Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
einit`. This issue may lead to code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://securitylab.github.com/advisories/GHSL-2023-145_GHSL-2023-151_stb_image_h/ - https://github.com/nothings/stb/blob/5736b15f7ea0ffb08dd38af21067c314d6a3aae9/stb_vorbis.c#L3660-L3677 - https://github.com/nothings/stb/blob/5736b15f7ea0ffb08dd38af21067c314d6a3aae9/stb_vorbis.c#L4208-L4215
CVE ID: CVE-2023-45680 State: PUBLISHED Published: 2023-10-20T23:26:54.394Z Last Updated: 2024-09-11T20:22:52.057Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: nothings Products: stb Problem Types: CWE-476 Description: stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger memory allocation failure in `start_decoder`. In that case the function returns early, the `f->comment_list` is set to `NULL`, but `f->comment_list_length` is not reset. Later in `vorbis_deinit` it tries to dereference the `NULL` pointer. This issue may lead to denial of service. Additional Analyst Notes: - CVE Program Container: - C
nce the `NULL` pointer. This issue may lead to denial of service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://securitylab.github.com/advisories/GHSL-2023-145_GHSL-2023-151_stb_image_h/ - https://github.com/nothings/stb/blob/5736b15f7ea0ffb08dd38af21067c314d6a3aae9/stb_vorbis.c#L3660-L3666 - https://github.com/nothings/stb/blob/5736b15f7ea0ffb08dd38af21067c314d6a3aae9/stb_vorbis.c#L4208-L4215
CVE ID: CVE-2023-45681 State: PUBLISHED Published: 2023-10-20T23:26:56.100Z Last Updated: 2025-02-13T17:14:08.194Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: nothings Products: stb Problem Types: CWE-787 Description: stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger memory write past an allocated heap buffer in `start_decoder`. The root cause is a potential integer overflow in `sizeof(char*) * (f->comment_list_length)` which may make `setup_malloc` allocate less memory than required. Since there is another integer overflow an attacker may overflow it too to force `setup_malloc` to return 0 and mak
red. Since there is another integer overflow an attacker may overflow it too to force `setup_malloc` to return 0 and make the exploit more reliable. This issue may lead to code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://securitylab.github.com/advisories/GHSL-2023-145_GHSL-2023-151_stb_image_h/ - https://github.com/nothings/stb/blob/5736b15f7ea0ffb08dd38af21067c314d6a3aae9/stb_vorbis.c#L3660-L3677 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LBIPXOBWUHPAH4QHMVP2AWWAPDDZDQ66/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2WRORY
VP2AWWAPDDZDQ66/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2WRORYQ2Z2XXHPX36JHBUSDVY6IOMW2N/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2MHQQXX27ACLLYUQHWSL3DVCOGUK5ZA4/
CVE ID: CVE-2023-45682 State: PUBLISHED Published: 2023-10-20T23:27:04.879Z Last Updated: 2024-09-12T13:35:19.803Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: nothings Products: stb Problem Types: CWE-125 Description: stb_vorbis is a single file MIT licensed library for processing ogg vorbis files. A crafted file may trigger out of bounds read in `DECODE` macro when `var` is negative. As it can be seen in the definition of `DECODE_RAW` a negative `var` is a valid value. This issue may be used to leak internal memory allocation information. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://securitylab.github
on. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://securitylab.github.com/advisories/GHSL-2023-145_GHSL-2023-151_stb_image_h/ - https://github.com/nothings/stb/blob/5736b15f7ea0ffb08dd38af21067c314d6a3aae9/stb_vorbis.c#L1717-L1729 - https://github.com/nothings/stb/blob/5736b15f7ea0ffb08dd38af21067c314d6a3aae9/stb_vorbis.c#L1754-L1756 - https://github.com/nothings/stb/blob/5736b15f7ea0ffb08dd38af21067c314d6a3aae9/stb_vorbis.c#L3231
CVE ID: CVE-2023-45683 State: PUBLISHED Published: 2023-10-16T18:13:10.451Z Last Updated: 2024-09-13T19:38:10.391Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: crewjam Products: saml Problem Types: CWE-79 Description: github.com/crewjam/saml is a saml library for the go language. In affected versions the package does not validate the ACS Location URI according to the SAML binding being parsed. If abused, this flaw allows attackers to register malicious Service Providers at the IdP and inject Javascript in the ACS endpoint definition, achieving Cross-Site-Scripting (XSS) in the IdP context during the redirection at the end of a SAML SSO Flow. Consequently, a
ving Cross-Site-Scripting (XSS) in the IdP context during the redirection at the end of a SAML SSO Flow. Consequently, an attacker may perform any authenticated action as the victim once the victim’s browser loaded the SAML IdP initiated SSO link for the malicious service provider. Note: SP registration is commonly an unrestricted operation in IdPs, hence not requiring particular permissions or publicly accessible to ease the IdP interoperability. This issue is fixed in version 0.4.14. Users unable to upgrade may perform external validation of URLs provided in SAML metadata, or restrict the ability for end-users to upload arbitrary metadata. Additional Analyst Notes: - CVE Program Container:
, or restrict the ability for end-users to upload arbitrary metadata. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/crewjam/saml/security/advisories/GHSA-267v-3v32-g6q5 - https://github.com/crewjam/saml/commit/b07b16cf83c4171d16da4d85608cb827f183cd79
CVE ID: CVE-2023-45684 State: PUBLISHED Published: 2023-11-14T00:00:00 Last Updated: 2024-09-03T15:13:52.177Z Vendors: n/a Products: n/a Problem Types: n/a Description: Northern.tech CFEngine Enterprise before 3.21.3 allows SQL Injection. The fixed versions are 3.18.6 and 3.21.3. The earliest affected version is 3.6.0. The issue is in the Mission Portal login page in the CFEngine hub. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cfengine.com/blog/2023/cve-2023-45684/
CVE ID: CVE-2023-45685 State: PUBLISHED Published: 2023-10-16T16:08:25.668Z Last Updated: 2024-09-16T14:48:25.595Z Vendors: South River Technologies Products: Titan MFT, Titan SFTP Problem Types: CWE-22 Description: Insufficient path validation when extracting a zip archive in South River Technologies' Titan MFT and Titan SFTP servers on Windows and Linux allows an authenticated attacker to write a file to any location on the filesystem via path traversal Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.rapid7.com/blog/post/2023/10/16/multiple-vulnerabilities-in-south-river-technologies-titan-mft-and-titan-sftp-fixed/ - https://helpdesk.so
st/2023/10/16/multiple-vulnerabilities-in-south-river-technologies-titan-mft-and-titan-sftp-fixed/ - https://helpdesk.southrivertech.com/portal/en/kb/articles/security-patch-for-issues-cve-2023-45685-through-cve-2023-45690
CVE ID: CVE-2023-45686 State: PUBLISHED Published: 2023-10-16T16:10:10.084Z Last Updated: 2024-09-16T17:39:11.007Z Vendors: South River Technologies Products: Titan MFT, Titan SFTP Problem Types: CWE-22 Description: Insufficient path validation when writing a file via WebDAV in South River Technologies' Titan MFT and Titan SFTP servers on Linux allows an authenticated attacker to write a file to any location on the filesystem via path traversal Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.rapid7.com/blog/post/2023/10/16/multiple-vulnerabilities-in-south-river-technologies-titan-mft-and-titan-sftp-fixed/ - https://helpdesk.southrivertec
16/multiple-vulnerabilities-in-south-river-technologies-titan-mft-and-titan-sftp-fixed/ - https://helpdesk.southrivertech.com/portal/en/kb/articles/security-patch-for-issues-cve-2023-45685-through-cve-2023-45690
CVE ID: CVE-2023-45687 State: PUBLISHED Published: 2023-10-16T16:12:31.582Z Last Updated: 2024-09-16T17:41:29.875Z Vendors: South River Technologies Products: Titan MFT, Titan SFTP Problem Types: CWE-384 Description: A session fixation vulnerability in South River Technologies' Titan MFT and Titan SFTP servers on Linux and Windows allows an attacker to bypass the server's authentication if they can trick an administrator into authorizating a session id of their choosing Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.rapid7.com/blog/post/2023/10/16/multiple-vulnerabilities-in-south-river-technologies-titan-mft-and-titan-sftp-fixed/ - http
id7.com/blog/post/2023/10/16/multiple-vulnerabilities-in-south-river-technologies-titan-mft-and-titan-sftp-fixed/ - https://helpdesk.southrivertech.com/portal/en/kb/articles/security-patch-for-issues-cve-2023-45685-through-cve-2023-45690
CVE ID: CVE-2023-45688 State: PUBLISHED Published: 2023-10-16T16:14:41.841Z Last Updated: 2024-09-16T18:06:59.780Z Vendors: South River Technologies Products: Titan MFT, Titan SFTP Problem Types: CWE-22 Description: Lack of sufficient path validation in South River Technologies' Titan MFT and Titan SFTP servers on Linux allows an authenticated attacker to get the size of an arbitrary file on the filesystem using path traversal in the ftp "SIZE" command Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.rapid7.com/blog/post/2023/10/16/multiple-vulnerabilities-in-south-river-technologies-titan-mft-and-titan-sftp-fixed/ - https://helpdesk.south
2023/10/16/multiple-vulnerabilities-in-south-river-technologies-titan-mft-and-titan-sftp-fixed/ - https://helpdesk.southrivertech.com/portal/en/kb/articles/security-patch-for-issues-cve-2023-45685-through-cve-2023-45690
CVE ID: CVE-2023-45689 State: PUBLISHED Published: 2023-10-16T16:19:08.287Z Last Updated: 2024-09-16T18:05:30.684Z Vendors: South River Technologies Products: Titan MFT, Titan SFTP Problem Types: CWE-22 Description: Lack of sufficient path validation in South River Technologies' Titan MFT and Titan SFTP servers on Windows and Linux allows an authenticated attacker with administrative privileges to read any file on the filesystem via path traversal Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.rapid7.com/blog/post/2023/10/16/multiple-vulnerabilities-in-south-river-technologies-titan-mft-and-titan-sftp-fixed/ - https://helpdesk.southriver
10/16/multiple-vulnerabilities-in-south-river-technologies-titan-mft-and-titan-sftp-fixed/ - https://helpdesk.southrivertech.com/portal/en/kb/articles/security-patch-for-issues-cve-2023-45685-through-cve-2023-45690
CVE ID: CVE-2023-45690 State: PUBLISHED Published: 2023-10-16T16:20:52.656Z Last Updated: 2024-09-16T17:41:56.320Z Vendors: South River Technologies Products: Titan MFT, Titan SFTP Problem Types: CWE-276 Description: Default file permissions on South River Technologies' Titan MFT and Titan SFTP servers on Linux allows a user that's authentication to the OS to read sensitive files on the filesystem Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.rapid7.com/blog/post/2023/10/16/multiple-vulnerabilities-in-south-river-technologies-titan-mft-and-titan-sftp-fixed/ - https://helpdesk.southrivertech.com/portal/en/kb/articles/security-patch-for-i
ologies-titan-mft-and-titan-sftp-fixed/ - https://helpdesk.southrivertech.com/portal/en/kb/articles/security-patch-for-issues-cve-2023-45685-through-cve-2023-45690
CVE ID: CVE-2023-45696 State: PUBLISHED Published: 2024-02-10T03:10:30.423Z Last Updated: 2025-06-03T18:54:13.238Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: HCL Software Products: HCL Sametime Description: Sametime is impacted by sensitive fields with autocomplete enabled in the Legacy web chat client. By default, this allows user entered data to be stored by the browser. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0109082
CVE ID: CVE-2023-45698 State: PUBLISHED Published: 2024-02-10T03:24:40.127Z Last Updated: 2024-10-28T01:26:42.271Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: HCL Software Products: HCL Sametime Description: Sametime is impacted by lack of clickjacking protection in Outlook add-in. The application is not implementing appropriate protections in order to protect users from clickjacking attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0109082
CVE ID: CVE-2023-45700 State: PUBLISHED Published: 2023-12-21T00:10:11.246Z Last Updated: 2024-08-02T20:29:32.576Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: HCL Software Products: HCL Launch Description: HCL Launch is vulnerable to HTML injection. This vulnerability may allow a user to embed arbitrary HTML tags in the Web UI potentially leading to sensitive information disclosure. Additional Analyst Notes: - CVE Program Container: References: - https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0108644
CVE ID: CVE-2023-45701 State: PUBLISHED Published: 2023-12-28T07:03:01.753Z Last Updated: 2024-08-02T20:29:31.596Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: HCL Software Products: HCL Launch Description: HCL Launch could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. Additional Analyst Notes: - CVE Program Container: References: - https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0108645
CVE ID: CVE-2023-45702 State: PUBLISHED Published: 2023-12-28T07:29:22.062Z Last Updated: 2024-08-02T20:29:32.293Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: HCL Software Products: HCL Launch Description: An HCL UrbanCode Deploy Agent installed as a Windows service in a non-standard location could be subject to a denial of service attack by local accounts.. Additional Analyst Notes: - CVE Program Container: References: - https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0108646
CVE ID: CVE-2023-45703 State: PUBLISHED Published: 2023-12-20T23:33:08.651Z Last Updated: 2024-08-02T20:29:32.699Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: HCL Software Products: HCL Launch Description: HCL Launch may mishandle input validation of an uploaded archive file leading to a denial of service due to resource exhaustion. Additional Analyst Notes: - CVE Program Container: References: - https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0108649
CVE ID: CVE-2023-45705 State: PUBLISHED Published: 2024-03-28T14:11:57.835Z Last Updated: 2025-03-28T20:48:19.707Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N) Vendors: HCL Software Products: BigFix Platform Description: An administrative user of WebReports may perform a Server Side Request Forgery (SSRF) exploit through SMTP configuration options. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0111972
CVE ID: CVE-2023-45706 State: PUBLISHED Published: 2024-03-28T14:19:40.914Z Last Updated: 2024-11-07T14:57:31.198Z Severity: LOW (CVSS 2 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N) Vendors: HCL Software Products: BigFix Platform Description: An administrative user of WebReports may perform a Cross Site Scripting (XSS) and/or Man in the Middle (MITM) exploit through SAML configuration. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0111972
CVE ID: CVE-2023-45707 State: PUBLISHED Published: 2024-06-08T15:10:32.739Z Last Updated: 2024-08-02T20:29:32.276Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: HCL Software Products: Connections Docs Description: HCL Connections Docs is vulnerable to a cross-site scripting attack where an attacker may leverage this issue to execute arbitrary code. This may lead to credentials disclosure and possibly launch additional attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0108427
CVE ID: CVE-2023-45715 State: PUBLISHED Published: 2024-03-28T14:26:32.839Z Last Updated: 2024-11-19T19:04:30.189Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L) Vendors: HCL Software Products: BigFix Platform Description: The console may experience a service interruption when processing file names with invalid characters. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0111972
CVE ID: CVE-2023-45716 State: PUBLISHED Published: 2024-02-09T21:17:50.900Z Last Updated: 2025-06-03T18:53:23.304Z Severity: LOW (CVSS 1.7 CVSS:3.1/AV:P/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N) Vendors: HCL Software Products: HCL Sametime Description: Sametime is impacted by sensitive information passed in URL. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0109082
CVE ID: CVE-2023-45718 State: PUBLISHED Published: 2024-02-09T21:22:09.163Z Last Updated: 2025-06-03T18:52:45.263Z Severity: LOW (CVSS 3.9 CVSS:3.1/AV:P/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N) Vendors: HCL Software Products: HCL Sametime Description: Sametime is impacted by a failure to invalidate sessions. The application is setting sensitive cookie values in a persistent manner in Sametime Web clients. When this happens, cookie values can remain valid even after a user has closed out their session. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0109082
CVE ID: CVE-2023-45720 State: PUBLISHED Published: 2025-04-24T16:25:16.979Z Last Updated: 2025-04-24T17:54:44.926Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: HCL Software Products: HCL Leap Problem Types: CWE-359 Description: Insufficient default configuration in HCL Leap allows anonymous access to directory information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0119900
CVE ID: CVE-2023-45721 State: PUBLISHED Published: 2025-04-30T21:13:30.911Z Last Updated: 2025-05-01T15:34:36.660Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: HCL Software Products: HCL Domino Leap Problem Types: CWE-359 Description: Insufficient default configuration in HCL Leap allows anonymous access to directory information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0120722
CVE ID: CVE-2023-45722 State: PUBLISHED Published: 2024-01-03T02:59:05.745Z Last Updated: 2025-06-03T14:44:24.171Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: HCL Software Products: DRYiCE MyXalytics Description: HCL DRYiCE MyXalytics is impacted by path traversal arbitrary file read vulnerability because it uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory. The product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. Potential exploits can comp
can cause the pathname to resolve to a location that is outside of the restricted directory. Potential exploits can completely disrupt or take over the application. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0109608
CVE ID: CVE-2023-45723 State: PUBLISHED Published: 2024-01-03T02:50:02.258Z Last Updated: 2025-06-18T15:27:02.999Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L) Vendors: HCL Software Products: DRYiCE MyXalytics Description: HCL DRYiCE MyXalytics is impacted by path traversal vulnerability which allows file upload capability. Certain endpoints permit users to manipulate the path (including the file name) where these files are stored on the server. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0109608
CVE ID: CVE-2023-45724 State: PUBLISHED Published: 2024-01-03T02:53:23.847Z Last Updated: 2025-06-18T15:27:27.226Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) Vendors: HCL Software Products: DRYiCE MyXalytics Description: HCL DRYiCE MyXalytics product is impacted by unauthenticated file upload vulnerability. The web application permits the upload of a certain file without requiring user authentication. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0109608
CVE ID: CVE-2023-45725 State: PUBLISHED Published: 2023-12-13T08:02:17.326Z Last Updated: 2024-08-02T20:29:31.714Z Vendors: Apache Software Foundation Products: Apache CouchDB, IBM Cloudant Problem Types: CWE-200 Description: Design document functions which receive a user http request object may expose authorization or session cookie headers of the user who accesses the document. These design document functions are: * list * show * rewrite * update An attacker can leak the session component using an HTML-like output, insert the session as an external resource (such as an image), or store the credential in a _local document with an "update" function. For the attack to succeed the attacker has
age), or store the credential in a _local document with an "update" function. For the attack to succeed the attacker has to be able to insert the design documents into the database, then manipulate a user to access a function from that design document. Workaround: Avoid using design documents from untrusted sources which may attempt to access or manipulate request object's headers Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread/pqjq9zt8vq9rsobkc1cow9sqm9vozlrg - https://docs.couchdb.org/en/stable/cve/2023-45725.html
CVE ID: CVE-2023-45727 State: PUBLISHED Published: 2023-10-18T09:01:12.285Z Last Updated: 2025-10-21T23:05:34.245Z Vendors: North Grid Corporation Products: Proself Enterprise/Standard Edition, Proself Gateway Edition, Proself Mail Sanitize Edition Problem Types: XML external entities (XXE) Description: Proself Enterprise/Standard Edition Ver5.62 and earlier, Proself Gateway Edition Ver1.65 and earlier, and Proself Mail Sanitize Edition Ver1.08 and earlier allow a remote unauthenticated attacker to conduct XML External Entity (XXE) attacks. By processing a specially crafted request containing malformed XML data, arbitrary files on the server containing account information may be read by the
request containing malformed XML data, arbitrary files on the server containing account information may be read by the attacker. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.proself.jp/information/153/ - https://jvn.jp/en/jp/JVN95981460/