Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-22856 State: PUBLISHED Published: 2023-03-06T06:23:18.800Z Last Updated: 2025-03-05T19:46:34.400Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: BlogEngine.NET Products: BlogEngine.NET Problem Types: CWE-79 Description: A stored Cross-site Scripting (XSS) vulnerability in BlogEngine.NET 3.3.8.0, allows injection of arbitrary JavaScript in the security context of a blog visitor through an upload of a specially crafted file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.themissinglink.com.au/security-advisories/cve-2023-22856
CVE ID: CVE-2023-22857 State: PUBLISHED Published: 2023-03-06T06:26:34.899Z Last Updated: 2025-03-05T19:46:07.641Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N) Vendors: BlogEngine.NET Products: BlogEngine.NET Problem Types: CWE-79 Description: A stored Cross-site Scripting (XSS) vulnerability in BlogEngine.NET 3.3.8.0, allows injection of arbitrary JavaScript in the security context of a blog visitor through an injection of a malicious payload into a blog post. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.themissinglink.com.au/security-advisories/cve-2023-22857
CVE ID: CVE-2023-22858 State: PUBLISHED Published: 2023-03-06T06:31:42.272Z Last Updated: 2025-03-05T19:45:35.086Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: BlogEngine.NET Products: BlogEngine.NET Problem Types: CWE-862, CWE-552 Description: An Improper Access Control vulnerability in BlogEngine.NET 3.3.8.0, allows unauthenticated visitors to access the files of unpublished blogs. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.themissinglink.com.au/security-advisories/cve-2023-22857
CVE ID: CVE-2023-22860 State: PUBLISHED Published: 2023-02-27T14:23:44.782Z Last Updated: 2025-03-10T13:48:36.149Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: IBM Products: Cloud Pak for Business Automation Problem Types: CWE-79 Description: IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 244100. Add
tended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 244100. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6958062 - https://exchange.xforce.ibmcloud.com/vulnerabilities/244100
CVE ID: CVE-2023-22862 State: PUBLISHED Published: 2023-06-04T23:42:57.221Z Last Updated: 2025-01-08T19:50:48.115Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: Aspera Connect, Aspera Cargo Problem Types: CWE-523 Description: IBM Aspera Connect 4.2.5 and IBM Aspera Cargo 4.2.5 transmits authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7001053
CVE ID: CVE-2023-22863 State: PUBLISHED Published: 2023-01-18T18:46:54.882Z Last Updated: 2025-04-03T19:50:13.063Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: Robotic Process Automation Problem Types: CWE-319 Description: IBM Robotic Process Automation 20.12.0 through 21.0.2 defaults to HTTP in some RPA commands when the prefix is not explicitly specified in the URL. This could allow an attacker to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 244109. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6855837 - https://exchange.x
am Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6855837 - https://exchange.xforce.ibmcloud.com/vulnerabilities/244109
CVE ID: CVE-2023-22868 State: PUBLISHED Published: 2023-02-17T16:01:36.702Z Last Updated: 2025-03-12T20:08:02.937Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: IBM Products: Aspera Faspex Problem Types: CWE-79 Description: IBM Aspera Faspex 4.4.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 244117. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6952319 - https://exchange.xfo
Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6952319 - https://exchange.xforce.ibmcloud.com/vulnerabilities/244117
CVE ID: CVE-2023-22869 State: PUBLISHED Published: 2024-04-19T15:48:02.828Z Last Updated: 2024-08-02T10:20:31.134Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: Aspera Faspex Problem Types: CWE-532 Description: IBM Aspera Faspex 5.0.0 through 5.0.7 stores potentially sensitive information in log files that could be read by a local user. IBM X-Force ID: 244119. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7148632 - https://exchange.xforce.ibmcloud.com/vulnerabilities/244119
CVE ID: CVE-2023-22870 State: PUBLISHED Published: 2023-09-05T00:46:14.649Z Last Updated: 2024-09-26T18:27:59.631Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: Aspera Faspex Problem Types: CWE-319 Description: IBM Aspera Faspex 5.0.5 transmits sensitive information in cleartext which could be obtained by an attacker using man in the middle techniques. IBM X-Force ID: 244121. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7029681 - https://exchange.xforce.ibmcloud.com/vulnerabilities/244121
CVE ID: CVE-2023-22874 State: PUBLISHED Published: 2023-05-05T14:57:23.735Z Last Updated: 2025-01-29T16:54:55.891Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) Vendors: IBM Products: MQ Problem Types: 703 Improper Check or Handling of Exceptional Conditions Description: IBM MQ Clients 9.2 CD, 9.3 CD, and 9.3 LTS are vulnerable to a denial of service attack when processing configuration files. IBM X-Force ID: 244216. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6985901 - https://exchange.xforce.ibmcloud.com/vulnerabilities/244216
CVE ID: CVE-2023-22875 State: PUBLISHED Published: 2023-01-17T18:22:21.437Z Last Updated: 2025-04-04T18:09:32.880Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) Vendors: IBM Products: Security QRadar SIEM Problem Types: CWE-200 Description: IBM QRadar SIEM 7.4 and 7.5copies certificate key files used for SSL/TLS in the QRadar web user interface to managed hosts in the deployment that do not require that key. IBM X-Force ID: 244356. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6855643 - https://exchange.xforce.ibmcloud.com/vulnerabilities/244356
CVE ID: CVE-2023-22876 State: PUBLISHED Published: 2023-03-15T18:39:30.727Z Last Updated: 2025-02-26T20:17:35.152Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: IBM Products: Sterling B2B Integrator Problem Types: CWE-200 Description: IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.7 and 6.1.0.0 through 6.1.2.1 could allow a privileged user to obtain sensitive information that could aid in further attacks against the system. IBM X-Force ID: 244364. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6963093 - https://exchange.xforce.ibmcloud.com/vulnerabilities/
nt: References: - https://www.ibm.com/support/pages/node/6963093 - https://exchange.xforce.ibmcloud.com/vulnerabilities/244364
CVE ID: CVE-2023-22877 State: PUBLISHED Published: 2023-08-28T00:34:57.905Z Last Updated: 2024-09-16T18:54:12.017Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: IBM Products: InfoSphere Information Server Problem Types: CWE-1236 Description: IBM InfoSphere Information Server 11.7 is potentially vulnerable to CSV Injection. A remote attacker could execute arbitrary commands on the system, caused by improper validation of csv file contents. IBM X-Force ID: 244368. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6988623 - https://exchange.xforce.ibmcloud.com/vulnerabilities/244368
CVE ID: CVE-2023-22878 State: PUBLISHED Published: 2023-05-19T15:53:35.326Z Last Updated: 2025-01-21T19:25:55.261Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: InfoSphere Information Server Problem Types: 256 Plaintext Storage of a Password Description: IBM InfoSphere Information Server 11.7 stores user credentials in plain clear text which can be read by a local user. IBM X-Force ID: 244373. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://https://www.ibm.com/support/pages/node/6988155 - https://exchange.xforce.ibmcloud.com/vulnerabilities/244373
CVE ID: CVE-2023-22880 State: PUBLISHED Published: 2023-03-16T00:00:00.000Z Last Updated: 2025-02-26T20:12:41.573Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N) Vendors: Zoom Video Communications Inc Products: Zoom for Windows, Zoom Rooms for Windows, Zoom VDI for Windows Problem Types: CWE-200 Description: Zoom for Windows clients before version 5.13.3, Zoom Rooms for Windows clients before version 5.13.5 and Zoom VDI for Windows clients before 5.13.1 contain an information disclosure vulnerability. A recent update to the Microsoft Edge WebView2 runtime used by the affected Zoom clients, transmitted text to Microsoft’s online Spellcheck service instead of the loca
runtime used by the affected Zoom clients, transmitted text to Microsoft’s online Spellcheck service instead of the local Windows Spellcheck. Updating Zoom remediates this vulnerability by disabling the feature. Updating Microsoft Edge WebView2 Runtime to at least version 109.0.1481.0 and restarting Zoom remediates this vulnerability by updating Microsoft’s telemetry behavior. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://explore.zoom.us/en/trust/security/security-bulletin/
CVE ID: CVE-2023-22881 State: PUBLISHED Published: 2023-03-16T00:00:00.000Z Last Updated: 2025-02-26T20:06:35.273Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Zoom Video Communications Inc Products: Zoom (for Android, iOS, Linux, macOS, and Windows) clients before version 5.13.5 Problem Types: CWE-119 Description: Zoom clients before version 5.13.5 contain a STUN parsing vulnerability. A malicious actor could send specially crafted UDP traffic to a victim Zoom client to remotely cause the client to crash, causing a denial of service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://explore.zoom.us/en/trust
ditional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://explore.zoom.us/en/trust/security/security-bulletin/
CVE ID: CVE-2023-22882 State: PUBLISHED Published: 2023-03-16T00:00:00.000Z Last Updated: 2025-02-26T20:05:52.120Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Zoom Video Communications Inc Products: Zoom (for Android, iOS, Linux, macOS, and Windows) clients before version 5.13.5 Problem Types: CWE-119 Description: Zoom clients before version 5.13.5 contain a STUN parsing vulnerability. A malicious actor could send specially crafted UDP traffic to a victim Zoom client to remotely cause the client to crash, causing a denial of service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://explore.zoom.us/en/trust
CVE ID: CVE-2023-22883 State: PUBLISHED Published: 2023-03-16T00:00:00.000Z Last Updated: 2025-02-26T20:05:20.982Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:H) Vendors: Zoom Video Communications Inc Products: Zoom Client for Meetings for IT Admin Windows installers Problem Types: CWE-367 Description: Zoom Client for IT Admin Windows installers before version 5.13.5 contain a local privilege escalation vulnerability. A local low-privileged user could exploit this vulnerability in an attack chain during the installation process to escalate their privileges to the SYSTEM user. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - htt
ileges to the SYSTEM user. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://explore.zoom.us/en/trust/security/security-bulletin/
CVE ID: CVE-2023-22884 State: PUBLISHED Published: 2023-01-21T13:02:49.475Z Last Updated: 2025-03-31T14:53:54.464Z Vendors: Apache Software Foundation Products: Apache Airflow, Apache Airflow MySQL Provider Problem Types: CWE-77 Description: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Software Foundation Apache Airflow, Apache Software Foundation Apache Airflow MySQL Provider.This issue affects Apache Airflow: before 2.5.1; Apache Airflow MySQL Provider: before 4.0.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/apache/airflow/pull/28811 - https://lists.apache.org/t
tainer: - CISA ADP Vulnrichment: References: - https://github.com/apache/airflow/pull/28811 - https://lists.apache.org/thread/0l0j3nt0t7fzrcjl2ch0jgj6c58kxs5h
CVE ID: CVE-2023-22885 State: REJECTED Published: N/A Last Updated: 2023-01-11T00:00:00 Description: No description available.
CVE ID: CVE-2023-22886 State: PUBLISHED Published: 2023-06-29T09:41:00.074Z Last Updated: 2024-10-07T18:27:17.133Z Vendors: Apache Software Foundation Products: Apache Airflow JDBC Provider Problem Types: CWE-20 Description: Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow JDBC Provider. Airflow JDBC Provider Connection’s [Connection URL] parameters had no restrictions, which made it possible to implement RCE attacks via different type JDBC drivers, obtain airflow server permission. This issue affects Apache Airflow JDBC Provider: before 4.0.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.or
4.0.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/ynbjwp4n0vzql0xzhog1gkp1ovncf8j3
CVE ID: CVE-2023-22887 State: PUBLISHED Published: 2023-07-12T09:14:25.892Z Last Updated: 2024-10-04T13:44:50.075Z Vendors: Apache Software Foundation Products: Apache Airflow Problem Types: CWE-22 Description: Apache Airflow, versions before 2.6.3, is affected by a vulnerability that allows an attacker to perform unauthorized file access outside the intended directory structure by manipulating the run_id parameter. This vulnerability is considered low since it requires an authenticated user to exploit it. It is recommended to upgrade to a version that is not affected Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/apache/airflow/p
ional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/apache/airflow/pull/32293 - https://lists.apache.org/thread/rxddqs76r6rkxsg1n24d029zys67qwwo
CVE ID: CVE-2023-22888 State: PUBLISHED Published: 2023-07-12T09:17:55.338Z Last Updated: 2024-10-04T13:48:16.076Z Vendors: Apache Software Foundation Products: Apache Airflow Problem Types: CWE-20 Description: Apache Airflow, versions before 2.6.3, is affected by a vulnerability that allows an attacker to cause a service disruption by manipulating the run_id parameter. This vulnerability is considered low since it requires an authenticated user to exploit it. It is recommended to upgrade to a version that is not affected Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/apache/airflow/pull/32293 - https://lists.apache.org/thread/dnl
CISA ADP Vulnrichment: References: - https://github.com/apache/airflow/pull/32293 - https://lists.apache.org/thread/dnlht2hvm7k81k5tgjtsfmk27c76kq7z
CVE ID: CVE-2023-22889 State: PUBLISHED Published: 2023-03-08T00:00:00.000Z Last Updated: 2025-03-05T20:26:49.707Z Vendors: n/a Products: n/a Problem Types: n/a Description: SmartBear Zephyr Enterprise through 7.15.0 mishandles user-defined input during report generation. This could lead to remote code execution by unauthenticated users. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://smartbear.com/security/cve/
CVE ID: CVE-2023-22890 State: PUBLISHED Published: 2023-03-08T00:00:00.000Z Last Updated: 2025-03-05T15:02:15.282Z Vendors: n/a Products: n/a Problem Types: n/a Description: SmartBear Zephyr Enterprise through 7.15.0 allows unauthenticated users to upload large files, which could exhaust the local drive space, causing a denial of service condition. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://smartbear.com/security/cve/
CVE ID: CVE-2023-22891 State: PUBLISHED Published: 2023-03-08T00:00:00.000Z Last Updated: 2025-03-05T20:25:01.778Z Vendors: n/a Products: n/a Problem Types: n/a Description: There exists a privilege escalation vulnerability in SmartBear Zephyr Enterprise through 7.15.0 that could be exploited by authorized users to reset passwords for other accounts. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://smartbear.com/security/cve/
CVE ID: CVE-2023-22892 State: PUBLISHED Published: 2023-03-08T00:00:00.000Z Last Updated: 2025-03-04T20:40:22.904Z Vendors: n/a Products: n/a Problem Types: n/a Description: There exists an information disclosure vulnerability in SmartBear Zephyr Enterprise through 7.15.0 that could be exploited by unauthenticated users to read arbitrary files from Zephyr instances. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://smartbear.com/security/cve/
CVE ID: CVE-2023-22893 State: PUBLISHED Published: 2023-04-19T00:00:00.000Z Last Updated: 2025-11-07T17:07:00.255Z Vendors: n/a Products: n/a Problem Types: n/a Description: Strapi through 4.5.5 does not verify the access or ID tokens issued during the OAuth flow when the AWS Cognito login provider is used for authentication. A remote attacker could forge an ID token that is signed using the 'None' type algorithm to bypass authentication and impersonate any user that use AWS Cognito for authentication. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/strapi/strapi/releases - https://www.ghostccamm.com/blog/multi_strapi_vulns/ - http
nt: References: - https://github.com/strapi/strapi/releases - https://www.ghostccamm.com/blog/multi_strapi_vulns/ - https://strapi.io/blog/security-disclosure-of-vulnerabilities-cve
CVE ID: CVE-2023-22894 State: PUBLISHED Published: 2023-04-19T00:00:00.000Z Last Updated: 2025-11-07T17:07:27.039Z Vendors: n/a Products: n/a Problem Types: n/a Description: Strapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by exploiting the query filter. The attacker can filter users by columns that contain sensitive information and infer a value from API responses. If the attacker has super admin access, then this can be exploited to discover the password hash and password reset token of all users. If the attacker has admin panel access to an account with permission to access the username and email of API users with a lower privileged
s admin panel access to an account with permission to access the username and email of API users with a lower privileged role (e.g., Editor or Author), then this can be exploited to discover sensitive information for all API users but not other admin accounts. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/strapi/strapi/releases - https://www.ghostccamm.com/blog/multi_strapi_vulns/ - https://strapi.io/blog/security-disclosure-of-vulnerabilities-cve
CVE ID: CVE-2023-22895 State: PUBLISHED Published: 2023-01-10T00:00:00.000Z Last Updated: 2025-04-07T18:15:47.336Z Vendors: n/a Products: n/a Problem Types: n/a Description: The bzip2 crate before 0.4.4 for Rust allow attackers to cause a denial of service via a large file that triggers an integer overflow in mem.rs. NOTE: this is unrelated to the https://crates.io/crates/bzip2-rs product. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/alexcrichton/bzip2-rs/pull/86 - https://crates.io/crates/bzip2/versions - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MI5SVRSGKBWB2JGDLDVIFY5ZQVD
s://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MI5SVRSGKBWB2JGDLDVIFY5ZQVDZP6I7/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SQK57GGXJX3AH7KF6S7S3N7JC5QOYUQ7/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UUK2JO25PPA6XBREKJRBLRCD22LKIOLO/
CVE ID: CVE-2023-22897 State: PUBLISHED Published: 2023-04-12T00:00:00.000Z Last Updated: 2025-02-13T16:44:06.147Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in SecurePoint UTM before 12.2.5.1. The firewall's endpoint at /spcgi.cgi allows information disclosure of memory contents to be achieved by an authenticated user. Essentially, uninitialized data can be retrieved via an approach in which a sessionid is obtained but not used. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://rcesecurity.com - https://github.com/MrTuxracer/advisories/blob/master/CVEs/CVE-2023-22897.txt - http://seclists.org/fulldisclos
ity.com - https://github.com/MrTuxracer/advisories/blob/master/CVEs/CVE-2023-22897.txt - http://seclists.org/fulldisclosure/2023/Apr/8 - http://packetstormsecurity.com/files/171928/SecurePoint-UTM-12.x-Memory-Leak.html
CVE ID: CVE-2023-22898 State: PUBLISHED Published: 2023-01-10T00:00:00.000Z Last Updated: 2025-04-07T18:37:47.223Z Vendors: n/a Products: n/a Problem Types: n/a Description: workers/extractor.py in Pandora (aka pandora-analysis/pandora) 1.3.0 allows a denial of service when an attacker submits a deeply nested ZIP archive (aka ZIP bomb). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/pandora-analysis/pandora/commit/1dc06327fdc07c56eae653e497dd137ec70d8265
CVE ID: CVE-2023-22899 State: PUBLISHED Published: 2023-01-10T00:00:00.000Z Last Updated: 2025-04-09T15:31:44.778Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zip4j through 2.11.2, as used in Threema and other products, does not always check the MAC when decrypting a ZIP archive. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://breakingthe3ma.app - https://breakingthe3ma.app/files/Threema-PST22.pdf - https://news.ycombinator.com/item?id=34316206 - https://threema.ch/en/blog/posts/news-alleged-weaknesses-statement - https://github.com/srikanth-lingala/zip4j/releases - https://github.com/srikanth-lingala/zip4j/issues/485