Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
PLUS NET CP 1543-1 (6AG1543-1AX00-2XE0) (All versions < V3.0.37). The webserver implementation of the affected products does not correctly release allocated memory after it has been used. An attacker with network access could use this vulnerability to cause a denial-of-service condition in the webserver of the affected product. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-693975.pdf - https://cert-portal.siemens.com/productcert/html/ssa-693975.html - https://cert-portal.siemens.com/productcert/html/ssa-139628.html - https://cert-portal.siemens.com/productcert/html/ssa-625862.html
CVE ID: CVE-2023-38381 State: PUBLISHED Published: 2023-10-03T09:55:57.767Z Last Updated: 2024-09-20T13:16:56.335Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: Cyle Conoly Products: WP-FlyBox Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Cyle Conoly WP-FlyBox plugin <= 6.46 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wp-flybox/wordpress-wp-flybox-plugin-6-46-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-38382 State: PUBLISHED Published: 2023-11-06T08:02:44.002Z Last Updated: 2024-09-05T14:07:17.796Z Vendors: Daniel Söderström / Sidney van de Stouwe Products: Subscribe to Category Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Daniel Söderström / Sidney van de Stouwe Subscribe to Category allows SQL Injection.This issue affects Subscribe to Category: from n/a through 2.7.4. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/subscribe-to-category/wordpress-subscribe-to-category-plugin-2-7-4-sql-injection
//patchstack.com/database/vulnerability/subscribe-to-category/wordpress-subscribe-to-category-plugin-2-7-4-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2023-38383 State: PUBLISHED Published: 2024-12-13T14:23:53.610Z Last Updated: 2024-12-13T18:31:44.651Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: OnTheGoSystems Products: Language Problem Types: CWE-862 Description: Missing Authorization vulnerability in OnTheGoSystems Language allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Language: from n/a through 1.2.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wordpress-language/vulnerability/wordpress-wordpress-language-plugin-1-2-1-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2023-38384 State: PUBLISHED Published: 2023-08-08T12:30:55.096Z Last Updated: 2024-09-25T16:47:45.468Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Syntactics, Inc. Products: eaSYNC Problem Types: CWE-79 Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Syntactics, Inc. EaSYNC plugin <= 1.3.7 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/easync-booking/wordpress-easync-plugin-1-3-6-reflected-cross-site-scripting-xss-vulnerability-2?_s_id=cve
CVE ID: CVE-2023-38385 State: PUBLISHED Published: 2024-12-13T14:23:54.204Z Last Updated: 2024-12-13T18:30:45.502Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H) Vendors: Artbees Products: JupiterX Core Problem Types: CWE-862 Description: Missing Authorization vulnerability in Artbees JupiterX Core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JupiterX Core: from 3.0.0 through 3.3.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/jupiterx-core/vulnerability/wordpress-jupiter-x-core-plugin-3-0-0-3-3-0-multiple-contributor-broken-access-control-vulnerability?_
ore/vulnerability/wordpress-jupiter-x-core-plugin-3-0-0-3-3-0-multiple-contributor-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2023-38386 State: PUBLISHED Published: 2024-06-19T13:06:42.439Z Last Updated: 2024-08-08T16:34:44.573Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L) Vendors: Saturday Drive Products: Ninja Forms Problem Types: CWE-862 Description: Missing Authorization vulnerability in Saturday Drive Ninja Forms.This issue affects Ninja Forms: from n/a through 3.6.25. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/ninja-forms/wordpress-ninja-forms-plugin-3-6-25-contributor-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2023-38387 State: PUBLISHED Published: 2023-09-03T11:13:14.710Z Last Updated: 2024-09-24T18:57:26.193Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Elastic Email Sender Products: Elastic Email Sender Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Elastic Email Sender plugin <= 1.2.6 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/elastic-email-sender/wordpress-elastic-email-sender-plugin-1-2-6-cross-site-scripting-xss?_s_id=cve
CVE ID: CVE-2023-38388 State: PUBLISHED Published: 2024-03-26T20:39:51.713Z Last Updated: 2024-08-06T18:30:00.516Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Artbees Products: JupiterX Core Problem Types: CWE-434 Description: Unrestricted Upload of File with Dangerous Type vulnerability in Artbees JupiterX Core.This issue affects JupiterX Core: from n/a through 3.3.5. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/jupiterx-core/wordpress-jupiter-x-core-plugin-3-3-0-unauthenticated-arbitrary-file-upload-vulnerability?_s_id=cve
CVE ID: CVE-2023-38389 State: PUBLISHED Published: 2024-06-21T15:58:28.347Z Last Updated: 2024-08-02T17:39:13.540Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Artbees Products: JupiterX Core Problem Types: CWE-863 Description: Incorrect Authorization vulnerability in Artbees JupiterX Core allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects JupiterX Core: from n/a through 3.3.8. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/jupiterx-core/wordpress-jupiter-x-core-plugin-3-3-0-unauthenticated-account-takeover-vulnerability?_s_id=cve
CVE ID: CVE-2023-38390 State: PUBLISHED Published: 2023-10-03T10:24:56.418Z Last Updated: 2024-09-20T19:41:29.005Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Anshul Labs Products: Mobile Address Bar Changer Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Anshul Labs Mobile Address Bar Changer plugin <= 3.0 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/mobile-address-bar-changer/wordpress-mobile-address-bar-changer-plugin-3-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-38391 State: PUBLISHED Published: 2023-11-03T23:07:33.642Z Last Updated: 2024-09-06T15:41:54.188Z Vendors: Themesgrove Products: Onepage Builder Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themesgrove Onepage Builder allows SQL Injection.This issue affects Onepage Builder: from n/a through 2.4.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/tx-onepager/wordpress-onepage-builder-easiest-landing-page-builder-for-wordpress-plugin-2-4-1-sql-injection?_s_id=cve
CVE ID: CVE-2023-38392 State: PUBLISHED Published: 2023-08-07T12:45:24.226Z Last Updated: 2024-09-25T16:52:03.367Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Hiroaki Miyashita Products: Custom Field Template Problem Types: CWE-79 Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Hiroaki Miyashita Custom Field Template plugin <= 2.5.9 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/custom-field-template/wordpress-custom-field-template-plugin-2-5-9-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-38393 State: PUBLISHED Published: 2024-06-19T14:15:38.656Z Last Updated: 2024-08-02T17:39:13.431Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L) Vendors: Saturday Drive Products: Ninja Forms Problem Types: CWE-862 Description: Missing Authorization vulnerability in Saturday Drive Ninja Forms.This issue affects Ninja Forms: from n/a through 3.6.25. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/ninja-forms/wordpress-ninja-forms-plugin-3-6-25-subscriber-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2023-38394 State: PUBLISHED Published: 2024-06-19T14:14:18.320Z Last Updated: 2024-08-02T17:39:12.894Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: Artbees Products: JupiterX Core Problem Types: CWE-862 Description: Missing Authorization vulnerability in Artbees JupiterX Core.This issue affects JupiterX Core: from 3.0.0 through 3.3.0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/jupiterx-core/wordpress-jupiter-x-core-plugin-3-3-0-multiple-subscriber-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2023-38395 State: PUBLISHED Published: 2024-06-12T09:38:20.050Z Last Updated: 2024-08-02T17:39:13.522Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: Afzal Multani Products: WP Clone Menu Problem Types: CWE-862 Description: Missing Authorization vulnerability in Afzal Multani WP Clone Menu.This issue affects WP Clone Menu: from n/a through 1.0.1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/clone-menu/wordpress-wp-clone-menu-plugin-1-0-1-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2023-38396 State: PUBLISHED Published: 2023-10-03T10:22:15.484Z Last Updated: 2024-09-20T19:03:36.267Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: Alain Gonzalez Products: google-map-shortcode Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Alain Gonzalez plugin <= 3.1.2 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/google-map-shortcode/wordpress-google-map-shortcode-plugin-3-1-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-38397 State: PUBLISHED Published: 2023-08-10T13:19:41.699Z Last Updated: 2024-09-25T16:44:17.881Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Eggemplo Products: Gestion-Pymes Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Eggemplo Gestion-Pymes plugin <= 1.5.6 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/gestion-pymes/wordpress-gestion-pymes-plugin-1-5-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-38398 State: PUBLISHED Published: 2023-10-03T10:16:12.120Z Last Updated: 2024-09-20T19:02:43.538Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Taboola Products: Taboola Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Taboola plugin <= 2.0.1 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/taboola/wordpress-taboola-plugin-2-0-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-38399 State: PUBLISHED Published: 2024-05-17T06:52:08.233Z Last Updated: 2024-08-02T17:39:13.475Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L) Vendors: Averta Products: Phlox Portfolio Problem Types: CWE-22 Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Averta Phlox Portfolio allows PHP Local File Inclusion.This issue affects Phlox Portfolio: from n/a through 2.3.1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/auxin-portfolio/wordpress-phlox-portfolio-plugin-2-3-1-unauthenticated-local-file-inclusio
ck.com/database/vulnerability/auxin-portfolio/wordpress-phlox-portfolio-plugin-2-3-1-unauthenticated-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2023-38400 State: PUBLISHED Published: 2023-11-30T16:57:16.768Z Last Updated: 2024-08-02T17:39:13.619Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Kriesi Products: Enfold - Responsive Multi-Purpose Theme Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kriesi Enfold - Responsive Multi-Purpose Theme allows Reflected XSS.This issue affects Enfold - Responsive Multi-Purpose Theme: from n/a through 5.6.4. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/enfold/wordpress-enfold-theme-5-6-4-reflected-cr
Container: References: - https://patchstack.com/database/vulnerability/enfold/wordpress-enfold-theme-5-6-4-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-38401 State: PUBLISHED Published: 2023-08-15T18:16:47.513Z Last Updated: 2024-11-22T14:08:18.521Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Hewlett Packard Enterprise (HPE) Products: HPE Aruba Networking Virtual Intranet Access (VIA) Description: A vulnerability in the HPE Aruba Networking Virtual Intranet Access (VIA) client could allow local users to elevate privileges. Successful exploitation could allow execution of arbitrary code with NT AUTHORITY\SYSTEM privileges on the operating system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.arubanetworks.com/assets/alert/ARUBA-PSA-20
- CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-011.txt
CVE ID: CVE-2023-38402 State: PUBLISHED Published: 2023-08-15T18:47:59.783Z Last Updated: 2024-10-03T13:39:07.179Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) Vendors: Hewlett Packard Enterprise (HPE) Products: HPE Aruba Networking Virtual Intranet Access (VIA) Description: A vulnerability in the HPE Aruba Networking Virtual Intranet Access (VIA) client could allow malicious users to overwrite arbitrary files as NT AUTHORITY\SYSTEM. A successful exploit could allow these malicious users to create a Denial-of-Service (DoS) condition affecting the Microsoft Windows operating System boot process. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichme
icrosoft Windows operating System boot process. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-011.txt
CVE ID: CVE-2023-38403 State: PUBLISHED Published: 2023-07-17T00:00:00 Last Updated: 2024-11-27T14:33:27.522Z Vendors: n/a Products: n/a Problem Types: n/a Description: iperf3 before 3.14 allows peers to cause an integer overflow and heap corruption via a crafted length field. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://downloads.es.net/pub/iperf/esnet-secadv-2023-0001.txt.asc - https://github.com/esnet/iperf/commit/0ef151550d96cc4460f98832df84b4a1e87c65e9 - https://bugs.debian.org/1040830 - https://github.com/esnet/iperf/issues/1542 - https://cwe.mitre.org/data/definitions/130.html - https://lists.debian.org/debian-lts-announce/2023/07/m
f/issues/1542 - https://cwe.mitre.org/data/definitions/130.html - https://lists.debian.org/debian-lts-announce/2023/07/msg00025.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M25Z5FHTO3XWMGP37JHJ7IIIHSGCLKEV/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BV6EBWWF4PEQKROEVXGYSTIT2MGBTLU7/ - https://security.netapp.com/advisory/ntap-20230818-0016/ - https://support.apple.com/kb/HT213984 - https://support.apple.com/kb/HT213985 - http://seclists.org/fulldisclosure/2023/Oct/24 - http://seclists.org/fulldisclosure/2023/Oct/26
CVE ID: CVE-2023-38404 State: PUBLISHED Published: 2023-07-17T00:00:00 Last Updated: 2024-10-30T15:08:02.282Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:H/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: The XPRTLD web application in Veritas InfoScale Operations Manager (VIOM) before 8.0.0.410 allows an authenticated attacker to upload all types of files to the server. An authenticated attacker can then execute the malicious file to perform command execution on the remote server. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.veritas.com/content/support/en_US/security/VTS23-009
CVE ID: CVE-2023-38405 State: PUBLISHED Published: 2023-07-17T00:00:00 Last Updated: 2024-10-31T15:02:30.850Z Vendors: n/a Products: n/a Problem Types: n/a Description: On Crestron 3-Series Control Systems before 1.8001.0187, crafting and sending a specific BACnet packet can cause a crash. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.crestron.com/release_notes/cp3n_1.8001.0187_release_notes.pdf
CVE ID: CVE-2023-38406 State: PUBLISHED Published: 2023-11-06T00:00:00.000Z Last Updated: 2025-11-04T16:10:14.828Z Vendors: n/a Products: n/a Problem Types: n/a Description: bgpd/bgp_flowspec.c in FRRouting (FRR) before 8.4.3 mishandles an nlri length of zero, aka a "flowspec overflow." Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/FRRouting/frr/pull/12884 - https://github.com/FRRouting/frr/compare/frr-8.4.2...frr-8.4.3 - https://lists.debian.org/debian-lts-announce/2024/04/msg00019.html
CVE ID: CVE-2023-38407 State: PUBLISHED Published: 2023-11-06T00:00:00.000Z Last Updated: 2025-11-04T16:10:15.810Z Vendors: n/a Products: n/a Problem Types: n/a Description: bgpd/bgp_label.c in FRRouting (FRR) before 8.5 attempts to read beyond the end of the stream during labeled unicast parsing. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/FRRouting/frr/pull/12951 - https://github.com/FRRouting/frr/pull/12956 - https://github.com/FRRouting/frr/compare/frr-8.5-rc...frr-8.5 - https://lists.debian.org/debian-lts-announce/2024/04/msg00019.html
CVE ID: CVE-2023-38408 State: PUBLISHED Published: 2023-07-20T00:00:00 Last Updated: 2024-10-15T18:33:21.591Z Vendors: n/a Products: n/a Problem Types: n/a Description: The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution if an agent is forwarded to an attacker-controlled system. (Code in /usr/lib is not necessarily safe for loading into ssh-agent.) NOTE: this issue exists because of an incomplete fix for CVE-2016-10009. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://news.ycombinator.com/item?id=36790196 - https://blog.qualys.com/vulnerabilities-threat-resear
ent: References: - https://news.ycombinator.com/item?id=36790196 - https://blog.qualys.com/vulnerabilities-threat-research/2023/07/19/cve-2023-38408-remote-code-execution-in-opensshs-forwarded-ssh-agent - https://www.qualys.com/2023/07/19/cve-2023-38408/rce-openssh-forwarded-ssh-agent.txt - https://github.com/openbsd/src/commit/f8f5a6b003981bb824329dc987d101977beda7ca - https://github.com/openbsd/src/commit/7bc29a9d5cd697290aa056e94ecee6253d3425f8 - https://github.com/openbsd/src/commit/f03a4faa55c4ce0818324701dadbf91988d7351d - https://www.openssh.com/txt/release-9.3p2 - https://www.openssh.com/security.html - https://security.gentoo.org/glsa/202307-01 - http://www.openwall.com/lists/oss-se
ttps://www.openssh.com/security.html - https://security.gentoo.org/glsa/202307-01 - http://www.openwall.com/lists/oss-security/2023/07/20/1 - http://www.openwall.com/lists/oss-security/2023/07/20/2 - http://packetstormsecurity.com/files/173661/OpenSSH-Forwarded-SSH-Agent-Remote-Code-Execution.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RAXVQS6ZYTULFAK3TEJHRLKZALJS3AOU/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CEBTJJINE2I3FHAUKKNQWMFGYMLSMWKQ/ - https://security.netapp.com/advisory/ntap-20230803-0010/ - https://lists.debian.org/debian-lts-announce/2023/08/msg00021.html - http:
ity.netapp.com/advisory/ntap-20230803-0010/ - https://lists.debian.org/debian-lts-announce/2023/08/msg00021.html - http://www.openwall.com/lists/oss-security/2023/09/22/9 - http://www.openwall.com/lists/oss-security/2023/09/22/11 - https://support.apple.com/kb/HT213940 - https://www.vicarius.io/vsociety/posts/exploring-opensshs-agent-forwarding-rce-cve-2023-38408
CVE ID: CVE-2023-38409 State: PUBLISHED Published: 2023-07-17T00:00:00 Last Updated: 2024-10-30T14:58:56.847Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in set_con2fb_map in drivers/video/fbdev/core/fbcon.c in the Linux kernel before 6.2.12. Because an assignment occurs only for the first vc, the fbcon_registered_fb and fbcon_display arrays can be desynchronized in fbcon_mode_deleted (the con2fb_map points at the old fb_info). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=fffb0b52d5258554c645c966c6cbef7de50b851d - https://cdn.kernel.
org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=fffb0b52d5258554c645c966c6cbef7de50b851d - https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.2.12
CVE ID: CVE-2023-38410 State: PUBLISHED Published: 2023-07-26T23:55:10.127Z Last Updated: 2024-10-23T14:23:29.697Z Vendors: Apple Products: iOS and iPadOS, macOS Problem Types: A user may be able to elevate privileges Description: The issue was addressed with improved checks. This issue is fixed in iOS 16.6 and iPadOS 16.6, macOS Ventura 13.5. A user may be able to elevate privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.apple.com/en-us/HT213841 - https://support.apple.com/en-us/HT213843
CVE ID: CVE-2023-38411 State: PUBLISHED Published: 2023-11-14T19:05:02.227Z Last Updated: 2024-08-30T15:09:43.281Z Severity: LOW (CVSS 3.9 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L) Vendors: n/a Products: Intel Smart Campus android application Problem Types: escalation of privilege, CWE-284 Description: Improper access control in the Intel Smart Campus android application before version 9.4 may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00863.html