Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-49909 State: PUBLISHED Published: 2024-04-09T14:12:46.395Z Last Updated: 2025-11-04T18:19:56.105Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Tp-Link Products: AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3), N300 Wireless Access Point (EAP115) Problem Types: CWE-121 Description: A stack-based buffer overflow vulnerability exists in the web interface Radio Scheduling functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) v5.1.0 Build 20220926. A specially crafted series of HTTP requests can lead to remote code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.Thi
can lead to remote code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.This vulnerability refers specifically to the overflow that occurs via the `action` parameter at offset `0x0045ab38` of the `httpd_portal` binary shipped with v5.1.0 Build 20220926 of the EAP225. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1888
CVE ID: CVE-2023-49910 State: PUBLISHED Published: 2024-04-09T14:12:46.510Z Last Updated: 2025-11-04T18:19:57.314Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Tp-Link Products: AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3), N300 Wireless Access Point (EAP115) Problem Types: CWE-121 Description: A stack-based buffer overflow vulnerability exists in the web interface Radio Scheduling functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) v5.1.0 Build 20220926. A specially crafted series of HTTP requests can lead to remote code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.Thi
can lead to remote code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.This vulnerability refers specifically to the overflow that occurs via the `ssid` parameter at offset `0x42247c` of the `httpd` binary shipped with v5.0.4 Build 20220216 of the EAP115. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1888
CVE ID: CVE-2023-49911 State: PUBLISHED Published: 2024-04-09T14:12:46.602Z Last Updated: 2025-11-04T18:19:58.551Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Tp-Link Products: AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3), N300 Wireless Access Point (EAP115) Problem Types: CWE-121 Description: A stack-based buffer overflow vulnerability exists in the web interface Radio Scheduling functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) v5.1.0 Build 20220926. A specially crafted series of HTTP requests can lead to remote code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.Thi
can lead to remote code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.This vulnerability refers specifically to the overflow that occurs via the `band` parameter at offset `0x422420` of the `httpd` binary shipped with v5.0.4 Build 20220216 of the EAP115. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1888
CVE ID: CVE-2023-49912 State: PUBLISHED Published: 2024-04-09T14:12:46.695Z Last Updated: 2025-11-04T18:19:59.784Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Tp-Link Products: AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3), N300 Wireless Access Point (EAP115) Problem Types: CWE-121 Description: A stack-based buffer overflow vulnerability exists in the web interface Radio Scheduling functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) v5.1.0 Build 20220926. A specially crafted series of HTTP requests can lead to remote code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.Thi
can lead to remote code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.This vulnerability refers specifically to the overflow that occurs via the `profile` parameter at offset `0x4224b0` of the `httpd` binary shipped with v5.0.4 Build 20220216 of the EAP115. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1888
CVE ID: CVE-2023-49913 State: PUBLISHED Published: 2024-04-09T14:12:46.790Z Last Updated: 2025-11-04T18:20:01.068Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Tp-Link Products: AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3), N300 Wireless Access Point (EAP115) Problem Types: CWE-121 Description: A stack-based buffer overflow vulnerability exists in the web interface Radio Scheduling functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) v5.1.0 Build 20220926. A specially crafted series of HTTP requests can lead to remote code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.Thi
can lead to remote code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.This vulnerability refers specifically to the overflow that occurs via the `action` parameter at offset `0x422448` of the `httpd` binary shipped with v5.0.4 Build 20220216 of the EAP115. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1888
CVE ID: CVE-2023-49914 State: PUBLISHED Published: 2023-12-02T00:00:00 Last Updated: 2024-08-02T22:09:49.454Z Vendors: n/a Products: n/a Problem Types: n/a Description: InteraXon Muse 2 devices allow remote attackers to cause a denial of service (incorrect Muse App report of an outstanding, calm meditation state) via a 480 MHz RF carrier that is modulated by a "false" brain wave, aka a Brain-Hack attack. For example, the Muse App does not display the reception of a strong RF carrier, and alert the user that a report may be misleading if this carrier has been modulated by a low-frequency signal. Additional Analyst Notes: - CVE Program Container: References: - https://dl.acm.org/doi/10.1145/36
low-frequency signal. Additional Analyst Notes: - CVE Program Container: References: - https://dl.acm.org/doi/10.1145/3605758.3623497 - https://scholar.google.com/citations?view_op=view_citation&hl=en&user=8hu27apy8A4C&citation_for_view=8hu27apy8A4C:Se3iqnhoufwC
CVE ID: CVE-2023-49920 State: PUBLISHED Published: 2023-12-21T09:27:09.651Z Last Updated: 2025-02-13T17:18:58.218Z Vendors: Apache Software Foundation Products: Apache Airflow Problem Types: CWE-352 Description: Apache Airflow, version 2.7.0 through 2.7.3, has a vulnerability that allows an attacker to trigger a DAG in a GET request without CSRF validation. As a result, it was possible for a malicious website opened in the same browser - by the user who also had Airflow UI opened - to trigger the execution of DAGs without the user's consent. Users are advised to upgrade to version 2.8.0 or later which is not affected Additional Analyst Notes: - CVE Program Container: References: - https://gi
version 2.8.0 or later which is not affected Additional Analyst Notes: - CVE Program Container: References: - https://github.com/apache/airflow/pull/36026 - https://lists.apache.org/thread/mnwd2vcfw3gms6ft6kl951vfbqrxsnjq - http://www.openwall.com/lists/oss-security/2023/12/21/3
CVE ID: CVE-2023-49921 State: PUBLISHED Published: 2024-07-26T05:10:33.913Z Last Updated: 2024-08-02T22:09:49.139Z Severity: MEDIUM (CVSS 5.2 CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N) Vendors: Elastic Products: Elasticsearch Problem Types: CWE-532 Description: An issue was discovered by Elastic whereby Watcher search input logged the search query results on DEBUG log level. This could lead to raw contents of documents stored in Elasticsearch to be printed in logs. Elastic has released 8.11.2 and 7.17.16 that resolves this issue by removing this excessive logging. This issue only affects users that use Watcher and have a Watch defined that uses the search input and additionally have set t
ssue only affects users that use Watcher and have a Watch defined that uses the search input and additionally have set the search input’s logger to DEBUG or finer, for example using: org.elasticsearch.xpack.watcher.input.search, org.elasticsearch.xpack.watcher.input, org.elasticsearch.xpack.watcher, or wider, since the loggers are hierarchical. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://discuss.elastic.co/t/elasticsearch-8-11-2-7-17-16-security-update-esa-2023-29/349179
CVE ID: CVE-2023-49922 State: PUBLISHED Published: 2023-12-12T18:23:20.438Z Last Updated: 2024-12-02T14:30:39.538Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: Elastic Products: Beats Problem Types: CWE-532 Description: An issue was discovered by Elastic whereby Beats and Elastic Agent would log a raw event in its own logs at the WARN or ERROR level if ingesting that event to Elasticsearch failed with any 4xx HTTP status code except 409 or 429. Depending on the nature of the event that Beats or Elastic Agent attempted to ingest, this could lead to the insertion of sensitive or private information in the Beats or Elastic Agent logs. Elastic has released 8.
ld lead to the insertion of sensitive or private information in the Beats or Elastic Agent logs. Elastic has released 8.11.3 and 7.17.16 that prevents this issue by limiting these types of logs to DEBUG level logging, which is disabled by default. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://discuss.elastic.co/t/beats-and-elastic-agent-8-11-3-7-17-16-security-update-esa-2023-30/349180
CVE ID: CVE-2023-49923 State: PUBLISHED Published: 2023-12-12T17:53:42.091Z Last Updated: 2025-05-24T10:23:40.732Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: Elastic Products: Enterprise Search Problem Types: CWE-532 Description: An issue was discovered by Elastic whereby the Documents API of App Search logged the raw contents of indexed documents at INFO log level. Depending on the contents of such documents, this could lead to the insertion of sensitive or private information in the App Search logs. Elastic has released 8.11.2 and 7.17.16 that resolves this issue by changing the log level at which these are logged to DEBUG, which is disabled by defaul
17.16 that resolves this issue by changing the log level at which these are logged to DEBUG, which is disabled by default. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://discuss.elastic.co/t/enterprise-search-8-11-2-7-17-16-security-update-esa-2023-31/349181 - https://www.elastic.co/community/security
CVE ID: CVE-2023-49926 State: PUBLISHED Published: 2023-12-03T00:00:00 Last Updated: 2024-08-02T22:09:49.384Z Vendors: n/a Products: n/a Problem Types: n/a Description: app/Lib/Tools/EventTimelineTool.php in MISP before 2.4.179 allows XSS in the event timeline widget. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/MISP/MISP/commit/dc73287ee2000476e3a5800ded402825ca10f7e8 - https://github.com/MISP/MISP/compare/v2.4.178...v2.4.179
CVE ID: CVE-2023-49927 State: PUBLISHED Published: 2024-06-05T00:00:00 Last Updated: 2024-08-02T22:09:49.582Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AC:L/AV:N/A:N/C:L/I:N/PR:N/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, Exynos 990, Exynos 850, Exynos 1080, Exynos 2100, Exynos 2200, Exynos 1280, Exynos 1380, Exynos 1330, Exynos 9110, Exynos W920, Exynos Modem 5123, Exynos Modem 5300. The baseband software does not properly check format types specified by the RRC. This can lead to a lack of encryption. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: R
RC. This can lead to a lack of encryption. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://semiconductor.samsung.com/support/quality-support/product-security-updates/
CVE ID: CVE-2023-49928 State: PUBLISHED Published: 2024-06-05T00:00:00.000Z Last Updated: 2025-03-13T14:48:47.130Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, Exynos 990, Exynos 850, Exynos 1080, Exynos 2100, Exynos 2200, Exynos 1280, Exynos 1380, Exynos 1330, Exynos 9110, Exynos W920, Exynos Modem 5123, Exynos Modem 5300. The baseband software does not properly check states specified by the RRC. This can lead to disclosure of sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://semiconductor.samsung.com/support/qual
st Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://semiconductor.samsung.com/support/quality-support/product-security-updates/
CVE ID: CVE-2023-49930 State: PUBLISHED Published: 2024-02-28T00:00:00.000Z Last Updated: 2025-03-28T18:40:08.763Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Couchbase Server before 7.2.4. cURL calls to /diag/eval are not sufficiently restricted. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://forums.couchbase.com/tags/security - https://docs.couchbase.com/server/current/release-notes/relnotes.html - https://www.couchbase.com/alerts/
CVE ID: CVE-2023-49931 State: PUBLISHED Published: 2024-02-28T00:00:00 Last Updated: 2024-08-13T19:55:54.792Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Couchbase Server before 7.2.4. SQL++ cURL calls to /diag/eval are not sufficiently restricted. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://forums.couchbase.com/tags/security - https://docs.couchbase.com/server/current/release-notes/relnotes.html - https://www.couchbase.com/alerts/
CVE ID: CVE-2023-49932 State: PUBLISHED Published: 2024-02-28T00:00:00 Last Updated: 2024-11-07T18:41:23.230Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Couchbase Server before 7.2.4. An attacker can bypass SQL++ N1QL cURL host restrictions. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://forums.couchbase.com/tags/security - https://docs.couchbase.com/server/current/release-notes/relnotes.html - https://www.couchbase.com/alerts/
CVE ID: CVE-2023-49933 State: PUBLISHED Published: 2023-12-14T00:00:00.000Z Last Updated: 2025-11-04T18:20:04.049Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in SchedMD Slurm 22.05.x, 23.02.x, and 23.11.x. There is Improper Enforcement of Message Integrity During Transmission in a Communication Channel. This allows attackers to modify RPC traffic in a way that bypasses message hash checks. The fixed versions are 22.05.11, 23.02.7, and 23.11.1. Additional Analyst Notes: - CVE Program Container: References: - https://www.schedmd.com/security-archive.php - https://lists.schedmd.com/pipermail/slurm-announce/2023/000103.html - https://lists.fedoraproject.or
urity-archive.php - https://lists.schedmd.com/pipermail/slurm-announce/2023/000103.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/63FEDDYEE2WK7FHWBHKON3OZVQI56WSQ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AYQS3LFGC4HE4WCW4L3NAA2I6FRIWMNO/
CVE ID: CVE-2023-49934 State: PUBLISHED Published: 2023-12-14T00:00:00.000Z Last Updated: 2025-11-04T18:20:06.437Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in SchedMD Slurm 23.11.x. There is SQL Injection against the SlurmDBD database. The fixed version is 23.11.1. Additional Analyst Notes: - CVE Program Container: References: - https://www.schedmd.com/security-archive.php - https://lists.schedmd.com/pipermail/slurm-announce/2023/000103.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/63FEDDYEE2WK7FHWBHKON3OZVQI56WSQ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedora
essage/63FEDDYEE2WK7FHWBHKON3OZVQI56WSQ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AYQS3LFGC4HE4WCW4L3NAA2I6FRIWMNO/
CVE ID: CVE-2023-49935 State: PUBLISHED Published: 2023-12-14T00:00:00.000Z Last Updated: 2025-11-04T18:20:08.930Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in SchedMD Slurm 23.02.x and 23.11.x. There is Incorrect Access Control because of a slurmd Message Integrity Bypass. An attacker can reuse root-level authentication tokens during interaction with the slurmd process. This bypasses the RPC message hashes that protect against undesired MUNGE credential reuse. The fixed versions are 23.02.7 and 23.11.1. Additional Analyst Notes: - CVE Program Container: References: - https://www.schedmd.com/security-archive.php - https://lists.schedmd.com/pipermail/s
VE Program Container: References: - https://www.schedmd.com/security-archive.php - https://lists.schedmd.com/pipermail/slurm-announce/2023/000103.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/63FEDDYEE2WK7FHWBHKON3OZVQI56WSQ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AYQS3LFGC4HE4WCW4L3NAA2I6FRIWMNO/
CVE ID: CVE-2023-49936 State: PUBLISHED Published: 2023-12-14T00:00:00.000Z Last Updated: 2025-11-04T18:20:11.470Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in SchedMD Slurm 22.05.x, 23.02.x, and 23.11.x. A NULL pointer dereference leads to denial of service. The fixed versions are 22.05.11, 23.02.7, and 23.11.1. Additional Analyst Notes: - CVE Program Container: References: - https://www.schedmd.com/security-archive.php - https://lists.schedmd.com/pipermail/slurm-announce/2023/000103.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/63FEDDYEE2WK7FHWBHKON3OZVQI56WSQ/ - https://lists.fedoraproject.o
ist/package-announce%40lists.fedoraproject.org/message/63FEDDYEE2WK7FHWBHKON3OZVQI56WSQ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AYQS3LFGC4HE4WCW4L3NAA2I6FRIWMNO/
CVE ID: CVE-2023-49937 State: PUBLISHED Published: 2023-12-14T00:00:00.000Z Last Updated: 2025-11-04T18:20:14.076Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in SchedMD Slurm 22.05.x, 23.02.x, and 23.11.x. Because of a double free, attackers can cause a denial of service or possibly execute arbitrary code. The fixed versions are 22.05.11, 23.02.7, and 23.11.1. Additional Analyst Notes: - CVE Program Container: References: - https://www.schedmd.com/security-archive.php - https://lists.schedmd.com/pipermail/slurm-announce/2023/000103.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/63FEDDYEE2WK7FHWBH
ml - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/63FEDDYEE2WK7FHWBHKON3OZVQI56WSQ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AYQS3LFGC4HE4WCW4L3NAA2I6FRIWMNO/
CVE ID: CVE-2023-49938 State: PUBLISHED Published: 2023-12-14T00:00:00.000Z Last Updated: 2025-11-04T18:20:16.498Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in SchedMD Slurm 22.05.x and 23.02.x. There is Incorrect Access Control: an attacker can modified their extended group list that is used with the sbcast subsystem, and open files with an unauthorized set of extended groups. The fixed versions are 22.05.11 and 23.02.7. Additional Analyst Notes: - CVE Program Container: References: - https://www.schedmd.com/security-archive.php - https://lists.schedmd.com/pipermail/slurm-announce/2023/000103.html - https://lists.fedoraproject.org/archives/list/packa
ttps://lists.schedmd.com/pipermail/slurm-announce/2023/000103.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/63FEDDYEE2WK7FHWBHKON3OZVQI56WSQ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AYQS3LFGC4HE4WCW4L3NAA2I6FRIWMNO/
CVE ID: CVE-2023-49943 State: PUBLISHED Published: 2024-01-18T00:00:00.000Z Last Updated: 2025-06-02T15:04:50.359Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine ServiceDesk Plus MSP before 14504 allows stored XSS (by a low-privileged technician) via a task's name in a time sheet. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://manageengine.com - https://www.manageengine.com/products/service-desk-msp/CVE-2023-49943.html
CVE ID: CVE-2023-49944 State: PUBLISHED Published: 2023-12-25T00:00:00 Last Updated: 2024-08-02T22:09:49.439Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Challenge Response feature of BeyondTrust Privilege Management for Windows (PMfW) before 2023-07-14 allows local administrators to bypass this feature by decrypting the shared key, or by locating the decrypted shared key in process memory. The threat is mitigated by the Agent Protection feature. Additional Analyst Notes: - CVE Program Container: References: - https://www.beyondtrust.com/security - https://www.beyondtrust.com/trust-center/security-advisories/bt23-08
CVE ID: CVE-2023-49946 State: PUBLISHED Published: 2023-12-03T00:00:00 Last Updated: 2024-08-02T22:09:49.457Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Forgejo before 1.20.5-1, certain endpoints do not check whether an object belongs to a repository for which permissions are being checked. This allows remote attackers to read private issues, read private pull requests, delete issues, and perform other unauthorized actions. Additional Analyst Notes: - CVE Program Container: References: - https://forgejo.org/2023-11-release-v1-20-5-1/ - https://codeberg.org/forgejo/forgejo/src/branch/forgejo/RELEASE-NOTES.md - https://about.gitea.com/security - https://github.com/gogs/gogs/
g/forgejo/forgejo/src/branch/forgejo/RELEASE-NOTES.md - https://about.gitea.com/security - https://github.com/gogs/gogs/security
CVE ID: CVE-2023-49947 State: PUBLISHED Published: 2023-12-03T00:00:00 Last Updated: 2024-08-02T22:09:49.222Z Vendors: n/a Products: n/a Problem Types: n/a Description: Forgejo before 1.20.5-1 allows 2FA bypass when docker login uses Basic Authentication. Additional Analyst Notes: - CVE Program Container: References: - https://forgejo.org/2023-11-release-v1-20-5-1/ - https://codeberg.org/forgejo/forgejo/commit/44df78edd40076b349d50dc5fb02af417a44cfab
CVE ID: CVE-2023-49948 State: PUBLISHED Published: 2023-12-03T00:00:00 Last Updated: 2024-08-02T22:09:49.130Z Vendors: n/a Products: n/a Problem Types: n/a Description: Forgejo before 1.20.5-1 allows remote attackers to test for the existence of private user accounts by appending .rss (or another extension) to a URL. Additional Analyst Notes: - CVE Program Container: References: - https://forgejo.org/2023-11-release-v1-20-5-1/ - https://codeberg.org/forgejo/forgejo/src/branch/forgejo/RELEASE-NOTES.md - https://codeberg.org/forgejo/forgejo/commit/d7408d8b0b04afd2a3c8e23cc908e7bd3849f34d
CVE ID: CVE-2023-49949 State: PUBLISHED Published: 2023-12-26T00:00:00 Last Updated: 2024-08-02T22:09:49.616Z Vendors: n/a Products: n/a Problem Types: n/a Description: Passwork before 6.2.0 allows remote authenticated users to bypass 2FA by sending all one million of the possible 6-digit codes. Additional Analyst Notes: - CVE Program Container: References: - https://passwork.ru/ - https://acribia.ru/articles/2fa_bypass_passwork