: Certain HP LaserJet Pro print products are potentially vulnerable to a stack-based buffer overflow related to the compact font format parser. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.hp.com/us-en/document/ish_8651888-8651916-16/hpsbpi03853
CVE ID: CVE-2023-35178 State: PUBLISHED Published: 2023-06-30T15:54:06.696Z Last Updated: 2024-12-04T17:03:50.815Z Vendors: HP Inc. Products: HP LaserJet Pro Description: Certain HP LaserJet Pro print products are potentially vulnerable to Buffer Overflow when performing a GET request to scan jobs. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.hp.com/us-en/document/ish_8651729-8651769-16/hpsbpi03854
CVE ID: CVE-2023-35179 State: PUBLISHED Published: 2023-08-10T23:14:48.081Z Last Updated: 2024-10-09T19:29:50.832Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: SolarWinds Products: Serv-U Problem Types: CWE-284 Description: A vulnerability has been identified within Serv-U 15.4 that, if exploited, allows an actor to bypass multi-factor/two-factor authentication. The actor must have administrator-level access to Serv-U to perform this action. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.solarwinds.com/trust-center/security-advisories/CVE-2023-35179 - https://support.solarwinds.com/SuccessCenter/s/artic
ww.solarwinds.com/trust-center/security-advisories/CVE-2023-35179 - https://support.solarwinds.com/SuccessCenter/s/article/Serv-U-15-4-Hotfix-1?language=en_US
CVE ID: CVE-2023-35180 State: PUBLISHED Published: 2023-10-19T14:23:48.383Z Last Updated: 2024-09-12T20:41:27.923Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: SolarWinds Products: Access Rights Manager Problem Types: CWE-502 Description: The SolarWinds Access Rights Manager was susceptible to Remote Code Execution Vulnerability. This vulnerability allows authenticated users to abuse SolarWinds ARM API. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.solarwinds.com/trust-center/security-advisories/CVE-2023-35180 - https://documentation.solarwinds.com/en/success_center/arm/content/release_notes/arm_2023-2-1
dvisories/CVE-2023-35180 - https://documentation.solarwinds.com/en/success_center/arm/content/release_notes/arm_2023-2-1_release_notes.htm
CVE ID: CVE-2023-35181 State: PUBLISHED Published: 2023-10-19T14:24:54.662Z Last Updated: 2024-09-13T15:37:44.724Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: SolarWinds Products: Access Rights Manager Problem Types: CWE-276 Description: The SolarWinds Access Rights Manager was susceptible to Privilege Escalation Vulnerability. This vulnerability allows users to abuse incorrect folder permission resulting in Privilege Escalation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.solarwinds.com/trust-center/security-advisories/CVE-2023-35181
CVE ID: CVE-2023-35182 State: PUBLISHED Published: 2023-10-19T14:23:31.797Z Last Updated: 2024-09-12T20:35:49.631Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: SolarWinds Products: Access Rights Manager Problem Types: CWE-502 Description: The SolarWinds Access Rights Manager was susceptible to Remote Code Execution Vulnerability. This vulnerability can be abused by unauthenticated users on SolarWinds ARM Server. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.solarwinds.com/trust-center/security-advisories/CVE-2023-35182 - https://documentation.solarwinds.com/en/success_center/arm/content/release_notes/a
/security-advisories/CVE-2023-35182 - https://documentation.solarwinds.com/en/success_center/arm/content/release_notes/arm_2023-2-1_release_notes.htm
CVE ID: CVE-2023-35183 State: PUBLISHED Published: 2023-10-19T14:23:59.019Z Last Updated: 2024-09-13T14:32:25.149Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: SolarWinds Products: Access Rights Manager Problem Types: CWE-276 Description: The SolarWinds Access Rights Manager was susceptible to Privilege Escalation Vulnerability. This vulnerability allows authenticated users to abuse local resources to Privilege Escalation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.solarwinds.com/trust-center/security-advisories/CVE-2023-35183 - https://documentation.solarwinds.com/en/success_center/arm/content/rele
rust-center/security-advisories/CVE-2023-35183 - https://documentation.solarwinds.com/en/success_center/arm/content/release_notes/arm_2023-2-1_release_notes.htm
CVE ID: CVE-2023-35184 State: PUBLISHED Published: 2023-10-19T14:22:26.928Z Last Updated: 2024-09-12T20:08:03.662Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: SolarWinds Products: Access Rights Manager Problem Types: CWE-502 Description: The SolarWinds Access Rights Manager was susceptible to Remote Code Execution Vulnerability. This vulnerability allows an unauthenticated user to abuse a SolarWinds service resulting in a remote code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.solarwinds.com/trust-center/security-advisories/CVE-2023-35184 - https://documentation.solarwinds.com/en/success_
://www.solarwinds.com/trust-center/security-advisories/CVE-2023-35184 - https://documentation.solarwinds.com/en/success_center/arm/content/release_notes/arm_2023-2-1_release_notes.htm
CVE ID: CVE-2023-35185 State: PUBLISHED Published: 2023-10-19T14:24:15.553Z Last Updated: 2024-10-15T18:32:08.169Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: SolarWinds Products: Access Rights Manager Problem Types: CWE-22 Description: The SolarWinds Access Rights Manager was susceptible to a Directory Traversal Remote Code Vulnerability using SYSTEM privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.solarwinds.com/trust-center/security-advisories/CVE-2023-35185 - https://documentation.solarwinds.com/en/success_center/arm/content/release_notes/arm_2023-2-1_release_notes.htm
CVE ID: CVE-2023-35186 State: PUBLISHED Published: 2023-10-19T14:21:57.282Z Last Updated: 2024-09-12T19:29:05.305Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: SolarWinds Products: Access Rights Manager Problem Types: CWE-502 Description: The SolarWinds Access Rights Manager was susceptible to Remote Code Execution Vulnerability. This vulnerability allows an authenticated user to abuse SolarWinds service resulting in remote code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.solarwinds.com/trust-center/security-advisories/CVE-2023-35186 - https://documentation.solarwinds.com/en/success_center/a
olarwinds.com/trust-center/security-advisories/CVE-2023-35186 - https://documentation.solarwinds.com/en/success_center/arm/content/release_notes/arm_2023-2-1_release_notes.htm
CVE ID: CVE-2023-35187 State: PUBLISHED Published: 2023-10-19T14:24:33.720Z Last Updated: 2024-09-13T15:35:58.950Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: SolarWinds Products: Access Rights Manager Problem Types: CWE-22 Description: The SolarWinds Access Rights Manager was susceptible to a Directory Traversal Remote Code Vulnerability. This vulnerability allows an unauthenticated user to achieve the Remote Code Execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://https://www.solarwinds.com/trust-center/security-advisories/CVE-2023-35187 - https://documentation.solarwinds.com/en/success_center/arm/
rwinds.com/trust-center/security-advisories/CVE-2023-35187 - https://documentation.solarwinds.com/en/success_center/arm/content/release_notes/arm_2023-2-1_release_notes.htm
CVE ID: CVE-2023-35188 State: PUBLISHED Published: 2024-02-06T16:00:21.973Z Last Updated: 2025-05-15T19:44:21.642Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: SolarWinds Products: SolarWinds Platform Problem Types: CWE-89 Description: SQL Injection Remote Code Execution Vulnerability was found using a create statement in the SolarWinds Platform. This vulnerability requires user authentication to be exploited. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.solarwinds.com/trust-center/security-advisories/CVE-2023-35188 - https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_n
urity-advisories/CVE-2023-35188 - https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2024-1_release_notes.htm
CVE ID: CVE-2023-35189 State: PUBLISHED Published: 2023-07-18T17:12:24.681Z Last Updated: 2024-10-28T15:30:01.043Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: iagona Products: ScrutisWeb Problem Types: CWE-434 Description: Iagona ScrutisWeb versions 2.1.37 and prior are vulnerable to a remote code execution vulnerability that could allow an unauthenticated user to upload a malicious payload and execute it. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-199-03
CVE ID: CVE-2023-35191 State: PUBLISHED Published: 2024-03-14T16:45:47.845Z Last Updated: 2025-02-13T16:55:49.912Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H) Vendors: n/a Products: Intel(R) SPS firmware versions Problem Types: denial of service, CWE-400 Description: Uncontrolled resource consumption for some Intel(R) SPS firmware versions may allow a privileged user to potentially enable denial of service via network access. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00923.html - https://security.netapp.com/advisory/ntap-20240405-0005/
CVE ID: CVE-2023-35192 State: PUBLISHED Published: 2024-05-16T20:47:47.123Z Last Updated: 2024-08-02T16:23:59.377Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) GPA Framework software Problem Types: escalation of privilege, CWE-427 Description: Uncontrolled search path in some Intel(R) GPA Framework software before version 2023.3 may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00831.html
CVE ID: CVE-2023-35193 State: PUBLISHED Published: 2023-10-11T15:16:55.642Z Last Updated: 2025-11-04T19:16:55.162Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Peplink Products: Surf SOHO HW1 Problem Types: CWE-78 Description: An OS command injection vulnerability exists in the api.cgi cmd.mvpn.x509.write functionality of peplink Surf SOHO HW1 v6.3.5 (in QEMU). A specially crafted HTTP request can lead to command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.This vulnerability is specifically for the `system` call in the file `/web/MANGA/cgi-bin/api.cgi` for firmware version 6.3.5 at offset 0x4bddb8. Additional
or the `system` call in the file `/web/MANGA/cgi-bin/api.cgi` for firmware version 6.3.5 at offset 0x4bddb8. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1782
CVE ID: CVE-2023-35194 State: PUBLISHED Published: 2023-10-11T15:16:55.771Z Last Updated: 2025-11-04T19:16:56.262Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Peplink Products: Surf SOHO HW1 Problem Types: CWE-78 Description: An OS command injection vulnerability exists in the api.cgi cmd.mvpn.x509.write functionality of peplink Surf SOHO HW1 v6.3.5 (in QEMU). A specially crafted HTTP request can lead to command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.This vulnerability is specifically for the `system` call in the file `/web/MANGA/cgi-bin/api.cgi` for firmware version 6.3.5 at offset `0x4bde44`. Additiona
or the `system` call in the file `/web/MANGA/cgi-bin/api.cgi` for firmware version 6.3.5 at offset `0x4bde44`. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1782
CVE ID: CVE-2023-35296 State: PUBLISHED Published: 2023-07-11T17:03:19.728Z Last Updated: 2025-02-28T20:00:25.791Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows 11 version 21H2, Windows 10 Version 21H2, Windows 11 version 22H2, Windows 10 Version 22H2, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core instal
2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) Problem Types: CWE-125 Description: Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-35296
CVE ID: CVE-2023-35297 State: PUBLISHED Published: 2023-07-11T17:03:20.451Z Last Updated: 2025-01-01T01:52:55.325Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows 11 version 21H2, Windows 10 Version 21H2, Windows 11 version 22H2, Windows 10 Version 22H2, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 Service Pack 2 (Server Core installation), Windows Server 2008 Service Pack 2, Wi
08 Service Pack 2, Windows Server 2008 Service Pack 2 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 R2 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) Problem Types: CWE-843 Description: Windows Pragmatic General Multicast (PGM) Remote Code Execution Vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-35297
CVE ID: CVE-2023-35298 State: PUBLISHED Published: 2023-07-11T17:03:20.978Z Last Updated: 2025-01-01T01:52:56.004Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows Server 2022, Windows 11 version 21H2, Windows 11 version 22H2 Problem Types: CWE-400 Description: HTTP.sys Denial of Service Vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-35298
CVE ID: CVE-2023-35299 State: PUBLISHED Published: 2023-07-11T17:03:21.515Z Last Updated: 2025-01-01T01:52:56.569Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows 11 version 21H2, Windows 10 Version 21H2, Windows 11 version 22H2, Windows 10 Version 22H2, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 Service Pack 2 (Server Core installation), Windows Server 2008 Service Pack 2, Wi