Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-46679 State: PUBLISHED Published: 2023-11-07T20:37:20.832Z Last Updated: 2024-09-12T19:11:10.443Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Projectworlds Pvt. Limited Products: Online Job Portal Problem Types: CWE-89 Description: Online Job Portal v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'txt_uname_email' parameter of the index.php resource does not validate the characters received and they are sent unfiltered to the database. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/netrebko - https://projectworlds.in
CVE ID: CVE-2023-46680 State: REJECTED Published: 2023-11-07T20:38:16.585Z Last Updated: 2024-01-02T18:44:40.295Z Description: No description available.
CVE ID: CVE-2023-46681 State: PUBLISHED Published: 2023-12-26T07:29:17.894Z Last Updated: 2024-08-02T20:53:20.829Z Vendors: BUFFALO INC. Products: VR-S1000 Problem Types: Improper neutralization of argument delimiters in a command ('Argument Injection') Description: Improper neutralization of argument delimiters in a command ('Argument Injection') vulnerability in VR-S1000 firmware Ver. 2.37 and earlier allows an authenticated attacker who can access to the product's command line interface to execute an arbitrary command. Additional Analyst Notes: - CVE Program Container: References: - https://www.buffalo.jp/news/detail/20231225-01.html - https://jvn.jp/en/jp/JVN23771490/
CVE ID: CVE-2023-46683 State: PUBLISHED Published: 2024-02-06T16:20:13.525Z Last Updated: 2025-11-04T18:18:47.927Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Tp-Link Products: ER7206 Omada Gigabit VPN Router Problem Types: CWE-78 Description: A post authentication command injection vulnerability exists when configuring the wireguard VPN functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322 Rel.70591. A specially crafted HTTP request can lead to arbitrary command injection . An attacker can make an authenticated HTTP request to trigger this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: Re
TP request to trigger this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1857
CVE ID: CVE-2023-46685 State: PUBLISHED Published: 2024-07-08T15:22:29.649Z Last Updated: 2025-11-04T17:12:48.778Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: LevelOne Products: WBR-6013 Problem Types: CWE-259 Description: A hard-coded password vulnerability exists in the telnetd functionality of LevelOne WBR-6013 RER4_A_v3411b_2T2R_LEV_09_170623. A set of specially crafted network packets can lead to arbitrary command execution. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1871
CVE ID: CVE-2023-46686 State: PUBLISHED Published: 2023-12-18T22:01:03.342Z Last Updated: 2024-10-01T15:59:10.520Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N) Vendors: Gallagher Products: Command Centre Diagnostics Service Problem Types: CWE-807 Description: A reliance on untrusted inputs in a security decision could be exploited by a privileged user to configure the Gallagher Command Centre Diagnostics Service to use less secure communication protocols. This issue affects: Gallagher Diagnostics Service prior to v1.3.0 (distributed in 9.00.1507(MR1)). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.gallag
MR1)). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.gallagher.com/Security-Advisories/CVE-2023-46686
CVE ID: CVE-2023-46687 State: PUBLISHED Published: 2024-02-09T03:49:28.352Z Last Updated: 2025-06-17T21:29:29.569Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Emerson Products: Rosemount GC370XA, Rosemount GC700XA, Rosemount GC1500XA Problem Types: CWE-77 Description: In Emerson Rosemount GC370XA, GC700XA, and GC1500XA products, an unauthenticated user with network access could execute arbitrary commands in root context from a remote computer. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-030-01 - https://www.emerson.com/documents/automation/security-not
tps://www.cisa.gov/news-events/ics-advisories/icsa-24-030-01 - https://www.emerson.com/documents/automation/security-notification-emerson-gas-chromatographs-cyber-security-notification-icsa-24-030-01-en-10103910.pdf
CVE ID: CVE-2023-46688 State: PUBLISHED Published: 2023-12-06T08:40:47.953Z Last Updated: 2024-08-02T20:53:20.878Z Vendors: Implem Inc. Products: Pleasanter Problem Types: Open Redirect Description: Open redirect vulnerability in Pleasanter 1.3.47.0 and earlier allows a remote unauthenticated attacker to redirect users to arbitrary web sites via a specially crafted URL. Additional Analyst Notes: - CVE Program Container: References: - https://pleasanter.org/archives/vulnerability-update-202311 - https://jvn.jp/en/jp/JVN96209256/
CVE ID: CVE-2023-46689 State: PUBLISHED Published: 2024-05-16T20:47:19.349Z Last Updated: 2024-08-02T20:53:20.959Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) Power Gadget software for macOS Problem Types: escalation of privilege, CWE-707 Description: Improper neutralization in Intel(R) Power Gadget software for macOS all versions may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01037.html
CVE ID: CVE-2023-46690 State: PUBLISHED Published: 2023-11-30T22:07:25.118Z Last Updated: 2024-08-02T20:53:20.838Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Delta Electronics Products: InfraSuite Device Master Problem Types: CWE-35 Description: In Delta Electronics InfraSuite Device Master v.1.0.7, a vulnerability exists that allows an attacker to write to any file to any location of the filesystem, which could lead to remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-331-01
CVE ID: CVE-2023-46691 State: PUBLISHED Published: 2024-05-16T20:47:21.139Z Last Updated: 2024-08-02T20:53:20.891Z Severity: HIGH (CVSS 7.9 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:H) Vendors: n/a Products: Intel(R) Power Gadget software for Windows Problem Types: escalation of privilege, CWE-416 Description: Use after free in Intel(R) Power Gadget software for Windows all versions may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01037.html
CVE ID: CVE-2023-46693 State: PUBLISHED Published: 2023-12-07T00:00:00 Last Updated: 2024-08-02T20:53:20.780Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability in FormaLMS before 4.0.5 allows attackers to run arbitrary code via title parameters. Additional Analyst Notes: - CVE Program Container: References: - https://www.formalms.org/download/342-forma-lms-4-0-5.html
CVE ID: CVE-2023-46694 State: PUBLISHED Published: 2024-05-28T19:21:18.374Z Last Updated: 2025-02-13T15:46:56.032Z Vendors: n/a Products: n/a Problem Types: n/a Description: Vtenext 21.02 allows an authenticated attacker to upload arbitrary files, potentially enabling them to execute remote commands. This flaw exists due to the application's failure to enforce proper authentication controls when accessing the Ckeditor file manager functionality. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/invisiblebyte/CVE-2023-46694
CVE ID: CVE-2023-46695 State: PUBLISHED Published: 2023-11-02T00:00:00 Last Updated: 2024-08-02T20:53:20.867Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Django 3.2 before 3.2.23, 4.1 before 4.1.13, and 4.2 before 4.2.7. The NFKC normalization is slow on Windows. As a consequence, django.contrib.auth.forms.UsernameField is subject to a potential DoS (denial of service) attack via certain inputs with a very large number of Unicode characters. Additional Analyst Notes: - CVE Program Container: References: - https://groups.google.com/forum/#%21forum/django-announce - https://docs.djangoproject.com/en/4.2/releases/security/ - https://www.djangoproject.co
orum/#%21forum/django-announce - https://docs.djangoproject.com/en/4.2/releases/security/ - https://www.djangoproject.com/weblog/2023/nov/01/security-releases/ - https://security.netapp.com/advisory/ntap-20231214-0001/
CVE ID: CVE-2023-46699 State: PUBLISHED Published: 2023-12-26T07:20:48.092Z Last Updated: 2024-09-12T12:36:17.923Z Vendors: WESEEK, Inc. Products: GROWI Problem Types: Cross-site request forgery (CSRF) Description: Cross-site request forgery (CSRF) vulnerability exists in the User settings (/me) page of GROWI versions prior to v6.0.0. If a user views a malicious page while logging in, settings may be changed without the user's intention. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://weseek.co.jp/ja/news/2023/11/21/growi-prevent-xss6/ - https://jvn.jp/en/jp/JVN18715935/
CVE ID: CVE-2023-46700 State: PUBLISHED Published: 2023-11-20T04:47:07.850Z Last Updated: 2024-08-29T13:44:41.371Z Vendors: LuxSoft Products: LuxCal Web Calendar Problem Types: SQL Injection Description: SQL injection vulnerability in LuxCal Web Calendar prior to 5.2.4M (MySQL version) and LuxCal Web Calendar prior to 5.2.4L (SQLite version) allows a remote unauthenticated attacker to execute an arbitrary SQL command by sending a crafted request, and obtain or alter information stored in the database. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.luxsoft.eu/ - https://www.luxsoft.eu/?download - https://www.luxsoft.eu/lcforum/viewtopic.p
t: References: - https://www.luxsoft.eu/ - https://www.luxsoft.eu/?download - https://www.luxsoft.eu/lcforum/viewtopic.php?id=476 - https://jvn.jp/en/jp/JVN15005948/
CVE ID: CVE-2023-46701 State: PUBLISHED Published: 2023-12-12T08:19:22.274Z Last Updated: 2024-08-02T20:53:20.920Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Mattermost Products: Mattermost Problem Types: CWE-200 Description: Mattermost fails to perform authorization checks in the /plugins/playbooks/api/v0/runs/add-to-timeline-dialog endpoint of the Playbooks plugin allowing an attacker to get limited information about a post if they know the post ID Additional Analyst Notes: - CVE Program Container: References: - https://mattermost.com/security-updates
CVE ID: CVE-2023-46705 State: PUBLISHED Published: 2023-11-20T11:46:21.070Z Last Updated: 2024-08-07T20:31:18.912Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: OpenHarmony Products: OpenHarmony Problem Types: CWE-843 Description: in OpenHarmony v3.2.2 and prior versions allow a local attacker causes system information leak through type confusion. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2023/2023-12.md
CVE ID: CVE-2023-46706 State: PUBLISHED Published: 2024-02-01T22:24:05.901Z Last Updated: 2024-08-22T14:28:18.363Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: MachineSense Products: FeverWarn Problem Types: CWE-798 Description: Multiple MachineSense devices have credentials unable to be changed by the user or administrator. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-025-01 - https://machinesense.com/pages/about-machinesense
CVE ID: CVE-2023-46708 State: PUBLISHED Published: 2024-03-04T06:19:03.484Z Last Updated: 2024-08-02T20:53:20.895Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L) Vendors: OpenHarmony Products: OpenHarmony Problem Types: CWE-416 Description: in OpenHarmony v3.2.4 and prior versions allow a local attacker arbitrary code execution in any apps through use after free. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2024/2024-03.md
CVE ID: CVE-2023-46711 State: PUBLISHED Published: 2023-12-26T07:29:49.181Z Last Updated: 2024-09-12T18:44:42.909Z Vendors: BUFFALO INC. Products: VR-S1000 Problem Types: Use of Hard-coded Cryptographic Key Description: VR-S1000 firmware Ver. 2.37 and earlier uses a hard-coded cryptographic key which may allow an attacker to analyze the password of a specific product user. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.buffalo.jp/news/detail/20231225-01.html - https://jvn.jp/en/jp/JVN23771490/
CVE ID: CVE-2023-46712 State: PUBLISHED Published: 2024-01-10T17:51:37.943Z Last Updated: 2025-06-03T14:27:40.042Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:U/RC:R) Vendors: Fortinet Products: FortiPortal Problem Types: CWE-284 Description: A improper access control in Fortinet FortiPortal version 7.0.0 through 7.0.6, Fortinet FortiPortal version 7.2.0 through 7.2.1 allows attacker to escalate its privilege via specifically crafted HTTP requests. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-23-395
CVE ID: CVE-2023-46713 State: PUBLISHED Published: 2023-12-13T06:41:18.704Z Last Updated: 2024-08-02T20:53:21.140Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:U/RL:X/RC:X) Vendors: Fortinet Products: FortiWeb Problem Types: CWE-117 Description: An improper output neutralization for logs in Fortinet FortiWeb 6.2.0 - 6.2.8, 6.3.0 - 6.3.23, 7.0.0 - 7.0.9, 7.2.0 - 7.2.5 and 7.4.0 may allow an attacker to forge traffic logs via a crafted URL of the web application. Additional Analyst Notes: - CVE Program Container: References: - https://fortiguard.com/psirt/FG-IR-23-256
CVE ID: CVE-2023-46714 State: PUBLISHED Published: 2024-05-14T16:19:13.614Z Last Updated: 2024-08-02T20:53:20.924Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:C) Vendors: Fortinet Products: FortiOS Problem Types: CWE-121 Description: A stack-based buffer overflow [CWE-121] vulnerability in Fortinet FortiOS version 7.2.1 through 7.2.6 and version 7.4.0 through 7.4.1 allows a privileged attacker over the administrative interface to execute arbitrary code or commands via crafted HTTP or HTTPs requests. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://fortiguard.com/psirt/FG-IR-23-415
CVE ID: CVE-2023-46715 State: PUBLISHED Published: 2025-01-14T14:08:52.045Z Last Updated: 2025-01-14T20:55:58.030Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N/E:P/RL:X/RC:C) Vendors: Fortinet Products: FortiProxy, FortiOS Problem Types: CWE-346 Description: An origin validation error [CWE-346] vulnerability in Fortinet FortiOS IPSec VPN version 7.4.0 through 7.4.1 and version 7.2.6 and below allows an authenticated IPSec VPN user with dynamic IP addressing to send (but not receive) packets spoofing the IP of another user via crafted network packets. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-23-407
CVE ID: CVE-2023-46716 State: REJECTED Published: N/A Last Updated: 2025-05-06T02:55:09.134Z Description: No description available.
CVE ID: CVE-2023-46717 State: PUBLISHED Published: 2024-03-12T15:09:19.790Z Last Updated: 2024-08-02T20:53:21.214Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: Fortinet Products: FortiOS Problem Types: CWE-287 Description: An improper authentication vulnerability [CWE-287] in FortiOS versions 7.4.1 and below, versions 7.2.6 and below, and versions 7.0.12 and below when configured with FortiAuthenticator in HA may allow a readonly user to gain read-write access via successive login attempts. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://fortiguard.com/psirt/FG-IR-23-424
CVE ID: CVE-2023-46718 State: PUBLISHED Published: 2025-10-14T15:23:02.581Z Last Updated: 2025-10-30T13:35:30.100Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:X) Vendors: Fortinet Products: FortiOS, FortiProxy Problem Types: CWE-121 Description: A stack-based buffer overflow in Fortinet FortiOS version 7.4.0 through 7.4.1 and 7.2.0 through 7.2.7 and 7.0.0 through 7.0.12 and 6.4.6 through 6.4.15 and 6.2.9 through 6.2.16 and 6.0.13 through 6.0.18 allows attacker to execute unauthorized code or commands via specially crafted CLI commands. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-23-354
CVE ID: CVE-2023-46719 State: REJECTED Published: N/A Last Updated: 2025-03-17T22:38:05.481Z Description: No description available.
CVE ID: CVE-2023-46720 State: PUBLISHED Published: 2024-06-11T14:32:00.582Z Last Updated: 2025-08-27T20:32:54.386Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:X) Vendors: Fortinet Products: FortiOS Problem Types: CWE-121 Description: A stack-based buffer overflow in Fortinet FortiOS version 7.4.0 through 7.4.1 and 7.2.0 through 7.2.7 and 7.0.0 through 7.0.12 and 6.4.6 through 6.4.15 and 6.2.9 through 6.2.16 and 6.0.13 through 6.0.18 allows attacker to execute unauthorized code or commands via specially crafted CLI commands. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://fortiguard.fortinet.com/psirt/FG
Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://fortiguard.fortinet.com/psirt/FG-IR-23-356
CVE ID: CVE-2023-46721 State: REJECTED Published: N/A Last Updated: 2025-03-17T22:38:05.034Z Description: No description available.
CVE ID: CVE-2023-46722 State: PUBLISHED Published: 2023-10-31T15:36:49.932Z Last Updated: 2024-09-05T18:54:28.906Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: pimcore Products: admin-ui-classic-bundle Problem Types: CWE-80, CWE-79 Description: The Pimcore Admin Classic Bundle provides a backend UI for Pimcore. Prior to version 1.2.0, a cross-site scripting vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other malicious sites. Users should upgrade to version 1.2.0 to receive a patch or, as a workaround, apply the patch manually. Additional Analyst N
s should upgrade to version 1.2.0 to receive a patch or, as a workaround, apply the patch manually. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/pimcore/admin-ui-classic-bundle/security/advisories/GHSA-jfxw-6c5v-c42f - https://github.com/pimcore/admin-ui-classic-bundle/commit/19fda2e86557c2ed4978316104de5ccdaa66d8b9 - https://github.com/pimcore/pimcore/commit/757375677dc83a44c6c22f26d97452cc5cda5d7c
CVE ID: CVE-2023-46723 State: PUBLISHED Published: 2023-10-31T15:34:44.646Z Last Updated: 2024-09-05T20:14:13.094Z Severity: HIGH (CVSS 8.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L) Vendors: paijp Products: lte-pic32-writer Problem Types: CWE-538 Description: lte-pic32-writer is a writer for PIC32 devices. In versions 0.0.1 and prior, those who use `sendto.txt` are vulnerable to attackers who known the IMEI reading the sendto.txt. The sendto.txt file can contain the SNS(such as slack and zulip) URL and API key. As of time of publication, a patch is not yet available. As workarounds, avoid using `sendto.txt` or use `.htaccess` to block access to `sendto.txt`. Additional Analyst Notes: - C
workarounds, avoid using `sendto.txt` or use `.htaccess` to block access to `sendto.txt`. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/paijp/lte-pic32-writer/security/advisories/GHSA-9qgg-ph2v-v4mh
CVE ID: CVE-2023-46724 State: PUBLISHED Published: 2023-11-01T19:09:34.513Z Last Updated: 2025-02-13T17:14:32.361Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) Vendors: squid-cache Products: squid Problem Types: CWE-125, CWE-129, CWE-786, CWE-823, CWE-1285 Description: Squid is a caching proxy for the Web. Due to an Improper Validation of Specified Index bug, Squid versions 3.3.0.1 through 5.9 and 6.0 prior to 6.4 compiled using `--with-openssl` are vulnerable to a Denial of Service attack against SSL Certificate validation. This problem allows a remote server to perform Denial of Service against Squid Proxy by initiating a TLS Handshake with a specially crafted SSL
emote server to perform Denial of Service against Squid Proxy by initiating a TLS Handshake with a specially crafted SSL Certificate in a server certificate chain. This attack is limited to HTTPS and SSL-Bump. This bug is fixed in Squid version 6.4. In addition, patches addressing this problem for the stable releases can be found in Squid's patch archives. Those who you use a prepackaged version of Squid should refer to the package vendor for availability information on updated packages. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/squid-cache/squid/security/advisories/GHSA-73m6-jm96-c6r3 - https://github.com/squid-cache/squid/c
- https://github.com/squid-cache/squid/security/advisories/GHSA-73m6-jm96-c6r3 - https://github.com/squid-cache/squid/commit/b70f864940225dfe69f9f653f948e787f99c3810 - http://www.squid-cache.org/Versions/v5/SQUID-2023_4.patch - http://www.squid-cache.org/Versions/v6/SQUID-2023_4.patch - https://security.netapp.com/advisory/ntap-20231208-0001/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MEV66D3PAAY6K7TWDT3WZBLCPLASFJDC/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A5QASTMCUSUEW3UOMKHZJB3FTONWSRXS/
CVE ID: CVE-2023-46725 State: PUBLISHED Published: 2023-11-02T14:19:42.920Z Last Updated: 2024-09-12T19:35:43.524Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: foodcoopshop Products: foodcoopshop Problem Types: CWE-918 Description: FoodCoopShop is open source software for food coops and local shops. Versions starting with 3.2.0 prior to 3.6.1 are vulnerable to server-side request forgery. In the Network module, a manufacturer account can use the `/api/updateProducts.json` endpoint to make the server send a request to an arbitrary host. This means that the server can be used as a proxy into the internal network where the server is. Furthermore, the checks on
s means that the server can be used as a proxy into the internal network where the server is. Furthermore, the checks on a valid image are not adequate, leading to a time of check time of use issue. For example, by using a custom server that returns 200 on HEAD requests, then return a valid image on first GET request and then a 302 redirect to final target on second GET request, the server will copy whatever file is at the redirect destination, making this a full SSRF. Version 3.6.1 fixes this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/foodcoopshop/foodcoopshop/security/advisories/GHSA-jhww-fx2j-3rf7 - https://g