Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-39156 State: PUBLISHED Published: 2023-07-26T13:54:55.468Z Last Updated: 2024-10-23T14:42:55.330Z Vendors: Jenkins Project Products: Jenkins Bazaar Plugin Description: A cross-site request forgery (CSRF) vulnerability in Jenkins Bazaar Plugin 1.22 and earlier allows attackers to delete previously created Bazaar SCM tags. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2023-07-26/#SECURITY-3095 - http://www.openwall.com/lists/oss-security/2023/07/26/2
CVE ID: CVE-2023-39157 State: PUBLISHED Published: 2023-12-31T10:04:01.077Z Last Updated: 2024-08-02T18:02:05.358Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: Crocoblock Products: JetElements For Elementor Problem Types: CWE-94 Description: Improper Control of Generation of Code ('Code Injection') vulnerability in Crocoblock JetElements For Elementor.This issue affects JetElements For Elementor: from n/a through 2.6.10. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/jet-elements/wordpress-jetelements-for-elementor-plugin-2-6-10-authenticated-remote-code-execution-rce-vulnerability?_s_id=cve
CVE ID: CVE-2023-39158 State: PUBLISHED Published: 2023-10-03T13:20:37.333Z Last Updated: 2024-09-20T13:13:19.012Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: theDotstore Products: Banner Management For WooCommerce Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in theDotstore Banner Management For WooCommerce plugin <= 2.4.2 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/banner-management-for-woocommerce/wordpress-banner-management-for-woocommerce-plugin-2-4-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-39159 State: PUBLISHED Published: 2023-10-03T12:39:47.588Z Last Updated: 2024-09-20T13:14:23.132Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: theDotstore Products: Fraud Prevention For Woocommerce Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in theDotstore Fraud Prevention For Woocommerce plugin <= 2.1.5 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/woo-blocker-lite-prevent-fake-orders-and-blacklist-fraud-customers/wordpress-fraud-prevention-for-woocommerce-plugin-2-1-4-cross-site-request-forgery-csrf
rs-and-blacklist-fraud-customers/wordpress-fraud-prevention-for-woocommerce-plugin-2-1-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-39161 State: PUBLISHED Published: 2024-06-04T07:14:51.890Z Last Updated: 2024-08-02T18:02:06.433Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: WP Discussion Board Products: Discussion Board Problem Types: CWE-80 Description: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in WP Discussion Board Discussion Board allows Content Spoofing, Cross-Site Scripting (XSS).This issue affects Discussion Board: from n/a through 2.4.8. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/wp-discussion-board/wordpress-discussion
Program Container: References: - https://patchstack.com/database/vulnerability/wp-discussion-board/wordpress-discussion-board-plugin-2-4-8-content-injection-vulnerability?_s_id=cve
CVE ID: CVE-2023-39162 State: PUBLISHED Published: 2023-09-04T09:46:44.189Z Last Updated: 2024-09-24T18:54:16.165Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: XLPlugins Products: User Email Verification for WooCommerce Problem Types: CWE-79 Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in XLPlugins User Email Verification for WooCommerce plugin <= 3.5.0 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/woo-confirmation-email/wordpress-user-email-verification-for-woocommerce-plugin-3-5-0-reflected-cross-site-scripting-xss-vulnerability?_
-email/wordpress-user-email-verification-for-woocommerce-plugin-3-5-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-39163 State: PUBLISHED Published: 2024-05-17T06:52:32.047Z Last Updated: 2024-08-02T18:02:06.866Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L) Vendors: Averta Products: Phlox Shop Problem Types: CWE-22 Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Averta Phlox Shop allows PHP Local File Inclusion.This issue affects Phlox Shop: from n/a through 2.0.0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/auxin-shop/wordpress-phlox-shop-plugin-2-0-0-unauthenticated-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2023-39164 State: PUBLISHED Published: 2023-09-04T09:30:53.026Z Last Updated: 2024-09-24T18:55:07.403Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Molongui Products: Author Box for Authors, Co-Authors, Multiple Authors and Guest Authors – Molongui Problem Types: CWE-79 Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Molongui Author Box for Authors, Co-Authors, Multiple Authors and Guest Authors – Molongui plugin <= 4.6.19 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/molongui-authorship/wordpress-molongui-plugin-4-6-18-
hment: References: - https://patchstack.com/database/vulnerability/molongui-authorship/wordpress-molongui-plugin-4-6-18-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-39165 State: PUBLISHED Published: 2023-10-03T11:09:06.622Z Last Updated: 2024-09-19T20:45:55.818Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: Fetch Designs Products: Sign-up Sheets Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Fetch Designs Sign-up Sheets plugin <= 2.2.8 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/sign-up-sheets/wordpress-sign-up-sheets-plugin-2-2-8-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-39166 State: PUBLISHED Published: 2023-11-13T16:58:54.003Z Last Updated: 2024-08-02T18:02:05.310Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: tagDiv Products: tagDiv Composer Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in tagDiv tagDiv Composer allows Cross-Site Scripting (XSS).This issue affects tagDiv Composer: from n/a before 4.4. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/td-composer/wordpress-tagdiv-composer-plugin-4-1-csrf-to-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-39167 State: PUBLISHED Published: 2023-12-07T14:05:01.746Z Last Updated: 2025-11-04T19:17:34.708Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: SENEC Products: Storage Box V1, Storage Box V2, Storage Box V3 Problem Types: CWE-862 Description: In SENEC Storage Box V1,V2 and V3 an unauthenticated remote attacker can obtain the devices' logfiles that contain sensitive data. Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/fulldisclosure/2023/Nov/5
CVE ID: CVE-2023-39168 State: REJECTED Published: N/A Last Updated: 2023-12-07T14:07:49.504Z Description: No description available.
CVE ID: CVE-2023-39169 State: PUBLISHED Published: 2023-12-07T14:14:43.336Z Last Updated: 2025-11-04T19:17:37.357Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: SENEC Products: Storage Box V1, Storage Box V2, Storage Box V3 Problem Types: CWE-798 Description: The affected devices use publicly available default credentials with administrative privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://seclists.org/fulldisclosure/2023/Nov/3
CVE ID: CVE-2023-39170 State: REJECTED Published: 2023-12-07T14:20:08.383Z Last Updated: 2025-02-13T15:46:48.150Z Description: No description available.
CVE ID: CVE-2023-39171 State: PUBLISHED Published: 2023-12-07T14:23:57.124Z Last Updated: 2025-11-04T19:17:39.942Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: SENEC Products: Storage Box V1, Storage Box V2, Storage Box V3 Problem Types: CWE-668 Description: SENEC Storage Box V1,V2 and V3 accidentially expose a management UI accessible with publicly known admin credentials. Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/fulldisclosure/2023/Nov/2
CVE ID: CVE-2023-39172 State: PUBLISHED Published: 2023-12-07T13:58:56.198Z Last Updated: 2025-11-04T19:17:41.037Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: SENEC Products: Storage Box V1, Storage Box V2, Storage Box V3 Problem Types: CWE-319 Description: The affected devices transmit sensitive information unencrypted allowing a remote unauthenticated attacker to capture and modify network traffic. Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/fulldisclosure/2023/Nov/4
CVE ID: CVE-2023-39173 State: PUBLISHED Published: 2023-07-25T14:45:43.929Z Last Updated: 2024-10-15T19:01:46.931Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: JetBrains Products: TeamCity Problem Types: CWE-266 Description: In JetBrains TeamCity before 2023.05.2 a token with limited permissions could be used to gain full account access Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2023-39174 State: PUBLISHED Published: 2023-07-25T14:45:44.602Z Last Updated: 2024-10-15T18:58:32.017Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: JetBrains Products: TeamCity Problem Types: CWE-1333 Description: In JetBrains TeamCity before 2023.05.2 a ReDoS attack was possible via integration with issue trackers Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2023-39175 State: PUBLISHED Published: 2023-07-25T14:45:45.187Z Last Updated: 2024-10-15T18:51:27.536Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: JetBrains Products: TeamCity Problem Types: CWE-79 Description: In JetBrains TeamCity before 2023.05.2 reflected XSS via GitHub integration was possible Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2023-39176 State: PUBLISHED Published: 2024-11-18T09:50:46.409Z Last Updated: 2024-11-18T15:10:46.492Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N) Vendors: Red Hat Products: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 Problem Types: CWE-125 Description: A flaw was found within the parsing of SMB2 requests that have a transform header in the kernel ksmbd module. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this to disclose sensitive information on affected installation
the end of an allocated buffer. An attacker can leverage this to disclose sensitive information on affected installations of Linux. Only systems with ksmbd enabled are vulnerable to this CVE. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2023-39176 - https://bugzilla.redhat.com/show_bug.cgi?id=2326503 - https://www.zerodayinitiative.com/advisories/ZDI-24-586/
CVE ID: CVE-2023-39177 State: REJECTED Published: N/A Last Updated: 2025-10-29T11:51:57.669Z Description: No description available.
CVE ID: CVE-2023-39178 State: REJECTED Published: N/A Last Updated: 2025-10-29T11:51:42.603Z Description: No description available.
CVE ID: CVE-2023-39179 State: PUBLISHED Published: 2024-11-18T09:51:09.580Z Last Updated: 2024-11-18T15:08:52.852Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:L) Vendors: Red Hat Products: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 Problem Types: CWE-125 Description: A flaw was found within the handling of SMB2 read requests in the kernel ksmbd module. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this to disclose sensitive information on affected installations of Linux. Only systems
uffer. An attacker can leverage this to disclose sensitive information on affected installations of Linux. Only systems with ksmbd enabled are vulnerable to this CVE. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2023-39179 - https://bugzilla.redhat.com/show_bug.cgi?id=2326529 - https://www.zerodayinitiative.com/advisories/ZDI-24-586/
CVE ID: CVE-2023-39180 State: PUBLISHED Published: 2024-11-18T09:53:20.134Z Last Updated: 2024-11-18T15:05:29.429Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L) Vendors: Red Hat Products: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 Problem Types: CWE-400 Description: A flaw was found within the handling of SMB2_READ commands in the kernel ksmbd module. The issue results from not releasing memory after its effective lifetime. An attacker can leverage this to create a denial-of-service condition on affected installations of Linux. Authentication is not required to exploit this vulnerability, but only sy
condition on affected installations of Linux. Authentication is not required to exploit this vulnerability, but only systems with ksmbd enabled are vulnerable. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2023-39180 - https://bugzilla.redhat.com/show_bug.cgi?id=2326531 - https://www.zerodayinitiative.com/advisories/ZDI-24-589/
CVE ID: CVE-2023-39181 State: PUBLISHED Published: 2023-08-08T09:20:49.513Z Last Updated: 2024-10-11T13:15:12.813Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: Solid Edge SE2023 Problem Types: CWE-787 Description: A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 7). The affected application contains an out of bounds write past the end of an allocated buffer while parsing a specially crafted PAR file. This could allow an attacker to execute code in the context of the current process. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-port
ent process. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-811403.pdf
CVE ID: CVE-2023-39182 State: PUBLISHED Published: 2023-08-08T09:20:50.603Z Last Updated: 2024-10-11T13:13:17.812Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: Solid Edge SE2023 Problem Types: CWE-125 Description: A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 7). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted DFT files. This could allow an attacker to execute code in the context of the current process. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-por
rent process. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-811403.pdf
CVE ID: CVE-2023-39183 State: PUBLISHED Published: 2023-08-08T09:20:51.735Z Last Updated: 2024-10-11T13:10:01.475Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: Solid Edge SE2023 Problem Types: CWE-125 Description: A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 7). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted PSM files. This could allow an attacker to execute code in the context of the current process. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-por
CVE ID: CVE-2023-39184 State: PUBLISHED Published: 2023-08-08T09:20:52.900Z Last Updated: 2024-10-11T13:09:23.272Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: Solid Edge SE2023 Problem Types: CWE-125 Description: A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 7). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted PSM files. This could allow an attacker to execute code in the context of the current process. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-por
CVE ID: CVE-2023-39185 State: PUBLISHED Published: 2023-08-08T09:20:54.033Z Last Updated: 2024-10-11T13:08:35.860Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: Solid Edge SE2023 Problem Types: CWE-125 Description: A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 7). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted PAR files. This could allow an attacker to execute code in the context of the current process. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-por
CVE ID: CVE-2023-39186 State: PUBLISHED Published: 2023-08-08T09:20:55.154Z Last Updated: 2024-10-10T20:35:54.562Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: Solid Edge SE2023 Problem Types: CWE-125 Description: A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 7). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted DFT files. This could allow an attacker to execute code in the context of the current process. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-por
CVE ID: CVE-2023-39187 State: PUBLISHED Published: 2023-08-08T09:20:56.224Z Last Updated: 2024-10-10T17:51:59.575Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: Solid Edge SE2023 Problem Types: CWE-125 Description: A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 7). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted DFT files. This could allow an attacker to execute code in the context of the current process. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-por
CVE ID: CVE-2023-39188 State: PUBLISHED Published: 2023-08-08T09:20:57.321Z Last Updated: 2024-10-11T13:08:03.661Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: Solid Edge SE2023 Problem Types: CWE-125 Description: A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 7). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted DFT files. This could allow an attacker to execute code in the context of the current process. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-por
CVE ID: CVE-2023-39189 State: PUBLISHED Published: 2023-10-09T17:57:44.776Z Last Updated: 2025-11-06T19:47:40.196Z Severity: MEDIUM (CVSS 5.1 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:L) Vendors: Red Hat Products: Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 Problem Types: CWE-125 Description: A flaw was found in the Netfilter subsystem in the Linux kernel. The nfnl_osf_add_callback function did not validate the user mode controlled opt_num field. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, leading to a crash or information disclosure. Additional Analyst Notes: - CVE Program
to trigger an out-of-bounds read, leading to a crash or information disclosure. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2024:2394 - https://access.redhat.com/errata/RHSA-2024:2950 - https://access.redhat.com/errata/RHSA-2024:3138 - https://access.redhat.com/security/cve/CVE-2023-39189 - https://bugzilla.redhat.com/show_bug.cgi?id=2226777
CVE ID: CVE-2023-39190 State: REJECTED Published: N/A Last Updated: 2023-07-28T13:33:14.205Z Description: No description available.
CVE ID: CVE-2023-39191 State: PUBLISHED Published: 2023-10-04T18:03:02.966Z Last Updated: 2025-11-06T21:01:40.060Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.2 Extended Update Support, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8 Problem Types: CWE-20 Description: An improper input validation flaw was found in the eBPF subsystem in the Linux kernel. The issue occurs due to a lack of proper validation of dynamic pointers within user-supplied eBPF programs prior to executing them. This may allow an attacker with CAP_BPF privileges to escalate privi
ser-supplied eBPF programs prior to executing them. This may allow an attacker with CAP_BPF privileges to escalate privileges and execute arbitrary code in the context of the kernel. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2023:6583 - https://access.redhat.com/errata/RHSA-2024:0381 - https://access.redhat.com/errata/RHSA-2024:0439 - https://access.redhat.com/errata/RHSA-2024:0448 - https://access.redhat.com/security/cve/CVE-2023-39191 - https://bugzilla.redhat.com/show_bug.cgi?id=2226783 - https://www.zerodayinitiative.com/advisories/ZDI-CAN-19399/
CVE ID: CVE-2023-39192 State: PUBLISHED Published: 2023-10-09T17:57:48.959Z Last Updated: 2025-11-08T07:10:41.834Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L) Vendors: Red Hat Products: Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 9 Problem Types: CWE-125 Description: A flaw was found in the Netfilter subsystem in the Linux kernel. The xt_u32 module did not validate the fields in the xt_u32 structure. This flaw allows a local privileged attacker to trigger an out-of-bounds read by setting the size fields with a value beyond the array boundaries, leading to a crash or information disclosure. Additiona