Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
frame element. To change this behavior, configure the `config.iframe_attributes` option. Also starting from version 4.21.0, the Media Embed plugin regenerates the entire content of the embed widget by default. To change this behavior, configure the `config.embed_keepOriginalContent` option. Those who choose to enable either of the more permissive options or who cannot upgrade to a patched version should properly configure Content Security Policy to avoid any potential security issues that may arise from embedding iframe elements on their web page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ckeditor/ckeditor4/security/advisorie
- CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-vh5c-xwqv-cv9g - https://ckeditor.com/cke4/addon/embed - https://ckeditor.com/cke4/addon/iframe - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GWKG2VCPJNETVCDTXU4X6FQ2PO6XCNGN/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VCYKD3JZWWA3ESOZG4PHJJEXT4EYIUIQ/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L4ODGOW6PYVOXHQSMWJBOCE6DXWAI33W/
CVE ID: CVE-2023-28440 State: PUBLISHED Published: 2023-04-18T20:40:13.534Z Last Updated: 2025-02-06T16:29:37.700Z Severity: LOW (CVSS 2.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L) Vendors: discourse Products: discourse Problem Types: CWE-400 Description: Discourse is an open source platform for community discussion. In affected versions a maliciously crafted request from a Discourse administrator can lead to a long-running request and eventual timeout. This has the greatest potential impact in shared hosting environments where admins are untrusted. This issue has been addressed in versions 3.0.3 and 3.1.0.beta4. Users are advised to upgrade. There are no known workarounds for this vulne
addressed in versions 3.0.3 and 3.1.0.beta4. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/discourse/discourse/security/advisories/GHSA-vm65-pv5h-6g3w
CVE ID: CVE-2023-28441 State: PUBLISHED Published: 2023-03-23T23:02:47.281Z Last Updated: 2025-02-25T14:50:37.175Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H) Vendors: invernyx Products: smartcars-3-bugs Problem Types: CWE-532 Description: smartCARS 3 is flight tracking software. In version 0.5.8 and prior, all persons who have failed login attempts will have their password stored in error logs. This problem doesn't occur in version 0.5.9. As a workaround, delete the affected log file, and ensure one logs in correctly. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/invernyx/smartcars-3-bugs/security/adviso
E Program Container: - CISA ADP Vulnrichment: References: - https://github.com/invernyx/smartcars-3-bugs/security/advisories/GHSA-fp42-c8g2-5jc7
CVE ID: CVE-2023-28442 State: PUBLISHED Published: 2023-03-23T23:10:49.688Z Last Updated: 2025-02-25T14:50:29.574Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: GeoNode Products: geonode Problem Types: CWE-200 Description: GeoNode is an open source platform that facilitates the creation, sharing, and collaborative use of geospatial data. Prior to versions 2.20.6, 2.19.6, and 2.18.7, anonymous users can obtain sensitive information about GeoNode configurations from the response of the `/geoserver/rest/about/status` Geoserver REST API endpoint. The Geoserver endpoint is secured by default, but the configuration of Geoserver for GeoNode opens a list of REST end
t. The Geoserver endpoint is secured by default, but the configuration of Geoserver for GeoNode opens a list of REST endpoints to support some of its public-facing services. The vulnerability impacts both GeoNode 3 and GeoNode 4 instances. Geoserver security configuration is provided by `geoserver-geonode-ext`. A patch for 2.20.7 has been released which blocks access to the affected endpoint. The patch has been backported to branches 2.20.6, 2.19.7, 2.19.6, and 2.18.7. All the published artifacts and Docker images have been updated accordingly. A more advanced patch has been applied to the master and development versions, which require some changes to GeoNode code. They will be available wit
n applied to the master and development versions, which require some changes to GeoNode code. They will be available with the next 4.1.0 release. The patched configuration only has an effect on new deployments. For existing setups, the patch must be applied manually inside the Geoserver data directory. The patched file must replace the existing `<geoserver_datadir>/security/rest.properties` file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/GeoNode/geonode/security/advisories/GHSA-87mh-vw7c-5v6w - https://github.com/GeoNode/geoserver-geonode-ext/commit/f44cb074d8361c0f4e625013675bdd7bd8203df6 - https://github.com/GeoNode/geoserv
b.com/GeoNode/geoserver-geonode-ext/commit/f44cb074d8361c0f4e625013675bdd7bd8203df6 - https://github.com/GeoNode/geoserver-geonode-ext/blob/2.20.7/data/security/rest.properties
CVE ID: CVE-2023-28443 State: PUBLISHED Published: 2023-03-23T23:13:58.299Z Last Updated: 2025-02-21T15:30:10.767Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N) Vendors: directus Products: directus Problem Types: CWE-532, CWE-284 Description: Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 9.23.3, the `directus_refresh_token` is not redacted properly from the log outputs and can be used to impersonate users without their permission. This issue is patched in version 9.23.3. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/directus/directus/security/advisorie
- CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/directus/directus/security/advisories/GHSA-8vg2-wf3q-mwv7 - https://github.com/directus/directus/commit/349536303983ccba68ecb3e4fb35315424011afc - https://github.com/directus/directus/blob/7c479c5161639aac466c763b6b958a9524201d74/api/src/logger.ts#L13
CVE ID: CVE-2023-28444 State: PUBLISHED Published: 2023-03-24T19:58:59.998Z Last Updated: 2025-02-24T19:37:02.320Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L) Vendors: kyubisation Products: angular-server-side-configuration Problem Types: CWE-538, CWE-200 Description: angular-server-side-configuration helps configure an angular application at runtime on the server or in a docker container via environment variables. angular-server-side-configuration detects used environment variables in TypeScript (.ts) files during build time of an Angular CLI project. The detected environment variables are written to a ngssc.json file in the output directory. During deployment
project. The detected environment variables are written to a ngssc.json file in the output directory. During deployment of an Angular based app, the environment variables based on the variables from ngssc.json are inserted into the apps index.html (or defined index file). With version 15.0.0 the environment variable detection was widened to the entire project, relative to the angular.json file from the Angular CLI. In a monorepo setup, this could lead to environment variables intended for a backend/service to be detected and written to the ngssc.json, which would then be populated and exposed via index.html. This has NO IMPACT, in a plain Angular project that has no backend component. This
opulated and exposed via index.html. This has NO IMPACT, in a plain Angular project that has no backend component. This vulnerability has been mitigated in version 15.1.0, by adding an option `searchPattern` which restricts the detection file range by default. As a workaround, manually edit or create ngssc.json or run script after ngssc.json generation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/kyubisation/angular-server-side-configuration/security/advisories/GHSA-gwvm-vrp4-4pp5 - https://github.com/kyubisation/angular-server-side-configuration/commit/d701f51260637a84ede278e248934e0437a7ff86 - https://github.com/kyubisation/a
ion/angular-server-side-configuration/commit/d701f51260637a84ede278e248934e0437a7ff86 - https://github.com/kyubisation/angular-server-side-configuration/releases/tag/v15.1.0
CVE ID: CVE-2023-28445 State: PUBLISHED Published: 2023-03-23T23:23:27.931Z Last Updated: 2025-02-20T19:17:12.688Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: denoland Products: deno Problem Types: CWE-125, CWE-787 Description: Deno is a runtime for JavaScript and TypeScript that uses V8 and is built in Rust. Resizable ArrayBuffers passed to asynchronous functions that are shrunk during the asynchronous operation could result in an out-of-bound read/write. It is unlikely that this has been exploited in the wild, as the only version affected is Deno 1.32.0. Deno Deploy users are not affected. The problem has been resolved by disabling resizable ArrayBuff
ected is Deno 1.32.0. Deno Deploy users are not affected. The problem has been resolved by disabling resizable ArrayBuffers temporarily in Deno 1.32.1. Deno 1.32.2 will re-enable resizable ArrayBuffers with a proper fix. As a workaround, run with `--v8-flags=--no-harmony-rab-gsab` to disable resizable ArrayBuffers. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/denoland/deno/security/advisories/GHSA-c25x-cm9x-qqgx - https://github.com/denoland/deno/pull/18395 - https://github.com/denoland/deno/releases/tag/v1.32.1
CVE ID: CVE-2023-28446 State: PUBLISHED Published: 2023-03-24T19:46:28.641Z Last Updated: 2025-02-19T20:25:29.969Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: denoland Products: deno Problem Types: CWE-150 Description: Deno is a simple, modern and secure runtime for JavaScript and TypeScript that uses V8 and is built in Rust. Arbitrary program names without any ANSI filtering allows any malicious program to clear the first 2 lines of a `op_spawn_child` or `op_kill` prompt and replace it with any desired text. This works with any command on the respective platform, giving the program the full ability to choose what program they wanted to run. This problem c
n the respective platform, giving the program the full ability to choose what program they wanted to run. This problem can not be exploited on systems that do not attach an interactive prompt (for example headless servers). This issue has been patched in version 1.31.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/denoland/deno/security/advisories/GHSA-vq67-rp93-65qf - https://github.com/denoland/deno/blob/7d13d65468c37022f003bb680dfbddd07ea72173/runtime/js/40_process.js#L175 - https://github.com/denoland/deno/releases/tag/v1.31.2
CVE ID: CVE-2023-28447 State: PUBLISHED Published: 2023-03-28T20:07:39.103Z Last Updated: 2025-11-03T21:47:36.097Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: smarty-php Products: smarty Problem Types: CWE-79 Description: Smarty is a template engine for PHP. In affected versions smarty did not properly escape javascript code. An attacker could exploit this vulnerability to execute arbitrary JavaScript code in the context of the user's browser session. This may lead to unauthorized access to sensitive user data, manipulation of the web application's behavior, or unauthorized actions performed on behalf of the user. Users are advised to upgrade to either ver
lication's behavior, or unauthorized actions performed on behalf of the user. Users are advised to upgrade to either version 3.1.48 or to 4.3.1 to resolve this issue. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/smarty-php/smarty/security/advisories/GHSA-7j98-h7fp-4vwj - https://github.com/smarty-php/smarty/commit/685662466f653597428966d75a661073104d713d - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HSAUM3YHWHO4UCJXRGRLQGPJAO3MFOZZ/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JBB35GLYTL6JL6EOM6BOZ
/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JBB35GLYTL6JL6EOM6BOZNYP47JKNNHT/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P7O7SKTATM6GAP45S64QFXNLWIY5I7HP/
CVE ID: CVE-2023-28448 State: PUBLISHED Published: 2023-03-24T19:34:29.037Z Last Updated: 2025-02-19T20:26:23.804Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L) Vendors: firecracker-microvm Products: versionize Problem Types: CWE-125 Description: Versionize is a framework for version tolerant serializion/deserialization of Rust data structures, designed for usecases that need fast deserialization times and minimal size overhead. An issue was discovered in the ‘Versionize::deserialize’ implementation provided by the ‘versionize’ crate for ‘vmm_sys_utils::fam::FamStructWrapper', which can lead to out of bounds memory accesses. The impact started with version 0.1.1. T
utils::fam::FamStructWrapper', which can lead to out of bounds memory accesses. The impact started with version 0.1.1. The issue was corrected in version 0.1.10 by inserting a check that verifies, for any deserialized header, the lengths of compared flexible arrays are equal and aborting deserialization otherwise. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/firecracker-microvm/versionize/security/advisories/GHSA-8vxc-r5wp-vgvc - https://github.com/firecracker-microvm/versionize/pull/53 - https://github.com/firecracker-microvm/versionize/commit/a57a051ba006cfa3b41a0532f484df759e008d47
CVE ID: CVE-2023-28450 State: PUBLISHED Published: 2023-03-15T00:00:00.000Z Last Updated: 2025-11-03T21:47:37.596Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Dnsmasq before 2.90. The default maximum EDNS.0 UDP packet size was set to 4096 but should be 1232 because of DNS Flag Day 2020. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://thekelleys.org.uk/dnsmasq/doc.html - https://thekelleys.org.uk/gitweb/?p=dnsmasq.git%3Ba=commit%3Bh=eb92fb32b746f2104b0f370b5b295bb8dd4bd5e5 - https://thekelleys.org.uk/gitweb/?p=dnsmasq.git%3Ba=blob%3Bf=CHANGELOG - https://capec.mitre.org/data/definitions/495.html - http
hekelleys.org.uk/gitweb/?p=dnsmasq.git%3Ba=blob%3Bf=CHANGELOG - https://capec.mitre.org/data/definitions/495.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OU2ZT4ITSEOOR2CFBAHK4Z67KXJIEWQA/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6UQ6LKDTLSSD64TBIZ3XEKBM2SWC63VV/
CVE ID: CVE-2023-28451 State: PUBLISHED Published: 2024-09-18T00:00:00 Last Updated: 2024-09-18T18:29:11.073Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Technitium 11.0.2. There is a vulnerability (called BadDNS) in DNS resolving software, which triggers a resolver to ignore valid responses, thus causing DoS (denial of service) for normal resolution. The effects of an exploit would be widespread and highly impactful, because the attacker could just forge a response targeting the source port of a vulnerable resolver without the need to guess the correct TXID. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://technitium.com/dns/
to guess the correct TXID. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://technitium.com/dns/ - https://gist.github.com/idealeer/89947ca07836fd0f7e9761198ca9a0f3.
CVE ID: CVE-2023-28452 State: PUBLISHED Published: 2024-09-18T00:00:00.000Z Last Updated: 2025-03-19T20:44:07.451Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in CoreDNS through 1.10.1. There is a vulnerability in DNS resolving software, which triggers a resolver to ignore valid responses, thus causing denial of service for normal resolution. In an exploit, the attacker could just forge a response targeting the source port of a vulnerable resolver without the need to guess the correct TXID. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://coredns.io/ - https://gist.github.com/idealeer/e41c7fb3b661d4262d0b6f21e12168ba
CVE ID: CVE-2023-28455 State: PUBLISHED Published: 2024-09-18T00:00:00 Last Updated: 2024-09-18T18:01:19.543Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Technitium through 11.0.2. The forwarding mode enables attackers to create a query loop using Technitium resolvers, launching amplification attacks and causing potential DoS. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://technitium.com/dns/ - https://gist.github.com/idealeer/89947ca07836fd0f7e9761198ca9a0f3
CVE ID: CVE-2023-28456 State: PUBLISHED Published: 2024-09-18T00:00:00 Last Updated: 2024-09-18T17:59:03.960Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Technitium through 11.0.2. It enables attackers to launch amplification attacks (3 times more than other "golden model" software like BIND) and cause potential DoS. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://technitium.com/dns/ - https://gist.github.com/idealeer/89947ca07836fd0f7e9761198ca9a0f3
CVE ID: CVE-2023-28457 State: PUBLISHED Published: 2024-09-18T00:00:00 Last Updated: 2024-09-18T17:54:46.035Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Technitium through 11.0.3. It enables attackers to conduct a DNS cache poisoning attack and inject fake responses within 1 second, which is impactful. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://technitium.com/dns/ - https://gist.github.com/idealeer/89947ca07836fd0f7e9761198ca9a0f3
CVE ID: CVE-2023-28458 State: PUBLISHED Published: 2023-04-20T00:00:00.000Z Last Updated: 2025-02-05T16:16:19.399Z Vendors: n/a Products: n/a Problem Types: n/a Description: pretalx 2.3.1 before 2.3.2 allows path traversal in HTML export (a non-default feature). Organizers can trigger the overwriting (with the standard pretalx 404 page content) of an arbitrary file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://pretalx.com/p/news/security-release-232/ - https://github.com/pretalx/pretalx/commit/60722c43cf975f319e94102e6bff320723776890 - https://github.com/pretalx/pretalx/releases/tag/v2.3.2 - https://www.sonarsource.com/blog/pretalx-vulnera
320723776890 - https://github.com/pretalx/pretalx/releases/tag/v2.3.2 - https://www.sonarsource.com/blog/pretalx-vulnerabilities-how-to-get-accepted-at-every-conference/
CVE ID: CVE-2023-28459 State: PUBLISHED Published: 2023-04-20T00:00:00.000Z Last Updated: 2025-02-05T16:14:54.170Z Vendors: n/a Products: n/a Problem Types: n/a Description: pretalx 2.3.1 before 2.3.2 allows path traversal in HTML export (a non-default feature). Users were able to upload crafted HTML documents that trigger the reading of arbitrary files. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://pretalx.com/p/news/security-release-232/ - https://github.com/pretalx/pretalx/commit/60722c43cf975f319e94102e6bff320723776890 - https://github.com/pretalx/pretalx/releases/tag/v2.3.2 - https://www.sonarsource.com/blog/pretalx-vulnerabilities-how
- https://github.com/pretalx/pretalx/releases/tag/v2.3.2 - https://www.sonarsource.com/blog/pretalx-vulnerabilities-how-to-get-accepted-at-every-conference/
CVE ID: CVE-2023-28460 State: PUBLISHED Published: 2023-03-15T00:00:00.000Z Last Updated: 2025-02-27T14:18:37.236Z Vendors: n/a Products: n/a Problem Types: n/a Description: A command injection vulnerability was discovered in Array Networks APV products. A remote attacker can send a crafted packet after logging into the affected appliance as an administrator, resulting in arbitrary shell code execution. This is fixed in 8.6.1.262 or newer and 10.4.2.93 or newer. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.arraynetworks.net/prx/001/http/supportportal.arraynetworks.net/documentation/FieldNotice/Array_Networks_Security_Advisory_Comma
tworks.net/prx/001/http/supportportal.arraynetworks.net/documentation/FieldNotice/Array_Networks_Security_Advisory_Command_Injection_Vulnerabilities_APV_ID-133258.pdf
CVE ID: CVE-2023-28461 State: PUBLISHED Published: 2023-03-15T00:00:00.000Z Last Updated: 2025-10-21T23:15:23.174Z Vendors: n/a Products: n/a Problem Types: n/a Description: Array Networks Array AG Series and vxAG (9.4.0.481 and earlier) allow remote code execution. An attacker can browse the filesystem on the SSL VPN gateway using a flags attribute in an HTTP header without authentication. The product could then be exploited through a vulnerable URL. The 2023-03-09 vendor advisory stated "a new Array AG release with the fix will be available soon." Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.arraynetworks.net/prx/001/http/support
: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.arraynetworks.net/prx/001/http/supportportal.arraynetworks.net/documentation/FieldNotice/Array_Networks_Security_Advisory_for_Remote_Code_Execution_Vulnerability_AG.pdf
CVE ID: CVE-2023-28462 State: PUBLISHED Published: 2023-03-30T00:00:00.000Z Last Updated: 2025-02-18T19:00:42.236Z Vendors: n/a Products: n/a Problem Types: n/a Description: A JNDI rebind operation in the default ORB listener in Payara Server 4.1.2.191 (Enterprise), 5.20.0 and newer (Enterprise), and 5.2020.1 and newer (Community), when Java 1.8u181 and earlier is used, allows remote attackers to load malicious code on the server once a JNDI directory scan is performed. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://blog.payara.fish/vulnerability-affecting-server-environments-on-java-1.8-on-updates-lower-than-1.8u191
CVE ID: CVE-2023-28464 State: PUBLISHED Published: 2023-03-31T00:00:00 Last Updated: 2024-08-02T12:38:25.326Z Vendors: n/a Products: n/a Problem Types: n/a Description: hci_conn_cleanup in net/bluetooth/hci_conn.c in the Linux kernel through 6.2.9 has a use-after-free (observed in hci_conn_hash_flush) because of calls to hci_dev_put and hci_conn_put. There is a double free that may lead to privilege escalation. Additional Analyst Notes: - CVE Program Container: References: - https://lore.kernel.org/lkml/20230309074645.74309-1-wzhmmmmm%40gmail.com/ - https://www.openwall.com/lists/oss-security/2023/03/28/2 - https://www.openwall.com/lists/oss-security/2023/03/28/3 - https://security.netapp.co
/lists/oss-security/2023/03/28/2 - https://www.openwall.com/lists/oss-security/2023/03/28/3 - https://security.netapp.com/advisory/ntap-20230517-0004/
CVE ID: CVE-2023-28465 State: PUBLISHED Published: 2023-12-12T00:00:00.000Z Last Updated: 2025-05-27T14:31:25.217Z Vendors: n/a Products: n/a Problem Types: n/a Description: The package-decompression feature in HL7 (Health Level 7) FHIR Core Libraries before 5.6.106 allows attackers to copy arbitrary files to certain directories via directory traversal, if an allowed directory name is a substring of the directory name chosen by the attacker. NOTE: this issue exists because of an incomplete fix for CVE-2023-24057. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.smilecdr.com/our-blog/statement-on-cve-2023-24057-smile-digital-health - https: